chore: prep for release

chore: Update deps
build(deps): bump atlassian/gajira-transition from 3.0.0 to 3.0.1
2023-06-12 21:29:52 -07:00 · 2023-06-12 20:36:42 -07:00 · 2023-06-12 20:18:00 -07:00 · 2023-06-12 20:17:31 -07:00 · 2023-06-12 20:15:59 -07:00 · 2023-05-16 16:32:13 -04:00
158 changed files with 6994 additions and 1268 deletions
@@ -1,25 +0,0 @@
-version: 2.1
-jobs:
-  build:
-    resource_class: large
-    machine:
-      image: 'ubuntu-2004:202107-02'
-    working_directory: ~/terraform-provider-watchtower
-    steps:
-    - add_ssh_keys:
-        fingerprints:
-        # hc-github-team-secure-boundary github user,TF_ACC=1 ~/.go/bin/go test ./... -v $(TESTARGS) -timeout 120m to read private modules
-          - "d4:7f:b2:f7:6f:4d:e7:21:cc:d2:b7:6a:8b:68:e6:d4"
-    - checkout
-    - run:
-        name: "Install go"
-        command: |
-          unset GOPATH # ci image has done strange things with GOPATH, unset it so install-go can fix it
-          make install-go
-          source ~/.bashrc
-          go mod download
-    - run:
-        name: "Run Acceptance Tests"
-        command: |
-          source ~/.bashrc
-          make testacc-ci
@@ -0,0 +1,16 @@
+schema_version = 1
+
+project {
+  license = "MPL-2.0"
+
+  copyright_year = 2020
+
+  # (OPTIONAL) A list of globs that should not have copyright or license headers.
+  # Supports doublestar glob patterns for more flexibility in defining which
+  # files or folders should be ignored
+  # Default: []
+  header_ignore = [
+    "examples/**/*.tf",
+    "examples/**/*.sh",
+  ]
+}
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 # See GitHub's docs for more information on this file:
 # https://docs.github.com/en/free-pro-team@latest/github/administering-a-repository/configuration-options-for-dependency-updates
 version: 2
@@ -0,0 +1,15 @@
+name: Lint GitHub Actions workflows
+on: push
+
+permissions:
+  contents: read
+
+jobs:
+  actionlint:
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
+    steps:
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - name: Check workflow files
+        uses: docker://docker.mirror.hashicorp.services/rhysd/actionlint@sha256:02ccb6d91e4cb4a7b21eb99d5274d257e81ae667688d730e89d7ea0d6d35db91
+        with:
+          args: -color
@@ -9,6 +9,9 @@ on:

 name: Jira Sync

+permissions:
+  contents: read
+
 jobs:
  sync:
    runs-on: ubuntu-latest
@@ -18,19 +21,19 @@ jobs:
      if: github.event.action == 'opened'
      id: boundary-team-role
      run: |
-        TEAM=boundary
+        TEAM="boundary"
        ROLE="$(hub api orgs/hashicorp/teams/${TEAM}/memberships/${{ github.actor }} | jq -r '.role | select(.!=null)')"
-        if [[ -n ${ROLE} ]]; then
+        if [[ -n "${ROLE}" ]]; then
          echo "Actor ${{ github.actor }} is a ${TEAM} team member, skipping ticket creation"
        else
          echo "Actor ${{ github.actor }} is not a ${TEAM} team member"
        fi
-        echo "::set-output name=role::${ROLE}"
+        echo "name=role::${ROLE}" >> "$GITHUB_OUTPUT"
      env:
        GITHUB_TOKEN: ${{ secrets.JIRA_SYNC_GITHUB_TOKEN }}

    - name: Login
-      uses: atlassian/gajira-login@v2.0.0
+      uses: atlassian/gajira-login@45fd029b9f1d6d8926c6f04175aa80c0e42c9026 # v3.0.1
      env:
        JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
        JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
@@ -41,14 +44,14 @@ jobs:
      id: set-ticket-type
      run: |
        if [[ "${{ github.event_name }}" == "pull_request_target" ]]; then
-          echo "::set-output name=type::PR"
+          echo "name=type::PR" >> "$GITHUB_OUTPUT"
        else
-          echo "::set-output name=type::ISS"
+          echo "name=type::ISS" >> "$GITHUB_OUTPUT"
        fi

    - name: Create ticket
      if: github.event.action == 'opened' && !steps.boundary-team-role.outputs.role
-      uses: tomhjp/gh-action-jira-create@v0.2.0
+      uses: tomhjp/gh-action-jira-create@3ed1789cad3521292e591a7cfa703215ec1348bf # v0.2.1
      with:
        project: ICU
        issuetype: "GH Issue"
@@ -60,28 +63,28 @@ jobs:
    - name: Search
      if: github.event.action != 'opened'
      id: search
-      uses: tomhjp/gh-action-jira-search@v0.2.1
+      uses: tomhjp/gh-action-jira-search@04700b457f317c3e341ce90da5a3ff4ce058f2fa # v0.2.2
      with:
        # cf[10089] is Issue Link custom field
        jql: 'issuetype = "GH Issue" and cf[10089]="${{ github.event.issue.html_url || github.event.pull_request.html_url }}"'

    - name: Sync comment
      if: github.event.action == 'created' && steps.search.outputs.issue
-      uses: tomhjp/gh-action-jira-comment@v0.2.0
+      uses: tomhjp/gh-action-jira-comment@6eb6b9ead70221916b6badd118c24535ed220bd9 # v0.2.0
      with:
        issue: ${{ steps.search.outputs.issue }}
        comment: "${{ github.actor }} ${{ github.event.review.state || 'commented' }}:\n\n${{ github.event.comment.body || github.event.review.body }}\n\n${{ github.event.comment.html_url || github.event.review.html_url }}"

    - name: Close ticket
      if: (github.event.action == 'closed' || github.event.action == 'deleted') && steps.search.outputs.issue
-      uses: atlassian/gajira-transition@v2.0.2
+      uses: atlassian/gajira-transition@38fc9cd61b03d6a53dd35fcccda172fe04b36de3 # v3
      with:
        issue: ${{ steps.search.outputs.issue }}
        transition: Done

    - name: Reopen ticket
      if: github.event.action == 'reopened' && steps.search.outputs.issue
-      uses: atlassian/gajira-transition@v2.0.2
+      uses: atlassian/gajira-transition@38fc9cd61b03d6a53dd35fcccda172fe04b36de3 # v3
      with:
        issue: ${{ steps.search.outputs.issue }}
        transition: "To Do"
@@ -14,18 +14,18 @@ jobs:
    outputs:
      version: ${{ steps.go-version.outputs.version }}
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
      - id: go-version
-        run: echo "::set-output name=version::$(cat ./.go-version)"
+        run: echo "name=version::$(cat ./.go-version)" >> "$GITHUB_OUTPUT"
  release-notes:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
        with:
          fetch-depth: 0
      - name: Generate Release Notes
        run: sed -n -e "1{/# /d;}" -e "2{/^$/d;}" -e "/# $(git describe --abbrev=0 --exclude="$(git describe --abbrev=0 --match='v*.*.*' --tags)" --match='v*.*.*' --tags | tr -d v)/q;p" CHANGELOG.md > release-notes.txt
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
        with:
          name: release-notes
          path: release-notes.txt
@@ -0,0 +1,43 @@
+name: test
+
+on:
+  - push
+  - workflow_dispatch
+  - workflow_call
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
+    steps:
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - name: Determine go version
+        id: get-go-version
+        # We use .go-version as our source of truth for current Go
+        # version, because "goenv" can react to it automatically.
+        run: |
+          echo "Building with Go $(cat .go-version)"
+          echo "go-version=$(cat .go-version)" >> "$GITHUB_OUTPUT"
+      - name: Set up Go
+        uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
+        with:
+          go-version: "${{ steps.get-go-version.outputs.go-version }}"
+      - name: Determine Go cache paths
+        id: go-cache-paths
+        run: |
+          echo "go-build=$(go env GOCACHE)" >> "$GITHUB_OUTPUT"
+          echo "go-mod=$(go env GOMODCACHE)" >> "$GITHUB_OUTPUT"
+      - name: Set up Go modules cache
+        uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
+        with:
+          path: |
+            ${{ steps.go-cache-paths.outputs.go-build }}
+            ${{ steps.go-cache-paths.outputs.go-mod }}
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go
+      - name: Acceptance Tests
+        run: |
+          make testacc
@@ -1 +1 @@
-1.18.4
+1.20.5
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 archives:
  - files:
      # Ensure only built binary is archived
@@ -1,2 +1,5 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 url_source_repository      = "https://github.com/hashicorp/terraform-provider-boundary"
 url_license                = "https://github.com/hashicorp/terraform-provider-boundary/blob/main/LICENSE"
@@ -2,6 +2,124 @@

 Canonical reference for changes, improvements, and bugfixes for the Boundary Terraform provider.

+## 1.1.8 (June 13, 2023)
+
+### New and Improved
+
+* Add support for target default client port
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/379))
+* Add support for using ldap primary auth method
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/392))
+
+### Deprecations/Changes
+
+* Deprecate `password_auth_method_login_name` & `password_auth_method_password` for Terraform Provider.
+  `password_auth_method_login_name` & `password_auth_method_password` fields have been set to deprecated 
+  with a recommendation to use `auth_method_login_name` & `auth_method_password` fields instead.
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/392))
+* Deprecate type field for `boundary_account_password`
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/396))
+* Deprecate type field for `boundary_account_ldap`
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/400))
+
+## 1.1.7 (May 12, 2023)
+
+### Bug Fix
+* Fix default auth method with recovery kms
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/406))  
+
+## 1.1.6 (May 5, 2023)
+
+### New and Improved
+* Add support for using default auth method if no auth method ID is provided for provider
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/385))
+* Fix typo in Managed Group resource page
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/370))
+
+### Bug Fix
+* Force new resource on credential_type change
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/389))
+
+## 1.1.5 (April 21, 2023)
+
+### New and Improved
+* Add support for credential store vault worker filters ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/375))
+
+### Bug Fix
+* Allow users to set OIDC maxAge value to 0 to require immediate reauth ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/364))
+
+## 1.1.4 (February 15, 2023)
+
+### New and Improved
+
+* Add support for worker egress and ingress filters
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/319))
+* Add support for vault ssh certificate credential libraries
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/320))
+* Add support for targets with address configurations
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/308))
+
+## 1.1.3 (November 29, 2022)
+
+### New and Improved
+
+* Add support for a workers as a resource
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/293)).
+
+## 1.1.2 (October 18, 2022)
+
+### New and Improved
+
+* Add support for setting mapping overrides for vault credential libraries
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/287)).
+
+### Bug Fixes
+
+* Improve error message when authenticating to boundary
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/290)).
+* Set state before returning an error when creating a resource
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/289))
+
+## 1.1.1 (October 12, 2022)
+
+### Bug Fixes
+
+* The plugin cleanup function is being called before the entire Terraform workflow is complete.
+  ([Issue](https://github.com/hashicorp/terraform-provider-boundary/issues/282)),
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/285)).
+
+## 1.1.0 (October 4, 2022)
+
+### New and Improved
+
+* Add support for JSON credentials
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/271)).
+* Add support for setting the plugin execution directory from the config
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/280)).
+
+### Deprecations/Changes
+
+* Fix panic resulting from expired Vault credential store tokens
+  ([Issue](https://github.com/hashicorp/terraform-provider-boundary/issues/279),
+  [PR](https://github.com/hashicorp/terraform-provider-boundary/pull/277)).
+* Remove `application_credential_source_ids` of the `target` resource which was deprecated
+  in 1.0.12 ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/273)).
+* Remove `default_role` from the `role` resource, this schema was never supported and was
+  included mistakenly ([Issue](https://github.com/hashicorp/terraform-provider-boundary/issues/130),
+  [PR](https://github.com/hashicorp/terraform-provider-boundary/pull/269)).
+
+## 1.0.12 (September 13, 2022)
+
+### New and Improved
+
+* Add support for SSH targets
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/264)).
+
+### Deprecations/Changes
+
+* Deprecate `application_credential_source_ids` of the `target` resource
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/260)).
+
 ## 1.0.11 (August 26, 2022)

 ### New and Improved
@@ -146,4 +264,4 @@ Update provider to handle new domain errors ([PR](https://github.com/hashicorp/t

 ## 0.1.0 (October 14, 2020)

-Initial release!
+Initial release!
@@ -0,0 +1,4 @@
+# These owners will be the default owners for everything in
+# the repo, unless a later match takes precedence.
+
+@hashicorp/boundary
@@ -1,4 +1,7 @@
-FROM golang:1.18
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+FROM golang:1.20

 WORKDIR /go/src/terraform-provider-boundary
 COPY . .
@@ -1,3 +1,5 @@
+Copyright (c) 2020 HashiCorp, Inc.
+
 Mozilla Public License Version 2.0
 ==================================

@@ -34,15 +34,6 @@ test:
 testacc:
 	TF_ACC=1 go test ./... -v $(TESTARGS) -timeout 120m

-testacc-ci:
-	git config --global --add url."git@github.com:".insteadOf "https://github.com/"
-	TF_ACC=1 ~/.go/bin/go test ./... -v $(TESTARGS) -timeout 120m
-
-install-go: ~/.go/bin/go
-
-~/.go/bin/go:
-	./ci/goinstall.sh
-
 dev:
 	GOOS=${GOOS} GOARCH=${GOARCH} ./scripts/plugins.sh
 	mkdir -p $(INSTALL_PATH)
@@ -9,7 +9,7 @@ Requirements
 ------------

 -	[Terraform](https://www.terraform.io/downloads.html) >= 0.12.x
-	[Go](https://golang.org/doc/install) >= 1.18
+-	[Go](https://golang.org/doc/install) >= 1.20

 Building The Provider
 ---------------------
@@ -1,118 +0,0 @@
-#!/bin/bash
-set -e
-
-VERSION="1.18.4"
-
-[ -z "$GOROOT" ] && GOROOT="$HOME/.go"
-[ -z "$GOPATH" ] && GOPATH="$HOME/go"
-
-OS="$(uname -s)"
-ARCH="$(uname -m)"
-
-case $OS in
-    "Linux")
-        case $ARCH in
-        "x86_64")
-            ARCH=amd64
-            ;;
-        "aarch64")
-            ARCH=arm64
-            ;;
-        "armv6")
-            ARCH=armv6l
-            ;;
-        "armv8")
-            ARCH=arm64
-            ;;
-        .*386.*)
-            ARCH=386
-            ;;
-        esac
-        PLATFORM="linux-$ARCH"
-    ;;
-    "Darwin")
-        PLATFORM="darwin-amd64"
-    ;;
-esac
-
-print_help() {
-    echo "Usage: bash goinstall.sh OPTIONS"
-    echo -e "\nOPTIONS:"
-    echo -e "  --remove\tRemove currently installed version"
-    echo -e "  --version\tSpecify a version number to install"
-}
-
-if [ -n "`$SHELL -c 'echo $ZSH_VERSION'`" ]; then
-    shell_profile="zshrc"
-elif [ -n "`$SHELL -c 'echo $BASH_VERSION'`" ]; then
-    shell_profile="bashrc"
-fi
-
-if [ "$1" == "--remove" ]; then
-    rm -rf "$GOROOT"
-    if [ "$OS" == "Darwin" ]; then
-        sed -i "" '/# GoLang/d' "$HOME/.${shell_profile}"
-        sed -i "" '/export GOROOT/d' "$HOME/.${shell_profile}"
-        sed -i "" '/$GOROOT\/bin/d' "$HOME/.${shell_profile}"
-        sed -i "" '/export GOPATH/d' "$HOME/.${shell_profile}"
-        sed -i "" '/$GOPATH\/bin/d' "$HOME/.${shell_profile}"
-    else
-        sed -i '/# GoLang/d' "$HOME/.${shell_profile}"
-        sed -i '/export GOROOT/d' "$HOME/.${shell_profile}"
-        sed -i '/$GOROOT\/bin/d' "$HOME/.${shell_profile}"
-        sed -i '/export GOPATH/d' "$HOME/.${shell_profile}"
-        sed -i '/$GOPATH\/bin/d' "$HOME/.${shell_profile}"
-    fi
-    echo "Go removed."
-    exit 0
-elif [ "$1" == "--help" ]; then
-    print_help
-    exit 0
-elif [ "$1" == "--version" ]; then
-    if [ -z "$2" ]; then # Check if --version has a second positional parameter
-        echo "Please provide a version number for: $1"
-    else
-        VERSION=$2
-    fi
-elif [ ! -z "$1" ]; then
-    echo "Unrecognized option: $1"
-    exit 1
-fi
-
-if [ -d "$GOROOT" ]; then
-    echo "The Go install directory ($GOROOT) already exists. Exiting."
-    exit 1
-fi
-
-PACKAGE_NAME="go$VERSION.$PLATFORM.tar.gz"
-TEMP_DIRECTORY=$(mktemp -d)
-
-echo "Downloading $PACKAGE_NAME ..."
-if hash wget 2>/dev/null; then
-    wget https://storage.googleapis.com/golang/$PACKAGE_NAME -O "$TEMP_DIRECTORY/go.tar.gz"
-else
-    curl -o "$TEMP_DIRECTORY/go.tar.gz" https://storage.googleapis.com/golang/$PACKAGE_NAME
-fi
-
-if [ $? -ne 0 ]; then
-    echo "Download failed! Exiting."
-    exit 1
-fi
-
-echo "Extracting File..."
-mkdir -p "$GOROOT"
-tar -C "$GOROOT" --strip-components=1 -xzf "$TEMP_DIRECTORY/go.tar.gz"
-touch "$HOME/.${shell_profile}"
-{
-    echo '# GoLang'
-    echo "export GOROOT=${GOROOT}"
-    echo 'export PATH=$GOROOT/bin:$PATH'
-    echo "export GOPATH=$GOPATH"
-    echo 'export PATH=$GOPATH/bin:$PATH'
-} >> "$HOME/.${shell_profile}"
-
-mkdir -p $GOPATH/{src,pkg,bin}
-echo -e "\nGo $VERSION was installed into $GOROOT.\nMake sure to relogin into your shell or run:"
-echo -e "\n\tsource $HOME/.${shell_profile}\n\nto update your environment variables."
-echo "Tip: Opening a new terminal window usually just works. :)"
-rm -f "$TEMP_DIRECTORY/go.tar.gz"
@@ -20,6 +20,19 @@ provider "boundary" {
  password_auth_method_login_name = "myuser"          # changeme
  password_auth_method_password   = "passpass"        # changeme
 }
+
+provider "boundary" {
+  addr                            = "http://127.0.0.1:9200"
+  password_auth_method_login_name = "myuser"
+  password_auth_method_password   = "passpass"
+}
+
+provider "boundary" {
+  addr                            = "http://127.0.0.1:9200"
+  password_auth_method_login_name = "myuser"
+  password_auth_method_password   = "passpass"
+  scope_id                        = "s_1234567890"
+}
 ```

 <!-- schema generated by tfplugindocs -->
@@ -31,9 +44,13 @@ provider "boundary" {

 ### Optional

- `auth_method_id` (String) The auth method ID e.g. ampw_1234567890
- `password_auth_method_login_name` (String) The auth method login name for password-style auth methods
- `password_auth_method_password` (String) The auth method password for password-style auth methods
+- `auth_method_id` (String) The auth method ID e.g. ampw_1234567890. If not set, the default auth method for the given scope ID will be used.
+- `auth_method_login_name` (String) The auth method login name for password-style or ldap-style auth methods
+- `auth_method_password` (String) The auth method password for password-style or ldap-style auth methods
+- `password_auth_method_login_name` (String, Deprecated) The auth method login name for password-style auth methods
+- `password_auth_method_password` (String, Deprecated) The auth method password for password-style auth methods
+- `plugin_execution_dir` (String) Specifies a directory that the Boundary provider can use to write and execute its built-in plugins.
 - `recovery_kms_hcl` (String) Can be a heredoc string or a path on disk. If set, the string/file will be parsed as HCL and used with the recovery KMS mechanism. While this is set, it will override any other authentication information; the KMS mechanism will always be used. See Boundary's KMS docs for examples: https://boundaryproject.io/docs/configuration/kms
+- `scope_id` (String) The scope ID for the default auth method.
 - `tls_insecure` (Boolean) When set to true, does not validate the Boundary API endpoint certificate
 - `token` (String) The Boundary token to use, as a string or path on disk containing just the string. If set, the token read here will be used in place of authenticating with the auth method specified in "auth_method_id", although the recovery KMS mechanism will still override this. Can also be set with the BOUNDARY_TOKEN environment variable.
@@ -25,7 +25,7 @@ Deprecated: use `boundary_account_password` instead.
 - `description` (String) The account description.
 - `login_name` (String) The login name for this account.
 - `name` (String) The account name. Defaults to the resource name.
- `password` (String) The account password. Only set on create, changes will not be reflected when updating account.
+- `password` (String, Sensitive) The account password. Only set on create, changes will not be reflected when updating account.

 ### Read-Only

@@ -0,0 +1,33 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_account_ldap Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The account resource allows you to configure a Boundary account.
+---
+
+# boundary_account_ldap (Resource)
+
+The account resource allows you to configure a Boundary account.
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `auth_method_id` (String) The resource ID for the auth method.
+
+### Optional
+
+- `description` (String) The account description.
+- `login_name` (String) The login name for this account.
+- `name` (String) The account name. Defaults to the resource name.
+- `type` (String, Deprecated) The resource type.
+
+### Read-Only
+
+- `id` (String) The ID of the account.
+
+
@@ -28,7 +28,6 @@ resource "boundary_auth_method" "password" {

 resource "boundary_account_password" "jeff" {
  auth_method_id = boundary_auth_method.password.id
-  type           = "password"
  login_name     = "jeff"
  password       = "$uper$ecure"
 }
@@ -40,14 +39,14 @@ resource "boundary_account_password" "jeff" {
 ### Required

 - `auth_method_id` (String) The resource ID for the auth method.
- `type` (String) The resource type.

 ### Optional

 - `description` (String) The account description.
 - `login_name` (String) The login name for this account.
 - `name` (String) The account name. Defaults to the resource name.
- `password` (String) The account password. Only set on create, changes will not be reflected when updating account.
+- `password` (String, Sensitive) The account password. Only set on create, changes will not be reflected when updating account.
+- `type` (String, Deprecated) The resource type.

 ### Read-Only

@@ -0,0 +1,56 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_auth_method_ldap Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The LDAP auth method resource allows you to configure a Boundary authmethodldap.
+---
+
+# boundary_auth_method_ldap (Resource)
+
+The LDAP auth method resource allows you to configure a Boundary auth_method_ldap.
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `scope_id` (String) The scope ID.
+
+### Optional
+
+- `account_attribute_maps` (List of String) Account attribute maps fullname and email.
+- `anon_group_search` (Boolean) Use anon bind when performing LDAP group searches (optional).
+- `bind_dn` (String) The distinguished name of entry to bind when performing user and group searches (optional).
+- `bind_password` (String) The password to use along with bind-dn performing user and group searches (optional).
+- `bind_password_hmac` (String) The HMAC of the bind password returned by the Boundary controller, which is used for comparison after initial setting of the value.
+- `certificates` (List of String) PEM-encoded X.509 CA certificate in ASN.1 DER form that can be used as a trust anchor when connecting to an LDAP server(optional).  This may be specified multiple times
+- `client_certificate` (String) PEM-encoded X.509 client certificate in ASN.1 DER form that can be used to authenticate against an LDAP server(optional).
+- `client_certificate_key` (String) PEM-encoded X.509 client certificate key in PKCS #8, ASN.1 DER form used with the client certificate (optional).
+- `client_certificate_key_hmac` (String) The HMAC of the client certificate key returned by the Boundary controller, which is used for comparison after initial setting of the value.
+- `description` (String) The auth method description.
+- `discover_dn` (Boolean) Use anon bind to discover the bind DN of a user (optional).
+- `enable_groups` (Boolean) Find the authenticated user's groups during authentication (optional).
+- `group_attr` (String) The attribute that enumerates a user's group membership from entries returned by a group search (optional).
+- `group_dn` (String) The base DN under which to perform group search.
+- `group_filter` (String) A go template used to construct a LDAP group search filter (optional).
+- `insecure_tls` (Boolean) Skip the LDAP server SSL certificate validation (optional) - insecure and use with caution.
+- `is_primary_for_scope` (Boolean) When true, makes this auth method the primary auth method for the scope in which it resides. The primary auth method for a scope means the the user will be automatically created when they login using an LDAP account.
+- `name` (String) The auth method name. Defaults to the resource name.
+- `start_tls` (Boolean) Issue StartTLS command after connecting (optional).
+- `state` (String) Can be one of 'inactive', 'active-private', or 'active-public'. Defaults to active-public.
+- `type` (String) The type of auth method; hardcoded.
+- `upn_domain` (String) The userPrincipalDomain used to construct the UPN string for the authenticating user (optional).
+- `urls` (List of String) The LDAP URLs that specify LDAP servers to connect to (required).  May be specified multiple times.
+- `use_token_groups` (Boolean) Use the Active Directory tokenGroups constructed attribute of the user to find the group memberships (optional).
+- `user_attr` (String) The attribute on user entry matching the username passed when authenticating (optional).
+- `user_dn` (String) The base DN under which to perform user search (optional).
+- `user_filter` (String) A go template used to construct a LDAP user search filter (optional).
+
+### Read-Only
+
+- `id` (String) The ID of the auth method.
+
+
@@ -27,14 +27,14 @@ The OIDC auth method resource allows you to configure a Boundary auth_method_oid
 - `callback_url` (String) The URL that should be provided to the IdP for callbacks.
 - `claims_scopes` (List of String) Claims scopes.
 - `client_id` (String) The client ID assigned to this auth method from the provider.
- `client_secret` (String) The secret key assigned to this auth method from the provider. Once set, only the hash will be kept and the original value can be removed from configuration.
+- `client_secret` (String, Sensitive) The secret key assigned to this auth method from the provider. Once set, only the hash will be kept and the original value can be removed from configuration.
 - `client_secret_hmac` (String) The HMAC of the client secret returned by the Boundary controller, which is used for comparison after initial setting of the value.
 - `description` (String) The auth method description.
 - `disable_discovered_config_validation` (Boolean) Disables validation logic ensuring that the OIDC provider's information from its discovery endpoint matches the information here. The validation is only performed at create or update time.
 - `idp_ca_certs` (List of String) A list of CA certificates to trust when validating the IdP's token signatures.
- `is_primary_for_scope` (Boolean) When true, makes this auth method the primary auth method for the scope in which it resides. The primary auth method for a scope means the the user will be automatically created when they login using an OIDC account.
+- `is_primary_for_scope` (Boolean) When true, makes this auth method the primary auth method for the scope in which it resides. The primary auth method for a scope means the user will be automatically created when they login using an OIDC account.
 - `issuer` (String) The issuer corresponding to the provider, which must match the issuer field in generated tokens.
- `max_age` (Number) The max age to provide to the provider, indicating how much time is allowed to have passed since the last authentication before the user is challenged again.
+- `max_age` (Number) The max age to provide to the provider, indicating how much time is allowed to have passed since the last authentication before the user is challenged again. A value of 0 sets an immediate requirement for all users to reauthenticate, and an unset maxAge results in a Terraform value of -1 and the default TTL of the chosen OIDC will be used.
 - `name` (String) The auth method name. Defaults to the resource name.
 - `signing_algorithms` (List of String) Allowed signing algorithms for the provider's issued tokens.
 - `state` (String) Can be one of 'inactive', 'active-private', or 'active-public'. Currently automatically set to active-public.
@@ -0,0 +1,69 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_credential_json Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The json credential resource allows you to congiure a credential using a json object.
+---
+
+# boundary_credential_json (Resource)
+
+The json credential resource allows you to congiure a credential using a json object.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_static" "example" {
+  name        = "example_static_credential_store"
+  description = "My first static credential store!"
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_json" "example" {
+  name                = "example_json"
+  description         = "My first json credential!"
+  credential_store_id = boundary_credential_store_static.example.id
+  object              = file("~/object.json") # change to valid json file
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `credential_store_id` (String) The credential store in which to save this json credential.
+- `object` (String, Sensitive) The object for the this json credential. Either values encoded with the "jsonencode" function, pre-escaped JSON string, or a file
+
+### Optional
+
+- `description` (String) The description of this json credential.
+- `name` (String) The name of this json credential. Defaults to the resource name.
+
+### Read-Only
+
+- `id` (String) The ID of this json credential.
+- `object_hmac` (String) The object hmac.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_credential_json.example_json <my-id>
+```
@@ -56,6 +56,33 @@ resource "boundary_credential_library_vault" "bar" {
 }
 EOT
 }
+
+resource "boundary_credential_library_vault" "baz" {
+  name                = "baz"
+  description         = "vault username password credential with mapping overrides"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "my/secret/baz" # change to Vault backend path
+  http_method         = "GET"
+  credential_type     = "username_password"
+  credential_mapping_overrides = {
+    password_attribute = "alternative_password_label"
+    username_attribute = "alternative_username_label"
+  }
+}
+
+resource "boundary_credential_library_vault" "quz" {
+  name                = "quz"
+  description         = "vault ssh private key credential with mapping overrides"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "my/secret/quz" # change to Vault backend path
+  http_method         = "GET"
+  credential_type     = "ssh_private_key"
+  credential_mapping_overrides = {
+    private_key_attribute            = "alternative_key_label"
+    private_key_passphrase_attribute = "alternative_passphrase_label"
+    username_attribute               = "alternative_username_label"
+  }
+}
 ```

 <!-- schema generated by tfplugindocs -->
@@ -68,7 +95,8 @@ EOT

 ### Optional

- `credential_type` (String) The type of credential the library generates.
+- `credential_mapping_overrides` (Map of String) The credential mapping override.
+- `credential_type` (String) The type of credential the library generates. Cannot be updated on an existing resource.
 - `description` (String) The Vault credential library description.
 - `http_method` (String) The HTTP method the library uses when requesting credentials from Vault. Defaults to 'GET'
 - `http_request_body` (String) The body of the HTTP request the library sends to Vault when requesting credentials. Only valid if `http_method` is set to `POST`.
@@ -0,0 +1,111 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_credential_library_vault_ssh_certificate Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The credential library for Vault resource allows you to configure a Boundary credential library for Vault.
+---
+
+# boundary_credential_library_vault_ssh_certificate (Resource)
+
+The credential library for Vault resource allows you to configure a Boundary credential library for Vault.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_vault" "foo" {
+  name        = "foo"
+  description = "My first Vault credential store!"
+  address     = "http://127.0.0.1:8200"      # change to Vault address
+  token       = "s.0ufRo6XEGU2jOqnIr7OlFYP5" # change to valid Vault token
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_library_vault_ssh_certificate" "foo" {
+  name                = "foo"
+  description         = "My first Vault SSH certificate credential library!"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "ssh/sign/foo" # change to correct Vault endpoint and role
+  username            = "foo"          # change to valid username
+}
+
+resource "boundary_credential_library_vault_ssh_certificate" "bar" {
+  name                = "bar"
+  description         = "My second Vault SSH certificate credential library!"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "ssh/sign/foo" # change to correct Vault endpoint and role
+  username            = "foo"
+  key_type            = "ecdsa"
+  key_bits            = 384
+
+  extensions = {
+    permit-pty = ""
+  }
+}
+
+resource "boundary_credential_library_vault_ssh_certificate" "baz" {
+  name                = "baz"
+  description         = "vault "
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "ssh/issue/foo" # change to correct Vault endpoint and role
+  username            = "foo"
+  key_type            = "rsa"
+  key_bits            = 4096
+
+  extensions = {
+    permit-pty            = ""
+    permit-X11-forwarding = ""
+  }
+
+  critical_options = {
+    force-command = "/bin/some_script"
+  }
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `credential_store_id` (String) The ID of the credential store that this library belongs to.
+- `path` (String) The path in Vault to request credentials from.
+- `username` (String) The username to use with the certificate returned by the library.
+
+### Optional
+
+- `critical_options` (Map of String) Specifies a map of the critical options that the certificate should be signed for.
+- `description` (String) The Vault credential library description.
+- `extensions` (Map of String) Specifies a map of the extensions that the certificate should be signed for.
+- `key_bits` (Number) Specifies the number of bits to use for the generated keys.
+- `key_id` (String) Specifies the key id a certificate should have.
+- `key_type` (String) Specifies the desired key type; must be ed25519, ecdsa, or rsa.
+- `name` (String) The Vault credential library name. Defaults to the resource name.
+- `ttl` (String) Specifies the requested time to live for a certificate returned from the library.
+
+### Read-Only
+
+- `id` (String) The ID of the Vault credential library.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_credential_library_vault_ssh_certificate.foo <my-id>
+```
@@ -50,14 +50,14 @@ resource "boundary_credential_ssh_private_key" "example" {
 ### Required

 - `credential_store_id` (String) ID of the credential store this credential belongs to.
- `private_key` (String) The private key associated with the credential.
+- `private_key` (String, Sensitive) The private key associated with the credential.
 - `username` (String) The username associated with the credential.

 ### Optional

 - `description` (String) The description of the credential.
 - `name` (String) The name of the credential. Defaults to the resource name.
- `private_key_passphrase` (String) The passphrase of the private key associated with the credential.
+- `private_key_passphrase` (String, Sensitive) The passphrase of the private key associated with the credential.

 ### Read-Only

@@ -56,6 +56,7 @@ resource "boundary_credential_store_vault" "example" {
 - `namespace` (String) The namespace within Vault to use.
 - `tls_server_name` (String) Name to use as the SNI host when connecting to Vault via TLS.
 - `tls_skip_verify` (Boolean) Whether or not to skip TLS verification.
+- `worker_filter` (String) HCP Only. A filter used to control which PKI workers can handle Vault requests. This allows the use of private Vault instances with Boundary.

 ### Read-Only

@@ -49,7 +49,7 @@ resource "boundary_credential_username_password" "example" {
 ### Required

 - `credential_store_id` (String) The credential store in which to save this username/password credential.
- `password` (String) The password of this username/password credential.
+- `password` (String, Sensitive) The password of this username/password credential.
 - `username` (String) The username of this username/password credential.

 ### Optional
@@ -10,7 +10,70 @@ description: |-

 The host catalog resource allows you to configure a Boundary plugin-type host catalog. Host catalogs are always part of a project, so a project resource should be used inline or you should have the project ID in hand to successfully configure a host catalog.

+## Example Usage

+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = boundary_scope.global.id
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+# For more information about the aws plugin, please visit here:
+# https://github.com/hashicorp/boundary-plugin-host-aws
+#
+# For more information about aws users, please visit here:
+# https://learn.hashicorp.com/tutorials/boundary/aws-host-catalogs?in=boundary/oss-access-management#configure-terraform-and-iam-user-privileges
+resource "boundary_host_catalog_plugin" "aws_example" {
+  name            = "My aws catalog"
+  description     = "My first host catalog!"
+  scope_id        = boundary_scope.project.id
+  plugin_name     = "aws"
+  attributes_json = jsonencode({ "region" = "us-east-1" })
+
+  # recommended to pass in aws secrets using a file() or using environment variables
+  # the secrets below must be generated in aws by creating a aws iam user with programmatic access
+  secrets_json = jsonencode({
+    "access_key_id"     = "aws_access_key_id_value",
+    "secret_access_key" = "aws_secret_access_key_value"
+  })
+}
+
+# For more information about the azure plugin, please visit here:
+# https://github.com/hashicorp/boundary-plugin-host-azure
+#
+# For more information about azure ad applications, please visit here:
+# https://learn.hashicorp.com/tutorials/boundary/azure-host-catalogs#register-a-new-azure-ad-application-1
+resource "boundary_host_catalog_plugin" "azure_example" {
+  name        = "My azure catalog"
+  description = "My second host catalog!"
+  scope_id    = boundary_scope.project.id
+  plugin_name = "azure"
+
+  # the attributes below must be generated in azure by creating an ad application
+  attributes_json = jsonencode({
+    "disable_credential_rotation" = "true",
+    "tenant_id"                   = "ARM_TENANT_ID",
+    "subscription_id"             = "ARM_SUBSCRIPTION_ID",
+    "client_id"                   = "ARM_CLIENT_ID"
+  })
+
+  # recommended to pass in azure secrets using a file() or using environment variables
+  # the secrets below must be generated in azure by creating an ad application
+  secrets_json = jsonencode({
+    "secret_value" = "ARM_CLIENT_SECRET"
+  })
+}
+```

 <!-- schema generated by tfplugindocs -->
 ## Schema
@@ -36,4 +99,10 @@ The host catalog resource allows you to configure a Boundary plugin-type host ca

 - `id` (String) The ID of the host catalog.

+## Import

+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_host_catalog_plugin.foo <my-id>
+```
@@ -10,7 +10,30 @@ description: |-

 The static host catalog resource allows you to configure a Boundary static-type host catalog. Host catalogs are always part of a project, so a project resource should be used inline or you should have the project ID in hand to successfully configure a host catalog.

+## Example Usage

+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = boundary_scope.global.id
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_host_catalog_static" "example" {
+  name        = "My catalog"
+  description = "My first host catalog!"
+  scope_id    = boundary_scope.project.id
+}
+```

 <!-- schema generated by tfplugindocs -->
 ## Schema
@@ -28,4 +51,10 @@ The static host catalog resource allows you to configure a Boundary static-type

 - `id` (String) The ID of the host catalog.

+## Import

+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_host_catalog_static.foo <my-id>
+```
@@ -10,7 +10,113 @@ description: |-

 The host_set_plugin resource allows you to configure a Boundary host set. Host sets are always part of a host catalog, so a host catalog resource should be used inline or you should have the host catalog ID in hand to successfully configure a host set.

+## Example Usage

+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+# For more information about the aws plugin, please visit here:
+# https://github.com/hashicorp/boundary-plugin-host-aws
+#
+# For more information about aws users, please visit here:
+# https://learn.hashicorp.com/tutorials/boundary/aws-host-catalogs?in=boundary/oss-access-management#configure-terraform-and-iam-user-privileges
+resource "boundary_host_catalog_plugin" "aws_example" {
+  name            = "My aws catalog"
+  description     = "My first host catalog!"
+  scope_id        = boundary_scope.project.id
+  plugin_name     = "aws"
+  attributes_json = jsonencode({ "region" = "us-east-1" })
+
+  # recommended to pass in aws secrets using a file() or using environment variables
+  # the secrets below must be generated in aws by creating a aws iam user with programmatic access
+  secrets_json = jsonencode({
+    "access_key_id"     = "aws_access_key_id_value",
+    "secret_access_key" = "aws_secret_access_key_value"
+  })
+}
+
+resource "boundary_host_set_plugin" "web" {
+  name            = "My web host set plugin"
+  host_catalog_id = boundary_host_catalog_plugin.aws_example.id
+  attributes_json = jsonencode({ "filters" = "tag:service-type=web" })
+}
+
+resource "boundary_host_set_plugin" "foobar" {
+  name                = "My foobar host set plugin"
+  host_catalog_id     = boundary_host_catalog_plugin.aws_example.id
+  preferred_endpoints = ["cidr:54.0.0.0/8"]
+  attributes_json = jsonencode({
+    "filters" = "tag-key=foo",
+    "filters" = "tag-key=bar"
+  })
+}
+
+resource "boundary_host_set_plugin" "launch" {
+  name                  = "My launch host set plugin"
+  host_catalog_id       = boundary_host_catalog_plugin.aws_example.id
+  sync_interval_seconds = 60
+  attributes_json = jsonencode({
+    "filters" = "tag:development=prod,dev",
+    "filters" = "launch-time=2022-01-04T*"
+  })
+}
+
+# For more information about the azure plugin, please visit here:
+# https://github.com/hashicorp/boundary-plugin-host-azure
+#
+# For more information about azure ad applications, please visit here:
+# https://learn.hashicorp.com/tutorials/boundary/azure-host-catalogs#register-a-new-azure-ad-application-1
+resource "boundary_host_catalog_plugin" "azure_example" {
+  name        = "My azure catalog"
+  description = "My second host catalog!"
+  scope_id    = boundary_scope.project.id
+  plugin_name = "azure"
+
+  # the attributes below must be generated in azure by creating an ad application
+  attributes_json = jsonencode({
+    "disable_credential_rotation" = "true",
+    "tenant_id"                   = "ARM_TENANT_ID",
+    "subscription_id"             = "ARM_SUBSCRIPTION_ID",
+    "client_id"                   = "ARM_CLIENT_ID"
+  })
+
+  # recommended to pass in azure secrets using a file() or using environment variables
+  # the secrets below must be generated in azure by creating an ad application
+  secrets_json = jsonencode({
+    "secret_value" = "ARM_CLIENT_SECRET"
+  })
+}
+
+resource "boundary_host_set_plugin" "database" {
+  name            = "My database host set plugin"
+  host_catalog_id = boundary_host_catalog_plugin.azure_example.id
+  attributes_json = jsonencode({ "filter" = "tagName eq 'service-type' and tagValue eq 'database'" })
+}
+
+resource "boundary_host_set_plugin" "foodev" {
+  name                  = "My foodev host set plugin"
+  host_catalog_id       = boundary_host_catalog_plugin.azure_example.id
+  preferred_endpoints   = ["cidr:54.0.0.0/8"]
+  sync_interval_seconds = 60
+  attributes_json = jsonencode({
+    "filter" = "tagName eq 'tag-key' and tagValue eq 'foo'",
+    "filter" = "tagName eq 'application' and tagValue eq 'dev'",
+  })
+}
+```

 <!-- schema generated by tfplugindocs -->
 ## Schema
@@ -32,4 +138,10 @@ The host_set_plugin resource allows you to configure a Boundary host set. Host s

 - `id` (String) The ID of the host set.

+## Import

+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_host_set_plugin.foo <my-id>
+```
@@ -10,7 +10,50 @@ description: |-

 The host_set_static resource allows you to configure a Boundary host set. Host sets are always part of a host catalog, so a host catalog resource should be used inline or you should have the host catalog ID in hand to successfully configure a host set.

+## Example Usage

+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_host_catalog_static" "example" {
+  scope_id = boundary_scope.project.id
+}
+
+resource "boundary_host_static" "first" {
+  name            = "host_1"
+  description     = "My first host!"
+  address         = "10.0.0.1"
+  host_catalog_id = boundary_host_catalog_static.example.id
+}
+
+resource "boundary_host_static" "second" {
+  name            = "host_2"
+  description     = "My second host!"
+  address         = "10.0.0.2"
+  host_catalog_id = boundary_host_catalog_static.example.id
+}
+
+resource "boundary_host_set_static" "web" {
+  host_catalog_id = boundary_host_catalog_static.example.id
+  host_ids = [
+    boundary_host_static.first.id,
+    boundary_host_static.second.id,
+  ]
+}
+```

 <!-- schema generated by tfplugindocs -->
 ## Schema
@@ -30,4 +73,10 @@ The host_set_static resource allows you to configure a Boundary host set. Host s

 - `id` (String) The ID of the host set.

+## Import

+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_host_set_static.foo <my-id>
+```
@@ -10,7 +10,37 @@ description: |-

 The static host resource allows you to configure a Boundary static host. Hosts are always part of a project, so a project resource should be used inline or you should have the project ID in hand to successfully configure a host.

+## Example Usage

+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_host_catalog_static" "example" {
+  name        = "My catalog"
+  description = "My first host catalog!"
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_host_static" "example" {
+  name            = "example_host"
+  description     = "My first host!"
+  address         = "10.0.0.1"
+  host_catalog_id = boundary_host_catalog_static.example.id
+}
+```

 <!-- schema generated by tfplugindocs -->
 ## Schema
@@ -30,4 +60,10 @@ The static host resource allows you to configure a Boundary static host. Hosts a

 - `id` (String) The ID of the host.

+## Import

+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_host_static.foo <my-id>
+```
@@ -0,0 +1,32 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_managed_group_ldap Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The managed group resource allows you to configure a Boundary group.
+---
+
+# boundary_managed_group_ldap (Resource)
+
+The managed group resource allows you to configure a Boundary group.
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `auth_method_id` (String) The resource ID for the auth method.
+- `group_names` (List of String) The list of groups that make up the managed group.
+
+### Optional
+
+- `description` (String) The managed group description.
+- `name` (String) The managed group name. Defaults to the resource name.
+
+### Read-Only
+
+- `id` (String) The ID of the group.
+
+
@@ -126,7 +126,6 @@ resource "boundary_role" "readonly" {

 ### Optional

- `default_role` (Boolean) Indicates that the role containing this value is the default role (that is, has the id 'r_default'), which triggers some specialized behavior to allow it to be imported and managed.
 - `description` (String) The role description.
 - `grant_scope_id` (String)
 - `grant_strings` (Set of String) A list of stringified grants for the role.
@@ -47,6 +47,7 @@ resource "boundary_credential_library_vault" "foo" {
  credential_store_id = boundary_credential_store_vault.foo.id
  path                = "my/secret/foo" # change to Vault backend path
  http_method         = "GET"
+  credential_type     = "username_password"
 }

 resource "boundary_host_catalog" "foo" {
@@ -92,10 +93,33 @@ resource "boundary_target" "foo" {
  host_source_ids = [
    boundary_host_set.foo.id
  ]
-  application_credential_source_ids = [
+  brokered_credential_source_ids = [
    boundary_credential_library_vault.foo.id
  ]
 }
+
+resource "boundary_target" "ssh_foo" {
+  name         = "ssh_foo"
+  description  = "Ssh target"
+  type         = "ssh"
+  default_port = "22"
+  scope_id     = boundary_scope.project.id
+  host_source_ids = [
+    boundary_host_set.foo.id
+  ]
+  injected_application_credential_source_ids = [
+    boundary_credential_library_vault.foo.id
+  ]
+}
+
+resource "boundary_target" "address_foo" {
+  name         = "address_foo"
+  description  = "Foo target with an address"
+  type         = "tcp"
+  default_port = "22"
+  scope_id     = boundary_scope.project.id
+  address      = "127.0.0.1"
+}
 ```

 <!-- schema generated by tfplugindocs -->
@@ -108,14 +132,19 @@ resource "boundary_target" "foo" {

 ### Optional

- `application_credential_source_ids` (Set of String) A list of application credential source ID's.
+- `address` (String) Optionally, a valid network address to connect to for this target. Cannot be used alongside host_source_ids.
+- `brokered_credential_source_ids` (Set of String) A list of brokered credential source ID's.
+- `default_client_port` (Number) The default client port for this target.
 - `default_port` (Number) The default port for this target.
 - `description` (String) The target description.
- `host_source_ids` (Set of String) A list of host source ID's.
+- `egress_worker_filter` (String) Boolean expression to filter the workers used to access this target
+- `host_source_ids` (Set of String) A list of host source ID's. Cannot be used alongside address.
+- `ingress_worker_filter` (String) HCP Only. Boolean expression to filter the workers a user will connect to when initiating a session against this target
+- `injected_application_credential_source_ids` (Set of String) A list of injected application credential source ID's.
 - `name` (String) The target name. Defaults to the resource name.
 - `session_connection_limit` (Number)
 - `session_max_seconds` (Number)
- `worker_filter` (String) Boolean expression to filter the workers for this target
+- `worker_filter` (String, Deprecated) Boolean expression to filter the workers for this target

 ### Read-Only

@@ -0,0 +1,54 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_worker Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The resource allows you to create a self-managed worker object.
+---
+
+# boundary_worker (Resource)
+
+The resource allows you to create a self-managed worker object.
+
+## Example Usage
+
+```terraform
+resource "boundary_worker" "controller_led" {
+  scope_id    = "global"
+  name        = "worker 1"
+  description = "self managed worker with controller led auth"
+}
+
+resource "boundary_self_managed_worker" "worker_led" {
+  scope_id                    = "global"
+  name                        = "worker 2"
+  description                 = "self managed worker with worker led auth"
+  worker_generated_auth_token = var.worker_generated_auth_token
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Optional
+
+- `description` (String) The description for the worker.
+- `name` (String) The name for the worker.
+- `scope_id` (String) The scope for the worker. Defaults to `global`.
+- `worker_generated_auth_token` (String) The worker authentication token required to register the worker for the worker-led authentication flow. Leaving this blank will result in a controller generated token.
+
+### Read-Only
+
+- `address` (String) The accessible address of the self managed worker.
+- `authorized_actions` (List of String) A list of actions that the worker is entitled to perform.
+- `controller_generated_activation_token` (String) A single use token generated by the controller to be passed to the self-managed worker.
+- `id` (String) The ID of the worker.
+- `release_version` (Number) The version of the Boundary binary running on the self managed worker.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_worker.foo <my-id>
+```
@@ -4,3 +4,16 @@ provider "boundary" {
  password_auth_method_login_name = "myuser"          # changeme
  password_auth_method_password   = "passpass"        # changeme
 }
+
+provider "boundary" {
+  addr                            = "http://127.0.0.1:9200"
+  password_auth_method_login_name = "myuser"
+  password_auth_method_password   = "passpass"
+}
+
+provider "boundary" {
+  addr                            = "http://127.0.0.1:9200"
+  password_auth_method_login_name = "myuser"
+  password_auth_method_password   = "passpass"
+  scope_id                        = "s_1234567890"
+}
@@ -13,7 +13,6 @@ resource "boundary_auth_method" "password" {

 resource "boundary_account_password" "jeff" {
  auth_method_id = boundary_auth_method.password.id
-  type           = "password"
  login_name     = "jeff"
  password       = "$uper$ecure"
 }
@@ -0,0 +1 @@
+terraform import boundary_credential_json.example_json <my-id>
@@ -0,0 +1,27 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_static" "example" {
+  name        = "example_static_credential_store"
+  description = "My first static credential store!"
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_json" "example" {
+  name                = "example_json"
+  description         = "My first json credential!"
+  credential_store_id = boundary_credential_store_static.example.id
+  object              = file("~/object.json") # change to valid json file
+}
@@ -41,3 +41,30 @@ resource "boundary_credential_library_vault" "bar" {
 }
 EOT
 }
+
+resource "boundary_credential_library_vault" "baz" {
+  name                = "baz"
+  description         = "vault username password credential with mapping overrides"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "my/secret/baz" # change to Vault backend path
+  http_method         = "GET"
+  credential_type     = "username_password"
+  credential_mapping_overrides = {
+    password_attribute = "alternative_password_label"
+    username_attribute = "alternative_username_label"
+  }
+}
+
+resource "boundary_credential_library_vault" "quz" {
+  name                = "quz"
+  description         = "vault ssh private key credential with mapping overrides"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "my/secret/quz" # change to Vault backend path
+  http_method         = "GET"
+  credential_type     = "ssh_private_key"
+  credential_mapping_overrides = {
+    private_key_attribute            = "alternative_key_label"
+    private_key_passphrase_attribute = "alternative_passphrase_label"
+    username_attribute               = "alternative_username_label"
+  }
+}
@@ -0,0 +1 @@
+terraform import boundary_credential_library_vault_ssh_certificate.foo <my-id>
@@ -0,0 +1,63 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_vault" "foo" {
+  name        = "foo"
+  description = "My first Vault credential store!"
+  address     = "http://127.0.0.1:8200"      # change to Vault address
+  token       = "s.0ufRo6XEGU2jOqnIr7OlFYP5" # change to valid Vault token
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_library_vault_ssh_certificate" "foo" {
+  name                = "foo"
+  description         = "My first Vault SSH certificate credential library!"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "ssh/sign/foo" # change to correct Vault endpoint and role
+  username            = "foo"          # change to valid username
+}
+
+resource "boundary_credential_library_vault_ssh_certificate" "bar" {
+  name                = "bar"
+  description         = "My second Vault SSH certificate credential library!"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "ssh/sign/foo" # change to correct Vault endpoint and role
+  username            = "foo"
+  key_type            = "ecdsa"
+  key_bits            = 384
+
+  extensions = {
+    permit-pty = ""
+  }
+}
+
+resource "boundary_credential_library_vault_ssh_certificate" "baz" {
+  name                = "baz"
+  description         = "vault "
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "ssh/issue/foo" # change to correct Vault endpoint and role
+  username            = "foo"
+  key_type            = "rsa"
+  key_bits            = 4096
+
+  extensions = {
+    permit-pty            = ""
+    permit-X11-forwarding = ""
+  }
+
+  critical_options = {
+    force-command = "/bin/some_script"
+  }
+}
@@ -0,0 +1 @@
+terraform import boundary_host_catalog_plugin.foo <my-id>
@@ -0,0 +1,60 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = boundary_scope.global.id
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+# For more information about the aws plugin, please visit here:
+# https://github.com/hashicorp/boundary-plugin-host-aws
+#
+# For more information about aws users, please visit here:
+# https://learn.hashicorp.com/tutorials/boundary/aws-host-catalogs?in=boundary/oss-access-management#configure-terraform-and-iam-user-privileges
+resource "boundary_host_catalog_plugin" "aws_example" {
+  name            = "My aws catalog"
+  description     = "My first host catalog!"
+  scope_id        = boundary_scope.project.id
+  plugin_name     = "aws"
+  attributes_json = jsonencode({ "region" = "us-east-1" })
+
+  # recommended to pass in aws secrets using a file() or using environment variables
+  # the secrets below must be generated in aws by creating a aws iam user with programmatic access
+  secrets_json = jsonencode({
+    "access_key_id"     = "aws_access_key_id_value",
+    "secret_access_key" = "aws_secret_access_key_value"
+  })
+}
+
+# For more information about the azure plugin, please visit here:
+# https://github.com/hashicorp/boundary-plugin-host-azure
+#
+# For more information about azure ad applications, please visit here:
+# https://learn.hashicorp.com/tutorials/boundary/azure-host-catalogs#register-a-new-azure-ad-application-1
+resource "boundary_host_catalog_plugin" "azure_example" {
+  name        = "My azure catalog"
+  description = "My second host catalog!"
+  scope_id    = boundary_scope.project.id
+  plugin_name = "azure"
+
+  # the attributes below must be generated in azure by creating an ad application
+  attributes_json = jsonencode({
+    "disable_credential_rotation" = "true",
+    "tenant_id"                   = "ARM_TENANT_ID",
+    "subscription_id"             = "ARM_SUBSCRIPTION_ID",
+    "client_id"                   = "ARM_CLIENT_ID"
+  })
+
+  # recommended to pass in azure secrets using a file() or using environment variables
+  # the secrets below must be generated in azure by creating an ad application
+  secrets_json = jsonencode({
+    "secret_value" = "ARM_CLIENT_SECRET"
+  })
+}
@@ -0,0 +1 @@
+terraform import boundary_host_catalog_static.foo <my-id>
@@ -0,0 +1,20 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = boundary_scope.global.id
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_host_catalog_static" "example" {
+  name        = "My catalog"
+  description = "My first host catalog!"
+  scope_id    = boundary_scope.project.id
+}
@@ -0,0 +1 @@
+terraform import boundary_host_set_plugin.foo <my-id>
@@ -0,0 +1,103 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+# For more information about the aws plugin, please visit here:
+# https://github.com/hashicorp/boundary-plugin-host-aws
+#
+# For more information about aws users, please visit here:
+# https://learn.hashicorp.com/tutorials/boundary/aws-host-catalogs?in=boundary/oss-access-management#configure-terraform-and-iam-user-privileges
+resource "boundary_host_catalog_plugin" "aws_example" {
+  name            = "My aws catalog"
+  description     = "My first host catalog!"
+  scope_id        = boundary_scope.project.id
+  plugin_name     = "aws"
+  attributes_json = jsonencode({ "region" = "us-east-1" })
+
+  # recommended to pass in aws secrets using a file() or using environment variables
+  # the secrets below must be generated in aws by creating a aws iam user with programmatic access
+  secrets_json = jsonencode({
+    "access_key_id"     = "aws_access_key_id_value",
+    "secret_access_key" = "aws_secret_access_key_value"
+  })
+}
+
+resource "boundary_host_set_plugin" "web" {
+  name            = "My web host set plugin"
+  host_catalog_id = boundary_host_catalog_plugin.aws_example.id
+  attributes_json = jsonencode({ "filters" = "tag:service-type=web" })
+}
+
+resource "boundary_host_set_plugin" "foobar" {
+  name                = "My foobar host set plugin"
+  host_catalog_id     = boundary_host_catalog_plugin.aws_example.id
+  preferred_endpoints = ["cidr:54.0.0.0/8"]
+  attributes_json = jsonencode({
+    "filters" = "tag-key=foo",
+    "filters" = "tag-key=bar"
+  })
+}
+
+resource "boundary_host_set_plugin" "launch" {
+  name                  = "My launch host set plugin"
+  host_catalog_id       = boundary_host_catalog_plugin.aws_example.id
+  sync_interval_seconds = 60
+  attributes_json = jsonencode({
+    "filters" = "tag:development=prod,dev",
+    "filters" = "launch-time=2022-01-04T*"
+  })
+}
+
+# For more information about the azure plugin, please visit here:
+# https://github.com/hashicorp/boundary-plugin-host-azure
+#
+# For more information about azure ad applications, please visit here:
+# https://learn.hashicorp.com/tutorials/boundary/azure-host-catalogs#register-a-new-azure-ad-application-1
+resource "boundary_host_catalog_plugin" "azure_example" {
+  name        = "My azure catalog"
+  description = "My second host catalog!"
+  scope_id    = boundary_scope.project.id
+  plugin_name = "azure"
+
+  # the attributes below must be generated in azure by creating an ad application
+  attributes_json = jsonencode({
+    "disable_credential_rotation" = "true",
+    "tenant_id"                   = "ARM_TENANT_ID",
+    "subscription_id"             = "ARM_SUBSCRIPTION_ID",
+    "client_id"                   = "ARM_CLIENT_ID"
+  })
+
+  # recommended to pass in azure secrets using a file() or using environment variables
+  # the secrets below must be generated in azure by creating an ad application
+  secrets_json = jsonencode({
+    "secret_value" = "ARM_CLIENT_SECRET"
+  })
+}
+
+resource "boundary_host_set_plugin" "database" {
+  name            = "My database host set plugin"
+  host_catalog_id = boundary_host_catalog_plugin.azure_example.id
+  attributes_json = jsonencode({ "filter" = "tagName eq 'service-type' and tagValue eq 'database'" })
+}
+
+resource "boundary_host_set_plugin" "foodev" {
+  name                  = "My foodev host set plugin"
+  host_catalog_id       = boundary_host_catalog_plugin.azure_example.id
+  preferred_endpoints   = ["cidr:54.0.0.0/8"]
+  sync_interval_seconds = 60
+  attributes_json = jsonencode({
+    "filter" = "tagName eq 'tag-key' and tagValue eq 'foo'",
+    "filter" = "tagName eq 'application' and tagValue eq 'dev'",
+  })
+}
@@ -0,0 +1 @@
+terraform import boundary_host_set_static.foo <my-id>
@@ -0,0 +1,40 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_host_catalog_static" "example" {
+  scope_id = boundary_scope.project.id
+}
+
+resource "boundary_host_static" "first" {
+  name            = "host_1"
+  description     = "My first host!"
+  address         = "10.0.0.1"
+  host_catalog_id = boundary_host_catalog_static.example.id
+}
+
+resource "boundary_host_static" "second" {
+  name            = "host_2"
+  description     = "My second host!"
+  address         = "10.0.0.2"
+  host_catalog_id = boundary_host_catalog_static.example.id
+}
+
+resource "boundary_host_set_static" "web" {
+  host_catalog_id = boundary_host_catalog_static.example.id
+  host_ids = [
+    boundary_host_static.first.id,
+    boundary_host_static.second.id,
+  ]
+}
@@ -0,0 +1 @@
+terraform import boundary_host_static.foo <my-id>
@@ -0,0 +1,27 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_host_catalog_static" "example" {
+  name        = "My catalog"
+  description = "My first host catalog!"
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_host_static" "example" {
+  name            = "example_host"
+  description     = "My first host!"
+  address         = "10.0.0.1"
+  host_catalog_id = boundary_host_catalog_static.example.id
+}
@@ -32,6 +32,7 @@ resource "boundary_credential_library_vault" "foo" {
  credential_store_id = boundary_credential_store_vault.foo.id
  path                = "my/secret/foo" # change to Vault backend path
  http_method         = "GET"
+  credential_type     = "username_password"
 }

 resource "boundary_host_catalog" "foo" {
@@ -77,7 +78,30 @@ resource "boundary_target" "foo" {
  host_source_ids = [
    boundary_host_set.foo.id
  ]
-  application_credential_source_ids = [
+  brokered_credential_source_ids = [
    boundary_credential_library_vault.foo.id
  ]
 }
+
+resource "boundary_target" "ssh_foo" {
+  name         = "ssh_foo"
+  description  = "Ssh target"
+  type         = "ssh"
+  default_port = "22"
+  scope_id     = boundary_scope.project.id
+  host_source_ids = [
+    boundary_host_set.foo.id
+  ]
+  injected_application_credential_source_ids = [
+    boundary_credential_library_vault.foo.id
+  ]
+}
+
+resource "boundary_target" "address_foo" {
+  name         = "address_foo"
+  description  = "Foo target with an address"
+  type         = "tcp"
+  default_port = "22"
+  scope_id     = boundary_scope.project.id
+  address      = "127.0.0.1"
+}
@@ -0,0 +1 @@
+terraform import boundary_worker.foo <my-id>
@@ -0,0 +1,13 @@
+resource "boundary_worker" "controller_led" {
+  scope_id                    = "global"
+  name                        = "worker 1"
+  description                 = "self managed worker with controlled led auth"
+  worker_generated_auth_token = var.worker_generated_auth_token
+}
+
+resource "boundary_self_managed_worker" "worker_led" {
+  scope_id                    = "global"
+  name                        = "worker 2"
+  description                 = "self managed worker with controlled led auth"
+  worker_generated_auth_token = var.worker_generated_auth_token
+}
@@ -0,0 +1,12 @@
+resource "boundary_worker" "controller_led" {
+  scope_id    = "global"
+  name        = "worker 1"
+  description = "self managed worker with controller led auth"
+}
+
+resource "boundary_self_managed_worker" "worker_led" {
+  scope_id                    = "global"
+  name                        = "worker 2"
+  description                 = "self managed worker with worker led auth"
+  worker_generated_auth_token = var.worker_generated_auth_token
+}
@@ -1,146 +1,150 @@
 module github.com/hashicorp/terraform-provider-boundary

-go 1.18
+go 1.20

 require (
-	github.com/hashicorp/boundary v0.10.2
-	github.com/hashicorp/boundary/api v0.0.28
-	github.com/hashicorp/boundary/sdk v0.0.20
-	github.com/hashicorp/cap v0.2.0
+	github.com/hashicorp/boundary v0.13.0
+	github.com/hashicorp/boundary/api v0.0.39
+	github.com/hashicorp/boundary/sdk v0.0.35
+	github.com/hashicorp/cap v0.3.1
+	github.com/hashicorp/cap/ldap v0.0.0-20230420150311-6d1e00a6c5e0
 	github.com/hashicorp/go-cty v1.4.1-0.20200723130312-85980079f637
-	github.com/hashicorp/go-kms-wrapping/v2 v2.0.6-0.20220722192355-a843f53fa48d
-	github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.5
+	github.com/hashicorp/go-kms-wrapping/v2 v2.0.10-0.20230601143830-08d524b564ba
+	github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.10
 	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7
-	github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.2
-	github.com/hashicorp/terraform-plugin-docs v0.13.0
-	github.com/hashicorp/terraform-plugin-sdk/v2 v2.21.0
-	github.com/kr/pretty v0.3.0
+	github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.4
+	github.com/hashicorp/terraform-plugin-docs v0.14.1
+	github.com/hashicorp/terraform-plugin-sdk/v2 v2.26.1
+	github.com/jimlambrt/gldap v0.1.6
+	github.com/kr/pretty v0.3.1
 	github.com/mitchellh/go-homedir v1.1.0
-	github.com/stretchr/testify v1.8.0
-	golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d
+	github.com/stretchr/testify v1.8.4
+	golang.org/x/crypto v0.9.0
 )

 require (
 	github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 // indirect
-	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
+	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
 	github.com/DATA-DOG/go-sqlmock v1.5.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
-	github.com/Masterminds/semver/v3 v3.1.1 // indirect
-	github.com/Masterminds/sprig/v3 v3.2.2 // indirect
-	github.com/Microsoft/go-winio v0.5.0 // indirect
+	github.com/Masterminds/semver/v3 v3.2.0 // indirect
+	github.com/Masterminds/sprig/v3 v3.2.3 // indirect
+	github.com/Microsoft/go-winio v0.6.0 // indirect
 	github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 // indirect
 	github.com/agext/levenshtein v1.2.2 // indirect
 	github.com/alessio/shellescape v1.4.1 // indirect
 	github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
-	github.com/armon/go-metrics v0.3.9 // indirect
 	github.com/armon/go-radix v1.0.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bgentry/speakeasy v0.1.0 // indirect
+	github.com/cenkalti/backoff v2.2.1+incompatible // indirect
 	github.com/cenkalti/backoff/v3 v3.0.0 // indirect
-	github.com/cenkalti/backoff/v4 v4.1.0 // indirect
-	github.com/cespare/xxhash/v2 v2.1.2 // indirect
-	github.com/containerd/continuity v0.1.0 // indirect
-	github.com/coreos/go-oidc/v3 v3.1.0 // indirect
-	github.com/danieljoos/wincred v1.1.2 // indirect
+	github.com/cenkalti/backoff/v4 v4.2.0 // indirect
+	github.com/cespare/xxhash/v2 v2.2.0 // indirect
+	github.com/containerd/continuity v0.3.0 // indirect
+	github.com/coreos/go-oidc/v3 v3.5.0 // indirect
+	github.com/danieljoos/wincred v1.2.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/docker/cli v20.10.7+incompatible // indirect
-	github.com/docker/docker v20.10.9+incompatible // indirect
+	github.com/docker/cli v23.0.1+incompatible // indirect
+	github.com/docker/docker v23.0.3+incompatible // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
-	github.com/docker/go-units v0.4.0 // indirect
+	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dvsekhvalnov/jose2go v1.5.0 // indirect
-	github.com/fatih/color v1.13.0 // indirect
+	github.com/fatih/color v1.15.0 // indirect
 	github.com/fatih/structs v1.1.0 // indirect
-	github.com/godbus/dbus/v5 v5.0.6 // indirect
+	github.com/go-asn1-ber/asn1-ber v1.5.4 // indirect
+	github.com/go-jose/go-jose/v3 v3.0.0 // indirect
+	github.com/go-ldap/ldap/v3 v3.4.4 // indirect
+	github.com/godbus/dbus/v5 v5.1.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang-migrate/migrate/v4 v4.15.1 // indirect
-	github.com/golang/protobuf v1.5.2 // indirect
-	github.com/golang/snappy v0.0.4 // indirect
-	github.com/google/go-cmp v0.5.8 // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/google/go-cmp v0.5.9 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/google/uuid v1.3.0 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.10.0 // indirect
-	github.com/hashicorp/dbassert v0.0.0-20210708202608-ecf920cf1ed8 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 // indirect
+	github.com/hashicorp/dbassert v0.0.0-20230405175854-2d88acd5134b // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
-	github.com/hashicorp/eventlogger v0.1.1-0.20211106154408-4ff8da3a890c // indirect
-	github.com/hashicorp/eventlogger/filters/encrypt v0.1.7 // indirect
-	github.com/hashicorp/go-bexpr v0.1.10 // indirect
+	github.com/hashicorp/eventlogger v0.1.2-0.20230428153751-cca445805f24 // indirect
+	github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20230428153751-cca445805f24 // indirect
+	github.com/hashicorp/go-bexpr v0.1.12 // indirect
 	github.com/hashicorp/go-checkpoint v0.5.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-dbw v0.0.0-20220412153211-c470aec9369f // indirect
-	github.com/hashicorp/go-hclog v1.2.1 // indirect
-	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
-	github.com/hashicorp/go-kms-wrapping/extras/kms/v2 v2.0.0-20220711120347-32232bae6803 // indirect
-	github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.2 // indirect
+	github.com/hashicorp/go-dbw v0.0.0-20230605211904-d40e5c9d5995 // indirect
+	github.com/hashicorp/go-hclog v1.5.0 // indirect
+	github.com/hashicorp/go-kms-wrapping/extras/kms/v2 v2.0.0-20221122211539-47c893099f13 // indirect
+	github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.4 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/hashicorp/go-plugin v1.4.4 // indirect
-	github.com/hashicorp/go-retryablehttp v0.7.0 // indirect
+	github.com/hashicorp/go-plugin v1.4.9 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.2 // indirect
 	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
 	github.com/hashicorp/go-secure-stdlib/base62 v0.1.2 // indirect
 	github.com/hashicorp/go-secure-stdlib/gatedwriter v0.1.1 // indirect
-	github.com/hashicorp/go-secure-stdlib/kv-builder v0.1.1 // indirect
-	github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.4 // indirect
-	github.com/hashicorp/go-secure-stdlib/mlock v0.1.1 // indirect
+	github.com/hashicorp/go-secure-stdlib/kv-builder v0.1.2 // indirect
+	github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.7 // indirect
+	github.com/hashicorp/go-secure-stdlib/mlock v0.1.3 // indirect
 	github.com/hashicorp/go-secure-stdlib/reloadutil v0.1.1 // indirect
 	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
-	github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.1 // indirect
+	github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.2 // indirect
 	github.com/hashicorp/go-sockaddr v1.0.2 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
 	github.com/hashicorp/go-version v1.6.0 // indirect
-	github.com/hashicorp/golang-lru v0.5.4 // indirect
-	github.com/hashicorp/hc-install v0.4.0 // indirect
+	github.com/hashicorp/hc-install v0.5.0 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
-	github.com/hashicorp/hcl/v2 v2.13.0 // indirect
+	github.com/hashicorp/hcl/v2 v2.16.2 // indirect
 	github.com/hashicorp/logutils v1.0.0 // indirect
-	github.com/hashicorp/nodeenrollment v0.1.13 // indirect
-	github.com/hashicorp/terraform-exec v0.17.2 // indirect
-	github.com/hashicorp/terraform-json v0.14.0 // indirect
-	github.com/hashicorp/terraform-plugin-go v0.14.0 // indirect
-	github.com/hashicorp/terraform-plugin-log v0.7.0 // indirect
-	github.com/hashicorp/terraform-registry-address v0.0.0-20220623143253-7d51757b572c // indirect
+	github.com/hashicorp/nodeenrollment v0.2.4 // indirect
+	github.com/hashicorp/terraform-exec v0.18.1 // indirect
+	github.com/hashicorp/terraform-json v0.16.0 // indirect
+	github.com/hashicorp/terraform-plugin-go v0.14.3 // indirect
+	github.com/hashicorp/terraform-plugin-log v0.8.0 // indirect
+	github.com/hashicorp/terraform-registry-address v0.1.0 // indirect
 	github.com/hashicorp/terraform-svchost v0.0.0-20200729002733-f050f53b9734 // indirect
-	github.com/hashicorp/vault/api v1.3.1 // indirect
+	github.com/hashicorp/vault/api v1.9.1 // indirect
 	github.com/hashicorp/vault/sdk v0.3.0 // indirect
-	github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d // indirect
-	github.com/huandu/xstrings v1.3.2 // indirect
+	github.com/hashicorp/yamux v0.1.1 // indirect
+	github.com/huandu/xstrings v1.4.0 // indirect
 	github.com/imdario/mergo v0.3.13 // indirect
 	github.com/jackc/chunkreader/v2 v2.0.1 // indirect
-	github.com/jackc/pgconn v1.10.1 // indirect
+	github.com/jackc/pgconn v1.14.0 // indirect
 	github.com/jackc/pgio v1.0.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
-	github.com/jackc/pgproto3/v2 v2.2.0 // indirect
-	github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b // indirect
-	github.com/jackc/pgtype v1.9.0 // indirect
-	github.com/jackc/pgx/v4 v4.14.0 // indirect
+	github.com/jackc/pgproto3/v2 v2.3.2 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
+	github.com/jackc/pgtype v1.14.0 // indirect
+	github.com/jackc/pgx/v4 v4.18.1 // indirect
+	github.com/jackc/pgx/v5 v5.3.1 // indirect
 	github.com/jefferai/go-libsecret v0.0.0-20210525195240-b53481abef97 // indirect
 	github.com/jefferai/isbadcipher v0.0.0-20190226160619-51d2077c035f // indirect
 	github.com/jefferai/keyring v1.1.7-0.20220316160357-58a74bb55891 // indirect
 	github.com/jinzhu/gorm v1.9.12 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
-	github.com/jinzhu/now v1.1.3 // indirect
+	github.com/jinzhu/now v1.1.5 // indirect
 	github.com/kr/text v0.2.0 // indirect
-	github.com/lib/pq v1.10.2 // indirect
-	github.com/mattn/go-colorable v0.1.12 // indirect
-	github.com/mattn/go-isatty v0.0.14 // indirect
-	github.com/mattn/go-sqlite3 v2.0.1+incompatible // indirect
+	github.com/lib/pq v1.10.7 // indirect
+	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-isatty v0.0.19 // indirect
+	github.com/mattn/go-sqlite3 v2.0.3+incompatible // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
-	github.com/mitchellh/cli v1.1.4 // indirect
+	github.com/mikesmitty/edkey v0.0.0-20170222072505-3356ea4e686a // indirect
+	github.com/mitchellh/cli v1.1.5 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/go-testing-interface v1.14.1 // indirect
 	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
-	github.com/mitchellh/pointerstructure v1.2.0 // indirect
+	github.com/mitchellh/pointerstructure v1.2.1 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
-	github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6 // indirect
+	github.com/moby/term v0.0.0-20221205130635-1aeaba878587 // indirect
 	github.com/mr-tron/base58 v1.2.0 // indirect
 	github.com/mtibben/percent v0.2.1 // indirect
-	github.com/oklog/run v1.0.0 // indirect
+	github.com/oklog/run v1.1.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.0.1 // indirect
-	github.com/opencontainers/runc v1.0.2 // indirect
-	github.com/ory/dockertest/v3 v3.7.0 // indirect
-	github.com/pierrec/lz4 v2.5.2+incompatible // indirect
-	github.com/pires/go-proxyproto v0.6.1 // indirect
+	github.com/opencontainers/image-spec v1.0.2 // indirect
+	github.com/opencontainers/runc v1.1.5 // indirect
+	github.com/ory/dockertest/v3 v3.9.1 // indirect
+	github.com/pires/go-proxyproto v0.7.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/posener/complete v1.2.3 // indirect
@@ -148,37 +152,42 @@ require (
 	github.com/prometheus/client_model v0.2.0 // indirect
 	github.com/prometheus/common v0.32.1 // indirect
 	github.com/prometheus/procfs v0.7.3 // indirect
-	github.com/rogpeppe/go-internal v1.8.1 // indirect
+	github.com/rogpeppe/go-internal v1.9.0 // indirect
 	github.com/russross/blackfriday v1.6.0 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
 	github.com/sethvargo/go-diceware v0.3.0 // indirect
 	github.com/shopspring/decimal v1.3.1 // indirect
-	github.com/sirupsen/logrus v1.8.1 // indirect
+	github.com/sirupsen/logrus v1.9.0 // indirect
 	github.com/spf13/cast v1.5.0 // indirect
 	github.com/vmihailenco/msgpack v4.0.4+incompatible // indirect
 	github.com/vmihailenco/msgpack/v4 v4.3.12 // indirect
 	github.com/vmihailenco/tagparser v0.1.1 // indirect
-	github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f // indirect
+	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
-	github.com/xo/dburl v0.9.0 // indirect
-	github.com/zalando/go-keyring v0.2.1 // indirect
-	github.com/zclconf/go-cty v1.10.0 // indirect
+	github.com/xo/dburl v0.14.2 // indirect
+	github.com/zalando/go-keyring v0.2.3 // indirect
+	github.com/zclconf/go-cty v1.13.1 // indirect
 	go.uber.org/atomic v1.9.0 // indirect
-	golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd // indirect
-	golang.org/x/oauth2 v0.0.0-20220309155454-6242fa91716a // indirect
-	golang.org/x/sys v0.0.0-20220627191245-f75cf1eec38b // indirect
-	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 // indirect
-	golang.org/x/text v0.3.7 // indirect
-	golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e // indirect
+	golang.org/x/exp v0.0.0-20230425010034-47ecfdc1ba53 // indirect
+	golang.org/x/mod v0.8.0 // indirect
+	golang.org/x/net v0.10.0 // indirect
+	golang.org/x/oauth2 v0.8.0 // indirect
+	golang.org/x/sys v0.8.0 // indirect
+	golang.org/x/term v0.8.0 // indirect
+	golang.org/x/text v0.9.0 // indirect
+	golang.org/x/time v0.3.0 // indirect
+	golang.org/x/tools v0.6.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20220317150908-0efb43f6373e // indirect
-	google.golang.org/grpc v1.48.0 // indirect
-	google.golang.org/protobuf v1.28.1 // indirect
+	google.golang.org/genproto v0.0.0-20230526203410-71b5a4ffd15e // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20230530153820-e85fd2cbaebc // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc // indirect
+	google.golang.org/grpc v1.55.0 // indirect
+	google.golang.org/protobuf v1.30.0 // indirect
 	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	gorm.io/driver/postgres v1.2.2 // indirect
-	gorm.io/driver/sqlite v1.2.4 // indirect
-	gorm.io/gorm v1.22.3 // indirect
+	gorm.io/driver/postgres v1.5.2 // indirect
+	gorm.io/driver/sqlite v1.5.1 // indirect
+	gorm.io/gorm v1.25.1 // indirect
 )
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider

 const (
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // Helpers for dealing with file paths and their contents
 //
 // Originally from Terraform; see
@@ -1,9 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider

 import (
 	"context"
 	"errors"
 	"fmt"
+	"net/http"
 	"strings"

 	"github.com/hashicorp/boundary/api"
@@ -17,6 +21,12 @@ import (
 	kms_plugin_assets "github.com/hashicorp/terraform-provider-boundary/plugins/kms"
 )

+const (
+	PASSWORD_AUTH_METHOD_PREFIX = "ampw"
+	LDAP_AUTH_METHOD_PREFIX     = "amldap"
+	DEFAULT_PROVIDER_SCOPE      = "global"
+)
+
 func init() {
 	// descriptions are written in markdown for docs
 	schema.DescriptionKind = schema.StringMarkdown
@@ -43,50 +53,78 @@ func New() *schema.Provider {
 			"auth_method_id": {
 				Type:        schema.TypeString,
 				Optional:    true,
-				Description: "The auth method ID e.g. ampw_1234567890",
+				Description: "The auth method ID e.g. ampw_1234567890. If not set, the default auth method for the given scope ID will be used.",
 			},
 			"password_auth_method_login_name": {
 				Type:        schema.TypeString,
 				Optional:    true,
 				Description: "The auth method login name for password-style auth methods",
+				Deprecated:  "Use auth_method_login_name instead",
 			},
 			"password_auth_method_password": {
 				Type:        schema.TypeString,
 				Optional:    true,
 				Description: "The auth method password for password-style auth methods",
+				Deprecated:  "Use auth_method_password instead",
+			},
+			"auth_method_login_name": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Description: "The auth method login name for password-style or ldap-style auth methods",
+			},
+			"auth_method_password": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Description: "The auth method password for password-style or ldap-style auth methods",
 			},
 			"tls_insecure": {
 				Type:        schema.TypeBool,
 				Optional:    true,
 				Description: "When set to true, does not validate the Boundary API endpoint certificate",
 			},
+			"plugin_execution_dir": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Description: `Specifies a directory that the Boundary provider can use to write and execute its built-in plugins.`,
+			},
+			"scope_id": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Description: `The scope ID for the default auth method.`,
+			},
 		},
 		ResourcesMap: map[string]*schema.Resource{
-			"boundary_account":                      resourceAccount(),
-			"boundary_account_password":             resourceAccountPassword(),
-			"boundary_account_oidc":                 resourceAccountOidc(),
-			"boundary_auth_method":                  resourceAuthMethod(),
-			"boundary_auth_method_password":         resourceAuthMethodPassword(),
-			"boundary_auth_method_oidc":             resourceAuthMethodOidc(),
-			"boundary_credential_library_vault":     resourceCredentialLibraryVault(),
-			"boundary_credential_store_vault":       resourceCredentialStoreVault(),
-			"boundary_credential_store_static":      resourceCredentialStoreStatic(),
-			"boundary_credential_username_password": resourceCredentialUsernamePassword(),
-			"boundary_credential_ssh_private_key":   resourceCredentialSshPrivateKey(),
-			"boundary_managed_group":                resourceManagedGroup(),
-			"boundary_group":                        resourceGroup(),
-			"boundary_host":                         resourceHost(),
-			"boundary_host_static":                  resourceHostStatic(),
-			"boundary_host_catalog":                 resourceHostCatalog(),
-			"boundary_host_catalog_static":          resourceHostCatalogStatic(),
-			"boundary_host_catalog_plugin":          resourceHostCatalogPlugin(),
-			"boundary_host_set":                     resourceHostSet(),
-			"boundary_host_set_static":              resourceHostSetStatic(),
-			"boundary_host_set_plugin":              resourceHostSetPlugin(),
-			"boundary_role":                         resourceRole(),
-			"boundary_scope":                        resourceScope(),
-			"boundary_target":                       resourceTarget(),
-			"boundary_user":                         resourceUser(),
+			"boundary_account":                                  resourceAccount(),
+			"boundary_account_password":                         resourceAccountPassword(),
+			"boundary_account_oidc":                             resourceAccountOidc(),
+			"boundary_account_ldap":                             resourceAccountLdap(),
+			"boundary_auth_method":                              resourceAuthMethod(),
+			"boundary_auth_method_password":                     resourceAuthMethodPassword(),
+			"boundary_auth_method_oidc":                         resourceAuthMethodOidc(),
+			"boundary_auth_method_ldap":                         resourceAuthMethodLdap(),
+			"boundary_credential_library_vault":                 resourceCredentialLibraryVault(),
+			"boundary_credential_library_vault_ssh_certificate": resourceCredentialLibraryVaultSshCertificate(),
+			"boundary_credential_store_vault":                   resourceCredentialStoreVault(),
+			"boundary_credential_store_static":                  resourceCredentialStoreStatic(),
+			"boundary_credential_username_password":             resourceCredentialUsernamePassword(),
+			"boundary_credential_ssh_private_key":               resourceCredentialSshPrivateKey(),
+			"boundary_credential_json":                          resourceCredentialJson(),
+			"boundary_managed_group":                            resourceManagedGroup(),
+			"boundary_managed_group_ldap":                       resourceManagedGroupLdap(),
+			"boundary_group":                                    resourceGroup(),
+			"boundary_host":                                     resourceHost(),
+			"boundary_host_static":                              resourceHostStatic(),
+			"boundary_host_catalog":                             resourceHostCatalog(),
+			"boundary_host_catalog_static":                      resourceHostCatalogStatic(),
+			"boundary_host_catalog_plugin":                      resourceHostCatalogPlugin(),
+			"boundary_host_set":                                 resourceHostSet(),
+			"boundary_host_set_static":                          resourceHostSetStatic(),
+			"boundary_host_set_plugin":                          resourceHostSetPlugin(),
+			"boundary_role":                                     resourceRole(),
+			"boundary_scope":                                    resourceScope(),
+			"boundary_target":                                   resourceTarget(),
+			"boundary_user":                                     resourceUser(),
+			"boundary_worker":                                   resourceWorker(),
 		},
 	}

@@ -102,24 +140,56 @@ type metaData struct {

 func providerAuthenticate(ctx context.Context, d *schema.ResourceData, md *metaData) error {
 	var credentials map[string]interface{}
+	amClient := authmethods.NewClient(md.client)
+
+	var providerScope string
+	scopeId, scopeIdOk := d.GetOk("scope_id")
+	switch {
+	case scopeIdOk:
+		providerScope = scopeId.(string)
+	default:
+		providerScope = DEFAULT_PROVIDER_SCOPE
+	}

-	authMethodId, authMethodIdOk := d.GetOk("auth_method_id")
 	recoveryKmsHcl, recoveryKmsHclOk := d.GetOk("recovery_kms_hcl")
 	if token, ok := d.GetOk("token"); ok {
 		md.client.SetToken(token.(string))
 	}

+	// If auth_method_id is not set, get the default auth method ID for the given scope ID.
+	// Skip fetching default auth method when recovery_kms_hcl is set or the client token isn't null.
+	authMethodId, authMethodIdOk := d.GetOk("auth_method_id")
+	if !authMethodIdOk && !recoveryKmsHclOk && md.client.Token() == "" {
+		defaultAuthMethodId, err := getDefaultAuthMethodId(ctx, amClient, providerScope, "")
+		if err != nil {
+			return err
+		}
+		authMethodIdOk = true
+		authMethodId = defaultAuthMethodId
+	}
+
 	switch {
 	case recoveryKmsHclOk:
 		recoveryHclStr, _, err := ReadPathOrContents(recoveryKmsHcl.(string))
 		if err != nil {
 			return fmt.Errorf(`error reading data from "recovery_kms_hcl": %v`, err)
 		}
-		wrapper, _, err := wrapper.GetWrapperFromHcl(ctx, recoveryHclStr, "recovery",
-			configutil.WithPluginOptions(
-				pluginutil.WithPluginsMap(kms_plugin_assets.BuiltinKmsPlugins()),
-				pluginutil.WithPluginsFilesystem(kms_plugin_assets.KmsPluginPrefix, kms_plugin_assets.FileSystem()),
-			))
+
+		opts := []pluginutil.Option{
+			pluginutil.WithPluginsMap(kms_plugin_assets.BuiltinKmsPlugins()),
+			pluginutil.WithPluginsFilesystem(kms_plugin_assets.KmsPluginPrefix, kms_plugin_assets.FileSystem()),
+		}
+
+		if execDir, ok := d.GetOk("plugin_execution_dir"); ok {
+			opts = append(opts, pluginutil.WithPluginExecutionDirectory(execDir.(string)))
+		}
+
+		// TODO: cleanup plugin when finished
+		wrapper, _, err := wrapper.GetWrapperFromHcl(
+			ctx,
+			recoveryHclStr,
+			"recovery",
+			configutil.WithPluginOptions(opts...))
 		if err != nil {
 			return fmt.Errorf(`error reading wrappers from "recovery_kms_hcl": %v`, err)
 		}
@@ -136,29 +206,44 @@ func providerAuthenticate(ctx context.Context, d *schema.ResourceData, md *metaD

 	case authMethodIdOk:
 		switch {
-		case strings.HasPrefix(authMethodId.(string), "ampw"):
-			// Password-style
-			authMethodLoginName, ok := d.GetOk("password_auth_method_login_name")
+		case strings.HasPrefix(authMethodId.(string), PASSWORD_AUTH_METHOD_PREFIX) || strings.HasPrefix(authMethodId.(string), LDAP_AUTH_METHOD_PREFIX):
+			// Password-style & LDAP-style
+			authMethodLoginName, ok := d.GetOk("auth_method_login_name")
 			if !ok {
-				return errors.New("password-style auth method login name not set, please set password_auth_method_login_name on the provider")
+				authMethodLoginName, ok = d.GetOk("password_auth_method_login_name")
+				if !ok {
+					return errors.New("auth method login name not set, please set auth_method_login_name on the provider")
+				}
 			}
-			authMethodPassword, ok := d.GetOk("password_auth_method_password")
+			authMethodPassword, ok := d.GetOk("auth_method_password")
 			if !ok {
-				return errors.New("password-style auth method password not set, please set password_auth_method_password on the provider")
+				authMethodPassword, ok = d.GetOk("password_auth_method_password")
+				if !ok {
+					return errors.New("auth method password not set, please set auth_method_password on the provider")
+				}
 			}
 			credentials = map[string]interface{}{
 				"login_name": authMethodLoginName,
 				"password":   authMethodPassword,
 			}
-
+		case strings.HasPrefix(authMethodId.(string), "amoidc"):
+			// OIDC-style
+			return errors.New("OIDC auth method is currently not supported by Boundary Terraform Provider. only password auth method is supported at this time")
 		default:
 			return errors.New("no suitable typed auth method information found")
 		}

-		am := authmethods.NewClient(md.client)
-
-		at, err := am.Authenticate(ctx, authMethodId.(string), "login", credentials)
+		at, err := amClient.Authenticate(ctx, authMethodId.(string), "login", credentials)
 		if err != nil {
+			if apiErr := api.AsServerError(err); apiErr != nil {
+				statusCode := apiErr.Response().StatusCode()
+				if statusCode == http.StatusNotFound {
+					return fmt.Errorf("unknown auth_method_id: %s", err.Error())
+				}
+				if statusCode == http.StatusUnauthorized {
+					return fmt.Errorf("invalid login name or password: %s", err.Error())
+				}
+			}
 			return err
 		}
 		md.client.SetToken(at.Attributes["token"].(string))
@@ -205,3 +290,40 @@ func providerConfigure(p *schema.Provider) schema.ConfigureContextFunc {
 		return md, nil
 	}
 }
+
+// getDefaultAuthMethodId iterates over boundary client.List() to find the default auth method ID for the given scopeId.
+// If there is only one auth method, it'll return it even if it's not the primary auth method
+// If scope ID is empty or no primary auth method is found, it returns an error.
+func getDefaultAuthMethodId(ctx context.Context, client *authmethods.Client, scopeId, amType string) (string, error) {
+	if scopeId == "" {
+		return "", fmt.Errorf("must pass a non empty scope ID string to get default auth method ID")
+	}
+	authMethodListResult, err := client.List(ctx, scopeId)
+	if err != nil {
+		return "", err
+	}
+
+	authMethodItems := authMethodListResult.GetItems()
+
+	// If there is only one auth method that matches the auth method prefix, return it even if it's not the primary auth method
+	if len(authMethodItems) == 1 {
+		authMethod := authMethodItems[0]
+		if !strings.HasPrefix(authMethod.Id, amType) {
+			return "", fmt.Errorf("error looking up default auth method for scope ID: '%s'. got '%s' but the provider requires an auth method prefix of '%s'", scopeId, authMethod.Id, amType)
+		}
+
+		return authMethod.Id, nil
+	}
+
+	// find the primary auth method that matches auth method prefix
+	for _, m := range authMethodItems {
+		if m.IsPrimary {
+			if !strings.HasPrefix(m.Id, amType) {
+				return "", fmt.Errorf("error looking up primary auth method for scope ID: '%s'. got '%s' but the provider requires an auth method prefix of '%s'", scopeId, m.Id, amType)
+			}
+
+			return m.Id, nil
+		}
+	}
+	return "", fmt.Errorf("default auth method not found for scope ID: '%s'. Please set a primary auth method on this scope or pass one explicitly using the `auth_method_id` field", scopeId)
+}
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider

 import (
@@ -5,14 +8,20 @@ import (
 	"crypto/rand"
 	"encoding/base64"
 	"fmt"
+	"regexp"
 	"strings"
 	"testing"

 	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/cap/ldap"
+	"github.com/hashicorp/cap/oidc"
 	wrapping "github.com/hashicorp/go-kms-wrapping/v2"
 	"github.com/hashicorp/go-kms-wrapping/v2/aead"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/jimlambrt/gldap"
+	"github.com/jimlambrt/gldap/testdirectory"
 )

 var (
@@ -95,13 +104,46 @@ provider "boundary" {
 	return strings.Join(c, "\n")
 }

+func testConfigWithDefaultAuthMethod(url string, res ...string) string {
+	provider := fmt.Sprintf(`
+provider "boundary" {
+	addr  = "%s"
+	password_auth_method_login_name = "%s"
+	password_auth_method_password = "%s"
+}`, url, tcLoginName, tcPassword)
+
+	c := []string{provider}
+	c = append(c, res...)
+	return strings.Join(c, "\n")
+}
+
+func testConfigWithOIDCAuthMethod(url string, res ...string) string {
+	provider := fmt.Sprintf(`
+provider "boundary" {
+	addr  = "%s"
+	auth_method_id = "amoidc_0000000000"
+}`, url)
+
+	c := []string{provider}
+	c = append(c, res...)
+	return strings.Join(c, "\n")
+}
+
+func testConfigWithoutAMPWCredentials(url string, res ...string) string {
+	provider := fmt.Sprintf(`
+provider "boundary" {
+	addr  = "%s"
+}`, url)
+
+	c := []string{provider}
+	c = append(c, res...)
+	return strings.Join(c, "\n")
+}
+
 func testConfigWithRecovery(url string, res ...string) string {
 	provider := fmt.Sprintf(`
 provider "boundary" {
 	addr             = "%s"
-	auth_method_id       = "%s"
-	password_auth_method_login_name = "%s"
-	password_auth_method_password = "%s"
 	recovery_kms_hcl = <<DOC
 	kms "aead" {
 		purpose = ["recovery", "config"]
@@ -110,7 +152,20 @@ provider "boundary" {
 		key_id = "global_recovery"
 	}
 	DOC
-}`, url, tcPAUM, tcLoginName, tcPassword)
+}`, url)
+
+	c := []string{provider}
+	c = append(c, res...)
+	return strings.Join(c, "\n")
+}
+
+func testConfigWithLDAPAuthMethod(url string, loginName string, password string, res ...string) string {
+	provider := fmt.Sprintf(`
+provider "boundary" {
+	addr             = "%s"
+	auth_method_login_name = "%s"
+	auth_method_password = "%s"
+}`, url, loginName, password)

 	c := []string{provider}
 	c = append(c, res...)
@@ -136,3 +191,188 @@ func TestProvider(t *testing.T) {
 		t.Fatalf("err: %s", err)
 	}
 }
+
+func TestConfigWithLdapAuthMethod(t *testing.T) {
+	td := createDefaultLdap(t)
+	defer td.Stop()
+	tc := controller.NewTestController(t, tcConfig...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+	ldapLoginName := "alice"
+	ldapPassword := "password"
+
+	createLdapAMConfig := fmt.Sprintf(testPrimaryAuthMethodLdap, td.Host(), td.Port(), testdirectory.DefaultUserDN, testdirectory.DefaultGroupDN)
+	createLdapAccountConfig := fmt.Sprintf(testProviderLdapAccountConfig, ldapLoginName)
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		ProviderFactories: providerFactories(&provider),
+		CheckDestroy:      testAccCheckAuthMethodResourceDestroy(t, provider, ldapAuthMethodType),
+		Steps: []resource.TestStep{
+			{
+				// create ldap auth method
+				Config: testConfig(url, fooOrg, createLdapAMConfig, createLdapAccountConfig),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapInsecureTlsField, "true"),
+				),
+			},
+			{
+				// authenticate with LDAP auth method and ensure auth token exists
+				Config: testConfigWithLDAPAuthMethod(url, ldapLoginName, ldapPassword, fooOrg, createLdapAMConfig, createLdapAccountConfig),
+				Check: resource.ComposeTestCheckFunc(
+					testProviderTokenExists(provider),
+				),
+			},
+			{
+				// check if authentication with password auth method works after
+				Config: testConfig(url, fooOrg),
+				Check: resource.ComposeTestCheckFunc(
+					testProviderTokenExists(provider),
+				),
+			},
+		},
+	})
+}
+
+func TestConfigWithDefaultAuthMethod(t *testing.T) {
+	tc := controller.NewTestController(t, tcConfig...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		IsUnitTest:        true,
+		ProviderFactories: providerFactories(&provider),
+		CheckDestroy:      testAccCheckScopeResourceDestroy(t, provider),
+		Steps: []resource.TestStep{
+			{
+				Config: testConfigWithDefaultAuthMethod(url, fooOrg, firstProjectFoo, secondProject),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckScopeResourceExists(provider, "boundary_scope.org1"),
+					testProviderTokenExists(provider),
+				),
+			},
+		},
+	})
+}
+
+func TestConfigWithoutAMPWCredentials(t *testing.T) {
+	tc := controller.NewTestController(t, tcConfig...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		IsUnitTest:        true,
+		ProviderFactories: providerFactories(&provider),
+		Steps: []resource.TestStep{
+			{
+				Config:      testConfigWithoutAMPWCredentials(url, fooOrg, firstProjectFoo, secondProject),
+				ExpectError: regexp.MustCompile("auth method login name not set, please set auth_method_login_name on the provider"),
+			},
+		},
+	})
+}
+
+func TestConfigWithOIDCAuthMethod(t *testing.T) {
+	tc := controller.NewTestController(t, tcConfig...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		IsUnitTest:        true,
+		ProviderFactories: providerFactories(&provider),
+		Steps: []resource.TestStep{
+			{
+				Config:      testConfigWithOIDCAuthMethod(url, fooOrg, firstProjectFoo, secondProject),
+				ExpectError: regexp.MustCompile("OIDC auth method is currently not supported by Boundary Terraform Provider. only password auth method is supported at this time"),
+			},
+		},
+	})
+}
+
+// Create OIDC auth method and set it as the primary auth method.
+// Attempt to authenticate with recovery to test checks for default auth method
+func TestRecoveryWithOIDCDefaultAuthMethod(t *testing.T) {
+	tp := oidc.StartTestProvider(t)
+	wrapper := testWrapper(context.Background(), t, tcRecoveryKey)
+	tc := controller.NewTestController(t, append(tcConfig, controller.WithRecoveryKms(wrapper))...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	tpCert := strings.TrimSpace(tp.CACert())
+	createConfig := fmt.Sprintf(fooAuthMethodOidc, fooAuthMethodOidcDesc, tp.Addr(), tpCert)
+	updateConfig := fmt.Sprintf(fooAuthMethodOidcUpdate, fooAuthMethodOidcDescUpdate, fooAuthMethodOidcCaCerts)
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		ProviderFactories: providerFactories(&provider),
+		CheckDestroy:      testAccCheckAuthMethodResourceDestroy(t, provider, oidcAuthMethodType),
+		Steps: []resource.TestStep{
+			{
+				// create auth method
+				Config: testConfig(url, fooOrg, createConfig),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", "description", fooAuthMethodOidcDesc),
+					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", "name", "test"),
+					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcIssuerKey, tp.Addr()),
+				),
+			},
+			importStep("boundary_auth_method_oidc.foo", "client_secret", "is_primary_for_scope"),
+			{
+				// set auth method as primary auth method
+				Config: testConfig(url, fooOrg, updateConfig),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", "name", "test"),
+					testAccIsPrimaryForScope(provider, "boundary_auth_method_oidc.foo", true),
+				),
+			},
+			{
+				// authenticate provider with recovery kms with unsupported OIDC primary auth method
+				Config: testConfigWithRecovery(url, fooOrg, updateConfig),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", "name", "test"),
+					testAccIsPrimaryForScope(provider, "boundary_auth_method_oidc.foo", true),
+				),
+			},
+			importStep("boundary_auth_method_oidc.foo", "client_secret", "is_primary_for_scope", authmethodOidcMaxAgeKey),
+		},
+	})
+}
+
+func testProviderTokenExists(testProvider *schema.Provider) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		md := testProvider.Meta().(*metaData)
+		if md.client.Token() == "" {
+			return fmt.Errorf("token not set")
+		}
+		return nil
+	}
+}
+
+func createDefaultLdap(t *testing.T) *testdirectory.Directory {
+	td := testdirectory.Start(t,
+		testdirectory.WithDefaults(t, &testdirectory.Defaults{AllowAnonymousBind: true}),
+		testdirectory.WithNoTLS(t),
+	)
+
+	groups := []*gldap.Entry{
+		testdirectory.NewGroup(t, "admin", []string{"alice"}),
+	}
+
+	users := testdirectory.NewUsers(t, []string{"alice"}, testdirectory.WithMembersOf(t, "admin"))
+
+	for _, u := range users {
+		u.Attributes = append(u.Attributes,
+			gldap.NewEntryAttribute(ldap.DefaultADUserPasswordAttribute, []string{"password"}),
+			gldap.NewEntryAttribute(ldap.DefaultOpenLDAPUserPasswordAttribute, []string{"password"}),
+			gldap.NewEntryAttribute("fullName", []string{"test-full-name"}),
+		)
+	}
+
+	td.SetUsers(users...)
+	td.SetGroups(groups...)
+
+	return td
+}
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider

 import (
@@ -60,7 +63,7 @@ func resourceAccount() *schema.Resource {
 				Description: "The account password. Only set on create, changes will not be reflected when updating account.",
 				Type:        schema.TypeString,
 				Optional:    true,
-
+				Sensitive:   true,
 				DiffSuppressFunc: func(k, old, new string, d *schema.ResourceData) bool {
 					if d.Id() == "" {
 						// This is a new resource do not suppress password diff
@@ -0,0 +1,248 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package provider
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/accounts"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+const (
+	accountTypeLdap = "ldap"
+)
+
+func resourceAccountLdap() *schema.Resource {
+	return &schema.Resource{
+		Description: "The account resource allows you to configure a Boundary account.",
+
+		CreateContext: resourceAccountLdapCreate,
+		ReadContext:   resourceAccountLdapRead,
+		UpdateContext: resourceAccountLdapUpdate,
+		DeleteContext: resourceAccountDelete,
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			IDKey: {
+				Description: "The ID of the account.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			NameKey: {
+				Description: "The account name. Defaults to the resource name.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			DescriptionKey: {
+				Description: "The account description.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			AuthMethodIdKey: {
+				Description: "The resource ID for the auth method.",
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+			},
+			TypeKey: {
+				Description: "The resource type.",
+				Type:        schema.TypeString,
+				Deprecated:  "The value for this field will be infered since 'ldap' is the only possible value.",
+				Default:     accountTypeLdap,
+				Optional:    true,
+				ForceNew:    true,
+			},
+			accountLoginNameKey: {
+				Description: "The login name for this account.",
+				Type:        schema.TypeString,
+				Optional:    true,
+				ForceNew:    true,
+			},
+		},
+	}
+}
+
+func setFromAccountLdapResponseMap(d *schema.ResourceData, raw map[string]interface{}) error {
+	if err := d.Set(NameKey, raw["name"]); err != nil {
+		return err
+	}
+	if err := d.Set(DescriptionKey, raw["description"]); err != nil {
+		return err
+	}
+	if err := d.Set(AuthMethodIdKey, raw["auth_method_id"]); err != nil {
+		return err
+	}
+	if err := d.Set(TypeKey, raw["type"]); err != nil {
+		return err
+	}
+
+	switch raw["type"].(string) {
+	case accountTypeLdap:
+		if attrsVal, ok := raw["attributes"]; ok {
+			attrs := attrsVal.(map[string]interface{})
+			if err := d.Set(accountLoginNameKey, attrs["login_name"]); err != nil {
+				return err
+			}
+		}
+	}
+
+	d.SetId(raw["id"].(string))
+	return nil
+}
+
+func resourceAccountLdapCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+
+	var authMethodId string
+	if authMethodIdVal, ok := d.GetOk(AuthMethodIdKey); ok {
+		authMethodId = authMethodIdVal.(string)
+	} else {
+		return diag.Errorf("no auth method ID provided")
+	}
+
+	var loginName *string
+	if keyVal, ok := d.GetOk(accountLoginNameKey); ok {
+		key := keyVal.(string)
+		loginName = &key
+	}
+
+	opts := []accounts.Option{}
+
+	var typeStr string
+	if typeVal, ok := d.GetOk(TypeKey); ok {
+		typeStr = typeVal.(string)
+	} else {
+		return diag.Errorf("no type provided")
+	}
+	switch typeStr {
+	case accountTypeLdap:
+		if loginName != nil {
+			opts = append(opts, accounts.WithLdapAccountLoginName(*loginName))
+		}
+	default:
+		return diag.Errorf("invalid type provided")
+	}
+
+	nameVal, ok := d.GetOk(NameKey)
+	if ok {
+		nameStr := nameVal.(string)
+		opts = append(opts, accounts.WithName(nameStr))
+	}
+
+	descVal, ok := d.GetOk(DescriptionKey)
+	if ok {
+		descStr := descVal.(string)
+		opts = append(opts, accounts.WithDescription(descStr))
+	}
+
+	aClient := accounts.NewClient(md.client)
+
+	acr, err := aClient.Create(ctx, authMethodId, opts...)
+	if err != nil {
+		return diag.Errorf("error creating account: %v", err)
+	}
+	if acr == nil {
+		return diag.Errorf("nil account after create")
+	}
+
+	if err := setFromAccountLdapResponseMap(d, acr.GetResponse().Map); err != nil {
+		return diag.FromErr(err)
+	}
+
+	return nil
+}
+
+func resourceAccountLdapRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	aClient := accounts.NewClient(md.client)
+
+	arr, err := aClient.Read(ctx, d.Id())
+	if err != nil {
+		if apiErr := api.AsServerError(err); apiErr != nil && apiErr.Response().StatusCode() == http.StatusNotFound {
+			d.SetId("")
+			return nil
+		}
+		return diag.Errorf("error reading account: %v", err)
+	}
+	if arr == nil {
+		return diag.Errorf("account nil after read")
+	}
+
+	if err := setFromAccountLdapResponseMap(d, arr.GetResponse().Map); err != nil {
+		return diag.FromErr(err)
+	}
+
+	return nil
+}
+
+func resourceAccountLdapUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	aClient := accounts.NewClient(md.client)
+
+	opts := []accounts.Option{}
+
+	var name *string
+	if d.HasChange(NameKey) {
+		opts = append(opts, accounts.DefaultName())
+		nameVal, ok := d.GetOk(NameKey)
+		if ok {
+			nameStr := nameVal.(string)
+			name = &nameStr
+			opts = append(opts, accounts.WithName(nameStr))
+		}
+	}
+
+	var desc *string
+	if d.HasChange(DescriptionKey) {
+		opts = append(opts, accounts.DefaultDescription())
+		descVal, ok := d.GetOk(DescriptionKey)
+		if ok {
+			descStr := descVal.(string)
+			desc = &descStr
+			opts = append(opts, accounts.WithDescription(descStr))
+		}
+	}
+
+	var loginName *string
+	if d.HasChange(accountLoginNameKey) {
+		switch d.Get(TypeKey).(string) {
+		case accountTypeLdap:
+			opts = append(opts, accounts.DefaultLdapAccountLoginName())
+			keyVal, ok := d.GetOk(accountLoginNameKey)
+			if ok {
+				keyStr := keyVal.(string)
+				loginName = &keyStr
+				opts = append(opts, accounts.WithLdapAccountLoginName(keyStr))
+			}
+		default:
+			return diag.Errorf(`"login_name" cannot be used with this type of account`)
+		}
+	}
+
+	if len(opts) > 0 {
+		opts = append(opts, accounts.WithAutomaticVersioning(true))
+		_, err := aClient.Update(ctx, d.Id(), 0, opts...)
+		if err != nil {
+			return diag.Errorf("error updating account: %v", err)
+		}
+	}
+
+	if d.HasChange(NameKey) {
+		d.Set(NameKey, name)
+	}
+	if d.HasChange(DescriptionKey) {
+		d.Set(DescriptionKey, desc)
+	}
+	if d.HasChange(accountLoginNameKey) {
+		d.Set(accountLoginNameKey, loginName)
+	}
+
+	return nil
+}
@@ -0,0 +1,150 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package provider
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+const (
+	testAccountLdapDesc       = "test account"
+	testAccountLdapDescUpdate = "test account update"
+	testAccountLdapName       = "test account name"
+	testAccountLdapNameUpdate = "test account name updated"
+)
+
+var (
+	testAccountLdap = fmt.Sprintf(`
+resource "boundary_auth_method_ldap" "foo" {
+	name        = "test"
+	description = "test account"
+	type        = "ldap"
+	scope_id    = boundary_scope.org1.id
+	depends_on  = [boundary_role.org1_admin]
+
+	urls        = ["ldaps://ldap1", "ldaps://ldap2"]
+}
+
+resource "boundary_account_ldap" "foo" {
+	name           = "%s"
+	description    = "%s"
+	type           = "ldap"
+	login_name     = "foo"
+	auth_method_id = boundary_auth_method_ldap.foo.id
+}`, testAccountLdapName, testAccountLdapDesc)
+
+	testAccountLdapUpdate = fmt.Sprintf(`
+resource "boundary_auth_method_ldap" "foo" {
+	name        = "test"
+	description = "test account"
+	type        = "ldap"
+	scope_id    = boundary_scope.org1.id
+	depends_on = [boundary_role.org1_admin]
+	urls         	  = ["ldaps://ldap1", "ldaps://ldap2"]
+}
+
+resource "boundary_account_ldap" "foo" {
+	name           = "%s"
+	description    = "%s"
+	type           = "ldap"
+	login_name     = "foo"
+	auth_method_id = boundary_auth_method_ldap.foo.id
+}`, testAccountLdapNameUpdate, testAccountLdapDescUpdate)
+
+	testAccountLdapWithoutTypeField = fmt.Sprintf(`
+resource "boundary_auth_method_ldap" "foo" {
+	name        = "test"
+	description = "test account"
+	type        = "ldap"
+	scope_id    = boundary_scope.org1.id
+	depends_on = [boundary_role.org1_admin]
+	urls         	  = ["ldaps://ldap1", "ldaps://ldap2"]
+}
+
+resource "boundary_account_ldap" "foo" {
+	name           = "%s"
+	description    = "%s"
+	login_name     = "foo"
+	auth_method_id = boundary_auth_method_ldap.foo.id
+}`, testAccountLdapNameUpdate, testAccountLdapDescUpdate)
+
+	testProviderLdapAccountConfig = `
+resource "boundary_account_ldap" "test-ldap" {
+	name           = "alice"
+	description    = "test"
+	type           = "ldap"
+	login_name     = "%s"
+	auth_method_id = boundary_auth_method_ldap.test-ldap.id
+}
+
+resource "boundary_user" "alice" {
+	name        = "alice"
+	description = "test user resource"
+	account_ids = [boundary_account_ldap.test-ldap.id]
+	scope_id = boundary_scope.global.id
+}
+
+resource "boundary_role" "ldap_principal" {
+	scope_id = boundary_scope.global.id
+	grant_scope_id = boundary_scope.global.id
+	grant_strings = ["id=*;type=*;actions=*"]
+	principal_ids = [boundary_user.alice.id]
+}`
+)
+
+func TestAccLdapAccount(t *testing.T) {
+	tc := controller.NewTestController(t, tcConfig...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	var provider *schema.Provider
+
+	resource.Test(t, resource.TestCase{
+		ProviderFactories: providerFactories(&provider),
+		CheckDestroy:      testAccCheckAccountResourceDestroy(t, provider, baseAccountType),
+		Steps: []resource.TestStep{
+			{
+				// create
+				Config: testConfig(url, fooOrg, testAccountLdap),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "description", testAccountLdapDesc),
+					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "name", testAccountLdapName),
+					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "type", "ldap"),
+					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "login_name", "foo"),
+					testAccCheckAccountResourceExists(provider, "boundary_account_ldap.foo"),
+				),
+			},
+			importStep("boundary_account_ldap.foo", "ldap"),
+			{
+				// update
+				Config: testConfig(url, fooOrg, testAccountLdapUpdate),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "description", testAccountLdapDescUpdate),
+					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "name", testAccountLdapNameUpdate),
+					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "type", "ldap"),
+					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "login_name", "foo"),
+					testAccCheckAccountResourceExists(provider, "boundary_account_ldap.foo"),
+				),
+			},
+			importStep("boundary_account_ldap.foo", "ldap"),
+			{
+				// update without passing type field
+				Config: testConfig(url, fooOrg, testAccountLdapWithoutTypeField),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "description", testAccountLdapDescUpdate),
+					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "name", testAccountLdapNameUpdate),
+					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "type", "ldap"),
+					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "login_name", "foo"),
+					testAccCheckAccountResourceExists(provider, "boundary_account_ldap.foo"),
+				),
+			},
+			importStep("boundary_account_ldap.foo", "ldap"),
+		},
+	})
+}
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider

 import (
@@ -0,0 +1,97 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package provider
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/cap/oidc"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+const (
+	fooAccountOidcDesc       = "test account oidc"
+	fooAccountOidcDescUpdate = "test account oidc update"
+)
+
+var (
+	fooAccountOidc = `
+resource "boundary_auth_method_oidc" "foo" {
+	name        = "test"
+	description = "test account oidc auth method"
+	scope_id    = boundary_scope.org1.id
+	depends_on  = [boundary_role.org1_admin]
+
+	issuer            = "%s"
+	client_id         = "foo_id"
+	client_secret     = "foo_secret"
+	max_age           = 0
+	api_url_prefix    = "http://localhost:9200"
+	idp_ca_certs   = [
+<<EOT
+%s
+EOT
+	]
+	allowed_audiences = ["foo_aud"]
+	signing_algorithms = ["ES256"]
+	account_claim_maps = ["oid=sub"]
+	claims_scopes = ["profile"]
+}
+
+resource "boundary_account_oidc" "foo" {
+	name           = "test"
+	description    = "%s"
+	subject		   = "%s"
+	issuer		   = "%s"
+	auth_method_id = boundary_auth_method_oidc.foo.id
+}`
+)
+
+func TestAccOidcAccount(t *testing.T) {
+	tp := oidc.StartTestProvider(t)
+	tc := controller.NewTestController(t, tcConfig...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	var provider *schema.Provider
+
+	tpCert := strings.TrimSpace(tp.CACert())
+	createConfig := fmt.Sprintf(fooAccountOidc, tp.Addr(), tpCert, fooAccountOidcDesc, tp.ExpectedSubject(), tp.Addr())
+	updateConfig := fmt.Sprintf(fooAccountOidc, tp.Addr(), tpCert, fooAccountOidcDescUpdate, tp.ExpectedSubject(), tp.Addr())
+
+	resource.Test(t, resource.TestCase{
+		ProviderFactories: providerFactories(&provider),
+		CheckDestroy:      testAccCheckAccountResourceDestroy(t, provider, oidcAccountType),
+		Steps: []resource.TestStep{
+			{
+				// create
+				Config: testConfig(url, fooOrg, createConfig),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("boundary_account_oidc.foo", "description", fooAccountOidcDesc),
+					resource.TestCheckResourceAttr("boundary_account_oidc.foo", "name", "test"),
+					resource.TestCheckResourceAttr("boundary_account_oidc.foo", "issuer", tp.Addr()),
+					resource.TestCheckResourceAttr("boundary_account_oidc.foo", "subject", tp.ExpectedSubject()),
+					testAccCheckAccountResourceExists(provider, "boundary_account_oidc.foo"),
+				),
+			},
+			importStep("boundary_account_oidc.foo", "oidc"),
+			{
+				// update
+				Config: testConfig(url, fooOrg, updateConfig),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("boundary_account_oidc.foo", "description", fooAccountOidcDescUpdate),
+					resource.TestCheckResourceAttr("boundary_account_oidc.foo", "name", "test"),
+					resource.TestCheckResourceAttr("boundary_account_oidc.foo", "issuer", tp.Addr()),
+					resource.TestCheckResourceAttr("boundary_account_oidc.foo", "subject", tp.ExpectedSubject()),
+					testAccCheckAccountResourceExists(provider, "boundary_account_oidc.foo"),
+				),
+			},
+			importStep("boundary_account_oidc.foo", "oidc"),
+		},
+	})
+}
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider

 import (
@@ -53,7 +56,9 @@ func resourceAccountPassword() *schema.Resource {
 			TypeKey: {
 				Description: "The resource type.",
 				Type:        schema.TypeString,
-				Required:    true,
+				Deprecated:  "The value for this field will be infered since 'password' is the only possible value.",
+				Default:     accountTypePassword,
+				Optional:    true,
 				ForceNew:    true,
 			},
 			accountLoginNameKey: {
@@ -65,7 +70,7 @@ func resourceAccountPassword() *schema.Resource {
 				Description: "The account password. Only set on create, changes will not be reflected when updating account.",
 				Type:        schema.TypeString,
 				Optional:    true,
-
+				Sensitive:   true,
 				DiffSuppressFunc: func(k, old, new string, d *schema.ResourceData) bool {
 					if d.Id() == "" {
 						// This is a new resource do not suppress password diff
@@ -1,17 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider

 import (
-	"context"
 	"fmt"
-	"net/http"
 	"testing"

-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/accounts"
 	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
 )

 const (
@@ -55,6 +53,23 @@ resource "boundary_account_password" "foo" {
 	password       = "foofoofoo"
 	auth_method_id = boundary_auth_method.foo.id
 }`, fooAccountPasswordDescUpdate)
+
+	fooAccountPasswordWithoutTypeField = fmt.Sprintf(`
+	resource "boundary_auth_method" "foo" {
+		name        = "test"
+		description = "test account"
+		type        = "password"
+		scope_id    = boundary_scope.org1.id
+		depends_on = [boundary_role.org1_admin]
+	}
+	
+	resource "boundary_account_password" "foo" {
+		name           = "test"
+		description    = "%s"
+		login_name     = "foo"
+		password       = "foofoofoo"
+		auth_method_id = boundary_auth_method.foo.id
+	}`, fooAccountPasswordDescUpdate)
 )

 func TestAccAccount(t *testing.T) {
@@ -66,7 +81,7 @@ func TestAccAccount(t *testing.T) {

 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckAccountPasswordResourceDestroy(t, provider),
+		CheckDestroy:      testAccCheckAccountResourceDestroy(t, provider, passwordAccountType),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -77,7 +92,7 @@ func TestAccAccount(t *testing.T) {
 					resource.TestCheckResourceAttr("boundary_account_password.foo", "type", "password"),
 					resource.TestCheckResourceAttr("boundary_account_password.foo", "login_name", "foo"),
 					resource.TestCheckResourceAttr("boundary_account_password.foo", "password", "foofoofoo"),
-					testAccCheckAccountPasswordResourceExists(provider, "boundary_account_password.foo"),
+					testAccCheckAccountResourceExists(provider, "boundary_account_password.foo"),
 				),
 			},
 			importStep("boundary_account_password.foo", "password"),
@@ -90,61 +105,23 @@ func TestAccAccount(t *testing.T) {
 					resource.TestCheckResourceAttr("boundary_account_password.foo", "type", "password"),
 					resource.TestCheckResourceAttr("boundary_account_password.foo", "login_name", "foo"),
 					resource.TestCheckResourceAttr("boundary_account_password.foo", "password", "foofoofoo"),
-					testAccCheckAccountPasswordResourceExists(provider, "boundary_account_password.foo"),
+					testAccCheckAccountResourceExists(provider, "boundary_account_password.foo"),
+				),
+			},
+			importStep("boundary_account_password.foo", "password"),
+			{
+				// update without passing type field
+				Config: testConfig(url, fooOrg, fooAccountPasswordWithoutTypeField),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("boundary_account_password.foo", "description", fooAccountPasswordDescUpdate),
+					resource.TestCheckResourceAttr("boundary_account_password.foo", "name", "test"),
+					resource.TestCheckResourceAttr("boundary_account_password.foo", "type", "password"),
+					resource.TestCheckResourceAttr("boundary_account_password.foo", "login_name", "foo"),
+					resource.TestCheckResourceAttr("boundary_account_password.foo", "password", "foofoofoo"),
+					testAccCheckAccountResourceExists(provider, "boundary_account_password.foo"),
 				),
 			},
 			importStep("boundary_account_password.foo", "password"),
 		},
 	})
 }
-
-func testAccCheckAccountPasswordResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[name]
-		if !ok {
-			return fmt.Errorf("Not found: %s", name)
-		}
-
-		id := rs.Primary.ID
-		if id == "" {
-			return fmt.Errorf("No ID is set")
-		}
-
-		md := testProvider.Meta().(*metaData)
-
-		amClient := accounts.NewClient(md.client)
-
-		if _, err := amClient.Read(context.Background(), id); err != nil {
-			return fmt.Errorf("Got an error when reading account %q: %v", id, err)
-		}
-
-		return nil
-	}
-}
-
-func testAccCheckAccountPasswordResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if testProvider.Meta() == nil {
-			t.Fatal("got nil provider metadata")
-		}
-		md := testProvider.Meta().(*metaData)
-
-		for _, rs := range s.RootModule().Resources {
-			switch rs.Type {
-			case "boundary_account_password":
-				id := rs.Primary.ID
-
-				amClient := accounts.NewClient(md.client)
-
-				_, err := amClient.Read(context.Background(), id)
-				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
-					return fmt.Errorf("didn't get a 404 when reading destroyed account %q: %v", id, err)
-				}
-
-			default:
-				continue
-			}
-		}
-		return nil
-	}
-}
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider

 import (
@@ -66,7 +69,7 @@ func TestAccAccountBase(t *testing.T) {

 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckAccountResourceDestroy(t, provider),
+		CheckDestroy:      testAccCheckAccountResourceDestroy(t, provider, baseAccountType),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -122,7 +125,15 @@ func testAccCheckAccountResourceExists(testProvider *schema.Provider, name strin
 	}
 }

-func testAccCheckAccountResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
+type accountType string
+
+const (
+	baseAccountType     accountType = "boundary_account"
+	passwordAccountType accountType = "boundary_account_password"
+	oidcAccountType     accountType = "boundary_account_oidc"
+)
+
+func testAccCheckAccountResourceDestroy(t *testing.T, testProvider *schema.Provider, typ accountType) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if testProvider.Meta() == nil {
 			t.Fatal("got nil provider metadata")
@@ -131,7 +142,7 @@ func testAccCheckAccountResourceDestroy(t *testing.T, testProvider *schema.Provi

 		for _, rs := range s.RootModule().Resources {
 			switch rs.Type {
-			case "boundary_account":
+			case string(typ):
 				id := rs.Primary.ID

 				amClient := accounts.NewClient(md.client)
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider

 import (
@@ -0,0 +1,817 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package provider
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/authmethods"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+const (
+	authMethodTypeLdap = "ldap"
+
+	authMethodLdapStartTlsField                  = "start_tls"
+	authMethodLdapInsecureTlsField               = "insecure_tls"
+	authMethodLdapDiscoverDnField                = "discover_dn"
+	authMethodLdapAnonGrpSearchField             = "anon_group_search"
+	authMethodLdapUpnDomainField                 = "upn_domain"
+	authMethodLdapUrlsField                      = "urls"
+	authMethodLdapUserDnField                    = "user_dn"
+	authMethodLdapUserAttrField                  = "user_attr"
+	authMethodLdapUserFilterField                = "user_filter"
+	authMethodLdapEnableGrpsField                = "enable_groups"
+	authMethodLdapGroupDnField                   = "group_dn"
+	authMethodLdapGroupAttrField                 = "group_attr"
+	authMethodLdapGroupFilterField               = "group_filter"
+	authMethodLdapCertificatesField              = "certificates"
+	authMethodLdapClientCertField                = "client_certificate"
+	authMethodLdapClientCertKeyField             = "client_certificate_key"
+	authMethodLdapBindDnField                    = "bind_dn"
+	authMethodLdapBindPasswordField              = "bind_password"
+	authMethodLdapUseTokenGrpsField              = "use_token_groups"
+	authMethodLdapAccountAttrMapsField           = "account_attribute_maps"
+	authMethodLdapPrimaryAuthMethodForScopeField = "is_primary_for_scope"
+	authMethodLdapStateField                     = "state"
+
+	// computed-only parameters
+	authMethodLdapClientCertKeyHmacKey = "client_certificate_key_hmac"
+	authMethodLdapBindPasswordHmacKey  = "bind_password_hmac"
+)
+
+func resourceAuthMethodLdap() *schema.Resource {
+	return &schema.Resource{
+		Description: "The LDAP auth method resource allows you to configure a Boundary auth_method_ldap.",
+
+		CreateContext: resourceAuthMethodLdapCreate,
+		ReadContext:   resourceAuthMethodLdapRead,
+		UpdateContext: resourceAuthMethodLdapUpdate,
+		DeleteContext: resourceAuthMethodDelete,
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			IDKey: {
+				Description: "The ID of the auth method.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			NameKey: {
+				Description: "The auth method name. Defaults to the resource name.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			DescriptionKey: {
+				Description: "The auth method description.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			ScopeIdKey: {
+				Description: "The scope ID.",
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+			},
+
+			// LDAP specific configurable parameters
+			authMethodLdapStartTlsField: {
+				Description: "Issue StartTLS command after connecting (optional).",
+				Type:        schema.TypeBool,
+				Optional:    true,
+			},
+			authMethodLdapInsecureTlsField: {
+				Description: "Skip the LDAP server SSL certificate validation (optional) - insecure and use with caution.",
+				Type:        schema.TypeBool,
+				Optional:    true,
+			},
+			authMethodLdapDiscoverDnField: {
+				Description: "Use anon bind to discover the bind DN of a user (optional).",
+				Type:        schema.TypeBool,
+				Optional:    true,
+			},
+			authMethodLdapAnonGrpSearchField: {
+				Description: "Use anon bind when performing LDAP group searches (optional).",
+				Type:        schema.TypeBool,
+				Optional:    true,
+			},
+			authMethodLdapUpnDomainField: {
+				Description: "The userPrincipalDomain used to construct the UPN string for the authenticating user (optional).",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			authMethodLdapUrlsField: {
+				Description: "The LDAP URLs that specify LDAP servers to connect to (required).  May be specified multiple times.",
+				Type:        schema.TypeList,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+				Optional: true,
+			},
+			authMethodLdapUserDnField: {
+				Description: "The base DN under which to perform user search (optional).",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			authMethodLdapUserAttrField: {
+				Description: "The attribute on user entry matching the username passed when authenticating (optional).",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			authMethodLdapUserFilterField: {
+				Description: "A go template used to construct a LDAP user search filter (optional).",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			authMethodLdapEnableGrpsField: {
+				Description: "Find the authenticated user's groups during authentication (optional).",
+				Type:        schema.TypeBool,
+				Optional:    true,
+			},
+			authMethodLdapGroupDnField: {
+				Description: "The base DN under which to perform group search.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			authMethodLdapGroupAttrField: {
+				Description: "The attribute that enumerates a user's group membership from entries returned by a group search (optional).",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			authMethodLdapGroupFilterField: {
+				Description: "A go template used to construct a LDAP group search filter (optional).",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			authMethodLdapCertificatesField: {
+				Description: "PEM-encoded X.509 CA certificate in ASN.1 DER form that can be used as a trust anchor when connecting to an LDAP server(optional).  This may be specified multiple times",
+				Type:        schema.TypeList,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+				Optional: true,
+			},
+			authMethodLdapClientCertField: {
+				Description: "PEM-encoded X.509 client certificate in ASN.1 DER form that can be used to authenticate against an LDAP server(optional).",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			authMethodLdapClientCertKeyField: {
+				Description: "PEM-encoded X.509 client certificate key in PKCS #8, ASN.1 DER form used with the client certificate (optional).",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			authMethodLdapBindDnField: {
+				Description: "The distinguished name of entry to bind when performing user and group searches (optional).",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			authMethodLdapBindPasswordField: {
+				Description: "The password to use along with bind-dn performing user and group searches (optional).",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			authMethodLdapUseTokenGrpsField: {
+				Description: "Use the Active Directory tokenGroups constructed attribute of the user to find the group memberships (optional).",
+				Type:        schema.TypeBool,
+				Optional:    true,
+			},
+			authMethodLdapAccountAttrMapsField: {
+				Description: "Account attribute maps fullname and email.",
+				Type:        schema.TypeList,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+				Optional: true,
+			},
+			authMethodLdapStateField: {
+				Description: "Can be one of 'inactive', 'active-private', or 'active-public'. Defaults to active-public.",
+				Type:        schema.TypeString,
+				Optional:    true,
+				Computed:    true,
+			},
+
+			// LDAP specific immutable and computed parameters
+			authMethodLdapClientCertKeyHmacKey: {
+				Description: "The HMAC of the client certificate key returned by the Boundary controller, which is used for comparison after initial setting of the value.",
+				Type:        schema.TypeString,
+				Optional:    true,
+				Computed:    true,
+			},
+			authMethodLdapBindPasswordHmacKey: {
+				Description: "The HMAC of the bind password returned by the Boundary controller, which is used for comparison after initial setting of the value.",
+				Type:        schema.TypeString,
+				Optional:    true,
+				Computed:    true,
+			},
+
+			authMethodLdapPrimaryAuthMethodForScopeField: {
+				Description: "When true, makes this auth method the primary auth method for the scope in which it resides. The primary auth method for a scope means the the user will be automatically created when they login using an LDAP account.",
+				Type:        schema.TypeBool,
+				Optional:    true,
+			},
+
+			TypeKey: {
+				Description: "The type of auth method; hardcoded.",
+				Type:        schema.TypeString,
+				Default:     authMethodTypeLdap,
+				Optional:    true,
+			},
+		},
+	}
+}
+
+func setFromLdapAuthMethodResponseMap(d *schema.ResourceData, raw map[string]interface{}) error {
+	if err := d.Set(NameKey, raw[NameKey]); err != nil {
+		return err
+	}
+	if err := d.Set(DescriptionKey, raw[DescriptionKey]); err != nil {
+		return err
+	}
+	if err := d.Set(ScopeIdKey, raw[ScopeIdKey]); err != nil {
+		return err
+	}
+	if err := d.Set(TypeKey, raw[TypeKey]); err != nil {
+		return err
+	}
+
+	if attrsVal, ok := raw["attributes"]; ok {
+		attrs := attrsVal.(map[string]interface{})
+
+		// these are always set
+		if err := d.Set(authMethodLdapUrlsField, attrs[authMethodLdapUrlsField].([]interface{})); err != nil {
+			return err
+		}
+		if err := d.Set(authMethodLdapStateField, attrs[authMethodLdapStateField].(string)); err != nil {
+			return err
+		}
+
+		// optional attributes
+		if v, ok := attrs[authMethodLdapStartTlsField]; ok {
+			if err := d.Set(authMethodLdapStartTlsField, v.(bool)); err != nil {
+				return err
+			}
+		} else {
+			d.Set(authMethodLdapStartTlsField, false)
+		}
+
+		if v, ok := attrs[authMethodLdapInsecureTlsField]; ok {
+			if err := d.Set(authMethodLdapInsecureTlsField, v.(bool)); err != nil {
+				return err
+			}
+		} else {
+			if err := d.Set(authMethodLdapInsecureTlsField, false); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapDiscoverDnField]; ok {
+			if err := d.Set(authMethodLdapDiscoverDnField, v.(bool)); err != nil {
+				return err
+			}
+		} else {
+			if err := d.Set(authMethodLdapDiscoverDnField, false); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapAnonGrpSearchField]; ok {
+			if err := d.Set(authMethodLdapAnonGrpSearchField, v.(bool)); err != nil {
+				return err
+			}
+		} else {
+			if err := d.Set(authMethodLdapAnonGrpSearchField, false); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapUpnDomainField]; ok {
+			if err := d.Set(authMethodLdapUpnDomainField, v.(string)); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapUserDnField]; ok {
+			if err := d.Set(authMethodLdapUserDnField, v.(string)); err != nil {
+				return err
+			}
+		}
+		if v, ok := attrs[authMethodLdapUserAttrField]; ok {
+			if err := d.Set(authMethodLdapUserAttrField, v.(string)); err != nil {
+				return err
+			}
+		}
+		if v, ok := attrs[authMethodLdapUserFilterField]; ok {
+			if err := d.Set(authMethodLdapUserFilterField, v.(string)); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapEnableGrpsField]; ok {
+			if err := d.Set(authMethodLdapEnableGrpsField, v.(bool)); err != nil {
+				return err
+			}
+		} else {
+			if err := d.Set(authMethodLdapEnableGrpsField, false); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapGroupDnField]; ok {
+			if err := d.Set(authMethodLdapGroupDnField, v.(string)); err != nil {
+				return err
+			}
+		}
+		if v, ok := attrs[authMethodLdapGroupAttrField]; ok {
+			if err := d.Set(authMethodLdapGroupAttrField, v.(string)); err != nil {
+				return err
+			}
+		}
+		if v, ok := attrs[authMethodLdapGroupFilterField]; ok {
+			if err := d.Set(authMethodLdapGroupFilterField, v.(string)); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapCertificatesField]; ok {
+			if err := d.Set(authMethodLdapCertificatesField, v.([]interface{})); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapClientCertField]; ok {
+			if err := d.Set(authMethodLdapClientCertField, v.(string)); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapClientCertKeyField]; ok {
+			if err := d.Set(authMethodLdapClientCertKeyField, v.(string)); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapClientCertKeyHmacKey]; ok {
+			if err := d.Set(authMethodLdapClientCertKeyHmacKey, v.(string)); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapBindDnField]; ok {
+			if err := d.Set(authMethodLdapBindDnField, v.(string)); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapBindPasswordField]; ok {
+			if err := d.Set(authMethodLdapBindPasswordField, v.(string)); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapBindPasswordHmacKey]; ok {
+			if err := d.Set(authMethodLdapBindPasswordHmacKey, v.(string)); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapUseTokenGrpsField]; ok {
+			if err := d.Set(authMethodLdapUseTokenGrpsField, v.(bool)); err != nil {
+				return err
+			}
+		} else {
+			if err := d.Set(authMethodLdapUseTokenGrpsField, false); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapAccountAttrMapsField]; ok {
+			if err := d.Set(authMethodLdapAccountAttrMapsField, v.([]interface{})); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapStateField]; ok {
+			if err := d.Set(authMethodLdapStateField, v.(string)); err != nil {
+				return err
+			}
+		}
+	}
+
+	d.SetId(raw["id"].(string))
+
+	return nil
+}
+
+func resourceAuthMethodLdapCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+
+	var typeStr string
+	if typeVal, ok := d.GetOk(TypeKey); ok {
+		typeStr = typeVal.(string)
+	} else {
+		return diag.Errorf("no type provided")
+	}
+
+	opts := []authmethods.Option{}
+
+	opts = append(opts, authmethods.WithAutomaticVersioning(true))
+
+	if rawUrls, ok := d.GetOk(authMethodLdapUrlsField); ok {
+		urls := []string{}
+		for _, u := range rawUrls.([]interface{}) {
+			urls = append(urls, u.(string))
+		}
+		opts = append(opts, authmethods.WithLdapAuthMethodUrls(urls))
+	}
+
+	if startTls, ok := d.GetOk(authMethodLdapStartTlsField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodStartTls(startTls.(bool)))
+	}
+
+	if insecureTls, ok := d.GetOk(authMethodLdapInsecureTlsField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodInsecureTls(insecureTls.(bool)))
+	}
+
+	if discoverDn, ok := d.GetOk(authMethodLdapDiscoverDnField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodDiscoverDn(discoverDn.(bool)))
+	}
+
+	if anonGrpSearch, ok := d.GetOk(authMethodLdapAnonGrpSearchField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodAnonGroupSearch(anonGrpSearch.(bool)))
+	}
+
+	if upnDomain, ok := d.GetOk(authMethodLdapUpnDomainField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodUpnDomain(upnDomain.(string)))
+	}
+
+	if userDn, ok := d.GetOk(authMethodLdapUserDnField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodUserDn(userDn.(string)))
+	}
+
+	if userAttr, ok := d.GetOk(authMethodLdapUserAttrField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodUserAttr(userAttr.(string)))
+	}
+
+	if userFilter, ok := d.GetOk(authMethodLdapUserFilterField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodUserFilter(userFilter.(string)))
+	}
+
+	if enableGrps, ok := d.GetOk(authMethodLdapEnableGrpsField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodEnableGroups(enableGrps.(bool)))
+	}
+
+	if groupDn, ok := d.GetOk(authMethodLdapGroupDnField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodGroupDn(groupDn.(string)))
+	}
+
+	if groupAttr, ok := d.GetOk(authMethodLdapGroupAttrField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodGroupAttr(groupAttr.(string)))
+	}
+
+	if groupFilter, ok := d.GetOk(authMethodLdapGroupFilterField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodGroupFilter(groupFilter.(string)))
+	}
+
+	if rawCerts, ok := d.GetOk(authMethodLdapCertificatesField); ok {
+		certs := []string{}
+		for _, u := range rawCerts.([]interface{}) {
+			certs = append(certs, u.(string))
+		}
+		opts = append(opts, authmethods.WithLdapAuthMethodCertificates(certs))
+	}
+
+	if clientCert, ok := d.GetOk(authMethodLdapClientCertField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodClientCertificate(clientCert.(string)))
+	}
+
+	if clientCertKey, ok := d.GetOk(authMethodLdapClientCertKeyField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodClientCertificateKey(clientCertKey.(string)))
+	}
+
+	if bindDn, ok := d.GetOk(authMethodLdapBindDnField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodBindDn(bindDn.(string)))
+	}
+
+	if bindPassword, ok := d.GetOk(authMethodLdapBindPasswordField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodBindPassword(bindPassword.(string)))
+	}
+
+	if useTokenGrps, ok := d.GetOk(authMethodLdapUseTokenGrpsField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodUseTokenGroups(useTokenGrps.(bool)))
+	}
+
+	if rawAccountAttrMaps, ok := d.GetOk(authMethodLdapAccountAttrMapsField); ok {
+		accountAttrMaps := []string{}
+		for _, u := range rawAccountAttrMaps.([]interface{}) {
+			accountAttrMaps = append(accountAttrMaps, u.(string))
+		}
+		opts = append(opts, authmethods.WithLdapAuthMethodAccountAttributeMaps(accountAttrMaps))
+	}
+
+	state, ok := d.GetOk(authMethodLdapStateField)
+	switch ok {
+	case true:
+		opts = append(opts, authmethods.WithLdapAuthMethodState(state.(string)))
+	default:
+		opts = append(opts, authmethods.WithLdapAuthMethodState("active-public"))
+	}
+
+	if nameVal, ok := d.GetOk(NameKey); ok {
+		nameStr := nameVal.(string)
+		opts = append(opts, authmethods.WithName(nameStr))
+	}
+
+	if descVal, ok := d.GetOk(DescriptionKey); ok {
+		descStr := descVal.(string)
+		opts = append(opts, authmethods.WithDescription(descStr))
+	}
+
+	var scopeId string
+	scopeIdVal, ok := d.GetOk(ScopeIdKey)
+	switch ok {
+	case true:
+		scopeId = scopeIdVal.(string)
+	default:
+		return diag.Errorf("no scope ID provided")
+	}
+
+	amClient := authmethods.NewClient(md.client)
+
+	amcr, err := amClient.Create(ctx, typeStr, scopeId, opts...)
+	switch {
+	case err != nil:
+		return diag.Errorf("error creating auth method: %v", err)
+	case amcr == nil:
+		return diag.Errorf("nil auth method after create")
+	}
+
+	if err := setFromLdapAuthMethodResponseMap(d, amcr.GetResponse().Map); err != nil {
+		return diag.Errorf("%v", err)
+	}
+
+	amid := amcr.GetResponse().Map["id"].(string)
+
+	// update scope when set to primary
+	if p, ok := d.GetOk(authMethodLdapPrimaryAuthMethodForScopeField); ok {
+		if p.(bool) {
+			if err := updateScopeWithPrimaryAuthMethodId(ctx, scopeId, amid, meta); err != nil {
+				return diag.Errorf("%v", err)
+			}
+
+			amcr.GetResponse().Map[authMethodLdapPrimaryAuthMethodForScopeField] = true
+		}
+	}
+
+	if err := setFromLdapAuthMethodResponseMap(d, amcr.GetResponse().Map); err != nil {
+		return diag.FromErr(err)
+	}
+	return nil
+}
+
+func resourceAuthMethodLdapRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	amClient := authmethods.NewClient(md.client)
+
+	amrr, err := amClient.Read(ctx, d.Id())
+	if err != nil {
+		if apiErr := api.AsServerError(err); apiErr.Response().StatusCode() == http.StatusNotFound {
+			d.SetId("")
+			return nil
+		}
+		return diag.Errorf("error reading auth method: %v", err)
+	}
+	if amrr == nil {
+		return diag.Errorf("auth method nil after read")
+	}
+
+	serr, isPrimary := readScopeIsPrimaryAuthMethodId(ctx, amrr.GetResponse().Map["scope_id"].(string), amrr.GetResponse().Map["id"].(string), meta)
+	if err != nil {
+		return diag.Errorf("%v", serr)
+	}
+
+	if isPrimary {
+		amrr.GetResponse().Map[authMethodLdapPrimaryAuthMethodForScopeField] = true
+	}
+
+	if err := setFromLdapAuthMethodResponseMap(d, amrr.GetResponse().Map); err != nil {
+		return diag.FromErr(err)
+	}
+	return nil
+}
+
+func resourceAuthMethodLdapUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	amClient := authmethods.NewClient(md.client)
+
+	opts := []authmethods.Option{}
+
+	if d.HasChange(NameKey) {
+		opts = append(opts, authmethods.DefaultName())
+		nameVal, ok := d.GetOk(NameKey)
+		if ok {
+			opts = append(opts, authmethods.WithName(nameVal.(string)))
+		}
+	}
+
+	if d.HasChange(DescriptionKey) {
+		opts = append(opts, authmethods.DefaultDescription())
+		descVal, ok := d.GetOk(DescriptionKey)
+		if ok {
+			opts = append(opts, authmethods.WithDescription(descVal.(string)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapUrlsField) {
+		if rawUrls, ok := d.GetOk(authMethodLdapUrlsField); ok {
+			urls := []string{}
+			for _, u := range rawUrls.([]interface{}) {
+				urls = append(urls, u.(string))
+			}
+			opts = append(opts, authmethods.WithLdapAuthMethodUrls(urls))
+		}
+	}
+
+	if d.HasChange(authMethodLdapStartTlsField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodStartTls())
+		if startTls, ok := d.GetOk(authMethodLdapStartTlsField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodStartTls(startTls.(bool)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapInsecureTlsField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodInsecureTls())
+		if insecureTls, ok := d.GetOk(authMethodLdapInsecureTlsField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodInsecureTls(insecureTls.(bool)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapDiscoverDnField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodDiscoverDn())
+		if discoverDn, ok := d.GetOk(authMethodLdapDiscoverDnField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodDiscoverDn(discoverDn.(bool)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapAnonGrpSearchField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodAnonGroupSearch())
+		if AnonGrpSearch, ok := d.GetOk(authMethodLdapAnonGrpSearchField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodAnonGroupSearch(AnonGrpSearch.(bool)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapUpnDomainField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodUpnDomain())
+		if upnDomain, ok := d.GetOk(authMethodLdapUpnDomainField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodUpnDomain(upnDomain.(string)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapUserDnField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodUserDn())
+		if userDn, ok := d.GetOk(authMethodLdapUserDnField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodUserDn(userDn.(string)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapUserAttrField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodUserAttr())
+		if userAttr, ok := d.GetOk(authMethodLdapUserAttrField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodUserAttr(userAttr.(string)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapUserFilterField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodUserFilter())
+		if userFilter, ok := d.GetOk(authMethodLdapUserFilterField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodUserFilter(userFilter.(string)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapEnableGrpsField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodEnableGroups())
+		if enableGrps, ok := d.GetOk(authMethodLdapEnableGrpsField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodEnableGroups(enableGrps.(bool)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapGroupDnField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodGroupDn())
+		if groupDn, ok := d.GetOk(authMethodLdapGroupDnField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodGroupDn(groupDn.(string)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapGroupAttrField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodGroupAttr())
+		if groupAttr, ok := d.GetOk(authMethodLdapGroupAttrField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodGroupAttr(groupAttr.(string)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapGroupFilterField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodGroupFilter())
+		if groupFilter, ok := d.GetOk(authMethodLdapGroupFilterField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodGroupFilter(groupFilter.(string)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapCertificatesField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodCertificates())
+		if rawCerts, ok := d.GetOk(authMethodLdapCertificatesField); ok {
+			certs := []string{}
+			for _, u := range rawCerts.([]interface{}) {
+				certs = append(certs, u.(string))
+			}
+			opts = append(opts, authmethods.WithLdapAuthMethodCertificates(certs))
+		}
+	}
+
+	if d.HasChange(authMethodLdapClientCertField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodClientCertificate())
+		if clientCert, ok := d.GetOk(authMethodLdapClientCertField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodClientCertificate(clientCert.(string)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapClientCertKeyField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodClientCertificateKey())
+		if clientCertKey, ok := d.GetOk(authMethodLdapClientCertKeyField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodClientCertificateKey(clientCertKey.(string)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapBindDnField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodBindDn())
+		if bindDn, ok := d.GetOk(authMethodLdapBindDnField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodBindDn(bindDn.(string)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapBindPasswordField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodBindPassword())
+		if bindPassword, ok := d.GetOk(authMethodLdapBindPasswordField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodBindPassword(bindPassword.(string)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapUseTokenGrpsField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodUseTokenGroups())
+		if useTokenGrps, ok := d.GetOk(authMethodLdapUseTokenGrpsField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodUseTokenGroups(useTokenGrps.(bool)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapAccountAttrMapsField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodAccountAttributeMaps())
+		if rawAccountAttrMaps, ok := d.GetOk(authMethodLdapAccountAttrMapsField); ok {
+			accountAttrMaps := []string{}
+			for _, u := range rawAccountAttrMaps.([]interface{}) {
+				accountAttrMaps = append(accountAttrMaps, u.(string))
+			}
+			opts = append(opts, authmethods.WithLdapAuthMethodAccountAttributeMaps(accountAttrMaps))
+		}
+	}
+
+	if d.HasChange(authMethodLdapStateField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodState())
+		if state, ok := d.GetOk(authMethodLdapStateField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodState(state.(string)))
+		}
+	}
+
+	if len(opts) > 0 {
+		opts = append(opts, authmethods.WithAutomaticVersioning(true))
+		amur, err := amClient.Update(ctx, d.Id(), 0, opts...)
+		if err != nil {
+			return diag.Errorf("error updating auth method: %v", err)
+		}
+
+		if d.HasChange(authMethodLdapPrimaryAuthMethodForScopeField) {
+			if p, ok := d.GetOk(authMethodLdapPrimaryAuthMethodForScopeField); ok {
+				if p.(bool) {
+					if err := updateScopeWithPrimaryAuthMethodId(
+						ctx,
+						amur.GetResponse().Map["scope_id"].(string),
+						amur.GetResponse().Map["id"].(string),
+						meta); err != nil {
+						return diag.Errorf("%v", err)
+					}
+
+					amur.GetResponse().Map[authMethodLdapPrimaryAuthMethodForScopeField] = true
+				}
+			}
+		}
+
+		if err := setFromLdapAuthMethodResponseMap(d, amur.GetResponse().Map); err != nil {
+			return diag.FromErr(err)
+		}
+		return nil
+	}
+	return nil
+}
@@ -0,0 +1,199 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package provider
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/jimlambrt/gldap/testdirectory"
+)
+
+const (
+	testAuthMethodLdapDesc = "test auth method ldap"
+
+	testAuthMethodLdapDescUpdate = "test auth method ldap update"
+
+	testAuthMethodLdapCert = `-----BEGIN CERTIFICATE-----
+MIIDsjCCApoCCQCslgm7fAu/VzANBgkqhkiG9w0BAQsFADCBmjELMAkGA1UEBhMC
+VVMxCzAJBgNVBAgMAldBMRMwEQYDVQQHDApCZWxsaW5naGFtMRIwEAYDVQQKDAlI
+YXNoaUNvcnAxETAPBgNVBAsMCEJvdW5kYXJ5MRswGQYDVQQDDBJib3VuZGFyeXBy
+b2plY3QuaW8xJTAjBgkqhkiG9w0BCQEWFmptYWxuaWNrQGhhc2hpY29ycC5jb20w
+HhcNMjEwNDA2MjMzNTIxWhcNMjYwNDA1MjMzNTIxWjCBmjELMAkGA1UEBhMCVVMx
+CzAJBgNVBAgMAldBMRMwEQYDVQQHDApCZWxsaW5naGFtMRIwEAYDVQQKDAlIYXNo
+aUNvcnAxETAPBgNVBAsMCEJvdW5kYXJ5MRswGQYDVQQDDBJib3VuZGFyeXByb2pl
+Y3QuaW8xJTAjBgkqhkiG9w0BCQEWFmptYWxuaWNrQGhhc2hpY29ycC5jb20wggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDUa/ZLwYhTQ2hGzlwy/sB9xY9h
+dM4qzY8DUF3Sin/+J2j59q3/vXZA7PS+o1GhoG1nW3J51zgyNFOY/EKHdtxVBken
+YTTG+JswzrcTxsMV7/sYDgCLq6W8dPMV72gPH/3dRi3/0KUHtA6rBOf0Shf0f6Sz
+7VmgTWcNmLvXpHKOs4YkjOL/tyflTgNm5j1dOa53TtwtMyvCcpGrB7PGL8m5+E2U
+qxOzQ9kWfA6zr4Gl5rIm+Us8Ez3n1yGwjwFBteexk1Fot8zWKhoy7pZ3ZjWRpjwL
+hfGs5eJs4kERQVAGONt39ZIR6OzOFxAsvI9WrMvxAsdCK63RtF2k4r0X21yDAgMB
+AAEwDQYJKoZIhvcNAQELBQADggEBAJZcl7Zxjya23IcOV8jZDdCHtqnbcg9TcQb+
+kpX1uEKJMFJoNmNK1q//nJxG1YBn3G8t9XtO6Kc6egdGHXWnOsM37N9hbYPJ2kW1
+WWAwqWkQbV3wb0cc6MuU1S9xivOqwM046ZIcjrWR4T4tEUSUfYc3I+Yd8APdapn8
+vePgWnmi/aSsx9RxVOUrzmVhzgN7rQJZGwnYYnxl4cwy2jxpysmXzg/grfXCZs/V
+Kkc7Y5Ph6vRQ+vPCeB7QUxHxjlr8aq+rYDIaSiZ+/4+qyme0ergfvZmMSU8A3NNS
+tYIMds5s2lIqVwOoyzpBEOjWBhUThH+aZu1A5c7Cb7s1eLSRX70=
+-----END CERTIFICATE-----`
+)
+
+var (
+	testAuthMethodLdap = `
+resource "boundary_auth_method_ldap" "test-ldap" {
+	name        = "test"
+	description = "%s"
+	scope_id    = boundary_scope.org1.id
+	depends_on  = [boundary_role.org1_admin]
+
+	start_tls   	  = true
+	discover_dn 	  = true
+	anon_group_search = true
+	upn_domain  	  = "upn-domain-test"
+  	urls         	  = ["ldaps://ldap1", "ldaps://ldap2"]
+	user_dn           = "user-dn"
+	user_attr         = "user-attr"
+	user_filter       = "user-filter"
+	enable_groups     = true
+	group_dn          = "group-dn"
+	group_attr        = "group-attr"
+	group_filter      = "group-filter"
+	bind_dn           = "bind-dn"
+	bind_password     = "bind-password"
+	use_token_groups  = true
+  	certificates 	  = [
+<<EOT
+%s
+EOT
+  ]
+}`
+
+	testPrimaryAuthMethodLdap = `
+resource "boundary_auth_method_ldap" "test-ldap" {
+	name        		 = "test"
+	description 		 = "test auth method ldap"
+	scope_id    		 = "global"
+	is_primary_for_scope = true
+  	urls         	  	 = ["ldap://%s:%d"]
+	user_dn           	 = "%s"
+	group_dn          	 = "%s"
+	discover_dn 	  	 = true
+	enable_groups    	 = true
+	insecure_tls	 	 = true
+}`
+
+	testAuthMethodLdapUpdate = `
+resource "boundary_auth_method_ldap" "test-ldap" {
+	name                 = "test"
+	description          = "%s"
+	scope_id             = boundary_scope.org1.id
+	is_primary_for_scope = true
+	depends_on           = [boundary_role.org1_admin]
+
+	start_tls            = false
+	insecure_tls  		 = true
+	discover_dn 		 = false
+	anon_group_search 	 = false
+	upn_domain  		 = "upn-domain-test-updated"
+	urls                 = ["ldaps://ldap1-updated", "ldaps://ldap2-updated"]
+	user_dn              = "user-dn-updated"
+	user_attr            = "user-attr-updated"
+	user_filter          = "user-filter-updated"
+	enable_groups        = false
+	group_dn             = "group-dn-updated"
+	group_attr           = "group-attr-updated"
+	group_filter         = "group-filter-updated"
+	bind_dn              = "bind-dn-updated"
+	bind_password        = "bind-password-updated" 
+	use_token_groups     = false
+	state                = "inactive"
+  	certificates         = [
+<<EOT
+%s
+EOT
+  ]
+	}`
+)
+
+func TestAccAuthMethodLdap(t *testing.T) {
+	td := testdirectory.Start(t,
+		testdirectory.WithDefaults(t, &testdirectory.Defaults{AllowAnonymousBind: true}),
+	)
+	tc := controller.NewTestController(t, tcConfig...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	tdCert := strings.TrimSpace(td.Cert())
+	createConfig := fmt.Sprintf(testAuthMethodLdap, testAuthMethodLdapDesc, tdCert)
+	updateConfig := fmt.Sprintf(testAuthMethodLdapUpdate, testAuthMethodLdapDescUpdate, testAuthMethodLdapCert)
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		ProviderFactories: providerFactories(&provider),
+		CheckDestroy:      testAccCheckAuthMethodResourceDestroy(t, provider, ldapAuthMethodType),
+		Steps: []resource.TestStep{
+			{
+				// create
+				Config: testConfig(url, fooOrg, createConfig),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", "description", testAuthMethodLdapDesc),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", "name", "test"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapStateField, "active-public"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapStartTlsField, "true"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapInsecureTlsField, "false"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapDiscoverDnField, "true"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapAnonGrpSearchField, "true"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUpnDomainField, "upn-domain-test"),
+					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_ldap.test-ldap", authMethodLdapUrlsField, []string{"ldaps://ldap1", "ldaps://ldap2"}),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUserDnField, "user-dn"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUserAttrField, "user-attr"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUserFilterField, "user-filter"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapEnableGrpsField, "true"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapGroupDnField, "group-dn"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapGroupAttrField, "group-attr"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapGroupFilterField, "group-filter"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapBindDnField, "bind-dn"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapBindPasswordField, "bind-password"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUseTokenGrpsField, "true"),
+					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_ldap.test-ldap", authMethodLdapCertificatesField, []string{tdCert}),
+				),
+			},
+			importStep("boundary_auth_method_ldap.test-ldap", "is_primary_for_scope", "bind_password", "client_certificate_key"),
+			{
+				// update
+				Config: testConfig(url, fooOrg, updateConfig),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapStateField, "inactive"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", "description", testAuthMethodLdapDescUpdate),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", "name", "test"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapStartTlsField, "false"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapInsecureTlsField, "true"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapDiscoverDnField, "false"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapAnonGrpSearchField, "false"), resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUpnDomainField, "upn-domain-test-updated"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUpnDomainField, "upn-domain-test-updated"),
+					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_ldap.test-ldap", authMethodLdapUrlsField, []string{"ldaps://ldap1-updated", "ldaps://ldap2-updated"}),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUserDnField, "user-dn-updated"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUserAttrField, "user-attr-updated"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUserFilterField, "user-filter-updated"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapEnableGrpsField, "false"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapGroupDnField, "group-dn-updated"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapGroupAttrField, "group-attr-updated"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapGroupFilterField, "group-filter-updated"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapBindDnField, "bind-dn-updated"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapBindPasswordField, "bind-password-updated"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUseTokenGrpsField, "false"),
+					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_ldap.test-ldap", authMethodLdapCertificatesField, []string{testAuthMethodLdapCert}),
+					testAccCheckAuthMethodResourceExists(provider, "boundary_auth_method_ldap.test-ldap"),
+					testAccIsPrimaryForScope(provider, "boundary_auth_method_ldap.test-ldap", true),
+					testAccCheckAuthMethodResourceExists(provider, "boundary_auth_method_ldap.test-ldap"),
+				),
+			},
+			importStep("boundary_auth_method_ldap.test-ldap", "is_primary_for_scope", "bind_password", "client_certificate_key"),
+		},
+	})
+}
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider

 import (
@@ -99,6 +102,7 @@ func resourceAuthMethodOidc() *schema.Resource {
 				Description: "The secret key assigned to this auth method from the provider. Once set, only the hash will be kept and the original value can be removed from configuration.",
 				Type:        schema.TypeString,
 				Optional:    true,
+				Sensitive:   true,
 			},
 			authmethodOidcIssuerKey: {
 				Description: "The issuer corresponding to the provider, which must match the issuer field in generated tokens.",
@@ -111,9 +115,11 @@ func resourceAuthMethodOidc() *schema.Resource {
 				Optional:    true,
 			},
 			authmethodOidcMaxAgeKey: {
-				Description: "The max age to provide to the provider, indicating how much time is allowed to have passed since the last authentication before the user is challenged again.",
-				Type:        schema.TypeInt,
-				Optional:    true,
+				Description: `The max age to provide to the provider, indicating how much time is allowed to have passed since the last authentication before the user is challenged again. ` +
+					`A value of 0 sets an immediate requirement for all users to reauthenticate, and an unset maxAge results in a Terraform value of -1 and the default TTL of the chosen OIDC will be used.`,
+				Type:     schema.TypeInt,
+				Optional: true,
+				Default:  -1,
 			},
 			authmethodOidcSigningAlgorithmsKey: {
 				Description: "Allowed signing algorithms for the provider's issued tokens.",
@@ -162,7 +168,7 @@ func resourceAuthMethodOidc() *schema.Resource {
 				Computed:    true,
 			},
 			authmethodOidcIsPrimaryAuthMethodForScope: {
-				Description: "When true, makes this auth method the primary auth method for the scope in which it resides. The primary auth method for a scope means the the user will be automatically created when they login using an OIDC account.",
+				Description: "When true, makes this auth method the primary auth method for the scope in which it resides. The primary auth method for a scope means the user will be automatically created when they login using an OIDC account.",
 				Type:        schema.TypeBool,
 				Optional:    true,
 			},
@@ -263,8 +269,12 @@ func resourceAuthMethodOidcCreate(ctx context.Context, d *schema.ResourceData, m
 	if clientSecret, ok := d.GetOk(authmethodOidcClientSecretKey); ok {
 		opts = append(opts, authmethods.WithOidcAuthMethodClientSecret(clientSecret.(string)))
 	}
-	if maxAge, ok := d.GetOk(authmethodOidcMaxAgeKey); ok {
+	// null values are not correctly recognized by the Terraform SDK, so we instead check here for maxAge value
+	// if maxAge is unset it will default and set the terraform state to -1 and clear the maxAge param in Boundary
+	if maxAge, _ := d.GetOk(authmethodOidcMaxAgeKey); maxAge.(int) >= 0 {
 		opts = append(opts, authmethods.WithOidcAuthMethodMaxAge(uint32(maxAge.(int))))
+	} else {
+		opts = append(opts, authmethods.DefaultOidcAuthMethodMaxAge())
 	}
 	if prefix, ok := d.GetOk(authmethodOidcApiUrlPrefixKey); ok {
 		opts = append(opts, authmethods.WithOidcAuthMethodApiUrlPrefix(prefix.(string)))
@@ -467,8 +477,12 @@ func resourceAuthMethodOidcUpdate(ctx context.Context, d *schema.ResourceData, m
 		}
 	}
 	if d.HasChange(authmethodOidcMaxAgeKey) {
-		if maxAge, ok := d.GetOk(authmethodOidcMaxAgeKey); ok {
+		// null values are not correctly recognized by the Terraform SDK, so we instead check here for maxAge value
+		// if maxAge is unset it will default and set the terraform state to -1 and clear the maxAge param in Boundary
+		if maxAge, _ := d.GetOk(authmethodOidcMaxAgeKey); maxAge.(int) >= 0 {
 			opts = append(opts, authmethods.WithOidcAuthMethodMaxAge(uint32(maxAge.(int))))
+		} else {
+			opts = append(opts, authmethods.DefaultOidcAuthMethodMaxAge())
 		}
 	}
 	if d.HasChange(authmethodOidcSigningAlgorithmsKey) {
@@ -1,13 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider

 import (
 	"context"
 	"fmt"
-	"net/http"
 	"strings"
 	"testing"

-	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/authmethods"
 	"github.com/hashicorp/boundary/api/scopes"
 	"github.com/hashicorp/boundary/testing/controller"
@@ -49,13 +50,13 @@ var (
 resource "boundary_auth_method_oidc" "foo" {
 	name        = "test"
 	description = "%s"
-	scope_id    = boundary_scope.org1.id
+	scope_id    = "global"
 	depends_on  = [boundary_role.org1_admin]

  issuer            = "%s"
  client_id         = "foo_id"
  client_secret     = "foo_secret"
-  max_age           = 10
+  max_age           = 0
  api_url_prefix    = "http://localhost:9200"
  idp_ca_certs   = [
 <<EOT
@@ -72,14 +73,13 @@ EOT
 resource "boundary_auth_method_oidc" "foo" {
 	name                 = "test"
 	description          = "%s"
-	scope_id             = boundary_scope.org1.id
+	scope_id             = "global"
 	is_primary_for_scope = true
 	depends_on           = [boundary_role.org1_admin]

  issuer            = "https://test-update.com"
  client_id         = "foo_id_update"
  client_secret     = "foo_secret_update"
-  max_age           = 1
  api_url_prefix    = "http://localhost:9200"
  idp_ca_certs   = [
 <<EOT
@@ -91,7 +91,7 @@ EOT
  account_claim_maps = ["oid=sub"]
 	claims_scopes = ["profile"]

-  // we need to disable this validatin, since the updated issuer isn't discoverable
+  // we need to disable this validation, since the updated issuer isn't discoverable
  disable_discovered_config_validation = true 
 }`
 )
@@ -109,7 +109,7 @@ func TestAccAuthMethodOidc(t *testing.T) {
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckAuthMethodOidcResourceDestroy(t, provider),
+		CheckDestroy:      testAccCheckAuthMethodResourceDestroy(t, provider, oidcAuthMethodType),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -119,13 +119,13 @@ func TestAccAuthMethodOidc(t *testing.T) {
 					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", "name", "test"),
 					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcIssuerKey, tp.Addr()),
 					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcClientIdKey, "foo_id"),
-					testAccCheckAuthMethodOidcAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcIdpCaCertsKey, []string{tpCert}),
-					testAccCheckAuthMethodOidcAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcAllowedAudiencesKey, []string{"foo_aud"}),
-					testAccCheckAuthMethodOidcAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcSigningAlgorithmsKey, []string{"ES256"}),
-					testAccCheckAuthMethodOidcAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcAccountClaimMapsKey, []string{"oid=sub"}),
-					testAccCheckAuthMethodOidcAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcClaimsScopesKey, []string{"profile"}),
-					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcMaxAgeKey, "10"),
-					testAccCheckAuthMethodOidcResourceExists(provider, "boundary_auth_method_oidc.foo"),
+					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcMaxAgeKey, "0"),
+					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcIdpCaCertsKey, []string{tpCert}),
+					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcAllowedAudiencesKey, []string{"foo_aud"}),
+					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcSigningAlgorithmsKey, []string{"ES256"}),
+					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcAccountClaimMapsKey, []string{"oid=sub"}),
+					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcClaimsScopesKey, []string{"profile"}),
+					testAccCheckAuthMethodResourceExists(provider, "boundary_auth_method_oidc.foo"),
 					testAccIsPrimaryForScope(provider, "boundary_auth_method_oidc.foo", false),
 				),
 			},
@@ -138,71 +138,20 @@ func TestAccAuthMethodOidc(t *testing.T) {
 					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", "name", "test"),
 					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcIssuerKey, "https://test-update.com"),
 					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcClientIdKey, "foo_id_update"),
-					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcMaxAgeKey, "1"),
-					testAccCheckAuthMethodOidcAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcIdpCaCertsKey, []string{fooAuthMethodOidcCaCerts}),
-					testAccCheckAuthMethodOidcAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcAllowedAudiencesKey, []string{"foo_aud_update"}),
-					testAccCheckAuthMethodOidcResourceExists(provider, "boundary_auth_method_oidc.foo"),
+					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcMaxAgeKey, "-1"),
+					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcIdpCaCertsKey, []string{fooAuthMethodOidcCaCerts}),
+					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcAllowedAudiencesKey, []string{"foo_aud_update"}),
+					testAccCheckAuthMethodResourceExists(provider, "boundary_auth_method_oidc.foo"),
 					testAccIsPrimaryForScope(provider, "boundary_auth_method_oidc.foo", true),
-					testAccCheckAuthMethodOidcResourceExists(provider, "boundary_auth_method_oidc.foo"),
+					testAccCheckAuthMethodResourceExists(provider, "boundary_auth_method_oidc.foo"),
 				),
 			},
-			importStep("boundary_auth_method_oidc.foo", "client_secret", "is_primary_for_scope"),
+			importStep("boundary_auth_method_oidc.foo", "client_secret", "is_primary_for_scope", authmethodOidcMaxAgeKey),
 		},
 	})
 }

-func testAccCheckAuthMethodOidcResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[name]
-		if !ok {
-			return fmt.Errorf("Not found: %s", name)
-		}
-
-		id := rs.Primary.ID
-		if id == "" {
-			return fmt.Errorf("No ID is set")
-		}
-
-		md := testProvider.Meta().(*metaData)
-
-		amClient := authmethods.NewClient(md.client)
-
-		if _, err := amClient.Read(context.Background(), id); err != nil {
-			return fmt.Errorf("Got an error when reading auth method %q: %w", id, err)
-		}
-
-		return nil
-	}
-}
-
-func testAccCheckAuthMethodOidcResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if testProvider.Meta() == nil {
-			t.Fatal("got nil provider metadata")
-		}
-		md := testProvider.Meta().(*metaData)
-
-		for _, rs := range s.RootModule().Resources {
-			switch rs.Type {
-			case "boundary_auth_method_oidc":
-				id := rs.Primary.ID
-
-				amClient := authmethods.NewClient(md.client)
-
-				_, err := amClient.Read(context.Background(), id)
-				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
-					return fmt.Errorf("didn't get a 404 when reading destroyed auth method %q: %v", id, err)
-				}
-
-			default:
-				continue
-			}
-		}
-		return nil
-	}
-}
-
-func testAccCheckAuthMethodOidcAttrAryValueSet(testProvider *schema.Provider, name string, key string, strAry []string) resource.TestCheckFunc {
+func testAccCheckAuthMethodAttrAryValueSet(testProvider *schema.Provider, name string, key string, strAry []string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[name]
 		if !ok {
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider

 import (
@@ -1,17 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider

 import (
-	"context"
 	"fmt"
-	"net/http"
 	"testing"

-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/authmethods"
 	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
 )

 const (
@@ -47,7 +45,7 @@ func TestAccAuthMethodPassword(t *testing.T) {
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckAuthMethodResourceDestroy(t, provider),
+		CheckDestroy:      testAccCheckAuthMethodResourceDestroy(t, provider, passwordAuthMethodType),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -74,54 +72,3 @@ func TestAccAuthMethodPassword(t *testing.T) {
 		},
 	})
 }
-
-func testAccCheckAuthMethodResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[name]
-		if !ok {
-			return fmt.Errorf("Not found: %s", name)
-		}
-
-		id := rs.Primary.ID
-		if id == "" {
-			return fmt.Errorf("No ID is set")
-		}
-
-		md := testProvider.Meta().(*metaData)
-
-		amClient := authmethods.NewClient(md.client)
-
-		if _, err := amClient.Read(context.Background(), id); err != nil {
-			return fmt.Errorf("Got an error when reading auth method %q: %w", id, err)
-		}
-
-		return nil
-	}
-}
-
-func testAccCheckAuthMethodResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if testProvider.Meta() == nil {
-			t.Fatal("got nil provider metadata")
-		}
-		md := testProvider.Meta().(*metaData)
-
-		for _, rs := range s.RootModule().Resources {
-			switch rs.Type {
-			case "boundary_auth_method_password":
-				id := rs.Primary.ID
-
-				amClient := authmethods.NewClient(md.client)
-
-				_, err := amClient.Read(context.Background(), id)
-				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
-					return fmt.Errorf("didn't get a 404 when reading destroyed auth method %q: %v", id, err)
-				}
-
-			default:
-				continue
-			}
-		}
-		return nil
-	}
-}
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider

 import (
@@ -49,7 +52,7 @@ func TestAccBaseAuthMethodPassword(t *testing.T) {
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckAuthMethodResourceDestroy(t, provider),
+		CheckDestroy:      testAccCheckAuthMethodResourceDestroy(t, provider, baseAuthMethodType),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -58,7 +61,7 @@ func TestAccBaseAuthMethodPassword(t *testing.T) {
 					resource.TestCheckResourceAttr("boundary_auth_method.foo", "description", fooBaseAuthMethodDesc),
 					resource.TestCheckResourceAttr("boundary_auth_method.foo", "name", "test"),
 					resource.TestCheckResourceAttr("boundary_auth_method.foo", "type", "password"),
-					testAccCheckBaseAuthMethodResourceExists(provider, "boundary_auth_method.foo"),
+					testAccCheckAuthMethodResourceExists(provider, "boundary_auth_method.foo"),
 				),
 			},
 			importStep("boundary_auth_method.foo"),
@@ -70,7 +73,7 @@ func TestAccBaseAuthMethodPassword(t *testing.T) {
 					resource.TestCheckResourceAttr("boundary_auth_method.foo", "description", fooBaseAuthMethodDescUpdate),
 					resource.TestCheckResourceAttr("boundary_auth_method.foo", "name", "test"),
 					resource.TestCheckResourceAttr("boundary_auth_method.foo", "type", "password"),
-					testAccCheckBaseAuthMethodResourceExists(provider, "boundary_auth_method.foo"),
+					testAccCheckAuthMethodResourceExists(provider, "boundary_auth_method.foo"),
 				),
 			},
 			importStep("boundary_auth_method.foo"),
@@ -78,7 +81,7 @@ func TestAccBaseAuthMethodPassword(t *testing.T) {
 	})
 }

-func testAccCheckBaseAuthMethodResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
+func testAccCheckAuthMethodResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[name]
 		if !ok {
@@ -102,7 +105,16 @@ func testAccCheckBaseAuthMethodResourceExists(testProvider *schema.Provider, nam
 	}
 }

-func testAccCheckBaseAuthMethodResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
+type authMethodType string
+
+const (
+	baseAuthMethodType     authMethodType = "boundary_auth_method"
+	passwordAuthMethodType authMethodType = "boundary_auth_method_password"
+	ldapAuthMethodType     authMethodType = "boundary_auth_method_ldap"
+	oidcAuthMethodType     authMethodType = "boundary_auth_method_oidc"
+)
+
+func testAccCheckAuthMethodResourceDestroy(t *testing.T, testProvider *schema.Provider, typ authMethodType) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if testProvider.Meta() == nil {
 			t.Fatal("got nil provider metadata")
@@ -111,7 +123,7 @@ func testAccCheckBaseAuthMethodResourceDestroy(t *testing.T, testProvider *schem

 		for _, rs := range s.RootModule().Resources {
 			switch rs.Type {
-			case "boundary_auth_method":
+			case string(typ):
 				id := rs.Primary.ID

 				amClient := authmethods.NewClient(md.client)
@@ -0,0 +1,225 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package provider
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/credentials"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+const (
+	credentialJsonCredentialType = "json"
+	credentialJsonObjectKey      = "object"
+	credentialJsonObjectHmacKey  = "object_hmac"
+)
+
+func resourceCredentialJson() *schema.Resource {
+	return &schema.Resource{
+		Description: "The json credential resource allows you to congiure a credential using a json object.",
+
+		CreateContext: resourceCredentialJsonCreate,
+		ReadContext:   resourceCredentialJsonRead,
+		UpdateContext: resourceCredentialJsonUpdate,
+		DeleteContext: resourceCredentialJsonDelete,
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			IDKey: {
+				Description: "The ID of this json credential.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			NameKey: {
+				Description: "The name of this json credential. Defaults to the resource name.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			DescriptionKey: {
+				Description: "The description of this json credential.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			credentialStoreIdKey: {
+				Description: "The credential store in which to save this json credential.",
+				Type:        schema.TypeString,
+				ForceNew:    true,
+				Required:    true,
+			},
+			credentialJsonObjectKey: {
+				Description: `The object for the this json credential. Either values encoded with the "jsonencode" function, pre-escaped JSON string, or a file`,
+				Type:        schema.TypeString,
+				Required:    true,
+				Sensitive:   true,
+			},
+			credentialJsonObjectHmacKey: {
+				Description: "The object hmac.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+		},
+	}
+}
+
+func setFromCredentialJsonResponseMap(d *schema.ResourceData, raw map[string]interface{}, fromRead bool) error {
+	if err := d.Set(NameKey, raw[NameKey]); err != nil {
+		return err
+	}
+	if err := d.Set(DescriptionKey, raw[DescriptionKey]); err != nil {
+		return err
+	}
+	if err := d.Set(credentialStoreIdKey, raw[credentialStoreIdKey]); err != nil {
+		return err
+	}
+
+	if attrsVal, ok := raw["attributes"]; ok {
+		attrs := attrsVal.(map[string]interface{})
+		stateObjectHmac := d.Get(credentialJsonObjectHmacKey)
+		boundaryObjectHmac := attrs[credentialJsonObjectHmacKey].(string)
+		if stateObjectHmac.(string) != boundaryObjectHmac && fromRead {
+			if err := d.Set(credentialJsonObjectKey, "(changed in Boundary)"); err != nil {
+				return err
+			}
+		}
+		if err := d.Set(credentialJsonObjectHmacKey, boundaryObjectHmac); err != nil {
+			return nil
+		}
+	}
+
+	d.SetId(raw["id"].(string))
+
+	return nil
+}
+
+func resourceCredentialJsonCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+
+	var opts []credentials.Option
+	if v, ok := d.GetOk(NameKey); ok {
+		opts = append(opts, credentials.WithName(v.(string)))
+	}
+	if v, ok := d.GetOk(DescriptionKey); ok {
+		opts = append(opts, credentials.WithDescription(v.(string)))
+	}
+
+	if v, ok := d.GetOk(credentialJsonObjectKey); ok {
+		var jsonObject map[string]interface{}
+		if err := json.Unmarshal([]byte(v.(string)), &jsonObject); err != nil {
+			return diag.Errorf("error unmarshaling json: %v", err)
+		}
+		opts = append(opts, credentials.WithJsonCredentialObject(jsonObject))
+	}
+
+	var credentialStoreId string
+	retrievedStoreId, ok := d.GetOk(credentialStoreIdKey)
+	if ok {
+		credentialStoreId = retrievedStoreId.(string)
+	} else {
+		return diag.Errorf("credential store id is unset")
+	}
+
+	client := credentials.NewClient(md.client)
+	cred, err := client.Create(ctx, credentialJsonCredentialType, credentialStoreId, opts...)
+	if err != nil {
+		return diag.Errorf("error creating credential: %v", err)
+	}
+	if cred == nil {
+		return diag.Errorf("nil credential after create")
+	}
+
+	if err := setFromCredentialJsonResponseMap(d, cred.GetResponse().Map, false); err != nil {
+		return diag.Errorf("error generating credential from response map: %v", err)
+	}
+
+	return nil
+}
+
+func resourceCredentialJsonRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	client := credentials.NewClient(md.client)
+
+	cred, err := client.Read(ctx, d.Id())
+	if err != nil {
+		if apiErr := api.AsServerError(err); apiErr != nil && apiErr.Response().StatusCode() == http.StatusNotFound {
+			d.SetId("")
+			return nil
+		}
+		return diag.Errorf("error reading credential: %v", err)
+	}
+	if cred == nil {
+		return diag.Errorf("credential nil after read")
+	}
+
+	if err := setFromCredentialJsonResponseMap(d, cred.GetResponse().Map, true); err != nil {
+		return diag.Errorf("error generating credential from response map: %v", err)
+	}
+
+	return nil
+}
+
+func resourceCredentialJsonUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	client := credentials.NewClient(md.client)
+
+	var opts []credentials.Option
+	if d.HasChange(NameKey) {
+		opts = append(opts, credentials.DefaultName())
+		if v, ok := d.GetOk(NameKey); ok {
+			opts = append(opts, credentials.WithName(v.(string)))
+		}
+	}
+
+	if d.HasChange(DescriptionKey) {
+		opts = append(opts, credentials.DefaultDescription())
+		if v, ok := d.GetOk(DescriptionKey); ok {
+			opts = append(opts, credentials.WithDescription(v.(string)))
+		}
+	}
+
+	if d.HasChange(credentialJsonObjectKey) {
+		if v, ok := d.GetOk(credentialJsonObjectKey); ok {
+			var jsonObject map[string]interface{}
+			if err := json.Unmarshal([]byte(v.(string)), &jsonObject); err != nil {
+				return diag.Errorf("error unmarshaling json: %v", err)
+			}
+			opts = append(opts, credentials.WithJsonCredentialObject(jsonObject))
+		}
+	}
+
+	if len(opts) > 0 {
+		opts = append(opts, credentials.WithAutomaticVersioning(true))
+		credUpdate, err := client.Update(ctx, d.Id(), 0, opts...)
+		if err != nil {
+			return diag.Errorf("error updating credential: %v", err)
+		}
+		if credUpdate == nil {
+			return diag.Errorf("credential nil after update")
+		}
+
+		if err = setFromCredentialJsonResponseMap(d, credUpdate.GetResponse().Map, false); err != nil {
+			return diag.Errorf("error generating credential from response map: %v", err)
+		}
+	}
+
+	return nil
+}
+
+func resourceCredentialJsonDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	client := credentials.NewClient(md.client)
+
+	_, err := client.Delete(ctx, d.Id())
+	if err != nil {
+		return diag.Errorf("error deleting credential: %v", err)
+	}
+
+	return nil
+}
@@ -0,0 +1,209 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package provider
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/credentials"
+	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+)
+
+const (
+	jsonCredResc       = "boundary_credential_json.example"
+	jsonCredName       = "bar"
+	jsonCredNameUpdate = "foo"
+	jsonCredDesc       = "the bar"
+	jsonCredDescUpdate = "the foo"
+	jsonCredObj        = `jsonencode({
+		password = "password",
+		username = "admin"
+	})`
+	jsonCredObjUpdate = `jsonencode({
+		password = "password",
+		username = "db-admin"
+	})`
+)
+
+func jsonCredResource(name, description, object string) string {
+	return fmt.Sprintf(`
+resource "boundary_credential_store_static" "example" {
+	name  = "static store name"
+	description = "static store description"
+	scope_id = boundary_scope.proj1.id
+	depends_on = [boundary_role.proj1_admin]
+}
+
+resource "boundary_credential_json" "example" {
+	name  = "%s"
+	description = "%s"
+	credential_store_id = boundary_credential_store_static.example.id
+	object = %s
+}`, name, description, object)
+}
+
+func TestAccCredentialJson(t *testing.T) {
+	tc := controller.NewTestController(t, tcConfig...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	res := jsonCredResource(
+		jsonCredName,
+		jsonCredDesc,
+		jsonCredObj,
+	)
+
+	resUpdate := jsonCredResource(
+		jsonCredNameUpdate,
+		jsonCredDescUpdate,
+		jsonCredObjUpdate,
+	)
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		ProviderFactories: providerFactories(&provider),
+		CheckDestroy:      testAccCheckCredentialResourceDestroy(t, provider, jsonCredentialType),
+		Steps: []resource.TestStep{
+			{
+				// create
+				Config: testConfig(url, fooOrg, firstProjectFoo, res),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(jsonCredResc, NameKey, jsonCredName),
+					resource.TestCheckResourceAttr(jsonCredResc, DescriptionKey, jsonCredDesc),
+					resource.TestCheckResourceAttr(jsonCredResc, credentialJsonObjectKey, `{"password":"password","username":"admin"}`),
+
+					testAccCheckCredentialJsonObjectHmac(),
+					testAccCheckCredentialResourceExists(provider, jsonCredResc),
+				),
+			},
+			importStep(jsonCredResc, credentialJsonObjectKey),
+			{
+				// update
+				Config: testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(jsonCredResc, NameKey, jsonCredNameUpdate),
+					resource.TestCheckResourceAttr(jsonCredResc, DescriptionKey, jsonCredDescUpdate),
+					resource.TestCheckResourceAttr(jsonCredResc, credentialJsonObjectKey, `{"password":"password","username":"db-admin"}`),
+
+					testAccCheckCredentialJsonObjectHmac(),
+					testAccCheckCredentialResourceExists(provider, jsonCredResc),
+				),
+			},
+			importStep(jsonCredResc, credentialJsonObjectKey),
+			{
+				// Run a plan only update and verify no changes
+				PlanOnly: true,
+				Config:   testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+			},
+			importStep(jsonCredResc, credentialJsonObjectKey),
+			{
+				// update again but apply a preConfig to externally update resource
+				PreConfig: func() { jsonCredExternalUpdate(t, provider) },
+				Config:    testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+			},
+			importStep(jsonCredResc, credentialJsonObjectKey),
+		},
+	})
+}
+
+func testAccCheckCredentialResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("not found: %s", name)
+		}
+
+		id := rs.Primary.ID
+		if id == "" {
+			return fmt.Errorf("no ID is set")
+		}
+		storeId = id
+
+		md := testProvider.Meta().(*metaData)
+		c := credentials.NewClient(md.client)
+		if _, err := c.Read(context.Background(), id); err != nil {
+			return fmt.Errorf("got an error reading %q: %w", id, err)
+		}
+
+		return nil
+	}
+}
+
+type credentialType string
+
+const (
+	jsonCredentialType             credentialType = "boundary_credential_json"
+	sshPrivateKeyCredentialType    credentialType = "boundary_credential_ssh_private_key"
+	usernamePasswordCredentialType credentialType = "boundary_credential_username_password"
+)
+
+func testAccCheckCredentialResourceDestroy(t *testing.T, testProvider *schema.Provider, typ credentialType) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if testProvider.Meta() == nil {
+			t.Fatal("got nil provider metadata")
+		}
+		md := testProvider.Meta().(*metaData)
+
+		for _, rs := range s.RootModule().Resources {
+			switch rs.Type {
+			case string(typ):
+				id := rs.Primary.ID
+
+				c := credentials.NewClient(md.client)
+				_, err := c.Read(context.Background(), id)
+				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
+					return fmt.Errorf("didn't get a 404 when reading destroyed credential %q: %v", id, err)
+				}
+			default:
+				continue
+			}
+		}
+		return nil
+	}
+}
+
+func testAccCheckCredentialJsonObjectHmac() resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[jsonCredResc]
+		if !ok {
+			return fmt.Errorf("not found: %s", jsonCredResc)
+		}
+
+		computed := rs.Primary.Attributes["object_hmac"]
+		if len(computed) != 43 {
+			return fmt.Errorf("Computed password hmac not the expected length of 43 characters. hmac: %q", computed)
+		}
+
+		return nil
+	}
+}
+
+func jsonCredExternalUpdate(t *testing.T, testProvider *schema.Provider) {
+	if storeId == "" {
+		t.Fatal("storeId must be set before testing an external update")
+	}
+
+	md := testProvider.Meta().(*metaData)
+	c := credentials.NewClient(md.client)
+	cr, err := c.Read(context.Background(), storeId)
+	if err != nil {
+		t.Fatal(fmt.Errorf("got an error reading %q: %w", storeId, err))
+	}
+
+	// update credential options
+	var opts []credentials.Option
+	opts = append(opts, credentials.WithDescription("this is an updated description"))
+
+	_, err = c.Update(context.Background(), cr.Item.Id, cr.Item.Version, opts...)
+	if err != nil {
+		t.Fatal(fmt.Errorf("got an error updating %q: %w", cr.Item.Id, err))
+	}
+}
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider

 import (
@@ -11,11 +14,13 @@ import (
 )

 const (
-	credentialStoreIdKey                     = "credential_store_id"
-	credentialLibraryVaultHttpMethodKey      = "http_method"
-	credentialLibraryVaultHttpRequestBodyKey = "http_request_body"
-	credentialLibraryVaultPathKey            = "path"
-	credentialLibraryCredentialTypeKey       = "credential_type"
+	credentialStoreIdKey                           = "credential_store_id"
+	credentialLibraryVaultType                     = "vault-generic"
+	credentialLibraryVaultHttpMethodKey            = "http_method"
+	credentialLibraryVaultHttpRequestBodyKey       = "http_request_body"
+	credentialLibraryVaultPathKey                  = "path"
+	credentialLibraryCredentialTypeKey             = "credential_type"
+	credentialLibraryCredentialMappingOverridesKey = "credential_mapping_overrides"
 )

 var libraryVaultAttrs = []string{
@@ -74,9 +79,15 @@ func resourceCredentialLibraryVault() *schema.Resource {
 				Required:    true,
 			},
 			credentialLibraryCredentialTypeKey: {
-				Description: "The type of credential the library generates.",
+				Description: "The type of credential the library generates. Cannot be updated on an existing resource.",
 				Type:        schema.TypeString,
 				Optional:    true,
+				ForceNew:    true,
+			},
+			credentialLibraryCredentialMappingOverridesKey: {
+				Description: "The credential mapping override.",
+				Type:        schema.TypeMap,
+				Optional:    true,
 			},
 		},
 	}
@@ -93,6 +104,10 @@ func setFromVaultCredentialLibraryResponseMap(d *schema.ResourceData, raw map[st
 		return err
 	}

+	if err := d.Set(credentialLibraryCredentialMappingOverridesKey, raw[credentialLibraryCredentialMappingOverridesKey]); err != nil {
+		return err
+	}
+
 	if attrsVal, ok := raw["attributes"]; ok {
 		attrs := attrsVal.(map[string]interface{})
 		for _, v := range libraryVaultAttrs {
@@ -129,6 +144,10 @@ func resourceCredentialLibraryCreateVault(ctx context.Context, d *schema.Resourc
 	if v, ok := d.GetOk(credentialLibraryCredentialTypeKey); ok {
 		opts = append(opts, credentiallibraries.WithCredentialType(v.(string)))
 	}
+	if v, ok := d.GetOk(credentialLibraryCredentialMappingOverridesKey); ok {
+		mappingOverrides := v.(map[string]interface{})
+		opts = append(opts, credentiallibraries.WithCredentialMappingOverrides(mappingOverrides))
+	}

 	var credentialStoreId string
 	cid, ok := d.GetOk(credentialStoreIdKey)
@@ -139,7 +158,7 @@ func resourceCredentialLibraryCreateVault(ctx context.Context, d *schema.Resourc
 	}

 	client := credentiallibraries.NewClient(md.client)
-	cr, err := client.Create(ctx, credentialStoreId, opts...)
+	cr, err := client.Create(ctx, credentialLibraryVaultType, credentialStoreId, opts...)
 	if err != nil {
 		return diag.Errorf("error creating credential library: %v", err)
 	}
@@ -216,6 +235,40 @@ func resourceCredentialLibraryUpdateVault(ctx context.Context, d *schema.Resourc
 			opts = append(opts, credentiallibraries.WithVaultCredentialLibraryPath(v.(string)))
 		}
 	}
+	if d.HasChange(credentialLibraryCredentialMappingOverridesKey) {
+		var oldMapping, newMapping map[string]interface{}
+		old, new := d.GetChange(credentialLibraryCredentialMappingOverridesKey)
+
+		if old == nil {
+			old = map[string]interface{}{}
+		}
+		oldMapping = old.(map[string]interface{})
+
+		if new == nil {
+			new = map[string]interface{}{}
+		}
+		newMapping = new.(map[string]interface{})
+
+		newAttrs := []string{}
+		for k := range newMapping {
+			newAttrs = append(newAttrs, k)
+		}
+
+		for oldAttr := range oldMapping {
+			isRemoved := true
+			for _, newAttr := range newAttrs {
+				if oldAttr == newAttr {
+					isRemoved = false
+					break
+				}
+			}
+			if isRemoved {
+				newMapping[oldAttr] = nil
+			}
+		}
+
+		opts = append(opts, credentiallibraries.WithCredentialMappingOverrides(newMapping))
+	}

 	if len(opts) > 0 {
 		opts = append(opts, credentiallibraries.WithAutomaticVersioning(true))
@@ -0,0 +1,404 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package provider
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/credentiallibraries"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+const (
+	credentialLibraryVaultSshCertificateType               = "vault-ssh-certificate"
+	credentialLibraryVaultSshCertificatePathKey            = "path"
+	credentialLibraryVaultSshCertificateUsernameKey        = "username"
+	credentialLibraryVaultSshCertificateKeyTypeKey         = "key_type"
+	credentialLibraryVaultSshCertificateKeyBitsKey         = "key_bits"
+	credentialLibraryVaultSshCertificateTtlKey             = "ttl"
+	credentialLibraryVaultSshCertificateKeyIdKey           = "key_id"
+	credentialLibraryVaultSshCertificateCriticalOptionsKey = "critical_options"
+	credentialLibraryVaultSshCertificateExtensionsKey      = "extensions"
+)
+
+var libraryVaultSshCertificateAttrs = []string{
+	credentialLibraryVaultSshCertificatePathKey,
+	credentialLibraryVaultSshCertificateUsernameKey,
+	credentialLibraryVaultSshCertificateKeyTypeKey,
+	credentialLibraryVaultSshCertificateKeyBitsKey,
+	credentialLibraryVaultSshCertificateTtlKey,
+	credentialLibraryVaultSshCertificateKeyIdKey,
+	credentialLibraryVaultSshCertificateCriticalOptionsKey,
+	credentialLibraryVaultSshCertificateExtensionsKey,
+}
+
+func resourceCredentialLibraryVaultSshCertificate() *schema.Resource {
+	return &schema.Resource{
+		Description: "The credential library for Vault resource allows you to configure a Boundary credential library for Vault.",
+
+		CreateContext: resourceCredentialLibraryCreateVaultSshCertificate,
+		ReadContext:   resourceCredentialLibraryReadVaultSshCertificate,
+		UpdateContext: resourceCredentialLibraryUpdateVaultSshCertificate,
+		DeleteContext: resourceCredentialLibraryDeleteVaultSshCertificate,
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			IDKey: {
+				Description: "The ID of the Vault credential library.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			NameKey: {
+				Description: "The Vault credential library name. Defaults to the resource name.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			DescriptionKey: {
+				Description: "The Vault credential library description.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			credentialStoreIdKey: {
+				Description: "The ID of the credential store that this library belongs to.",
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+			},
+			credentialLibraryVaultSshCertificatePathKey: {
+				Description: "The path in Vault to request credentials from.",
+				Type:        schema.TypeString,
+				Required:    true,
+			},
+			credentialLibraryVaultSshCertificateUsernameKey: {
+				Description: "The username to use with the certificate returned by the library.",
+				Type:        schema.TypeString,
+				Required:    true,
+			},
+			credentialLibraryVaultSshCertificateKeyTypeKey: {
+				Description: "Specifies the desired key type; must be ed25519, ecdsa, or rsa.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			credentialLibraryVaultSshCertificateKeyBitsKey: {
+				Description: "Specifies the number of bits to use for the generated keys.",
+				Type:        schema.TypeInt,
+				Optional:    true,
+			},
+			credentialLibraryVaultSshCertificateTtlKey: {
+				Description: "Specifies the requested time to live for a certificate returned from the library.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			credentialLibraryVaultSshCertificateKeyIdKey: {
+				Description: "Specifies the key id a certificate should have.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			credentialLibraryVaultSshCertificateCriticalOptionsKey: {
+				Description: "Specifies a map of the critical options that the certificate should be signed for.",
+				Type:        schema.TypeMap,
+				Optional:    true,
+			},
+			credentialLibraryVaultSshCertificateExtensionsKey: {
+				Description: "Specifies a map of the extensions that the certificate should be signed for.",
+				Type:        schema.TypeMap,
+				Optional:    true,
+			},
+		},
+	}
+}
+
+func setFromVaultSshCertificateCredentialLibraryResponseMap(d *schema.ResourceData, raw map[string]interface{}) error {
+	if err := d.Set(NameKey, raw[NameKey]); err != nil {
+		return err
+	}
+	if err := d.Set(DescriptionKey, raw[DescriptionKey]); err != nil {
+		return err
+	}
+	if err := d.Set(credentialStoreIdKey, raw[credentialStoreIdKey]); err != nil {
+		return err
+	}
+
+	if attrsVal, ok := raw["attributes"]; ok {
+		attrs := attrsVal.(map[string]interface{})
+		for _, v := range libraryVaultSshCertificateAttrs {
+			if err := d.Set(v, attrs[v]); err != nil {
+				return err
+			}
+		}
+	}
+
+	d.SetId(raw["id"].(string))
+
+	return nil
+}
+
+func resourceCredentialLibraryCreateVaultSshCertificate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+
+	var opts []credentiallibraries.Option
+	if v, ok := d.GetOk(NameKey); ok {
+		opts = append(opts, credentiallibraries.WithName(v.(string)))
+	}
+	if v, ok := d.GetOk(DescriptionKey); ok {
+		opts = append(opts, credentiallibraries.WithDescription(v.(string)))
+	}
+	if v, ok := d.GetOk(credentialLibraryVaultSshCertificatePathKey); ok {
+		opts = append(opts, credentiallibraries.WithVaultCredentialLibraryPath(v.(string)))
+	}
+	if v, ok := d.GetOk(credentialLibraryVaultSshCertificateUsernameKey); ok {
+		opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryUsername(v.(string)))
+	}
+	if v, ok := d.GetOk(credentialLibraryVaultSshCertificateKeyTypeKey); ok {
+		opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryKeyType(v.(string)))
+	}
+	if v, ok := d.GetOk(credentialLibraryVaultSshCertificateKeyBitsKey); ok {
+		opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryKeyBits(uint32(v.(int))))
+	}
+	if v, ok := d.GetOk(credentialLibraryVaultSshCertificateTtlKey); ok {
+		opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryTtl(v.(string)))
+	}
+	if v, ok := d.GetOk(credentialLibraryVaultSshCertificateKeyIdKey); ok {
+		opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryKeyId(v.(string)))
+	}
+	if v, ok := d.GetOk(credentialLibraryVaultSshCertificateCriticalOptionsKey); ok {
+		if vv, ok := v.(map[string]any); ok {
+			co := make(map[string]string, len(vv))
+			for k, vvv := range vv {
+				co[k] = vvv.(string)
+			}
+			opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryCriticalOptions(co))
+		}
+	}
+	if v, ok := d.GetOk(credentialLibraryVaultSshCertificateExtensionsKey); ok {
+		if vv, ok := v.(map[string]any); ok {
+			e := make(map[string]string, len(vv))
+			for k, vvv := range vv {
+				e[k] = vvv.(string)
+			}
+			opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryExtensions(e))
+		}
+	}
+
+	var credentialStoreId string
+	cid, ok := d.GetOk(credentialStoreIdKey)
+	if ok {
+		credentialStoreId = cid.(string)
+	} else {
+		return diag.Errorf("no credential store ID is set")
+	}
+
+	client := credentiallibraries.NewClient(md.client)
+	cr, err := client.Create(ctx, credentialLibraryVaultSshCertificateType, credentialStoreId, opts...)
+	if err != nil {
+		return diag.Errorf("error creating credential library: %v", err)
+	}
+	if cr == nil {
+		return diag.Errorf("nil credential library after create")
+	}
+
+	if err := setFromVaultSshCertificateCredentialLibraryResponseMap(d, cr.GetResponse().Map); err != nil {
+		return diag.FromErr(err)
+	}
+
+	return nil
+}
+
+func resourceCredentialLibraryReadVaultSshCertificate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	client := credentiallibraries.NewClient(md.client)
+
+	cr, err := client.Read(ctx, d.Id())
+	if err != nil {
+		if apiErr := api.AsServerError(err); apiErr != nil && apiErr.Response().StatusCode() == http.StatusNotFound {
+			d.SetId("")
+			return nil
+		}
+		return diag.Errorf("error reading credential library: %v", err)
+	}
+	if cr == nil {
+		return diag.Errorf("credential library nil after read")
+	}
+
+	if err := setFromVaultSshCertificateCredentialLibraryResponseMap(d, cr.GetResponse().Map); err != nil {
+		return diag.FromErr(err)
+	}
+
+	return nil
+}
+
+func resourceCredentialLibraryUpdateVaultSshCertificate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	client := credentiallibraries.NewClient(md.client)
+
+	var opts []credentiallibraries.Option
+	if d.HasChange(NameKey) {
+		opts = append(opts, credentiallibraries.DefaultName())
+		nameVal, ok := d.GetOk(NameKey)
+		if ok {
+			opts = append(opts, credentiallibraries.WithName(nameVal.(string)))
+		}
+	}
+	if d.HasChange(DescriptionKey) {
+		opts = append(opts, credentiallibraries.DefaultDescription())
+		descVal, ok := d.GetOk(DescriptionKey)
+		if ok {
+			opts = append(opts, credentiallibraries.WithDescription(descVal.(string)))
+		}
+	}
+	if d.HasChange(credentialLibraryVaultSshCertificatePathKey) {
+		v, ok := d.GetOk(credentialLibraryVaultSshCertificatePathKey)
+		if ok {
+			opts = append(opts, credentiallibraries.WithVaultCredentialLibraryPath(v.(string)))
+		}
+	}
+	if d.HasChange(credentialLibraryVaultSshCertificateUsernameKey) {
+		v, ok := d.GetOk(credentialLibraryVaultSshCertificateUsernameKey)
+		if ok {
+			opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryUsername(v.(string)))
+		}
+	}
+	if d.HasChange(credentialLibraryVaultSshCertificateKeyTypeKey) {
+		v, ok := d.GetOk(credentialLibraryVaultSshCertificateKeyTypeKey)
+		if ok {
+			opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryKeyType(v.(string)))
+		}
+	}
+	if d.HasChange(credentialLibraryVaultSshCertificateKeyBitsKey) {
+		v, ok := d.GetOk(credentialLibraryVaultSshCertificateKeyBitsKey)
+		if ok {
+			opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryKeyBits(uint32(v.(int))))
+		}
+	}
+	if d.HasChange(credentialLibraryVaultSshCertificateTtlKey) {
+		v, ok := d.GetOk(credentialLibraryVaultSshCertificateTtlKey)
+		if ok {
+			opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryTtl(v.(string)))
+		}
+	}
+	if d.HasChange(credentialLibraryVaultSshCertificateKeyIdKey) {
+		v, ok := d.GetOk(credentialLibraryVaultSshCertificateKeyIdKey)
+		if ok {
+			opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryKeyId(v.(string)))
+		}
+	}
+	if d.HasChange(credentialLibraryVaultSshCertificateCriticalOptionsKey) {
+		var oldCriticalOptions, newCriticalOptions map[string]interface{}
+		old, new := d.GetChange(credentialLibraryVaultSshCertificateCriticalOptionsKey)
+
+		if old == nil {
+			old = map[string]interface{}{}
+		}
+		oldCriticalOptions = old.(map[string]interface{})
+
+		if new == nil {
+			new = map[string]interface{}{}
+		}
+		newCriticalOptions = new.(map[string]interface{})
+
+		newAttrs := []string{}
+		for k := range newCriticalOptions {
+			newAttrs = append(newAttrs, k)
+		}
+
+		for oldAttr := range oldCriticalOptions {
+			isRemoved := true
+			for _, newAttr := range newAttrs {
+				if oldAttr == newAttr {
+					isRemoved = false
+					break
+				}
+			}
+			if isRemoved {
+				newCriticalOptions[oldAttr] = nil
+			}
+		}
+
+		co := make(map[string]string, 0)
+		for k, v := range newCriticalOptions {
+			if v != nil {
+				co[k] = v.(string)
+			}
+		}
+		if len(co) == 0 {
+			co = nil
+		}
+		opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryCriticalOptions(co))
+
+	}
+	if d.HasChange(credentialLibraryVaultSshCertificateExtensionsKey) {
+		var oldExtensions, newExtensions map[string]interface{}
+		old, new := d.GetChange(credentialLibraryVaultSshCertificateExtensionsKey)
+
+		if old == nil {
+			old = map[string]interface{}{}
+		}
+		oldExtensions = old.(map[string]interface{})
+
+		if new == nil {
+			new = map[string]interface{}{}
+		}
+		newExtensions = new.(map[string]interface{})
+
+		newAttrs := []string{}
+		for k := range newExtensions {
+			newAttrs = append(newAttrs, k)
+		}
+
+		for oldAttr := range oldExtensions {
+			isRemoved := true
+			for _, newAttr := range newAttrs {
+				if oldAttr == newAttr {
+					isRemoved = false
+					break
+				}
+			}
+			if isRemoved {
+				newExtensions[oldAttr] = nil
+			}
+		}
+
+		e := make(map[string]string, 0)
+		for k, v := range newExtensions {
+			if v != nil {
+				e[k] = v.(string)
+			}
+		}
+		if len(e) == 0 {
+			e = nil
+		}
+		opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryExtensions(e))
+	}
+
+	if len(opts) > 0 {
+		opts = append(opts, credentiallibraries.WithAutomaticVersioning(true))
+		aur, err := client.Update(ctx, d.Id(), 0, opts...)
+		if err != nil {
+			return diag.Errorf("error updating credential library: %v", err)
+		}
+
+		if err := setFromVaultSshCertificateCredentialLibraryResponseMap(d, aur.GetResponse().Map); err != nil {
+			return diag.Errorf("error setting credential library from response: %v", err)
+		}
+	}
+
+	return nil
+}
+
+func resourceCredentialLibraryDeleteVaultSshCertificate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	client := credentiallibraries.NewClient(md.client)
+
+	_, err := client.Delete(ctx, d.Id())
+	if err != nil {
+		return diag.Errorf("error deleting credential library: %v", err)
+	}
+
+	return nil
+}
@@ -0,0 +1,208 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package provider
+
+import (
+	"fmt"
+	"strconv"
+	"testing"
+
+	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/boundary/testing/vault"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+const (
+	vaultSshCertCredResc            = "boundary_credential_library_vault_ssh_certificate.example"
+	vaultSshCertCredExtCOResc       = "boundary_credential_library_vault_ssh_certificate.ext_co_example"
+	vaultSshCertCredLibName         = "foo"
+	vaultSshCertCredLibDesc         = "the foo"
+	vaultSshCertCredLibPath         = "/ssh/sign/foo"
+	vaultSshCertCredUsername        = "bar"
+	vaultSshCertCredLibStringUpdate = "_random"
+	vaultSshCertCredKeyType         = "ecdsa"
+	vaultSshCertCredKeyBits         = 256
+)
+
+var vaultSshCertCredLibResource = fmt.Sprintf(`
+resource "boundary_credential_library_vault_ssh_certificate" "example" {
+	name                = "%s"
+	description         = "%s"
+	credential_store_id = boundary_credential_store_vault.example.id
+  	path                = "%s"
+  	username            = "%s"
+	key_type            = "ed25519"
+}`, vaultSshCertCredLibName,
+	vaultSshCertCredLibDesc,
+	vaultSshCertCredLibPath,
+	vaultSshCertCredUsername)
+
+var vaultSshCertCredLibResourceUpdate = fmt.Sprintf(`
+resource "boundary_credential_library_vault_ssh_certificate" "example" {
+  	name                = "%s"
+	description         = "%s"
+  	credential_store_id = boundary_credential_store_vault.example.id
+  	path                = "%s"
+  	username            = "%s"
+	key_type            = "%s"
+	key_bits            = %d
+}`, vaultSshCertCredLibName+vaultSshCertCredLibStringUpdate,
+	vaultSshCertCredLibDesc+vaultSshCertCredLibStringUpdate,
+	vaultSshCertCredLibPath+vaultSshCertCredLibStringUpdate,
+	vaultSshCertCredUsername+vaultSshCertCredLibStringUpdate,
+	vaultSshCertCredKeyType,
+	vaultSshCertCredKeyBits)
+
+var vaultSshCertCredLibResourceExtensionsCriticalOpts = fmt.Sprintf(`
+resource "boundary_credential_library_vault_ssh_certificate" "ext_co_example" {
+	name                = "%s"
+	description         = "%s"
+	credential_store_id = boundary_credential_store_vault.example.id
+  	path                = "%s"
+  	username            = "%s"
+	key_type            = "ed25519"
+	extensions = {
+	  permit-pty = ""
+    }
+	critical_options = {
+	  force-command = "/bin/foo"
+	}
+}`, vaultSshCertCredLibName,
+	vaultSshCertCredLibDesc,
+	vaultSshCertCredLibPath,
+	vaultSshCertCredUsername)
+
+var vaultSshCertCredLibResourceExtensionsCriticalOptsUpdate = fmt.Sprintf(`
+resource "boundary_credential_library_vault_ssh_certificate" "ext_co_example" {
+	name                = "%s"
+	description         = "%s"
+	credential_store_id = boundary_credential_store_vault.example.id
+  	path                = "%s"
+  	username            = "%s"
+	key_type            = "ed25519"
+	extensions = {
+	  permit-pty            = ""
+	  permit-X11-forwarding = ""
+    }
+}`, vaultSshCertCredLibName,
+	vaultSshCertCredLibDesc,
+	vaultSshCertCredLibPath,
+	vaultSshCertCredUsername)
+
+var vaultSshCertCredLibResourceExtensionsCriticalOptsUpdate2 = fmt.Sprintf(`
+resource "boundary_credential_library_vault_ssh_certificate" "ext_co_example" {
+	name                = "%s"
+	description         = "%s"
+	credential_store_id = boundary_credential_store_vault.example.id
+  	path                = "%s"
+  	username            = "%s"
+	key_type            = "ed25519"
+	extensions = {
+	  permit-pty = ""
+    }
+	critical_options = {
+	  force-command  = "/bin/foo"
+	  source-address = "10.10.0.0/16"
+	}
+}`, vaultSshCertCredLibName,
+	vaultSshCertCredLibDesc,
+	vaultSshCertCredLibPath,
+	vaultSshCertCredUsername)
+
+func TestAccCredentialLibraryVaultSshCertificate(t *testing.T) {
+	tc := controller.NewTestController(t, tcConfig...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	vc := vault.NewTestVaultServer(t)
+	_, token := vc.CreateToken(t)
+	credStoreRes := vaultCredStoreResource(vc,
+		vaultCredStoreName,
+		vaultCredStoreDesc,
+		vaultCredStoreNamespace,
+		"www.original.com",
+		token,
+		true)
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		IsUnitTest:        true,
+		ProviderFactories: providerFactories(&provider),
+		CheckDestroy:      testAccCheckCredentialLibraryVaultResourceDestroy(t, provider, sshCertVaultCredentialLibraryType),
+		Steps: []resource.TestStep{
+			{
+				// create
+				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultSshCertCredLibResource),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(vaultSshCertCredResc, NameKey, vaultSshCertCredLibName),
+					resource.TestCheckResourceAttr(vaultSshCertCredResc, DescriptionKey, vaultSshCertCredLibDesc),
+					resource.TestCheckResourceAttr(vaultSshCertCredResc, credentialLibraryVaultPathKey, vaultSshCertCredLibPath),
+					resource.TestCheckResourceAttr(vaultSshCertCredResc, credentialLibraryVaultSshCertificateUsernameKey, vaultSshCertCredUsername),
+
+					testAccCheckCredentialLibraryResourceExists(provider, vaultSshCertCredResc),
+				),
+			},
+			importStep(vaultSshCertCredResc),
+			{
+				// update
+				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultSshCertCredLibResourceUpdate),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(vaultSshCertCredResc, NameKey, vaultSshCertCredLibName+vaultSshCertCredLibStringUpdate),
+					resource.TestCheckResourceAttr(vaultSshCertCredResc, DescriptionKey, vaultSshCertCredLibDesc+vaultSshCertCredLibStringUpdate),
+					resource.TestCheckResourceAttr(vaultSshCertCredResc, credentialLibraryVaultPathKey, vaultSshCertCredLibPath+vaultSshCertCredLibStringUpdate),
+					resource.TestCheckResourceAttr(vaultSshCertCredResc, credentialLibraryVaultSshCertificateUsernameKey, vaultSshCertCredUsername+vaultSshCertCredLibStringUpdate),
+					resource.TestCheckResourceAttr(vaultSshCertCredResc, credentialLibraryVaultSshCertificateKeyTypeKey, vaultSshCertCredKeyType),
+					resource.TestCheckResourceAttr(vaultSshCertCredResc, credentialLibraryVaultSshCertificateKeyBitsKey, strconv.Itoa(vaultSshCertCredKeyBits)),
+
+					testAccCheckCredentialLibraryResourceExists(provider, vaultSshCertCredResc),
+				),
+			},
+			importStep(vaultSshCertCredResc),
+			{
+				// create with extensions and critical options
+				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultSshCertCredLibResourceExtensionsCriticalOpts),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, NameKey, vaultSshCertCredLibName),
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, DescriptionKey, vaultSshCertCredLibDesc),
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultPathKey, vaultSshCertCredLibPath),
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateUsernameKey, vaultSshCertCredUsername),
+
+					testAccCheckCredentialLibraryResourceExists(provider, vaultSshCertCredExtCOResc),
+				),
+			},
+			importStep(vaultSshCertCredExtCOResc),
+			{
+				// update with extensions and remove critical options
+				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultSshCertCredLibResourceExtensionsCriticalOptsUpdate),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, NameKey, vaultSshCertCredLibName),
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, DescriptionKey, vaultSshCertCredLibDesc),
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultPathKey, vaultSshCertCredLibPath),
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateUsernameKey, vaultSshCertCredUsername),
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateCriticalOptionsKey+".%", "0"),
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateExtensionsKey+".%", "2"),
+
+					testAccCheckCredentialLibraryResourceExists(provider, vaultSshCertCredExtCOResc),
+				),
+			},
+			importStep(vaultSshCertCredExtCOResc),
+			{
+				// update with extensions and remove critical options
+				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultSshCertCredLibResourceExtensionsCriticalOptsUpdate2),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, NameKey, vaultSshCertCredLibName),
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, DescriptionKey, vaultSshCertCredLibDesc),
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultPathKey, vaultSshCertCredLibPath),
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateUsernameKey, vaultSshCertCredUsername),
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateCriticalOptionsKey+".%", "2"),
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateExtensionsKey+".%", "1"),
+
+					testAccCheckCredentialLibraryResourceExists(provider, vaultSshCertCredExtCOResc),
+				),
+			},
+			importStep(vaultSshCertCredExtCOResc),
+		},
+	})
+}
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider

 import (
@@ -16,24 +19,27 @@ import (
 )

 const (
-	vaultCredResc            = "boundary_credential_library_vault.example"
-	vaultCredTypedResc       = "boundary_credential_library_vault.typed_example"
-	vaultCredLibName         = "foo"
-	vaultCredLibDesc         = "the foo"
-	vaultCredLibPath         = "/foo/bar"
-	vaultCredLibMethodGet    = "GET"
-	vaultCredLibMethodPost   = "POST"
-	vaultCredLibRequestBody  = "foobar"
-	vaultCredLibStringUpdate = "_random"
+	vaultCredResc                 = "boundary_credential_library_vault.example"
+	vaultCredTypedResc            = "boundary_credential_library_vault.typed_example"
+	vaultCredUsernamePasswordResc = "boundary_credential_library_vault.username_password_mapping_override"
+	vaultCredSshPrivateKeyResc    = "boundary_credential_library_vault.ssh_private_key_mapping_override"
+	vaultCredLibName              = "foo"
+	vaultCredLibNameOverride      = "base foo"
+	vaultCredLibDesc              = "the foo"
+	vaultCredLibPath              = "/foo/bar"
+	vaultCredLibMethodGet         = "GET"
+	vaultCredLibMethodPost        = "POST"
+	vaultCredLibRequestBody       = "foobar"
+	vaultCredLibStringUpdate      = "_random"
 )

 var vaultCredLibResource = fmt.Sprintf(`
 resource "boundary_credential_library_vault" "example" {
-	name  = "%s"
-	description = "%s"
+	name                = "%s"
+	description         = "%s"
 	credential_store_id = boundary_credential_store_vault.example.id
-  	path = "%s"
-  	http_method = "%s"
+  	path                = "%s"
+  	http_method         = "%s"
 }`, vaultCredLibName,
 	vaultCredLibDesc,
 	vaultCredLibPath,
@@ -41,12 +47,12 @@ resource "boundary_credential_library_vault" "example" {

 var vaultCredLibResourceUpdate = fmt.Sprintf(`
 resource "boundary_credential_library_vault" "example" {
-  	name  = "%s"
-	description = "%s"
+  	name                = "%s"
+	description         = "%s"
  	credential_store_id = boundary_credential_store_vault.example.id
-  	path = "%s"
-  	http_method = "%s"
-  	http_request_body = "%s"
+  	path                = "%s"
+  	http_method         = "%s"
+  	http_request_body   = "%s"
 }`, vaultCredLibName+vaultCredLibStringUpdate,
 	vaultCredLibDesc+vaultCredLibStringUpdate,
 	vaultCredLibPath+vaultCredLibStringUpdate,
@@ -66,6 +72,71 @@ resource "boundary_credential_library_vault" "typed_example" {
 	vaultCredLibPath,
 	vaultCredLibMethodGet)

+var vaultUsernamePasswordMappingOverrideCredLibResource = fmt.Sprintf(`
+resource "boundary_credential_library_vault" "username_password_mapping_override" {
+	name                         = "%s"
+	description                  = "%s"
+	credential_store_id          = boundary_credential_store_vault.example.id
+	path                         = "%s"
+	http_method                  = "%s"
+	credential_type              = "username_password"
+	credential_mapping_overrides = {
+		password_attribute = "alternative_password_label"
+		username_attribute = "alternative_username_label"
+	}
+}`, vaultCredLibNameOverride,
+	vaultCredLibDesc,
+	vaultCredLibPath,
+	vaultCredLibMethodGet)
+
+var vaultUsernamePasswordMappingOverrideCredLibResourceUpdate = fmt.Sprintf(`
+	resource "boundary_credential_library_vault" "username_password_mapping_override" {
+		name                         = "%s"
+		description                  = "%s"
+		credential_store_id          = boundary_credential_store_vault.example.id
+		path                         = "%s"
+		http_method                  = "%s"
+		credential_type              = "username_password"
+		credential_mapping_overrides = {
+			password_attribute = "updated_password_label"
+			username_attribute = "updated_username_label"
+		}
+	}`, vaultCredLibNameOverride,
+	vaultCredLibDesc,
+	vaultCredLibPath,
+	vaultCredLibMethodGet)
+
+var vaultUsernamePasswordMappingOverrideCredLibResourceRemove = fmt.Sprintf(`
+	resource "boundary_credential_library_vault" "username_password_mapping_override" {
+		name                         = "%s"
+		description                  = "%s"
+		credential_store_id          = boundary_credential_store_vault.example.id
+		path                         = "%s"
+		http_method                  = "%s"
+		credential_type              = "username_password"
+	}`, vaultCredLibNameOverride,
+	vaultCredLibDesc,
+	vaultCredLibPath,
+	vaultCredLibMethodGet)
+
+var vaultSshPrivateKeyMappingOverrideCredLibResource = fmt.Sprintf(`
+resource "boundary_credential_library_vault" "ssh_private_key_mapping_override" {
+	name                         = "%s"
+	description                  = "%s"
+	credential_store_id          = boundary_credential_store_vault.example.id
+	path                         = "%s"
+	http_method                  = "%s"
+	credential_type              = "ssh_private_key"
+	credential_mapping_overrides = {
+		private_key_attribute 			 = "alternative_key_label"
+		private_key_passphrase_attribute = "alternative_passphrase_label"
+		username_attribute 				 = "alternative_username_label"
+	}
+}`, vaultCredLibName,
+	vaultCredLibDesc,
+	vaultCredLibPath,
+	vaultCredLibMethodGet)
+
 func TestAccCredentialLibraryVault(t *testing.T) {
 	tc := controller.NewTestController(t, tcConfig...)
 	defer tc.Shutdown()
@@ -85,7 +156,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		IsUnitTest:        true,
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckCredentialLibraryVaultResourceDestroy(t, provider),
+		CheckDestroy:      testAccCheckCredentialLibraryVaultResourceDestroy(t, provider, baseVaultCredentialLibraryType),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -97,7 +168,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 					resource.TestCheckResourceAttr(vaultCredResc, credentialLibraryVaultHttpMethodKey, vaultCredLibMethodGet),
 					resource.TestCheckResourceAttr(vaultCredResc, credentialLibraryVaultHttpRequestBodyKey, ""),

-					testAccCheckCredentialLibraryVaultResourceExists(provider, vaultCredResc),
+					testAccCheckCredentialLibraryResourceExists(provider, vaultCredResc),
 				),
 			},
 			importStep(vaultCredResc),
@@ -112,7 +183,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 					resource.TestCheckResourceAttr(vaultCredResc, credentialLibraryVaultHttpMethodKey, vaultCredLibMethodPost),
 					resource.TestCheckResourceAttr(vaultCredResc, credentialLibraryVaultHttpRequestBodyKey, vaultCredLibRequestBody),

-					testAccCheckCredentialLibraryVaultResourceExists(provider, vaultCredResc),
+					testAccCheckCredentialLibraryResourceExists(provider, vaultCredResc),
 				),
 			},
 			importStep(vaultCredResc),
@@ -128,7 +199,75 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 					resource.TestCheckResourceAttr(vaultCredTypedResc, credentialLibraryVaultHttpRequestBodyKey, ""),
 					resource.TestCheckResourceAttr(vaultCredTypedResc, credentialLibraryCredentialTypeKey, "ssh_private_key"),

-					testAccCheckCredentialLibraryVaultResourceExists(provider, vaultCredTypedResc),
+					testAccCheckCredentialLibraryResourceExists(provider, vaultCredTypedResc),
+				),
+			},
+			importStep(vaultCredResc),
+
+			{
+				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate, vaultUsernamePasswordMappingOverrideCredLibResource),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, NameKey, vaultCredLibNameOverride),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, DescriptionKey, vaultCredLibDesc),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultPathKey, vaultCredLibPath),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultHttpMethodKey, vaultCredLibMethodGet),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultHttpRequestBodyKey, ""),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryCredentialTypeKey, "username_password"),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, "credential_mapping_overrides.password_attribute", "alternative_password_label"),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, "credential_mapping_overrides.username_attribute", "alternative_username_label"),
+
+					testAccCheckCredentialLibraryResourceExists(provider, vaultCredUsernamePasswordResc),
+				),
+			},
+			importStep(vaultCredResc),
+
+			{
+				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate, vaultUsernamePasswordMappingOverrideCredLibResourceUpdate),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, NameKey, vaultCredLibNameOverride),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, DescriptionKey, vaultCredLibDesc),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultPathKey, vaultCredLibPath),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultHttpMethodKey, vaultCredLibMethodGet),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultHttpRequestBodyKey, ""),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryCredentialTypeKey, "username_password"),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, "credential_mapping_overrides.password_attribute", "updated_password_label"),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, "credential_mapping_overrides.username_attribute", "updated_username_label"),
+
+					testAccCheckCredentialLibraryResourceExists(provider, vaultCredUsernamePasswordResc),
+				),
+			},
+			importStep(vaultCredResc),
+
+			{
+				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate, vaultUsernamePasswordMappingOverrideCredLibResourceRemove),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, NameKey, vaultCredLibNameOverride),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, DescriptionKey, vaultCredLibDesc),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultPathKey, vaultCredLibPath),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultHttpMethodKey, vaultCredLibMethodGet),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultHttpRequestBodyKey, ""),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryCredentialTypeKey, "username_password"),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryCredentialMappingOverridesKey+".%", "0"),
+
+					testAccCheckCredentialLibraryResourceExists(provider, vaultCredUsernamePasswordResc),
+				),
+			},
+			importStep(vaultCredResc),
+
+			{
+				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate, vaultSshPrivateKeyMappingOverrideCredLibResource),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, NameKey, vaultCredLibName),
+					resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, DescriptionKey, vaultCredLibDesc),
+					resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, credentialLibraryVaultPathKey, vaultCredLibPath),
+					resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, credentialLibraryVaultHttpMethodKey, vaultCredLibMethodGet),
+					resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, credentialLibraryVaultHttpRequestBodyKey, ""),
+					resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, credentialLibraryCredentialTypeKey, "ssh_private_key"),
+					resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, "credential_mapping_overrides.private_key_attribute", "alternative_key_label"),
+					resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, "credential_mapping_overrides.private_key_passphrase_attribute", "alternative_passphrase_label"),
+					resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, "credential_mapping_overrides.username_attribute", "alternative_username_label"),
+
+					testAccCheckCredentialLibraryResourceExists(provider, vaultCredSshPrivateKeyResc),
 				),
 			},
 			importStep(vaultCredResc),
@@ -136,7 +275,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 	})
 }

-func testAccCheckCredentialLibraryVaultResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
+func testAccCheckCredentialLibraryResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[name]
 		if !ok {
@@ -158,7 +297,14 @@ func testAccCheckCredentialLibraryVaultResourceExists(testProvider *schema.Provi
 	}
 }

-func testAccCheckCredentialLibraryVaultResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
+type vaultCredentialLibraryType string
+
+const (
+	baseVaultCredentialLibraryType    vaultCredentialLibraryType = "boundary_credential_library_vault"
+	sshCertVaultCredentialLibraryType vaultCredentialLibraryType = "boundary_credential_library_vault_ssh_certificate"
+)
+
+func testAccCheckCredentialLibraryVaultResourceDestroy(t *testing.T, testProvider *schema.Provider, typ vaultCredentialLibraryType) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if testProvider.Meta() == nil {
 			t.Fatal("got nil provider metadata")
@@ -167,7 +313,7 @@ func testAccCheckCredentialLibraryVaultResourceDestroy(t *testing.T, testProvide

 		for _, rs := range s.RootModule().Resources {
 			switch rs.Type {
-			case "boundary_credential_library_vault":
+			case string(typ):
 				id := rs.Primary.ID

 				c := credentiallibraries.NewClient(md.client)
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider

 import (
@@ -62,6 +65,7 @@ func resourceCredentialSshPrivateKey() *schema.Resource {
 				Description: "The private key associated with the credential.",
 				Type:        schema.TypeString,
 				Required:    true,
+				Sensitive:   true,
 			},
 			credentialSshPrivateKeyPrivateKeyHmacKey: {
 				Description: "The private key hmac.",
@@ -72,6 +76,7 @@ func resourceCredentialSshPrivateKey() *schema.Resource {
 				Description: "The passphrase of the private key associated with the credential.",
 				Type:        schema.TypeString,
 				Optional:    true,
+				Sensitive:   true,
 			},
 			credentialSshPrivateKeyPassphraseHmacKey: {
 				Description: "The private key passphrase hmac.",
@@ -1,13 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider

 import (
-	"context"
 	"fmt"
-	"net/http"
 	"testing"

-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/credentials"
 	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -72,7 +71,7 @@ func TestAccCredentialSshPrivateKey(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		IsUnitTest:        true,
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckCredentialSshPrivateKeyResourceDestroy(t, provider),
+		CheckDestroy:      testAccCheckCredentialResourceDestroy(t, provider, sshPrivateKeyCredentialType),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -84,8 +83,8 @@ func TestAccCredentialSshPrivateKey(t *testing.T) {
 					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, credentialSshPrivateKeyPrivateKeyKey, privKey),
 					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, credentialSshPrivateKeyPassphraseKey, ""),

-					testAccCheckCredentialStoreSshPrivateKeyHmac(provider),
-					testAccCheckCredentialSshPrivateKeyResourceExists(provider, sshPrivateKeyCredResc),
+					testAccCheckCredentialStoreSshPrivateKeyHmac(),
+					testAccCheckCredentialResourceExists(provider, sshPrivateKeyCredResc),
 				),
 			},
 			importStep(sshPrivateKeyCredResc, credentialSshPrivateKeyPrivateKeyKey, credentialSshPrivateKeyPassphraseKey),
@@ -99,63 +98,15 @@ func TestAccCredentialSshPrivateKey(t *testing.T) {
 					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, credentialSshPrivateKeyPrivateKeyKey, privKeyUpdate),
 					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, credentialSshPrivateKeyPassphraseKey, privKeyUpdatePassphrase),

-					testAccCheckCredentialStoreSshPrivateKeyHmac(provider),
-					testAccCheckCredentialSshPrivateKeyResourceExists(provider, sshPrivateKeyCredResc),
+					testAccCheckCredentialStoreSshPrivateKeyHmac(),
+					testAccCheckCredentialResourceExists(provider, sshPrivateKeyCredResc),
 				),
 			},
 		},
 	})
 }

-func testAccCheckCredentialSshPrivateKeyResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[name]
-		if !ok {
-			return fmt.Errorf("not found: %s", name)
-		}
-
-		id := rs.Primary.ID
-		if id == "" {
-			return fmt.Errorf("no ID is set")
-		}
-		storeId = id
-
-		md := testProvider.Meta().(*metaData)
-		c := credentials.NewClient(md.client)
-		if _, err := c.Read(context.Background(), id); err != nil {
-			return fmt.Errorf("got an error reading %q: %w", id, err)
-		}
-
-		return nil
-	}
-}
-
-func testAccCheckCredentialSshPrivateKeyResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if testProvider.Meta() == nil {
-			t.Fatal("got nil provider metadata")
-		}
-		md := testProvider.Meta().(*metaData)
-
-		for _, rs := range s.RootModule().Resources {
-			switch rs.Type {
-			case "boundary_credential_ssh_private_key":
-				id := rs.Primary.ID
-
-				c := credentials.NewClient(md.client)
-				_, err := c.Read(context.Background(), id)
-				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
-					return fmt.Errorf("didn't get a 404 when reading destroyed credential %q: %v", id, err)
-				}
-			default:
-				continue
-			}
-		}
-		return nil
-	}
-}
-
-func testAccCheckCredentialStoreSshPrivateKeyHmac(testProvider *schema.Provider) resource.TestCheckFunc {
+func testAccCheckCredentialStoreSshPrivateKeyHmac() resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[sshPrivateKeyCredResc]
 		if !ok {
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider

 import (
@@ -1,17 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider

 import (
 	"context"
 	"fmt"
-	"net/http"
 	"testing"

-	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/credentialstores"
 	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
 )

 const (
@@ -47,7 +47,7 @@ func TestAccCredentialStoreStatic(t *testing.T) {
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckCredentialStoreStaticResourceDestroy(t, provider),
+		CheckDestroy:      testAccCheckCredentialStoreResourceDestroy(t, provider, staticStoreCredentialStoreType),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -56,7 +56,7 @@ func TestAccCredentialStoreStatic(t *testing.T) {
 					resource.TestCheckResourceAttr(staticCredStoreResc, NameKey, staticCredStoreName),
 					resource.TestCheckResourceAttr(staticCredStoreResc, DescriptionKey, staticCredStoreDesc),

-					testAccCheckCredentialStoreVaultResourceExists(provider, staticCredStoreResc),
+					testAccCheckCredentialStoreResourceExists(provider, staticCredStoreResc),
 				),
 			},
 			importStep(staticCredStoreResc),
@@ -67,7 +67,7 @@ func TestAccCredentialStoreStatic(t *testing.T) {
 					resource.TestCheckResourceAttr(staticCredStoreResc, NameKey, staticCredStoreName+staticCredStoreUpdate),
 					resource.TestCheckResourceAttr(staticCredStoreResc, DescriptionKey, staticCredStoreDesc+staticCredStoreUpdate),

-					testAccCheckCredentialStoreVaultResourceExists(provider, staticCredStoreResc),
+					testAccCheckCredentialStoreResourceExists(provider, staticCredStoreResc),
 				),
 			},
 			importStep(staticCredStoreResc),
@@ -112,28 +112,3 @@ func staticCredentialStoreExternalUpdate(t *testing.T, testProvider *schema.Prov
 		t.Fatal(fmt.Errorf("got an error updating %q: %w", cr.Item.Id, err))
 	}
 }
-
-func testAccCheckCredentialStoreStaticResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if testProvider.Meta() == nil {
-			t.Fatal("got nil provider metadata")
-		}
-		md := testProvider.Meta().(*metaData)
-
-		for _, rs := range s.RootModule().Resources {
-			switch rs.Type {
-			case "boundary_credential_store_static":
-				id := rs.Primary.ID
-
-				c := credentialstores.NewClient(md.client)
-				_, err := c.Read(context.Background(), id)
-				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
-					return fmt.Errorf("didn't get a 404 when reading destroyed static credential store %q: %v", id, err)
-				}
-			default:
-				continue
-			}
-		}
-		return nil
-	}
-}
@@ -1,7 +1,11 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider

 import (
 	"context"
+	"fmt"
 	"net/http"

 	"github.com/hashicorp/boundary/api"
@@ -22,6 +26,7 @@ const (
 	credentialStoreVaultClientCertificateKeyKey     = "client_certificate_key"
 	credentialStoreVaultClientCertificateKeyHmacKey = "client_certificate_key_hmac"
 	credentialStoreType                             = "vault"
+	credentialStoreVaultWorkerFilterKey             = "worker_filter"
 )

 var storeVaultAttrs = []string{
@@ -119,40 +124,61 @@ func resourceCredentialStoreVault() *schema.Resource {
 				Type:        schema.TypeString,
 				Computed:    true,
 			},
+			credentialStoreVaultWorkerFilterKey: {
+				Description: "HCP Only. A filter used to control which PKI workers can handle Vault requests. This allows the use of private Vault instances with Boundary.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
 		},
 	}
 }

-func setFromVaultCredentialStoreResponseMap(d *schema.ResourceData, raw map[string]interface{}, fromRead bool) error {
+func setFromVaultCredentialStoreResponseMap(d *schema.ResourceData, raw map[string]interface{}, fromRead bool) diag.Diagnostics {
 	if err := d.Set(NameKey, raw[NameKey]); err != nil {
-		return err
+		return diag.FromErr(err)
 	}
 	if err := d.Set(DescriptionKey, raw[DescriptionKey]); err != nil {
-		return err
+		return diag.FromErr(err)
 	}
 	if err := d.Set(ScopeIdKey, raw[ScopeIdKey]); err != nil {
-		return err
+		return diag.FromErr(err)
+	}
+	if err := d.Set(credentialStoreVaultWorkerFilterKey, raw[credentialStoreVaultWorkerFilterKey]); err != nil {
+		return diag.FromErr(err)
 	}

+	var diags diag.Diagnostics
+	csId := raw["id"]
 	if attrsVal, ok := raw["attributes"]; ok {
 		attrs := attrsVal.(map[string]interface{})
 		for _, v := range storeVaultAttrs {
 			if err := d.Set(v, attrs[v]); err != nil {
-				return err
+				return diag.FromErr(err)
 			}
 		}

-		stateTokenHmac := d.Get(credentialStoreVaultTokenHmacKey)
-		boundaryTokenHmac := attrs[credentialStoreVaultTokenHmacKey].(string)
-		if stateTokenHmac.(string) != boundaryTokenHmac && fromRead {
-			// TokenHmac has changed in Boundary, therefore the token has changed.
-			// Update token value to force tf to attempt update.
-			if err := d.Set(credentialStoreVaultTokenKey, "(changed in Boundary)"); err != nil {
-				return err
+		boundaryTokenHmac, ok := attrs[credentialStoreVaultTokenHmacKey]
+		tokenStatus := attrs["token_status"]
+		switch {
+		case ok:
+			boundaryTokenHmacStr := boundaryTokenHmac.(string)
+			stateTokenHmac := d.Get(credentialStoreVaultTokenHmacKey)
+			if stateTokenHmac.(string) != boundaryTokenHmacStr && fromRead {
+				// TokenHmac has changed in Boundary, therefore the token has changed.
+				// Update token value to force tf to attempt update.
+				if err := d.Set(credentialStoreVaultTokenKey, "(changed in Boundary)"); err != nil {
+					return diag.FromErr(err)
+				}
 			}
-		}
-		if err := d.Set(credentialStoreVaultTokenHmacKey, boundaryTokenHmac); err != nil {
-			return err
+			if err := d.Set(credentialStoreVaultTokenHmacKey, boundaryTokenHmacStr); err != nil {
+				return diag.FromErr(err)
+			}
+
+		case tokenStatus == "expired":
+			diags = append(diags, diag.Diagnostic{
+				Severity: diag.Warning,
+				Summary:  fmt.Sprintf("Vault token has expired for credential store %q, please update.", csId),
+			})
 		}

 		stateClientKeyHmac := d.Get(credentialStoreVaultClientCertificateKeyHmacKey)
@@ -164,17 +190,17 @@ func setFromVaultCredentialStoreResponseMap(d *schema.ResourceData, raw map[stri
 			// ClientKeyHmac has changed in Boundary, therefore the ClientKey has changed.
 			// Update ClientKey value to force tf to attempt update.
 			if err := d.Set(credentialStoreVaultClientCertificateKeyKey, "(changed in Boundary)"); err != nil {
-				return err
+				return diag.FromErr(err)
 			}
 		}
 		if err := d.Set(credentialStoreVaultClientCertificateKeyHmacKey, boundaryClientKeyHmac); err != nil {
-			return err
+			return diag.FromErr(err)
 		}
 	}

-	d.SetId(raw["id"].(string))
+	d.SetId(csId.(string))

-	return nil
+	return diags
 }

 func resourceCredentialStoreVaultCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
@@ -211,6 +237,9 @@ func resourceCredentialStoreVaultCreate(ctx context.Context, d *schema.ResourceD
 	if v, ok := d.GetOk(credentialStoreVaultTokenKey); ok {
 		opts = append(opts, credentialstores.WithVaultCredentialStoreToken(v.(string)))
 	}
+	if v, ok := d.GetOk(credentialStoreVaultWorkerFilterKey); ok {
+		opts = append(opts, credentialstores.WithVaultCredentialStoreWorkerFilter(v.(string)))
+	}

 	var scope string
 	gotScope, ok := d.GetOk(ScopeIdKey)
@@ -229,8 +258,8 @@ func resourceCredentialStoreVaultCreate(ctx context.Context, d *schema.ResourceD
 		return diag.Errorf("nil credential store after create")
 	}

-	if err := setFromVaultCredentialStoreResponseMap(d, cr.GetResponse().Map, false); err != nil {
-		return diag.Errorf("error generating credential store from response map: %v", err)
+	if diagnostics := setFromVaultCredentialStoreResponseMap(d, cr.GetResponse().Map, false); diagnostics != nil {
+		return diagnostics
 	}

 	return nil
@@ -252,8 +281,8 @@ func resourceCredentialStoreVaultRead(ctx context.Context, d *schema.ResourceDat
 		return diag.Errorf("credential store nil after read")
 	}

-	if err := setFromVaultCredentialStoreResponseMap(d, cr.GetResponse().Map, true); err != nil {
-		return diag.Errorf("error generating credential store from response map: %v", err)
+	if diagnostics := setFromVaultCredentialStoreResponseMap(d, cr.GetResponse().Map, true); diagnostics != nil {
+		return diagnostics
 	}

 	return nil
@@ -342,6 +371,14 @@ func resourceCredentialStoreVaultUpdate(ctx context.Context, d *schema.ResourceD
 		}
 	}

+	if d.HasChange(credentialStoreVaultWorkerFilterKey) {
+		opts = append(opts, credentialstores.DefaultVaultCredentialStoreWorkerFilter())
+		v, ok := d.GetOk(credentialStoreVaultWorkerFilterKey)
+		if ok {
+			opts = append(opts, credentialstores.WithVaultCredentialStoreWorkerFilter(v.(string)))
+		}
+	}
+
 	if len(opts) > 0 {
 		opts = append(opts, credentialstores.WithAutomaticVersioning(true))
 		crUpdate, err := client.Update(ctx, d.Id(), 0, opts...)
@@ -352,8 +389,8 @@ func resourceCredentialStoreVaultUpdate(ctx context.Context, d *schema.ResourceD
 			return diag.Errorf("credential store nil after update")
 		}

-		if err = setFromVaultCredentialStoreResponseMap(d, crUpdate.GetResponse().Map, false); err != nil {
-			return diag.Errorf("error generating credential store from response map: %v", err)
+		if diagnostics := setFromVaultCredentialStoreResponseMap(d, crUpdate.GetResponse().Map, false); diagnostics != nil {
+			return diagnostics
 		}
 	}

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider

 import (
@@ -6,11 +9,11 @@ import (
 	"crypto/sha256"
 	"encoding/base64"
 	"fmt"
+	"github.com/hashicorp/boundary/api"
 	"net/http"
 	"strings"
 	"testing"

-	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/credentialstores"
 	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/boundary/testing/vault"
@@ -97,7 +100,7 @@ func TestAccCredentialStoreVault(t *testing.T) {
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckCredentialStoreVaultResourceDestroy(t, provider),
+		CheckDestroy:      testAccCheckCredentialStoreResourceDestroy(t, provider, vaultStoreCredentialStoreType),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -115,7 +118,7 @@ func TestAccCredentialStoreVault(t *testing.T) {
 					resource.TestCheckResourceAttr(vaultCredStoreResc, credentialStoreVaultClientCertificateKey, ""),
 					resource.TestCheckResourceAttr(vaultCredStoreResc, credentialStoreVaultClientCertificateKeyKey, ""),

-					testAccCheckCredentialStoreVaultResourceExists(provider, vaultCredStoreResc),
+					testAccCheckCredentialStoreResourceExists(provider, vaultCredStoreResc),
 				),
 			},
 			importStep(vaultCredStoreResc, credentialStoreVaultTokenKey, credentialStoreVaultClientCertificateKeyKey),
@@ -135,7 +138,7 @@ func TestAccCredentialStoreVault(t *testing.T) {
 					resource.TestCheckResourceAttr(vaultCredStoreResc, credentialStoreVaultClientCertificateKey, string(vcUpdate.ClientCert)),
 					resource.TestCheckResourceAttr(vaultCredStoreResc, credentialStoreVaultClientCertificateKeyKey, string(vcUpdate.ClientKey)),

-					testAccCheckCredentialStoreVaultResourceExists(provider, vaultCredStoreResc),
+					testAccCheckCredentialStoreResourceExists(provider, vaultCredStoreResc),
 				),
 			},
 			importStep(vaultCredStoreResc, credentialStoreVaultTokenKey, credentialStoreVaultClientCertificateKeyKey),
@@ -191,7 +194,7 @@ func externalUpdate(t *testing.T, testProvider *schema.Provider) {
 	}
 }

-func testAccCheckCredentialStoreVaultResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
+func testAccCheckCredentialStoreResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[name]
 		if !ok {
@@ -214,7 +217,14 @@ func testAccCheckCredentialStoreVaultResourceExists(testProvider *schema.Provide
 	}
 }

-func testAccCheckCredentialStoreVaultResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
+type credentialDestroyStoreType string
+
+const (
+	staticStoreCredentialStoreType credentialDestroyStoreType = "boundary_credential_store_static"
+	vaultStoreCredentialStoreType  credentialDestroyStoreType = "boundary_credential_store_vault"
+)
+
+func testAccCheckCredentialStoreResourceDestroy(t *testing.T, testProvider *schema.Provider, typ credentialDestroyStoreType) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if testProvider.Meta() == nil {
 			t.Fatal("got nil provider metadata")
@@ -223,13 +233,13 @@ func testAccCheckCredentialStoreVaultResourceDestroy(t *testing.T, testProvider

 		for _, rs := range s.RootModule().Resources {
 			switch rs.Type {
-			case "boundary_credential_store_vault":
+			case string(typ):
 				id := rs.Primary.ID

 				c := credentialstores.NewClient(md.client)
 				_, err := c.Read(context.Background(), id)
 				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
-					return fmt.Errorf("didn't get a 404 when reading destroyed Vault credential store %q: %v", id, err)
+					return fmt.Errorf("didn't get a 404 when reading destroyed static credential store %q: %v", id, err)
 				}
 			default:
 				continue
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider

 import (
@@ -60,6 +63,7 @@ func resourceCredentialUsernamePassword() *schema.Resource {
 				Description: "The password of this username/password credential.",
 				Type:        schema.TypeString,
 				Required:    true,
+				Sensitive:   true,
 			},
 			credentialUsernamePasswordPasswordHmacKey: {
 				Description: "The password hmac.",
@@ -1,12 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider

 import (
 	"context"
 	"fmt"
-	"net/http"
 	"testing"

-	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/credentials"
 	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
@@ -66,7 +67,7 @@ func TestAccCredentialUsernamePassword(t *testing.T) {
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckCredentialUsernamePasswordResourceDestroy(t, provider),
+		CheckDestroy:      testAccCheckCredentialResourceDestroy(t, provider, usernamePasswordCredentialType),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -77,8 +78,8 @@ func TestAccCredentialUsernamePassword(t *testing.T) {
 					resource.TestCheckResourceAttr(usernamePasswordCredResc, credentialUsernamePasswordUsernameKey, usernamePasswordCredUsername),
 					resource.TestCheckResourceAttr(usernamePasswordCredResc, credentialUsernamePasswordPasswordKey, usernamePasswordCredPassword),

-					testAccCheckCredentialStoreUsernamePasswordHmac(provider),
-					testAccCheckCredentialUsernamePasswordResourceExists(provider, usernamePasswordCredResc),
+					testAccCheckCredentialStoreUsernamePasswordHmac(),
+					testAccCheckCredentialResourceExists(provider, usernamePasswordCredResc),
 				),
 			},
 			importStep(usernamePasswordCredResc, credentialUsernamePasswordPasswordKey),
@@ -91,8 +92,8 @@ func TestAccCredentialUsernamePassword(t *testing.T) {
 					resource.TestCheckResourceAttr(usernamePasswordCredResc, credentialUsernamePasswordUsernameKey, usernamePasswordCredUsername+usernamePasswordCredUpdate),
 					resource.TestCheckResourceAttr(usernamePasswordCredResc, credentialUsernamePasswordPasswordKey, usernamePasswordCredPassword+usernamePasswordCredUpdate),

-					testAccCheckCredentialStoreUsernamePasswordHmac(provider),
-					testAccCheckCredentialUsernamePasswordResourceExists(provider, usernamePasswordCredResc),
+					testAccCheckCredentialStoreUsernamePasswordHmac(),
+					testAccCheckCredentialResourceExists(provider, usernamePasswordCredResc),
 				),
 			},
 			importStep(usernamePasswordCredResc, credentialUsernamePasswordPasswordKey),
@@ -134,55 +135,7 @@ func usernamePasswordCredExternalUpdate(t *testing.T, testProvider *schema.Provi
 	}
 }

-func testAccCheckCredentialUsernamePasswordResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[name]
-		if !ok {
-			return fmt.Errorf("not found: %s", name)
-		}
-
-		id := rs.Primary.ID
-		if id == "" {
-			return fmt.Errorf("no ID is set")
-		}
-		storeId = id
-
-		md := testProvider.Meta().(*metaData)
-		c := credentials.NewClient(md.client)
-		if _, err := c.Read(context.Background(), id); err != nil {
-			return fmt.Errorf("got an error reading %q: %w", id, err)
-		}
-
-		return nil
-	}
-}
-
-func testAccCheckCredentialUsernamePasswordResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if testProvider.Meta() == nil {
-			t.Fatal("got nil provider metadata")
-		}
-		md := testProvider.Meta().(*metaData)
-
-		for _, rs := range s.RootModule().Resources {
-			switch rs.Type {
-			case "boundary_credential_username_password":
-				id := rs.Primary.ID
-
-				c := credentials.NewClient(md.client)
-				_, err := c.Read(context.Background(), id)
-				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
-					return fmt.Errorf("didn't get a 404 when reading destroyed username password credential %q: %v", id, err)
-				}
-			default:
-				continue
-			}
-		}
-		return nil
-	}
-}
-
-func testAccCheckCredentialStoreUsernamePasswordHmac(testProvider *schema.Provider) resource.TestCheckFunc {
+func testAccCheckCredentialStoreUsernamePasswordHmac() resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[usernamePasswordCredResc]
 		if !ok {
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider

 import (
@@ -75,7 +78,7 @@ func setFromGroupResponseMap(d *schema.ResourceData, raw map[string]interface{})
 	return nil
 }

-func resourceGroupCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceGroupCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) (errs diag.Diagnostics) {
 	md := meta.(*metaData)

 	var scopeId string
@@ -108,7 +111,12 @@ func resourceGroupCreate(ctx context.Context, d *schema.ResourceData, meta inter
 	if gcr == nil {
 		return diag.Errorf("group nil after create")
 	}
-	raw := gcr.GetResponse().Map
+	apiResponse := gcr.GetResponse().Map
+	defer func() {
+		if err := setFromGroupResponseMap(d, apiResponse); err != nil {
+			errs = append(errs, diag.FromErr(err)...)
+		}
+	}()

 	if val, ok := d.GetOk(groupMemberIdsKey); ok {
 		list := val.(*schema.Set).List()
@@ -118,16 +126,12 @@ func resourceGroupCreate(ctx context.Context, d *schema.ResourceData, meta inter
 		}
 		gcsmr, err := grps.SetMembers(ctx, gcr.Item.Id, gcr.Item.Version, memberIds)
 		if err != nil {
-			return diag.Errorf("error setting principals on role: %v", err)
+			return diag.Errorf("error setting members on group: %v", err)
 		}
 		if gcsmr == nil {
 			return diag.Errorf("group nil after setting members")
 		}
-		raw = gcsmr.GetResponse().Map
-	}
-
-	if err := setFromGroupResponseMap(d, raw); err != nil {
-		return diag.FromErr(err)
+		apiResponse = gcsmr.GetResponse().Map
 	}

 	return nil
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider

 import (
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider

 import (
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider

 import (
@@ -5,10 +8,8 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"net/http"
 	"testing"

-	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/hostcatalogs"
 	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
@@ -153,7 +154,7 @@ func TestAccPluginHostCatalog(t *testing.T) {
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckPluginHostCatalogResourceDestroy(t, provider),
+		CheckDestroy:      testAccCheckHostCatalogResourceDestroy(t, provider, baseHostCatalogType),
 		Steps: []resource.TestStep{
 			{
 				// test create
@@ -365,27 +366,3 @@ func testAccCheckPluginHostCatalogResourceExists(testProvider *schema.Provider,
 		return nil
 	}
 }
-
-func testAccCheckPluginHostCatalogResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		md := testProvider.Meta().(*metaData)
-
-		for _, rs := range s.RootModule().Resources {
-			switch rs.Type {
-			case "boundary_host_catalog":
-
-				id := rs.Primary.ID
-				hcClient := hostcatalogs.NewClient(md.client)
-
-				_, err := hcClient.Read(context.Background(), id)
-				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
-					return fmt.Errorf("didn't get a 404 when reading destroyed host catalog %q: %v", id, err)
-				}
-
-			default:
-				continue
-			}
-		}
-		return nil
-	}
-}
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider

 import (
@@ -1 +1 @@
 .18.4
 .20.5
				`@@ -0,0 +1 @@`
				`terraform import boundary_credential_json.example_json <my-id>`
				`@@ -0,0 +1 @@`
				`terraform import boundary_credential_library_vault_ssh_certificate.foo <my-id>`
				`@@ -0,0 +1 @@`
				`terraform import boundary_host_catalog_plugin.foo <my-id>`
				`@@ -0,0 +1 @@`
				`terraform import boundary_host_set_plugin.foo <my-id>`
				`@@ -0,0 +1 @@`
				`terraform import boundary_host_set_static.foo <my-id>`
				`@@ -0,0 +1 @@`
				`terraform import boundary_host_static.foo <my-id>`
				`@@ -0,0 +1 @@`
				`terraform import boundary_worker.foo <my-id>`