test: Update tests to run against boundary-enterprise (#834)

* chore: Update make testacc to use boundary dev

Use boundary dev instead of test controller in order to get an enterprise cluster

* test: Update tests to use boundary dev cluster

- Set up environment variables via loadTestConfig
- Update testConfigWithRecovery to use recovery key from config
- Update testCOnfigWithoutAMPWCredentials to use boundary dev's auth method

* test: Update tests to use their own orgs

This is to address some test failures due to conflicts when creating resources within the same org.

* test: Enable tests that require boundary-enterprise

* chore: Update workflow to use boundary enterprise

.boundary-version

@@ -0,0 +1 @@
+1.0.1+ent

.github/workflows/test.yml

@@ -12,6 +12,7 @@ permissions:
 jobs:
   test:
     runs-on: ubuntu-latest
+    if: github.event.pull_request.head.repo.fork != 'true'
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Determine go version
@@ -40,6 +41,47 @@ jobs:
           key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
           restore-keys: |
             ${{ runner.os }}-go
+      - name: Determine boundary version
+        id: get-boundary-version
+        run: |
+          echo "Testing with boundary-enterprise $(cat .boundary-version)"
+          echo "boundary-version=$(cat .boundary-version)" >> "$GITHUB_OUTPUT"
+      - name: Download boundary-enterprise
+        run: |
+          VERSION="${{ steps.get-boundary-version.outputs.boundary-version }}"
+
+          release=$(curl -s "https://api.releases.hashicorp.com/v1/releases/boundary/${VERSION}?license_class=enterprise")
+          binary_url=$(echo "$release" | jq -r '.builds[] | select(.os == "linux" and .arch == "amd64") | .url')
+          shasums_url=$(echo "$release" | jq -r '.url_shasums')
+          shasums_sig_url=$(echo "$release" | jq -r '.url_shasums_signatures[0]')
+
+          # Download boundary, checksums, and checksum signature
+          echo "::group::Download files"
+          wget -q --server-response "$binary_url"
+          wget -q --server-response -O boundary_SHA256SUMS "$shasums_url"
+          wget -q --server-response -O boundary_SHA256SUMS.sig "$shasums_sig_url"
+          echo "::endgroup::"
+
+          # Verify signature against HashiCorp's public key
+          echo "::group::Verify signature"
+          export GNUPGHOME=./.gnupg
+          mkdir -p "$GNUPGHOME" && chmod 700 "$GNUPGHOME"
+          curl -s https://www.hashicorp.com/.well-known/pgp-key.txt | gpg --import
+          gpg --verify boundary_SHA256SUMS.sig boundary_SHA256SUMS
+          grep "boundary_${VERSION}_linux_amd64.zip" boundary_SHA256SUMS | shasum --algorithm 256 --check
+          echo "::endgroup::"
+
+          echo "::group::Extract boundary executable"
+          mkdir -p "$HOME/bin"
+          unzip "boundary_${VERSION}_linux_amd64.zip" -d "$HOME/bin"
+          echo "$HOME/bin" >> "${GITHUB_PATH}"
+          echo "::endgroup::"
+      - name: Verify boundary version
+        run: |
+          boundary version
       - name: Acceptance Tests
+        env:
+          BOUNDARY_ADDR: http://localhost:9200
+          BOUNDARY_LICENSE: ${{ secrets.BOUNDARY_LICENSE }}
         run: |
           make testacc

Makefile

@@ -30,7 +30,7 @@ test:
 
 # Run acceptance tests
 testacc:
-	TF_ACC=1 go test ./... -v $(TESTARGS) -timeout 120m
+	./test.sh
 
 dev:
 	GOOS=${GOOS} GOARCH=${GOARCH} ./scripts/plugins.sh

go.mod

@@ -17,6 +17,7 @@ require (
 	github.com/hashicorp/terraform-plugin-docs v0.25.0
 	github.com/hashicorp/terraform-plugin-sdk/v2 v2.40.1
 	github.com/jimlambrt/gldap v0.1.14
+	github.com/kelseyhightower/envconfig v1.4.0
 	github.com/kr/pretty v0.3.1
 	github.com/mitchellh/go-homedir v1.1.0
 	github.com/stretchr/testify v1.11.1

go.sum

@@ -360,6 +360,8 @@ github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkr
 github.com/jinzhu/now v1.0.1/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
 github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ=
 github.com/jinzhu/now v1.1.5/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
+github.com/kelseyhightower/envconfig v1.4.0 h1:Im6hONhd3pLkfDFsbRgu68RDNkGF1r3dvMUtDTo2cv8=
+github.com/kelseyhightower/envconfig v1.4.0/go.mod h1:cccZRl6mQpaq41TPp5QxidR+Sa3axMbJDNb//FQX6Gg=
 github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=
 github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=

internal/provider/data_source_account_test.go

@@ -8,10 +8,12 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/cap/oidc"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/stretchr/testify/require"
 )
 
 var accountPasswordRead = `
@@ -36,16 +38,17 @@ data "boundary_account" "acc_oidc" {
 }`
 
 func TestAccAccountReadPassword(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
 		Steps: []resource.TestStep{
 			{
-				Config: testConfig(url, fooOrg, fooAccountPassword, accountPasswordRead),
+				Config: testConfig(url, fooOrg(suffix), fooAccountPassword, accountPasswordRead),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAccountResourceExists(provider, "boundary_account_password.foo"),
 					resource.TestCheckResourceAttrSet("data.boundary_account.acc_password", IDKey),
@@ -54,7 +57,7 @@ func TestAccAccountReadPassword(t *testing.T) {
 					resource.TestCheckResourceAttr("data.boundary_account.acc_password", DescriptionKey, fooAccountPasswordDesc),
 					resource.TestCheckResourceAttr("data.boundary_account.acc_password", TypeKey, "password"),
 					resource.TestCheckResourceAttrSet("data.boundary_account.acc_password", "scope.0.id"),
-					resource.TestCheckResourceAttr("data.boundary_account.acc_password", "scope.0.name", "org1"),
+					resource.TestMatchResourceAttr("data.boundary_account.acc_password", "scope.0.name", regexache.MustCompile(`^org1-`)),
 					resource.TestCheckResourceAttr("data.boundary_account.acc_password", "scope.0.type", "org"),
 				),
 			},
@@ -63,16 +66,17 @@ func TestAccAccountReadPassword(t *testing.T) {
 }
 
 func TestAccAccountReadLdap(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
 		Steps: []resource.TestStep{
 			{
-				Config: testConfig(url, fooOrg, testAccountLdap, accountLdapRead),
+				Config: testConfig(url, fooOrg(suffix), testAccountLdap, accountLdapRead),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAccountResourceExists(provider, "boundary_account_ldap.foo"),
 					resource.TestCheckResourceAttrSet("data.boundary_account.acc_ldap", IDKey),
@@ -81,7 +85,7 @@ func TestAccAccountReadLdap(t *testing.T) {
 					resource.TestCheckResourceAttr("data.boundary_account.acc_ldap", DescriptionKey, testAccountLdapDesc),
 					resource.TestCheckResourceAttr("data.boundary_account.acc_ldap", TypeKey, "ldap"),
 					resource.TestCheckResourceAttrSet("data.boundary_account.acc_ldap", "scope.0.id"),
-					resource.TestCheckResourceAttr("data.boundary_account.acc_ldap", "scope.0.name", "org1"),
+					resource.TestMatchResourceAttr("data.boundary_account.acc_ldap", "scope.0.name", regexache.MustCompile(`^org1-`)),
 					resource.TestCheckResourceAttr("data.boundary_account.acc_ldap", "scope.0.type", "org"),
 				),
 			},
@@ -91,9 +95,10 @@ func TestAccAccountReadLdap(t *testing.T) {
 
 func TestAccAccountReadOidc(t *testing.T) {
 	tp := oidc.StartTestProvider(t)
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	tpCert := strings.TrimSpace(tp.CACert())
@@ -103,7 +108,7 @@ func TestAccAccountReadOidc(t *testing.T) {
 		ProviderFactories: providerFactories(&provider),
 		Steps: []resource.TestStep{
 			{
-				Config: testConfig(url, fooOrg, createConfig, accountOidcRead),
+				Config: testConfig(url, fooOrg(suffix), createConfig, accountOidcRead),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAccountResourceExists(provider, "boundary_account_oidc.foo"),
 					resource.TestCheckResourceAttrSet("data.boundary_account.acc_oidc", IDKey),
@@ -112,7 +117,7 @@ func TestAccAccountReadOidc(t *testing.T) {
 					resource.TestCheckResourceAttr("data.boundary_account.acc_oidc", DescriptionKey, fooAccountOidcDesc),
 					resource.TestCheckResourceAttr("data.boundary_account.acc_oidc", TypeKey, "oidc"),
 					resource.TestCheckResourceAttrSet("data.boundary_account.acc_oidc", "scope.0.id"),
-					resource.TestCheckResourceAttr("data.boundary_account.acc_oidc", "scope.0.name", "org1"),
+					resource.TestMatchResourceAttr("data.boundary_account.acc_oidc", "scope.0.name", regexache.MustCompile(`^org1-`)),
 					resource.TestCheckResourceAttr("data.boundary_account.acc_oidc", "scope.0.type", "org"),
 				),
 			},

internal/provider/data_source_auth_method_test.go

@@ -7,16 +7,20 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/YakDriver/regexache"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/stretchr/testify/require"
 )
 
 const (
 	testAuthMethodName = "test_auth_method"
 )
 
-var authMethodReadGlobal = fmt.Sprintf(`
+func authMethodReadGlobal(suffix string) string {
+	name := testAuthMethodName + "-" + suffix
+	return fmt.Sprintf(`
 resource "boundary_auth_method" "auth_method" {
 	name 		= "%s"
 	description = "test"
@@ -28,7 +32,8 @@ resource "boundary_auth_method" "auth_method" {
 data "boundary_auth_method" "auth_method" {
 	depends_on = [ boundary_auth_method.auth_method ]
 	name 	   = "%s"
-}`, testAuthMethodName, testAuthMethodName)
+}`, name, name)
+}
 
 var authMethodReadOrg = fmt.Sprintf(`
 resource "boundary_auth_method" "auth_method" {
@@ -46,20 +51,21 @@ data "boundary_auth_method" "auth_method" {
 }`, testAuthMethodName, testAuthMethodName)
 
 func TestAccAuthMethodReadGlobal(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
 		Steps: []resource.TestStep{
 			{
-				Config: testConfig(url, fooOrg, authMethodReadGlobal),
+				Config: testConfig(url, fooOrg(suffix), authMethodReadGlobal(suffix)),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttrSet("data.boundary_auth_method.auth_method", IDKey),
 					resource.TestCheckResourceAttrSet("data.boundary_auth_method.auth_method", ScopeIdKey),
-					resource.TestCheckResourceAttr("data.boundary_auth_method.auth_method", NameKey, testAuthMethodName),
+					resource.TestMatchResourceAttr("data.boundary_auth_method.auth_method", NameKey, regexache.MustCompile(`^`+testAuthMethodName)),
 					resource.TestCheckResourceAttr("data.boundary_auth_method.auth_method", TypeKey, "password"),
 					resource.TestCheckResourceAttrSet("data.boundary_auth_method.auth_method", DescriptionKey),
 					resource.TestCheckResourceAttrSet("data.boundary_auth_method.auth_method", "scope.0.id"),
@@ -72,16 +78,17 @@ func TestAccAuthMethodReadGlobal(t *testing.T) {
 }
 
 func TestAccAuthMethodReadOrg(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
 		Steps: []resource.TestStep{
 			{
-				Config: testConfig(url, fooOrg, authMethodReadOrg),
+				Config: testConfig(url, fooOrg(suffix), authMethodReadOrg),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttrSet("data.boundary_auth_method.auth_method", IDKey),
 					resource.TestCheckResourceAttrSet("data.boundary_auth_method.auth_method", ScopeIdKey),
@@ -89,7 +96,7 @@ func TestAccAuthMethodReadOrg(t *testing.T) {
 					resource.TestCheckResourceAttr("data.boundary_auth_method.auth_method", TypeKey, "password"),
 					resource.TestCheckResourceAttrSet("data.boundary_auth_method.auth_method", DescriptionKey),
 					resource.TestCheckResourceAttrSet("data.boundary_auth_method.auth_method", "scope.0.id"),
-					resource.TestCheckResourceAttr("data.boundary_auth_method.auth_method", "scope.0.name", "org1"),
+					resource.TestMatchResourceAttr("data.boundary_auth_method.auth_method", "scope.0.name", regexache.MustCompile(`^org1-`)),
 					resource.TestCheckResourceAttr("data.boundary_auth_method.auth_method", "scope.0.type", "org"),
 				),
 			},

internal/provider/data_source_group_test.go

@@ -7,17 +7,20 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/YakDriver/regexache"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/stretchr/testify/require"
 )
 
 const (
 	testGroupName = "test_group"
 )
 
-var groupReadGlobal = fmt.Sprintf(`
+func groupReadGlobal(suffix string) string {
-
+	name := testGroupName + "-" + suffix
+	return fmt.Sprintf(`
 resource "boundary_user" "user" {
 	description = "user"
 	scope_id    = "global"
@@ -35,7 +38,8 @@ resource "boundary_group" "group" {
 data "boundary_group" "group" {
 	depends_on = [ boundary_group.group ]
 	name = "%s"
-}`, testGroupName, testGroupName)
+}`, name, name)
+}
 
 var groupReadOrg = fmt.Sprintf(`
 resource "boundary_user" "user" {
@@ -59,21 +63,22 @@ data "boundary_group" "group" {
 }`, testGroupName, testGroupName)
 
 func TestAccGroupReadGlobal(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
 		Steps: []resource.TestStep{
 			{
-				Config: testConfig(url, fooOrg, groupReadGlobal),
+				Config: testConfig(url, fooOrg(suffix), groupReadGlobal(suffix)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGroupResourceExists(provider, "boundary_group.group"),
 					resource.TestCheckResourceAttrSet("data.boundary_group.group", IDKey),
 					resource.TestCheckResourceAttrSet("data.boundary_group.group", ScopeIdKey),
-					resource.TestCheckResourceAttr("data.boundary_group.group", NameKey, testGroupName),
+					resource.TestMatchResourceAttr("data.boundary_group.group", NameKey, regexache.MustCompile(`^`+testGroupName)),
 					resource.TestCheckResourceAttrSet("data.boundary_group.group", DescriptionKey),
 					resource.TestCheckResourceAttrSet("data.boundary_group.group", fmt.Sprintf("%s.#", GroupMemberIdsKey)),
 					resource.TestCheckResourceAttrSet("data.boundary_group.group", "scope.0.id"),
@@ -86,16 +91,17 @@ func TestAccGroupReadGlobal(t *testing.T) {
 }
 
 func TestAccGroupReadOrg(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
 		Steps: []resource.TestStep{
 			{
-				Config: testConfig(url, fooOrg, groupReadOrg),
+				Config: testConfig(url, fooOrg(suffix), groupReadOrg),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGroupResourceExists(provider, "boundary_group.group"),
 					resource.TestCheckResourceAttrSet("data.boundary_group.group", IDKey),
@@ -104,7 +110,7 @@ func TestAccGroupReadOrg(t *testing.T) {
 					resource.TestCheckResourceAttrSet("data.boundary_group.group", DescriptionKey),
 					resource.TestCheckResourceAttrSet("data.boundary_group.group", fmt.Sprintf("%s.#", GroupMemberIdsKey)),
 					resource.TestCheckResourceAttrSet("data.boundary_group.group", "scope.0.id"),
-					resource.TestCheckResourceAttr("data.boundary_group.group", "scope.0.name", "org1"),
+					resource.TestMatchResourceAttr("data.boundary_group.group", "scope.0.name", regexache.MustCompile(`^org1-`)),
 					resource.TestCheckResourceAttr("data.boundary_group.group", "scope.0.type", "org"),
 				),
 			},

internal/provider/data_source_role_test.go

@@ -7,19 +7,23 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/YakDriver/regexache"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/stretchr/testify/require"
 )
 
 const (
 	testRoleName = "my_role"
 )
 
-var roleReadGlobal = fmt.Sprintf(`
+func roleReadGlobal(suffix string) string {
+	name := testRoleName + "-" + suffix
+	return fmt.Sprintf(`
 resource "boundary_user" "user" {
-  name     = "my_user"
+  name     = "my_user-%s"
-  scope_id    = "global"
+  scope_id = "global"
 }
 
 resource "boundary_role" "role" {
@@ -36,7 +40,8 @@ data "boundary_role" "role" {
   depends_on = [ boundary_role.role ]
   name       = "%s"
 }
-`, testRoleName, testRoleName)
+`, suffix, name, name)
+}
 
 var roleReadOrg = fmt.Sprintf(`
 resource "boundary_user" "user" {
@@ -62,9 +67,10 @@ data "boundary_role" "role" {
 `, testRoleName, testRoleName)
 
 func TestAccRoleReadGlobal(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	dataSourceName := "data.boundary_role.role"
 
@@ -73,11 +79,11 @@ func TestAccRoleReadGlobal(t *testing.T) {
 		ProviderFactories: providerFactories(&provider),
 		Steps: []resource.TestStep{
 			{
-				Config: testConfig(url, roleReadGlobal),
+				Config: testConfig(url, roleReadGlobal(suffix)),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttrSet(dataSourceName, IDKey),
 					resource.TestCheckResourceAttrSet(dataSourceName, ScopeIdKey),
-					resource.TestCheckResourceAttr(dataSourceName, NameKey, testRoleName),
+					resource.TestMatchResourceAttr(dataSourceName, NameKey, regexache.MustCompile(`^`+testRoleName)),
 					resource.TestCheckResourceAttrSet(dataSourceName, DescriptionKey),
 					resource.TestCheckResourceAttr(dataSourceName, fmt.Sprintf("%s.#", roleGrantStringsKey), "1"),
 					resource.TestCheckResourceAttr(dataSourceName, fmt.Sprintf("%s.0", roleGrantStringsKey), "ids=*;type=*;actions=read"),
@@ -94,9 +100,10 @@ func TestAccRoleReadGlobal(t *testing.T) {
 }
 
 func TestAccRoleReadOrg(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	dataSourceName := "data.boundary_role.role"
 
@@ -105,7 +112,7 @@ func TestAccRoleReadOrg(t *testing.T) {
 		ProviderFactories: providerFactories(&provider),
 		Steps: []resource.TestStep{
 			{
-				Config: testConfig(url, fooOrg, roleReadOrg),
+				Config: testConfig(url, fooOrg(suffix), roleReadOrg),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttrSet(dataSourceName, IDKey),
 					resource.TestCheckResourceAttrSet(dataSourceName, ScopeIdKey),
@@ -115,7 +122,7 @@ func TestAccRoleReadOrg(t *testing.T) {
 					resource.TestCheckResourceAttr(dataSourceName, fmt.Sprintf("%s.0", roleGrantStringsKey), "ids=*;type=*;actions=read"),
 					resource.TestCheckResourceAttr(dataSourceName, fmt.Sprintf("%s.#", roleGrantScopeIdsKey), "1"),
 					resource.TestCheckResourceAttrSet(dataSourceName, "scope.0.id"),
-					resource.TestCheckResourceAttr(dataSourceName, "scope.0.name", "org1"),
+					resource.TestMatchResourceAttr(dataSourceName, "scope.0.name", regexache.MustCompile(`^org1-`)),
 					resource.TestCheckResourceAttr(dataSourceName, "scope.0.type", "org"),
 					resource.TestCheckResourceAttr(dataSourceName, fmt.Sprintf("%s.#", rolePrincipalIdsKey), "1"),
 					resource.TestCheckResourceAttrPair(dataSourceName, fmt.Sprintf("%s.0", rolePrincipalIdsKey), "boundary_user.user", "id"),

internal/provider/data_source_scope_test.go

@@ -7,62 +7,68 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/stretchr/testify/require"
 )
 
 const (
-	orgName        = "test org scope"
+	scopeDesc = "created to test the scope datasource"
-	projectName    = "test project scope"
-	notProjectName = "test project scope with wrong name"
-	scopeDesc      = "created to test the scope datasource"
 )
 
-var scopeCreateAndRead = fmt.Sprintf(`
+func scopeCreateAndRead(suffix string) string {
+	orgName := "test org scope " + suffix
+	projectName := "test project scope " + suffix
+	return fmt.Sprintf(`
 resource "boundary_scope" "global" {
 	global_scope = true
-	name = "global"
+	name         = "global"
-	description = "Global Scope"
+	description  = "Global Scope"
-	scope_id = "global"
+	scope_id     = "global"
 }
 
 resource "boundary_scope" "org" {
-	scope_id = boundary_scope.global.id
+	scope_id    = boundary_scope.global.id
-	name = "%s"
+	name        = "%s"
 	description = "%s"
 }
 
 resource "boundary_scope" "project" {
-	depends_on = [boundary_role.org_admin]
+	depends_on  = [boundary_role.org_admin]
-	scope_id = boundary_scope.org.id
+	scope_id    = boundary_scope.org.id
-	name = "%s"
+	name        = "%s"
 	description = "%s"
 }
 
 resource "boundary_role" "org_admin" {
-	scope_id = "global"
+	scope_id        = "global"
 	grant_scope_ids = [boundary_scope.org.id]
-	grant_strings = ["ids=*;type=*;actions=*"]
+	grant_strings   = ["ids=*;type=*;actions=*"]
-	principal_ids = ["u_auth"]
+	principal_ids   = ["u_auth"]
 }
 
 data "boundary_scope" "org" {
 	depends_on = [boundary_scope.org]
-	scope_id = "global"
+	scope_id   = "global"
-	name = "%s"
+	name       = "%s"
 }
 
 data "boundary_scope" "project" {
 	depends_on = [boundary_scope.project]
-	scope_id = data.boundary_scope.org.id
+	scope_id   = data.boundary_scope.org.id
-	name = "%s"
+	name       = "%s"
 }`, orgName, scopeDesc, projectName, scopeDesc, orgName, projectName)
+}
 
 func TestAccScopeRead(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
+
+	orgName := "test org scope " + suffix
+	projectName := "test project scope " + suffix
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
@@ -71,7 +77,7 @@ func TestAccScopeRead(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// create and read
-				Config: testConfig(url, scopeCreateAndRead),
+				Config: testConfig(url, scopeCreateAndRead(suffix)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckScopeResourceExists(provider, "boundary_scope.org"),
 					resource.TestCheckResourceAttr("boundary_scope.org", "description", scopeDesc),

internal/provider/data_source_user_test.go

@@ -8,9 +8,10 @@ import (
 	"testing"
 
 	"github.com/YakDriver/regexache"
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/stretchr/testify/require"
 )
 
 var (
@@ -37,10 +38,11 @@ data "boundary_user" "admin" {
 // NOTE: this test also tests out the direct token auth mechanism.
 
 func TestAccUserDataSource_basicOrgUser(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
-	token := tc.Token().Token
+	token := cfg.BoundaryAuthToken
+	suffix := id.UniqueId()
 
 	resourceName := "boundary_user.org1"
 	dataSourceName := "data.boundary_user.org1"
@@ -52,7 +54,7 @@ func TestAccUserDataSource_basicOrgUser(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// test create
-				Config: testConfigWithToken(url, token, fooOrg, orgUserDataSource),
+				Config: testConfigWithToken(url, token, fooOrg(suffix), orgUserDataSource),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckUserResourceExists(provider, resourceName),
 					resource.TestCheckResourceAttr(dataSourceName, DescriptionKey, fooDescription),
@@ -64,10 +66,11 @@ func TestAccUserDataSource_basicOrgUser(t *testing.T) {
 }
 
 func TestAccUserDataSource_globalAdminUser(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
-	token := tc.Token().Token
+	token := cfg.BoundaryAuthToken
+	suffix := id.UniqueId()
 
 	dataSourceName := "data.boundary_user.admin"
 
@@ -76,11 +79,11 @@ func TestAccUserDataSource_globalAdminUser(t *testing.T) {
 		ProviderFactories: providerFactories(&provider),
 		Steps: []resource.TestStep{
 			{
-				Config: testConfigWithToken(url, token, fooOrg, globalUserDataSource),
+				Config: testConfigWithToken(url, token, fooOrg(suffix), globalUserDataSource),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(dataSourceName, NameKey, "admin"),
 					resource.TestCheckResourceAttr(dataSourceName, DescriptionKey, "Initial admin user within the \"global\" scope"),
-					resource.TestCheckResourceAttr(dataSourceName, LoginNameKey, "testuser"),
+					resource.TestCheckResourceAttr(dataSourceName, LoginNameKey, tcLoginName),
 					resource.TestMatchResourceAttr(dataSourceName, IDKey, regexache.MustCompile(`^u_.+`)),
 					resource.TestMatchResourceAttr(dataSourceName, PrimaryAccountIdKey, regexache.MustCompile(`^acctpw_.+`)),
 					resource.TestCheckResourceAttr(dataSourceName, "authorized_actions.#", "8"),

internal/provider/provider_test.go

@@ -17,23 +17,24 @@ import (
 	"github.com/hashicorp/cap/oidc"
 	wrapping "github.com/hashicorp/go-kms-wrapping/v2"
 	"github.com/hashicorp/go-kms-wrapping/v2/aead"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
 	"github.com/jimlambrt/gldap"
 	"github.com/jimlambrt/gldap/testdirectory"
+	"github.com/stretchr/testify/require"
 )
 
 var (
-	tcLoginName = "testuser"
+	tcLoginName = "admin"
-	tcPassword  = "passpass"
+	tcPassword  = "password"
-	tcPAUM      = "ampw_0000000000"
+	tcPAUM      = "ampw_1234567890"
 	tcConfig    = []controller.Option{
 		controller.WithDefaultPasswordAuthMethodId(tcPAUM),
 		controller.WithDefaultLoginName(tcLoginName),
 		controller.WithDefaultPassword(tcPassword),
 	}
-	tcRecoveryKey = "7xtkEoS5EXPbgynwd+dDLHopaCqK8cq0Rpep4eooaTs="
 )
 
 func providerFactories(p **schema.Provider) map[string]func() (*schema.Provider, error) {
@@ -145,15 +146,23 @@ provider "boundary" {
 func testConfigWithoutAMPWCredentials(url string, res ...string) string {
 	provider := fmt.Sprintf(`
 provider "boundary" {
-	addr  = "%s"
+	addr           = "%s"
-}`, url)
+	auth_method_id = "%s"
+}`, url, tcPAUM)
 
 	c := []string{provider}
 	c = append(c, res...)
 	return strings.Join(c, "\n")
 }
 
-func testConfigWithRecovery(url string, res ...string) string {
+func testConfigWithRecovery(t *testing.T, url string, res ...string) string {
+	t.Helper()
+	cfg, err := loadTestConfig()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	key := requireRecoveryKey(t, cfg)
 	provider := fmt.Sprintf(`
 provider "boundary" {
 	addr             = "%s"
@@ -161,24 +170,25 @@ provider "boundary" {
 	kms "aead" {
 		purpose = ["recovery", "config"]
 		aead_type = "aes-gcm"
-		key = "7xtkEoS5EXPbgynwd+dDLHopaCqK8cq0Rpep4eooaTs="
+		key = "%s"
 		key_id = "global_recovery"
 	}
 	DOC
-}`, url)
+}`, url, key)
 
 	c := []string{provider}
 	c = append(c, res...)
 	return strings.Join(c, "\n")
 }
 
-func testConfigWithLDAPAuthMethod(url string, loginName string, password string, res ...string) string {
+func testConfigWithLDAPAuthMethod(url string, scopeId string, loginName string, password string, res ...string) string {
 	provider := fmt.Sprintf(`
 provider "boundary" {
-	addr             = "%s"
+	addr                   = "%s"
+	scope_id               = "%s"
 	auth_method_login_name = "%s"
-	auth_method_password = "%s"
+	auth_method_password   = "%s"
-}`, url, loginName, password)
+}`, url, scopeId, loginName, password)
 
 	c := []string{provider}
 	c = append(c, res...)
@@ -208,49 +218,68 @@ func TestProvider(t *testing.T) {
 func TestConfigWithLdapAuthMethod(t *testing.T) {
 	td := createDefaultLdap(t)
 	defer td.Stop()
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 	ldapLoginName := "alice"
 	ldapPassword := "password"
 
 	createLdapAMConfig := fmt.Sprintf(testPrimaryAuthMethodLdap, td.Host(), td.Port(), testdirectory.DefaultUserDN, testdirectory.DefaultGroupDN)
 	createLdapAccountConfig := fmt.Sprintf(testProviderLdapAccountConfig, ldapLoginName)
 
+	// provider is set by providerFactories when resource.Test initialises.
+	// steps is declared as a var (slice = reference type) so step 1's Check can
+	// write the org scope ID into steps[1].Config before the framework reads it.
 	var provider *schema.Provider
+	var steps []resource.TestStep
+	steps = []resource.TestStep{
+		{
+			// Step 1: create LDAP auth method as primary for the org.
+			// Capture the org scope ID and write it into step 2's provider block.
+			Config: testConfig(url, fooOrg(suffix), createLdapAMConfig, createLdapAccountConfig),
+			Check: resource.ComposeTestCheckFunc(
+				resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapInsecureTlsField, "true"),
+				func(s *terraform.State) error {
+					rs, ok := s.RootModule().Resources["boundary_scope.org1"]
+					if !ok {
+						return fmt.Errorf("boundary_scope.org1 not found in state")
+					}
+					steps[1].Config = testConfigWithLDAPAuthMethod(url, rs.Primary.ID, ldapLoginName, ldapPassword, fooOrg(suffix), createLdapAMConfig, createLdapAccountConfig)
+					return nil
+				},
+			),
+		},
+		{
+			// Step 2: provider uses scope_id=org1 to auto-discover the LDAP primary AM.
+			// Config is written by step 1's Check above; placeholder avoids empty-step error.
+			Config: testConfig(url, fooOrg(suffix), createLdapAMConfig, createLdapAccountConfig),
+			Check: resource.ComposeTestCheckFunc(
+				func(s *terraform.State) error { return testProviderTokenExists(provider)(s) },
+			),
+		},
+		{
+			// Step 3: switch back to password auth and verify it still works after
+			// LDAP was primary for the org.
+			Config: testConfig(url, fooOrg(suffix)),
+			Check: resource.ComposeTestCheckFunc(
+				func(s *terraform.State) error { return testProviderTokenExists(provider)(s) },
+			),
+		},
+	}
+
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
 		CheckDestroy:      testAccCheckAuthMethodResourceDestroy(t, provider, ldapAuthMethodType),
-		Steps: []resource.TestStep{
+		Steps:             steps,
-			{
-				// create ldap auth method
-				Config: testConfig(url, fooOrg, createLdapAMConfig, createLdapAccountConfig),
-				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapInsecureTlsField, "true"),
-				),
-			},
-			{
-				// authenticate with LDAP auth method and ensure auth token exists
-				Config: testConfigWithLDAPAuthMethod(url, ldapLoginName, ldapPassword, fooOrg, createLdapAMConfig, createLdapAccountConfig),
-				Check: resource.ComposeTestCheckFunc(
-					testProviderTokenExists(provider),
-				),
-			},
-			{
-				// check if authentication with password auth method works after
-				Config: testConfig(url, fooOrg),
-				Check: resource.ComposeTestCheckFunc(
-					testProviderTokenExists(provider),
-				),
-			},
-		},
 	})
 }
 
 func TestConfigWithDefaultAuthMethod(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
@@ -259,7 +288,7 @@ func TestConfigWithDefaultAuthMethod(t *testing.T) {
 		CheckDestroy:      testAccCheckScopeResourceDestroy(t, provider),
 		Steps: []resource.TestStep{
 			{
-				Config: testConfigWithDefaultAuthMethod(url, fooOrg, firstProjectFoo, secondProject),
+				Config: testConfigWithDefaultAuthMethod(url, fooOrg(suffix), firstProjectFoo, secondProject),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckScopeResourceExists(provider, "boundary_scope.org1"),
 					testProviderTokenExists(provider),
@@ -270,9 +299,10 @@ func TestConfigWithDefaultAuthMethod(t *testing.T) {
 }
 
 func TestConfigWithDeprecatedAuthMethod(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
@@ -281,7 +311,7 @@ func TestConfigWithDeprecatedAuthMethod(t *testing.T) {
 		CheckDestroy:      testAccCheckScopeResourceDestroy(t, provider),
 		Steps: []resource.TestStep{
 			{
-				Config: testConfigWithDeprecatedAuthMethod(url, fooOrg, firstProjectFoo, secondProject),
+				Config: testConfigWithDeprecatedAuthMethod(url, fooOrg(suffix), firstProjectFoo, secondProject),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckScopeResourceExists(provider, "boundary_scope.org1"),
 					testProviderTokenExists(provider),
@@ -292,9 +322,10 @@ func TestConfigWithDeprecatedAuthMethod(t *testing.T) {
 }
 
 func TestConfigWithoutAMPWCredentials(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
@@ -302,7 +333,7 @@ func TestConfigWithoutAMPWCredentials(t *testing.T) {
 		ProviderFactories: providerFactories(&provider),
 		Steps: []resource.TestStep{
 			{
-				Config:      testConfigWithoutAMPWCredentials(url, fooOrg, firstProjectFoo, secondProject),
+				Config:      testConfigWithoutAMPWCredentials(url, fooOrg(suffix), firstProjectFoo, secondProject),
 				ExpectError: regexp.MustCompile("auth method login name not set, please set auth_method_login_name on the provider"),
 			},
 		},
@@ -310,9 +341,10 @@ func TestConfigWithoutAMPWCredentials(t *testing.T) {
 }
 
 func TestConfigWithOIDCAuthMethod(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
@@ -320,7 +352,7 @@ func TestConfigWithOIDCAuthMethod(t *testing.T) {
 		ProviderFactories: providerFactories(&provider),
 		Steps: []resource.TestStep{
 			{
-				Config:      testConfigWithOIDCAuthMethod(url, fooOrg, firstProjectFoo, secondProject),
+				Config:      testConfigWithOIDCAuthMethod(url, fooOrg(suffix), firstProjectFoo, secondProject),
 				ExpectError: regexp.MustCompile("OIDC auth method is currently not supported by Boundary Terraform Provider. only password auth method is supported at this time"),
 			},
 		},
@@ -330,12 +362,12 @@ func TestConfigWithOIDCAuthMethod(t *testing.T) {
 // Create OIDC auth method and set it as the primary auth method.
 // Attempt to authenticate with recovery to test checks for default auth method
 func TestRecoveryWithOIDCDefaultAuthMethod(t *testing.T) {
-	tp := oidc.StartTestProvider(t)
+	cfg, err := loadTestConfig()
-	wrapper := testWrapper(context.Background(), t, tcRecoveryKey)
+	require.NoError(t, err)
-	tc := controller.NewTestController(t, append(tcConfig, controller.WithRecoveryKms(wrapper))...)
+	url := cfg.BoundaryAddr
-	defer tc.Shutdown()
+	suffix := id.UniqueId()
-	url := tc.ApiAddrs()[0]
 
+	tp := oidc.StartTestProvider(t)
 	tpCert := strings.TrimSpace(tp.CACert())
 	createConfig := fmt.Sprintf(fooAuthMethodOidc, fooAuthMethodOidcDesc, tp.Addr(), tpCert)
 	updateConfig := fmt.Sprintf(fooAuthMethodOidcUpdate, fooAuthMethodOidcDescUpdate, fooAuthMethodOidcCaCerts)
@@ -347,7 +379,7 @@ func TestRecoveryWithOIDCDefaultAuthMethod(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// create auth method
-				Config: testConfig(url, fooOrg, createConfig),
+				Config: testConfig(url, fooOrg(suffix), createConfig),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", "description", fooAuthMethodOidcDesc),
 					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", "name", "test"),
@@ -357,7 +389,7 @@ func TestRecoveryWithOIDCDefaultAuthMethod(t *testing.T) {
 			importStep("boundary_auth_method_oidc.foo", "client_secret", "is_primary_for_scope"),
 			{
 				// set auth method as primary auth method
-				Config: testConfig(url, fooOrg, updateConfig),
+				Config: testConfig(url, fooOrg(suffix), updateConfig),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", "name", "test"),
 					testAccIsPrimaryForScope(provider, "boundary_auth_method_oidc.foo", true),
@@ -365,7 +397,7 @@ func TestRecoveryWithOIDCDefaultAuthMethod(t *testing.T) {
 			},
 			{
 				// authenticate provider with recovery kms with unsupported OIDC primary auth method
-				Config: testConfigWithRecovery(url, fooOrg, updateConfig),
+				Config: testConfigWithRecovery(t, url, fooOrg(suffix), updateConfig),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", "name", "test"),
 					testAccIsPrimaryForScope(provider, "boundary_auth_method_oidc.foo", true),

internal/provider/resource_account.go

@@ -220,6 +220,9 @@ func resourceAccountDelete(ctx context.Context, d *schema.ResourceData, meta int
 
 	_, err := aClient.Delete(ctx, d.Id())
 	if err != nil {
+		if apiErr := api.AsServerError(err); apiErr != nil && apiErr.Response().StatusCode() == http.StatusNotFound {
+			return nil
+		}
 		return diag.Errorf("error deleting account: %v", err)
 	}
 

internal/provider/resource_account_ldap_test.go

@@ -7,9 +7,10 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/stretchr/testify/require"
 )
 
 const (
@@ -87,21 +88,31 @@ resource "boundary_user" "alice" {
 	name        = "alice"
 	description = "test user resource"
 	account_ids = [boundary_account_ldap.test-ldap.id]
-	scope_id = boundary_scope.global.id
+	scope_id    = boundary_scope.org1.id
 }
 
 resource "boundary_role" "ldap_principal" {
-	scope_id = boundary_scope.global.id
+	scope_id        = boundary_scope.org1.id
+	grant_scope_ids = ["this", "children"]
+	grant_strings   = ["ids=*;type=*;actions=*"]
+	principal_ids   = [boundary_user.alice.id]
+	depends_on      = [boundary_role.org1_admin]
+}
+
+resource "boundary_role" "ldap_global_reader" {
+	scope_id        = boundary_scope.global.id
 	grant_scope_ids = ["this"]
-	grant_strings = ["ids=*;type=*;actions=*"]
+	grant_strings   = ["ids=*;type=*;actions=*"]
-	principal_ids = [boundary_user.alice.id]
+	principal_ids   = [boundary_user.alice.id]
+	depends_on      = [boundary_role.org1_admin]
 }`
 )
 
 func TestAccLdapAccount(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	suffix := id.UniqueId()
+	url := cfg.BoundaryAddr
 
 	var provider *schema.Provider
 
@@ -111,7 +122,7 @@ func TestAccLdapAccount(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// create
-				Config: testConfig(url, fooOrg, testAccountLdap),
+				Config: testConfig(url, fooOrg(suffix), testAccountLdap),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "description", testAccountLdapDesc),
 					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "name", testAccountLdapName),
@@ -123,7 +134,7 @@ func TestAccLdapAccount(t *testing.T) {
 			importStep("boundary_account_ldap.foo", "ldap"),
 			{
 				// update
-				Config: testConfig(url, fooOrg, testAccountLdapUpdate),
+				Config: testConfig(url, fooOrg(suffix), testAccountLdapUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "description", testAccountLdapDescUpdate),
 					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "name", testAccountLdapNameUpdate),
@@ -135,7 +146,7 @@ func TestAccLdapAccount(t *testing.T) {
 			importStep("boundary_account_ldap.foo", "ldap"),
 			{
 				// update without passing type field
-				Config: testConfig(url, fooOrg, testAccountLdapWithoutTypeField),
+				Config: testConfig(url, fooOrg(suffix), testAccountLdapWithoutTypeField),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "description", testAccountLdapDescUpdate),
 					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "name", testAccountLdapNameUpdate),

internal/provider/resource_account_oidc_test.go

@@ -8,10 +8,11 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/cap/oidc"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/stretchr/testify/require"
 )
 
 const (
@@ -52,9 +53,10 @@ resource "boundary_account_oidc" "foo" {
 
 func TestAccOidcAccount(t *testing.T) {
 	tp := oidc.StartTestProvider(t)
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	suffix := id.UniqueId()
+	url := cfg.BoundaryAddr
 
 	var provider *schema.Provider
 
@@ -68,7 +70,7 @@ func TestAccOidcAccount(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// create
-				Config: testConfig(url, fooOrg, createConfig),
+				Config: testConfig(url, fooOrg(suffix), createConfig),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("boundary_account_oidc.foo", "description", fooAccountOidcDesc),
 					resource.TestCheckResourceAttr("boundary_account_oidc.foo", "name", "test"),
@@ -80,7 +82,7 @@ func TestAccOidcAccount(t *testing.T) {
 			importStep("boundary_account_oidc.foo", "oidc"),
 			{
 				// update
-				Config: testConfig(url, fooOrg, updateConfig),
+				Config: testConfig(url, fooOrg(suffix), updateConfig),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("boundary_account_oidc.foo", "description", fooAccountOidcDescUpdate),
 					resource.TestCheckResourceAttr("boundary_account_oidc.foo", "name", "test"),

internal/provider/resource_account_password_test.go

@@ -7,9 +7,10 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/stretchr/testify/require"
 )
 
 const (
@@ -73,9 +74,10 @@ resource "boundary_account_password" "foo" {
 )
 
 func TestAccAccount(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	suffix := id.UniqueId()
+	url := cfg.BoundaryAddr
 
 	var provider *schema.Provider
 
@@ -85,7 +87,7 @@ func TestAccAccount(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// create
-				Config: testConfig(url, fooOrg, fooAccountPassword),
+				Config: testConfig(url, fooOrg(suffix), fooAccountPassword),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("boundary_account_password.foo", "description", fooAccountPasswordDesc),
 					resource.TestCheckResourceAttr("boundary_account_password.foo", "name", "test"),
@@ -98,7 +100,7 @@ func TestAccAccount(t *testing.T) {
 			importStep("boundary_account_password.foo", "password"),
 			{
 				// update
-				Config: testConfig(url, fooOrg, fooAccountPasswordUpdate),
+				Config: testConfig(url, fooOrg(suffix), fooAccountPasswordUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("boundary_account_password.foo", "description", fooAccountPasswordDescUpdate),
 					resource.TestCheckResourceAttr("boundary_account_password.foo", "name", "test"),
@@ -111,7 +113,7 @@ func TestAccAccount(t *testing.T) {
 			importStep("boundary_account_password.foo", "password"),
 			{
 				// update without passing type field
-				Config: testConfig(url, fooOrg, fooAccountPasswordWithoutTypeField),
+				Config: testConfig(url, fooOrg(suffix), fooAccountPasswordWithoutTypeField),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("boundary_account_password.foo", "description", fooAccountPasswordDescUpdate),
 					resource.TestCheckResourceAttr("boundary_account_password.foo", "name", "test"),

internal/provider/resource_account_test.go

@@ -11,10 +11,11 @@ import (
 
 	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/accounts"
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/stretchr/testify/require"
 )
 
 const (
@@ -61,9 +62,10 @@ resource "boundary_account" "foo" {
 )
 
 func TestAccAccountBase(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	suffix := id.UniqueId()
+	url := cfg.BoundaryAddr
 
 	var provider *schema.Provider
 
@@ -73,7 +75,7 @@ func TestAccAccountBase(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// create
-				Config: testConfig(url, fooOrg, fooAccount),
+				Config: testConfig(url, fooOrg(suffix), fooAccount),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("boundary_account.foo", "description", fooAccountDesc),
 					resource.TestCheckResourceAttr("boundary_account.foo", "name", "test"),
@@ -86,7 +88,7 @@ func TestAccAccountBase(t *testing.T) {
 			importStep("boundary_account.foo", "password"),
 			{
 				// update
-				Config: testConfig(url, fooOrg, fooAccountUpdate),
+				Config: testConfig(url, fooOrg(suffix), fooAccountUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("boundary_account.foo", "description", fooAccountDescUpdate),
 					resource.TestCheckResourceAttr("boundary_account.foo", "name", "test"),

internal/provider/resource_alias_target_test.go

@@ -11,10 +11,11 @@ import (
 
 	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/aliases"
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/stretchr/testify/require"
 )
 
 type aliasDestroyType string
@@ -58,9 +59,10 @@ resource "boundary_alias_target" "example" {
 }
 
 func TestAccAliasTarget(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	suffix := id.UniqueId()
+	url := cfg.BoundaryAddr
 
 	res := targetAliasResource(targetAliasName, targetAliasDesc, targetAliasValue)
 
@@ -74,7 +76,7 @@ func TestAccAliasTarget(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// create
-				Config: testConfig(url, fooOrg, firstProjectFoo, fooBarTarget, res),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, fooBarTarget, res),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(targetAliasResc, NameKey, targetAliasName),
 					resource.TestCheckResourceAttr(targetAliasResc, DescriptionKey, targetAliasDesc),
@@ -86,7 +88,7 @@ func TestAccAliasTarget(t *testing.T) {
 			importStep(targetAliasResc),
 			{
 				// update
-				Config: testConfig(url, fooOrg, firstProjectFoo, fooBarTarget, resUpdate),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, fooBarTarget, resUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(targetAliasResc, NameKey, targetAliasName+targetAliasUpdate),
 					resource.TestCheckResourceAttr(targetAliasResc, DescriptionKey, targetAliasDesc+targetAliasUpdate),
@@ -99,7 +101,7 @@ func TestAccAliasTarget(t *testing.T) {
 			{
 				// Run a plan only update and verify no changes
 				PlanOnly: true,
-				Config:   testConfig(url, fooOrg, firstProjectFoo, fooBarTarget, resUpdate),
+				Config:   testConfig(url, fooOrg(suffix), firstProjectFoo, fooBarTarget, resUpdate),
 			},
 			importStep(targetAliasResc),
 			{
@@ -109,7 +111,7 @@ func TestAccAliasTarget(t *testing.T) {
 				PreConfig:          func() { targetAliasExternalUpdate(t, provider) },
 				PlanOnly:           true,
 				ExpectNonEmptyPlan: true,
-				Config:             testConfig(url, fooOrg, firstProjectFoo, fooBarTarget, resUpdate),
+				Config:             testConfig(url, fooOrg(suffix), firstProjectFoo, fooBarTarget, resUpdate),
 			},
 			importStep(targetAliasResc),
 		},

internal/provider/resource_auth_method_ldap_test.go

@@ -8,10 +8,11 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/jimlambrt/gldap/testdirectory"
+	"github.com/stretchr/testify/require"
 )
 
 const (
@@ -79,9 +80,10 @@ EOT
 resource "boundary_auth_method_ldap" "test-ldap" {
 	name        		 = "test"
 	description 		 = "test auth method ldap"
-	scope_id    		 = "global"
+	scope_id    		 = boundary_scope.org1.id
 	is_primary_for_scope = true
-  	urls         	  	 = ["ldap://%s:%d"]
+	depends_on           = [boundary_role.org1_admin]
+	urls         	  	 = ["ldap://%s:%d"]
 	user_dn           	 = "%s"
 	group_dn          	 = "%s"
 	discover_dn 	  	 = true
@@ -129,9 +131,10 @@ func TestAccAuthMethodLdap(t *testing.T) {
 		t,
 		testdirectory.WithDefaults(t, &testdirectory.Defaults{AllowAnonymousBind: true}),
 	)
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	suffix := id.UniqueId()
+	url := cfg.BoundaryAddr
 
 	tdCert := strings.TrimSpace(td.Cert())
 	createConfig := fmt.Sprintf(testAuthMethodLdap, testAuthMethodLdapDesc, tdCert)
@@ -144,7 +147,7 @@ func TestAccAuthMethodLdap(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// create
-				Config: testConfig(url, fooOrg, createConfig),
+				Config: testConfig(url, fooOrg(suffix), createConfig),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", "description", testAuthMethodLdapDesc),
 					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", "name", "test"),
@@ -173,7 +176,7 @@ func TestAccAuthMethodLdap(t *testing.T) {
 			importStep("boundary_auth_method_ldap.test-ldap", "is_primary_for_scope", "bind_password", "client_certificate_key"),
 			{
 				// update
-				Config: testConfig(url, fooOrg, updateConfig),
+				Config: testConfig(url, fooOrg(suffix), updateConfig),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapStateField, "inactive"),
 					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", "description", testAuthMethodLdapDescUpdate),

internal/provider/resource_auth_method_oidc_test.go

@@ -11,11 +11,12 @@ import (
 
 	"github.com/hashicorp/boundary/api/authmethods"
 	"github.com/hashicorp/boundary/api/scopes"
-	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/cap/oidc"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/stretchr/testify/require"
 )
 
 const (
@@ -50,7 +51,7 @@ var (
 resource "boundary_auth_method_oidc" "foo" {
 	name        = "test"
 	description = "%s"
-	scope_id    = "global"
+	scope_id    = boundary_scope.org1.id
 	depends_on  = [boundary_role.org1_admin]
 
   issuer            = "%s"
@@ -74,7 +75,7 @@ EOT
 resource "boundary_auth_method_oidc" "foo" {
 	name                 = "test"
 	description          = "%s"
-	scope_id             = "global"
+	scope_id             = boundary_scope.org1.id
 	is_primary_for_scope = true
 	depends_on           = [boundary_role.org1_admin]
 
@@ -100,9 +101,10 @@ EOT
 
 func TestAccAuthMethodOidc(t *testing.T) {
 	tp := oidc.StartTestProvider(t)
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	suffix := id.UniqueId()
+	url := cfg.BoundaryAddr
 
 	tpCert := strings.TrimSpace(tp.CACert())
 	createConfig := fmt.Sprintf(fooAuthMethodOidc, fooAuthMethodOidcDesc, tp.Addr(), tpCert)
@@ -115,7 +117,7 @@ func TestAccAuthMethodOidc(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// create
-				Config: testConfig(url, fooOrg, createConfig),
+				Config: testConfig(url, fooOrg(suffix), createConfig),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", "description", fooAuthMethodOidcDesc),
 					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", "name", "test"),
@@ -135,7 +137,7 @@ func TestAccAuthMethodOidc(t *testing.T) {
 			importStep("boundary_auth_method_oidc.foo", "client_secret", "is_primary_for_scope"),
 			{
 				// update
-				Config: testConfig(url, fooOrg, updateConfig),
+				Config: testConfig(url, fooOrg(suffix), updateConfig),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", "description", fooAuthMethodOidcDescUpdate),
 					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", "name", "test"),

internal/provider/resource_auth_method_password_test.go

@@ -7,9 +7,10 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/stretchr/testify/require"
 )
 
 const (
@@ -48,9 +49,10 @@ resource "boundary_auth_method_password" "foo" {
 )
 
 func TestAccAuthMethodPassword(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	suffix := id.UniqueId()
+	url := cfg.BoundaryAddr
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
@@ -59,7 +61,7 @@ func TestAccAuthMethodPassword(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// create
-				Config: testConfig(url, fooOrg, fooAuthMethod),
+				Config: testConfig(url, fooOrg(suffix), fooAuthMethod),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("boundary_auth_method_password.foo", "description", fooAuthMethodDesc),
 					resource.TestCheckResourceAttr("boundary_auth_method_password.foo", "name", "test"),
@@ -71,7 +73,7 @@ func TestAccAuthMethodPassword(t *testing.T) {
 			importStep("boundary_auth_method_password.foo"),
 			{
 				// update
-				Config: testConfig(url, fooOrg, fooAuthMethodUpdate),
+				Config: testConfig(url, fooOrg(suffix), fooAuthMethodUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("boundary_auth_method_password.foo", "description", fooAuthMethodDescUpdate),
 					resource.TestCheckResourceAttr("boundary_auth_method_password.foo", "name", "test"),
@@ -86,9 +88,10 @@ func TestAccAuthMethodPassword(t *testing.T) {
 }
 
 func TestAccAuthMethodPasswordIsPrimary(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	suffix := id.UniqueId()
+	url := cfg.BoundaryAddr
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
@@ -97,7 +100,7 @@ func TestAccAuthMethodPasswordIsPrimary(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// create
-				Config: testConfig(url, fooOrg, fooAuthMethod),
+				Config: testConfig(url, fooOrg(suffix), fooAuthMethod),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("boundary_auth_method_password.foo", "description", fooAuthMethodDesc),
 					resource.TestCheckResourceAttr("boundary_auth_method_password.foo", "name", "test"),
@@ -109,7 +112,7 @@ func TestAccAuthMethodPasswordIsPrimary(t *testing.T) {
 			importStep("boundary_auth_method_password.foo"),
 			{
 				// update
-				Config: testConfig(url, fooOrg, fooAuthMethodIsPrimaryUpdate),
+				Config: testConfig(url, fooOrg(suffix), fooAuthMethodIsPrimaryUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("boundary_auth_method_password.foo", "description", fooAuthMethodDesc),
 					resource.TestCheckResourceAttr("boundary_auth_method_password.foo", "name", "test"),

internal/provider/resource_auth_method_test.go

@@ -11,10 +11,11 @@ import (
 
 	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/authmethods"
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/stretchr/testify/require"
 )
 
 const (
@@ -55,9 +56,10 @@ resource "boundary_auth_method" "foo" {
 )
 
 func TestAccBaseAuthMethodPassword(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	suffix := id.UniqueId()
+	url := cfg.BoundaryAddr
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
@@ -66,7 +68,7 @@ func TestAccBaseAuthMethodPassword(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// create
-				Config: testConfig(url, fooOrg, fooBaseAuthMethod),
+				Config: testConfig(url, fooOrg(suffix), fooBaseAuthMethod),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("boundary_auth_method.foo", "description", fooBaseAuthMethodDesc),
 					resource.TestCheckResourceAttr("boundary_auth_method.foo", "name", "test"),
@@ -78,7 +80,7 @@ func TestAccBaseAuthMethodPassword(t *testing.T) {
 
 			{
 				// update
-				Config: testConfig(url, fooOrg, fooBaseAuthMethodUpdate),
+				Config: testConfig(url, fooOrg(suffix), fooBaseAuthMethodUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("boundary_auth_method.foo", "description", fooBaseAuthMethodDescUpdate),
 					resource.TestCheckResourceAttr("boundary_auth_method.foo", "name", "test"),
@@ -92,9 +94,10 @@ func TestAccBaseAuthMethodPassword(t *testing.T) {
 }
 
 func TestAccBaseAuthMethodPasswordIsPrimary(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	suffix := id.UniqueId()
+	url := cfg.BoundaryAddr
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
@@ -103,7 +106,7 @@ func TestAccBaseAuthMethodPasswordIsPrimary(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// create
-				Config: testConfig(url, fooOrg, fooBaseAuthMethod),
+				Config: testConfig(url, fooOrg(suffix), fooBaseAuthMethod),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("boundary_auth_method.foo", "description", fooBaseAuthMethodDesc),
 					resource.TestCheckResourceAttr("boundary_auth_method.foo", "name", "test"),
@@ -115,7 +118,7 @@ func TestAccBaseAuthMethodPasswordIsPrimary(t *testing.T) {
 			importStep("boundary_auth_method.foo"),
 			{
 				// update
-				Config: testConfig(url, fooOrg, fooBaseAuthMethodIsPrimaryUpdate),
+				Config: testConfig(url, fooOrg(suffix), fooBaseAuthMethodIsPrimaryUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("boundary_auth_method.foo", "description", fooBaseAuthMethodDesc),
 					resource.TestCheckResourceAttr("boundary_auth_method.foo", "name", "test"),

internal/provider/resource_credential_json_test.go

@@ -11,10 +11,11 @@ import (
 
 	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/credentials"
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/stretchr/testify/require"
 )
 
 const (
@@ -51,9 +52,10 @@ resource "boundary_credential_json" "example" {
 }
 
 func TestAccCredentialJson(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	suffix := id.UniqueId()
+	url := cfg.BoundaryAddr
 
 	res := jsonCredResource(
 		jsonCredName,
@@ -74,7 +76,7 @@ func TestAccCredentialJson(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// create
-				Config: testConfig(url, fooOrg, firstProjectFoo, res),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, res),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(jsonCredResc, NameKey, jsonCredName),
 					resource.TestCheckResourceAttr(jsonCredResc, DescriptionKey, jsonCredDesc),
@@ -87,7 +89,7 @@ func TestAccCredentialJson(t *testing.T) {
 			importStep(jsonCredResc, credentialJsonObjectKey),
 			{
 				// update
-				Config: testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(jsonCredResc, NameKey, jsonCredNameUpdate),
 					resource.TestCheckResourceAttr(jsonCredResc, DescriptionKey, jsonCredDescUpdate),
@@ -101,13 +103,13 @@ func TestAccCredentialJson(t *testing.T) {
 			{
 				// Run a plan only update and verify no changes
 				PlanOnly: true,
-				Config:   testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+				Config:   testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdate),
 			},
 			importStep(jsonCredResc, credentialJsonObjectKey),
 			{
 				// update again but apply a preConfig to externally update resource
 				PreConfig: func() { jsonCredExternalUpdate(t, provider) },
-				Config:    testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+				Config:    testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdate),
 			},
 			importStep(jsonCredResc, credentialJsonObjectKey),
 		},

internal/provider/resource_credential_library_vault_ldap_test.go

@@ -7,10 +7,11 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/boundary/testing/vault"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/stretchr/testify/require"
 )
 
 const (
@@ -42,9 +43,10 @@ resource "boundary_credential_library_vault_ldap" "example" {
 	vaultLdapCredLibPath+vaultLdapCredLibStringUpdate)
 
 func TestAccCredentialLibraryVaultLdap(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	suffix := id.UniqueId()
+	url := cfg.BoundaryAddr
 
 	vc := vault.NewTestVaultServer(t)
 	_, token := vc.CreateToken(t)
@@ -64,7 +66,7 @@ func TestAccCredentialLibraryVaultLdap(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// create
-				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultLdapCredLibResource),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, credStoreRes, vaultLdapCredLibResource),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(vaultLdapCredResc, NameKey, vaultLdapCredLibName),
 					resource.TestCheckResourceAttr(vaultLdapCredResc, DescriptionKey, vaultLdapCredLibDesc),
@@ -76,7 +78,7 @@ func TestAccCredentialLibraryVaultLdap(t *testing.T) {
 			importStep(vaultLdapCredResc),
 			{
 				// update
-				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultLdapCredLibResourceUpdate),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, credStoreRes, vaultLdapCredLibResourceUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(vaultLdapCredResc, NameKey, vaultLdapCredLibName+vaultLdapCredLibStringUpdate),
 					resource.TestCheckResourceAttr(vaultLdapCredResc, DescriptionKey, vaultLdapCredLibDesc+vaultLdapCredLibStringUpdate),

internal/provider/resource_credential_library_vault_ssh_certificate_test.go

@@ -8,10 +8,11 @@ import (
 	"strconv"
 	"testing"
 
-	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/boundary/testing/vault"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/stretchr/testify/require"
 )
 
 const (
@@ -119,9 +120,10 @@ resource "boundary_credential_library_vault_ssh_certificate" "ext_co_example" {
 	vaultSshCertCredUsername)
 
 func TestAccCredentialLibraryVaultSshCertificate(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	suffix := id.UniqueId()
+	url := cfg.BoundaryAddr
 
 	vc := vault.NewTestVaultServer(t)
 	_, token := vc.CreateToken(t)
@@ -141,7 +143,7 @@ func TestAccCredentialLibraryVaultSshCertificate(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// create
-				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultSshCertCredLibResource),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, credStoreRes, vaultSshCertCredLibResource),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(vaultSshCertCredResc, NameKey, vaultSshCertCredLibName),
 					resource.TestCheckResourceAttr(vaultSshCertCredResc, DescriptionKey, vaultSshCertCredLibDesc),
@@ -154,7 +156,7 @@ func TestAccCredentialLibraryVaultSshCertificate(t *testing.T) {
 			importStep(vaultSshCertCredResc),
 			{
 				// update
-				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultSshCertCredLibResourceUpdate),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, credStoreRes, vaultSshCertCredLibResourceUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(vaultSshCertCredResc, NameKey, vaultSshCertCredLibName+vaultSshCertCredLibStringUpdate),
 					resource.TestCheckResourceAttr(vaultSshCertCredResc, DescriptionKey, vaultSshCertCredLibDesc+vaultSshCertCredLibStringUpdate),
@@ -169,7 +171,7 @@ func TestAccCredentialLibraryVaultSshCertificate(t *testing.T) {
 			importStep(vaultSshCertCredResc),
 			{
 				// create with extensions, critical options, and additional valid principals
-				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultSshCertCredLibResourceExtensionsCriticalOpts),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, credStoreRes, vaultSshCertCredLibResourceExtensionsCriticalOpts),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, NameKey, vaultSshCertCredLibName),
 					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, DescriptionKey, vaultSshCertCredLibDesc),
@@ -183,7 +185,7 @@ func TestAccCredentialLibraryVaultSshCertificate(t *testing.T) {
 			importStep(vaultSshCertCredExtCOResc),
 			{
 				// update with extensions and remove critical options
-				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultSshCertCredLibResourceExtensionsCriticalOptsUpdate),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, credStoreRes, vaultSshCertCredLibResourceExtensionsCriticalOptsUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, NameKey, vaultSshCertCredLibName),
 					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, DescriptionKey, vaultSshCertCredLibDesc),
@@ -199,7 +201,7 @@ func TestAccCredentialLibraryVaultSshCertificate(t *testing.T) {
 			importStep(vaultSshCertCredExtCOResc),
 			{
 				// update with extensions and remove critical options
-				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultSshCertCredLibResourceExtensionsCriticalOptsUpdate2),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, credStoreRes, vaultSshCertCredLibResourceExtensionsCriticalOptsUpdate2),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, NameKey, vaultSshCertCredLibName),
 					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, DescriptionKey, vaultSshCertCredLibDesc),

internal/provider/resource_credential_library_vault_test.go

@@ -11,11 +11,12 @@ import (
 
 	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/credentiallibraries"
-	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/boundary/testing/vault"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/stretchr/testify/require"
 )
 
 const (
@@ -138,9 +139,10 @@ resource "boundary_credential_library_vault" "ssh_private_key_mapping_override"
 	vaultCredLibMethodGet)
 
 func TestAccCredentialLibraryVault(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	suffix := id.UniqueId()
+	url := cfg.BoundaryAddr
 
 	vc := vault.NewTestVaultServer(t)
 	_, token := vc.CreateToken(t)
@@ -160,7 +162,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// create
-				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultCredLibResource),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, credStoreRes, vaultCredLibResource),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(vaultCredResc, NameKey, vaultCredLibName),
 					resource.TestCheckResourceAttr(vaultCredResc, DescriptionKey, vaultCredLibDesc),
@@ -175,7 +177,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 
 			{
 				// update
-				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(vaultCredResc, NameKey, vaultCredLibName+vaultCredLibStringUpdate),
 					resource.TestCheckResourceAttr(vaultCredResc, DescriptionKey, vaultCredLibDesc+vaultCredLibStringUpdate),
@@ -190,7 +192,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 
 			{
 				// create typed credential library, note credential type is immutable so no need for update test
-				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate, vaultTypedCredLibResource),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate, vaultTypedCredLibResource),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(vaultCredTypedResc, NameKey, vaultCredLibName),
 					resource.TestCheckResourceAttr(vaultCredTypedResc, DescriptionKey, vaultCredLibDesc),
@@ -205,7 +207,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 			importStep(vaultCredResc),
 
 			{
-				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate, vaultUsernamePasswordMappingOverrideCredLibResource),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate, vaultUsernamePasswordMappingOverrideCredLibResource),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, NameKey, vaultCredLibNameOverride),
 					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, DescriptionKey, vaultCredLibDesc),
@@ -222,7 +224,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 			importStep(vaultCredResc),
 
 			{
-				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate, vaultUsernamePasswordMappingOverrideCredLibResourceUpdate),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate, vaultUsernamePasswordMappingOverrideCredLibResourceUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, NameKey, vaultCredLibNameOverride),
 					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, DescriptionKey, vaultCredLibDesc),
@@ -239,7 +241,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 			importStep(vaultCredResc),
 
 			{
-				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate, vaultUsernamePasswordMappingOverrideCredLibResourceRemove),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate, vaultUsernamePasswordMappingOverrideCredLibResourceRemove),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, NameKey, vaultCredLibNameOverride),
 					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, DescriptionKey, vaultCredLibDesc),
@@ -255,7 +257,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 			importStep(vaultCredResc),
 
 			{
-				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate, vaultSshPrivateKeyMappingOverrideCredLibResource),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate, vaultSshPrivateKeyMappingOverrideCredLibResource),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, NameKey, vaultCredLibName),
 					resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, DescriptionKey, vaultCredLibDesc),

internal/provider/resource_credential_password_test.go

@@ -9,10 +9,11 @@ import (
 	"testing"
 
 	"github.com/hashicorp/boundary/api/credentials"
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/stretchr/testify/require"
 )
 
 const (
@@ -43,9 +44,10 @@ resource "boundary_credential_password" "example" {
 }
 
 func TestAccCredentialPassword(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	suffix := id.UniqueId()
+	url := cfg.BoundaryAddr
 
 	res := passwordCredResource(
 		passwordCredName,
@@ -66,7 +68,7 @@ func TestAccCredentialPassword(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// create
-				Config: testConfig(url, fooOrg, firstProjectFoo, res),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, res),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(passwordCredResc, NameKey, passwordCredName),
 					resource.TestCheckResourceAttr(passwordCredResc, DescriptionKey, passwordCredDesc),
@@ -79,7 +81,7 @@ func TestAccCredentialPassword(t *testing.T) {
 			importStep(passwordCredResc, credentialPasswordKey),
 			{
 				// update
-				Config: testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(passwordCredResc, NameKey, passwordCredName),
 					resource.TestCheckResourceAttr(passwordCredResc, DescriptionKey, passwordCredDesc),
@@ -93,13 +95,13 @@ func TestAccCredentialPassword(t *testing.T) {
 			{
 				// Run a plan only update and verify no changes
 				PlanOnly: true,
-				Config:   testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+				Config:   testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdate),
 			},
 			importStep(passwordCredResc, credentialPasswordKey),
 			{
 				// update again but apply a preConfig to externally update resource
 				PreConfig: func() { passwordCredExternalUpdate(t, provider) },
-				Config:    testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+				Config:    testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdate),
 			},
 			importStep(passwordCredResc, credentialPasswordKey),
 		},

internal/provider/resource_credential_ssh_private_key_test.go

@@ -7,10 +7,11 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/ssh/testdata"
 )
 
@@ -43,9 +44,10 @@ resource "boundary_credential_ssh_private_key" "example" {
 }
 
 func TestAccCredentialSshPrivateKey(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	suffix := id.UniqueId()
+	url := cfg.BoundaryAddr
 
 	privKey := string(testdata.PEMBytes["rsa"])
 	privKeyUpdate := string(testdata.PEMEncryptedKeys[0].PEMBytes)
@@ -75,7 +77,7 @@ func TestAccCredentialSshPrivateKey(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// create
-				Config: testConfig(url, fooOrg, firstProjectFoo, staticStore, res),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, staticStore, res),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, NameKey, sshPrivateKeyCredName),
 					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, DescriptionKey, sshPrivateKeyCredDesc),
@@ -90,7 +92,7 @@ func TestAccCredentialSshPrivateKey(t *testing.T) {
 			importStep(sshPrivateKeyCredResc, credentialSshPrivateKeyPrivateKeyKey, credentialSshPrivateKeyPassphraseKey),
 			{
 				// update
-				Config: testConfig(url, fooOrg, firstProjectFoo, staticStore, resUpdate),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, staticStore, resUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, NameKey, sshPrivateKeyCredName+sshPrivateKeyUpdate),
 					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, DescriptionKey, sshPrivateKeyCredDesc+sshPrivateKeyUpdate),

internal/provider/resource_credential_store_static_test.go

@@ -9,9 +9,10 @@ import (
 	"testing"
 
 	"github.com/hashicorp/boundary/api/credentialstores"
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/stretchr/testify/require"
 )
 
 const (
@@ -34,9 +35,10 @@ resource "boundary_credential_store_static" "example" {
 }
 
 func TestAccCredentialStoreStatic(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	suffix := id.UniqueId()
+	url := cfg.BoundaryAddr
 
 	res := staticCredStoreResource(staticCredStoreName,
 		staticCredStoreDesc)
@@ -51,7 +53,7 @@ func TestAccCredentialStoreStatic(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// create
-				Config: testConfig(url, fooOrg, firstProjectFoo, res),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, res),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(staticCredStoreResc, NameKey, staticCredStoreName),
 					resource.TestCheckResourceAttr(staticCredStoreResc, DescriptionKey, staticCredStoreDesc),
@@ -62,7 +64,7 @@ func TestAccCredentialStoreStatic(t *testing.T) {
 			importStep(staticCredStoreResc),
 			{
 				// update
-				Config: testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(staticCredStoreResc, NameKey, staticCredStoreName+staticCredStoreUpdate),
 					resource.TestCheckResourceAttr(staticCredStoreResc, DescriptionKey, staticCredStoreDesc+staticCredStoreUpdate),
@@ -74,7 +76,7 @@ func TestAccCredentialStoreStatic(t *testing.T) {
 			{
 				// Run a plan only update and verify no changes
 				PlanOnly: true,
-				Config:   testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+				Config:   testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdate),
 			},
 			importStep(staticCredStoreResc),
 			{
@@ -84,7 +86,7 @@ func TestAccCredentialStoreStatic(t *testing.T) {
 				PreConfig:          func() { staticCredentialStoreExternalUpdate(t, provider) },
 				PlanOnly:           true,
 				ExpectNonEmptyPlan: true,
-				Config:             testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+				Config:             testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdate),
 			},
 			importStep(staticCredStoreResc),
 		},

internal/provider/resource_credential_store_vault_test.go

@@ -15,11 +15,12 @@ import (
 
 	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/credentialstores"
-	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/boundary/testing/vault"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/blake2b"
 )
 
@@ -102,9 +103,10 @@ func TestSetFromVaultCredentialStoreResponseMapReadsWorkerFilterFromAttributes(t
 }
 
 func TestAccCredentialStoreVault(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	suffix := id.UniqueId()
+	url := cfg.BoundaryAddr
 
 	vc := vault.NewTestVaultServer(t)
 	secret, token := vc.CreateToken(t)
@@ -135,7 +137,7 @@ func TestAccCredentialStoreVault(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// create
-				Config: testConfig(url, fooOrg, firstProjectFoo, res),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, res),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(vaultCredStoreResc, NameKey, vaultCredStoreName),
 					resource.TestCheckResourceAttr(vaultCredStoreResc, DescriptionKey, vaultCredStoreDesc),
@@ -155,7 +157,7 @@ func TestAccCredentialStoreVault(t *testing.T) {
 			importStep(vaultCredStoreResc, credentialStoreVaultTokenKey, credentialStoreVaultClientCertificateKeyKey),
 			{
 				// update
-				Config: testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(vaultCredStoreResc, NameKey, vaultCredStoreName+vaultCredStoreUpdate),
 					resource.TestCheckResourceAttr(vaultCredStoreResc, DescriptionKey, vaultCredStoreDesc+vaultCredStoreUpdate),
@@ -176,7 +178,7 @@ func TestAccCredentialStoreVault(t *testing.T) {
 			{
 				// Run a plan only update and verify no changes
 				PlanOnly: true,
-				Config:   testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+				Config:   testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdate),
 			},
 			importStep(vaultCredStoreResc, credentialStoreVaultTokenKey, credentialStoreVaultClientCertificateKeyKey),
 			{
@@ -186,7 +188,7 @@ func TestAccCredentialStoreVault(t *testing.T) {
 				PreConfig:          func() { externalUpdate(t, provider) },
 				PlanOnly:           true,
 				ExpectNonEmptyPlan: true,
-				Config:             testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+				Config:             testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdate),
 			},
 			importStep(vaultCredStoreResc, credentialStoreVaultTokenKey, credentialStoreVaultClientCertificateKeyKey),
 		},

internal/provider/resource_credential_username_password_domain_test.go

@@ -9,10 +9,11 @@ import (
 	"testing"
 
 	"github.com/hashicorp/boundary/api/credentials"
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/stretchr/testify/require"
 )
 
 const (
@@ -72,9 +73,10 @@ resource "boundary_credential_username_password_domain" "example" {
 }
 
 func TestAccCredentialUsernamePasswordDomain(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	suffix := id.UniqueId()
+	url := cfg.BoundaryAddr
 
 	res := usernamePasswordDomainCredResourceWithDomain(
 		usernamePasswordDomainCredName,
@@ -113,7 +115,7 @@ func TestAccCredentialUsernamePasswordDomain(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// create
-				Config: testConfig(url, fooOrg, firstProjectFoo, res),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, res),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(usernamePasswordDomainCredResc, NameKey, usernamePasswordDomainCredName),
 					resource.TestCheckResourceAttr(usernamePasswordDomainCredResc, DescriptionKey, usernamePasswordDomainCredDesc),
@@ -128,7 +130,7 @@ func TestAccCredentialUsernamePasswordDomain(t *testing.T) {
 			importStep(usernamePasswordDomainCredResc, credentialUsernamePasswordDomainPasswordKey),
 			{
 				// update
-				Config: testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(usernamePasswordDomainCredResc, NameKey, usernamePasswordDomainCredName),
 					resource.TestCheckResourceAttr(usernamePasswordDomainCredResc, DescriptionKey, usernamePasswordDomainCredDesc),
@@ -144,13 +146,13 @@ func TestAccCredentialUsernamePasswordDomain(t *testing.T) {
 			{
 				// run a plan only update and verify no changes
 				PlanOnly: true,
-				Config:   testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+				Config:   testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdate),
 			},
 			importStep(usernamePasswordDomainCredResc, credentialUsernamePasswordDomainPasswordKey),
 			{
 				// update again but apply a preConfig to externally update resource
 				PreConfig: func() { usernamePasswordDomainCredExternalUpdate(t, provider) },
-				Config:    testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+				Config:    testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdate),
 			},
 			importStep(usernamePasswordDomainCredResc, credentialUsernamePasswordDomainPasswordKey),
 		},
@@ -162,7 +164,7 @@ func TestAccCredentialUsernamePasswordDomain(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// create
-				Config: testConfig(url, fooOrg, firstProjectFoo, res),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, res),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(usernamePasswordDomainCredResc, NameKey, usernamePasswordDomainCredName),
 					resource.TestCheckResourceAttr(usernamePasswordDomainCredResc, DescriptionKey, usernamePasswordDomainCredDesc),
@@ -177,7 +179,7 @@ func TestAccCredentialUsernamePasswordDomain(t *testing.T) {
 			importStep(usernamePasswordDomainCredResc, credentialUsernamePasswordDomainPasswordKey),
 			{
 				// update from 3 distinct fields to username@domain.
-				Config: testConfig(url, fooOrg, firstProjectFoo, resUpdateAt),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdateAt),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(usernamePasswordDomainCredResc, NameKey, usernamePasswordDomainCredName),
 					resource.TestCheckResourceAttr(usernamePasswordDomainCredResc, DescriptionKey, usernamePasswordDomainCredDesc),
@@ -199,7 +201,7 @@ func TestAccCredentialUsernamePasswordDomain(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// create
-				Config: testConfig(url, fooOrg, firstProjectFoo, res),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, res),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(usernamePasswordDomainCredResc, NameKey, usernamePasswordDomainCredName),
 					resource.TestCheckResourceAttr(usernamePasswordDomainCredResc, DescriptionKey, usernamePasswordDomainCredDesc),
@@ -214,7 +216,7 @@ func TestAccCredentialUsernamePasswordDomain(t *testing.T) {
 			importStep(usernamePasswordDomainCredResc, credentialUsernamePasswordDomainPasswordKey),
 			{
 				// update from 3 distinct fields to domain\username.
-				Config: testConfig(url, fooOrg, firstProjectFoo, resUpdateSlash),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdateSlash),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(usernamePasswordDomainCredResc, NameKey, usernamePasswordDomainCredName),
 					resource.TestCheckResourceAttr(usernamePasswordDomainCredResc, DescriptionKey, usernamePasswordDomainCredDesc),
@@ -232,9 +234,10 @@ func TestAccCredentialUsernamePasswordDomain(t *testing.T) {
 }
 
 func TestAccCredentialUsernamePasswordDomain_DomainInUsernameFieldUsingAt(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	suffix := id.UniqueId()
+	url := cfg.BoundaryAddr
 
 	res := usernamePasswordDomainCredResourceWithoutDomain(
 		usernamePasswordDomainCredName,
@@ -265,7 +268,7 @@ func TestAccCredentialUsernamePasswordDomain_DomainInUsernameFieldUsingAt(t *tes
 		Steps: []resource.TestStep{
 			{
 				// create
-				Config: testConfig(url, fooOrg, firstProjectFoo, res),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, res),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(usernamePasswordDomainCredResc, NameKey, usernamePasswordDomainCredName),
 					resource.TestCheckResourceAttr(usernamePasswordDomainCredResc, DescriptionKey, usernamePasswordDomainCredDesc),
@@ -280,7 +283,7 @@ func TestAccCredentialUsernamePasswordDomain_DomainInUsernameFieldUsingAt(t *tes
 			importStep(usernamePasswordDomainCredResc, credentialUsernamePasswordDomainPasswordKey),
 			{
 				// update
-				Config: testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(usernamePasswordDomainCredResc, NameKey, usernamePasswordDomainCredName),
 					resource.TestCheckResourceAttr(usernamePasswordDomainCredResc, DescriptionKey, usernamePasswordDomainCredDesc),
@@ -296,18 +299,18 @@ func TestAccCredentialUsernamePasswordDomain_DomainInUsernameFieldUsingAt(t *tes
 			{
 				// Run a plan only update and verify no changes
 				PlanOnly: true,
-				Config:   testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+				Config:   testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdate),
 			},
 			importStep(usernamePasswordDomainCredResc, credentialUsernamePasswordDomainPasswordKey),
 			{
 				// update again but apply a preConfig to externally update resource
 				PreConfig: func() { usernamePasswordDomainCredExternalUpdate(t, provider) },
-				Config:    testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+				Config:    testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdate),
 			},
 			importStep(usernamePasswordDomainCredResc, credentialUsernamePasswordDomainPasswordKey),
 			{
 				// update from username@domain to use all 3 fields separately.
-				Config: testConfig(url, fooOrg, firstProjectFoo, resUpdateSeparateFields),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdateSeparateFields),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(usernamePasswordDomainCredResc, NameKey, usernamePasswordDomainCredName),
 					resource.TestCheckResourceAttr(usernamePasswordDomainCredResc, DescriptionKey, usernamePasswordDomainCredDesc),
@@ -325,9 +328,10 @@ func TestAccCredentialUsernamePasswordDomain_DomainInUsernameFieldUsingAt(t *tes
 }
 
 func TestAccCredentialUsernamePasswordDomain_DomainInUsernameFieldUsingSlash(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	suffix := id.UniqueId()
+	url := cfg.BoundaryAddr
 
 	res := usernamePasswordDomainCredResourceWithoutDomain(
 		usernamePasswordDomainCredName,
@@ -358,7 +362,7 @@ func TestAccCredentialUsernamePasswordDomain_DomainInUsernameFieldUsingSlash(t *
 		Steps: []resource.TestStep{
 			{
 				// create
-				Config: testConfig(url, fooOrg, firstProjectFoo, res),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, res),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(usernamePasswordDomainCredResc, NameKey, usernamePasswordDomainCredName),
 					resource.TestCheckResourceAttr(usernamePasswordDomainCredResc, DescriptionKey, usernamePasswordDomainCredDesc),
@@ -373,7 +377,7 @@ func TestAccCredentialUsernamePasswordDomain_DomainInUsernameFieldUsingSlash(t *
 			importStep(usernamePasswordDomainCredResc, credentialUsernamePasswordDomainPasswordKey),
 			{
 				// update
-				Config: testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(usernamePasswordDomainCredResc, NameKey, usernamePasswordDomainCredName),
 					resource.TestCheckResourceAttr(usernamePasswordDomainCredResc, DescriptionKey, usernamePasswordDomainCredDesc),
@@ -389,18 +393,18 @@ func TestAccCredentialUsernamePasswordDomain_DomainInUsernameFieldUsingSlash(t *
 			{
 				// Run a plan only update and verify no changes
 				PlanOnly: true,
-				Config:   testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+				Config:   testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdate),
 			},
 			importStep(usernamePasswordDomainCredResc, credentialUsernamePasswordDomainPasswordKey),
 			{
 				// update again but apply a preConfig to externally update resource
 				PreConfig: func() { usernamePasswordDomainCredExternalUpdate(t, provider) },
-				Config:    testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+				Config:    testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdate),
 			},
 			importStep(usernamePasswordDomainCredResc, credentialUsernamePasswordDomainPasswordKey),
 			{
 				// update from domain\username to use all 3 fields separately.
-				Config: testConfig(url, fooOrg, firstProjectFoo, resUpdateSeparateFields),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdateSeparateFields),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(usernamePasswordDomainCredResc, NameKey, usernamePasswordDomainCredName),
 					resource.TestCheckResourceAttr(usernamePasswordDomainCredResc, DescriptionKey, usernamePasswordDomainCredDesc),
@@ -421,9 +425,10 @@ func TestAccCredentialUsernamePasswordDomain_DomainInUsernameFieldUsingSlash(t *
 // customization function by testing the diff equivalency of different
 // combinations of inputs.
 func TestResourceCredentialUsernamePasswordDomainCustomizeDiff(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	suffix := id.UniqueId()
+	url := cfg.BoundaryAddr
 
 	tests := []struct {
 		name            string
@@ -567,7 +572,7 @@ func TestResourceCredentialUsernamePasswordDomainCustomizeDiff(t *testing.T) {
 				Steps: []resource.TestStep{
 					{
 						// Create resource.
-						Config: testConfig(url, fooOrg, firstProjectFoo, tt.createResource),
+						Config: testConfig(url, fooOrg(suffix), firstProjectFoo, tt.createResource),
 						Check: resource.ComposeTestCheckFunc(
 							resource.TestCheckResourceAttr(usernamePasswordDomainCredResc, NameKey, usernamePasswordDomainCredName),
 							resource.TestCheckResourceAttr(usernamePasswordDomainCredResc, DescriptionKey, usernamePasswordDomainCredDesc),
@@ -583,7 +588,7 @@ func TestResourceCredentialUsernamePasswordDomainCustomizeDiff(t *testing.T) {
 					{
 						// Run a plan-only update on itself and verify no changes.
 						PlanOnly: true,
-						Config:   testConfig(url, fooOrg, firstProjectFoo, tt.createResource),
+						Config:   testConfig(url, fooOrg(suffix), firstProjectFoo, tt.createResource),
 					},
 					importStep(usernamePasswordDomainCredResc, credentialUsernamePasswordDomainPasswordKey),
 				},
@@ -592,7 +597,7 @@ func TestResourceCredentialUsernamePasswordDomainCustomizeDiff(t *testing.T) {
 			for _, resUpdate := range tt.planOnlyUpdates {
 				tc.Steps = append(tc.Steps, resource.TestStep{
 					PlanOnly: true,
-					Config:   testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+					Config:   testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdate),
 				}, importStep(usernamePasswordDomainCredResc, credentialUsernamePasswordDomainPasswordKey))
 			}
 

internal/provider/resource_credential_username_password_test.go

@@ -9,10 +9,11 @@ import (
 	"testing"
 
 	"github.com/hashicorp/boundary/api/credentials"
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/stretchr/testify/require"
 )
 
 const (
@@ -46,9 +47,10 @@ resource "boundary_credential_username_password" "example" {
 }
 
 func TestAccCredentialUsernamePassword(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	suffix := id.UniqueId()
+	url := cfg.BoundaryAddr
 
 	res := usernamePasswordCredResource(
 		usernamePasswordCredName,
@@ -71,7 +73,7 @@ func TestAccCredentialUsernamePassword(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// create
-				Config: testConfig(url, fooOrg, firstProjectFoo, res),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, res),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(usernamePasswordCredResc, NameKey, usernamePasswordCredName),
 					resource.TestCheckResourceAttr(usernamePasswordCredResc, DescriptionKey, usernamePasswordCredDesc),
@@ -85,7 +87,7 @@ func TestAccCredentialUsernamePassword(t *testing.T) {
 			importStep(usernamePasswordCredResc, credentialUsernamePasswordPasswordKey),
 			{
 				// update
-				Config: testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(usernamePasswordCredResc, NameKey, usernamePasswordCredName),
 					resource.TestCheckResourceAttr(usernamePasswordCredResc, DescriptionKey, usernamePasswordCredDesc),
@@ -100,13 +102,13 @@ func TestAccCredentialUsernamePassword(t *testing.T) {
 			{
 				// Run a plan only update and verify no changes
 				PlanOnly: true,
-				Config:   testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+				Config:   testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdate),
 			},
 			importStep(usernamePasswordCredResc, credentialUsernamePasswordPasswordKey),
 			{
 				// update again but apply a preConfig to externally update resource
 				PreConfig: func() { usernamePasswordCredExternalUpdate(t, provider) },
-				Config:    testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+				Config:    testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdate),
 			},
 			importStep(usernamePasswordCredResc, credentialUsernamePasswordPasswordKey),
 		},

internal/provider/resource_group_test.go

@@ -12,10 +12,11 @@ import (
 
 	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/groups"
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/stretchr/testify/require"
 )
 
 const (
@@ -117,11 +118,10 @@ resource "boundary_group" "proj1" {
 
 // NOTE: this test also tests out the recovery KMS mechanism.
 func TestAccGroup(t *testing.T) {
-	wrapper := testWrapper(context.Background(), t, tcRecoveryKey)
+	cfg, err := loadTestConfig()
-	tc := controller.NewTestController(t, append(tcConfig, controller.WithRecoveryKms(wrapper))...)
+	require.NoError(t, err)
-
+	url := cfg.BoundaryAddr
-	defer tc.Shutdown()
+	suffix := id.UniqueId()
-	url := tc.ApiAddrs()[0]
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
@@ -131,7 +131,7 @@ func TestAccGroup(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// test create
-				Config: testConfigWithRecovery(url, fooOrg, orgGroup),
+				Config: testConfigWithRecovery(t, url, fooOrg(suffix), orgGroup),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGroupResourceExists(provider, "boundary_group.org1"),
 					resource.TestCheckResourceAttr("boundary_group.org1", DescriptionKey, fooGroupDescription),
@@ -141,7 +141,7 @@ func TestAccGroup(t *testing.T) {
 			importStep("boundary_group.org1"),
 			{
 				// test update
-				Config: testConfigWithRecovery(url, fooOrg, orgGroupUpdate),
+				Config: testConfigWithRecovery(t, url, fooOrg(suffix), orgGroupUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGroupResourceExists(provider, "boundary_group.org1"),
 					resource.TestCheckResourceAttr("boundary_group.org1", DescriptionKey, fooGroupDescriptionUpdate),
@@ -150,7 +150,7 @@ func TestAccGroup(t *testing.T) {
 			importStep("boundary_group.org1"),
 			{
 				// test update to project scope
-				Config: testConfigWithRecovery(url, fooOrg, firstProjectFoo, orgToProjectGroupUpdate),
+				Config: testConfigWithRecovery(t, url, fooOrg(suffix), firstProjectFoo, orgToProjectGroupUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGroupResourceExists(provider, "boundary_group.org1"),
 					resource.TestCheckResourceAttr("boundary_group.org1", DescriptionKey, "org1-test-to-proj"),
@@ -160,7 +160,7 @@ func TestAccGroup(t *testing.T) {
 			importStep("boundary_group.org1"),
 			{
 				// test create
-				Config: testConfigWithRecovery(url, fooOrg, firstProjectFoo, projGroup),
+				Config: testConfigWithRecovery(t, url, fooOrg(suffix), firstProjectFoo, projGroup),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGroupResourceExists(provider, "boundary_group.proj1"),
 					resource.TestCheckResourceAttr("boundary_group.proj1", DescriptionKey, "desc-test-proj"),
@@ -171,7 +171,7 @@ func TestAccGroup(t *testing.T) {
 			importStep("boundary_group.proj1"),
 			{
 				// test update
-				Config: testConfigWithRecovery(url, fooOrg, firstProjectFoo, projGroupUpdate),
+				Config: testConfigWithRecovery(t, url, fooOrg(suffix), firstProjectFoo, projGroupUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGroupResourceExists(provider, "boundary_group.proj1"),
 					resource.TestCheckResourceAttr("boundary_group.proj1", DescriptionKey, "desc-test-proj-up"),
@@ -181,7 +181,7 @@ func TestAccGroup(t *testing.T) {
 			importStep("boundary_group.proj1"),
 			{
 				// test name removal
-				Config: testConfigWithRecovery(url, fooOrg, firstProjectFoo, projNameRemoval),
+				Config: testConfigWithRecovery(t, url, fooOrg(suffix), firstProjectFoo, projNameRemoval),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGroupResourceExists(provider, "boundary_group.proj1"),
 					resource.TestCheckResourceAttr("boundary_group.proj1", NameKey, ""),
@@ -191,7 +191,7 @@ func TestAccGroup(t *testing.T) {
 			importStep("boundary_group.proj1"),
 			{
 				// test update to org scope
-				Config: testConfigWithRecovery(url, fooOrg, firstProjectFoo, projToOrgGroupUpdate),
+				Config: testConfigWithRecovery(t, url, fooOrg(suffix), firstProjectFoo, projToOrgGroupUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGroupResourceExists(provider, "boundary_group.proj1"),
 					resource.TestCheckResourceAttr("boundary_group.proj1", DescriptionKey, "desc-back"),
@@ -204,10 +204,10 @@ func TestAccGroup(t *testing.T) {
 }
 
 func TestAccGroupWithMembers(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-
+	require.NoError(t, err)
-	defer tc.Shutdown()
+	url := cfg.BoundaryAddr
-	url := tc.ApiAddrs()[0]
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
@@ -217,7 +217,7 @@ func TestAccGroupWithMembers(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// test create
-				Config: testConfig(url, fooOrg, orgGroupWithMembers),
+				Config: testConfig(url, fooOrg(suffix), orgGroupWithMembers),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGroupResourceExists(provider, "boundary_group.with_members"),
 					testAccCheckUserResourceExists(provider, "boundary_user.org1"),
@@ -228,7 +228,7 @@ func TestAccGroupWithMembers(t *testing.T) {
 			importStep("boundary_group.with_members"),
 			{
 				// test update
-				Config: testConfig(url, fooOrg, orgGroupWithMembersUpdate),
+				Config: testConfig(url, fooOrg(suffix), orgGroupWithMembersUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGroupResourceExists(provider, "boundary_group.with_members"),
 					testAccCheckUserResourceExists(provider, "boundary_user.org1"),

internal/provider/resource_host_catalog_plugin_test.go

@@ -11,11 +11,12 @@ import (
 	"testing"
 
 	"github.com/hashicorp/boundary/api/hostcatalogs"
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
 	_ "github.com/kr/pretty" // So I don't have to keep adding to/removing from go.mod :-)
+	"github.com/stretchr/testify/require"
 )
 
 const (
@@ -24,7 +25,7 @@ const (
 	testPluginHostCatalogDescriptionUpdate2 = "bar foo foo"
 
 	testPluginHostCatalogWorkerFilterUpdate  = "\"dev\" in \"/tags/type\""
-	testPluginHostCatalogWorkerFilterUpdate2 = "\"pki\" in \"/tags/type\""
+	testPluginHostCatalogWorkerFilterUpdate2 = "\"local\" in \"/tags/type\""
 )
 
 // expectedAttributesState is used here and in plugin host sets to control how
@@ -36,6 +37,8 @@ const (
 	expectedAttributesStatePreviouslySetNoChange
 	expectedAttributesStatePreviouslySetButChanged
 	expectedAttributesStatePreviouslySetNowEmpty
+	expectedAttributesStateAttrsNowEmpty
+	expectedAttributesStateAttrsRestoredSecretsChanged
 )
 
 var projPluginHostCatalogBase = `
@@ -58,9 +61,10 @@ var (
 // different. Thus expectedAttributesState also controls expectations for
 // secrets.
 func TestAccPluginHostCatalog(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	suffix := id.UniqueId()
+	url := cfg.BoundaryAddr
 
 	resName := "boundary_host_catalog_plugin.foo"
 	initialValuesStr := fmt.Sprintf(
@@ -168,7 +172,7 @@ func TestAccPluginHostCatalog(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// test create
-				Config: testConfig(url, fooOrg, firstProjectFoo, initialHcl),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, initialHcl),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckScopeResourceExists(provider, "boundary_scope.org1"),
 					testAccCheckScopeResourceExists(provider, "boundary_scope.proj1"),
@@ -180,7 +184,7 @@ func TestAccPluginHostCatalog(t *testing.T) {
 			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
 			{
 				// test update
-				Config: testConfig(url, fooOrg, firstProjectFoo, update1Hcl),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, update1Hcl),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPluginHostCatalogResourceExists(provider, resName, expectedAttributesStatePreviouslySetButChanged),
 					resource.TestCheckResourceAttr(resName, DescriptionKey, testPluginHostCatalogDescriptionUpdate),
@@ -190,7 +194,7 @@ func TestAccPluginHostCatalog(t *testing.T) {
 			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
 			{
 				// test update
-				Config: testConfig(url, fooOrg, firstProjectFoo, update2Hcl),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, update2Hcl),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPluginHostCatalogResourceExists(provider, resName, expectedAttributesStatePreviouslySetNoChange),
 					resource.TestCheckResourceAttr(resName, DescriptionKey, testPluginHostCatalogDescriptionUpdate2),
@@ -202,7 +206,7 @@ func TestAccPluginHostCatalog(t *testing.T) {
 				// this runs the same HCL; mostly used in some manual checking
 				// to ensure update is still called even when nothing has
 				// changed (as we need for secrets)
-				Config: testConfig(url, fooOrg, firstProjectFoo, update2Hcl),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, update2Hcl),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPluginHostCatalogResourceExists(provider, resName, expectedAttributesStatePreviouslySetNoChange),
 					resource.TestCheckResourceAttr(resName, DescriptionKey, testPluginHostCatalogDescriptionUpdate2),
@@ -212,7 +216,7 @@ func TestAccPluginHostCatalog(t *testing.T) {
 			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
 			{
 				// test update
-				Config: testConfig(url, fooOrg, firstProjectFoo, update3Hcl),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, update3Hcl),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPluginHostCatalogResourceExists(provider, resName, expectedAttributesStatePreviouslySetNoChange),
 					resource.TestCheckResourceAttr(resName, DescriptionKey, testPluginHostCatalogDescriptionUpdate2),
@@ -222,7 +226,7 @@ func TestAccPluginHostCatalog(t *testing.T) {
 			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
 			{
 				// test update
-				Config: testConfig(url, fooOrg, firstProjectFoo, update4Hcl),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, update4Hcl),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPluginHostCatalogResourceExists(provider, resName, expectedAttributesStatePreviouslySetNowEmpty),
 					resource.TestCheckResourceAttr(resName, DescriptionKey, testPluginHostCatalogDescriptionUpdate2),
@@ -232,7 +236,7 @@ func TestAccPluginHostCatalog(t *testing.T) {
 			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
 			{
 				// test update
-				Config: testConfig(url, fooOrg, firstProjectFoo, update5Hcl),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, update5Hcl),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPluginHostCatalogResourceExists(provider, resName, expectedAttributesStatePreviouslyEmptyNowSet),
 					resource.TestCheckResourceAttr(resName, DescriptionKey, testPluginHostCatalogDescriptionUpdate2),
@@ -242,7 +246,7 @@ func TestAccPluginHostCatalog(t *testing.T) {
 			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
 			{
 				// test update
-				Config: testConfig(url, fooOrg, firstProjectFoo, update6Hcl),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, update6Hcl),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPluginHostCatalogResourceExists(provider, resName, expectedAttributesStatePreviouslySetNowEmpty),
 					resource.TestCheckResourceAttr(resName, DescriptionKey, testPluginHostCatalogDescriptionUpdate2),
@@ -255,11 +259,10 @@ func TestAccPluginHostCatalog(t *testing.T) {
 }
 
 func TestAccPluginHostCatalogWithWorkerFilter(t *testing.T) {
-	t.Skip("Skipping test until Boundary Terraform Provider can unit tests for Boundary Enterprise only features")
+	cfg, err := loadTestConfig()
-
+	require.NoError(t, err)
-	tc := controller.NewTestController(t, tcConfig...)
+	suffix := id.UniqueId()
-	defer tc.Shutdown()
+	url := cfg.BoundaryAddr
-	url := tc.ApiAddrs()[0]
 
 	resName := "boundary_host_catalog_plugin.foo"
 	initialValuesStr := fmt.Sprintf(
@@ -377,7 +380,7 @@ func TestAccPluginHostCatalogWithWorkerFilter(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// test create
-				Config: testConfig(url, fooOrg, firstProjectFoo, initialHcl),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, initialHcl),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckScopeResourceExists(provider, "boundary_scope.org1"),
 					testAccCheckScopeResourceExists(provider, "boundary_scope.proj1"),
@@ -389,7 +392,7 @@ func TestAccPluginHostCatalogWithWorkerFilter(t *testing.T) {
 			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
 			{
 				// test update
-				Config: testConfig(url, fooOrg, firstProjectFoo, update1Hcl),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, update1Hcl),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPluginHostCatalogResourceExists(provider, resName, expectedAttributesStatePreviouslySetButChanged),
 					resource.TestCheckResourceAttr(resName, DescriptionKey, testPluginHostCatalogDescriptionUpdate),
@@ -400,7 +403,7 @@ func TestAccPluginHostCatalogWithWorkerFilter(t *testing.T) {
 			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
 			{
 				// test update
-				Config: testConfig(url, fooOrg, firstProjectFoo, update2Hcl),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, update2Hcl),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPluginHostCatalogResourceExists(provider, resName, expectedAttributesStatePreviouslySetNoChange),
 					resource.TestCheckResourceAttr(resName, DescriptionKey, testPluginHostCatalogDescriptionUpdate2),
@@ -412,7 +415,7 @@ func TestAccPluginHostCatalogWithWorkerFilter(t *testing.T) {
 				// this runs the same HCL; mostly used in some manual checking
 				// to ensure update is still called even when nothing has
 				// changed (as we need for secrets)
-				Config: testConfig(url, fooOrg, firstProjectFoo, update2Hcl),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, update2Hcl),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPluginHostCatalogResourceExists(provider, resName, expectedAttributesStatePreviouslySetNoChange),
 					resource.TestCheckResourceAttr(resName, DescriptionKey, testPluginHostCatalogDescriptionUpdate2),
@@ -422,7 +425,7 @@ func TestAccPluginHostCatalogWithWorkerFilter(t *testing.T) {
 			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
 			{
 				// test update
-				Config: testConfig(url, fooOrg, firstProjectFoo, update3Hcl),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, update3Hcl),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPluginHostCatalogResourceExists(provider, resName, expectedAttributesStatePreviouslySetNoChange),
 					resource.TestCheckResourceAttr(resName, DescriptionKey, testPluginHostCatalogDescriptionUpdate2),
@@ -433,7 +436,7 @@ func TestAccPluginHostCatalogWithWorkerFilter(t *testing.T) {
 			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
 			{
 				// test update
-				Config: testConfig(url, fooOrg, firstProjectFoo, update4Hcl),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, update4Hcl),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPluginHostCatalogResourceExists(provider, resName, expectedAttributesStatePreviouslySetNowEmpty),
 					resource.TestCheckResourceAttr(resName, DescriptionKey, testPluginHostCatalogDescriptionUpdate2),
@@ -443,7 +446,7 @@ func TestAccPluginHostCatalogWithWorkerFilter(t *testing.T) {
 			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
 			{
 				// test update
-				Config: testConfig(url, fooOrg, firstProjectFoo, update5Hcl),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, update5Hcl),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPluginHostCatalogResourceExists(provider, resName, expectedAttributesStatePreviouslyEmptyNowSet),
 					resource.TestCheckResourceAttr(resName, DescriptionKey, testPluginHostCatalogDescriptionUpdate2),
@@ -454,7 +457,7 @@ func TestAccPluginHostCatalogWithWorkerFilter(t *testing.T) {
 			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
 			{
 				// test update
-				Config: testConfig(url, fooOrg, firstProjectFoo, update6Hcl),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, update6Hcl),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckPluginHostCatalogResourceExists(provider, resName, expectedAttributesStatePreviouslySetNowEmpty),
 					resource.TestCheckResourceAttr(resName, DescriptionKey, testPluginHostCatalogDescriptionUpdate2),

internal/provider/resource_host_catalog_static_test.go

@@ -11,10 +11,11 @@ import (
 
 	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/hostcatalogs"
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/stretchr/testify/require"
 )
 
 const (
@@ -54,9 +55,10 @@ func TestAccHostCatalogCreate(t *testing.T) {
 }
 
 func testAccHostCatalog(t *testing.T, static bool) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	suffix := id.UniqueId()
+	url := cfg.BoundaryAddr
 
 	resName := "boundary_host_catalog"
 	typeStr := `type = "static"`
@@ -74,7 +76,7 @@ func testAccHostCatalog(t *testing.T, static bool) {
 		Steps: []resource.TestStep{
 			{
 				// test create
-				Config: testConfig(url, fooOrg, firstProjectFoo, hc),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, hc),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckScopeResourceExists(provider, "boundary_scope.org1"),
 					testAccCheckScopeResourceExists(provider, "boundary_scope.proj1"),
@@ -85,7 +87,7 @@ func testAccHostCatalog(t *testing.T, static bool) {
 			importStep(fooName),
 			{
 				// test update
-				Config: testConfig(url, fooOrg, firstProjectFoo, hcu),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, hcu),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckHostCatalogResourceExists(provider, fooName),
 					resource.TestCheckResourceAttr(fooName, DescriptionKey, fooHostCatalogDescriptionUpdate),

internal/provider/resource_host_set_plugin_test.go

@@ -11,7 +11,7 @@ import (
 	"testing"
 
 	"github.com/hashicorp/boundary/api/hostsets"
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
@@ -53,9 +53,10 @@ func TestAccHostSetPlugin(t *testing.T) {
 		%s
 	}`
 
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	suffix := id.UniqueId()
+	url := cfg.BoundaryAddr
 	fooSetName := "boundary_host_set_plugin.foo"
 
 	attrBlock1 := `attributes_json = jsonencode({
@@ -91,7 +92,7 @@ func TestAccHostSetPlugin(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// test project hostset create
-				Config: testConfig(url, fooOrg, firstProjectFoo, catalogBlock, hsBlock),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, catalogBlock, hsBlock),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckHostSetPluginResourceExists(provider, fooSetName, expectedAttributesStatePreviouslyEmptyNowSet),
 					resource.TestCheckResourceAttr(fooSetName, NameKey, "test"),
@@ -104,7 +105,7 @@ func TestAccHostSetPlugin(t *testing.T) {
 			importStep(fooSetName),
 			{
 				// test project hostset update
-				Config: testConfig(url, fooOrg, firstProjectFoo, catalogBlock, hsUpdate1Block),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, catalogBlock, hsUpdate1Block),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckHostSetPluginResourceExists(provider, fooSetName, expectedAttributesStatePreviouslySetButChanged),
 					resource.TestCheckResourceAttr(fooSetName, NameKey, "test"),
@@ -117,7 +118,7 @@ func TestAccHostSetPlugin(t *testing.T) {
 			importStep(fooSetName),
 			{
 				// test project hostset update
-				Config: testConfig(url, fooOrg, firstProjectFoo, catalogBlock, hsUpdate2Block),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, catalogBlock, hsUpdate2Block),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckHostSetPluginResourceExists(provider, fooSetName, expectedAttributesStatePreviouslySetNoChange),
 					resource.TestCheckResourceAttr(fooSetName, NameKey, "test"),
@@ -130,7 +131,7 @@ func TestAccHostSetPlugin(t *testing.T) {
 			importStep(fooSetName),
 			{
 				// test project hostset update
-				Config: testConfig(url, fooOrg, firstProjectFoo, catalogBlock, hsUpdate3Block),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, catalogBlock, hsUpdate3Block),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckHostSetPluginResourceExists(provider, fooSetName, expectedAttributesStatePreviouslySetNowEmpty),
 					resource.TestCheckResourceAttr(fooSetName, NameKey, "test"),
@@ -143,7 +144,7 @@ func TestAccHostSetPlugin(t *testing.T) {
 			importStep(fooSetName),
 			{
 				// test project hostset update
-				Config: testConfig(url, fooOrg, firstProjectFoo, catalogBlock, hsUpdate4Block),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, catalogBlock, hsUpdate4Block),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckHostSetPluginResourceExists(provider, fooSetName, expectedAttributesStatePreviouslyEmptyNowSet),
 					resource.TestCheckResourceAttr(fooSetName, NameKey, "test"),
@@ -156,7 +157,7 @@ func TestAccHostSetPlugin(t *testing.T) {
 			importStep(fooSetName),
 			{
 				// test project hostset update
-				Config: testConfig(url, fooOrg, firstProjectFoo, catalogBlock, hsUpdate5Block),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, catalogBlock, hsUpdate5Block),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckHostSetPluginResourceExists(provider, fooSetName, expectedAttributesStatePreviouslySetNowEmpty),
 					resource.TestCheckResourceAttr(fooSetName, NameKey, "test"),

internal/provider/resource_host_set_static_test.go

@@ -11,10 +11,11 @@ import (
 
 	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/hostsets"
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/stretchr/testify/require"
 )
 
 func TestAccHostSetStatic(t *testing.T) {
@@ -59,10 +60,10 @@ func testAccHostSetStatic(t *testing.T, static bool) {
 		address         = "10.0.0.2"
 	}`
 
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	//	org := iam.TestOrg(t, tc.IamRepo())
+	suffix := id.UniqueId()
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
 
 	catalogName := "boundary_host_catalog"
 	hostName := "boundary_host"
@@ -90,7 +91,7 @@ func testAccHostSetStatic(t *testing.T, static bool) {
 		Steps: []resource.TestStep{
 			{
 				// test project hostset create
-				Config: testConfig(url, fooOrg, firstProjectFoo, hcBlock, hBlock, hsBlock),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, hcBlock, hBlock, hsBlock),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckHostSetStaticResourceExists(provider, fooSetName),
 					testAccCheckHostSetStaticHostIDsSet(provider, fooSetName, []string{fooHostName}),
@@ -101,7 +102,7 @@ func testAccHostSetStatic(t *testing.T, static bool) {
 			importStep(fooSetName),
 			{
 				// test project hostset update
-				Config: testConfig(url, fooOrg, firstProjectFoo, hcBlock, hBlock, h2Block, hsUpdateBlock),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, hcBlock, hBlock, h2Block, hsUpdateBlock),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckHostSetStaticResourceExists(provider, fooSetName),
 					testAccCheckHostSetStaticHostIDsSet(provider, fooSetName, []string{fooHostName, barHostName}),

internal/provider/resource_host_static_test.go

@@ -12,10 +12,11 @@ import (
 
 	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/hosts"
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/stretchr/testify/require"
 )
 
 func TestAccHost(t *testing.T) {
@@ -53,10 +54,10 @@ func testAccHost(t *testing.T, static bool) {
 		address         = "%s"
 	}`
 
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	//	org := iam.TestOrg(t, tc.IamRepo())
+	suffix := id.UniqueId()
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
 
 	catalogName := "boundary_host_catalog"
 	hostName := "boundary_host"
@@ -78,7 +79,7 @@ func testAccHost(t *testing.T, static bool) {
 		Steps: []resource.TestStep{
 			{
 				// test project host create
-				Config: testConfig(url, fooOrg, firstProjectFoo, hcBlock, hostBlock),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, hcBlock, hostBlock),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckHostAttributeSet(provider, fooHostName, "address", fooHostAddress),
 					testAccCheckHostResourceExists(provider, fooHostName),
@@ -90,7 +91,7 @@ func testAccHost(t *testing.T, static bool) {
 			importStep(fooHostName),
 			{
 				// test project host update
-				Config: testConfig(url, fooOrg, firstProjectFoo, hcBlock, hostUpdateBlock),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, hcBlock, hostUpdateBlock),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckHostAttributeSet(provider, fooHostName, "address", fooHostAddressUpdate),
 					testAccCheckHostResourceExists(provider, fooHostName),

internal/provider/resource_managed_group_ldap_test.go

@@ -10,10 +10,11 @@ import (
 	"testing"
 
 	"github.com/hashicorp/boundary/api/managedgroups"
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/stretchr/testify/require"
 )
 
 var (
@@ -35,14 +36,13 @@ resource "boundary_managed_group_ldap" "foo" {
 )
 
 func TestAccManagedGroupLdap(t *testing.T) {
-	wrapper := testWrapper(context.Background(), t, tcRecoveryKey)
+	cfg, err := loadTestConfig()
-	tc := controller.NewTestController(t, append(tcConfig, controller.WithRecoveryKms(wrapper))...)
+	require.NoError(t, err)
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	createConfig := fmt.Sprintf(testAuthMethodLdap, testAuthMethodLdapDesc, testAuthMethodLdapCert)
 
-	defer tc.Shutdown()
-	url := tc.ApiAddrs()[0]
-
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
@@ -50,7 +50,7 @@ func TestAccManagedGroupLdap(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// test create
-				Config: testConfig(url, fooOrg, createConfig, fooManagedGroupLdap),
+				Config: testConfig(url, fooOrg(suffix), createConfig, fooManagedGroupLdap),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckManagedGroupResourceExists(provider, "boundary_managed_group_ldap.foo"),
 					resource.TestCheckResourceAttr("boundary_managed_group_ldap.foo", DescriptionKey, managedGroupDescription),
@@ -61,7 +61,7 @@ func TestAccManagedGroupLdap(t *testing.T) {
 			importStep("boundary_managed_group_ldap.foo"),
 			{
 				// test update
-				Config: testConfig(url, fooOrg, createConfig, fooManagedGroupLdapUpdate),
+				Config: testConfig(url, fooOrg(suffix), createConfig, fooManagedGroupLdapUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckManagedGroupResourceExists(provider, "boundary_managed_group_ldap.foo"),
 					resource.TestCheckResourceAttr("boundary_managed_group_ldap.foo", DescriptionKey, managedGroupDescription+managedGroupUpdate),

internal/provider/resource_managed_group_test.go

@@ -12,11 +12,12 @@ import (
 
 	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/managedgroups"
-	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/cap/oidc"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/stretchr/testify/require"
 )
 
 const (
@@ -44,15 +45,14 @@ resource "boundary_managed_group" "foo" {
 )
 
 func TestAccManagedGroup(t *testing.T) {
-	wrapper := testWrapper(context.Background(), t, tcRecoveryKey)
 	tp := oidc.StartTestProvider(t)
-	tc := controller.NewTestController(t, append(tcConfig, controller.WithRecoveryKms(wrapper))...)
-
 	tpCert := strings.TrimSpace(tp.CACert())
 	createConfig := fmt.Sprintf(fooAuthMethodOidc, fooAuthMethodOidcDesc, tp.Addr(), tpCert)
 
-	defer tc.Shutdown()
+	cfg, err := loadTestConfig()
-	url := tc.ApiAddrs()[0]
+	require.NoError(t, err)
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
@@ -61,7 +61,7 @@ func TestAccManagedGroup(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// test create
-				Config: testConfig(url, fooOrg, createConfig, fooManagedGroup),
+				Config: testConfig(url, fooOrg(suffix), createConfig, fooManagedGroup),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckManagedGroupResourceExists(provider, "boundary_managed_group.foo"),
 					resource.TestCheckResourceAttr("boundary_managed_group.foo", DescriptionKey, managedGroupDescription),
@@ -72,7 +72,7 @@ func TestAccManagedGroup(t *testing.T) {
 			importStep("boundary_managed_group.foo"),
 			{
 				// test update
-				Config: testConfig(url, fooOrg, createConfig, fooManagedGroupUpdate),
+				Config: testConfig(url, fooOrg(suffix), createConfig, fooManagedGroupUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckManagedGroupResourceExists(provider, "boundary_managed_group.foo"),
 					resource.TestCheckResourceAttr("boundary_managed_group.foo", DescriptionKey, managedGroupDescription+managedGroupUpdate),

internal/provider/resource_role_grant_scope_ids_upgrade_test.go

@@ -10,10 +10,11 @@ import (
 	"testing"
 
 	"github.com/hashicorp/boundary/api/roles"
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/stretchr/testify/require"
 )
 
 var (
@@ -51,9 +52,10 @@ var (
 // TestAccRoleWithGrantScopes exercises creation and update with valid and
 // invalid grant scopes
 func TestAccRoleWithGrantScopes(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	t.Cleanup(tc.Shutdown)
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
@@ -63,7 +65,7 @@ func TestAccRoleWithGrantScopes(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// Create with valid grant scopes should create role
-				Config: testConfig(url, fooOrg, firstProjectFoo, fooUser, orgRoleWithGrantScopes),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, fooUser, orgRoleWithGrantScopes),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckScopeResourceExists(provider, "boundary_scope.proj1"),
 					testAccCheckRoleResourceExists(provider, "boundary_role.with_grant_scopes"),
@@ -77,7 +79,7 @@ func TestAccRoleWithGrantScopes(t *testing.T) {
 			{
 				// Update with invalid grant scopes should update role but return empty plan
 				// since grant scopes were not set correctly.
-				Config: testConfig(url, fooOrg, firstProjectFoo, fooUser, orgRoleWithInvalidGrantScopesUpdate),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, fooUser, orgRoleWithInvalidGrantScopesUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRoleResourceExists(provider, "boundary_role.with_grant_scopes"),
 					resource.TestCheckResourceAttr("boundary_role.with_grant_scopes", DescriptionKey, "with grant scopes update"),
@@ -87,7 +89,7 @@ func TestAccRoleWithGrantScopes(t *testing.T) {
 			},
 			{
 				// Update again without invalid principal should produce empty plan
-				Config: testConfig(url, fooOrg, firstProjectFoo, fooUser, orgRoleWithGrantScopesUpdate),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, fooUser, orgRoleWithGrantScopesUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRoleResourceExists(provider, "boundary_role.with_grant_scopes"),
 					testAccCheckRoleResourceGrantScopesSet(provider, "boundary_role.with_grant_scopes", []string{"this", "children"}),

internal/provider/resource_role_test.go

@@ -14,10 +14,11 @@ import (
 
 	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/roles"
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/stretchr/testify/require"
 )
 
 const (
@@ -188,9 +189,10 @@ resource "boundary_role" "with_grants" {
 )
 
 func TestAccRoleToOrgToProject(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	t.Cleanup(tc.Shutdown)
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
@@ -199,7 +201,7 @@ func TestAccRoleToOrgToProject(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// test org role create
-				Config: testConfig(url, fooOrg, orgRole),
+				Config: testConfig(url, fooOrg(suffix), orgRole),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRoleResourceExists(provider, "boundary_role.foo"),
 					resource.TestCheckResourceAttr("boundary_role.foo", "name", "test"),
@@ -209,7 +211,7 @@ func TestAccRoleToOrgToProject(t *testing.T) {
 			importStep("boundary_role.foo"),
 			{
 				// test org role update
-				Config: testConfig(url, fooOrg, orgRoleUpdate),
+				Config: testConfig(url, fooOrg(suffix), orgRoleUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRoleResourceExists(provider, "boundary_role.foo"),
 					resource.TestCheckResourceAttr("boundary_role.foo", "name", "test"),
@@ -219,7 +221,7 @@ func TestAccRoleToOrgToProject(t *testing.T) {
 			importStep("boundary_role.foo"),
 			{
 				// test org to project role create
-				Config: testConfig(url, fooOrg, firstProjectFoo, projRole),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, projRole),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRoleResourceExists(provider, "boundary_role.foo"),
 					resource.TestCheckResourceAttr("boundary_role.foo", "name", "test"),
@@ -229,7 +231,7 @@ func TestAccRoleToOrgToProject(t *testing.T) {
 			importStep("boundary_role.foo"),
 			{
 				// test project role update
-				Config: testConfig(url, fooOrg, firstProjectFoo, projRoleUpdate),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, projRoleUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRoleResourceExists(provider, "boundary_role.foo"),
 					resource.TestCheckResourceAttr("boundary_role.foo", "name", "test"),
@@ -242,9 +244,10 @@ func TestAccRoleToOrgToProject(t *testing.T) {
 }
 
 func TestAccRoleWithGrants(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	t.Cleanup(tc.Shutdown)
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
@@ -255,7 +258,7 @@ func TestAccRoleWithGrants(t *testing.T) {
 			{
 				// Create should return error due to invalid grant, however the role will still
 				// be created and should be set in state.
-				Config: testConfig(url, fooOrg, firstProjectFoo, projRoleWithInvalidGrants),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, projRoleWithInvalidGrants),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRoleResourceExists(provider, "boundary_role.with_grants"),
 					resource.TestCheckResourceAttr("boundary_role.with_grants", "name", "with_grants"),
@@ -265,7 +268,7 @@ func TestAccRoleWithGrants(t *testing.T) {
 			},
 			{
 				// Create again with valid grants should succeed
-				Config: testConfig(url, fooOrg, firstProjectFoo, projRoleWithGrants),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, projRoleWithGrants),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRoleResourceExists(provider, "boundary_role.with_grants"),
 					testAccCheckRoleResourceGrantsSet(provider, "boundary_role.with_grants", []string{readonlyGrant}),
@@ -277,7 +280,7 @@ func TestAccRoleWithGrants(t *testing.T) {
 			{
 				// Update should return error due to invalid grant, however the role will still
 				// be updated and should be set in state.
-				Config: testConfig(url, fooOrg, firstProjectFoo, projRoleWithInvalidGrantsUpdate),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, projRoleWithInvalidGrantsUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRoleResourceExists(provider, "boundary_role.with_grants"),
 					resource.TestCheckResourceAttr("boundary_role.with_grants", "name", "with_grants_update"),
@@ -287,7 +290,7 @@ func TestAccRoleWithGrants(t *testing.T) {
 			},
 			{
 				// Update should now succeed
-				Config: testConfig(url, fooOrg, firstProjectFoo, projRoleWithGrantsUpdate),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, projRoleWithGrantsUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRoleResourceExists(provider, "boundary_role.with_grants"),
 					testAccCheckRoleResourceGrantsSet(provider, "boundary_role.with_grants", []string{readonlyGrant, readonlyGrantUpdate}),
@@ -301,9 +304,10 @@ func TestAccRoleWithGrants(t *testing.T) {
 }
 
 func TestAccRoleWithPrincipals(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	t.Cleanup(tc.Shutdown)
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
@@ -314,7 +318,7 @@ func TestAccRoleWithPrincipals(t *testing.T) {
 			{
 				// Create with invalid principal should create role but return empty plan
 				// since principal was not set correctly.
-				Config: testConfig(url, fooOrg, firstProjectFoo, projRoleWithInvalidPrincipal),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, projRoleWithInvalidPrincipal),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRoleResourceExists(provider, "boundary_role.with_principal"),
 					resource.TestCheckResourceAttr("boundary_role.with_principal", DescriptionKey, "with principal"),
@@ -324,7 +328,7 @@ func TestAccRoleWithPrincipals(t *testing.T) {
 			},
 			{
 				// Create again without invalid principal should produce empty plan
-				Config: testConfig(url, fooOrg, firstProjectFoo, fooUser, projRoleWithPrincipal),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, fooUser, projRoleWithPrincipal),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRoleResourceExists(provider, "boundary_role.with_principal"),
 					testAccCheckRoleResourcePrincipalsSet(provider, "boundary_role.with_principal", []string{"boundary_user.foo"}),
@@ -338,7 +342,7 @@ func TestAccRoleWithPrincipals(t *testing.T) {
 			{
 				// Update with invalid principal should update role but return empty plan
 				// since principal was not set correctly.
-				Config: testConfig(url, fooOrg, firstProjectFoo, fooUser, projRoleWithInvalidPrincipalUpdate),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, fooUser, projRoleWithInvalidPrincipalUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRoleResourceExists(provider, "boundary_role.with_principal"),
 					resource.TestCheckResourceAttr("boundary_role.with_principal", DescriptionKey, "with principal update"),
@@ -348,7 +352,7 @@ func TestAccRoleWithPrincipals(t *testing.T) {
 			},
 			{
 				// Update again without invalid principal should produce empty plan
-				Config: testConfig(url, fooOrg, firstProjectFoo, fooUser, barUser, projRoleWithPrincipalUpdate),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, fooUser, barUser, projRoleWithPrincipalUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRoleResourceExists(provider, "boundary_role.with_principal"),
 					testAccCheckUserResourceExists(provider, "boundary_user.foo"),
@@ -364,9 +368,10 @@ func TestAccRoleWithPrincipals(t *testing.T) {
 }
 
 func TestAccRoleWithGroups(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	t.Cleanup(tc.Shutdown)
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
@@ -375,7 +380,7 @@ func TestAccRoleWithGroups(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// test create
-				Config: testConfig(url, fooOrg, firstProjectFoo, projRoleWithGroups),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, projRoleWithGroups),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRoleResourceExists(provider, "boundary_role.with_groups"),
 					testAccCheckRoleResourceGroupsSet(provider, "boundary_role.with_groups", []string{"boundary_group.foo"}),
@@ -388,7 +393,7 @@ func TestAccRoleWithGroups(t *testing.T) {
 			importStep("boundary_role.with_groups"),
 			{
 				// test update
-				Config: testConfig(url, fooOrg, firstProjectFoo, projRoleWithGroupsUpdate),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, projRoleWithGroupsUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckRoleResourceExists(provider, "boundary_role.with_groups"),
 					testAccCheckGroupResourceExists(provider, "boundary_group.foo"),

internal/provider/resource_scope_test.go

@@ -11,34 +11,39 @@ import (
 
 	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/scopes"
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/stretchr/testify/require"
 )
 
-const (
+// fooOrg returns HCL for a global scope wrapper and an org scope whose name is
-	fooOrg = `
+// unique per test via the provided suffix, preventing conflicts on the shared controller.
+func fooOrg(suffix string) string {
+	return fmt.Sprintf(`
 resource "boundary_scope" "global" {
 	global_scope = true
-	name = "global"
+	name         = "global"
-	description = "Global Scope"
+	description  = "Global Scope"
-	scope_id = "global"
+	scope_id     = "global"
 }
 
 resource "boundary_scope" "org1" {
-	name = "org1"
+	name     = "org1-%s"
 	scope_id = boundary_scope.global.id
 }
 
 resource "boundary_role" "org1_admin" {
-	scope_id = boundary_scope.global.id
+	scope_id        = boundary_scope.global.id
 	grant_scope_ids = [boundary_scope.org1.id]
-	grant_strings = ["ids=*;type=*;actions=*"]
+	grant_strings   = ["ids=*;type=*;actions=*"]
-	principal_ids = ["u_auth"]
+	principal_ids   = ["u_auth"]
+}
+`, suffix)
 }
-`
 
+const (
 	firstProjectFoo = `
 resource "boundary_scope" "proj1" {
 	name = "proj1"
@@ -88,9 +93,10 @@ resource "boundary_role" "proj2_admin" {
 )
 
 func TestAccScopeCreation(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
@@ -98,7 +104,7 @@ func TestAccScopeCreation(t *testing.T) {
 		CheckDestroy:      testAccCheckScopeResourceDestroy(t, provider),
 		Steps: []resource.TestStep{
 			{
-				Config: testConfig(url, fooOrg, firstProjectFoo, secondProject),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, secondProject),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckScopeResourceExists(provider, "boundary_scope.org1"),
 					testAccCheckScopeResourceExists(provider, "boundary_scope.proj1"),
@@ -110,7 +116,7 @@ func TestAccScopeCreation(t *testing.T) {
 			importStep("boundary_scope.proj1"),
 			// Updates the first project to have description bar
 			{
-				Config: testConfig(url, fooOrg, firstProjectBar, secondProject),
+				Config: testConfig(url, fooOrg(suffix), firstProjectBar, secondProject),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckScopeResourceExists(provider, "boundary_scope.proj1"),
 					resource.TestCheckResourceAttr("boundary_scope.proj1", DescriptionKey, "bar"),
@@ -120,7 +126,7 @@ func TestAccScopeCreation(t *testing.T) {
 			importStep("boundary_scope.proj1"),
 			// Remove second project
 			{
-				Config: testConfig(url, fooOrg, firstProjectBar),
+				Config: testConfig(url, fooOrg(suffix), firstProjectBar),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckScopeResourceExists(provider, "boundary_scope.proj1"),
 					resource.TestCheckResourceAttr("boundary_scope.proj1", DescriptionKey, "bar"),

internal/provider/resource_storage_bucket.go

@@ -226,6 +226,18 @@ func setFromStorageBucketResponseMap(d *schema.ResourceData, raw map[string]inte
 		}
 	}
 
+	if v, ok := raw[storageBucketNameKey]; ok {
+		if err := d.Set(storageBucketNameKey, v); err != nil {
+			return err
+		}
+	}
+
+	if v, ok := raw[WorkerFilterKey]; ok {
+		if err := d.Set(WorkerFilterKey, v); err != nil {
+			return err
+		}
+	}
+
 	d.SetId(raw[IDKey].(string))
 
 	if err := d.Set(internalForceUpdateKey, strconv.FormatInt(rand.Int63(), 10)); err != nil {

internal/provider/resource_storage_bucket_test.go

@@ -13,10 +13,11 @@ import (
 
 	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/storagebuckets"
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/stretchr/testify/require"
 )
 
 const (
@@ -25,15 +26,15 @@ const (
 	testStorageBucketDescriptionUpdate2 = "bar foo foo"
 )
 
-var projStorageBucketBase = `
+var orgStorageBucketBase = `
 resource "boundary_storage_bucket" "foo" {
 	name        	= "foo"
-	scope_id    	= boundary_scope.proj1.id
+	scope_id    	= boundary_scope.org1.id
 	plugin_name 	= "loopback"
-	bucket_name   	= "testbucket123"
+	bucket_name   	= "default"
-    worker_filter 	= "\"pki\" in \"/tags/type\""
+	worker_filter 	= "\"dev\" in \"/tags/type\""
 %s
-	depends_on  	= [boundary_role.proj1_admin]
+	depends_on  	= [boundary_role.org1_admin]
 }`
 
 var (
@@ -42,14 +43,12 @@ var (
 )
 
 func TestAccStorageBucket(t *testing.T) {
-	t.Skip("Skipping test until Boundary Terraform Provider can unit tests for Boundary Enterprise only features")
+	cfg, err := loadTestConfig()
-
+	require.NoError(t, err)
-	tc := controller.NewTestController(t, tcConfig...)
+	url := cfg.BoundaryAddr
-	defer tc.Shutdown()
+	suffix := id.UniqueId()
-	url := tc.ApiAddrs()[0]
 
 	resName := "boundary_storage_bucket.foo"
-	workerFilter := "\"pki\" in \"/tags/type\""
 	initialValuesStr := fmt.Sprintf(
 		`
 	description = "%s"
@@ -57,13 +56,11 @@ func TestAccStorageBucket(t *testing.T) {
 		foo = "bar"
 		zip = "zap"
 	})
-	workerFilter = "%s"
 	secrets_json = jsonencode({
 		hush = "puppies"
 	})
 	`,
 		testStorageBucketDescription,
-		workerFilter,
 	)
 
 	// Changed description and secrets
@@ -74,13 +71,11 @@ func TestAccStorageBucket(t *testing.T) {
 		foo = "bar"
 		zip = "zoop"
 	})
-	workerFilter = "%s"
 	secrets_json = jsonencode({
 		flush = "fluppies"
 	})
 	`,
 		testStorageBucketDescriptionUpdate,
-		workerFilter,
 	)
 
 	// Changed description, no secrets update
@@ -91,19 +86,18 @@ func TestAccStorageBucket(t *testing.T) {
 		foo = "bar"
 		zip = "zoop"
 	})
-	workerFilter = "%s"
 	secrets_json = jsonencode({
 		flush = "fluppies"
 	})
 	`,
 		testStorageBucketDescriptionUpdate2,
-		workerFilter,
 	)
 
-	// Same description, now explicitly unset secrets and blankify attrs
+	// Null only attributes_json; keep secrets (loopback plugin cannot clear secrets)
 	valuesStrUpdate3 := fmt.Sprintf(
 		`
 		description = "%s"
+		attributes_json = "null"
 		secrets_json = jsonencode({
 			flush = "fluppies"
 		})
@@ -111,7 +105,7 @@ func TestAccStorageBucket(t *testing.T) {
 		testStorageBucketDescriptionUpdate2,
 	)
 
-	// Set values again
+	// Re-add attributes_json and change secrets so HMAC changes
 	valuesStrUpdate4 := fmt.Sprintf(
 		`
 		description = "%s"
@@ -120,28 +114,17 @@ func TestAccStorageBucket(t *testing.T) {
 			zip = "zoop"
 		})
 		secrets_json = jsonencode({
-			flush = "fluppies"
+			flush = "fluppies2"
 		})
 		`,
 		testStorageBucketDescriptionUpdate2,
 	)
 
-	// Explicitly set both secrets and attributes to null
+	initialHcl := fmt.Sprintf(orgStorageBucketBase, initialValuesStr)
-	valuesStrUpdate5 := fmt.Sprintf(
+	update1Hcl := fmt.Sprintf(orgStorageBucketBase, valuesStrUpdate1)
-		`
+	update2Hcl := fmt.Sprintf(orgStorageBucketBase, valuesStrUpdate2)
-		description = "%s"
+	update3Hcl := fmt.Sprintf(orgStorageBucketBase, valuesStrUpdate3)
-		attributes_json = "null"
+	update4Hcl := fmt.Sprintf(orgStorageBucketBase, valuesStrUpdate4)
-		secrets_json = "null"
-		`,
-		testStorageBucketDescriptionUpdate2,
-	)
-
-	initialHcl := fmt.Sprintf(projStorageBucketBase, initialValuesStr)
-	update1Hcl := fmt.Sprintf(projStorageBucketBase, valuesStrUpdate1)
-	update2Hcl := fmt.Sprintf(projStorageBucketBase, valuesStrUpdate2)
-	update3Hcl := fmt.Sprintf(projStorageBucketBase, valuesStrUpdate3)
-	update4Hcl := fmt.Sprintf(projStorageBucketBase, valuesStrUpdate4)
-	update5Hcl := fmt.Sprintf(projStorageBucketBase, valuesStrUpdate5)
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
@@ -150,10 +133,9 @@ func TestAccStorageBucket(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// test create
-				Config: testConfig(url, fooOrg, firstProjectFoo, initialHcl),
+				Config: testConfig(url, fooOrg(suffix), initialHcl),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckScopeResourceExists(provider, "boundary_scope.org1"),
-					testAccCheckScopeResourceExists(provider, "boundary_scope.proj1"),
 					testAccCheckStorageBucketResourceExists(provider, resName, expectedAttributesStatePreviouslyEmptyNowSet),
 					resource.TestCheckResourceAttr(resName, DescriptionKey, testStorageBucketDescription),
 				),
@@ -162,7 +144,7 @@ func TestAccStorageBucket(t *testing.T) {
 			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
 			{
 				// test update
-				Config: testConfig(url, fooOrg, firstProjectFoo, update1Hcl),
+				Config: testConfig(url, fooOrg(suffix), update1Hcl),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStorageBucketResourceExists(provider, resName, expectedAttributesStatePreviouslySetButChanged),
 					resource.TestCheckResourceAttr(resName, DescriptionKey, testStorageBucketDescriptionUpdate),
@@ -172,7 +154,7 @@ func TestAccStorageBucket(t *testing.T) {
 			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
 			{
 				// test update
-				Config: testConfig(url, fooOrg, firstProjectFoo, update2Hcl),
+				Config: testConfig(url, fooOrg(suffix), update2Hcl),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStorageBucketResourceExists(provider, resName, expectedAttributesStatePreviouslySetNoChange),
 					resource.TestCheckResourceAttr(resName, DescriptionKey, testStorageBucketDescriptionUpdate2),
@@ -184,7 +166,7 @@ func TestAccStorageBucket(t *testing.T) {
 				// this runs the same HCL; mostly used in some manual checking
 				// to ensure update is still called even when nothing has
 				// changed (as we need for secrets)
-				Config: testConfig(url, fooOrg, firstProjectFoo, update2Hcl),
+				Config: testConfig(url, fooOrg(suffix), update2Hcl),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckStorageBucketResourceExists(provider, resName, expectedAttributesStatePreviouslySetNoChange),
 					resource.TestCheckResourceAttr(resName, DescriptionKey, testStorageBucketDescriptionUpdate2),
@@ -193,30 +175,20 @@ func TestAccStorageBucket(t *testing.T) {
 			},
 			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
 			{
-				// test update
+				// test update: null attributes_json only — secrets unchanged (loopback cannot clear secrets)
-				Config: testConfig(url, fooOrg, firstProjectFoo, update3Hcl),
+				Config: testConfig(url, fooOrg(suffix), update3Hcl),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckStorageBucketResourceExists(provider, resName, expectedAttributesStatePreviouslySetNoChange),
+					testAccCheckStorageBucketResourceExists(provider, resName, expectedAttributesStateAttrsNowEmpty),
 					resource.TestCheckResourceAttr(resName, DescriptionKey, testStorageBucketDescriptionUpdate2),
 				),
 				ExpectNonEmptyPlan: true,
 			},
 			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
 			{
-				// test update
+				// test update: re-add attributes_json with changed secrets
-				Config: testConfig(url, fooOrg, firstProjectFoo, update4Hcl),
+				Config: testConfig(url, fooOrg(suffix), update4Hcl),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckStorageBucketResourceExists(provider, resName, expectedAttributesStatePreviouslySetNowEmpty),
+					testAccCheckStorageBucketResourceExists(provider, resName, expectedAttributesStateAttrsRestoredSecretsChanged),
-					resource.TestCheckResourceAttr(resName, DescriptionKey, testStorageBucketDescriptionUpdate2),
-				),
-				ExpectNonEmptyPlan: true,
-			},
-			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
-			{
-				// test update
-				Config: testConfig(url, fooOrg, firstProjectFoo, update5Hcl),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckStorageBucketResourceExists(provider, resName, expectedAttributesStatePreviouslyEmptyNowSet),
 					resource.TestCheckResourceAttr(resName, DescriptionKey, testStorageBucketDescriptionUpdate2),
 				),
 				ExpectNonEmptyPlan: true,
@@ -342,6 +314,51 @@ func testAccCheckStorageBucketResourceExists(testProvider *schema.Provider, name
 				return fmt.Errorf("expected empty new attributes value, got %s", attrs)
 			}
 			currentStorageBucketAttributesValue = ""
+
+		case expectedAttributesStateAttrsRestoredSecretsChanged:
+			// attrs go from empty back to set; secrets change
+			if currentStorageBucketSecretsHmacValue == "" {
+				return errors.New("expected previous secrets hmac value")
+			}
+			val := secretsHmac.(string)
+			if val == "" {
+				return errors.New("expected non-empty new secrets hmac value")
+			}
+			if val == currentStorageBucketSecretsHmacValue {
+				return errors.New("expected changed secrets hmac value")
+			}
+			currentStorageBucketSecretsHmacValue = val
+			if currentStorageBucketAttributesValue != "" {
+				return fmt.Errorf("expected no previous attributes value, got %s", currentStorageBucketAttributesValue)
+			}
+			if attrs == nil {
+				return errors.New("expected non-empty new attributes value")
+			}
+			attrsVal, err := json.Marshal(attrs)
+			if err != nil {
+				return fmt.Errorf("error marshaling attrs: %w", err)
+			}
+			currentStorageBucketAttributesValue = string(attrsVal)
+
+		case expectedAttributesStateAttrsNowEmpty:
+			// secrets unchanged (loopback plugin cannot clear secrets); only attrs cleared
+			if currentStorageBucketSecretsHmacValue == "" {
+				return errors.New("expected previous secrets hmac value")
+			}
+			val := secretsHmac.(string)
+			if val == "" {
+				return errors.New("expected non-empty secrets hmac value (secrets cannot be cleared)")
+			}
+			if val != currentStorageBucketSecretsHmacValue {
+				return errors.New("expected unchanged secrets hmac value")
+			}
+			if currentStorageBucketAttributesValue == "" {
+				return errors.New("expected previous attributes value")
+			}
+			if attrs != nil {
+				return fmt.Errorf("expected empty new attributes value, got %s", attrs)
+			}
+			currentStorageBucketAttributesValue = ""
 		}
 		return nil
 	}

internal/provider/resource_target_test.go

@@ -12,11 +12,12 @@ import (
 
 	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/targets"
-	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/boundary/testing/vault"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/stretchr/testify/require"
 )
 
 const (
@@ -220,10 +221,10 @@ resource "boundary_target" "foo" {
 )
 
 func TestAccTarget(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-
+	require.NoError(t, err)
-	defer tc.Shutdown()
+	suffix := id.UniqueId()
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
 
 	vc := vault.NewTestVaultServer(t)
 	_, token := vc.CreateToken(t)
@@ -243,7 +244,7 @@ func TestAccTarget(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// test create
-				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, fooBarCredLibs, fooBarHostSet, fooTarget),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, credStoreRes, fooBarCredLibs, fooBarHostSet, fooTarget),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTargetResourceExists(provider, "boundary_target.foo"),
 					resource.TestCheckResourceAttr("boundary_target.foo", DescriptionKey, fooTargetDescription),
@@ -260,7 +261,7 @@ func TestAccTarget(t *testing.T) {
 			importStep("boundary_target.foo"),
 			{
 				// test update
-				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, fooBarCredLibs, fooBarHostSet, fooTargetUpdate),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, credStoreRes, fooBarCredLibs, fooBarHostSet, fooTargetUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTargetResourceExists(provider, "boundary_target.foo"),
 					resource.TestCheckResourceAttr("boundary_target.foo", DescriptionKey, fooTargetDescriptionUpdate),
@@ -276,7 +277,7 @@ func TestAccTarget(t *testing.T) {
 			importStep("boundary_target.foo"),
 			{
 				// test unset hosts and cred sources
-				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, fooBarCredLibs, fooBarHostSet, fooTargetUpdateUnsetHostAndCredSources),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, credStoreRes, fooBarCredLibs, fooBarHostSet, fooTargetUpdateUnsetHostAndCredSources),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTargetResourceExists(provider, "boundary_target.foo"),
 					resource.TestCheckResourceAttr("boundary_target.foo", DescriptionKey, fooTargetDescriptionUpdate),
@@ -292,7 +293,7 @@ func TestAccTarget(t *testing.T) {
 			importStep("boundary_target.foo"),
 			{
 				// test updating state file when the target is created, but fails on associating an invalid injected credential source to a tcp target type
-				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, fooBarCredLibs, fooTargetPartialSuccess),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, credStoreRes, fooBarCredLibs, fooTargetPartialSuccess),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTargetResourceExists(provider, "boundary_target.foo"),
 					resource.TestCheckResourceAttr("boundary_target.foo", DescriptionKey, ""),
@@ -308,7 +309,7 @@ func TestAccTarget(t *testing.T) {
 			importStep("boundary_target.foo", targetInjectedAppCredentialSourceIdsKey),
 			{
 				// test resolving invalid injected credential source error without raising duplicate name error, due to state file not being in sync.
-				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, fooBarCredLibs, fooTargetUpdateUnsetHostAndCredSources),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, credStoreRes, fooBarCredLibs, fooTargetUpdateUnsetHostAndCredSources),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTargetResourceExists(provider, "boundary_target.foo"),
 					resource.TestCheckResourceAttr("boundary_target.foo", DescriptionKey, fooTargetDescriptionUpdate),
@@ -328,10 +329,10 @@ func TestAccTarget(t *testing.T) {
 }
 
 func TestAccTargetWithAddress(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	t.Cleanup(tc.Shutdown)
+	require.NoError(t, err)
-
+	suffix := id.UniqueId()
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
@@ -341,7 +342,7 @@ func TestAccTargetWithAddress(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// test create
-				Config: testConfig(url, fooOrg, firstProjectFoo, fooTargetWithIPAddress),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, fooTargetWithIPAddress),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTargetResourceExists(provider, "boundary_target.foo"),
 					resource.TestCheckResourceAttr("boundary_target.foo", NameKey, "test"),
@@ -355,7 +356,7 @@ func TestAccTargetWithAddress(t *testing.T) {
 			importStep("boundary_target.foo"),
 			{
 				// test update
-				Config: testConfig(url, fooOrg, firstProjectFoo, fooTargetWithDNSAddress),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, fooTargetWithDNSAddress),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTargetResourceExists(provider, "boundary_target.foo"),
 					resource.TestCheckResourceAttr("boundary_target.foo", NameKey, "test"),
@@ -369,7 +370,7 @@ func TestAccTargetWithAddress(t *testing.T) {
 			importStep("boundary_target.foo"),
 			{
 				// test update to unset address
-				Config: testConfig(url, fooOrg, firstProjectFoo, fooTargetUnsetAddress),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, fooTargetUnsetAddress),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTargetResourceExists(provider, "boundary_target.foo"),
 					resource.TestCheckResourceAttr("boundary_target.foo", NameKey, "test"),
@@ -383,7 +384,7 @@ func TestAccTargetWithAddress(t *testing.T) {
 			importStep("boundary_target.foo"),
 			{
 				// test set host source
-				Config: testConfig(url, fooOrg, firstProjectFoo, fooBarHostSet, fooTargetSetHostSource),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, fooBarHostSet, fooTargetSetHostSource),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTargetResourceExists(provider, "boundary_target.foo"),
 					resource.TestCheckResourceAttr("boundary_target.foo", NameKey, "test"),
@@ -399,10 +400,10 @@ func TestAccTargetWithAddress(t *testing.T) {
 }
 
 func TestAccTargetWithAddress_MoveToHostSourceDirectly(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	t.Cleanup(tc.Shutdown)
+	require.NoError(t, err)
-
+	suffix := id.UniqueId()
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
@@ -412,7 +413,7 @@ func TestAccTargetWithAddress_MoveToHostSourceDirectly(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// test create
-				Config: testConfig(url, fooOrg, firstProjectFoo, fooTargetWithIPAddress),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, fooTargetWithIPAddress),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTargetResourceExists(provider, "boundary_target.foo"),
 					resource.TestCheckResourceAttr("boundary_target.foo", NameKey, "test"),
@@ -426,7 +427,7 @@ func TestAccTargetWithAddress_MoveToHostSourceDirectly(t *testing.T) {
 			importStep("boundary_target.foo"),
 			{
 				// test set host source
-				Config: testConfig(url, fooOrg, firstProjectFoo, fooBarHostSet, fooTargetSetHostSource),
+				Config: testConfig(url, fooOrg(suffix), firstProjectFoo, fooBarHostSet, fooTargetSetHostSource),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckTargetResourceExists(provider, "boundary_target.foo"),
 					resource.TestCheckResourceAttr("boundary_target.foo", NameKey, "test"),
@@ -442,6 +443,7 @@ func TestAccTargetWithAddress_MoveToHostSourceDirectly(t *testing.T) {
 }
 
 func TestAccTargetWithAddress_HostSourceAndAddressConflict(t *testing.T) {
+	suffix := id.UniqueId()
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		IsUnitTest:        true,
@@ -450,7 +452,7 @@ func TestAccTargetWithAddress_HostSourceAndAddressConflict(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// test create target with address and host source
-				Config:      testConfig("not_required", fooOrg, firstProjectFoo, fooBarHostSet, fooTargetWithAddressAndHostSource),
+				Config:      testConfig("not_required", fooOrg(suffix), firstProjectFoo, fooBarHostSet, fooTargetWithAddressAndHostSource),
 				ExpectError: regexp.MustCompile(`"address": conflicts with host_source_ids`),
 			},
 		},

internal/provider/resource_user_test.go

@@ -11,10 +11,11 @@ import (
 
 	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/users"
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/stretchr/testify/require"
 )
 
 const (
@@ -63,10 +64,11 @@ resource "boundary_user" "org1" {
 // NOTE: this test also tests out the direct token auth mechanism.
 
 func TestAccUser(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
-	token := tc.Token().Token
+	token := cfg.BoundaryAuthToken
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
@@ -75,7 +77,7 @@ func TestAccUser(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// test create
-				Config: testConfigWithToken(url, token, fooOrg, orgUser),
+				Config: testConfigWithToken(url, token, fooOrg(suffix), orgUser),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckUserResourceExists(provider, "boundary_user.org1"),
 					resource.TestCheckResourceAttr("boundary_user.org1", DescriptionKey, fooDescription),
@@ -85,7 +87,7 @@ func TestAccUser(t *testing.T) {
 			importStep("boundary_user.org1"),
 			{
 				// test update description
-				Config: testConfigWithToken(url, token, fooOrg, orgUserUpdate),
+				Config: testConfigWithToken(url, token, fooOrg(suffix), orgUserUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckUserResourceExists(provider, "boundary_user.org1"),
 					resource.TestCheckResourceAttr("boundary_user.org1", DescriptionKey, fooDescriptionUpdate),
@@ -98,10 +100,11 @@ func TestAccUser(t *testing.T) {
 }
 
 func TestAccUserWithAccounts(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
-	token := tc.Token().Token
+	token := cfg.BoundaryAuthToken
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
@@ -110,7 +113,7 @@ func TestAccUserWithAccounts(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// test create
-				Config: testConfigWithToken(url, token, fooOrg, fooAccount, orgUserWithAccts),
+				Config: testConfigWithToken(url, token, fooOrg(suffix), fooAccount, orgUserWithAccts),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckUserResourceExists(provider, "boundary_user.org1"),
 					testAccCheckAccountResourceExists(provider, "boundary_account.foo"),
@@ -123,7 +126,7 @@ func TestAccUserWithAccounts(t *testing.T) {
 			importStep("boundary_account.foo", "password"),
 			{
 				// test update description
-				Config: testConfigWithToken(url, token, fooOrg, fooAccount, orgUserWithAcctsUpdate),
+				Config: testConfigWithToken(url, token, fooOrg(suffix), fooAccount, orgUserWithAcctsUpdate),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckUserResourceExists(provider, "boundary_user.org1"),
 					testAccCheckAccountResourceExists(provider, "boundary_account.foo"),

internal/provider/testing.go

@@ -0,0 +1,36 @@
+// Copyright IBM Corp. 2020, 2026
+// SPDX-License-Identifier: MPL-2.0
+
+package provider
+
+import (
+	"testing"
+
+	"github.com/kelseyhightower/envconfig"
+)
+
+type config struct {
+	BoundaryAddr        string `envconfig:"BOUNDARY_ADDR" required:"true"`
+	BoundaryAuthToken   string `envconfig:"BOUNDARY_AUTH_TOKEN" required:"true"`
+	BoundaryRecoveryKey string `envconfig:"BOUNDARY_DEV_RECOVERY_KEY"`
+}
+
+func loadTestConfig() (*config, error) {
+	var c config
+	err := envconfig.Process("", &c)
+	if err != nil {
+		return nil, err
+	}
+
+	return &c, nil
+}
+
+// requireRecoveryKey returns cfg.BoundaryRecoveryKey or calls t.Skip when the
+// env var is not set. Call this only in tests that actually use the recovery KMS.
+func requireRecoveryKey(t *testing.T, cfg *config) string {
+	t.Helper()
+	if cfg.BoundaryRecoveryKey == "" {
+		t.Fatal("BOUNDARY_DEV_RECOVERY_KEY not set")
+	}
+	return cfg.BoundaryRecoveryKey
+}

internal/provider/worker_test.go

@@ -12,10 +12,10 @@ import (
 
 	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/workers"
-	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/stretchr/testify/require"
 )
 
 const (
@@ -63,9 +63,9 @@ func TestWorkerWorkerLed(t *testing.T) {
 		t.Skip("Not running worker led activation test without worker led token present")
 	}
 
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
@@ -105,9 +105,9 @@ func TestWorkerWorkerLed(t *testing.T) {
 }
 
 func TestWorkerControllerLed(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
+	cfg, err := loadTestConfig()
-	defer tc.Shutdown()
+	require.NoError(t, err)
-	url := tc.ApiAddrs()[0]
+	url := cfg.BoundaryAddr
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{

test.sh

@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2020, 2026
+# SPDX-License-Identifier: MPL-2.0
+
+function die {
+    echo $*
+    exit 1
+}
+
+# error out early if missing a command
+which boundary || die "missing boundary"
+[[ -n "${BOUNDARY_LICENSE}" ]] || die "BOUNDARY_LICENSE is not set"
+
+export BOUNDARY_ADDR="http://localhost:9200"
+export TEST_RECOVERY_KEY="7xtkEoS5EXPbgynwd+dDLHopaCqK8cq0Rpep4eooaTs="
+
+echo "starting boundary dev in background"
+boundary dev -recovery-key $TEST_RECOVERY_KEY --create-loopback-plugin &>/dev/null &
+boundary_pid=$!
+
+function cleanup {
+    rv=$?
+    echo "stopping boundary dev"
+    if [[ -n ${boundary_pid} ]]; then
+        kill ${boundary_pid}
+    fi
+    exit $rv
+}
+
+trap cleanup EXIT
+
+max=120
+c=0
+until boundary scopes list; do
+    echo 'waiting for boundary to be up'
+    ((c+=1))
+    if [[ $c -ge $max ]]; then
+        die "timeout waiting for boundary controller to get healthy"
+    fi
+    sleep 1
+done
+
+c=0
+until curl -s http://localhost:9203/health\?worker_info\=1 | jq -e '.worker_process_info.upstream_connection_state == "READY"' > /dev/null; do
+    echo 'waiting for boundary worker to be up'
+    ((c+=1))
+    if [[ $c -ge $max ]]; then
+        die "timeout waiting for boundary worker to get healthy"
+    fi
+    sleep 1
+done
+
+# Wait a little longer to ensure the worker is fully ready before we start
+# running tests. Without this, there were some flaky tests, specifically when
+# trying to connect to a target in the alias tests (those are the first to run).
+# The worker health check alone was not sufficient during testing, and it was
+# not clear what else could be checked to ensure the worker was fully ready.
+sleep 10
+
+echo "authenticating with boundary"
+export BOUNDARY_PW=password
+export BOUNDARY_AUTH_TOKEN=$(boundary authenticate password \
+    -auth-method-id=ampw_1234567890 \
+    -login-name=admin \
+    -password=env://BOUNDARY_PW \
+    -format=json | jq -r '.item.attributes.token')
+[[ -n "${BOUNDARY_AUTH_TOKEN}" ]] || die "failed to obtain boundary auth token"
+
+echo "setting primary auth method on global scope"
+boundary scopes update \
+    -token=env://BOUNDARY_AUTH_TOKEN \
+    -id=global \
+    -primary-auth-method-id=ampw_1234567890
+
+echo "running tests"
+TF_ACC=1 \
+    BOUNDARY_ADDR=http://localhost:9200 \
+    BOUNDARY_DEV_RECOVERY_KEY=$TEST_RECOVERY_KEY \
+    BOUNDARY_AUTH_TOKEN=$BOUNDARY_AUTH_TOKEN \
+    BOUNDARY_TOKEN="" \
+    go test ./... -count=1 -v -timeout 120m 2>&1