chore: run go generate

* add username password resource

* fix a few bugs in the tf code as well as complete tests with copied crypto code

* address PR comments

* clean up all of the hmac testing code

* remove plan only in test and fix some descriptions per PR

.gitignore

@@ -35,4 +35,4 @@ website/vendor
 *.winfile eol=crlf
 
 # Compilation outputs
-/plugins/kms/assets/boundary-plugin*
+/plugins/kms/assets/*/*/boundary-plugin*

.go-version

@@ -1 +1 @@
-1.18.1
+1.18.4

.goreleaser.yml

@@ -7,7 +7,7 @@ archives:
 before:
   hooks:
     - 'go mod download'
-    - './scripts/plugins.sh'
+    - './scripts/plugins-all.sh'
 builds:
   - # Binary naming only required for Terraform CLI 0.12
     binary: '{{ .ProjectName }}_v{{ .Version }}_x5'

CHANGELOG.md

@@ -1,3 +1,39 @@
+# Boundary Terraform Provider CHANGELOG
+
+Canonical reference for changes, improvements, and bugfixes for the Boundary Terraform provider.
+
+## 1.0.11 (August 26, 2022)
+
+### New and Improved
+
+* Add support for SSH private key credentials
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/257)).
+* Add support for credential type in Vault libraries
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/257)).
+
+## 1.0.10 (August 10, 2022)
+
+### New and Improved
+
+* Adds support for static credential stores
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/236)).
+* Adds support for username password credentials 
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/242)).
+
+## 1.0.9 (June 6, 2022)
+
+### Bug Fixes
+
+* The bug fix released in 1.0.8 to resolve the `plugin is nil` error only worked for 
+  Linux AMD64. This was due to a build issue where the plugin binaries were only built for 
+  Linux AMD64. Other platforms would receive an error similar to:
+
+            Error: error reading wrappers from "recovery_kms_hcl":
+            Error configuring kms: error fetching kms plugin rpc client: 
+            fork/exec boundary-plugin-kms-awskms.gz: exec format error
+  ([Issue](https://github.com/hashicorp/terraform-provider-boundary/issues/209)),
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/216)).
+
 ## 1.0.8 (June 1, 2022)
 
 ### Bug Fixes

Makefile

@@ -44,7 +44,7 @@ install-go: ~/.go/bin/go
 	./ci/goinstall.sh
 
 dev:
-	./scripts/plugins.sh
+	GOOS=${GOOS} GOARCH=${GOARCH} ./scripts/plugins.sh
 	mkdir -p $(INSTALL_PATH)
 	go build -o $(INSTALL_PATH)/terraform-provider-boundary main.go
 

ci/goinstall.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 set -e
 
-VERSION="1.18.1"
+VERSION="1.18.4"
 
 [ -z "$GOROOT" ] && GOROOT="$HOME/.go"
 [ -z "$GOPATH" ] && GOPATH="$HOME/go"

docs/resources/account.md

@@ -3,12 +3,12 @@
 page_title: "boundary_account Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  Deprecated: use resource_account_password instead.
+  Deprecated: use boundary_account_password instead.
 ---
 
 # boundary_account (Resource)
 
-Deprecated: use `resource_account_password` instead.
+Deprecated: use `boundary_account_password` instead.
 
 
 

docs/resources/credential_library_vault.md

@@ -68,6 +68,7 @@ EOT
 
 ### Optional
 
+- `credential_type` (String) The type of credential the library generates.
 - `description` (String) The Vault credential library description.
 - `http_method` (String) The HTTP method the library uses when requesting credentials from Vault. Defaults to 'GET'
 - `http_request_body` (String) The body of the HTTP request the library sends to Vault when requesting credentials. Only valid if `http_method` is set to `POST`.

docs/resources/credential_ssh_private_key.md

@@ -0,0 +1,74 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_credential_ssh_private_key Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The SSH private key credential resource allows you to configure a credential using a username, private key and optional passphrase.
+---
+
+# boundary_credential_ssh_private_key (Resource)
+
+The SSH private key credential resource allows you to configure a credential using a username, private key and optional passphrase.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_static" "example" {
+  name        = "example_static_credential_store"
+  description = "My first static credential store!"
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_ssh_private_key" "example" {
+  name                   = "example_ssh_private_key"
+  description            = "My first ssh private key credential!"
+  credential_store_id    = boundary_credential_store_static.example.id
+  username               = "my-username"
+  private_key            = file("~/.ssh/id_rsa") # change to valid SSH Private Key
+  private_key_passphrase = "optional-passphrase" # change to the passphrase of the Private Key if required
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `credential_store_id` (String) ID of the credential store this credential belongs to.
+- `private_key` (String) The private key associated with the credential.
+- `username` (String) The username associated with the credential.
+
+### Optional
+
+- `description` (String) The description of the credential.
+- `name` (String) The name of the credential. Defaults to the resource name.
+- `private_key_passphrase` (String) The passphrase of the private key associated with the credential.
+
+### Read-Only
+
+- `id` (String) The ID of the credential.
+- `private_key_hmac` (String) The private key hmac.
+- `private_key_passphrase_hmac` (String) The private key passphrase hmac.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_credential_ssh_private_key.example_ssh_private_key <my-id>
+```

docs/resources/credential_store_static.md

@@ -0,0 +1,60 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_credential_store_static Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The static credential store resource allows you to configure a Boundary static credential store.
+---
+
+# boundary_credential_store_static (Resource)
+
+The static credential store resource allows you to configure a Boundary static credential store.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_static" "example" {
+  name        = "example_static_credential_store"
+  description = "My first static credential store!"
+  scope_id    = boundary_scope.project.id
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `scope_id` (String) The scope for this credential store.
+
+### Optional
+
+- `description` (String) The static credential store description.
+- `name` (String) The static credential store name. Defaults to the resource name.
+
+### Read-Only
+
+- `id` (String) The ID of the static credential store.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_credential_store_static.example_static_credential_store <my-id>
+```

docs/resources/credential_username_password.md

@@ -0,0 +1,71 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_credential_username_password Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The username/password credential resource allows you to configure a credential using a username and password pair.
+---
+
+# boundary_credential_username_password (Resource)
+
+The username/password credential resource allows you to configure a credential using a username and password pair.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_static" "example" {
+  name        = "example_static_credential_store"
+  description = "My first static credential store!"
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_username_password" "example" {
+  name                = "example_username_password"
+  description         = "My first username password credential!"
+  credential_store_id = boundary_credential_store_static.example.id
+  username            = "my-username"
+  password            = "my-password"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `credential_store_id` (String) The credential store in which to save this username/password credential.
+- `password` (String) The password of this username/password credential.
+- `username` (String) The username of this username/password credential.
+
+### Optional
+
+- `description` (String) The description of this username/password credential.
+- `name` (String) The name of this username/password credential. Defaults to the resource name.
+
+### Read-Only
+
+- `id` (String) The ID of this username/password credential.
+- `password_hmac` (String) The password hmac.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_credential_username_password.example_username_password <my-id>
+```

docs/resources/host.md

@@ -3,12 +3,12 @@
 page_title: "boundary_host Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  Deprecated: use resource_host_static instead.
+  Deprecated: use boundary_host_static instead.
 ---
 
 # boundary_host (Resource)
 
-Deprecated: use `resource_host_static` instead.
+Deprecated: use `boundary_host_static` instead.
 
 ## Example Usage
 

docs/resources/host_catalog.md

@@ -3,12 +3,12 @@
 page_title: "boundary_host_catalog Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  Deprecated: use resource_host_catalog_static instead.
+  Deprecated: use boundary_host_catalog_static instead.
 ---
 
 # boundary_host_catalog (Resource)
 
-Deprecated: use `resource_host_catalog_static` instead.
+Deprecated: use `boundary_host_catalog_static` instead.
 
 ## Example Usage
 

docs/resources/host_set.md

@@ -3,12 +3,12 @@
 page_title: "boundary_host_set Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  Deprecated: use resource_host_set_static instead.
+  Deprecated: use boundary_host_set_static instead.
 ---
 
 # boundary_host_set (Resource)
 
-Deprecated: use `resource_host_set_static` instead.
+Deprecated: use `boundary_host_set_static` instead.
 
 ## Example Usage
 

examples/resources/boundary_credential_ssh_private_key/import.sh

@@ -0,0 +1 @@
+terraform import boundary_credential_ssh_private_key.example_ssh_private_key <my-id>

examples/resources/boundary_credential_ssh_private_key/resource.tf

@@ -0,0 +1,29 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_static" "example" {
+  name        = "example_static_credential_store"
+  description = "My first static credential store!"
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_ssh_private_key" "example" {
+  name                   = "example_ssh_private_key"
+  description            = "My first ssh private key credential!"
+  credential_store_id    = boundary_credential_store_static.example.id
+  username               = "my-username"
+  private_key            = file("~/.ssh/id_rsa") # change to valid SSH Private Key
+  private_key_passphrase = "optional-passphrase" # change to the passphrase of the Private Key if required
+}

examples/resources/boundary_credential_store_static/import.sh

@@ -0,0 +1 @@
+terraform import boundary_credential_store_static.example_static_credential_store <my-id>

examples/resources/boundary_credential_store_static/resource.tf

@@ -0,0 +1,20 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_static" "example" {
+  name        = "example_static_credential_store"
+  description = "My first static credential store!"
+  scope_id    = boundary_scope.project.id
+}

examples/resources/boundary_credential_username_password/import.sh

@@ -0,0 +1 @@
+terraform import boundary_credential_username_password.example_username_password <my-id>

examples/resources/boundary_credential_username_password/resource.tf

@@ -0,0 +1,28 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_static" "example" {
+  name        = "example_static_credential_store"
+  description = "My first static credential store!"
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_username_password" "example" {
+  name                = "example_username_password"
+  description         = "My first username password credential!"
+  credential_store_id = boundary_credential_store_static.example.id
+  username            = "my-username"
+  password            = "my-password"
+}

go.mod

@@ -3,30 +3,31 @@ module github.com/hashicorp/terraform-provider-boundary
 go 1.18
 
 require (
-	github.com/hashicorp/boundary v0.8.1
-	github.com/hashicorp/boundary/api v0.0.24
-	github.com/hashicorp/boundary/sdk v0.0.15
+	github.com/hashicorp/boundary v0.10.2
+	github.com/hashicorp/boundary/api v0.0.28
+	github.com/hashicorp/boundary/sdk v0.0.20
 	github.com/hashicorp/cap v0.2.0
 	github.com/hashicorp/go-cty v1.4.1-0.20200723130312-85980079f637
-	github.com/hashicorp/go-kms-wrapping/v2 v2.0.5
-	github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.3
-	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.5
-	github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.1
-	github.com/hashicorp/terraform-plugin-docs v0.9.0
-	github.com/hashicorp/terraform-plugin-sdk/v2 v2.17.0
+	github.com/hashicorp/go-kms-wrapping/v2 v2.0.6-0.20220722192355-a843f53fa48d
+	github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.5
+	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7
+	github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.2
+	github.com/hashicorp/terraform-plugin-docs v0.13.0
+	github.com/hashicorp/terraform-plugin-sdk/v2 v2.21.0
 	github.com/kr/pretty v0.3.0
 	github.com/mitchellh/go-homedir v1.1.0
-	github.com/stretchr/testify v1.7.1
-	golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e
+	github.com/stretchr/testify v1.8.0
+	golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d
 )
 
 require (
 	github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 // indirect
-	github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
+	github.com/DATA-DOG/go-sqlmock v1.5.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.1.1 // indirect
 	github.com/Masterminds/sprig/v3 v3.2.2 // indirect
-	github.com/Microsoft/go-winio v0.4.16 // indirect
+	github.com/Microsoft/go-winio v0.5.0 // indirect
 	github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 // indirect
 	github.com/agext/levenshtein v1.2.2 // indirect
 	github.com/alessio/shellescape v1.4.1 // indirect
@@ -38,13 +39,12 @@ require (
 	github.com/cenkalti/backoff/v3 v3.0.0 // indirect
 	github.com/cenkalti/backoff/v4 v4.1.0 // indirect
 	github.com/cespare/xxhash/v2 v2.1.2 // indirect
-	github.com/containerd/containerd v1.4.3 // indirect
-	github.com/containerd/continuity v0.0.0-20200709052629-daa8e1ccc0bc // indirect
+	github.com/containerd/continuity v0.1.0 // indirect
 	github.com/coreos/go-oidc/v3 v3.1.0 // indirect
 	github.com/danieljoos/wincred v1.1.2 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/docker/cli v20.10.7+incompatible // indirect
-	github.com/docker/docker v20.10.7+incompatible // indirect
+	github.com/docker/docker v20.10.9+incompatible // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
 	github.com/docker/go-units v0.4.0 // indirect
 	github.com/dvsekhvalnov/jose2go v1.5.0 // indirect
@@ -52,7 +52,7 @@ require (
 	github.com/fatih/structs v1.1.0 // indirect
 	github.com/godbus/dbus/v5 v5.0.6 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang-migrate/migrate/v4 v4.14.1 // indirect
+	github.com/golang-migrate/migrate/v4 v4.15.1 // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
 	github.com/google/go-cmp v0.5.8 // indirect
@@ -67,9 +67,10 @@ require (
 	github.com/hashicorp/go-bexpr v0.1.10 // indirect
 	github.com/hashicorp/go-checkpoint v0.5.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-dbw v0.0.0-20211215222256-2ff0d37184ff // indirect
-	github.com/hashicorp/go-hclog v1.2.0 // indirect
+	github.com/hashicorp/go-dbw v0.0.0-20220412153211-c470aec9369f // indirect
+	github.com/hashicorp/go-hclog v1.2.1 // indirect
 	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
+	github.com/hashicorp/go-kms-wrapping/extras/kms/v2 v2.0.0-20220711120347-32232bae6803 // indirect
 	github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.2 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-plugin v1.4.4 // indirect
@@ -85,17 +86,18 @@ require (
 	github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.1 // indirect
 	github.com/hashicorp/go-sockaddr v1.0.2 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
-	github.com/hashicorp/go-version v1.5.0 // indirect
+	github.com/hashicorp/go-version v1.6.0 // indirect
 	github.com/hashicorp/golang-lru v0.5.4 // indirect
-	github.com/hashicorp/hc-install v0.3.2 // indirect
+	github.com/hashicorp/hc-install v0.4.0 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
-	github.com/hashicorp/hcl/v2 v2.12.0 // indirect
+	github.com/hashicorp/hcl/v2 v2.13.0 // indirect
 	github.com/hashicorp/logutils v1.0.0 // indirect
-	github.com/hashicorp/terraform-exec v0.16.1 // indirect
+	github.com/hashicorp/nodeenrollment v0.1.13 // indirect
+	github.com/hashicorp/terraform-exec v0.17.2 // indirect
 	github.com/hashicorp/terraform-json v0.14.0 // indirect
-	github.com/hashicorp/terraform-plugin-go v0.9.1 // indirect
-	github.com/hashicorp/terraform-plugin-log v0.4.0 // indirect
-	github.com/hashicorp/terraform-registry-address v0.0.0-20210412075316-9b2996cce896 // indirect
+	github.com/hashicorp/terraform-plugin-go v0.14.0 // indirect
+	github.com/hashicorp/terraform-plugin-log v0.7.0 // indirect
+	github.com/hashicorp/terraform-registry-address v0.0.0-20220623143253-7d51757b572c // indirect
 	github.com/hashicorp/terraform-svchost v0.0.0-20200729002733-f050f53b9734 // indirect
 	github.com/hashicorp/vault/api v1.3.1 // indirect
 	github.com/hashicorp/vault/sdk v0.3.0 // indirect
@@ -121,7 +123,7 @@ require (
 	github.com/mattn/go-colorable v0.1.12 // indirect
 	github.com/mattn/go-isatty v0.0.14 // indirect
 	github.com/mattn/go-sqlite3 v2.0.1+incompatible // indirect
-	github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
 	github.com/mitchellh/cli v1.1.4 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/go-testing-interface v1.14.1 // indirect
@@ -129,13 +131,13 @@ require (
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/mitchellh/pointerstructure v1.2.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
-	github.com/moby/term v0.0.0-20201216013528-df9cb8a40635 // indirect
+	github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6 // indirect
 	github.com/mr-tron/base58 v1.2.0 // indirect
 	github.com/mtibben/percent v0.2.1 // indirect
 	github.com/oklog/run v1.0.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.0.1 // indirect
-	github.com/opencontainers/runc v1.0.0-rc9 // indirect
+	github.com/opencontainers/runc v1.0.2 // indirect
 	github.com/ory/dockertest/v3 v3.7.0 // indirect
 	github.com/pierrec/lz4 v2.5.2+incompatible // indirect
 	github.com/pires/go-proxyproto v0.6.1 // indirect
@@ -149,8 +151,9 @@ require (
 	github.com/rogpeppe/go-internal v1.8.1 // indirect
 	github.com/russross/blackfriday v1.6.0 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
+	github.com/sethvargo/go-diceware v0.3.0 // indirect
 	github.com/shopspring/decimal v1.3.1 // indirect
-	github.com/sirupsen/logrus v1.7.0 // indirect
+	github.com/sirupsen/logrus v1.8.1 // indirect
 	github.com/spf13/cast v1.5.0 // indirect
 	github.com/vmihailenco/msgpack v4.0.4+incompatible // indirect
 	github.com/vmihailenco/msgpack/v4 v4.3.12 // indirect
@@ -164,17 +167,17 @@ require (
 	go.uber.org/atomic v1.9.0 // indirect
 	golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd // indirect
 	golang.org/x/oauth2 v0.0.0-20220309155454-6242fa91716a // indirect
-	golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a // indirect
+	golang.org/x/sys v0.0.0-20220627191245-f75cf1eec38b // indirect
 	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 // indirect
 	golang.org/x/text v0.3.7 // indirect
 	golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e // indirect
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/genproto v0.0.0-20220317150908-0efb43f6373e // indirect
-	google.golang.org/grpc v1.46.0 // indirect
-	google.golang.org/protobuf v1.28.0 // indirect
+	google.golang.org/grpc v1.48.0 // indirect
+	google.golang.org/protobuf v1.28.1 // indirect
 	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	gopkg.in/yaml.v3 v3.0.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 	gorm.io/driver/postgres v1.2.2 // indirect
 	gorm.io/driver/sqlite v1.2.4 // indirect
 	gorm.io/gorm v1.22.3 // indirect

internal/provider/provider.go

@@ -14,7 +14,7 @@ import (
 	"github.com/hashicorp/go-secure-stdlib/pluginutil/v2"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-provider-boundary/plugins/kms"
+	kms_plugin_assets "github.com/hashicorp/terraform-provider-boundary/plugins/kms"
 )
 
 func init() {
@@ -62,28 +62,31 @@ func New() *schema.Provider {
 			},
 		},
 		ResourcesMap: map[string]*schema.Resource{
-			"boundary_account":                  resourceAccount(),
-			"boundary_account_password":         resourceAccountPassword(),
-			"boundary_account_oidc":             resourceAccountOidc(),
-			"boundary_auth_method":              resourceAuthMethod(),
-			"boundary_auth_method_password":     resourceAuthMethodPassword(),
-			"boundary_auth_method_oidc":         resourceAuthMethodOidc(),
-			"boundary_credential_library_vault": resourceCredentialLibraryVault(),
-			"boundary_credential_store_vault":   resourceCredentialStoreVault(),
-			"boundary_managed_group":            resourceManagedGroup(),
-			"boundary_group":                    resourceGroup(),
-			"boundary_host":                     resourceHost(),
-			"boundary_host_static":              resourceHostStatic(),
-			"boundary_host_catalog":             resourceHostCatalog(),
-			"boundary_host_catalog_static":      resourceHostCatalogStatic(),
-			"boundary_host_catalog_plugin":      resourceHostCatalogPlugin(),
-			"boundary_host_set":                 resourceHostSet(),
-			"boundary_host_set_static":          resourceHostSetStatic(),
-			"boundary_host_set_plugin":          resourceHostSetPlugin(),
-			"boundary_role":                     resourceRole(),
-			"boundary_scope":                    resourceScope(),
-			"boundary_target":                   resourceTarget(),
-			"boundary_user":                     resourceUser(),
+			"boundary_account":                      resourceAccount(),
+			"boundary_account_password":             resourceAccountPassword(),
+			"boundary_account_oidc":                 resourceAccountOidc(),
+			"boundary_auth_method":                  resourceAuthMethod(),
+			"boundary_auth_method_password":         resourceAuthMethodPassword(),
+			"boundary_auth_method_oidc":             resourceAuthMethodOidc(),
+			"boundary_credential_library_vault":     resourceCredentialLibraryVault(),
+			"boundary_credential_store_vault":       resourceCredentialStoreVault(),
+			"boundary_credential_store_static":      resourceCredentialStoreStatic(),
+			"boundary_credential_username_password": resourceCredentialUsernamePassword(),
+			"boundary_credential_ssh_private_key":   resourceCredentialSshPrivateKey(),
+			"boundary_managed_group":                resourceManagedGroup(),
+			"boundary_group":                        resourceGroup(),
+			"boundary_host":                         resourceHost(),
+			"boundary_host_static":                  resourceHostStatic(),
+			"boundary_host_catalog":                 resourceHostCatalog(),
+			"boundary_host_catalog_static":          resourceHostCatalogStatic(),
+			"boundary_host_catalog_plugin":          resourceHostCatalogPlugin(),
+			"boundary_host_set":                     resourceHostSet(),
+			"boundary_host_set_static":              resourceHostSetStatic(),
+			"boundary_host_set_plugin":              resourceHostSetPlugin(),
+			"boundary_role":                         resourceRole(),
+			"boundary_scope":                        resourceScope(),
+			"boundary_target":                       resourceTarget(),
+			"boundary_user":                         resourceUser(),
 		},
 	}
 

internal/provider/resource_account.go

@@ -12,8 +12,8 @@ import (
 
 func resourceAccount() *schema.Resource {
 	return &schema.Resource{
-		DeprecationMessage: "Deprecated: use `resource_account_password` instead.",
-		Description:        "Deprecated: use `resource_account_password` instead.",
+		DeprecationMessage: "Deprecated: use `boundary_account_password` instead.",
+		Description:        "Deprecated: use `boundary_account_password` instead.",
 
 		CreateContext: resourceAccountCreate,
 		ReadContext:   resourceAccountRead,

internal/provider/resource_credential_library_vault.go

@@ -6,7 +6,6 @@ import (
 
 	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/credentiallibraries"
-
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 )
@@ -16,6 +15,7 @@ const (
 	credentialLibraryVaultHttpMethodKey      = "http_method"
 	credentialLibraryVaultHttpRequestBodyKey = "http_request_body"
 	credentialLibraryVaultPathKey            = "path"
+	credentialLibraryCredentialTypeKey       = "credential_type"
 )
 
 var libraryVaultAttrs = []string{
@@ -73,6 +73,11 @@ func resourceCredentialLibraryVault() *schema.Resource {
 				Type:        schema.TypeString,
 				Required:    true,
 			},
+			credentialLibraryCredentialTypeKey: {
+				Description: "The type of credential the library generates.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
 		},
 	}
 }
@@ -121,6 +126,9 @@ func resourceCredentialLibraryCreateVault(ctx context.Context, d *schema.Resourc
 	if v, ok := d.GetOk(credentialLibraryVaultPathKey); ok {
 		opts = append(opts, credentiallibraries.WithVaultCredentialLibraryPath(v.(string)))
 	}
+	if v, ok := d.GetOk(credentialLibraryCredentialTypeKey); ok {
+		opts = append(opts, credentiallibraries.WithCredentialType(v.(string)))
+	}
 
 	var credentialStoreId string
 	cid, ok := d.GetOk(credentialStoreIdKey)

internal/provider/resource_credential_library_vault_test.go

@@ -17,6 +17,7 @@ import (
 
 const (
 	vaultCredResc            = "boundary_credential_library_vault.example"
+	vaultCredTypedResc       = "boundary_credential_library_vault.typed_example"
 	vaultCredLibName         = "foo"
 	vaultCredLibDesc         = "the foo"
 	vaultCredLibPath         = "/foo/bar"
@@ -52,6 +53,19 @@ resource "boundary_credential_library_vault" "example" {
 	vaultCredLibMethodPost,
 	vaultCredLibRequestBody)
 
+var vaultTypedCredLibResource = fmt.Sprintf(`
+resource "boundary_credential_library_vault" "typed_example" {
+	name                = "%s"
+	description         = "%s"
+	credential_store_id = boundary_credential_store_vault.example.id
+  	path                = "%s"
+  	http_method         = "%s"
+	credential_type     = "ssh_private_key"
+}`, vaultCredLibName,
+	vaultCredLibDesc,
+	vaultCredLibPath,
+	vaultCredLibMethodGet)
+
 func TestAccCredentialLibraryVault(t *testing.T) {
 	tc := controller.NewTestController(t, tcConfig...)
 	defer tc.Shutdown()
@@ -69,8 +83,9 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
+		IsUnitTest:        true,
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckAuthMethodResourceDestroy(t, provider),
+		CheckDestroy:      testAccCheckCredentialLibraryVaultResourceDestroy(t, provider),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -101,6 +116,22 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 				),
 			},
 			importStep(vaultCredResc),
+
+			{
+				// create typed credential library, note credential type is immutable so no need for update test
+				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate, vaultTypedCredLibResource),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(vaultCredTypedResc, NameKey, vaultCredLibName),
+					resource.TestCheckResourceAttr(vaultCredTypedResc, DescriptionKey, vaultCredLibDesc),
+					resource.TestCheckResourceAttr(vaultCredTypedResc, credentialLibraryVaultPathKey, vaultCredLibPath),
+					resource.TestCheckResourceAttr(vaultCredTypedResc, credentialLibraryVaultHttpMethodKey, vaultCredLibMethodGet),
+					resource.TestCheckResourceAttr(vaultCredTypedResc, credentialLibraryVaultHttpRequestBodyKey, ""),
+					resource.TestCheckResourceAttr(vaultCredTypedResc, credentialLibraryCredentialTypeKey, "ssh_private_key"),
+
+					testAccCheckCredentialLibraryVaultResourceExists(provider, vaultCredTypedResc),
+				),
+			},
+			importStep(vaultCredResc),
 		},
 	})
 }

internal/provider/resource_credential_ssh_private_key.go

@@ -0,0 +1,276 @@
+package provider
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/credentials"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+const (
+	credentialSshPrivateKeyUsernameKey       = "username"
+	credentialSshPrivateKeyPrivateKeyKey     = "private_key"
+	credentialSshPrivateKeyPrivateKeyHmacKey = "private_key_hmac"
+	credentialSshPrivateKeyPassphraseKey     = "private_key_passphrase"
+	credentialSshPrivateKeyPassphraseHmacKey = "private_key_passphrase_hmac"
+	credentialSshPrivateKeyCredentialType    = "ssh_private_key"
+)
+
+func resourceCredentialSshPrivateKey() *schema.Resource {
+	return &schema.Resource{
+		Description: "The SSH private key credential resource allows you to configure a credential using a username, private key and optional passphrase.",
+
+		CreateContext: resourceCredentialSshPrivateKeyCreate,
+		ReadContext:   resourceCredentialSshPrivateKeyRead,
+		UpdateContext: resourceCredentialSshPrivateKeyUpdate,
+		DeleteContext: resourceCredentialSshPrivateKeyDelete,
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			IDKey: {
+				Description: "The ID of the credential.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			NameKey: {
+				Description: "The name of the credential. Defaults to the resource name.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			DescriptionKey: {
+				Description: "The description of the credential.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			credentialStoreIdKey: {
+				Description: "ID of the credential store this credential belongs to.",
+				Type:        schema.TypeString,
+				ForceNew:    true,
+				Required:    true,
+			},
+			credentialSshPrivateKeyUsernameKey: {
+				Description: "The username associated with the credential.",
+				Type:        schema.TypeString,
+				Required:    true,
+			},
+			credentialSshPrivateKeyPrivateKeyKey: {
+				Description: "The private key associated with the credential.",
+				Type:        schema.TypeString,
+				Required:    true,
+			},
+			credentialSshPrivateKeyPrivateKeyHmacKey: {
+				Description: "The private key hmac.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			credentialSshPrivateKeyPassphraseKey: {
+				Description: "The passphrase of the private key associated with the credential.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			credentialSshPrivateKeyPassphraseHmacKey: {
+				Description: "The private key passphrase hmac.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+		},
+	}
+}
+
+func setFromCredentialSshPrivateKeyResponseMap(d *schema.ResourceData, raw map[string]interface{}, fromRead bool) error {
+	if err := d.Set(NameKey, raw[NameKey]); err != nil {
+		return err
+	}
+	if err := d.Set(DescriptionKey, raw[DescriptionKey]); err != nil {
+		return err
+	}
+	if err := d.Set(credentialStoreIdKey, raw[credentialStoreIdKey]); err != nil {
+		return err
+	}
+
+	if attrsVal, ok := raw["attributes"]; ok {
+		attrs := attrsVal.(map[string]interface{})
+		if err := d.Set(credentialSshPrivateKeyUsernameKey, attrs[credentialSshPrivateKeyUsernameKey]); err != nil {
+			return err
+		}
+
+		statePrivKeyHmac := d.Get(credentialSshPrivateKeyPrivateKeyHmacKey)
+		boundaryPrivKeyHmac := attrs[credentialSshPrivateKeyPrivateKeyHmacKey].(string)
+		if statePrivKeyHmac.(string) != boundaryPrivKeyHmac && fromRead {
+			// PrivateKeyHmac has changed in Boundary, therefore the private key has changed.
+			// Update private key value to force tf to attempt update.
+			if err := d.Set(credentialSshPrivateKeyPrivateKeyKey, "(changed in Boundary)"); err != nil {
+				return err
+			}
+		}
+		if err := d.Set(credentialSshPrivateKeyPrivateKeyHmacKey, boundaryPrivKeyHmac); err != nil {
+			return err
+		}
+
+		var statePassphraseHmac, boundaryPassphraseHmac string
+		if v := d.Get(credentialSshPrivateKeyPassphraseHmacKey); v != nil {
+			statePassphraseHmac = v.(string)
+		}
+		if v := attrs[credentialSshPrivateKeyPassphraseHmacKey]; v != nil {
+			boundaryPassphraseHmac = v.(string)
+		}
+		if statePassphraseHmac != boundaryPassphraseHmac && fromRead {
+			// PassphraseHmac has changed in Boundary, therefore the private key passphrase has changed.
+			// Update private key passphrase value to force tf to attempt update.
+			if err := d.Set(credentialSshPrivateKeyPassphraseKey, "(changed in Boundary)"); err != nil {
+				return err
+			}
+		}
+		if err := d.Set(credentialSshPrivateKeyPassphraseHmacKey, boundaryPassphraseHmac); err != nil {
+			return err
+		}
+	}
+
+	d.SetId(raw["id"].(string))
+
+	return nil
+}
+
+func resourceCredentialSshPrivateKeyCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+
+	var opts []credentials.Option
+	if v, ok := d.GetOk(NameKey); ok {
+		opts = append(opts, credentials.WithName(v.(string)))
+	}
+	if v, ok := d.GetOk(DescriptionKey); ok {
+		opts = append(opts, credentials.WithDescription(v.(string)))
+	}
+	if v, ok := d.GetOk(credentialSshPrivateKeyUsernameKey); ok {
+		opts = append(opts, credentials.WithSshPrivateKeyCredentialUsername(v.(string)))
+	}
+	if v, ok := d.GetOk(credentialSshPrivateKeyPrivateKeyKey); ok {
+		opts = append(opts, credentials.WithSshPrivateKeyCredentialPrivateKey(v.(string)))
+	}
+	if v, ok := d.GetOk(credentialSshPrivateKeyPassphraseKey); ok {
+		opts = append(opts, credentials.WithSshPrivateKeyCredentialPrivateKeyPassphrase(v.(string)))
+	}
+
+	var credentialStoreId string
+	retrievedStoreId, ok := d.GetOk(credentialStoreIdKey)
+	if ok {
+		credentialStoreId = retrievedStoreId.(string)
+	} else {
+		return diag.Errorf("credential store id is unset")
+	}
+
+	client := credentials.NewClient(md.client)
+	cr, err := client.Create(ctx, credentialSshPrivateKeyCredentialType, credentialStoreId, opts...)
+	if err != nil {
+		return diag.Errorf("error creating credential: %v", err)
+	}
+	if cr == nil {
+		return diag.Errorf("nil credential after create")
+	}
+
+	if err := setFromCredentialSshPrivateKeyResponseMap(d, cr.GetResponse().Map, false); err != nil {
+		return diag.Errorf("error generating credential from response map: %v", err)
+	}
+
+	return nil
+}
+
+func resourceCredentialSshPrivateKeyRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	client := credentials.NewClient(md.client)
+
+	cr, err := client.Read(ctx, d.Id())
+	if err != nil {
+		if apiErr := api.AsServerError(err); apiErr != nil && apiErr.Response().StatusCode() == http.StatusNotFound {
+			d.SetId("")
+			return nil
+		}
+		return diag.Errorf("error reading credential: %v", err)
+	}
+	if cr == nil {
+		return diag.Errorf("credential nil after read")
+	}
+
+	if err := setFromCredentialSshPrivateKeyResponseMap(d, cr.GetResponse().Map, true); err != nil {
+		return diag.Errorf("error generating credential from response map: %v", err)
+	}
+
+	return nil
+}
+
+func resourceCredentialSshPrivateKeyUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	client := credentials.NewClient(md.client)
+
+	var opts []credentials.Option
+	if d.HasChange(NameKey) {
+		opts = append(opts, credentials.DefaultName())
+		nameVal, ok := d.GetOk(NameKey)
+		if ok {
+			opts = append(opts, credentials.WithName(nameVal.(string)))
+		}
+	}
+
+	if d.HasChange(DescriptionKey) {
+		opts = append(opts, credentials.DefaultDescription())
+		descVal, ok := d.GetOk(DescriptionKey)
+		if ok {
+			opts = append(opts, credentials.WithDescription(descVal.(string)))
+		}
+	}
+
+	if d.HasChange(credentialSshPrivateKeyUsernameKey) {
+		usernameVal, ok := d.GetOk(credentialSshPrivateKeyUsernameKey)
+		if ok {
+			opts = append(opts, credentials.WithSshPrivateKeyCredentialUsername(usernameVal.(string)))
+		}
+	}
+
+	if d.HasChange(credentialSshPrivateKeyPrivateKeyKey) {
+		privKeyVal, ok := d.GetOk(credentialSshPrivateKeyPrivateKeyKey)
+		if ok {
+			opts = append(opts, credentials.WithSshPrivateKeyCredentialPrivateKey(privKeyVal.(string)))
+		}
+	}
+
+	if d.HasChange(credentialSshPrivateKeyPassphraseKey) {
+		passVal, ok := d.GetOk(credentialSshPrivateKeyPassphraseKey)
+		if ok {
+			opts = append(opts, credentials.WithSshPrivateKeyCredentialPrivateKeyPassphrase(passVal.(string)))
+		}
+	}
+
+	if len(opts) > 0 {
+		opts = append(opts, credentials.WithAutomaticVersioning(true))
+		crUpdate, err := client.Update(ctx, d.Id(), 0, opts...)
+		if err != nil {
+			return diag.Errorf("error updating credential: %v", err)
+		}
+		if crUpdate == nil {
+			return diag.Errorf("credential nil after update")
+		}
+
+		if err = setFromCredentialSshPrivateKeyResponseMap(d, crUpdate.GetResponse().Map, false); err != nil {
+			return diag.Errorf("error generating credential from response map: %v", err)
+		}
+	}
+
+	return nil
+}
+
+func resourceCredentialSshPrivateKeyDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	client := credentials.NewClient(md.client)
+
+	_, err := client.Delete(ctx, d.Id())
+	if err != nil {
+		return diag.Errorf("error deleting credential: %v", err)
+	}
+
+	return nil
+}

internal/provider/resource_credential_ssh_private_key_test.go

@@ -0,0 +1,180 @@
+package provider
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/credentials"
+	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"golang.org/x/crypto/ssh/testdata"
+)
+
+const (
+	sshPrivateKeyCredResc = "boundary_credential_ssh_private_key.example"
+	sshPrivateKeyCredName = "Dr Jekyll"
+	sshPrivateKeyCredDesc = "my best description"
+	sshPrivateKeyUpdate   = "some magic update string"
+	sshPrivateKeyUsername = "my-user"
+)
+
+var staticStore = fmt.Sprintf(`
+resource "boundary_credential_store_static" "ssh_store" {
+	name        = "static store name"
+	description = "static store description"
+	scope_id    = boundary_scope.proj1.id
+	depends_on  = [boundary_role.proj1_admin]
+}`)
+
+func sshPrivateKeyResource(name, description, username, privateKey, passphrase string) string {
+	return fmt.Sprintf(`
+resource "boundary_credential_ssh_private_key" "example" {
+	name                   = %q
+	description            = %q
+	credential_store_id    = boundary_credential_store_static.ssh_store.id
+	username               = %q
+	private_key            = %q
+	private_key_passphrase = %q
+}`, name, description, username, privateKey, passphrase)
+}
+
+func TestAccCredentialSshPrivateKey(t *testing.T) {
+	tc := controller.NewTestController(t, tcConfig...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	privKey := string(testdata.PEMBytes["rsa"])
+	privKeyUpdate := string(testdata.PEMEncryptedKeys[0].PEMBytes)
+	privKeyUpdatePassphrase := testdata.PEMEncryptedKeys[0].EncryptionKey
+
+	res := sshPrivateKeyResource(
+		sshPrivateKeyCredName,
+		sshPrivateKeyCredDesc,
+		sshPrivateKeyUsername,
+		privKey,
+		"",
+	)
+
+	resUpdate := sshPrivateKeyResource(
+		sshPrivateKeyCredName+sshPrivateKeyUpdate,
+		sshPrivateKeyCredDesc+sshPrivateKeyUpdate,
+		sshPrivateKeyUsername+sshPrivateKeyUpdate,
+		privKeyUpdate,
+		privKeyUpdatePassphrase,
+	)
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		IsUnitTest:        true,
+		ProviderFactories: providerFactories(&provider),
+		CheckDestroy:      testAccCheckCredentialSshPrivateKeyResourceDestroy(t, provider),
+		Steps: []resource.TestStep{
+			{
+				// create
+				Config: testConfig(url, fooOrg, firstProjectFoo, staticStore, res),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, NameKey, sshPrivateKeyCredName),
+					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, DescriptionKey, sshPrivateKeyCredDesc),
+					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, credentialSshPrivateKeyUsernameKey, sshPrivateKeyUsername),
+					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, credentialSshPrivateKeyPrivateKeyKey, privKey),
+					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, credentialSshPrivateKeyPassphraseKey, ""),
+
+					testAccCheckCredentialStoreSshPrivateKeyHmac(provider),
+					testAccCheckCredentialSshPrivateKeyResourceExists(provider, sshPrivateKeyCredResc),
+				),
+			},
+			importStep(sshPrivateKeyCredResc, credentialSshPrivateKeyPrivateKeyKey, credentialSshPrivateKeyPassphraseKey),
+			{
+				// update
+				Config: testConfig(url, fooOrg, firstProjectFoo, staticStore, resUpdate),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, NameKey, sshPrivateKeyCredName+sshPrivateKeyUpdate),
+					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, DescriptionKey, sshPrivateKeyCredDesc+sshPrivateKeyUpdate),
+					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, credentialSshPrivateKeyUsernameKey, sshPrivateKeyUsername+sshPrivateKeyUpdate),
+					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, credentialSshPrivateKeyPrivateKeyKey, privKeyUpdate),
+					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, credentialSshPrivateKeyPassphraseKey, privKeyUpdatePassphrase),
+
+					testAccCheckCredentialStoreSshPrivateKeyHmac(provider),
+					testAccCheckCredentialSshPrivateKeyResourceExists(provider, sshPrivateKeyCredResc),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckCredentialSshPrivateKeyResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("not found: %s", name)
+		}
+
+		id := rs.Primary.ID
+		if id == "" {
+			return fmt.Errorf("no ID is set")
+		}
+		storeId = id
+
+		md := testProvider.Meta().(*metaData)
+		c := credentials.NewClient(md.client)
+		if _, err := c.Read(context.Background(), id); err != nil {
+			return fmt.Errorf("got an error reading %q: %w", id, err)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckCredentialSshPrivateKeyResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if testProvider.Meta() == nil {
+			t.Fatal("got nil provider metadata")
+		}
+		md := testProvider.Meta().(*metaData)
+
+		for _, rs := range s.RootModule().Resources {
+			switch rs.Type {
+			case "boundary_credential_ssh_private_key":
+				id := rs.Primary.ID
+
+				c := credentials.NewClient(md.client)
+				_, err := c.Read(context.Background(), id)
+				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
+					return fmt.Errorf("didn't get a 404 when reading destroyed credential %q: %v", id, err)
+				}
+			default:
+				continue
+			}
+		}
+		return nil
+	}
+}
+
+func testAccCheckCredentialStoreSshPrivateKeyHmac(testProvider *schema.Provider) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[sshPrivateKeyCredResc]
+		if !ok {
+			return fmt.Errorf("not found: %s", sshPrivateKeyCredResc)
+		}
+
+		computed := rs.Primary.Attributes["private_key_hmac"]
+		if len(computed) != 43 {
+			return fmt.Errorf("computed private key hmac not the expected length of 43 characters, got: %q", computed)
+		}
+
+		if rs.Primary.Attributes["private_key_passphrase"] != "" {
+			// We set a passphrase, validate the computed hmac is expected length
+			computed := rs.Primary.Attributes["private_key_passphrase_hmac"]
+			if len(computed) != 43 {
+				return fmt.Errorf("computed private key passphrase hmac not the expected length of 43 characters, got: %q", computed)
+			}
+		}
+
+		return nil
+	}
+}

internal/provider/resource_credential_store_static.go

@@ -0,0 +1,176 @@
+package provider
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/credentialstores"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+const staticCredentialStoreType = "static"
+
+func resourceCredentialStoreStatic() *schema.Resource {
+	return &schema.Resource{
+		Description: "The static credential store resource allows you to configure a Boundary static credential store.",
+
+		CreateContext: resourceStaticCredentialStoreCreate,
+		ReadContext:   resourceStaticCredentialStoreRead,
+		UpdateContext: resourceStaticCredentialStoreUpdate,
+		DeleteContext: resourceStaticCredentialStoreDelete,
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			IDKey: {
+				Description: "The ID of the static credential store.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			NameKey: {
+				Description: "The static credential store name. Defaults to the resource name.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			DescriptionKey: {
+				Description: "The static credential store description.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			ScopeIdKey: {
+				Description: "The scope for this credential store.",
+				Type:        schema.TypeString,
+				ForceNew:    true,
+				Required:    true,
+			},
+		},
+	}
+}
+
+func setFromStaticCredentialStoreResponseMap(d *schema.ResourceData, raw map[string]interface{}, fromRead bool) error {
+	if err := d.Set(NameKey, raw[NameKey]); err != nil {
+		return err
+	}
+	if err := d.Set(DescriptionKey, raw[DescriptionKey]); err != nil {
+		return err
+	}
+	if err := d.Set(ScopeIdKey, raw[ScopeIdKey]); err != nil {
+		return err
+	}
+
+	d.SetId(raw["id"].(string))
+
+	return nil
+}
+
+func resourceStaticCredentialStoreCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+
+	var opts []credentialstores.Option
+	if v, ok := d.GetOk(NameKey); ok {
+		opts = append(opts, credentialstores.WithName(v.(string)))
+	}
+	if v, ok := d.GetOk(DescriptionKey); ok {
+		opts = append(opts, credentialstores.WithDescription(v.(string)))
+	}
+
+	var scope string
+	gotScope, ok := d.GetOk(ScopeIdKey)
+	if ok {
+		scope = gotScope.(string)
+	} else {
+		return diag.Errorf("no scope is set")
+	}
+
+	client := credentialstores.NewClient(md.client)
+	cr, err := client.Create(ctx, staticCredentialStoreType, scope, opts...)
+	if err != nil {
+		return diag.Errorf("error creating credential store: %v", err)
+	}
+	if cr == nil {
+		return diag.Errorf("nil credential store after create")
+	}
+
+	if err := setFromStaticCredentialStoreResponseMap(d, cr.GetResponse().Map, false); err != nil {
+		return diag.Errorf("error generating credential store from response map: %v", err)
+	}
+
+	return nil
+}
+
+func resourceStaticCredentialStoreRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	client := credentialstores.NewClient(md.client)
+
+	cr, err := client.Read(ctx, d.Id())
+	if err != nil {
+		if apiErr := api.AsServerError(err); apiErr != nil && apiErr.Response().StatusCode() == http.StatusNotFound {
+			d.SetId("")
+			return nil
+		}
+		return diag.Errorf("error reading credential store: %v", err)
+	}
+	if cr == nil {
+		return diag.Errorf("credential store nil after read")
+	}
+
+	if err := setFromStaticCredentialStoreResponseMap(d, cr.GetResponse().Map, true); err != nil {
+		return diag.Errorf("error generating credential store from response map: %v", err)
+	}
+
+	return nil
+}
+
+func resourceStaticCredentialStoreUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	client := credentialstores.NewClient(md.client)
+
+	var opts []credentialstores.Option
+	if d.HasChange(NameKey) {
+		opts = append(opts, credentialstores.DefaultName())
+		nameVal, ok := d.GetOk(NameKey)
+		if ok {
+			opts = append(opts, credentialstores.WithName(nameVal.(string)))
+		}
+	}
+
+	if d.HasChange(DescriptionKey) {
+		opts = append(opts, credentialstores.DefaultDescription())
+		descVal, ok := d.GetOk(DescriptionKey)
+		if ok {
+			opts = append(opts, credentialstores.WithDescription(descVal.(string)))
+		}
+	}
+
+	if len(opts) > 0 {
+		opts = append(opts, credentialstores.WithAutomaticVersioning(true))
+		crUpdate, err := client.Update(ctx, d.Id(), 0, opts...)
+		if err != nil {
+			return diag.Errorf("error updating credential store: %v", err)
+		}
+		if crUpdate == nil {
+			return diag.Errorf("credential store nil after update")
+		}
+
+		if err = setFromStaticCredentialStoreResponseMap(d, crUpdate.GetResponse().Map, false); err != nil {
+			return diag.Errorf("error generating credential store from response map: %v", err)
+		}
+	}
+
+	return nil
+}
+
+func resourceStaticCredentialStoreDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	client := credentialstores.NewClient(md.client)
+
+	_, err := client.Delete(ctx, d.Id())
+	if err != nil {
+		return diag.Errorf("error deleting credential store: %v", err)
+	}
+
+	return nil
+}

internal/provider/resource_credential_store_static_test.go

@@ -0,0 +1,139 @@
+package provider
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/credentialstores"
+	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+)
+
+const (
+	staticCredStoreResc      = "boundary_credential_store_static.example"
+	staticCredStoreName      = "foo"
+	staticCredStoreDesc      = "the foo"
+	staticCredStoreNamespace = "static"
+	staticCredStoreUpdate    = "_random"
+)
+
+func staticCredStoreResource(name string, description string) string {
+	return fmt.Sprintf(`
+resource "boundary_credential_store_static" "example" {
+	name  = "%s"
+	description = "%s"
+	scope_id = boundary_scope.proj1.id
+	depends_on = [boundary_role.proj1_admin]
+}`, name,
+		description)
+}
+
+func TestAccCredentialStoreStatic(t *testing.T) {
+	tc := controller.NewTestController(t, tcConfig...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	res := staticCredStoreResource(staticCredStoreName,
+		staticCredStoreDesc)
+
+	resUpdate := staticCredStoreResource(staticCredStoreName+staticCredStoreUpdate,
+		staticCredStoreDesc+staticCredStoreUpdate)
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		ProviderFactories: providerFactories(&provider),
+		CheckDestroy:      testAccCheckCredentialStoreStaticResourceDestroy(t, provider),
+		Steps: []resource.TestStep{
+			{
+				// create
+				Config: testConfig(url, fooOrg, firstProjectFoo, res),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(staticCredStoreResc, NameKey, staticCredStoreName),
+					resource.TestCheckResourceAttr(staticCredStoreResc, DescriptionKey, staticCredStoreDesc),
+
+					testAccCheckCredentialStoreVaultResourceExists(provider, staticCredStoreResc),
+				),
+			},
+			importStep(staticCredStoreResc),
+			{
+				// update
+				Config: testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(staticCredStoreResc, NameKey, staticCredStoreName+staticCredStoreUpdate),
+					resource.TestCheckResourceAttr(staticCredStoreResc, DescriptionKey, staticCredStoreDesc+staticCredStoreUpdate),
+
+					testAccCheckCredentialStoreVaultResourceExists(provider, staticCredStoreResc),
+				),
+			},
+			importStep(staticCredStoreResc),
+			{
+				// Run a plan only update and verify no changes
+				PlanOnly: true,
+				Config:   testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+			},
+			importStep(staticCredStoreResc),
+			{
+				// update again but apply a preConfig to externally update resource
+				// TODO: Boundary currently causes an error on moving back to a previously
+				// used token, for now verify that a plan only step had changes
+				PreConfig:          func() { staticCredentialStoreExternalUpdate(t, provider) },
+				PlanOnly:           true,
+				ExpectNonEmptyPlan: true,
+				Config:             testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+			},
+			importStep(staticCredStoreResc),
+		},
+	})
+}
+
+func staticCredentialStoreExternalUpdate(t *testing.T, testProvider *schema.Provider) {
+	if storeId == "" {
+		t.Fatal("storeId must be set before testing an external update")
+	}
+
+	md := testProvider.Meta().(*metaData)
+	c := credentialstores.NewClient(md.client)
+	cr, err := c.Read(context.Background(), storeId)
+	if err != nil {
+		t.Fatal(fmt.Errorf("got an error reading %q: %w", storeId, err))
+	}
+
+	// update credential store options
+	var opts []credentialstores.Option
+	opts = append(opts, credentialstores.WithDescription("this is an updated description, my guy"))
+
+	_, err = c.Update(context.Background(), cr.Item.Id, cr.Item.Version, opts...)
+	if err != nil {
+		t.Fatal(fmt.Errorf("got an error updating %q: %w", cr.Item.Id, err))
+	}
+}
+
+func testAccCheckCredentialStoreStaticResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if testProvider.Meta() == nil {
+			t.Fatal("got nil provider metadata")
+		}
+		md := testProvider.Meta().(*metaData)
+
+		for _, rs := range s.RootModule().Resources {
+			switch rs.Type {
+			case "boundary_credential_store_static":
+				id := rs.Primary.ID
+
+				c := credentialstores.NewClient(md.client)
+				_, err := c.Read(context.Background(), id)
+				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
+					return fmt.Errorf("didn't get a 404 when reading destroyed static credential store %q: %v", id, err)
+				}
+			default:
+				continue
+			}
+		}
+		return nil
+	}
+}

internal/provider/resource_credential_username_password.go

@@ -0,0 +1,236 @@
+package provider
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/credentials"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+const (
+	credentialUsernamePasswordUsernameKey     = "username"
+	credentialUsernamePasswordPasswordKey     = "password"
+	credentialUsernamePasswordPasswordHmacKey = "password_hmac"
+	credentialUsernamePasswordCredentialType  = "username_password"
+)
+
+func resourceCredentialUsernamePassword() *schema.Resource {
+	return &schema.Resource{
+		Description: "The username/password credential resource allows you to configure a credential using a username and password pair.",
+
+		CreateContext: resourceCredentialUsernamePasswordCreate,
+		ReadContext:   resourceCredentialUsernamePasswordRead,
+		UpdateContext: resourceCredentialUsernamePasswordUpdate,
+		DeleteContext: resourceCredentialUsernamePasswordDelete,
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			IDKey: {
+				Description: "The ID of this username/password credential.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			NameKey: {
+				Description: "The name of this username/password credential. Defaults to the resource name.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			DescriptionKey: {
+				Description: "The description of this username/password credential.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			credentialStoreIdKey: {
+				Description: "The credential store in which to save this username/password credential.",
+				Type:        schema.TypeString,
+				ForceNew:    true,
+				Required:    true,
+			},
+			credentialUsernamePasswordUsernameKey: {
+				Description: "The username of this username/password credential.",
+				Type:        schema.TypeString,
+				Required:    true,
+			},
+			credentialUsernamePasswordPasswordKey: {
+				Description: "The password of this username/password credential.",
+				Type:        schema.TypeString,
+				Required:    true,
+			},
+			credentialUsernamePasswordPasswordHmacKey: {
+				Description: "The password hmac.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+		},
+	}
+}
+
+func setFromCredentialUsernamePasswordResponseMap(d *schema.ResourceData, raw map[string]interface{}, fromRead bool) error {
+	if err := d.Set(NameKey, raw[NameKey]); err != nil {
+		return err
+	}
+	if err := d.Set(DescriptionKey, raw[DescriptionKey]); err != nil {
+		return err
+	}
+	if err := d.Set(credentialStoreIdKey, raw[credentialStoreIdKey]); err != nil {
+		return err
+	}
+
+	if attrsVal, ok := raw["attributes"]; ok {
+		attrs := attrsVal.(map[string]interface{})
+		if err := d.Set(credentialUsernamePasswordUsernameKey, attrs[credentialUsernamePasswordUsernameKey]); err != nil {
+			return err
+		}
+
+		statePasswordHmac := d.Get(credentialUsernamePasswordPasswordHmacKey)
+		boundaryPasswordHmac := attrs[credentialUsernamePasswordPasswordHmacKey].(string)
+		if statePasswordHmac.(string) != boundaryPasswordHmac && fromRead {
+			// PasswordHmac has changed in Boundary, therefore the password has changed.
+			// Update password value to force tf to attempt update.
+			if err := d.Set(credentialUsernamePasswordPasswordKey, "(changed in Boundary)"); err != nil {
+				return err
+			}
+		}
+		if err := d.Set(credentialUsernamePasswordPasswordHmacKey, boundaryPasswordHmac); err != nil {
+			return err
+		}
+	}
+
+	d.SetId(raw["id"].(string))
+
+	return nil
+}
+
+func resourceCredentialUsernamePasswordCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+
+	var opts []credentials.Option
+	if v, ok := d.GetOk(NameKey); ok {
+		opts = append(opts, credentials.WithName(v.(string)))
+	}
+	if v, ok := d.GetOk(DescriptionKey); ok {
+		opts = append(opts, credentials.WithDescription(v.(string)))
+	}
+	if v, ok := d.GetOk(credentialUsernamePasswordUsernameKey); ok {
+		opts = append(opts, credentials.WithUsernamePasswordCredentialUsername(v.(string)))
+	}
+	if v, ok := d.GetOk(credentialUsernamePasswordPasswordKey); ok {
+		opts = append(opts, credentials.WithUsernamePasswordCredentialPassword(v.(string)))
+	}
+
+	var credentialStoreId string
+	retrievedStoreId, ok := d.GetOk(credentialStoreIdKey)
+	if ok {
+		credentialStoreId = retrievedStoreId.(string)
+	} else {
+		return diag.Errorf("credential store id is unset")
+	}
+
+	client := credentials.NewClient(md.client)
+	cr, err := client.Create(ctx, credentialUsernamePasswordCredentialType, credentialStoreId, opts...)
+	if err != nil {
+		return diag.Errorf("error creating credential: %v", err)
+	}
+	if cr == nil {
+		return diag.Errorf("nil credential after create")
+	}
+
+	if err := setFromCredentialUsernamePasswordResponseMap(d, cr.GetResponse().Map, false); err != nil {
+		return diag.Errorf("error generating credential from response map: %v", err)
+	}
+
+	return nil
+}
+
+func resourceCredentialUsernamePasswordRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	client := credentials.NewClient(md.client)
+
+	cr, err := client.Read(ctx, d.Id())
+	if err != nil {
+		if apiErr := api.AsServerError(err); apiErr != nil && apiErr.Response().StatusCode() == http.StatusNotFound {
+			d.SetId("")
+			return nil
+		}
+		return diag.Errorf("error reading credential: %v", err)
+	}
+	if cr == nil {
+		return diag.Errorf("credential nil after read")
+	}
+
+	if err := setFromCredentialUsernamePasswordResponseMap(d, cr.GetResponse().Map, true); err != nil {
+		return diag.Errorf("error generating credential from response map: %v", err)
+	}
+
+	return nil
+}
+
+func resourceCredentialUsernamePasswordUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	client := credentials.NewClient(md.client)
+
+	var opts []credentials.Option
+	if d.HasChange(NameKey) {
+		opts = append(opts, credentials.DefaultName())
+		nameVal, ok := d.GetOk(NameKey)
+		if ok {
+			opts = append(opts, credentials.WithName(nameVal.(string)))
+		}
+	}
+
+	if d.HasChange(DescriptionKey) {
+		opts = append(opts, credentials.DefaultDescription())
+		descVal, ok := d.GetOk(DescriptionKey)
+		if ok {
+			opts = append(opts, credentials.WithDescription(descVal.(string)))
+		}
+	}
+
+	if d.HasChange(credentialUsernamePasswordUsernameKey) {
+		usernameVal, ok := d.GetOk(credentialUsernamePasswordUsernameKey)
+		if ok {
+			opts = append(opts, credentials.WithUsernamePasswordCredentialUsername(usernameVal.(string)))
+		}
+	}
+
+	if d.HasChange(credentialUsernamePasswordPasswordKey) {
+		passwordVal, ok := d.GetOk(credentialUsernamePasswordPasswordKey)
+		if ok {
+			opts = append(opts, credentials.WithUsernamePasswordCredentialPassword(passwordVal.(string)))
+		}
+	}
+
+	if len(opts) > 0 {
+		opts = append(opts, credentials.WithAutomaticVersioning(true))
+		crUpdate, err := client.Update(ctx, d.Id(), 0, opts...)
+		if err != nil {
+			return diag.Errorf("error updating credential: %v", err)
+		}
+		if crUpdate == nil {
+			return diag.Errorf("credential nil after update")
+		}
+
+		if err = setFromCredentialUsernamePasswordResponseMap(d, crUpdate.GetResponse().Map, false); err != nil {
+			return diag.Errorf("error generating credential from response map: %v", err)
+		}
+	}
+
+	return nil
+}
+
+func resourceCredentialUsernamePasswordDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	client := credentials.NewClient(md.client)
+
+	_, err := client.Delete(ctx, d.Id())
+	if err != nil {
+		return diag.Errorf("error deleting credential: %v", err)
+	}
+
+	return nil
+}

internal/provider/resource_credential_username_password_test.go

@@ -0,0 +1,199 @@
+package provider
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/credentials"
+	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+)
+
+const (
+	usernamePasswordCredResc     = "boundary_credential_username_password.example"
+	usernamePasswordCredName     = "foo"
+	usernamePasswordCredDesc     = "the foo"
+	usernamePasswordCredUsername = "default_username"
+	usernamePasswordCredPassword = "default_password"
+	usernamePasswordCredUpdate   = "_random"
+)
+
+func usernamePasswordCredResource(name, description, username, password string) string {
+	return fmt.Sprintf(`
+resource "boundary_credential_store_static" "example" {
+	name  = "static store name"
+	description = "static store description"
+	scope_id = boundary_scope.proj1.id
+	depends_on = [boundary_role.proj1_admin]
+}
+
+resource "boundary_credential_username_password" "example" {
+	name  = "%s"
+	description = "%s"
+	credential_store_id = boundary_credential_store_static.example.id
+	username = "%s"
+	password = "%s"
+}`, name,
+		description,
+		username,
+		password)
+}
+
+func TestAccCredentialUsernamePassword(t *testing.T) {
+	tc := controller.NewTestController(t, tcConfig...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	res := usernamePasswordCredResource(
+		usernamePasswordCredName,
+		usernamePasswordCredDesc,
+		usernamePasswordCredUsername,
+		usernamePasswordCredPassword,
+	)
+
+	resUpdate := usernamePasswordCredResource(
+		usernamePasswordCredName,
+		usernamePasswordCredDesc,
+		usernamePasswordCredUsername+usernamePasswordCredUpdate,
+		usernamePasswordCredPassword+usernamePasswordCredUpdate,
+	)
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		ProviderFactories: providerFactories(&provider),
+		CheckDestroy:      testAccCheckCredentialUsernamePasswordResourceDestroy(t, provider),
+		Steps: []resource.TestStep{
+			{
+				// create
+				Config: testConfig(url, fooOrg, firstProjectFoo, res),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(usernamePasswordCredResc, NameKey, usernamePasswordCredName),
+					resource.TestCheckResourceAttr(usernamePasswordCredResc, DescriptionKey, usernamePasswordCredDesc),
+					resource.TestCheckResourceAttr(usernamePasswordCredResc, credentialUsernamePasswordUsernameKey, usernamePasswordCredUsername),
+					resource.TestCheckResourceAttr(usernamePasswordCredResc, credentialUsernamePasswordPasswordKey, usernamePasswordCredPassword),
+
+					testAccCheckCredentialStoreUsernamePasswordHmac(provider),
+					testAccCheckCredentialUsernamePasswordResourceExists(provider, usernamePasswordCredResc),
+				),
+			},
+			importStep(usernamePasswordCredResc, credentialUsernamePasswordPasswordKey),
+			{
+				// update
+				Config: testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(usernamePasswordCredResc, NameKey, usernamePasswordCredName),
+					resource.TestCheckResourceAttr(usernamePasswordCredResc, DescriptionKey, usernamePasswordCredDesc),
+					resource.TestCheckResourceAttr(usernamePasswordCredResc, credentialUsernamePasswordUsernameKey, usernamePasswordCredUsername+usernamePasswordCredUpdate),
+					resource.TestCheckResourceAttr(usernamePasswordCredResc, credentialUsernamePasswordPasswordKey, usernamePasswordCredPassword+usernamePasswordCredUpdate),
+
+					testAccCheckCredentialStoreUsernamePasswordHmac(provider),
+					testAccCheckCredentialUsernamePasswordResourceExists(provider, usernamePasswordCredResc),
+				),
+			},
+			importStep(usernamePasswordCredResc, credentialUsernamePasswordPasswordKey),
+			{
+				// Run a plan only update and verify no changes
+				PlanOnly: true,
+				Config:   testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+			},
+			importStep(usernamePasswordCredResc, credentialUsernamePasswordPasswordKey),
+			{
+				// update again but apply a preConfig to externally update resource
+				PreConfig: func() { usernamePasswordCredExternalUpdate(t, provider) },
+				Config:    testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+			},
+			importStep(usernamePasswordCredResc, credentialUsernamePasswordPasswordKey),
+		},
+	})
+}
+
+func usernamePasswordCredExternalUpdate(t *testing.T, testProvider *schema.Provider) {
+	if storeId == "" {
+		t.Fatal("storeId must be set before testing an external update")
+	}
+
+	md := testProvider.Meta().(*metaData)
+	c := credentials.NewClient(md.client)
+	cr, err := c.Read(context.Background(), storeId)
+	if err != nil {
+		t.Fatal(fmt.Errorf("got an error reading %q: %w", storeId, err))
+	}
+
+	// update credential options
+	var opts []credentials.Option
+	opts = append(opts, credentials.WithDescription("this is an updated description, my guy"))
+
+	_, err = c.Update(context.Background(), cr.Item.Id, cr.Item.Version, opts...)
+	if err != nil {
+		t.Fatal(fmt.Errorf("got an error updating %q: %w", cr.Item.Id, err))
+	}
+}
+
+func testAccCheckCredentialUsernamePasswordResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("not found: %s", name)
+		}
+
+		id := rs.Primary.ID
+		if id == "" {
+			return fmt.Errorf("no ID is set")
+		}
+		storeId = id
+
+		md := testProvider.Meta().(*metaData)
+		c := credentials.NewClient(md.client)
+		if _, err := c.Read(context.Background(), id); err != nil {
+			return fmt.Errorf("got an error reading %q: %w", id, err)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckCredentialUsernamePasswordResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if testProvider.Meta() == nil {
+			t.Fatal("got nil provider metadata")
+		}
+		md := testProvider.Meta().(*metaData)
+
+		for _, rs := range s.RootModule().Resources {
+			switch rs.Type {
+			case "boundary_credential_username_password":
+				id := rs.Primary.ID
+
+				c := credentials.NewClient(md.client)
+				_, err := c.Read(context.Background(), id)
+				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
+					return fmt.Errorf("didn't get a 404 when reading destroyed username password credential %q: %v", id, err)
+				}
+			default:
+				continue
+			}
+		}
+		return nil
+	}
+}
+
+func testAccCheckCredentialStoreUsernamePasswordHmac(testProvider *schema.Provider) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[usernamePasswordCredResc]
+		if !ok {
+			return fmt.Errorf("not found: %s", usernamePasswordCredResc)
+		}
+
+		computed := rs.Primary.Attributes["password_hmac"]
+		if len(computed) != 43 {
+			return fmt.Errorf("Computed password hmac not the expected length of 43 characters. hmac: %q", computed)
+		}
+
+		return nil
+	}
+}

internal/provider/resource_host_catalog_static.go

@@ -16,8 +16,8 @@ const (
 
 func resourceHostCatalog() *schema.Resource {
 	return &schema.Resource{
-		DeprecationMessage: "Deprecated: use `resource_host_catalog_static` instead.",
-		Description:        "Deprecated: use `resource_host_catalog_static` instead.",
+		DeprecationMessage: "Deprecated: use `boundary_host_catalog_static` instead.",
+		Description:        "Deprecated: use `boundary_host_catalog_static` instead.",
 
 		CreateContext: resourceHostCatalogStaticCreate(true),
 		ReadContext:   resourceHostCatalogStaticRead(true),

internal/provider/resource_host_set_static.go

@@ -17,8 +17,8 @@ const (
 
 func resourceHostSet() *schema.Resource {
 	return &schema.Resource{
-		DeprecationMessage: "Deprecated: use `resource_host_set_static` instead.",
-		Description:        "Deprecated: use `resource_host_set_static` instead.",
+		DeprecationMessage: "Deprecated: use `boundary_host_set_static` instead.",
+		Description:        "Deprecated: use `boundary_host_set_static` instead.",
 
 		CreateContext: resourceHostSetStaticCreate,
 		ReadContext:   resourceHostSetStaticRead,

internal/provider/resource_host_static.go

@@ -17,8 +17,8 @@ const (
 
 func resourceHost() *schema.Resource {
 	return &schema.Resource{
-		DeprecationMessage: "Deprecated: use `resource_host_static` instead.",
-		Description:        "Deprecated: use `resource_host_static` instead.",
+		DeprecationMessage: "Deprecated: use `boundary_host_static` instead.",
+		Description:        "Deprecated: use `boundary_host_static` instead.",
 
 		CreateContext: resourceHostStaticCreate,
 		ReadContext:   resourceHostStaticRead,

plugins/kms/assets.go

@@ -1,19 +1,17 @@
 package kms_plugin_assets
 
 import (
-	"embed"
 	"io/fs"
+	"path"
+	"runtime"
 )
 
 const contentDir = "assets"
 
-// content is our static web server content.
-//go:embed assets
-var content embed.FS
-
 func FileSystem() fs.FS {
 	// Remove the root
-	f, err := fs.Sub(content, contentDir)
+	dir := path.Join(contentDir, runtime.GOOS, runtime.GOARCH)
+	f, err := fs.Sub(content, dir)
 	if err != nil {
 		panic(err)
 	}

plugins/kms/assets/README.md

@@ -1,3 +0,0 @@
-This directory contains assets for kms plugins. This file in particular exists
-so that the Go embed package does not throw errors when importing this module
-outside of the main tree.

plugins/kms/assets/darwin/amd64/README.md

@@ -0,0 +1,3 @@
+This directory contains assets for darwin amd64 kms plugins. This file 
+in particular exists so that the Go embed package does not throw errors 
+when importing this module outside of the main tree.

plugins/kms/assets/darwin/arm64/README.md

@@ -0,0 +1,3 @@
+This directory contains assets for darwin arm64 kms plugins. This file 
+in particular exists so that the Go embed package does not throw errors 
+when importing this module outside of the main tree.

plugins/kms/assets/freebsd/386/README.md

@@ -0,0 +1,3 @@
+This directory contains assets for freebsd 386 kms plugins. This file 
+in particular exists so that the Go embed package does not throw errors 
+when importing this module outside of the main tree.

plugins/kms/assets/freebsd/amd64/README.md

@@ -0,0 +1,3 @@
+This directory contains assets for freebsd amd64 kms plugins. This file 
+in particular exists so that the Go embed package does not throw errors 
+when importing this module outside of the main tree.

plugins/kms/assets/freebsd/arm/README.md

@@ -0,0 +1,3 @@
+This directory contains assets for freebsd arm kms plugins. This file 
+in particular exists so that the Go embed package does not throw errors 
+when importing this module outside of the main tree.

plugins/kms/assets/linux/386/README.md

@@ -0,0 +1,3 @@
+This directory contains assets for linux 386 kms plugins. This file 
+in particular exists so that the Go embed package does not throw errors 
+when importing this module outside of the main tree.

plugins/kms/assets/linux/amd64/README.md

@@ -0,0 +1,3 @@
+This directory contains assets for linux amd64 kms plugins. This file 
+in particular exists so that the Go embed package does not throw errors 
+when importing this module outside of the main tree.

plugins/kms/assets/linux/arm/README.md

@@ -0,0 +1,3 @@
+This directory contains assets for linux arm kms plugins. This file 
+in particular exists so that the Go embed package does not throw errors 
+when importing this module outside of the main tree.

plugins/kms/assets/linux/arm64/README.md

@@ -0,0 +1,3 @@
+This directory contains assets for linux arm64 kms plugins. This file 
+in particular exists so that the Go embed package does not throw errors 
+when importing this module outside of the main tree.

plugins/kms/assets/windows/386/README.md

@@ -0,0 +1,3 @@
+This directory contains assets for windows 386 kms plugins. This file 
+in particular exists so that the Go embed package does not throw errors 
+when importing this module outside of the main tree.

plugins/kms/assets/windows/amd64/README.md

@@ -0,0 +1,3 @@
+This directory contains assets for windows amd64 kms plugins. This file 
+in particular exists so that the Go embed package does not throw errors 
+when importing this module outside of the main tree.

plugins/kms/assets_darwin_amd64.go

@@ -0,0 +1,9 @@
+package kms_plugin_assets
+
+import (
+	"embed"
+)
+
+// content is our static kms plugin content.
+//go:embed assets/darwin/amd64
+var content embed.FS

plugins/kms/assets_darwin_arm64.go

@@ -0,0 +1,9 @@
+package kms_plugin_assets
+
+import (
+	"embed"
+)
+
+// content is our static kms plugin content.
+//go:embed assets/darwin/arm64
+var content embed.FS

plugins/kms/assets_freebsd_386.go

@@ -0,0 +1,9 @@
+package kms_plugin_assets
+
+import (
+	"embed"
+)
+
+// content is our static kms plugin content.
+//go:embed assets/freebsd/386
+var content embed.FS

plugins/kms/assets_freebsd_amd64.go

@@ -0,0 +1,9 @@
+package kms_plugin_assets
+
+import (
+	"embed"
+)
+
+// content is our static kms plugin content.
+//go:embed assets/freebsd/amd64
+var content embed.FS

plugins/kms/assets_freebsd_arm.go

@@ -0,0 +1,9 @@
+package kms_plugin_assets
+
+import (
+	"embed"
+)
+
+// content is our static kms plugin content.
+//go:embed assets/freebsd/arm
+var content embed.FS

plugins/kms/assets_linux_386.go

@@ -0,0 +1,9 @@
+package kms_plugin_assets
+
+import (
+	"embed"
+)
+
+// content is our static kms plugin content.
+//go:embed assets/linux/386
+var content embed.FS

plugins/kms/assets_linux_amd64.go

@@ -0,0 +1,9 @@
+package kms_plugin_assets
+
+import (
+	"embed"
+)
+
+// content is our static kms plugin content.
+//go:embed assets/linux/amd64
+var content embed.FS

plugins/kms/assets_linux_arm.go

@@ -0,0 +1,9 @@
+package kms_plugin_assets
+
+import (
+	"embed"
+)
+
+// content is our static kms plugin content.
+//go:embed assets/linux/arm
+var content embed.FS

plugins/kms/assets_linux_arm64.go

@@ -0,0 +1,9 @@
+package kms_plugin_assets
+
+import (
+	"embed"
+)
+
+// content is our static kms plugin content.
+//go:embed assets/linux/arm64
+var content embed.FS

plugins/kms/assets_windows_386.go

@@ -0,0 +1,9 @@
+package kms_plugin_assets
+
+import (
+	"embed"
+)
+
+// content is our static kms plugin content.
+//go:embed assets/windows/386
+var content embed.FS

plugins/kms/assets_windows_amd64.go

@@ -0,0 +1,9 @@
+package kms_plugin_assets
+
+import (
+	"embed"
+)
+
+// content is our static kms plugin content.
+//go:embed assets/windows/amd64
+var content embed.FS

scripts/plugins-all.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+#
+# This script builds the required plugins for all supported distributions.
+set -e
+
+# Get the parent directory of where this script is.
+SOURCE="${BASH_SOURCE[0]}"
+while [ -h "$SOURCE" ] ; do SOURCE="$(readlink "$SOURCE")"; done
+export DIR="$( cd -P "$( dirname "$SOURCE" )/.." && pwd )"
+
+platforms="darwin/arm64 darwin/amd64 freebsd/386 freebsd/amd64 freebsd/arm linux/386 linux/amd64 linux/arm linux/arm64 windows/386 windows/amd64"
+
+cd $DIR/scripts;
+for platform in ${platforms}
+do
+    split=(${platform//\// })
+    goos=${split[0]}
+    goarch=${split[1]}
+    GOOS=${goos} GOARCH=${goarch} ./plugins.sh
+ done

scripts/plugins.sh

@@ -3,6 +3,16 @@
 # This script builds the required plugins.
 set -e
 
+if [[ -z "$GOOS" ]]; then
+    echo "Must provide GOOS in environment" 1>&2
+    exit 1
+fi
+
+if [[ -z "GOARCH" ]]; then
+    echo "Must provide GOARCH in environment" 1>&2
+    exit 1
+fi
+
 BINARY_SUFFIX=""
 if [ "${GOOS}x" = "windowsx" ]; then
     BINARY_SUFFIX=".exe"
@@ -13,16 +23,16 @@ SOURCE="${BASH_SOURCE[0]}"
 while [ -h "$SOURCE" ] ; do SOURCE="$(readlink "$SOURCE")"; done
 export DIR="$( cd -P "$( dirname "$SOURCE" )/.." && pwd )"
 
-echo "==> Building kms plugins..."
-rm -f $DIR/plugins/kms/assets/boundary-plugin-kms*
+echo "==> Building kms plugins for ${GOOS}-${GOARCH}..."
+rm -f $DIR/plugins/kms/assets/${GOOS}/${GOARCH}/boundary-plugin-kms-*
 for CURR_PLUGIN in $(ls $DIR/plugins/kms/mains); do
     echo "==> Building $CURR_PLUGIN plugin..."
     cd $DIR/plugins/kms/mains/$CURR_PLUGIN;
-    go build -v -o $DIR/plugins/kms/assets/boundary-plugin-kms-${CURR_PLUGIN}${BINARY_SUFFIX} .;
+    go build -v -o $DIR/plugins/kms/assets/${GOOS}/${GOARCH}/boundary-plugin-kms-${CURR_PLUGIN}${BINARY_SUFFIX} .;
     cd $DIR;
 done;
-cd $DIR/plugins/kms/assets;
-for CURR_PLUGIN in $(ls boundary-plugin*); do
+cd $DIR/plugins/kms/assets/${GOOS}/${GOARCH};
+for CURR_PLUGIN in $(ls boundary-plugin-kms-*); do
     echo "==> gzip $CURR_PLUGIN plugin..."
     gzip -f -9 $CURR_PLUGIN;
 done;