chore: Add changelog for release

* feat(oidc): OIDC Prompt Support

Boundary OIDC method does not currently support passing in prompts during authentication. This change adds the capability of passing OIDC prompts. Prompts are optional OIDC parameters that determine the behaviour of the authentication server: https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest

Add new optional `prompts` option to `boundary_auth_method_oidc` resource. `prompts` option are optional OIDC parameters that determine the behavior of the authentication server.

.circleci/config.yml

@@ -1,16 +0,0 @@
-version: 2.1
-jobs:
-  build:
-    machine:
-      image: 'ubuntu-1604:201903-01'
-    working_directory: ~/terraform-provider-watchtower
-    steps:
-    - add_ssh_keys:
-        fingerprints:
-        # hc-github-team-secure-boundary github user,TF_ACC=1 ~/.go/bin/go test ./... -v $(TESTARGS) -timeout 120m to read private modules
-          - "d4:7f:b2:f7:6f:4d:e7:21:cc:d2:b7:6a:8b:68:e6:d4"
-    - checkout
-    - run:
-        name: "Run Acceptance Tests"
-        command: |
-          make testacc-ci

.copywrite.hcl

@@ -0,0 +1,16 @@
+schema_version = 1
+
+project {
+  license = "MPL-2.0"
+
+  copyright_year = 2020
+
+  # (OPTIONAL) A list of globs that should not have copyright or license headers.
+  # Supports doublestar glob patterns for more flexibility in defining which
+  # files or folders should be ignored
+  # Default: []
+  header_ignore = [
+    "examples/**/*.tf",
+    "examples/**/*.sh",
+  ]
+}

.github/dependabot.yml

@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 # See GitHub's docs for more information on this file:
 # https://docs.github.com/en/free-pro-team@latest/github/administering-a-repository/configuration-options-for-dependency-updates
 version: 2

.github/workflows/actionlint.yml

@@ -0,0 +1,15 @@
+name: Lint GitHub Actions workflows
+on: push
+
+permissions:
+  contents: read
+
+jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - name: Check workflow files
+        uses: docker://docker.mirror.hashicorp.services/rhysd/actionlint@sha256:02ccb6d91e4cb4a7b21eb99d5274d257e81ae667688d730e89d7ea0d6d35db91
+        with:
+          args: -color

.github/workflows/jira.yml

@@ -9,6 +9,9 @@ on:
 
 name: Jira Sync
 
+permissions:
+  contents: read
+
 jobs:
   sync:
     runs-on: ubuntu-latest
@@ -18,19 +21,19 @@ jobs:
       if: github.event.action == 'opened'
       id: boundary-team-role
       run: |
-        TEAM=boundary
+        TEAM="boundary"
         ROLE="$(hub api orgs/hashicorp/teams/${TEAM}/memberships/${{ github.actor }} | jq -r '.role | select(.!=null)')"
-        if [[ -n ${ROLE} ]]; then
+        if [[ -n "${ROLE}" ]]; then
           echo "Actor ${{ github.actor }} is a ${TEAM} team member, skipping ticket creation"
         else
           echo "Actor ${{ github.actor }} is not a ${TEAM} team member"
         fi
-        echo "::set-output name=role::${ROLE}"
+        echo "name=role::${ROLE}" >> "$GITHUB_OUTPUT"
       env:
         GITHUB_TOKEN: ${{ secrets.JIRA_SYNC_GITHUB_TOKEN }}
 
     - name: Login
-      uses: atlassian/gajira-login@v2.0.0
+      uses: atlassian/gajira-login@45fd029b9f1d6d8926c6f04175aa80c0e42c9026 # v3.0.1
       env:
         JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
         JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
@@ -41,14 +44,14 @@ jobs:
       id: set-ticket-type
       run: |
         if [[ "${{ github.event_name }}" == "pull_request_target" ]]; then
-          echo "::set-output name=type::PR"
+          echo "name=type::PR" >> "$GITHUB_OUTPUT"
         else
-          echo "::set-output name=type::ISS"
+          echo "name=type::ISS" >> "$GITHUB_OUTPUT"
         fi
 
     - name: Create ticket
       if: github.event.action == 'opened' && !steps.boundary-team-role.outputs.role
-      uses: tomhjp/gh-action-jira-create@v0.2.0
+      uses: tomhjp/gh-action-jira-create@3ed1789cad3521292e591a7cfa703215ec1348bf # v0.2.1
       with:
         project: ICU
         issuetype: "GH Issue"
@@ -60,28 +63,28 @@ jobs:
     - name: Search
       if: github.event.action != 'opened'
       id: search
-      uses: tomhjp/gh-action-jira-search@v0.2.1
+      uses: tomhjp/gh-action-jira-search@04700b457f317c3e341ce90da5a3ff4ce058f2fa # v0.2.2
       with:
         # cf[10089] is Issue Link custom field
         jql: 'issuetype = "GH Issue" and cf[10089]="${{ github.event.issue.html_url || github.event.pull_request.html_url }}"'
 
     - name: Sync comment
       if: github.event.action == 'created' && steps.search.outputs.issue
-      uses: tomhjp/gh-action-jira-comment@v0.2.0
+      uses: tomhjp/gh-action-jira-comment@6eb6b9ead70221916b6badd118c24535ed220bd9 # v0.2.0
       with:
         issue: ${{ steps.search.outputs.issue }}
         comment: "${{ github.actor }} ${{ github.event.review.state || 'commented' }}:\n\n${{ github.event.comment.body || github.event.review.body }}\n\n${{ github.event.comment.html_url || github.event.review.html_url }}"
 
     - name: Close ticket
       if: (github.event.action == 'closed' || github.event.action == 'deleted') && steps.search.outputs.issue
-      uses: atlassian/gajira-transition@v2.0.2
+      uses: atlassian/gajira-transition@38fc9cd61b03d6a53dd35fcccda172fe04b36de3 # v3.0.1
       with:
         issue: ${{ steps.search.outputs.issue }}
         transition: Done
 
     - name: Reopen ticket
       if: github.event.action == 'reopened' && steps.search.outputs.issue
-      uses: atlassian/gajira-transition@v2.0.2
+      uses: atlassian/gajira-transition@38fc9cd61b03d6a53dd35fcccda172fe04b36de3 # v3.0.1
       with:
         issue: ${{ steps.search.outputs.issue }}
         transition: "To Do"

.github/workflows/make-gen-delta.yml

@@ -0,0 +1,43 @@
+name: "make-gen-delta"
+on:
+  - workflow_dispatch
+  - push
+  - pull_request
+  - workflow_call
+
+permissions:
+  contents: read
+
+jobs:
+  make-gen-delta:
+    name: "Check for uncommitted changes from make gen"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          fetch-depth: '0'
+      - name: Determine Go version
+        id: get-go-version
+        # We use .go-version as our source of truth for current Go
+        # version, because "goenv" can react to it automatically.
+        run: |
+          echo "Building with Go $(cat .go-version)"
+          echo "go-version=$(cat .go-version)" >> "$GITHUB_OUTPUT"
+      - name: Set up Go
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
+        with:
+          go-version: "${{ steps.get-go-version.outputs.go-version }}"
+      - name: Running go mod tidy
+        run: |
+          go mod tidy
+      - name: Install Dependencies
+        run: |
+          make tools
+      - name: Running make gen
+        run: |
+          make gen
+      - name: Check for changes
+        run: |
+          git diff --exit-code
+          git status --porcelain
+          test -z "$(git status --porcelain)"

.github/workflows/release.yml

@@ -0,0 +1,51 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v[0-9]+.[0-9]+.[0-9]+*'
+
+permissions:
+  contents: write
+
+jobs:
+  go-version:
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.go-version.outputs.version }}
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - id: go-version
+        run: echo "name=version::$(cat ./.go-version)" >> "$GITHUB_OUTPUT"
+  release-notes:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          fetch-depth: 0
+      - name: Generate Release Notes
+        run: sed -n -e "1{/# /d;}" -e "2{/^$/d;}" -e "/# $(git describe --abbrev=0 --exclude="$(git describe --abbrev=0 --match='v*.*.*' --tags)" --match='v*.*.*' --tags | tr -d v)/q;p" CHANGELOG.md > release-notes.txt
+      - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        with:
+          name: release-notes
+          path: release-notes.txt
+          retention-days: 1
+  terraform-provider-release:
+    name: 'Terraform Provider Release'
+    needs: [go-version, release-notes]
+    uses: hashicorp/ghaction-terraform-provider-release/.github/workflows/hashicorp.yml@v2
+    secrets:
+      hc-releases-github-token: '${{ secrets.HASHI_RELEASES_GITHUB_TOKEN }}'
+      hc-releases-host-staging: '${{ secrets.HC_RELEASES_HOST_STAGING }}'
+      hc-releases-host-prod: '${{ secrets.HC_RELEASES_HOST_PROD }}'
+      hc-releases-key-prod: '${{ secrets.HC_RELEASES_KEY_PROD }}'
+      hc-releases-key-staging: '${{ secrets.HC_RELEASES_KEY_STAGING }}'
+      hc-releases-terraform-registry-sync-token: '${{ secrets.TF_PROVIDER_RELEASE_TERRAFORM_REGISTRY_SYNC_TOKEN }}'
+      setup-signore-github-token: '${{ secrets.HASHI_SIGNORE_GITHUB_TOKEN }}'
+      signore-client-id: '${{ secrets.SIGNORE_CLIENT_ID }}'
+      signore-client-secret: '${{ secrets.SIGNORE_CLIENT_SECRET }}'
+    with:
+      release-notes: true
+      setup-go-version: '${{ needs.go-version.outputs.version }}'
+      # Product Version (e.g. v1.2.3 or github.ref_name)
+      product-version: '${{ github.ref_name }}'

.github/workflows/test.yml

@@ -0,0 +1,44 @@
+name: test
+
+on:
+  - push
+  - pull_request
+  - workflow_dispatch
+  - workflow_call
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - name: Determine go version
+        id: get-go-version
+        # We use .go-version as our source of truth for current Go
+        # version, because "goenv" can react to it automatically.
+        run: |
+          echo "Building with Go $(cat .go-version)"
+          echo "go-version=$(cat .go-version)" >> "$GITHUB_OUTPUT"
+      - name: Set up Go
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
+        with:
+          go-version: "${{ steps.get-go-version.outputs.go-version }}"
+      - name: Determine Go cache paths
+        id: go-cache-paths
+        run: |
+          echo "go-build=$(go env GOCACHE)" >> "$GITHUB_OUTPUT"
+          echo "go-mod=$(go env GOMODCACHE)" >> "$GITHUB_OUTPUT"
+      - name: Set up Go modules cache
+        uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+        with:
+          path: |
+            ${{ steps.go-cache-paths.outputs.go-build }}
+            ${{ steps.go-cache-paths.outputs.go-mod }}
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go
+      - name: Acceptance Tests
+        run: |
+          make testacc

.gitignore

@@ -33,3 +33,6 @@ website/vendor
 
 # Keep windows files with windows line endings
 *.winfile eol=crlf
+
+# Compilation outputs
+/plugins/kms/assets/*/*/boundary-plugin*

.go-version

@@ -1 +1 @@
-1.16.3
+1.21.3

.goreleaser.yml

@@ -0,0 +1,78 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+archives:
+  - files:
+      # Ensure only built binary is archived
+      - 'none*'
+    format: zip
+    name_template: '{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}'
+before:
+  hooks:
+    - 'go mod download'
+    - './scripts/plugins-all.sh'
+builds:
+  - # Binary naming only required for Terraform CLI 0.12
+    binary: '{{ .ProjectName }}_v{{ .Version }}_x5'
+    env:
+      - CGO_ENABLED=0
+    flags:
+      - -trimpath
+    goos:
+      - darwin
+      - freebsd
+      - linux
+      - windows
+    goarch:
+      - '386'
+      - amd64
+      - arm
+      - arm64
+    ignore:
+      - goarch: arm
+        goos: windows
+      - goarch: arm64
+        goos: freebsd
+      - goarch: arm64
+        goos: windows
+    ldflags:
+      - -s -w -X main.Version={{.Version}}
+    mod_timestamp: '{{ .CommitTimestamp }}'
+checksum:
+  algorithm: sha256
+  extra_files:
+    - glob: 'terraform-registry-manifest.json'
+      name_template: '{{ .ProjectName }}_{{ .Version }}_manifest.json'
+  name_template: '{{ .ProjectName }}_{{ .Version }}_SHA256SUMS'
+publishers:
+  - checksum: true
+    # Terraform CLI 0.10 - 0.11 perform discovery via HTTP headers on releases.hashicorp.com
+    # For providers which have existed since those CLI versions, exclude
+    # discovery by setting the protocol version headers to 5.
+    cmd: hc-releases upload -product {{ .ProjectName }} -version {{ .Version }} -file={{ .ArtifactPath }}={{ .ArtifactName }} -header=x-terraform-protocol-version=5 -header=x-terraform-protocol-versions=5.0
+    env:
+      - HC_RELEASES_HOST={{ .Env.HC_RELEASES_HOST }}
+      - HC_RELEASES_KEY={{ .Env.HC_RELEASES_KEY }}
+    extra_files:
+      - glob: 'terraform-registry-manifest.json'
+        name_template: '{{ .ProjectName }}_{{ .Version }}_manifest.json'
+    name: upload
+    signature: true
+release:
+  extra_files:
+    - glob: 'terraform-registry-manifest.json'
+      name_template: '{{ .ProjectName }}_{{ .Version }}_manifest.json'
+  ids:
+    - none
+signs:
+  - args: ["sign", "--dearmor", "--file", "${artifact}", "--out", "${signature}"]
+    artifacts: checksum
+    cmd: signore
+    signature: ${artifact}.sig
+  - args: ["sign", "--dearmor", "--file", "${artifact}", "--out", "${signature}"]
+    artifacts: checksum
+    cmd: signore
+    id: key-id
+    signature: ${artifact}.72D7468F.sig
+snapshot:
+  name_template: "{{ .Tag }}-next"

.release/release-metadata.hcl

@@ -0,0 +1,5 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+url_source_repository      = "https://github.com/hashicorp/terraform-provider-boundary"
+url_license                = "https://github.com/hashicorp/terraform-provider-boundary/blob/main/LICENSE"

.tfproto5

@@ -1 +0,0 @@
-Protocol 5.0 only

.vscode/launch.json

@@ -0,0 +1,22 @@
+{
+    // Use IntelliSense to learn about possible attributes.
+    // Hover to view descriptions of existing attributes.
+    // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
+    "version": "0.2.0",
+    "configurations": [
+        {
+            "name": "Launch a test function",
+            "type": "go",
+            "request": "launch",
+            "mode": "auto",
+            "program": "${fileDirname}",
+            "args": [
+                "-test.v",
+                "-test.run",
+                "^${selectedText}$"
+            ],
+            "showLog": true,
+            "envFile": "${workspaceFolder}/.vscode/private.env"
+        }
+    ]
+}

.vscode/private.env

@@ -0,0 +1,3 @@
+TF_ACC=1
+TF_LOG=INFO
+GOFLAGS='-mod=readonly'

CHANGELOG.md

@@ -1,9 +1,286 @@
+# Boundary Terraform Provider CHANGELOG
+
+Canonical reference for changes, improvements, and bugfixes for the Boundary Terraform provider.
+
+## Next
+
+### New and Improved
+
+## 1.1.11 (December 13, 2023)
+
+### New and Improved
+
+* Add support for OIDC prompts. Using prompts, the Relying Party (RP) can customize the authentication and authorization flow to suit their specific needs and improve the user experience. [OIDC Authentication request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest) server.
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/519))
+* Add boundary_auth_method data source
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/505))
+* Add boundary_group data source
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/503))
+* Add boundary_account data source
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/493))
+* Add boundary_user data source
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/468))
+
+### Bug Fix
+* Fix boundary_worker overwriting worker generated auth token during
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/461)) 
+
+## 1.1.10 (October 11, 2023)
+
+### New and Improved
+
+* Add support for Scope datasource
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/474))
+* LDAP: Add support for maximum_page_size and dereference_aliases
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/453))
+
+
+## 1.1.9 (July 19, 2023)
+
+### New and Improved
+
+* Add support for a storage bucket as a resource
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/417))
+* Add option to enable session recording on a target resource
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/421))
+* Update docs for host set plugin filters examples
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/420))  
+
+## 1.1.8 (June 13, 2023)
+
+### New and Improved
+
+* Add support for target default client port
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/379))
+* Add support for using ldap primary auth method
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/392))
+
+### Deprecations/Changes
+
+* Deprecate `password_auth_method_login_name` & `password_auth_method_password` for Terraform Provider.
+  `password_auth_method_login_name` & `password_auth_method_password` fields have been set to deprecated 
+  with a recommendation to use `auth_method_login_name` & `auth_method_password` fields instead.
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/392))
+* Deprecate type field for `boundary_account_password`
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/396))
+* Deprecate type field for `boundary_account_ldap`
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/400))
+
+## 1.1.7 (May 12, 2023)
+
+### Bug Fix
+* Fix default auth method with recovery kms
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/406))  
+
+## 1.1.6 (May 5, 2023)
+
+### New and Improved
+* Add support for using default auth method if no auth method ID is provided for provider
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/385))
+* Fix typo in Managed Group resource page
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/370))
+
+### Bug Fix
+* Force new resource on credential_type change
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/389))
+
+## 1.1.5 (April 21, 2023)
+
+### New and Improved
+* Add support for credential store vault worker filters ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/375))
+
+### Bug Fix
+* Allow users to set OIDC maxAge value to 0 to require immediate reauth ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/364))
+
+## 1.1.4 (February 15, 2023)
+
+### New and Improved
+
+* Add support for worker egress and ingress filters
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/319))
+* Add support for vault ssh certificate credential libraries
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/320))
+* Add support for targets with address configurations
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/308))
+
+## 1.1.3 (November 29, 2022)
+
+### New and Improved
+
+* Add support for a workers as a resource
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/293)).
+
+## 1.1.2 (October 18, 2022)
+
+### New and Improved
+
+* Add support for setting mapping overrides for vault credential libraries
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/287)).
+
+### Bug Fixes
+
+* Improve error message when authenticating to boundary
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/290)).
+* Set state before returning an error when creating a resource
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/289))
+
+## 1.1.1 (October 12, 2022)
+
+### Bug Fixes
+
+* The plugin cleanup function is being called before the entire Terraform workflow is complete.
+  ([Issue](https://github.com/hashicorp/terraform-provider-boundary/issues/282)),
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/285)).
+
+## 1.1.0 (October 4, 2022)
+
+### New and Improved
+
+* Add support for JSON credentials
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/271)).
+* Add support for setting the plugin execution directory from the config
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/280)).
+
+### Deprecations/Changes
+
+* Fix panic resulting from expired Vault credential store tokens
+  ([Issue](https://github.com/hashicorp/terraform-provider-boundary/issues/279),
+  [PR](https://github.com/hashicorp/terraform-provider-boundary/pull/277)).
+* Remove `application_credential_source_ids` of the `target` resource which was deprecated
+  in 1.0.12 ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/273)).
+* Remove `default_role` from the `role` resource, this schema was never supported and was
+  included mistakenly ([Issue](https://github.com/hashicorp/terraform-provider-boundary/issues/130),
+  [PR](https://github.com/hashicorp/terraform-provider-boundary/pull/269)).
+
+## 1.0.12 (September 13, 2022)
+
+### New and Improved
+
+* Add support for SSH targets
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/264)).
+
+### Deprecations/Changes
+
+* Deprecate `application_credential_source_ids` of the `target` resource
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/260)).
+
+## 1.0.11 (August 26, 2022)
+
+### New and Improved
+
+* Add support for SSH private key credentials
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/257)).
+* Add support for credential type in Vault libraries
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/257)).
+
+## 1.0.10 (August 10, 2022)
+
+### New and Improved
+
+* Adds support for static credential stores
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/236)).
+* Adds support for username password credentials 
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/242)).
+
+## 1.0.9 (June 6, 2022)
+
+### Bug Fixes
+
+* The bug fix released in 1.0.8 to resolve the `plugin is nil` error only worked for 
+  Linux AMD64. This was due to a build issue where the plugin binaries were only built for 
+  Linux AMD64. Other platforms would receive an error similar to:
+
+            Error: error reading wrappers from "recovery_kms_hcl":
+            Error configuring kms: error fetching kms plugin rpc client: 
+            fork/exec boundary-plugin-kms-awskms.gz: exec format error
+  ([Issue](https://github.com/hashicorp/terraform-provider-boundary/issues/209)),
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/216)).
+
+## 1.0.8 (June 1, 2022)
+
+### Bug Fixes
+
+* After moving to go-kms-wrapping V2, the Boundary Terraform Provider
+  did not load all KMS plugins resulting in an error when trying to
+  create a wrapper for any type other than 'aead':
+
+            Error: error reading wrappers from "recovery_kms_hcl":
+            Error configuring kms: plugin is nil
+  ([Issue](https://github.com/hashicorp/terraform-provider-boundary/issues/209)),
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/213)).
+
+## 1.0.7 (May 16, 2022)
+
+### Deprecations/Changes
+
+* Undoes an erroneous deprecation of the `login_name` and `password` fields in `resource_account_password` and `resource_account`. 
+  Deprecates `resource_account` that was replaced with `resource_account_password`
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/201)).
+
+## 1.0.6 (January 21, 2022)
+
+### New and Improved
+
+* Adds dynamic host plugin catalog/set
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/159)).
+* Adds support for insecure TLS to Boundary 
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/163)).
+
+ ### Deprecations/Changes
+
+* Removes fields `host_set_ids` and `application_credential_library_ids` of the 
+  `target` resource, which were deprecated in 1.0.5 
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/150)).
+
+## 1.0.5 (September 09, 2021)
+
+### Deprecations/Changes
+
+* Deprecate fields `host_set_ids` and `application_credential_library_ids` of the 
+  `target` resource. See boundary 0.5.0 [changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md#deprecationschanges) for more detail on the deprecation.
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/134)).
+
+## 1.0.4 (August 19, 2021)
+
+### New and Improved
+
+* Adds managed groups resource
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/118)).
+
+## 1.0.3 (June 30, 2021)
+
+### New and Improved
+
+* Adds credential library resource for Vault
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/114)).
+* Adds credential store resource for Vault
+  ([PR 1](https://github.com/hashicorp/terraform-provider-boundary/pull/114)),
+  ([PR 2](https://github.com/hashicorp/terraform-provider-boundary/pull/125)).
+* Adds claim scopes attribute to OIDC auth method
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/112)).
+* Adds account claim maps attribute to OIDC auth method
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/111)).
+
+### Bug Fixes
+
+* Make OIDC account attribute for subject ForceNew
+  ([Issue](https://github.com/hashicorp/terraform-provider-boundary/issues/119)),
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/122)).
+* Update static type attribute for host catalog resource
+  ([Issue](https://github.com/hashicorp/terraform-provider-boundary/issues/115)),
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/121)).
+
 ## 1.0.2 (May 06, 2021)
 
+### New and Improved
+
 * Adds OIDC account resource
-([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/105))
+([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/105)).
 * Adds OIDC auth method resource
-([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/105))
+([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/105)).
+
+### Deprecations/Changes
+
 * Deprecates fields on `resource_auth_method` that will be replaced in the future with generic `attributes` attribute.
 
 ## 1.0.1 (February 02, 2021)
@@ -11,7 +288,7 @@
 ### New and Improved
 
 * Adds worker filter to target resource
-  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/76))
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/76)).
 
 ## 1.0.0 (January 20, 2021)
 
@@ -20,15 +297,15 @@ We are bumping the version of the Boundary Terraform provider to v1.0.0 and will
 ### Bug Fixes
 
 * During `terraform apply`, do not update existing user account passwords when the password field is updated in the tf file.
-  ([Issue](https://github.com/hashicorp/terraform-provider-boundary/issues/71))
+  ([Issue](https://github.com/hashicorp/terraform-provider-boundary/issues/71)),
-  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/70))
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/70)).
 
 ## 0.1.4 (January 14, 2021)
 
 ### New and Improved
 
-Update provider to handle new domain errors ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/63))
+Update provider to handle new domain errors ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/63)).
 
 ## 0.1.0 (October 14, 2020)
 
-Initial release!
+Initial release!

CODEOWNERS

@@ -0,0 +1,4 @@
+# These owners will be the default owners for everything in
+# the repo, unless a later match takes precedence.
+
+@hashicorp/boundary

Dockerfile

@@ -1,4 +1,7 @@
-FROM golang:1.16
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+FROM golang:1.20
 
 WORKDIR /go/src/terraform-provider-boundary
 COPY . .

LICENSE

@@ -1,3 +1,5 @@
+Copyright (c) 2020 HashiCorp, Inc.
+
 Mozilla Public License Version 2.0
 ==================================
 

Makefile

@@ -1,4 +1,4 @@
-default: testacc 
+default: testacc
 GOOS=$(shell go env GOOS)
 GOARCH=$(shell go env GOARCH)
 INSTALL_PATH=~/.local/share/terraform/plugins/localhost/providers/boundary/0.0.1/linux_$(GOARCH)
@@ -11,11 +11,19 @@ ifeq ($(GOOS), "windows")
 	INSTALL_PATH=%APPDATA%/HashiCorp/Terraform/plugins/localhost/providers/boundary/0.0.1/windows_$(GOARCH)
 endif
 
+REGISTRY_NAME?=docker.io/hashicorpboundary
+IMAGE_NAME=postgres
+IMAGE_TAG ?= $(REGISTRY_NAME)/$(IMAGE_NAME):11-alpine
+DOCKER_ARGS ?= -d
+PG_OPTS ?=
+TEST_DB_PORT ?= 5432
+BOUNDARY_VERSION = $(shell go mod edit -json | jq -r '.["Require"][] | select(.Path=="github.com/hashicorp/boundary") | .["Version"]')
+GOPATH ?= $(abspath ~/go)
+GOMODCACHE ?= $(GOPATH)/pkg/mod
+
 tools:
 	go generate -tags tools tools/tools.go
-
+	go install github.com/hashicorp/copywrite@v0.15.0
-fmtcheck:
-	echo "Placeholder"
 
 test:
 	echo "Placeholder"
@@ -24,15 +32,13 @@ test:
 testacc:
 	TF_ACC=1 go test ./... -v $(TESTARGS) -timeout 120m
 
-testacc-ci: install-go
-	git config --global --add url."git@github.com:".insteadOf "https://github.com/"
-	TF_ACC=1 ~/.go/bin/go test ./... -v $(TESTARGS) -timeout 120m
-
-install-go:
-	./ci/goinstall.sh
-
 dev:
-	mkdir -p $(INSTALL_PATH)	
+	GOOS=${GOOS} GOARCH=${GOARCH} ./scripts/plugins.sh
+	mkdir -p $(INSTALL_PATH)
+	go build -o $(INSTALL_PATH)/terraform-provider-boundary main.go
+
+dev-no-plugins:
+	mkdir -p $(INSTALL_PATH)
 	go build -o $(INSTALL_PATH)/terraform-provider-boundary main.go
 
 all:
@@ -41,7 +47,46 @@ all:
 	GOOS=windows go build -o $(BUILD_ALL_PATH)/terraform-provider-boundary_windows-amd64 main.go
 	GOOS=linux go build -o $(BUILD_ALL_PATH)/terraform-provider-boundary_linux-amd64 main.go
 
+docs:
+	go run github.com/hashicorp/terraform-plugin-docs/cmd/tfplugindocs
+
 rm-id-flag-from-docs:
 	find docs/ -name "*.md" -type f | xargs sed -i -e '/- \*\*id\*\*/d'
 
-.PHONY: testacc tools
+test-database-up:
+	@echo "Using image:                       $(IMAGE_TAG)"
+	@echo "Additional postgres configuration: $(PG_OPTS)"
+	@echo "Using volume:                      $(GOMODCACHE)/github.com/hashicorp/boundary@$(BOUNDARY_VERSION)/internal/db/schema/migrations:/migrations"
+	@docker run \
+		$(DOCKER_ARGS) \
+		--name boundary-sql-tests \
+		-p $(TEST_DB_PORT):5432 \
+		-e POSTGRES_PASSWORD=boundary \
+		-e POSTGRES_USER=boundary \
+		-e POSTGRES_DB=boundary \
+		-e PGDATA=/pgdata \
+		--mount type=tmpfs,destination=/pgdata \
+		-v "$(GOMODCACHE)/github.com/hashicorp/boundary@$(BOUNDARY_VERSION)/internal/db/schema/migrations":/migrations \
+		$(IMAGE_TAG) \
+		-c 'config_file=/etc/postgresql/postgresql.conf' \
+		$(PG_OPTS) 1> /dev/null
+	@echo "Test database available at:        127.0.0.1:$(TEST_DB_PORT)"
+	@echo "For database logs run:"
+	@echo "    docker logs boundary-sql-tests"
+
+test-database-down:
+	docker stop boundary-sql-tests || true
+	docker rm -v boundary-sql-tests || true
+
+.PHONY: testacc tools docs test-database-up test-database-down
+
+.PHONY: copywrite
+copywrite:
+	copywrite headers
+
+.PHONY: fmt
+fmt:
+	gofumpt -w $$(find . -name '*.go')
+
+.PHONY: gen
+gen: docs copywrite fmt

README.md

@@ -1,18 +1,15 @@
 ![](boundary.png)
 
-Terraform Provider Boundary
+# Terraform Provider Boundary
-==================
 
 Available in the [Terraform Registry](https://registry.terraform.io/providers/hashicorp/boundary/latest).
 
-Requirements
+## Requirements
-------------
 
--	[Terraform](https://www.terraform.io/downloads.html) >= 0.12.x
+-	[Terraform](https://www.terraform.io/downloads.html) >= 0.13.x
--	[Go](https://golang.org/doc/install) >= 1.16
+-	[Go](https://golang.org/doc/install) >= 1.21
 
-Building The Provider
+## Building The Provider
----------------------
 
 1. Clone the repository
 1. Enter the repository directory
@@ -22,38 +19,44 @@ You'll need to ensure that your Terraform file contains the information necessar
 
 ```hcl
 terraform {
-        required_providers {
+  required_providers {
-                boundary = {
+    boundary = {
-                        source = "localhost/providers/boundary"
+      source = "localhost/providers/boundary"
-                        version = "0.0.1"
+      version = "0.0.1"
-                }
+    }
-        }
+  }
 }
 ```
 
-Adding Dependencies
+## Adding Dependencies
----------------------
 
 This provider uses [Go modules](https://github.com/golang/go/wiki/Modules).
 Please see the Go documentation for the most up to date information about using Go modules.
 
 To add a new dependency `github.com/author/dependency` to your Terraform provider:
 
-```
+```shell
 go get github.com/author/dependency
 go mod tidy
 ```
 
 Then commit the changes to `go.mod` and `go.sum`.
 
-Developing the Provider
+## Developing the Provider
----------------------------
 
 If you wish to work on the provider, you'll first need [Go](http://www.golang.org) installed on your machine (see [Requirements](#requirements) above).
 
 To compile the provider, run `go install`. This will build the provider and put the provider binary in the `$GOPATH/bin` directory.
 
-In order to run the full suite of Acceptance tests, run `make testacc`.
+In order to run the full suite of Acceptance tests,
+a postgres docker container must be started first:
+
+```sh
+$ go mod download # ensure boundary is installed, files are used by the docker image
+$ make test-database-up
+```
+
+Once the test database is ready the tests can be run using `make testacc`.
 
 *Note:* Acceptance tests create real resources, and often cost money to run.
 
@@ -61,17 +64,35 @@ In order to run the full suite of Acceptance tests, run `make testacc`.
 $ make testacc
 ```
 
-Generating Docs
+For more details on the docker image and troubleshooting see the
-----------------------
+[boundary testing doc](https://github.com/hashicorp/boundary/blob/main/CONTRIBUTING.md#testing).
+
+## Debugging the provider
+
+If you're using vscode, this provider has delve debugging baked into the [.vscode](https://github.com/hashicorp/terraform-provider-boundary/tree/main/.vscode) directory. To debug you can find instructions [here.](https://dev.to/drewmullen/vscode-terraform-provider-development-setup-debugging-6bn#usage)
+
+## Generating Docs
+
+This provider uses the [terraform-plugin-docs](https://github.com/hashicorp/terraform-plugin-docs/) tool to generate documentation. Each resource and data source requires a set of examples [examples](https://github.com/hashicorp/terraform-provider-boundary/tree/main/examples) then you execute a binary to generate the docs which are placed in [./docs](https://github.com/hashicorp/terraform-provider-boundary/tree/main/docs). Optionally, you can specify your own [templates](https://github.com/hashicorp/terraform-provider-boundary/tree/main/templates) for a resource or data source if you want to add custom information (example: [data "boundary_scope"](https://github.com/hashicorp/terraform-provider-boundary/blob/main/templates/data-sources/scope.md.tmpl#L11))
+
+### New Resources & Data Sources (documentation templates)
+
+If you're adding a new resource or a data source, you must include a documentation template for your new R/DS in [./templates](https://github.com/hashicorp/terraform-provider-boundary/tree/main/templates) directory. This provider uses the [terraform-plugin-docs](https://github.com/hashicorp/terraform-plugin-docs/) tool to generate documentation. For full details see the link.
+
+### Documentation Examples for Resources & Data Sources
+
+Examples are required for all resources and data sources. This provider uses the [terraform-plugin-docs](https://github.com/hashicorp/terraform-plugin-docs/) tool to generate documentation. To add examples, add a new file to the [./examples](https://github.com/hashicorp/terraform-provider-boundary/tree/main/examples) directory or update the existing files. Next make sure the corresponding template in [./templates](https://github.com/hashicorp/terraform-provider-boundary/tree/main/templates) directory references this example.
+
+### Generating
 
 From the root of the repo run:
 
-```
+```shell
 go run github.com/hashicorp/terraform-plugin-docs/cmd/tfplugindocs
 ```
 
-Using the provider
+## Using the provider
-----------------------
+
 Please see our detailed docs for individual resource usage. Below is a complex example using the Boundary provider to configure all resource types available:
 
 ```hcl
@@ -129,7 +150,7 @@ resource "boundary_user" "users" {
   scope_id    = boundary_scope.corp.id
 }
 
-// organiation level group for readonly users 
+// organization level group for readonly users
 resource "boundary_group" "readonly" {
   name        = "readonly"
   description = "Organization group for readonly users"

ci/goinstall.sh

@@ -1,118 +0,0 @@
-#!/bin/bash
-set -e
-
-VERSION="1.16"
-
-[ -z "$GOROOT" ] && GOROOT="$HOME/.go"
-[ -z "$GOPATH" ] && GOPATH="$HOME/go"
-
-OS="$(uname -s)"
-ARCH="$(uname -m)"
-
-case $OS in
-    "Linux")
-        case $ARCH in
-        "x86_64")
-            ARCH=amd64
-            ;;
-        "aarch64")
-            ARCH=arm64
-            ;;
-        "armv6")
-            ARCH=armv6l
-            ;;
-        "armv8")
-            ARCH=arm64
-            ;;
-        .*386.*)
-            ARCH=386
-            ;;
-        esac
-        PLATFORM="linux-$ARCH"
-    ;;
-    "Darwin")
-        PLATFORM="darwin-amd64"
-    ;;
-esac
-
-print_help() {
-    echo "Usage: bash goinstall.sh OPTIONS"
-    echo -e "\nOPTIONS:"
-    echo -e "  --remove\tRemove currently installed version"
-    echo -e "  --version\tSpecify a version number to install"
-}
-
-if [ -n "`$SHELL -c 'echo $ZSH_VERSION'`" ]; then
-    shell_profile="zshrc"
-elif [ -n "`$SHELL -c 'echo $BASH_VERSION'`" ]; then
-    shell_profile="bashrc"
-fi
-
-if [ "$1" == "--remove" ]; then
-    rm -rf "$GOROOT"
-    if [ "$OS" == "Darwin" ]; then
-        sed -i "" '/# GoLang/d' "$HOME/.${shell_profile}"
-        sed -i "" '/export GOROOT/d' "$HOME/.${shell_profile}"
-        sed -i "" '/$GOROOT\/bin/d' "$HOME/.${shell_profile}"
-        sed -i "" '/export GOPATH/d' "$HOME/.${shell_profile}"
-        sed -i "" '/$GOPATH\/bin/d' "$HOME/.${shell_profile}"
-    else
-        sed -i '/# GoLang/d' "$HOME/.${shell_profile}"
-        sed -i '/export GOROOT/d' "$HOME/.${shell_profile}"
-        sed -i '/$GOROOT\/bin/d' "$HOME/.${shell_profile}"
-        sed -i '/export GOPATH/d' "$HOME/.${shell_profile}"
-        sed -i '/$GOPATH\/bin/d' "$HOME/.${shell_profile}"
-    fi
-    echo "Go removed."
-    exit 0
-elif [ "$1" == "--help" ]; then
-    print_help
-    exit 0
-elif [ "$1" == "--version" ]; then
-    if [ -z "$2" ]; then # Check if --version has a second positional parameter
-        echo "Please provide a version number for: $1"
-    else
-        VERSION=$2
-    fi
-elif [ ! -z "$1" ]; then
-    echo "Unrecognized option: $1"
-    exit 1
-fi
-
-if [ -d "$GOROOT" ]; then
-    echo "The Go install directory ($GOROOT) already exists. Exiting."
-    exit 1
-fi
-
-PACKAGE_NAME="go$VERSION.$PLATFORM.tar.gz"
-TEMP_DIRECTORY=$(mktemp -d)
-
-echo "Downloading $PACKAGE_NAME ..."
-if hash wget 2>/dev/null; then
-    wget https://storage.googleapis.com/golang/$PACKAGE_NAME -O "$TEMP_DIRECTORY/go.tar.gz"
-else
-    curl -o "$TEMP_DIRECTORY/go.tar.gz" https://storage.googleapis.com/golang/$PACKAGE_NAME
-fi
-
-if [ $? -ne 0 ]; then
-    echo "Download failed! Exiting."
-    exit 1
-fi
-
-echo "Extracting File..."
-mkdir -p "$GOROOT"
-tar -C "$GOROOT" --strip-components=1 -xzf "$TEMP_DIRECTORY/go.tar.gz"
-touch "$HOME/.${shell_profile}"
-{
-    echo '# GoLang'
-    echo "export GOROOT=${GOROOT}"
-    echo 'export PATH=$GOROOT/bin:$PATH'
-    echo "export GOPATH=$GOPATH"
-    echo 'export PATH=$GOPATH/bin:$PATH'
-} >> "$HOME/.${shell_profile}"
-
-mkdir -p $GOPATH/{src,pkg,bin}
-echo -e "\nGo $VERSION was installed into $GOROOT.\nMake sure to relogin into your shell or run:"
-echo -e "\n\tsource $HOME/.${shell_profile}\n\nto update your environment variables."
-echo "Tip: Opening a new terminal window usually just works. :)"
-rm -f "$TEMP_DIRECTORY/go.tar.gz"

docs/data-sources/account.md

@@ -0,0 +1,47 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_account Data Source - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The boundary_account data source allows you to find a Boundary account.
+---
+
+# boundary_account (Data Source)
+
+The boundary_account data source allows you to find a Boundary account.
+
+## Example Usage
+
+```terraform
+# Retrieve the ID of a Boundary account
+data "boundary_account" "admin" {
+  name           = "admin"
+  auth_method_id = "ampw_1234567890"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `auth_method_id` (String) The auth method ID that will be queried for the account.
+- `name` (String) The name of the account to retrieve.
+
+### Read-Only
+
+- `description` (String) The description of the retrieved account.
+- `id` (String) The ID of the retrieved account.
+- `scope` (List of Object) (see [below for nested schema](#nestedatt--scope))
+- `type` (String) The type of the account
+
+<a id="nestedatt--scope"></a>
+### Nested Schema for `scope`
+
+Read-Only:
+
+- `description` (String)
+- `id` (String)
+- `name` (String)
+- `parent_scope_id` (String)
+- `type` (String)

docs/data-sources/auth_method.md

@@ -0,0 +1,60 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_auth_method Data Source - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The boundaryauthmethod data source allows you to find a Boundary auth method.
+---
+
+# boundary_auth_method (Data Source)
+
+The boundary_auth_method data source allows you to find a Boundary auth method.
+
+## Example Usage
+
+```terraform
+# Retrieve an auth method from the global scope
+data "boundary_auth_method" "auth_method" {
+  name = "password_auth_method"
+}
+
+# Auth method from a org scope
+data "boundary_scope" "org" {
+  name     = "my-org"
+  scope_id = "global"
+}
+
+data "boundary_auth_method" "auth_method" {
+  name     = "password_auth_method"
+  scope_id = data.boundary_scope.org.id
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `name` (String) The name of the auth method to retrieve.
+
+### Optional
+
+- `scope_id` (String) The scope ID in which the resource is created. Defaults `global` if unset.
+
+### Read-Only
+
+- `description` (String) The description of the retrieved auth method.
+- `id` (String) The ID of the retrieved auth method.
+- `scope` (List of Object) (see [below for nested schema](#nestedatt--scope))
+- `type` (String) The type of the auth method
+
+<a id="nestedatt--scope"></a>
+### Nested Schema for `scope`
+
+Read-Only:
+
+- `description` (String)
+- `id` (String)
+- `name` (String)
+- `parent_scope_id` (String)
+- `type` (String)

docs/data-sources/group.md

@@ -0,0 +1,60 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_group Data Source - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The boundary_group data source allows you to find a Boundary group.
+---
+
+# boundary_group (Data Source)
+
+The boundary_group data source allows you to find a Boundary group.
+
+## Example Usage
+
+```terraform
+# Retrieve a user from the global scope
+data "boundary_group" "global_group" {
+  name = "admin"
+}
+
+# User from an org scope
+data "boundary_scope" "org" {
+  name     = "org"
+  scope_id = "global"
+}
+
+data "boundary_group" "org_group" {
+  name     = "username"
+  scope_id = data.boundary_scope.org.id
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `name` (String) The name of the group to retrieve.
+
+### Optional
+
+- `scope_id` (String) The scope ID in which the resource is created. Defaults `global` if unset.
+
+### Read-Only
+
+- `description` (String) The description of the retrieved group.
+- `id` (String) The ID of the retrieved group.
+- `member_ids` (Set of String) Resource IDs for group members, these are most likely boundary users.
+- `scope` (List of Object) (see [below for nested schema](#nestedatt--scope))
+
+<a id="nestedatt--scope"></a>
+### Nested Schema for `scope`
+
+Read-Only:
+
+- `description` (String)
+- `id` (String)
+- `name` (String)
+- `parent_scope_id` (String)
+- `type` (String)

docs/data-sources/scope.md

@@ -0,0 +1,39 @@
+---
+page_title: "boundary_scope Data Source - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The scope data source allows you to discover an existing Boundary scope by name.
+---
+
+# boundary_scope (Data Source)
+
+The scope data source allows you to discover an existing Boundary scope by name.
+Please note that the Global scope will always have an id of "global", and does not need to be discovered with this data source.
+
+## Example Usage
+
+```terraform
+# Retrieve the ID of a Boundary project
+data "boundary_scope" "org" {
+  name     = "SecOps"
+  scope_id = "global"
+}
+
+data "boundary_scope" "project" {
+  name     = "2111"
+  scope_id = data.boundary_scope.id
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `name` (String) The name of the scope to retrieve.
+- `scope_id` (String) The parent scope ID that will be queried for the scope.
+
+### Read-Only
+
+- `description` (String) The description of the retrieved scope.
+- `id` (String) The ID of the retrieved scope.

docs/data-sources/user.md

@@ -0,0 +1,63 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_user Data Source - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The user data source allows you to find a Boundary user.
+---
+
+# boundary_user (Data Source)
+
+The user data source allows you to find a Boundary user.
+
+## Example Usage
+
+```terraform
+# Retrieve a user from the global scope
+data "boundary_user" "global_scope_admin" {
+  name = "admin"
+}
+
+# User from a org scope
+data "boundary_user" "org_user" {
+  name     = "username"
+  scope_id = data.boundary_scope.org.id
+}
+
+data "boundary_scope" "org" {
+  name     = "my-org"
+  scope_id = data.boundary_scope.org.id
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `name` (String) The username to search for.
+
+### Optional
+
+- `scope_id` (String) The scope ID in which the resource is created. Defaults `global` if unset.
+
+### Read-Only
+
+- `account_ids` (Set of String) Account ID's to associate with this user resource.
+- `authorized_actions` (List of String) A list of actions that the worker is entitled to perform.
+- `description` (String) The user description.
+- `id` (String) The ID of the user.
+- `login_name` (String) Login name for user.
+- `primary_account_id` (String) Primary account ID.
+- `scope` (List of Object) (see [below for nested schema](#nestedatt--scope))
+
+<a id="nestedatt--scope"></a>
+### Nested Schema for `scope`
+
+Read-Only:
+
+- `description` (String)
+- `id` (String)
+- `name` (String)
+- `parent_scope_id` (String)
+- `type` (String)

docs/index.md

@@ -20,6 +20,19 @@ provider "boundary" {
   password_auth_method_login_name = "myuser"          # changeme
   password_auth_method_password   = "passpass"        # changeme
 }
+
+provider "boundary" {
+  addr                            = "http://127.0.0.1:9200"
+  password_auth_method_login_name = "myuser"
+  password_auth_method_password   = "passpass"
+}
+
+provider "boundary" {
+  addr                            = "http://127.0.0.1:9200"
+  password_auth_method_login_name = "myuser"
+  password_auth_method_password   = "passpass"
+  scope_id                        = "s_1234567890"
+}
 ```
 
 <!-- schema generated by tfplugindocs -->
@@ -27,12 +40,17 @@ provider "boundary" {
 
 ### Required
 
-- **addr** (String) The base url of the Boundary API, e.g. "http://127.0.0.1:9200". If not set, it will be read from the "BOUNDARY_ADDR" env var.
+- `addr` (String) The base url of the Boundary API, e.g. "http://127.0.0.1:9200". If not set, it will be read from the "BOUNDARY_ADDR" env var.
 
 ### Optional
 
-- **auth_method_id** (String) The auth method ID e.g. ampw_1234567890
+- `auth_method_id` (String) The auth method ID e.g. ampw_1234567890. If not set, the default auth method for the given scope ID will be used.
-- **password_auth_method_login_name** (String) The auth method login name for password-style auth methods
+- `auth_method_login_name` (String) The auth method login name for password-style or ldap-style auth methods
-- **password_auth_method_password** (String) The auth method password for password-style auth methods
+- `auth_method_password` (String) The auth method password for password-style or ldap-style auth methods
-- **recovery_kms_hcl** (String) Can be a heredoc string or a path on disk. If set, the string/file will be parsed as HCL and used with the recovery KMS mechanism. While this is set, it will override any other authentication information; the KMS mechanism will always be used. See Boundary's KMS docs for examples: https://boundaryproject.io/docs/configuration/kms
+- `password_auth_method_login_name` (String, Deprecated) The auth method login name for password-style auth methods
-- **token** (String) The Boundary token to use, as a string or path on disk containing just the string. If set, the token read here will be used in place of authenticating with the auth method specified in "auth_method_id", although the recovery KMS mechanism will still override this. Can also be set with the BOUNDARY_TOKEN environment variable.
+- `password_auth_method_password` (String, Deprecated) The auth method password for password-style auth methods
+- `plugin_execution_dir` (String) Specifies a directory that the Boundary provider can use to write and execute its built-in plugins.
+- `recovery_kms_hcl` (String) Can be a heredoc string or a path on disk. If set, the string/file will be parsed as HCL and used with the recovery KMS mechanism. While this is set, it will override any other authentication information; the KMS mechanism will always be used. See Boundary's KMS docs for examples: https://boundaryproject.io/docs/configuration/kms
+- `scope_id` (String) The scope ID for the default auth method.
+- `tls_insecure` (Boolean) When set to true, does not validate the Boundary API endpoint certificate
+- `token` (String) The Boundary token to use, as a string or path on disk containing just the string. If set, the token read here will be used in place of authenticating with the auth method specified in "auth_method_id", although the recovery KMS mechanism will still override this. Can also be set with the BOUNDARY_TOKEN environment variable.

docs/resources/account.md

@@ -3,60 +3,30 @@
 page_title: "boundary_account Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The account resource allows you to configure a Boundary account.
+  Deprecated: use boundary_account_password instead.
 ---
 
 # boundary_account (Resource)
 
-The account resource allows you to configure a Boundary account.
+Deprecated: use `boundary_account_password` instead.
 
-## Example Usage
 
-```terraform
-resource "boundary_scope" "org" {
-  name                     = "organization_one"
-  description              = "My first scope!"
-  scope_id                 = "global"
-  auto_create_admin_role   = true
-  auto_create_default_role = true
-}
-
-resource "boundary_auth_method" "password" {
-  scope_id = boundary_scope.org.id
-  type     = "password"
-}
-
-resource "boundary_account" "jeff" {
-  auth_method_id = boundary_auth_method.password.id
-  type           = "password"
-  login_name     = "jeff"
-  password       = "$uper$ecure"
-}
-```
 
 <!-- schema generated by tfplugindocs -->
 ## Schema
 
 ### Required
 
-- **auth_method_id** (String) The resource ID for the auth method.
+- `auth_method_id` (String) The resource ID for the auth method.
-- **type** (String) The resource type.
+- `type` (String) The resource type.
 
 ### Optional
 
-- **description** (String) The account description.
+- `description` (String) The account description.
-- **login_name** (String, Deprecated) The login name for this account.
+- `login_name` (String) The login name for this account.
-- **name** (String) The account name. Defaults to the resource name.
+- `name` (String) The account name. Defaults to the resource name.
-- **password** (String, Deprecated) The account password. Only set on create, changes will not be reflected when updating account.
+- `password` (String, Sensitive) The account password. Only set on create, changes will not be reflected when updating account.
 
 ### Read-Only
 
-- **id** (String) The ID of the account.
+- `id` (String) The ID of the account.
-
-## Import
-
-Import is supported using the following syntax:
-
-```shell
-terraform import boundary_account.foo <my-id>
-```

docs/resources/account_ldap.md

@@ -0,0 +1,76 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_account_ldap Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The account resource allows you to configure a Boundary account.
+---
+
+# boundary_account_ldap (Resource)
+
+The account resource allows you to configure a Boundary account.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_auth_method_ldap" "forumsys_ldap" {
+  name          = "forumsys public LDAP"
+  scope_id      = "global"                               # add the new auth method to the global scope
+  urls          = ["ldap://ldap.forumsys.com"]           # the addr of the LDAP server
+  user_dn       = "dc=example,dc=com"                    # the basedn for users
+  user_attr     = "uid"                                  # the user attribute
+  group_dn      = "dc=example,dc=com"                    # the basedn for groups
+  bind_dn       = "cn=read-only-admin,dc=example,dc=com" # the dn to use when binding
+  bind_password = "password"                             # passwd to use when binding
+  state         = "active-public"                        # make sure the new auth-method is available to everyone
+  enable_groups = true                                   # this turns-on the discovery of a user's groups
+  discover_dn   = true                                   # this turns-on the discovery of an authenticating user's dn
+}
+
+resource "boundary_account_ldap" "einstein" {
+  auth_method_id = boundary_auth_method_ldap.forumsys_ldap.id
+  login_name     = "einstein"
+  name           = "einstein"
+}
+
+resource "boundary_user" "einstein" {
+  name        = "einstein"
+  description = "User resource for einstein"
+  scope_id    = "global"
+  account_ids = [boundary_account_ldap.einstein.id]
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `auth_method_id` (String) The resource ID for the auth method.
+
+### Optional
+
+- `description` (String) The account description.
+- `login_name` (String) The login name for this account.
+- `name` (String) The account name. Defaults to the resource name.
+- `type` (String, Deprecated) The resource type.
+
+### Read-Only
+
+- `id` (String) The ID of the account.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_account_ldap.foo <my-id>
+```

docs/resources/account_oidc.md

@@ -17,17 +17,15 @@ The account resource allows you to configure a Boundary account.
 
 ### Required
 
-- **auth_method_id** (String) The resource ID for the auth method.
+- `auth_method_id` (String) The resource ID for the auth method.
 
 ### Optional
 
-- **description** (String) The account description.
+- `description` (String) The account description.
-- **issuer** (String) The OIDC issuer.
+- `issuer` (String) The OIDC issuer.
-- **name** (String) The account name. Defaults to the resource name.
+- `name` (String) The account name. Defaults to the resource name.
-- **subject** (String) The OIDC subject.
+- `subject` (String) The OIDC subject.
 
 ### Read-Only
 
-- **id** (String) The ID of the account.
+- `id` (String) The ID of the account.
-
-

docs/resources/account_password.md

@@ -10,25 +10,52 @@ description: |-
 
 The account resource allows you to configure a Boundary account.
 
+## Example Usage
 
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_auth_method" "password" {
+  scope_id = boundary_scope.org.id
+  type     = "password"
+}
+
+resource "boundary_account_password" "jeff" {
+  auth_method_id = boundary_auth_method.password.id
+  login_name     = "jeff"
+  password       = "$uper$ecure"
+}
+```
 
 <!-- schema generated by tfplugindocs -->
 ## Schema
 
 ### Required
 
-- **auth_method_id** (String) The resource ID for the auth method.
+- `auth_method_id` (String) The resource ID for the auth method.
-- **type** (String) The resource type.
 
 ### Optional
 
-- **description** (String) The account description.
+- `description` (String) The account description.
-- **login_name** (String, Deprecated) The login name for this account.
+- `login_name` (String) The login name for this account.
-- **name** (String) The account name. Defaults to the resource name.
+- `name` (String) The account name. Defaults to the resource name.
-- **password** (String, Deprecated) The account password. Only set on create, changes will not be reflected when updating account.
+- `password` (String, Sensitive) The account password. Only set on create, changes will not be reflected when updating account.
+- `type` (String, Deprecated) The resource type.
 
 ### Read-Only
 
-- **id** (String) The ID of the account.
+- `id` (String) The ID of the account.
 
+## Import
 
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_account_password.foo <my-id>
+```

docs/resources/auth_method.md

@@ -32,19 +32,19 @@ resource "boundary_auth_method" "password" {
 
 ### Required
 
-- **scope_id** (String) The scope ID.
+- `scope_id` (String) The scope ID.
-- **type** (String) The resource type.
+- `type` (String) The resource type.
 
 ### Optional
 
-- **description** (String) The auth method description.
+- `description` (String) The auth method description.
-- **min_login_name_length** (Number, Deprecated) The minimum login name length.
+- `min_login_name_length` (Number, Deprecated) The minimum login name length.
-- **min_password_length** (Number, Deprecated) The minimum password length.
+- `min_password_length` (Number, Deprecated) The minimum password length.
-- **name** (String) The auth method name. Defaults to the resource name.
+- `name` (String) The auth method name. Defaults to the resource name.
 
 ### Read-Only
 
-- **id** (String) The ID of the account.
+- `id` (String) The ID of the account.
 
 ## Import
 

docs/resources/auth_method_ldap.md

@@ -0,0 +1,88 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_auth_method_ldap Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The LDAP auth method resource allows you to configure a Boundary authmethodldap.
+---
+
+# boundary_auth_method_ldap (Resource)
+
+The LDAP auth method resource allows you to configure a Boundary auth_method_ldap.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_auth_method_ldap" "forumsys_ldap" {
+  name          = "forumsys public LDAP"
+  scope_id      = "global"                               # add the new auth method to the global scope
+  urls          = ["ldap://ldap.forumsys.com"]           # the addr of the LDAP server
+  user_dn       = "dc=example,dc=com"                    # the basedn for users
+  user_attr     = "uid"                                  # the user attribute
+  group_dn      = "dc=example,dc=com"                    # the basedn for groups
+  bind_dn       = "cn=read-only-admin,dc=example,dc=com" # the dn to use when binding
+  bind_password = "password"                             # passwd to use when binding
+  state         = "active-public"                        # make sure the new auth-method is available to everyone
+  enable_groups = true                                   # this turns-on the discovery of a user's groups
+  discover_dn   = true                                   # this turns-on the discovery of an authenticating user's dn
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `scope_id` (String) The scope ID.
+
+### Optional
+
+- `account_attribute_maps` (List of String) Account attribute maps fullname and email.
+- `anon_group_search` (Boolean) Use anon bind when performing LDAP group searches (optional).
+- `bind_dn` (String) The distinguished name of entry to bind when performing user and group searches (optional).
+- `bind_password` (String) The password to use along with bind-dn performing user and group searches (optional).
+- `bind_password_hmac` (String) The HMAC of the bind password returned by the Boundary controller, which is used for comparison after initial setting of the value.
+- `certificates` (List of String) PEM-encoded X.509 CA certificate in ASN.1 DER form that can be used as a trust anchor when connecting to an LDAP server(optional).  This may be specified multiple times
+- `client_certificate` (String) PEM-encoded X.509 client certificate in ASN.1 DER form that can be used to authenticate against an LDAP server(optional).
+- `client_certificate_key` (String) PEM-encoded X.509 client certificate key in PKCS #8, ASN.1 DER form used with the client certificate (optional).
+- `client_certificate_key_hmac` (String) The HMAC of the client certificate key returned by the Boundary controller, which is used for comparison after initial setting of the value.
+- `dereference_aliases` (String) Control how aliases are dereferenced when performing the search. Can be one of: NeverDerefAliases, DerefInSearching, DerefFindingBaseObj, and DerefAlways (optional).
+- `description` (String) The auth method description.
+- `discover_dn` (Boolean) Use anon bind to discover the bind DN of a user (optional).
+- `enable_groups` (Boolean) Find the authenticated user's groups during authentication (optional).
+- `group_attr` (String) The attribute that enumerates a user's group membership from entries returned by a group search (optional).
+- `group_dn` (String) The base DN under which to perform group search.
+- `group_filter` (String) A go template used to construct a LDAP group search filter (optional).
+- `insecure_tls` (Boolean) Skip the LDAP server SSL certificate validation (optional) - insecure and use with caution.
+- `is_primary_for_scope` (Boolean) When true, makes this auth method the primary auth method for the scope in which it resides. The primary auth method for a scope means the the user will be automatically created when they login using an LDAP account.
+- `maximum_page_size` (Number) MaximumPageSize specifies a maximum search result size to use when retrieving the authenticated user's groups (optional).
+- `name` (String) The auth method name. Defaults to the resource name.
+- `start_tls` (Boolean) Issue StartTLS command after connecting (optional).
+- `state` (String) Can be one of 'inactive', 'active-private', or 'active-public'. Defaults to active-public.
+- `type` (String) The type of auth method; hardcoded.
+- `upn_domain` (String) The userPrincipalDomain used to construct the UPN string for the authenticating user (optional).
+- `urls` (List of String) The LDAP URLs that specify LDAP servers to connect to (required).  May be specified multiple times.
+- `use_token_groups` (Boolean) Use the Active Directory tokenGroups constructed attribute of the user to find the group memberships (optional).
+- `user_attr` (String) The attribute on user entry matching the username passed when authenticating (optional).
+- `user_dn` (String) The base DN under which to perform user search (optional).
+- `user_filter` (String) A go template used to construct a LDAP user search filter (optional).
+
+### Read-Only
+
+- `id` (String) The ID of the auth method.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_auth_method_ldap.foo <my-id>
+```

docs/resources/auth_method_oidc.md

@@ -10,36 +10,90 @@ description: |-
 
 The OIDC auth method resource allows you to configure a Boundary auth_method_oidc.
 
+## Example Usage
 
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_auth_method_oidc" "vault" {
+  api_url_prefix     = "https://XO-XO-XO-XO-XOXOXO.boundary.hashicorp.cloud:9200"
+  client_id          = "eieio"
+  client_secret      = "hvo_secret_XO"
+  description        = "My Boundary OIDC Auth Method for Vault"
+  issuer             = "https://XO-XO-XO-XO-XOXOXO.vault.hashicorp.cloud:8200/v1/identity/oidc/provider/my-provider"
+  scope_id           = "global"
+  signing_algorithms = ["RS256"]
+  type               = "oidc"
+}
+
+resource "boundary_auth_method_oidc" "oidc_with_one_prompt" {
+  api_url_prefix     = "https://XO-XO-XO-XO-XOXOXO.boundary.hashicorp.cloud:9200"
+  client_id          = "eieio"
+  client_secret      = "hvo_secret_XO"
+  description        = "My Boundary OIDC Auth Method With Prompt"
+  issuer             = "https://sts.windows.net/TENANT_ID/"
+  scope_id           = "global"
+  signing_algorithms = ["RS256"]
+  prompts            = ["select_account"]
+  type               = "oidc"
+}
+
+resource "boundary_auth_method_oidc" "oidc_with_multiple_prompts" {
+  api_url_prefix     = "https://XO-XO-XO-XO-XOXOXO.boundary.hashicorp.cloud:9200"
+  client_id          = "eieio"
+  client_secret      = "hvo_secret_XO"
+  description        = "My Boundary OIDC Auth Method With Multiple Prompts"
+  issuer             = "https://sts.windows.net/TENANT_ID/"
+  scope_id           = "global"
+  signing_algorithms = ["RS256"]
+  prompts            = ["consent", "select_account"]
+  type               = "oidc"
+}
+```
 
 <!-- schema generated by tfplugindocs -->
 ## Schema
 
 ### Required
 
-- **scope_id** (String) The scope ID.
+- `scope_id` (String) The scope ID.
 
 ### Optional
 
-- **allowed_audiences** (List of String) Audiences for which the provider responses will be allowed
+- `account_claim_maps` (List of String) Account claim maps for the to_claim of sub.
-- **api_url_prefix** (String) The API prefix to use when generating callback URLs for the provider. Should be set to an address at which the provider can reach back to the controller.
+- `allowed_audiences` (List of String) Audiences for which the provider responses will be allowed
-- **callback_url** (String) The URL that should be provided to the IdP for callbacks.
+- `api_url_prefix` (String) The API prefix to use when generating callback URLs for the provider. Should be set to an address at which the provider can reach back to the controller.
-- **client_id** (String) The client ID assigned to this auth method from the provider.
+- `callback_url` (String) The URL that should be provided to the IdP for callbacks.
-- **client_secret** (String) The secret key assigned to this auth method from the provider. Once set, only the hash will be kept and the original value can be removed from configuration.
+- `claims_scopes` (List of String) Claims scopes.
-- **client_secret_hmac** (String) The HMAC of the client secret returned by the Boundary controller, which is used for comparison after initial setting of the value.
+- `client_id` (String) The client ID assigned to this auth method from the provider.
-- **description** (String) The auth method description.
+- `client_secret` (String, Sensitive) The secret key assigned to this auth method from the provider. Once set, only the hash will be kept and the original value can be removed from configuration.
-- **disable_discovered_config_validation** (Boolean) Disables validation logic ensuring that the OIDC provider's information from its discovery endpoint matches the information here. The validation is only performed at create or update time.
+- `client_secret_hmac` (String) The HMAC of the client secret returned by the Boundary controller, which is used for comparison after initial setting of the value.
-- **idp_ca_certs** (List of String) A list of CA certificates to trust when validating the IdP's token signatures.
+- `description` (String) The auth method description.
-- **is_primary_for_scope** (Boolean) When true, makes this auth method the primary auth method for the scope in which it resides. The primary auth method for a scope means the the user will be automatically created when they login using an OIDC account.
+- `disable_discovered_config_validation` (Boolean) Disables validation logic ensuring that the OIDC provider's information from its discovery endpoint matches the information here. The validation is only performed at create or update time.
-- **issuer** (String) The issuer corresponding to the provider, which must match the issuer field in generated tokens.
+- `idp_ca_certs` (List of String) A list of CA certificates to trust when validating the IdP's token signatures.
-- **max_age** (Number) The max age to provide to the provider, indicating how much time is allowed to have passed since the last authentication before the user is challenged again.
+- `is_primary_for_scope` (Boolean) When true, makes this auth method the primary auth method for the scope in which it resides. The primary auth method for a scope means the user will be automatically created when they login using an OIDC account.
-- **name** (String) The auth method name. Defaults to the resource name.
+- `issuer` (String) The issuer corresponding to the provider, which must match the issuer field in generated tokens.
-- **signing_algorithms** (List of String) Allowed signing algorithms for the provider's issued tokens.
+- `max_age` (Number) The max age to provide to the provider, indicating how much time is allowed to have passed since the last authentication before the user is challenged again. A value of 0 sets an immediate requirement for all users to reauthenticate, and an unset maxAge results in a Terraform value of -1 and the default TTL of the chosen OIDC will be used.
-- **state** (String) Can be one of 'inactive', 'active-private', or 'active-public'. Currently automatically set to active-public.
+- `name` (String) The auth method name. Defaults to the resource name.
-- **type** (String) The type of auth method; hardcoded.
+- `prompts` (List of String) The prompts passed to the identity provider to determine whether to prompt the end-user for reauthentication, account selection or consent. Please note the values passed are case-sensitive. The valid values are: `none`, `login`, `consent` and `select_account`.
+- `signing_algorithms` (List of String) Allowed signing algorithms for the provider's issued tokens.
+- `state` (String) Can be one of 'inactive', 'active-private', or 'active-public'. Currently automatically set to active-public.
+- `type` (String) The type of auth method; hardcoded.
 
 ### Read-Only
 
-- **id** (String) The ID of the auth method.
+- `id` (String) The ID of the auth method.
 
+## Import
 
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_auth_method_oidc.foo <my-id>
+```

docs/resources/auth_method_password.md

@@ -17,18 +17,16 @@ The auth method resource allows you to configure a Boundary auth_method_password
 
 ### Required
 
-- **scope_id** (String) The scope ID.
+- `scope_id` (String) The scope ID.
 
 ### Optional
 
-- **description** (String) The auth method description.
+- `description` (String) The auth method description.
-- **min_login_name_length** (Number) The minimum login name length.
+- `min_login_name_length` (Number) The minimum login name length.
-- **min_password_length** (Number) The minimum password length.
+- `min_password_length` (Number) The minimum password length.
-- **name** (String) The auth method name. Defaults to the resource name.
+- `name` (String) The auth method name. Defaults to the resource name.
-- **type** (String) The resource type, hardcoded per resource
+- `type` (String) The resource type, hardcoded per resource
 
 ### Read-Only
 
-- **id** (String) The ID of the account.
+- `id` (String) The ID of the account.
-
-

docs/resources/credential_json.md

@@ -0,0 +1,69 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_credential_json Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The json credential resource allows you to congiure a credential using a json object.
+---
+
+# boundary_credential_json (Resource)
+
+The json credential resource allows you to congiure a credential using a json object.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_static" "example" {
+  name        = "example_static_credential_store"
+  description = "My first static credential store!"
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_json" "example" {
+  name                = "example_json"
+  description         = "My first json credential!"
+  credential_store_id = boundary_credential_store_static.example.id
+  object              = file("~/object.json") # change to valid json file
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `credential_store_id` (String) The credential store in which to save this json credential.
+- `object` (String, Sensitive) The object for the this json credential. Either values encoded with the "jsonencode" function, pre-escaped JSON string, or a file
+
+### Optional
+
+- `description` (String) The description of this json credential.
+- `name` (String) The name of this json credential. Defaults to the resource name.
+
+### Read-Only
+
+- `id` (String) The ID of this json credential.
+- `object_hmac` (String) The object hmac.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_credential_json.example_json <my-id>
+```

docs/resources/credential_library_vault.md

@@ -0,0 +1,115 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_credential_library_vault Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The credential library for Vault resource allows you to configure a Boundary credential library for Vault.
+---
+
+# boundary_credential_library_vault (Resource)
+
+The credential library for Vault resource allows you to configure a Boundary credential library for Vault.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_vault" "foo" {
+  name        = "foo"
+  description = "My first Vault credential store!"
+  address     = "http://127.0.0.1:8200"      # change to Vault address
+  token       = "s.0ufRo6XEGU2jOqnIr7OlFYP5" # change to valid Vault token
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_library_vault" "foo" {
+  name                = "foo"
+  description         = "My first Vault credential library!"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "my/secret/foo" # change to Vault backend path
+  http_method         = "GET"
+}
+
+resource "boundary_credential_library_vault" "bar" {
+  name                = "bar"
+  description         = "My second Vault credential library!"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "my/secret/bar" # change to Vault backend path
+  http_method         = "POST"
+  http_request_body   = <<EOT
+{
+  "key": "Value",
+}
+EOT
+}
+
+resource "boundary_credential_library_vault" "baz" {
+  name                = "baz"
+  description         = "vault username password credential with mapping overrides"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "my/secret/baz" # change to Vault backend path
+  http_method         = "GET"
+  credential_type     = "username_password"
+  credential_mapping_overrides = {
+    password_attribute = "alternative_password_label"
+    username_attribute = "alternative_username_label"
+  }
+}
+
+resource "boundary_credential_library_vault" "quz" {
+  name                = "quz"
+  description         = "vault ssh private key credential with mapping overrides"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "my/secret/quz" # change to Vault backend path
+  http_method         = "GET"
+  credential_type     = "ssh_private_key"
+  credential_mapping_overrides = {
+    private_key_attribute            = "alternative_key_label"
+    private_key_passphrase_attribute = "alternative_passphrase_label"
+    username_attribute               = "alternative_username_label"
+  }
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `credential_store_id` (String) The ID of the credential store that this library belongs to.
+- `path` (String) The path in Vault to request credentials from.
+
+### Optional
+
+- `credential_mapping_overrides` (Map of String) The credential mapping override.
+- `credential_type` (String) The type of credential the library generates. Cannot be updated on an existing resource.
+- `description` (String) The Vault credential library description.
+- `http_method` (String) The HTTP method the library uses when requesting credentials from Vault. Defaults to 'GET'
+- `http_request_body` (String) The body of the HTTP request the library sends to Vault when requesting credentials. Only valid if `http_method` is set to `POST`.
+- `name` (String) The Vault credential library name. Defaults to the resource name.
+
+### Read-Only
+
+- `id` (String) The ID of the Vault credential library.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_credential_library_vault.foo <my-id>
+```

docs/resources/credential_library_vault_ssh_certificate.md

@@ -0,0 +1,111 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_credential_library_vault_ssh_certificate Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The credential library for Vault resource allows you to configure a Boundary credential library for Vault.
+---
+
+# boundary_credential_library_vault_ssh_certificate (Resource)
+
+The credential library for Vault resource allows you to configure a Boundary credential library for Vault.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_vault" "foo" {
+  name        = "foo"
+  description = "My first Vault credential store!"
+  address     = "http://127.0.0.1:8200"      # change to Vault address
+  token       = "s.0ufRo6XEGU2jOqnIr7OlFYP5" # change to valid Vault token
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_library_vault_ssh_certificate" "foo" {
+  name                = "foo"
+  description         = "My first Vault SSH certificate credential library!"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "ssh/sign/foo" # change to correct Vault endpoint and role
+  username            = "foo"          # change to valid username
+}
+
+resource "boundary_credential_library_vault_ssh_certificate" "bar" {
+  name                = "bar"
+  description         = "My second Vault SSH certificate credential library!"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "ssh/sign/foo" # change to correct Vault endpoint and role
+  username            = "foo"
+  key_type            = "ecdsa"
+  key_bits            = 384
+
+  extensions = {
+    permit-pty = ""
+  }
+}
+
+resource "boundary_credential_library_vault_ssh_certificate" "baz" {
+  name                = "baz"
+  description         = "vault "
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "ssh/issue/foo" # change to correct Vault endpoint and role
+  username            = "foo"
+  key_type            = "rsa"
+  key_bits            = 4096
+
+  extensions = {
+    permit-pty            = ""
+    permit-X11-forwarding = ""
+  }
+
+  critical_options = {
+    force-command = "/bin/some_script"
+  }
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `credential_store_id` (String) The ID of the credential store that this library belongs to.
+- `path` (String) The path in Vault to request credentials from.
+- `username` (String) The username to use with the certificate returned by the library.
+
+### Optional
+
+- `critical_options` (Map of String) Specifies a map of the critical options that the certificate should be signed for.
+- `description` (String) The Vault credential library description.
+- `extensions` (Map of String) Specifies a map of the extensions that the certificate should be signed for.
+- `key_bits` (Number) Specifies the number of bits to use for the generated keys.
+- `key_id` (String) Specifies the key id a certificate should have.
+- `key_type` (String) Specifies the desired key type; must be ed25519, ecdsa, or rsa.
+- `name` (String) The Vault credential library name. Defaults to the resource name.
+- `ttl` (String) Specifies the requested time to live for a certificate returned from the library.
+
+### Read-Only
+
+- `id` (String) The ID of the Vault credential library.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_credential_library_vault_ssh_certificate.foo <my-id>
+```

docs/resources/credential_ssh_private_key.md

@@ -0,0 +1,74 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_credential_ssh_private_key Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The SSH private key credential resource allows you to configure a credential using a username, private key and optional passphrase.
+---
+
+# boundary_credential_ssh_private_key (Resource)
+
+The SSH private key credential resource allows you to configure a credential using a username, private key and optional passphrase.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_static" "example" {
+  name        = "example_static_credential_store"
+  description = "My first static credential store!"
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_ssh_private_key" "example" {
+  name                   = "example_ssh_private_key"
+  description            = "My first ssh private key credential!"
+  credential_store_id    = boundary_credential_store_static.example.id
+  username               = "my-username"
+  private_key            = file("~/.ssh/id_rsa") # change to valid SSH Private Key
+  private_key_passphrase = "optional-passphrase" # change to the passphrase of the Private Key if required
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `credential_store_id` (String) ID of the credential store this credential belongs to.
+- `private_key` (String, Sensitive) The private key associated with the credential.
+- `username` (String) The username associated with the credential.
+
+### Optional
+
+- `description` (String) The description of the credential.
+- `name` (String) The name of the credential. Defaults to the resource name.
+- `private_key_passphrase` (String, Sensitive) The passphrase of the private key associated with the credential.
+
+### Read-Only
+
+- `id` (String) The ID of the credential.
+- `private_key_hmac` (String) The private key hmac.
+- `private_key_passphrase_hmac` (String) The private key passphrase hmac.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_credential_ssh_private_key.example_ssh_private_key <my-id>
+```

docs/resources/credential_store_static.md

@@ -0,0 +1,60 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_credential_store_static Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The static credential store resource allows you to configure a Boundary static credential store.
+---
+
+# boundary_credential_store_static (Resource)
+
+The static credential store resource allows you to configure a Boundary static credential store.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_static" "example" {
+  name        = "example_static_credential_store"
+  description = "My first static credential store!"
+  scope_id    = boundary_scope.project.id
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `scope_id` (String) The scope for this credential store.
+
+### Optional
+
+- `description` (String) The static credential store description.
+- `name` (String) The static credential store name. Defaults to the resource name.
+
+### Read-Only
+
+- `id` (String) The ID of the static credential store.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_credential_store_static.example_static_credential_store <my-id>
+```

docs/resources/credential_store_vault.md

@@ -0,0 +1,73 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_credential_store_vault Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The credential store for Vault resource allows you to configure a Boundary credential store for Vault.
+---
+
+# boundary_credential_store_vault (Resource)
+
+The credential store for Vault resource allows you to configure a Boundary credential store for Vault.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_vault" "example" {
+  name        = "foo"
+  description = "My first Vault credential store!"
+  address     = "http://127.0.0.1:8200"      # change to Vault address
+  token       = "s.0ufRo6XEGU2jOqnIr7OlFYP5" # change to valid Vault token
+  scope_id    = boundary_scope.project.id
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `address` (String) The address to Vault server. This should be a complete URL such as 'https://127.0.0.1:8200'
+- `scope_id` (String) The scope for this credential store.
+- `token` (String, Sensitive) A token used for accessing Vault.
+
+### Optional
+
+- `ca_cert` (String) A PEM-encoded CA certificate to verify the Vault server's TLS certificate.
+- `client_certificate` (String) A PEM-encoded client certificate to use for TLS authentication to the Vault server.
+- `client_certificate_key` (String, Sensitive) A PEM-encoded private key matching the client certificate from 'client_certificate'.
+- `description` (String) The Vault credential store description.
+- `name` (String) The Vault credential store name. Defaults to the resource name.
+- `namespace` (String) The namespace within Vault to use.
+- `tls_server_name` (String) Name to use as the SNI host when connecting to Vault via TLS.
+- `tls_skip_verify` (Boolean) Whether or not to skip TLS verification.
+- `worker_filter` (String) HCP Only. A filter used to control which PKI workers can handle Vault requests. This allows the use of private Vault instances with Boundary.
+
+### Read-Only
+
+- `client_certificate_key_hmac` (String) The Vault client certificate key hmac.
+- `id` (String) The ID of the Vault credential store.
+- `token_hmac` (String) The Vault token hmac.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_credential_store_vault.foo <my-id>
+```

docs/resources/credential_username_password.md

@@ -0,0 +1,71 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_credential_username_password Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The username/password credential resource allows you to configure a credential using a username and password pair.
+---
+
+# boundary_credential_username_password (Resource)
+
+The username/password credential resource allows you to configure a credential using a username and password pair.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_static" "example" {
+  name        = "example_static_credential_store"
+  description = "My first static credential store!"
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_username_password" "example" {
+  name                = "example_username_password"
+  description         = "My first username password credential!"
+  credential_store_id = boundary_credential_store_static.example.id
+  username            = "my-username"
+  password            = "my-password"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `credential_store_id` (String) The credential store in which to save this username/password credential.
+- `password` (String, Sensitive) The password of this username/password credential.
+- `username` (String) The username of this username/password credential.
+
+### Optional
+
+- `description` (String) The description of this username/password credential.
+- `name` (String) The name of this username/password credential. Defaults to the resource name.
+
+### Read-Only
+
+- `id` (String) The ID of this username/password credential.
+- `password_hmac` (String) The password hmac.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_credential_username_password.example_username_password <my-id>
+```

docs/resources/group.md

@@ -69,17 +69,17 @@ resource "boundary_group" "example" {
 
 ### Required
 
-- **scope_id** (String) The scope ID in which the resource is created. Defaults to the provider's `default_scope` if unset.
+- `scope_id` (String) The scope ID in which the resource is created. Defaults to the provider's `default_scope` if unset.
 
 ### Optional
 
-- **description** (String) The group description.
+- `description` (String) The group description.
-- **member_ids** (Set of String) Resource IDs for group members, these are most likely boundary users.
+- `member_ids` (Set of String) Resource IDs for group members, these are most likely boundary users.
-- **name** (String) The group name. Defaults to the resource name.
+- `name` (String) The group name. Defaults to the resource name.
 
 ### Read-Only
 
-- **id** (String) The ID of the group.
+- `id` (String) The ID of the group.
 
 ## Import
 

docs/resources/host.md

@@ -3,12 +3,12 @@
 page_title: "boundary_host Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The host resource allows you to configure a Boundary static host. Hosts are always part of a project, so a project resource should be used inline or you should have the project ID in hand to successfully configure a host.
+  Deprecated: use boundary_host_static instead.
 ---
 
 # boundary_host (Resource)
 
-The host resource allows you to configure a Boundary static host. Hosts are always part of a project, so a project resource should be used inline or you should have the project ID in hand to successfully configure a host.
+Deprecated: use `boundary_host_static` instead.
 
 ## Example Usage
 
@@ -28,12 +28,20 @@ resource "boundary_scope" "project" {
   auto_create_admin_role = true
 }
 
-resource "boundary_host" "example" {
+resource "boundary_host_catalog" "static" {
-  name        = "example_host"
+  name        = "My catalog"
-  description = "My first host!"
+  description = "My first host catalog!"
-  address     = "10.0.0.1"
+  type        = "static"
   scope_id    = boundary_scope.project.id
 }
+
+resource "boundary_host" "example" {
+  type            = "static"
+  name            = "example_host"
+  description     = "My first host!"
+  address         = "10.0.0.1"
+  host_catalog_id = boundary_host_catalog.static.id
+}
 ```
 
 <!-- schema generated by tfplugindocs -->
@@ -41,18 +49,18 @@ resource "boundary_host" "example" {
 
 ### Required
 
-- **host_catalog_id** (String)
+- `host_catalog_id` (String)
-- **type** (String)
+- `type` (String) The type of host
 
 ### Optional
 
-- **address** (String) The static address of the host resource as `<IP>` (note: port assignment occurs in the target resource definition, do not add :port here) or a domain name.
+- `address` (String) The static address of the host resource as `<IP>` (note: port assignment occurs in the target resource definition, do not add :port here) or a domain name.
-- **description** (String) The host description.
+- `description` (String) The host description.
-- **name** (String) The host name. Defaults to the resource name.
+- `name` (String) The host name. Defaults to the resource name.
 
 ### Read-Only
 
-- **id** (String) The ID of the host.
+- `id` (String) The ID of the host.
 
 ## Import
 

docs/resources/host_catalog.md

@@ -3,12 +3,12 @@
 page_title: "boundary_host_catalog Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The host catalog resource allows you to configure a Boundary host catalog. Host catalogs are always part of a project, so a project resource should be used inline or you should have the project ID in hand to successfully configure a host catalog.
+  Deprecated: use boundary_host_catalog_static instead.
 ---
 
 # boundary_host_catalog (Resource)
 
-The host catalog resource allows you to configure a Boundary host catalog. Host catalogs are always part of a project, so a project resource should be used inline or you should have the project ID in hand to successfully configure a host catalog.
+Deprecated: use `boundary_host_catalog_static` instead.
 
 ## Example Usage
 
@@ -41,17 +41,17 @@ resource "boundary_host_catalog" "example" {
 
 ### Required
 
-- **scope_id** (String) The scope ID in which the resource is created.
+- `scope_id` (String) The scope ID in which the resource is created.
-- **type** (String) The host catalog type. Only `Static` (yes, title case) is supported.
+- `type` (String) The host catalog type. Only `static` is supported.
 
 ### Optional
 
-- **description** (String) The host catalog description.
+- `description` (String) The host catalog description.
-- **name** (String) The host catalog name. Defaults to the resource name.
+- `name` (String) The host catalog name. Defaults to the resource name.
 
 ### Read-Only
 
-- **id** (String) The ID of the host catalog.
+- `id` (String) The ID of the host catalog.
 
 ## Import
 

docs/resources/host_catalog_plugin.md

@@ -0,0 +1,108 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_host_catalog_plugin Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The host catalog resource allows you to configure a Boundary plugin-type host catalog. Host catalogs are always part of a project, so a project resource should be used inline or you should have the project ID in hand to successfully configure a host catalog.
+---
+
+# boundary_host_catalog_plugin (Resource)
+
+The host catalog resource allows you to configure a Boundary plugin-type host catalog. Host catalogs are always part of a project, so a project resource should be used inline or you should have the project ID in hand to successfully configure a host catalog.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = boundary_scope.global.id
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+# For more information about the aws plugin, please visit here:
+# https://github.com/hashicorp/boundary-plugin-host-aws
+#
+# For more information about aws users, please visit here:
+# https://learn.hashicorp.com/tutorials/boundary/aws-host-catalogs?in=boundary/oss-access-management#configure-terraform-and-iam-user-privileges
+resource "boundary_host_catalog_plugin" "aws_example" {
+  name            = "My aws catalog"
+  description     = "My first host catalog!"
+  scope_id        = boundary_scope.project.id
+  plugin_name     = "aws"
+  attributes_json = jsonencode({ "region" = "us-east-1" })
+
+  # recommended to pass in aws secrets using a file() or using environment variables
+  # the secrets below must be generated in aws by creating a aws iam user with programmatic access
+  secrets_json = jsonencode({
+    "access_key_id"     = "aws_access_key_id_value",
+    "secret_access_key" = "aws_secret_access_key_value"
+  })
+}
+
+# For more information about the azure plugin, please visit here:
+# https://github.com/hashicorp/boundary-plugin-host-azure
+#
+# For more information about azure ad applications, please visit here:
+# https://learn.hashicorp.com/tutorials/boundary/azure-host-catalogs#register-a-new-azure-ad-application-1
+resource "boundary_host_catalog_plugin" "azure_example" {
+  name        = "My azure catalog"
+  description = "My second host catalog!"
+  scope_id    = boundary_scope.project.id
+  plugin_name = "azure"
+
+  # the attributes below must be generated in azure by creating an ad application
+  attributes_json = jsonencode({
+    "disable_credential_rotation" = "true",
+    "tenant_id"                   = "ARM_TENANT_ID",
+    "subscription_id"             = "ARM_SUBSCRIPTION_ID",
+    "client_id"                   = "ARM_CLIENT_ID"
+  })
+
+  # recommended to pass in azure secrets using a file() or using environment variables
+  # the secrets below must be generated in azure by creating an ad application
+  secrets_json = jsonencode({
+    "secret_value" = "ARM_CLIENT_SECRET"
+  })
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `scope_id` (String) The scope ID in which the resource is created.
+
+### Optional
+
+- `attributes_json` (String) The attributes for the host catalog. Either values encoded with the "jsonencode" function, pre-escaped JSON string, or a file:// or env:// path. Set to a string "null" or remove the block to clear all attributes in the host catalog.
+- `description` (String) The host catalog description.
+- `internal_force_update` (String) Internal only. Used to force update so that we can always check the value of secrets.
+- `internal_hmac_used_for_secrets_config_hmac` (String) Internal only. The Boundary-provided HMAC used to calculate the current value of the HMAC'd config. Used for drift detection.
+- `internal_secrets_config_hmac` (String) Internal only. HMAC of (serverSecretsHmac + config secrets). Used for proper secrets handling.
+- `name` (String) The host catalog name. Defaults to the resource name.
+- `plugin_id` (String) The ID of the plugin that should back the resource. This or plugin_name must be defined.
+- `plugin_name` (String) The name of the plugin that should back the resource. This or plugin_id must be defined.
+- `secrets_hmac` (String) The HMAC'd secrets value returned from the server.
+- `secrets_json` (String, Sensitive) The secrets for the host catalog. Either values encoded with the "jsonencode" function, pre-escaped JSON string, or a file:// or env:// path. Set to a string "null" to clear any existing values. NOTE: Unlike "attributes_json", removing this block will NOT clear secrets from the host catalog; this allows injecting secrets for one call, then removing them for storage.
+
+### Read-Only
+
+- `id` (String) The ID of the host catalog.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_host_catalog_plugin.foo <my-id>
+```

docs/resources/host_catalog_static.md

@@ -0,0 +1,60 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_host_catalog_static Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The static host catalog resource allows you to configure a Boundary static-type host catalog. Host catalogs are always part of a project, so a project resource should be used inline or you should have the project ID in hand to successfully configure a host catalog.
+---
+
+# boundary_host_catalog_static (Resource)
+
+The static host catalog resource allows you to configure a Boundary static-type host catalog. Host catalogs are always part of a project, so a project resource should be used inline or you should have the project ID in hand to successfully configure a host catalog.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = boundary_scope.global.id
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_host_catalog_static" "example" {
+  name        = "My catalog"
+  description = "My first host catalog!"
+  scope_id    = boundary_scope.project.id
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `scope_id` (String) The scope ID in which the resource is created.
+
+### Optional
+
+- `description` (String) The host catalog description.
+- `name` (String) The host catalog name. Defaults to the resource name.
+
+### Read-Only
+
+- `id` (String) The ID of the host catalog.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_host_catalog_static.foo <my-id>
+```

docs/resources/host_set.md

@@ -3,12 +3,12 @@
 page_title: "boundary_host_set Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The host_set resource allows you to configure a Boundary host set. Host sets are always part of a host catalog, so a host catalog resource should be used inline or you should have the host catalog ID in hand to successfully configure a host set.
+  Deprecated: use boundary_host_set_static instead.
 ---
 
 # boundary_host_set (Resource)
 
-The host_set resource allows you to configure a Boundary host set. Host sets are always part of a host catalog, so a host catalog resource should be used inline or you should have the host catalog ID in hand to successfully configure a host set.
+Deprecated: use `boundary_host_set_static` instead.
 
 ## Example Usage
 
@@ -29,30 +29,32 @@ resource "boundary_scope" "project" {
 }
 
 resource "boundary_host_catalog" "static" {
+  type     = "static"
   scope_id = boundary_scope.project.id
 }
 
-resource "boundary_host" "1" {
+resource "boundary_host" "first" {
+  type            = "static"
   name            = "host_1"
   description     = "My first host!"
   address         = "10.0.0.1"
   host_catalog_id = boundary_host_catalog.static.id
-  scope_id        = boundary_scope.project.id
 }
 
-resource "boundary_host" "2" {
+resource "boundary_host" "second" {
+  type            = "static"
   name            = "host_2"
   description     = "My second host!"
   address         = "10.0.0.2"
   host_catalog_id = boundary_host_catalog.static.id
-  scope_id        = boundary_scope.project.id
 }
 
 resource "boundary_host_set" "web" {
   host_catalog_id = boundary_host_catalog.static.id
+  type            = "static"
   host_ids = [
-    boundary_host.1.id,
+    boundary_host.first.id,
-    boundary_host.2.id,
+    boundary_host.second.id,
   ]
 }
 ```
@@ -62,18 +64,18 @@ resource "boundary_host_set" "web" {
 
 ### Required
 
-- **host_catalog_id** (String) The catalog for the hostset.
+- `host_catalog_id` (String) The catalog for the host set.
-- **type** (String)
+- `type` (String) The type of host set
 
 ### Optional
 
-- **description** (String) The hostset description.
+- `description` (String) The host set description.
-- **host_ids** (Set of String) The list of host IDs contained in this set.
+- `host_ids` (Set of String) The list of host IDs contained in this set.
-- **name** (String) The hostset name. Defaults to the resource name.
+- `name` (String) The host set name. Defaults to the resource name.
 
 ### Read-Only
 
-- **id** (String) The ID of the hostset.
+- `id` (String) The ID of the host set.
 
 ## Import
 

docs/resources/host_set_plugin.md

@@ -0,0 +1,145 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_host_set_plugin Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The hostsetplugin resource allows you to configure a Boundary host set. Host sets are always part of a host catalog, so a host catalog resource should be used inline or you should have the host catalog ID in hand to successfully configure a host set.
+---
+
+# boundary_host_set_plugin (Resource)
+
+The host_set_plugin resource allows you to configure a Boundary host set. Host sets are always part of a host catalog, so a host catalog resource should be used inline or you should have the host catalog ID in hand to successfully configure a host set.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+# For more information about the aws plugin, please visit here:
+# https://github.com/hashicorp/boundary-plugin-host-aws
+#
+# For more information about aws users, please visit here:
+# https://learn.hashicorp.com/tutorials/boundary/aws-host-catalogs?in=boundary/oss-access-management#configure-terraform-and-iam-user-privileges
+resource "boundary_host_catalog_plugin" "aws_example" {
+  name            = "My aws catalog"
+  description     = "My first host catalog!"
+  scope_id        = boundary_scope.project.id
+  plugin_name     = "aws"
+  attributes_json = jsonencode({ "region" = "us-east-1" })
+
+  # recommended to pass in aws secrets using a file() or using environment variables
+  # the secrets below must be generated in aws by creating a aws iam user with programmatic access
+  secrets_json = jsonencode({
+    "access_key_id"     = "aws_access_key_id_value",
+    "secret_access_key" = "aws_secret_access_key_value"
+  })
+}
+
+resource "boundary_host_set_plugin" "web" {
+  name            = "My web host set plugin"
+  host_catalog_id = boundary_host_catalog_plugin.aws_example.id
+  attributes_json = jsonencode({ "filters" = ["tag:service-type=web"] })
+}
+
+resource "boundary_host_set_plugin" "foobar" {
+  name                = "My foobar host set plugin"
+  host_catalog_id     = boundary_host_catalog_plugin.aws_example.id
+  preferred_endpoints = ["cidr:54.0.0.0/8"]
+  attributes_json = jsonencode({
+    "filters" = ["tag-key=foo", "tag-key=bar"]
+  })
+}
+
+resource "boundary_host_set_plugin" "launch" {
+  name                  = "My launch host set plugin"
+  host_catalog_id       = boundary_host_catalog_plugin.aws_example.id
+  sync_interval_seconds = 60
+  attributes_json = jsonencode({
+    "filters" = ["tag:development=prod,dev", "launch-time=2022-01-04T*"]
+  })
+}
+
+# For more information about the azure plugin, please visit here:
+# https://github.com/hashicorp/boundary-plugin-host-azure
+#
+# For more information about azure ad applications, please visit here:
+# https://learn.hashicorp.com/tutorials/boundary/azure-host-catalogs#register-a-new-azure-ad-application-1
+resource "boundary_host_catalog_plugin" "azure_example" {
+  name        = "My azure catalog"
+  description = "My second host catalog!"
+  scope_id    = boundary_scope.project.id
+  plugin_name = "azure"
+
+  # the attributes below must be generated in azure by creating an ad application
+  attributes_json = jsonencode({
+    "disable_credential_rotation" = "true",
+    "tenant_id"                   = "ARM_TENANT_ID",
+    "subscription_id"             = "ARM_SUBSCRIPTION_ID",
+    "client_id"                   = "ARM_CLIENT_ID"
+  })
+
+  # recommended to pass in azure secrets using a file() or using environment variables
+  # the secrets below must be generated in azure by creating an ad application
+  secrets_json = jsonencode({
+    "secret_value" = "ARM_CLIENT_SECRET"
+  })
+}
+
+resource "boundary_host_set_plugin" "database" {
+  name            = "My database host set plugin"
+  host_catalog_id = boundary_host_catalog_plugin.azure_example.id
+  attributes_json = jsonencode({ "filter" = "tagName eq 'service-type' and tagValue eq 'database'" })
+}
+
+resource "boundary_host_set_plugin" "foodev" {
+  name                  = "My foodev host set plugin"
+  host_catalog_id       = boundary_host_catalog_plugin.azure_example.id
+  preferred_endpoints   = ["cidr:54.0.0.0/8"]
+  sync_interval_seconds = 60
+  attributes_json = jsonencode({
+    "filter" = "tagName eq 'tag-key' and tagValue eq 'foo'",
+    "filter" = "tagName eq 'application' and tagValue eq 'dev'",
+  })
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `host_catalog_id` (String) The catalog for the host set.
+
+### Optional
+
+- `attributes_json` (String) The attributes for the host set. Either values encoded with the "jsonencode" function, pre-escaped JSON string, or a file:// or env:// path. Set to a string "null" or remove the block to clear all attributes in the host set.
+- `description` (String) The host set description.
+- `name` (String) The host set name. Defaults to the resource name.
+- `preferred_endpoints` (List of String) The ordered list of preferred endpoints.
+- `sync_interval_seconds` (Number) The value to set for the sync interval seconds.
+- `type` (String) The type of host set
+
+### Read-Only
+
+- `id` (String) The ID of the host set.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_host_set_plugin.foo <my-id>
+```

docs/resources/host_set_static.md

@@ -0,0 +1,82 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_host_set_static Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The hostsetstatic resource allows you to configure a Boundary host set. Host sets are always part of a host catalog, so a host catalog resource should be used inline or you should have the host catalog ID in hand to successfully configure a host set.
+---
+
+# boundary_host_set_static (Resource)
+
+The host_set_static resource allows you to configure a Boundary host set. Host sets are always part of a host catalog, so a host catalog resource should be used inline or you should have the host catalog ID in hand to successfully configure a host set.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_host_catalog_static" "example" {
+  scope_id = boundary_scope.project.id
+}
+
+resource "boundary_host_static" "first" {
+  name            = "host_1"
+  description     = "My first host!"
+  address         = "10.0.0.1"
+  host_catalog_id = boundary_host_catalog_static.example.id
+}
+
+resource "boundary_host_static" "second" {
+  name            = "host_2"
+  description     = "My second host!"
+  address         = "10.0.0.2"
+  host_catalog_id = boundary_host_catalog_static.example.id
+}
+
+resource "boundary_host_set_static" "web" {
+  host_catalog_id = boundary_host_catalog_static.example.id
+  host_ids = [
+    boundary_host_static.first.id,
+    boundary_host_static.second.id,
+  ]
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `host_catalog_id` (String) The catalog for the host set.
+
+### Optional
+
+- `description` (String) The host set description.
+- `host_ids` (Set of String) The list of host IDs contained in this set.
+- `name` (String) The host set name. Defaults to the resource name.
+- `type` (String) The type of host set
+
+### Read-Only
+
+- `id` (String) The ID of the host set.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_host_set_static.foo <my-id>
+```

docs/resources/host_static.md

@@ -0,0 +1,69 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_host_static Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The static host resource allows you to configure a Boundary static host. Hosts are always part of a project, so a project resource should be used inline or you should have the project ID in hand to successfully configure a host.
+---
+
+# boundary_host_static (Resource)
+
+The static host resource allows you to configure a Boundary static host. Hosts are always part of a project, so a project resource should be used inline or you should have the project ID in hand to successfully configure a host.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_host_catalog_static" "example" {
+  name        = "My catalog"
+  description = "My first host catalog!"
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_host_static" "example" {
+  name            = "example_host"
+  description     = "My first host!"
+  address         = "10.0.0.1"
+  host_catalog_id = boundary_host_catalog_static.example.id
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `host_catalog_id` (String)
+
+### Optional
+
+- `address` (String) The static address of the host resource as `<IP>` (note: port assignment occurs in the target resource definition, do not add :port here) or a domain name.
+- `description` (String) The host description.
+- `name` (String) The host name. Defaults to the resource name.
+- `type` (String) The type of host
+
+### Read-Only
+
+- `id` (String) The ID of the host.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_host_static.foo <my-id>
+```

docs/resources/managed_group.md

@@ -0,0 +1,30 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_managed_group Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The managed group resource allows you to configure a Boundary group.
+---
+
+# boundary_managed_group (Resource)
+
+The managed group resource allows you to configure a Boundary group.
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `auth_method_id` (String) The resource ID for the auth method.
+- `filter` (String) Boolean expression to filter the workers for this managed group.
+
+### Optional
+
+- `description` (String) The managed group description.
+- `name` (String) The managed group name. Defaults to the resource name.
+
+### Read-Only
+
+- `id` (String) The ID of the group.

docs/resources/managed_group_ldap.md

@@ -0,0 +1,69 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_managed_group_ldap Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The managed group resource allows you to configure a Boundary group.
+---
+
+# boundary_managed_group_ldap (Resource)
+
+The managed group resource allows you to configure a Boundary group.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_auth_method_ldap" "forumsys_ldap" {
+  name          = "forumsys public LDAP"
+  scope_id      = "global"                               # add the new auth method to the global scope
+  urls          = ["ldap://ldap.forumsys.com"]           # the addr of the LDAP server
+  user_dn       = "dc=example,dc=com"                    # the basedn for users
+  user_attr     = "uid"                                  # the user attribute
+  group_dn      = "dc=example,dc=com"                    # the basedn for groups
+  bind_dn       = "cn=read-only-admin,dc=example,dc=com" # the dn to use when binding
+  bind_password = "password"                             # passwd to use when binding
+  state         = "active-public"                        # make sure the new auth-method is available to everyone
+  enable_groups = true                                   # this turns-on the discovery of a user's groups
+  discover_dn   = true                                   # this turns-on the discovery of an authenticating user's dn
+}
+
+resource "boundary_managed_group_ldap" "forumsys_scientists" {
+  name           = "scientists"
+  description    = "forumsys scientists managed group"
+  auth_method_id = boundary_auth_method_ldap.forumsys_ldap.id
+  group_names    = ["Scientists"]
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `auth_method_id` (String) The resource ID for the auth method.
+- `group_names` (List of String) The list of groups that make up the managed group.
+
+### Optional
+
+- `description` (String) The managed group description.
+- `name` (String) The managed group name. Defaults to the resource name.
+
+### Read-Only
+
+- `id` (String) The ID of the group.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_managed_group_ldap.foo <my-id>
+```

docs/resources/role.md

@@ -51,10 +51,10 @@ resource "boundary_user" "bar" {
 }
 
 resource "boundary_role" "example" {
-  name        = "My role"
+  name          = "My role"
-  description = "My first role!"
+  description   = "My first role!"
-  principals  = [boundary_user.foo.id, boundary_user.bar.id]
+  principal_ids = [boundary_user.foo.id, boundary_user.bar.id]
-  scope_id    = boundary_scope.org.id
+  scope_id      = boundary_scope.org.id
 }
 ```
 
@@ -76,11 +76,11 @@ resource "boundary_user" "readonly" {
 }
 
 resource "boundary_role" "readonly" {
-  name        = "readonly"
+  name          = "readonly"
-  description = "A readonly role"
+  description   = "A readonly role"
-  principals  = [boundary_user.readonly.id]
+  principal_ids = [boundary_user.readonly.id]
-  grants      = ["id=*;action=read"]
+  grant_strings = ["id=*;type=*;actions=read"]
-  scope_id    = boundary_scope.org.id
+  scope_id      = boundary_scope.org.id
 }
 ```
 
@@ -109,11 +109,11 @@ resource "boundary_user" "readonly" {
 }
 
 resource "boundary_role" "readonly" {
-  name        = "readonly"
+  name          = "readonly"
-  description = "A readonly role"
+  description   = "A readonly role"
-  principals  = [boundary_user.readonly.id]
+  principal_ids = [boundary_user.readonly.id]
-  grants      = ["id=*;action=read"]
+  grant_strings = ["id=*;type=*;actions=read"]
-  scope_id    = boundary_scope.project.id
+  scope_id      = boundary_scope.project.id
 }
 ```
 
@@ -122,20 +122,19 @@ resource "boundary_role" "readonly" {
 
 ### Required
 
-- **scope_id** (String) The scope ID in which the resource is created. Defaults to the provider's `default_scope` if unset.
+- `scope_id` (String) The scope ID in which the resource is created. Defaults to the provider's `default_scope` if unset.
 
 ### Optional
 
-- **default_role** (Boolean) Indicates that the role containing this value is the default role (that is, has the id 'r_default'), which triggers some specialized behavior to allow it to be imported and managed.
+- `description` (String) The role description.
-- **description** (String) The role description.
+- `grant_scope_id` (String)
-- **grant_scope_id** (String)
+- `grant_strings` (Set of String) A list of stringified grants for the role.
-- **grant_strings** (Set of String) A list of stringified grants for the role.
+- `name` (String) The role name. Defaults to the resource name.
-- **name** (String) The role name. Defaults to the resource name.
+- `principal_ids` (Set of String) A list of principal (user or group) IDs to add as principals on the role.
-- **principal_ids** (Set of String) A list of principal (user or group) IDs to add as principals on the role.
 
 ### Read-Only
 
-- **id** (String) The ID of the role.
+- `id` (String) The ID of the role.
 
 ## Import
 

docs/resources/scope.md

@@ -65,19 +65,19 @@ resource "boundary_role" "org_admin" {
 
 ### Required
 
-- **scope_id** (String) The scope ID containing the sub scope resource.
+- `scope_id` (String) The scope ID containing the sub scope resource.
 
 ### Optional
 
-- **auto_create_admin_role** (Boolean) If set, when a new scope is created, the provider will not disable the functionality that automatically creates a role in the new scope and gives permissions to manage the scope to the provider's user. Marking this true makes for simpler HCL but results in role resources that are unmanaged by Terraform.
+- `auto_create_admin_role` (Boolean) If set, when a new scope is created, the provider will not disable the functionality that automatically creates a role in the new scope and gives permissions to manage the scope to the provider's user. Marking this true makes for simpler HCL but results in role resources that are unmanaged by Terraform.
-- **auto_create_default_role** (Boolean) Only relevant when creating an org scope. If set, when a new scope is created, the provider will not disable the functionality that automatically creates a role in the new scope and gives listing of scopes and auth methods and the ability to authenticate to the anonymous user. Marking this true makes for simpler HCL but results in role resources that are unmanaged by Terraform.
+- `auto_create_default_role` (Boolean) Only relevant when creating an org scope. If set, when a new scope is created, the provider will not disable the functionality that automatically creates a role in the new scope and gives listing of scopes and auth methods and the ability to authenticate to the anonymous user. Marking this true makes for simpler HCL but results in role resources that are unmanaged by Terraform.
-- **description** (String) The scope description.
+- `description` (String) The scope description.
-- **global_scope** (Boolean) Indicates that the scope containing this value is the global scope, which triggers some specialized behavior to allow it to be imported and managed.
+- `global_scope` (Boolean) Indicates that the scope containing this value is the global scope, which triggers some specialized behavior to allow it to be imported and managed.
-- **name** (String) The scope name. Defaults to the resource name.
+- `name` (String) The scope name. Defaults to the resource name.
 
 ### Read-Only
 
-- **id** (String) The ID of the scope.
+- `id` (String) The ID of the scope.
 
 ## Import
 

docs/resources/storage_bucket.md

@@ -0,0 +1,75 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_storage_bucket Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The storage bucket resource allows you to configure a Boundary storage bucket. A storage bucket can only belong to the Global scope or an Org scope. At this time, the only supported storage for storage buckets is AWS S3. This feature requires Boundary Enterprise or Boundary HCP.
+---
+
+# boundary_storage_bucket (Resource)
+
+The storage bucket resource allows you to configure a Boundary storage bucket. A storage bucket can only belong to the Global scope or an Org scope. At this time, the only supported storage for storage buckets is AWS S3. This feature requires Boundary Enterprise or Boundary HCP.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = boundary_scope.global.id
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_storage_bucket" "aws_example" {
+  name            = "My aws storage bucket"
+  description     = "My first storage bucket!"
+  scope_id        = boundary_scope.org.id
+  plugin_name     = "aws"
+  bucket_name     = "mybucket"
+  attributes_json = jsonencode({ "region" = "us-east-1" })
+
+  # recommended to pass in aws secrets using a file() or using environment variables
+  # the secrets below must be generated in aws by creating a aws iam user with programmatic access
+  secrets_json = jsonencode({
+    "access_key_id"     = "aws_access_key_id_value",
+    "secret_access_key" = "aws_secret_access_key_value"
+  })
+  worker_filter = "\"pki\" in \"/tags/type\""
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `bucket_name` (String) The name of the bucket within the external object store service.
+- `scope_id` (String) The scope for this storage bucket.
+- `secrets_json` (String, Sensitive) The secrets for the storage bucket. Either values encoded with the "jsonencode" function, pre-escaped JSON string, or a file:// or env:// path. Set to a string "null" to clear any existing values. NOTE: Unlike "attributes_json", removing this block will NOT clear secrets from the storage bucket; this allows injecting secrets for one call, then removing them for storage.
+- `worker_filter` (String) Filters to the worker(s) that can handle requests for this storage bucket. The filter must match an existing worker in order to create a storage bucket.
+
+### Optional
+
+- `attributes_json` (String) The attributes for the storage bucket. The "region" attribute field is required when creating an AWS storage bucket. Values are either encoded with the "jsonencode" function, pre-escaped JSON string, or a file:// or env:// path. Set to a string "null" or remove the block to clear all attributes in the storage bucket.
+- `bucket_prefix` (String) The prefix used to organize the data held within the external object store.
+- `description` (String) The storage bucket description.
+- `name` (String) The storage bucket name. Defaults to the resource name.
+- `plugin_id` (String) The ID of the plugin that should back the resource. This or plugin_name must be defined.
+- `plugin_name` (String) The name of the plugin that should back the resource. This or plugin_id must be defined.
+
+### Read-Only
+
+- `id` (String) The ID of the storage bucket.
+- `internal_force_update` (String) Internal only. Used to force update so that we can always check the value of secrets.
+- `internal_hmac_used_for_secrets_config_hmac` (String) Internal only. The Boundary-provided HMAC used to calculate the current value of the HMAC'd config. Used for drift detection.
+- `internal_secrets_config_hmac` (String) Internal only. HMAC of (serverSecretsHmac + config secrets). Used for proper secrets handling.
+- `secrets_hmac` (String) The HMAC'd secrets value returned from the server.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_storage_bucket.foo <my-id>
+```

docs/resources/target.md

@@ -33,6 +33,23 @@ resource "boundary_scope" "project" {
   auto_create_admin_role = true
 }
 
+resource "boundary_credential_store_vault" "foo" {
+  name        = "vault_store"
+  description = "My first Vault credential store!"
+  address     = "http://127.0.0.1:8200"      # change to Vault address
+  token       = "s.0ufRo6XEGU2jOqnIr7OlFYP5" # change to valid Vault token
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_library_vault" "foo" {
+  name                = "foo"
+  description         = "My first Vault credential library!"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "my/secret/foo" # change to Vault backend path
+  http_method         = "GET"
+  credential_type     = "username_password"
+}
+
 resource "boundary_host_catalog" "foo" {
   name        = "test"
   description = "test catalog"
@@ -41,20 +58,21 @@ resource "boundary_host_catalog" "foo" {
 }
 
 resource "boundary_host" "foo" {
+  type            = "static"
   name            = "foo"
   host_catalog_id = boundary_host_catalog.foo.id
-  scope_id        = boundary_scope.project.id
   address         = "10.0.0.1"
 }
 
 resource "boundary_host" "bar" {
+  type            = "static"
   name            = "bar"
   host_catalog_id = boundary_host_catalog.foo.id
-  scope_id        = boundary_scope.project.id
   address         = "10.0.0.1"
 }
 
 resource "boundary_host_set" "foo" {
+  type            = "static"
   name            = "foo"
   host_catalog_id = boundary_host_catalog.foo.id
 
@@ -64,14 +82,71 @@ resource "boundary_host_set" "foo" {
   ]
 }
 
+resource "boundary_storage_bucket" "aws_example" {
+  name            = "My aws storage bucket"
+  description     = "My first storage bucket!"
+  scope_id        = boundary_scope.org.id
+  plugin_name     = "aws"
+  bucket_name     = "mybucket"
+  attributes_json = jsonencode({ "region" = "us-east-1" })
+  secrets_json = jsonencode({
+    "access_key_id"     = "aws_access_key_id_value",
+    "secret_access_key" = "aws_secret_access_key_value"
+  })
+  worker_filter = "\"pki\" in \"/tags/type\""
+}
+
 resource "boundary_target" "foo" {
   name         = "foo"
   description  = "Foo target"
+  type         = "tcp"
   default_port = "22"
   scope_id     = boundary_scope.project.id
-  host_set_ids = [
+  host_source_ids = [
     boundary_host_set.foo.id
   ]
+  brokered_credential_source_ids = [
+    boundary_credential_library_vault.foo.id
+  ]
+}
+
+resource "boundary_target" "ssh_foo" {
+  name         = "ssh_foo"
+  description  = "Ssh target"
+  type         = "ssh"
+  default_port = "22"
+  scope_id     = boundary_scope.project.id
+  host_source_ids = [
+    boundary_host_set.foo.id
+  ]
+  injected_application_credential_source_ids = [
+    boundary_credential_library_vault.foo.id
+  ]
+}
+
+resource "boundary_target" "ssh_session_recording_foo" {
+  name         = "ssh_foo"
+  description  = "Ssh target"
+  type         = "ssh"
+  default_port = "22"
+  scope_id     = boundary_scope.project.id
+  host_source_ids = [
+    boundary_host_set.foo.id
+  ]
+  injected_application_credential_source_ids = [
+    boundary_credential_library_vault.foo.id
+  ]
+  enable_session_recording = true
+  storage_bucket_id        = boundary_storage_bucket.aws_example
+}
+
+resource "boundary_target" "address_foo" {
+  name         = "address_foo"
+  description  = "Foo target with an address"
+  type         = "tcp"
+  default_port = "22"
+  scope_id     = boundary_scope.project.id
+  address      = "127.0.0.1"
 }
 ```
 
@@ -80,22 +155,30 @@ resource "boundary_target" "foo" {
 
 ### Required
 
-- **scope_id** (String) The scope ID in which the resource is created. Defaults to the provider's `default_scope` if unset.
+- `scope_id` (String) The scope ID in which the resource is created. Defaults to the provider's `default_scope` if unset.
-- **type** (String) The target resource type.
+- `type` (String) The target resource type.
 
 ### Optional
 
-- **default_port** (Number) The default port for this target.
+- `address` (String) Optionally, a valid network address to connect to for this target. Cannot be used alongside host_source_ids.
-- **description** (String) The target description.
+- `brokered_credential_source_ids` (Set of String) A list of brokered credential source ID's.
-- **host_set_ids** (Set of String) A list of host set ID's.
+- `default_client_port` (Number) The default client port for this target.
-- **name** (String) The target name. Defaults to the resource name.
+- `default_port` (Number) The default port for this target.
-- **session_connection_limit** (Number)
+- `description` (String) The target description.
-- **session_max_seconds** (Number)
+- `egress_worker_filter` (String) Boolean expression to filter the workers used to access this target
-- **worker_filter** (String) Boolean expression to filter the workers for this target
+- `enable_session_recording` (Boolean) HCP/Ent Only. Enable sessions recording for this target. Only applicable for SSH targets.
+- `host_source_ids` (Set of String) A list of host source ID's. Cannot be used alongside address.
+- `ingress_worker_filter` (String) HCP Only. Boolean expression to filter the workers a user will connect to when initiating a session against this target
+- `injected_application_credential_source_ids` (Set of String) A list of injected application credential source ID's.
+- `name` (String) The target name. Defaults to the resource name.
+- `session_connection_limit` (Number)
+- `session_max_seconds` (Number)
+- `storage_bucket_id` (String) HCP/Ent Only. Storage bucket for this target. Only applicable for SSH targets.
+- `worker_filter` (String, Deprecated) Boolean expression to filter the workers for this target
 
 ### Read-Only
 
-- **id** (String) The ID of the target.
+- `id` (String) The ID of the target.
 
 ## Import
 

docs/resources/user.md

@@ -26,7 +26,7 @@ resource "boundary_auth_method" "password" {
   type     = "password"
 }
 
-resource "boundary_account" "jeff" {
+resource "boundary_account_password" "jeff" {
   auth_method_id = boundary_auth_method.password.id
   type           = "password"
   login_name     = "jeff"
@@ -36,7 +36,7 @@ resource "boundary_account" "jeff" {
 resource "boundary_user" "jeff" {
   name        = "jeff"
   description = "Jeff's user resource"
-  account_ids = [boundary_account.jeff.id]
+  account_ids = [boundary_account_password.jeff.id]
   scope_id    = boundary_scope.org.id
 }
 ```
@@ -46,17 +46,17 @@ resource "boundary_user" "jeff" {
 
 ### Required
 
-- **scope_id** (String) The scope ID in which the resource is created. Defaults to the provider's `default_scope` if unset.
+- `scope_id` (String) The scope ID in which the resource is created. Defaults to the provider's `default_scope` if unset.
 
 ### Optional
 
-- **account_ids** (Set of String) Account ID's to associate with this user resource.
+- `account_ids` (Set of String) Account ID's to associate with this user resource.
-- **description** (String) The user description.
+- `description` (String) The user description.
-- **name** (String) The username. Defaults to the resource name.
+- `name` (String) The username. Defaults to the resource name.
 
 ### Read-Only
 
-- **id** (String) The ID of the user.
+- `id` (String) The ID of the user.
 
 ## Import
 

docs/resources/worker.md

@@ -0,0 +1,54 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_worker Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The resource allows you to create a self-managed worker object.
+---
+
+# boundary_worker (Resource)
+
+The resource allows you to create a self-managed worker object.
+
+## Example Usage
+
+```terraform
+resource "boundary_worker" "controller_led" {
+  scope_id    = "global"
+  name        = "worker 1"
+  description = "self managed worker with controller led auth"
+}
+
+resource "boundary_worker" "worker_led" {
+  scope_id                    = "global"
+  name                        = "worker 2"
+  description                 = "self managed worker with worker led auth"
+  worker_generated_auth_token = var.worker_generated_auth_token
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Optional
+
+- `description` (String) The description for the worker.
+- `name` (String) The name for the worker.
+- `scope_id` (String) The scope for the worker. Defaults to `global`.
+- `worker_generated_auth_token` (String) The worker authentication token required to register the worker for the worker-led authentication flow. Leaving this blank will result in a controller generated token.
+
+### Read-Only
+
+- `address` (String) The accessible address of the self managed worker.
+- `authorized_actions` (List of String) A list of actions that the worker is entitled to perform.
+- `controller_generated_activation_token` (String) A single use token generated by the controller to be passed to the self-managed worker.
+- `id` (String) The ID of the worker.
+- `release_version` (Number) The version of the Boundary binary running on the self managed worker.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_worker.foo <my-id>
+```

examples/data-sources/boundary_account/data-source.tf

@@ -0,0 +1,5 @@
+# Retrieve the ID of a Boundary account
+data "boundary_account" "admin" {
+  name           = "admin"
+  auth_method_id = "ampw_1234567890"
+}

examples/data-sources/boundary_auth_method/data-source.tf

@@ -0,0 +1,15 @@
+# Retrieve an auth method from the global scope
+data "boundary_auth_method" "auth_method" {
+  name = "password_auth_method"
+}
+
+# Auth method from a org scope
+data "boundary_scope" "org" {
+  name     = "my-org"
+  scope_id = "global"
+}
+
+data "boundary_auth_method" "auth_method" {
+  name     = "password_auth_method"
+  scope_id = data.boundary_scope.org.id
+}

examples/data-sources/boundary_group/data-source.tf

@@ -0,0 +1,15 @@
+# Retrieve a user from the global scope
+data "boundary_group" "global_group" {
+  name = "admin"
+}
+
+# User from an org scope
+data "boundary_scope" "org" {
+  name     = "org"
+  scope_id = "global"
+}
+
+data "boundary_group" "org_group" {
+  name     = "username"
+  scope_id = data.boundary_scope.org.id
+}

examples/data-sources/boundary_scope/data-source.tf

@@ -0,0 +1,10 @@
+# Retrieve the ID of a Boundary project
+data "boundary_scope" "org" {
+  name     = "SecOps"
+  scope_id = "global"
+}
+
+data "boundary_scope" "project" {
+  name     = "2111"
+  scope_id = data.boundary_scope.id
+}

examples/data-sources/boundary_user/data-source.tf

@@ -0,0 +1,15 @@
+# Retrieve a user from the global scope
+data "boundary_user" "global_scope_admin" {
+  name = "admin"
+}
+
+# User from a org scope
+data "boundary_user" "org_user" {
+  name     = "username"
+  scope_id = data.boundary_scope.org.id
+}
+
+data "boundary_scope" "org" {
+  name     = "my-org"
+  scope_id = data.boundary_scope.org.id
+}

examples/provider/provider.tf

@@ -4,3 +4,16 @@ provider "boundary" {
   password_auth_method_login_name = "myuser"          # changeme
   password_auth_method_password   = "passpass"        # changeme
 }
+
+provider "boundary" {
+  addr                            = "http://127.0.0.1:9200"
+  password_auth_method_login_name = "myuser"
+  password_auth_method_password   = "passpass"
+}
+
+provider "boundary" {
+  addr                            = "http://127.0.0.1:9200"
+  password_auth_method_login_name = "myuser"
+  password_auth_method_password   = "passpass"
+  scope_id                        = "s_1234567890"
+}

examples/resources/boundary_account/import.sh

@@ -1 +0,0 @@
-terraform import boundary_account.foo <my-id>

examples/resources/boundary_account_ldap/import.sh

@@ -0,0 +1 @@
+terraform import boundary_account_ldap.foo <my-id>

examples/resources/boundary_account_ldap/resource.tf

@@ -0,0 +1,34 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_auth_method_ldap" "forumsys_ldap" {
+  name          = "forumsys public LDAP"
+  scope_id      = "global"                               # add the new auth method to the global scope
+  urls          = ["ldap://ldap.forumsys.com"]           # the addr of the LDAP server
+  user_dn       = "dc=example,dc=com"                    # the basedn for users
+  user_attr     = "uid"                                  # the user attribute
+  group_dn      = "dc=example,dc=com"                    # the basedn for groups
+  bind_dn       = "cn=read-only-admin,dc=example,dc=com" # the dn to use when binding
+  bind_password = "password"                             # passwd to use when binding
+  state         = "active-public"                        # make sure the new auth-method is available to everyone
+  enable_groups = true                                   # this turns-on the discovery of a user's groups
+  discover_dn   = true                                   # this turns-on the discovery of an authenticating user's dn
+}
+
+resource "boundary_account_ldap" "einstein" {
+  auth_method_id = boundary_auth_method_ldap.forumsys_ldap.id
+  login_name     = "einstein"
+  name           = "einstein"
+}
+
+resource "boundary_user" "einstein" {
+  name        = "einstein"
+  description = "User resource for einstein"
+  scope_id    = "global"
+  account_ids = [boundary_account_ldap.einstein.id]
+}

examples/resources/boundary_account_password/import.sh

@@ -0,0 +1 @@
+terraform import boundary_account_password.foo <my-id>

examples/resources/boundary_account_password/resource.tf

@@ -11,9 +11,8 @@ resource "boundary_auth_method" "password" {
   type     = "password"
 }
 
-resource "boundary_account" "jeff" {
+resource "boundary_account_password" "jeff" {
   auth_method_id = boundary_auth_method.password.id
-  type           = "password"
   login_name     = "jeff"
   password       = "$uper$ecure"
 }

examples/resources/boundary_auth_method_ldap/import.sh

@@ -0,0 +1 @@
+terraform import boundary_auth_method_ldap.foo <my-id>

examples/resources/boundary_auth_method_ldap/resource.tf

@@ -0,0 +1,21 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_auth_method_ldap" "forumsys_ldap" {
+  name          = "forumsys public LDAP"
+  scope_id      = "global"                               # add the new auth method to the global scope
+  urls          = ["ldap://ldap.forumsys.com"]           # the addr of the LDAP server
+  user_dn       = "dc=example,dc=com"                    # the basedn for users
+  user_attr     = "uid"                                  # the user attribute
+  group_dn      = "dc=example,dc=com"                    # the basedn for groups
+  bind_dn       = "cn=read-only-admin,dc=example,dc=com" # the dn to use when binding
+  bind_password = "password"                             # passwd to use when binding
+  state         = "active-public"                        # make sure the new auth-method is available to everyone
+  enable_groups = true                                   # this turns-on the discovery of a user's groups
+  discover_dn   = true                                   # this turns-on the discovery of an authenticating user's dn
+}

examples/resources/boundary_auth_method_oidc/import.sh

@@ -0,0 +1 @@
+terraform import boundary_auth_method_oidc.foo <my-id>

examples/resources/boundary_auth_method_oidc/resource.tf

@@ -0,0 +1,42 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_auth_method_oidc" "vault" {
+  api_url_prefix     = "https://XO-XO-XO-XO-XOXOXO.boundary.hashicorp.cloud:9200"
+  client_id          = "eieio"
+  client_secret      = "hvo_secret_XO"
+  description        = "My Boundary OIDC Auth Method for Vault"
+  issuer             = "https://XO-XO-XO-XO-XOXOXO.vault.hashicorp.cloud:8200/v1/identity/oidc/provider/my-provider"
+  scope_id           = "global"
+  signing_algorithms = ["RS256"]
+  type               = "oidc"
+}
+
+resource "boundary_auth_method_oidc" "oidc_with_one_prompt" {
+  api_url_prefix     = "https://XO-XO-XO-XO-XOXOXO.boundary.hashicorp.cloud:9200"
+  client_id          = "eieio"
+  client_secret      = "hvo_secret_XO"
+  description        = "My Boundary OIDC Auth Method With Prompt"
+  issuer             = "https://sts.windows.net/TENANT_ID/"
+  scope_id           = "global"
+  signing_algorithms = ["RS256"]
+  prompts            = ["select_account"]
+  type               = "oidc"
+}
+
+resource "boundary_auth_method_oidc" "oidc_with_multiple_prompts" {
+  api_url_prefix     = "https://XO-XO-XO-XO-XOXOXO.boundary.hashicorp.cloud:9200"
+  client_id          = "eieio"
+  client_secret      = "hvo_secret_XO"
+  description        = "My Boundary OIDC Auth Method With Multiple Prompts"
+  issuer             = "https://sts.windows.net/TENANT_ID/"
+  scope_id           = "global"
+  signing_algorithms = ["RS256"]
+  prompts            = ["consent", "select_account"]
+  type               = "oidc"
+}

examples/resources/boundary_credential_json/import.sh

@@ -0,0 +1 @@
+terraform import boundary_credential_json.example_json <my-id>

examples/resources/boundary_credential_json/resource.tf

@@ -0,0 +1,27 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_static" "example" {
+  name        = "example_static_credential_store"
+  description = "My first static credential store!"
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_json" "example" {
+  name                = "example_json"
+  description         = "My first json credential!"
+  credential_store_id = boundary_credential_store_static.example.id
+  object              = file("~/object.json") # change to valid json file
+}

examples/resources/boundary_credential_library_vault/import.sh

@@ -0,0 +1 @@
+terraform import boundary_credential_library_vault.foo <my-id>

examples/resources/boundary_credential_library_vault/resource.tf

@@ -0,0 +1,70 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_vault" "foo" {
+  name        = "foo"
+  description = "My first Vault credential store!"
+  address     = "http://127.0.0.1:8200"      # change to Vault address
+  token       = "s.0ufRo6XEGU2jOqnIr7OlFYP5" # change to valid Vault token
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_library_vault" "foo" {
+  name                = "foo"
+  description         = "My first Vault credential library!"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "my/secret/foo" # change to Vault backend path
+  http_method         = "GET"
+}
+
+resource "boundary_credential_library_vault" "bar" {
+  name                = "bar"
+  description         = "My second Vault credential library!"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "my/secret/bar" # change to Vault backend path
+  http_method         = "POST"
+  http_request_body   = <<EOT
+{
+  "key": "Value",
+}
+EOT
+}
+
+resource "boundary_credential_library_vault" "baz" {
+  name                = "baz"
+  description         = "vault username password credential with mapping overrides"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "my/secret/baz" # change to Vault backend path
+  http_method         = "GET"
+  credential_type     = "username_password"
+  credential_mapping_overrides = {
+    password_attribute = "alternative_password_label"
+    username_attribute = "alternative_username_label"
+  }
+}
+
+resource "boundary_credential_library_vault" "quz" {
+  name                = "quz"
+  description         = "vault ssh private key credential with mapping overrides"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "my/secret/quz" # change to Vault backend path
+  http_method         = "GET"
+  credential_type     = "ssh_private_key"
+  credential_mapping_overrides = {
+    private_key_attribute            = "alternative_key_label"
+    private_key_passphrase_attribute = "alternative_passphrase_label"
+    username_attribute               = "alternative_username_label"
+  }
+}

examples/resources/boundary_credential_library_vault_ssh_certificate/import.sh

@@ -0,0 +1 @@
+terraform import boundary_credential_library_vault_ssh_certificate.foo <my-id>

examples/resources/boundary_credential_library_vault_ssh_certificate/resource.tf

@@ -0,0 +1,63 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_vault" "foo" {
+  name        = "foo"
+  description = "My first Vault credential store!"
+  address     = "http://127.0.0.1:8200"      # change to Vault address
+  token       = "s.0ufRo6XEGU2jOqnIr7OlFYP5" # change to valid Vault token
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_library_vault_ssh_certificate" "foo" {
+  name                = "foo"
+  description         = "My first Vault SSH certificate credential library!"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "ssh/sign/foo" # change to correct Vault endpoint and role
+  username            = "foo"          # change to valid username
+}
+
+resource "boundary_credential_library_vault_ssh_certificate" "bar" {
+  name                = "bar"
+  description         = "My second Vault SSH certificate credential library!"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "ssh/sign/foo" # change to correct Vault endpoint and role
+  username            = "foo"
+  key_type            = "ecdsa"
+  key_bits            = 384
+
+  extensions = {
+    permit-pty = ""
+  }
+}
+
+resource "boundary_credential_library_vault_ssh_certificate" "baz" {
+  name                = "baz"
+  description         = "vault "
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "ssh/issue/foo" # change to correct Vault endpoint and role
+  username            = "foo"
+  key_type            = "rsa"
+  key_bits            = 4096
+
+  extensions = {
+    permit-pty            = ""
+    permit-X11-forwarding = ""
+  }
+
+  critical_options = {
+    force-command = "/bin/some_script"
+  }
+}

examples/resources/boundary_credential_ssh_private_key/import.sh

@@ -0,0 +1 @@
+terraform import boundary_credential_ssh_private_key.example_ssh_private_key <my-id>

examples/resources/boundary_credential_ssh_private_key/resource.tf

@@ -0,0 +1,29 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_static" "example" {
+  name        = "example_static_credential_store"
+  description = "My first static credential store!"
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_ssh_private_key" "example" {
+  name                   = "example_ssh_private_key"
+  description            = "My first ssh private key credential!"
+  credential_store_id    = boundary_credential_store_static.example.id
+  username               = "my-username"
+  private_key            = file("~/.ssh/id_rsa") # change to valid SSH Private Key
+  private_key_passphrase = "optional-passphrase" # change to the passphrase of the Private Key if required
+}

examples/resources/boundary_credential_store_static/import.sh

@@ -0,0 +1 @@
+terraform import boundary_credential_store_static.example_static_credential_store <my-id>

examples/resources/boundary_credential_store_static/resource.tf

@@ -0,0 +1,20 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_static" "example" {
+  name        = "example_static_credential_store"
+  description = "My first static credential store!"
+  scope_id    = boundary_scope.project.id
+}

examples/resources/boundary_credential_store_vault/import.sh

@@ -0,0 +1 @@
+terraform import boundary_credential_store_vault.foo <my-id>

examples/resources/boundary_credential_store_vault/resource.tf

@@ -0,0 +1,22 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_vault" "example" {
+  name        = "foo"
+  description = "My first Vault credential store!"
+  address     = "http://127.0.0.1:8200"      # change to Vault address
+  token       = "s.0ufRo6XEGU2jOqnIr7OlFYP5" # change to valid Vault token
+  scope_id    = boundary_scope.project.id
+}

examples/resources/boundary_credential_username_password/import.sh

@@ -0,0 +1 @@
+terraform import boundary_credential_username_password.example_username_password <my-id>

examples/resources/boundary_credential_username_password/resource.tf

@@ -0,0 +1,28 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_static" "example" {
+  name        = "example_static_credential_store"
+  description = "My first static credential store!"
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_username_password" "example" {
+  name                = "example_username_password"
+  description         = "My first username password credential!"
+  credential_store_id = boundary_credential_store_static.example.id
+  username            = "my-username"
+  password            = "my-password"
+}

examples/resources/boundary_host/resource.tf

@@ -13,9 +13,17 @@ resource "boundary_scope" "project" {
   auto_create_admin_role = true
 }
 
-resource "boundary_host" "example" {
+resource "boundary_host_catalog" "static" {
-  name        = "example_host"
+  name        = "My catalog"
-  description = "My first host!"
+  description = "My first host catalog!"
-  address     = "10.0.0.1"
+  type        = "static"
   scope_id    = boundary_scope.project.id
 }
+
+resource "boundary_host" "example" {
+  type            = "static"
+  name            = "example_host"
+  description     = "My first host!"
+  address         = "10.0.0.1"
+  host_catalog_id = boundary_host_catalog.static.id
+}

examples/resources/boundary_host_catalog_plugin/import.sh

@@ -0,0 +1 @@
+terraform import boundary_host_catalog_plugin.foo <my-id>

examples/resources/boundary_host_catalog_plugin/resource.tf

@@ -0,0 +1,60 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = boundary_scope.global.id
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+# For more information about the aws plugin, please visit here:
+# https://github.com/hashicorp/boundary-plugin-host-aws
+#
+# For more information about aws users, please visit here:
+# https://learn.hashicorp.com/tutorials/boundary/aws-host-catalogs?in=boundary/oss-access-management#configure-terraform-and-iam-user-privileges
+resource "boundary_host_catalog_plugin" "aws_example" {
+  name            = "My aws catalog"
+  description     = "My first host catalog!"
+  scope_id        = boundary_scope.project.id
+  plugin_name     = "aws"
+  attributes_json = jsonencode({ "region" = "us-east-1" })
+
+  # recommended to pass in aws secrets using a file() or using environment variables
+  # the secrets below must be generated in aws by creating a aws iam user with programmatic access
+  secrets_json = jsonencode({
+    "access_key_id"     = "aws_access_key_id_value",
+    "secret_access_key" = "aws_secret_access_key_value"
+  })
+}
+
+# For more information about the azure plugin, please visit here:
+# https://github.com/hashicorp/boundary-plugin-host-azure
+#
+# For more information about azure ad applications, please visit here:
+# https://learn.hashicorp.com/tutorials/boundary/azure-host-catalogs#register-a-new-azure-ad-application-1
+resource "boundary_host_catalog_plugin" "azure_example" {
+  name        = "My azure catalog"
+  description = "My second host catalog!"
+  scope_id    = boundary_scope.project.id
+  plugin_name = "azure"
+
+  # the attributes below must be generated in azure by creating an ad application
+  attributes_json = jsonencode({
+    "disable_credential_rotation" = "true",
+    "tenant_id"                   = "ARM_TENANT_ID",
+    "subscription_id"             = "ARM_SUBSCRIPTION_ID",
+    "client_id"                   = "ARM_CLIENT_ID"
+  })
+
+  # recommended to pass in azure secrets using a file() or using environment variables
+  # the secrets below must be generated in azure by creating an ad application
+  secrets_json = jsonencode({
+    "secret_value" = "ARM_CLIENT_SECRET"
+  })
+}

examples/resources/boundary_host_catalog_static/import.sh

@@ -0,0 +1 @@
+terraform import boundary_host_catalog_static.foo <my-id>

examples/resources/boundary_host_catalog_static/resource.tf

@@ -0,0 +1,20 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = boundary_scope.global.id
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_host_catalog_static" "example" {
+  name        = "My catalog"
+  description = "My first host catalog!"
+  scope_id    = boundary_scope.project.id
+}

examples/resources/boundary_host_set/resource.tf

@@ -14,29 +14,31 @@ resource "boundary_scope" "project" {
 }
 
 resource "boundary_host_catalog" "static" {
+  type     = "static"
   scope_id = boundary_scope.project.id
 }
 
-resource "boundary_host" "1" {
+resource "boundary_host" "first" {
+  type            = "static"
   name            = "host_1"
   description     = "My first host!"
   address         = "10.0.0.1"
   host_catalog_id = boundary_host_catalog.static.id
-  scope_id        = boundary_scope.project.id
 }
 
-resource "boundary_host" "2" {
+resource "boundary_host" "second" {
+  type            = "static"
   name            = "host_2"
   description     = "My second host!"
   address         = "10.0.0.2"
   host_catalog_id = boundary_host_catalog.static.id
-  scope_id        = boundary_scope.project.id
 }
 
 resource "boundary_host_set" "web" {
   host_catalog_id = boundary_host_catalog.static.id
+  type            = "static"
   host_ids = [
-    boundary_host.1.id,
+    boundary_host.first.id,
-    boundary_host.2.id,
+    boundary_host.second.id,
   ]
 }

examples/resources/boundary_host_set_plugin/import.sh

@@ -0,0 +1 @@
+terraform import boundary_host_set_plugin.foo <my-id>

examples/resources/boundary_host_set_plugin/resource.tf

@@ -0,0 +1,101 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+# For more information about the aws plugin, please visit here:
+# https://github.com/hashicorp/boundary-plugin-host-aws
+#
+# For more information about aws users, please visit here:
+# https://learn.hashicorp.com/tutorials/boundary/aws-host-catalogs?in=boundary/oss-access-management#configure-terraform-and-iam-user-privileges
+resource "boundary_host_catalog_plugin" "aws_example" {
+  name            = "My aws catalog"
+  description     = "My first host catalog!"
+  scope_id        = boundary_scope.project.id
+  plugin_name     = "aws"
+  attributes_json = jsonencode({ "region" = "us-east-1" })
+
+  # recommended to pass in aws secrets using a file() or using environment variables
+  # the secrets below must be generated in aws by creating a aws iam user with programmatic access
+  secrets_json = jsonencode({
+    "access_key_id"     = "aws_access_key_id_value",
+    "secret_access_key" = "aws_secret_access_key_value"
+  })
+}
+
+resource "boundary_host_set_plugin" "web" {
+  name            = "My web host set plugin"
+  host_catalog_id = boundary_host_catalog_plugin.aws_example.id
+  attributes_json = jsonencode({ "filters" = ["tag:service-type=web"] })
+}
+
+resource "boundary_host_set_plugin" "foobar" {
+  name                = "My foobar host set plugin"
+  host_catalog_id     = boundary_host_catalog_plugin.aws_example.id
+  preferred_endpoints = ["cidr:54.0.0.0/8"]
+  attributes_json = jsonencode({
+    "filters" = ["tag-key=foo", "tag-key=bar"]
+  })
+}
+
+resource "boundary_host_set_plugin" "launch" {
+  name                  = "My launch host set plugin"
+  host_catalog_id       = boundary_host_catalog_plugin.aws_example.id
+  sync_interval_seconds = 60
+  attributes_json = jsonencode({
+    "filters" = ["tag:development=prod,dev", "launch-time=2022-01-04T*"]
+  })
+}
+
+# For more information about the azure plugin, please visit here:
+# https://github.com/hashicorp/boundary-plugin-host-azure
+#
+# For more information about azure ad applications, please visit here:
+# https://learn.hashicorp.com/tutorials/boundary/azure-host-catalogs#register-a-new-azure-ad-application-1
+resource "boundary_host_catalog_plugin" "azure_example" {
+  name        = "My azure catalog"
+  description = "My second host catalog!"
+  scope_id    = boundary_scope.project.id
+  plugin_name = "azure"
+
+  # the attributes below must be generated in azure by creating an ad application
+  attributes_json = jsonencode({
+    "disable_credential_rotation" = "true",
+    "tenant_id"                   = "ARM_TENANT_ID",
+    "subscription_id"             = "ARM_SUBSCRIPTION_ID",
+    "client_id"                   = "ARM_CLIENT_ID"
+  })
+
+  # recommended to pass in azure secrets using a file() or using environment variables
+  # the secrets below must be generated in azure by creating an ad application
+  secrets_json = jsonencode({
+    "secret_value" = "ARM_CLIENT_SECRET"
+  })
+}
+
+resource "boundary_host_set_plugin" "database" {
+  name            = "My database host set plugin"
+  host_catalog_id = boundary_host_catalog_plugin.azure_example.id
+  attributes_json = jsonencode({ "filter" = "tagName eq 'service-type' and tagValue eq 'database'" })
+}
+
+resource "boundary_host_set_plugin" "foodev" {
+  name                  = "My foodev host set plugin"
+  host_catalog_id       = boundary_host_catalog_plugin.azure_example.id
+  preferred_endpoints   = ["cidr:54.0.0.0/8"]
+  sync_interval_seconds = 60
+  attributes_json = jsonencode({
+    "filter" = "tagName eq 'tag-key' and tagValue eq 'foo'",
+    "filter" = "tagName eq 'application' and tagValue eq 'dev'",
+  })
+}

examples/resources/boundary_host_set_static/import.sh

@@ -0,0 +1 @@
+terraform import boundary_host_set_static.foo <my-id>

examples/resources/boundary_host_set_static/resource.tf

@@ -0,0 +1,40 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_host_catalog_static" "example" {
+  scope_id = boundary_scope.project.id
+}
+
+resource "boundary_host_static" "first" {
+  name            = "host_1"
+  description     = "My first host!"
+  address         = "10.0.0.1"
+  host_catalog_id = boundary_host_catalog_static.example.id
+}
+
+resource "boundary_host_static" "second" {
+  name            = "host_2"
+  description     = "My second host!"
+  address         = "10.0.0.2"
+  host_catalog_id = boundary_host_catalog_static.example.id
+}
+
+resource "boundary_host_set_static" "web" {
+  host_catalog_id = boundary_host_catalog_static.example.id
+  host_ids = [
+    boundary_host_static.first.id,
+    boundary_host_static.second.id,
+  ]
+}

examples/resources/boundary_host_static/import.sh

@@ -0,0 +1 @@
+terraform import boundary_host_static.foo <my-id>