chore: Update changelog

* chore: deprecate application_credential_source_ids

.go-version

@@ -1 +1 @@
-1.18.1
+1.19.1

CHANGELOG.md

@@ -1,3 +1,37 @@
+# Boundary Terraform Provider CHANGELOG
+
+Canonical reference for changes, improvements, and bugfixes for the Boundary Terraform provider.
+
+## 1.0.12 (September 13, 2022)
+
+### New and Improved
+
+* Add support for SSH targets
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/264)).
+
+### Deprecations/Changes
+
+* Deprecate `application_credential_source_ids` of the `target` resource
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/260)).
+
+## 1.0.11 (August 26, 2022)
+
+### New and Improved
+
+* Add support for SSH private key credentials
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/257)).
+* Add support for credential type in Vault libraries
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/257)).
+
+## 1.0.10 (August 10, 2022)
+
+### New and Improved
+
+* Adds support for static credential stores
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/236)).
+* Adds support for username password credentials 
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/242)).
+
 ## 1.0.9 (June 6, 2022)
 
 ### Bug Fixes

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.18
+FROM golang:1.19
 
 WORKDIR /go/src/terraform-provider-boundary
 COPY . .

README.md

@@ -9,7 +9,7 @@ Requirements
 ------------
 
 -	[Terraform](https://www.terraform.io/downloads.html) >= 0.12.x
--	[Go](https://golang.org/doc/install) >= 1.18
+-	[Go](https://golang.org/doc/install) >= 1.19
 
 Building The Provider
 ---------------------

ci/goinstall.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 set -e
 
-VERSION="1.18.1"
+VERSION="1.19.1"
 
 [ -z "$GOROOT" ] && GOROOT="$HOME/.go"
 [ -z "$GOPATH" ] && GOPATH="$HOME/go"

docs/resources/account.md

@@ -3,12 +3,12 @@
 page_title: "boundary_account Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  Deprecated: use resource_account_password instead.
+  Deprecated: use boundary_account_password instead.
 ---
 
 # boundary_account (Resource)
 
-Deprecated: use `resource_account_password` instead.
+Deprecated: use `boundary_account_password` instead.
 
 
 

docs/resources/credential_library_vault.md

@@ -68,6 +68,7 @@ EOT
 
 ### Optional
 
+- `credential_type` (String) The type of credential the library generates.
 - `description` (String) The Vault credential library description.
 - `http_method` (String) The HTTP method the library uses when requesting credentials from Vault. Defaults to 'GET'
 - `http_request_body` (String) The body of the HTTP request the library sends to Vault when requesting credentials. Only valid if `http_method` is set to `POST`.

docs/resources/credential_ssh_private_key.md

@@ -0,0 +1,74 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_credential_ssh_private_key Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The SSH private key credential resource allows you to configure a credential using a username, private key and optional passphrase.
+---
+
+# boundary_credential_ssh_private_key (Resource)
+
+The SSH private key credential resource allows you to configure a credential using a username, private key and optional passphrase.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_static" "example" {
+  name        = "example_static_credential_store"
+  description = "My first static credential store!"
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_ssh_private_key" "example" {
+  name                   = "example_ssh_private_key"
+  description            = "My first ssh private key credential!"
+  credential_store_id    = boundary_credential_store_static.example.id
+  username               = "my-username"
+  private_key            = file("~/.ssh/id_rsa") # change to valid SSH Private Key
+  private_key_passphrase = "optional-passphrase" # change to the passphrase of the Private Key if required
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `credential_store_id` (String) ID of the credential store this credential belongs to.
+- `private_key` (String) The private key associated with the credential.
+- `username` (String) The username associated with the credential.
+
+### Optional
+
+- `description` (String) The description of the credential.
+- `name` (String) The name of the credential. Defaults to the resource name.
+- `private_key_passphrase` (String) The passphrase of the private key associated with the credential.
+
+### Read-Only
+
+- `id` (String) The ID of the credential.
+- `private_key_hmac` (String) The private key hmac.
+- `private_key_passphrase_hmac` (String) The private key passphrase hmac.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_credential_ssh_private_key.example_ssh_private_key <my-id>
+```

docs/resources/credential_store_static.md

@@ -0,0 +1,60 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_credential_store_static Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The static credential store resource allows you to configure a Boundary static credential store.
+---
+
+# boundary_credential_store_static (Resource)
+
+The static credential store resource allows you to configure a Boundary static credential store.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_static" "example" {
+  name        = "example_static_credential_store"
+  description = "My first static credential store!"
+  scope_id    = boundary_scope.project.id
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `scope_id` (String) The scope for this credential store.
+
+### Optional
+
+- `description` (String) The static credential store description.
+- `name` (String) The static credential store name. Defaults to the resource name.
+
+### Read-Only
+
+- `id` (String) The ID of the static credential store.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_credential_store_static.example_static_credential_store <my-id>
+```

docs/resources/credential_username_password.md

@@ -0,0 +1,71 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_credential_username_password Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The username/password credential resource allows you to configure a credential using a username and password pair.
+---
+
+# boundary_credential_username_password (Resource)
+
+The username/password credential resource allows you to configure a credential using a username and password pair.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_static" "example" {
+  name        = "example_static_credential_store"
+  description = "My first static credential store!"
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_username_password" "example" {
+  name                = "example_username_password"
+  description         = "My first username password credential!"
+  credential_store_id = boundary_credential_store_static.example.id
+  username            = "my-username"
+  password            = "my-password"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `credential_store_id` (String) The credential store in which to save this username/password credential.
+- `password` (String) The password of this username/password credential.
+- `username` (String) The username of this username/password credential.
+
+### Optional
+
+- `description` (String) The description of this username/password credential.
+- `name` (String) The name of this username/password credential. Defaults to the resource name.
+
+### Read-Only
+
+- `id` (String) The ID of this username/password credential.
+- `password_hmac` (String) The password hmac.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_credential_username_password.example_username_password <my-id>
+```

docs/resources/host.md

@@ -3,12 +3,12 @@
 page_title: "boundary_host Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  Deprecated: use resource_host_static instead.
+  Deprecated: use boundary_host_static instead.
 ---
 
 # boundary_host (Resource)
 
-Deprecated: use `resource_host_static` instead.
+Deprecated: use `boundary_host_static` instead.
 
 ## Example Usage
 

docs/resources/host_catalog.md

@@ -3,12 +3,12 @@
 page_title: "boundary_host_catalog Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  Deprecated: use resource_host_catalog_static instead.
+  Deprecated: use boundary_host_catalog_static instead.
 ---
 
 # boundary_host_catalog (Resource)
 
-Deprecated: use `resource_host_catalog_static` instead.
+Deprecated: use `boundary_host_catalog_static` instead.
 
 ## Example Usage
 

docs/resources/host_set.md

@@ -3,12 +3,12 @@
 page_title: "boundary_host_set Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  Deprecated: use resource_host_set_static instead.
+  Deprecated: use boundary_host_set_static instead.
 ---
 
 # boundary_host_set (Resource)
 
-Deprecated: use `resource_host_set_static` instead.
+Deprecated: use `boundary_host_set_static` instead.
 
 ## Example Usage
 

docs/resources/target.md

@@ -47,6 +47,7 @@ resource "boundary_credential_library_vault" "foo" {
   credential_store_id = boundary_credential_store_vault.foo.id
   path                = "my/secret/foo" # change to Vault backend path
   http_method         = "GET"
+  credential_type     = "username_password"
 }
 
 resource "boundary_host_catalog" "foo" {
@@ -92,7 +93,21 @@ resource "boundary_target" "foo" {
   host_source_ids = [
     boundary_host_set.foo.id
   ]
-  application_credential_source_ids = [
+  brokered_credential_source_ids = [
+    boundary_credential_library_vault.foo.id
+  ]
+}
+
+resource "boundary_target" "ssh_foo" {
+  name         = "ssh_foo"
+  description  = "Ssh target"
+  type         = "ssh"
+  default_port = "22"
+  scope_id     = boundary_scope.project.id
+  host_source_ids = [
+    boundary_host_set.foo.id
+  ]
+  injected_application_credential_source_ids = [
     boundary_credential_library_vault.foo.id
   ]
 }
@@ -108,10 +123,12 @@ resource "boundary_target" "foo" {
 
 ### Optional
 
-- `application_credential_source_ids` (Set of String) A list of application credential source ID's.
+- `application_credential_source_ids` (Set of String, Deprecated) A list of application credential source ID's.
+- `brokered_credential_source_ids` (Set of String) A list of brokered credential source ID's.
 - `default_port` (Number) The default port for this target.
 - `description` (String) The target description.
 - `host_source_ids` (Set of String) A list of host source ID's.
+- `injected_application_credential_source_ids` (Set of String) A list of injected application credential source ID's.
 - `name` (String) The target name. Defaults to the resource name.
 - `session_connection_limit` (Number)
 - `session_max_seconds` (Number)

examples/resources/boundary_credential_ssh_private_key/import.sh

@@ -0,0 +1 @@
+terraform import boundary_credential_ssh_private_key.example_ssh_private_key <my-id>

examples/resources/boundary_credential_ssh_private_key/resource.tf

@@ -0,0 +1,29 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_static" "example" {
+  name        = "example_static_credential_store"
+  description = "My first static credential store!"
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_ssh_private_key" "example" {
+  name                   = "example_ssh_private_key"
+  description            = "My first ssh private key credential!"
+  credential_store_id    = boundary_credential_store_static.example.id
+  username               = "my-username"
+  private_key            = file("~/.ssh/id_rsa") # change to valid SSH Private Key
+  private_key_passphrase = "optional-passphrase" # change to the passphrase of the Private Key if required
+}

examples/resources/boundary_credential_store_static/import.sh

@@ -0,0 +1 @@
+terraform import boundary_credential_store_static.example_static_credential_store <my-id>

examples/resources/boundary_credential_store_static/resource.tf

@@ -0,0 +1,20 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_static" "example" {
+  name        = "example_static_credential_store"
+  description = "My first static credential store!"
+  scope_id    = boundary_scope.project.id
+}

examples/resources/boundary_credential_username_password/import.sh

@@ -0,0 +1 @@
+terraform import boundary_credential_username_password.example_username_password <my-id>

examples/resources/boundary_credential_username_password/resource.tf

@@ -0,0 +1,28 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_static" "example" {
+  name        = "example_static_credential_store"
+  description = "My first static credential store!"
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_username_password" "example" {
+  name                = "example_username_password"
+  description         = "My first username password credential!"
+  credential_store_id = boundary_credential_store_static.example.id
+  username            = "my-username"
+  password            = "my-password"
+}

examples/resources/boundary_target/resource.tf

@@ -32,6 +32,7 @@ resource "boundary_credential_library_vault" "foo" {
   credential_store_id = boundary_credential_store_vault.foo.id
   path                = "my/secret/foo" # change to Vault backend path
   http_method         = "GET"
+  credential_type     = "username_password"
 }
 
 resource "boundary_host_catalog" "foo" {
@@ -77,7 +78,21 @@ resource "boundary_target" "foo" {
   host_source_ids = [
     boundary_host_set.foo.id
   ]
-  application_credential_source_ids = [
+  brokered_credential_source_ids = [
+    boundary_credential_library_vault.foo.id
+  ]
+}
+
+resource "boundary_target" "ssh_foo" {
+  name         = "ssh_foo"
+  description  = "Ssh target"
+  type         = "ssh"
+  default_port = "22"
+  scope_id     = boundary_scope.project.id
+  host_source_ids = [
+    boundary_host_set.foo.id
+  ]
+  injected_application_credential_source_ids = [
     boundary_credential_library_vault.foo.id
   ]
 }

go.mod

@@ -1,32 +1,33 @@
 module github.com/hashicorp/terraform-provider-boundary
 
-go 1.18
+go 1.19
 
 require (
-	github.com/hashicorp/boundary v0.8.1
-	github.com/hashicorp/boundary/api v0.0.24
-	github.com/hashicorp/boundary/sdk v0.0.15
+	github.com/hashicorp/boundary v0.10.4
+	github.com/hashicorp/boundary/api v0.0.29
+	github.com/hashicorp/boundary/sdk v0.0.22
 	github.com/hashicorp/cap v0.2.0
 	github.com/hashicorp/go-cty v1.4.1-0.20200723130312-85980079f637
-	github.com/hashicorp/go-kms-wrapping/v2 v2.0.5
-	github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.3
-	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.5
-	github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.1
-	github.com/hashicorp/terraform-plugin-docs v0.9.0
-	github.com/hashicorp/terraform-plugin-sdk/v2 v2.17.0
+	github.com/hashicorp/go-kms-wrapping/v2 v2.0.6-0.20220722192355-a843f53fa48d
+	github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.5
+	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7
+	github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.2
+	github.com/hashicorp/terraform-plugin-docs v0.13.0
+	github.com/hashicorp/terraform-plugin-sdk/v2 v2.22.0
 	github.com/kr/pretty v0.3.0
 	github.com/mitchellh/go-homedir v1.1.0
-	github.com/stretchr/testify v1.7.1
-	golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e
+	github.com/stretchr/testify v1.8.0
+	golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa
 )
 
 require (
 	github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 // indirect
-	github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
+	github.com/DATA-DOG/go-sqlmock v1.5.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.1.1 // indirect
 	github.com/Masterminds/sprig/v3 v3.2.2 // indirect
-	github.com/Microsoft/go-winio v0.4.16 // indirect
+	github.com/Microsoft/go-winio v0.5.0 // indirect
 	github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 // indirect
 	github.com/agext/levenshtein v1.2.2 // indirect
 	github.com/alessio/shellescape v1.4.1 // indirect
@@ -38,13 +39,12 @@ require (
 	github.com/cenkalti/backoff/v3 v3.0.0 // indirect
 	github.com/cenkalti/backoff/v4 v4.1.0 // indirect
 	github.com/cespare/xxhash/v2 v2.1.2 // indirect
-	github.com/containerd/containerd v1.4.3 // indirect
-	github.com/containerd/continuity v0.0.0-20200709052629-daa8e1ccc0bc // indirect
+	github.com/containerd/continuity v0.1.0 // indirect
 	github.com/coreos/go-oidc/v3 v3.1.0 // indirect
 	github.com/danieljoos/wincred v1.1.2 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/docker/cli v20.10.7+incompatible // indirect
-	github.com/docker/docker v20.10.7+incompatible // indirect
+	github.com/docker/docker v20.10.9+incompatible // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
 	github.com/docker/go-units v0.4.0 // indirect
 	github.com/dvsekhvalnov/jose2go v1.5.0 // indirect
@@ -52,14 +52,14 @@ require (
 	github.com/fatih/structs v1.1.0 // indirect
 	github.com/godbus/dbus/v5 v5.0.6 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang-migrate/migrate/v4 v4.14.1 // indirect
+	github.com/golang-migrate/migrate/v4 v4.15.1 // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
 	github.com/google/go-cmp v0.5.8 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/google/uuid v1.3.0 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.10.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.2 // indirect
 	github.com/hashicorp/dbassert v0.0.0-20210708202608-ecf920cf1ed8 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/eventlogger v0.1.1-0.20211106154408-4ff8da3a890c // indirect
@@ -67,9 +67,10 @@ require (
 	github.com/hashicorp/go-bexpr v0.1.10 // indirect
 	github.com/hashicorp/go-checkpoint v0.5.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-dbw v0.0.0-20211215222256-2ff0d37184ff // indirect
-	github.com/hashicorp/go-hclog v1.2.0 // indirect
+	github.com/hashicorp/go-dbw v0.0.0-20220725170111-b7cb3aa3d628 // indirect
+	github.com/hashicorp/go-hclog v1.2.2 // indirect
 	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
+	github.com/hashicorp/go-kms-wrapping/extras/kms/v2 v2.0.0-20220711120347-32232bae6803 // indirect
 	github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.2 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-plugin v1.4.4 // indirect
@@ -85,17 +86,18 @@ require (
 	github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.1 // indirect
 	github.com/hashicorp/go-sockaddr v1.0.2 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
-	github.com/hashicorp/go-version v1.5.0 // indirect
+	github.com/hashicorp/go-version v1.6.0 // indirect
 	github.com/hashicorp/golang-lru v0.5.4 // indirect
-	github.com/hashicorp/hc-install v0.3.2 // indirect
+	github.com/hashicorp/hc-install v0.4.0 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
-	github.com/hashicorp/hcl/v2 v2.12.0 // indirect
+	github.com/hashicorp/hcl/v2 v2.14.0 // indirect
 	github.com/hashicorp/logutils v1.0.0 // indirect
-	github.com/hashicorp/terraform-exec v0.16.1 // indirect
+	github.com/hashicorp/nodeenrollment v0.1.16 // indirect
+	github.com/hashicorp/terraform-exec v0.17.3 // indirect
 	github.com/hashicorp/terraform-json v0.14.0 // indirect
-	github.com/hashicorp/terraform-plugin-go v0.9.1 // indirect
-	github.com/hashicorp/terraform-plugin-log v0.4.0 // indirect
-	github.com/hashicorp/terraform-registry-address v0.0.0-20210412075316-9b2996cce896 // indirect
+	github.com/hashicorp/terraform-plugin-go v0.14.0 // indirect
+	github.com/hashicorp/terraform-plugin-log v0.7.0 // indirect
+	github.com/hashicorp/terraform-registry-address v0.0.0-20220623143253-7d51757b572c // indirect
 	github.com/hashicorp/terraform-svchost v0.0.0-20200729002733-f050f53b9734 // indirect
 	github.com/hashicorp/vault/api v1.3.1 // indirect
 	github.com/hashicorp/vault/sdk v0.3.0 // indirect
@@ -103,25 +105,25 @@ require (
 	github.com/huandu/xstrings v1.3.2 // indirect
 	github.com/imdario/mergo v0.3.13 // indirect
 	github.com/jackc/chunkreader/v2 v2.0.1 // indirect
-	github.com/jackc/pgconn v1.10.1 // indirect
+	github.com/jackc/pgconn v1.12.1 // indirect
 	github.com/jackc/pgio v1.0.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
-	github.com/jackc/pgproto3/v2 v2.2.0 // indirect
+	github.com/jackc/pgproto3/v2 v2.3.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b // indirect
-	github.com/jackc/pgtype v1.9.0 // indirect
-	github.com/jackc/pgx/v4 v4.14.0 // indirect
+	github.com/jackc/pgtype v1.11.0 // indirect
+	github.com/jackc/pgx/v4 v4.16.1 // indirect
 	github.com/jefferai/go-libsecret v0.0.0-20210525195240-b53481abef97 // indirect
 	github.com/jefferai/isbadcipher v0.0.0-20190226160619-51d2077c035f // indirect
 	github.com/jefferai/keyring v1.1.7-0.20220316160357-58a74bb55891 // indirect
 	github.com/jinzhu/gorm v1.9.12 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
-	github.com/jinzhu/now v1.1.3 // indirect
+	github.com/jinzhu/now v1.1.5 // indirect
 	github.com/kr/text v0.2.0 // indirect
 	github.com/lib/pq v1.10.2 // indirect
 	github.com/mattn/go-colorable v0.1.12 // indirect
 	github.com/mattn/go-isatty v0.0.14 // indirect
-	github.com/mattn/go-sqlite3 v2.0.1+incompatible // indirect
-	github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
+	github.com/mattn/go-sqlite3 v2.0.3+incompatible // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
 	github.com/mitchellh/cli v1.1.4 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/go-testing-interface v1.14.1 // indirect
@@ -129,13 +131,13 @@ require (
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/mitchellh/pointerstructure v1.2.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
-	github.com/moby/term v0.0.0-20201216013528-df9cb8a40635 // indirect
+	github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6 // indirect
 	github.com/mr-tron/base58 v1.2.0 // indirect
 	github.com/mtibben/percent v0.2.1 // indirect
 	github.com/oklog/run v1.0.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.0.1 // indirect
-	github.com/opencontainers/runc v1.0.0-rc9 // indirect
+	github.com/opencontainers/runc v1.0.2 // indirect
 	github.com/ory/dockertest/v3 v3.7.0 // indirect
 	github.com/pierrec/lz4 v2.5.2+incompatible // indirect
 	github.com/pires/go-proxyproto v0.6.1 // indirect
@@ -149,8 +151,9 @@ require (
 	github.com/rogpeppe/go-internal v1.8.1 // indirect
 	github.com/russross/blackfriday v1.6.0 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
+	github.com/sethvargo/go-diceware v0.3.0 // indirect
 	github.com/shopspring/decimal v1.3.1 // indirect
-	github.com/sirupsen/logrus v1.7.0 // indirect
+	github.com/sirupsen/logrus v1.8.1 // indirect
 	github.com/spf13/cast v1.5.0 // indirect
 	github.com/vmihailenco/msgpack v4.0.4+incompatible // indirect
 	github.com/vmihailenco/msgpack/v4 v4.3.12 // indirect
@@ -158,24 +161,24 @@ require (
 	github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
-	github.com/xo/dburl v0.9.0 // indirect
+	github.com/xo/dburl v0.11.0 // indirect
 	github.com/zalando/go-keyring v0.2.1 // indirect
-	github.com/zclconf/go-cty v1.10.0 // indirect
+	github.com/zclconf/go-cty v1.11.0 // indirect
 	go.uber.org/atomic v1.9.0 // indirect
-	golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd // indirect
-	golang.org/x/oauth2 v0.0.0-20220309155454-6242fa91716a // indirect
-	golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a // indirect
+	golang.org/x/net v0.0.0-20220624214902-1bab6f366d9e // indirect
+	golang.org/x/oauth2 v0.0.0-20220722155238-128564f6959c // indirect
+	golang.org/x/sys v0.0.0-20220627191245-f75cf1eec38b // indirect
 	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 // indirect
 	golang.org/x/text v0.3.7 // indirect
 	golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20220317150908-0efb43f6373e // indirect
-	google.golang.org/grpc v1.46.0 // indirect
-	google.golang.org/protobuf v1.28.0 // indirect
+	google.golang.org/genproto v0.0.0-20220805133916-01dd62135a58 // indirect
+	google.golang.org/grpc v1.48.0 // indirect
+	google.golang.org/protobuf v1.28.1 // indirect
 	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	gopkg.in/yaml.v3 v3.0.0 // indirect
-	gorm.io/driver/postgres v1.2.2 // indirect
-	gorm.io/driver/sqlite v1.2.4 // indirect
-	gorm.io/gorm v1.22.3 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	gorm.io/driver/postgres v1.3.8 // indirect
+	gorm.io/driver/sqlite v1.3.6 // indirect
+	gorm.io/gorm v1.23.8 // indirect
 )

internal/provider/provider.go

@@ -14,7 +14,7 @@ import (
 	"github.com/hashicorp/go-secure-stdlib/pluginutil/v2"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-provider-boundary/plugins/kms"
+	kms_plugin_assets "github.com/hashicorp/terraform-provider-boundary/plugins/kms"
 )
 
 func init() {
@@ -62,28 +62,31 @@ func New() *schema.Provider {
 			},
 		},
 		ResourcesMap: map[string]*schema.Resource{
-			"boundary_account":                  resourceAccount(),
-			"boundary_account_password":         resourceAccountPassword(),
-			"boundary_account_oidc":             resourceAccountOidc(),
-			"boundary_auth_method":              resourceAuthMethod(),
-			"boundary_auth_method_password":     resourceAuthMethodPassword(),
-			"boundary_auth_method_oidc":         resourceAuthMethodOidc(),
-			"boundary_credential_library_vault": resourceCredentialLibraryVault(),
-			"boundary_credential_store_vault":   resourceCredentialStoreVault(),
-			"boundary_managed_group":            resourceManagedGroup(),
-			"boundary_group":                    resourceGroup(),
-			"boundary_host":                     resourceHost(),
-			"boundary_host_static":              resourceHostStatic(),
-			"boundary_host_catalog":             resourceHostCatalog(),
-			"boundary_host_catalog_static":      resourceHostCatalogStatic(),
-			"boundary_host_catalog_plugin":      resourceHostCatalogPlugin(),
-			"boundary_host_set":                 resourceHostSet(),
-			"boundary_host_set_static":          resourceHostSetStatic(),
-			"boundary_host_set_plugin":          resourceHostSetPlugin(),
-			"boundary_role":                     resourceRole(),
-			"boundary_scope":                    resourceScope(),
-			"boundary_target":                   resourceTarget(),
-			"boundary_user":                     resourceUser(),
+			"boundary_account":                      resourceAccount(),
+			"boundary_account_password":             resourceAccountPassword(),
+			"boundary_account_oidc":                 resourceAccountOidc(),
+			"boundary_auth_method":                  resourceAuthMethod(),
+			"boundary_auth_method_password":         resourceAuthMethodPassword(),
+			"boundary_auth_method_oidc":             resourceAuthMethodOidc(),
+			"boundary_credential_library_vault":     resourceCredentialLibraryVault(),
+			"boundary_credential_store_vault":       resourceCredentialStoreVault(),
+			"boundary_credential_store_static":      resourceCredentialStoreStatic(),
+			"boundary_credential_username_password": resourceCredentialUsernamePassword(),
+			"boundary_credential_ssh_private_key":   resourceCredentialSshPrivateKey(),
+			"boundary_managed_group":                resourceManagedGroup(),
+			"boundary_group":                        resourceGroup(),
+			"boundary_host":                         resourceHost(),
+			"boundary_host_static":                  resourceHostStatic(),
+			"boundary_host_catalog":                 resourceHostCatalog(),
+			"boundary_host_catalog_static":          resourceHostCatalogStatic(),
+			"boundary_host_catalog_plugin":          resourceHostCatalogPlugin(),
+			"boundary_host_set":                     resourceHostSet(),
+			"boundary_host_set_static":              resourceHostSetStatic(),
+			"boundary_host_set_plugin":              resourceHostSetPlugin(),
+			"boundary_role":                         resourceRole(),
+			"boundary_scope":                        resourceScope(),
+			"boundary_target":                       resourceTarget(),
+			"boundary_user":                         resourceUser(),
 		},
 	}
 

internal/provider/resource_account.go

@@ -12,8 +12,8 @@ import (
 
 func resourceAccount() *schema.Resource {
 	return &schema.Resource{
-		DeprecationMessage: "Deprecated: use `resource_account_password` instead.",
-		Description:        "Deprecated: use `resource_account_password` instead.",
+		DeprecationMessage: "Deprecated: use `boundary_account_password` instead.",
+		Description:        "Deprecated: use `boundary_account_password` instead.",
 
 		CreateContext: resourceAccountCreate,
 		ReadContext:   resourceAccountRead,

internal/provider/resource_credential_library_vault.go

@@ -6,7 +6,6 @@ import (
 
 	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/credentiallibraries"
-
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 )
@@ -16,6 +15,7 @@ const (
 	credentialLibraryVaultHttpMethodKey      = "http_method"
 	credentialLibraryVaultHttpRequestBodyKey = "http_request_body"
 	credentialLibraryVaultPathKey            = "path"
+	credentialLibraryCredentialTypeKey       = "credential_type"
 )
 
 var libraryVaultAttrs = []string{
@@ -73,6 +73,11 @@ func resourceCredentialLibraryVault() *schema.Resource {
 				Type:        schema.TypeString,
 				Required:    true,
 			},
+			credentialLibraryCredentialTypeKey: {
+				Description: "The type of credential the library generates.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
 		},
 	}
 }
@@ -121,6 +126,9 @@ func resourceCredentialLibraryCreateVault(ctx context.Context, d *schema.Resourc
 	if v, ok := d.GetOk(credentialLibraryVaultPathKey); ok {
 		opts = append(opts, credentiallibraries.WithVaultCredentialLibraryPath(v.(string)))
 	}
+	if v, ok := d.GetOk(credentialLibraryCredentialTypeKey); ok {
+		opts = append(opts, credentiallibraries.WithCredentialType(v.(string)))
+	}
 
 	var credentialStoreId string
 	cid, ok := d.GetOk(credentialStoreIdKey)

internal/provider/resource_credential_library_vault_test.go

@@ -17,6 +17,7 @@ import (
 
 const (
 	vaultCredResc            = "boundary_credential_library_vault.example"
+	vaultCredTypedResc       = "boundary_credential_library_vault.typed_example"
 	vaultCredLibName         = "foo"
 	vaultCredLibDesc         = "the foo"
 	vaultCredLibPath         = "/foo/bar"
@@ -52,6 +53,19 @@ resource "boundary_credential_library_vault" "example" {
 	vaultCredLibMethodPost,
 	vaultCredLibRequestBody)
 
+var vaultTypedCredLibResource = fmt.Sprintf(`
+resource "boundary_credential_library_vault" "typed_example" {
+	name                = "%s"
+	description         = "%s"
+	credential_store_id = boundary_credential_store_vault.example.id
+  	path                = "%s"
+  	http_method         = "%s"
+	credential_type     = "ssh_private_key"
+}`, vaultCredLibName,
+	vaultCredLibDesc,
+	vaultCredLibPath,
+	vaultCredLibMethodGet)
+
 func TestAccCredentialLibraryVault(t *testing.T) {
 	tc := controller.NewTestController(t, tcConfig...)
 	defer tc.Shutdown()
@@ -69,8 +83,9 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
+		IsUnitTest:        true,
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckAuthMethodResourceDestroy(t, provider),
+		CheckDestroy:      testAccCheckCredentialLibraryVaultResourceDestroy(t, provider),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -101,6 +116,22 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 				),
 			},
 			importStep(vaultCredResc),
+
+			{
+				// create typed credential library, note credential type is immutable so no need for update test
+				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate, vaultTypedCredLibResource),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(vaultCredTypedResc, NameKey, vaultCredLibName),
+					resource.TestCheckResourceAttr(vaultCredTypedResc, DescriptionKey, vaultCredLibDesc),
+					resource.TestCheckResourceAttr(vaultCredTypedResc, credentialLibraryVaultPathKey, vaultCredLibPath),
+					resource.TestCheckResourceAttr(vaultCredTypedResc, credentialLibraryVaultHttpMethodKey, vaultCredLibMethodGet),
+					resource.TestCheckResourceAttr(vaultCredTypedResc, credentialLibraryVaultHttpRequestBodyKey, ""),
+					resource.TestCheckResourceAttr(vaultCredTypedResc, credentialLibraryCredentialTypeKey, "ssh_private_key"),
+
+					testAccCheckCredentialLibraryVaultResourceExists(provider, vaultCredTypedResc),
+				),
+			},
+			importStep(vaultCredResc),
 		},
 	})
 }

internal/provider/resource_credential_ssh_private_key.go

@@ -0,0 +1,276 @@
+package provider
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/credentials"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+const (
+	credentialSshPrivateKeyUsernameKey       = "username"
+	credentialSshPrivateKeyPrivateKeyKey     = "private_key"
+	credentialSshPrivateKeyPrivateKeyHmacKey = "private_key_hmac"
+	credentialSshPrivateKeyPassphraseKey     = "private_key_passphrase"
+	credentialSshPrivateKeyPassphraseHmacKey = "private_key_passphrase_hmac"
+	credentialSshPrivateKeyCredentialType    = "ssh_private_key"
+)
+
+func resourceCredentialSshPrivateKey() *schema.Resource {
+	return &schema.Resource{
+		Description: "The SSH private key credential resource allows you to configure a credential using a username, private key and optional passphrase.",
+
+		CreateContext: resourceCredentialSshPrivateKeyCreate,
+		ReadContext:   resourceCredentialSshPrivateKeyRead,
+		UpdateContext: resourceCredentialSshPrivateKeyUpdate,
+		DeleteContext: resourceCredentialSshPrivateKeyDelete,
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			IDKey: {
+				Description: "The ID of the credential.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			NameKey: {
+				Description: "The name of the credential. Defaults to the resource name.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			DescriptionKey: {
+				Description: "The description of the credential.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			credentialStoreIdKey: {
+				Description: "ID of the credential store this credential belongs to.",
+				Type:        schema.TypeString,
+				ForceNew:    true,
+				Required:    true,
+			},
+			credentialSshPrivateKeyUsernameKey: {
+				Description: "The username associated with the credential.",
+				Type:        schema.TypeString,
+				Required:    true,
+			},
+			credentialSshPrivateKeyPrivateKeyKey: {
+				Description: "The private key associated with the credential.",
+				Type:        schema.TypeString,
+				Required:    true,
+			},
+			credentialSshPrivateKeyPrivateKeyHmacKey: {
+				Description: "The private key hmac.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			credentialSshPrivateKeyPassphraseKey: {
+				Description: "The passphrase of the private key associated with the credential.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			credentialSshPrivateKeyPassphraseHmacKey: {
+				Description: "The private key passphrase hmac.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+		},
+	}
+}
+
+func setFromCredentialSshPrivateKeyResponseMap(d *schema.ResourceData, raw map[string]interface{}, fromRead bool) error {
+	if err := d.Set(NameKey, raw[NameKey]); err != nil {
+		return err
+	}
+	if err := d.Set(DescriptionKey, raw[DescriptionKey]); err != nil {
+		return err
+	}
+	if err := d.Set(credentialStoreIdKey, raw[credentialStoreIdKey]); err != nil {
+		return err
+	}
+
+	if attrsVal, ok := raw["attributes"]; ok {
+		attrs := attrsVal.(map[string]interface{})
+		if err := d.Set(credentialSshPrivateKeyUsernameKey, attrs[credentialSshPrivateKeyUsernameKey]); err != nil {
+			return err
+		}
+
+		statePrivKeyHmac := d.Get(credentialSshPrivateKeyPrivateKeyHmacKey)
+		boundaryPrivKeyHmac := attrs[credentialSshPrivateKeyPrivateKeyHmacKey].(string)
+		if statePrivKeyHmac.(string) != boundaryPrivKeyHmac && fromRead {
+			// PrivateKeyHmac has changed in Boundary, therefore the private key has changed.
+			// Update private key value to force tf to attempt update.
+			if err := d.Set(credentialSshPrivateKeyPrivateKeyKey, "(changed in Boundary)"); err != nil {
+				return err
+			}
+		}
+		if err := d.Set(credentialSshPrivateKeyPrivateKeyHmacKey, boundaryPrivKeyHmac); err != nil {
+			return err
+		}
+
+		var statePassphraseHmac, boundaryPassphraseHmac string
+		if v := d.Get(credentialSshPrivateKeyPassphraseHmacKey); v != nil {
+			statePassphraseHmac = v.(string)
+		}
+		if v := attrs[credentialSshPrivateKeyPassphraseHmacKey]; v != nil {
+			boundaryPassphraseHmac = v.(string)
+		}
+		if statePassphraseHmac != boundaryPassphraseHmac && fromRead {
+			// PassphraseHmac has changed in Boundary, therefore the private key passphrase has changed.
+			// Update private key passphrase value to force tf to attempt update.
+			if err := d.Set(credentialSshPrivateKeyPassphraseKey, "(changed in Boundary)"); err != nil {
+				return err
+			}
+		}
+		if err := d.Set(credentialSshPrivateKeyPassphraseHmacKey, boundaryPassphraseHmac); err != nil {
+			return err
+		}
+	}
+
+	d.SetId(raw["id"].(string))
+
+	return nil
+}
+
+func resourceCredentialSshPrivateKeyCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+
+	var opts []credentials.Option
+	if v, ok := d.GetOk(NameKey); ok {
+		opts = append(opts, credentials.WithName(v.(string)))
+	}
+	if v, ok := d.GetOk(DescriptionKey); ok {
+		opts = append(opts, credentials.WithDescription(v.(string)))
+	}
+	if v, ok := d.GetOk(credentialSshPrivateKeyUsernameKey); ok {
+		opts = append(opts, credentials.WithSshPrivateKeyCredentialUsername(v.(string)))
+	}
+	if v, ok := d.GetOk(credentialSshPrivateKeyPrivateKeyKey); ok {
+		opts = append(opts, credentials.WithSshPrivateKeyCredentialPrivateKey(v.(string)))
+	}
+	if v, ok := d.GetOk(credentialSshPrivateKeyPassphraseKey); ok {
+		opts = append(opts, credentials.WithSshPrivateKeyCredentialPrivateKeyPassphrase(v.(string)))
+	}
+
+	var credentialStoreId string
+	retrievedStoreId, ok := d.GetOk(credentialStoreIdKey)
+	if ok {
+		credentialStoreId = retrievedStoreId.(string)
+	} else {
+		return diag.Errorf("credential store id is unset")
+	}
+
+	client := credentials.NewClient(md.client)
+	cr, err := client.Create(ctx, credentialSshPrivateKeyCredentialType, credentialStoreId, opts...)
+	if err != nil {
+		return diag.Errorf("error creating credential: %v", err)
+	}
+	if cr == nil {
+		return diag.Errorf("nil credential after create")
+	}
+
+	if err := setFromCredentialSshPrivateKeyResponseMap(d, cr.GetResponse().Map, false); err != nil {
+		return diag.Errorf("error generating credential from response map: %v", err)
+	}
+
+	return nil
+}
+
+func resourceCredentialSshPrivateKeyRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	client := credentials.NewClient(md.client)
+
+	cr, err := client.Read(ctx, d.Id())
+	if err != nil {
+		if apiErr := api.AsServerError(err); apiErr != nil && apiErr.Response().StatusCode() == http.StatusNotFound {
+			d.SetId("")
+			return nil
+		}
+		return diag.Errorf("error reading credential: %v", err)
+	}
+	if cr == nil {
+		return diag.Errorf("credential nil after read")
+	}
+
+	if err := setFromCredentialSshPrivateKeyResponseMap(d, cr.GetResponse().Map, true); err != nil {
+		return diag.Errorf("error generating credential from response map: %v", err)
+	}
+
+	return nil
+}
+
+func resourceCredentialSshPrivateKeyUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	client := credentials.NewClient(md.client)
+
+	var opts []credentials.Option
+	if d.HasChange(NameKey) {
+		opts = append(opts, credentials.DefaultName())
+		nameVal, ok := d.GetOk(NameKey)
+		if ok {
+			opts = append(opts, credentials.WithName(nameVal.(string)))
+		}
+	}
+
+	if d.HasChange(DescriptionKey) {
+		opts = append(opts, credentials.DefaultDescription())
+		descVal, ok := d.GetOk(DescriptionKey)
+		if ok {
+			opts = append(opts, credentials.WithDescription(descVal.(string)))
+		}
+	}
+
+	if d.HasChange(credentialSshPrivateKeyUsernameKey) {
+		usernameVal, ok := d.GetOk(credentialSshPrivateKeyUsernameKey)
+		if ok {
+			opts = append(opts, credentials.WithSshPrivateKeyCredentialUsername(usernameVal.(string)))
+		}
+	}
+
+	if d.HasChange(credentialSshPrivateKeyPrivateKeyKey) {
+		privKeyVal, ok := d.GetOk(credentialSshPrivateKeyPrivateKeyKey)
+		if ok {
+			opts = append(opts, credentials.WithSshPrivateKeyCredentialPrivateKey(privKeyVal.(string)))
+		}
+	}
+
+	if d.HasChange(credentialSshPrivateKeyPassphraseKey) {
+		passVal, ok := d.GetOk(credentialSshPrivateKeyPassphraseKey)
+		if ok {
+			opts = append(opts, credentials.WithSshPrivateKeyCredentialPrivateKeyPassphrase(passVal.(string)))
+		}
+	}
+
+	if len(opts) > 0 {
+		opts = append(opts, credentials.WithAutomaticVersioning(true))
+		crUpdate, err := client.Update(ctx, d.Id(), 0, opts...)
+		if err != nil {
+			return diag.Errorf("error updating credential: %v", err)
+		}
+		if crUpdate == nil {
+			return diag.Errorf("credential nil after update")
+		}
+
+		if err = setFromCredentialSshPrivateKeyResponseMap(d, crUpdate.GetResponse().Map, false); err != nil {
+			return diag.Errorf("error generating credential from response map: %v", err)
+		}
+	}
+
+	return nil
+}
+
+func resourceCredentialSshPrivateKeyDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	client := credentials.NewClient(md.client)
+
+	_, err := client.Delete(ctx, d.Id())
+	if err != nil {
+		return diag.Errorf("error deleting credential: %v", err)
+	}
+
+	return nil
+}

internal/provider/resource_credential_ssh_private_key_test.go

@@ -0,0 +1,180 @@
+package provider
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/credentials"
+	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"golang.org/x/crypto/ssh/testdata"
+)
+
+const (
+	sshPrivateKeyCredResc = "boundary_credential_ssh_private_key.example"
+	sshPrivateKeyCredName = "Dr Jekyll"
+	sshPrivateKeyCredDesc = "my best description"
+	sshPrivateKeyUpdate   = "some magic update string"
+	sshPrivateKeyUsername = "my-user"
+)
+
+var staticStore = fmt.Sprintf(`
+resource "boundary_credential_store_static" "ssh_store" {
+	name        = "static store name"
+	description = "static store description"
+	scope_id    = boundary_scope.proj1.id
+	depends_on  = [boundary_role.proj1_admin]
+}`)
+
+func sshPrivateKeyResource(name, description, username, privateKey, passphrase string) string {
+	return fmt.Sprintf(`
+resource "boundary_credential_ssh_private_key" "example" {
+	name                   = %q
+	description            = %q
+	credential_store_id    = boundary_credential_store_static.ssh_store.id
+	username               = %q
+	private_key            = %q
+	private_key_passphrase = %q
+}`, name, description, username, privateKey, passphrase)
+}
+
+func TestAccCredentialSshPrivateKey(t *testing.T) {
+	tc := controller.NewTestController(t, tcConfig...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	privKey := string(testdata.PEMBytes["rsa"])
+	privKeyUpdate := string(testdata.PEMEncryptedKeys[0].PEMBytes)
+	privKeyUpdatePassphrase := testdata.PEMEncryptedKeys[0].EncryptionKey
+
+	res := sshPrivateKeyResource(
+		sshPrivateKeyCredName,
+		sshPrivateKeyCredDesc,
+		sshPrivateKeyUsername,
+		privKey,
+		"",
+	)
+
+	resUpdate := sshPrivateKeyResource(
+		sshPrivateKeyCredName+sshPrivateKeyUpdate,
+		sshPrivateKeyCredDesc+sshPrivateKeyUpdate,
+		sshPrivateKeyUsername+sshPrivateKeyUpdate,
+		privKeyUpdate,
+		privKeyUpdatePassphrase,
+	)
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		IsUnitTest:        true,
+		ProviderFactories: providerFactories(&provider),
+		CheckDestroy:      testAccCheckCredentialSshPrivateKeyResourceDestroy(t, provider),
+		Steps: []resource.TestStep{
+			{
+				// create
+				Config: testConfig(url, fooOrg, firstProjectFoo, staticStore, res),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, NameKey, sshPrivateKeyCredName),
+					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, DescriptionKey, sshPrivateKeyCredDesc),
+					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, credentialSshPrivateKeyUsernameKey, sshPrivateKeyUsername),
+					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, credentialSshPrivateKeyPrivateKeyKey, privKey),
+					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, credentialSshPrivateKeyPassphraseKey, ""),
+
+					testAccCheckCredentialStoreSshPrivateKeyHmac(provider),
+					testAccCheckCredentialSshPrivateKeyResourceExists(provider, sshPrivateKeyCredResc),
+				),
+			},
+			importStep(sshPrivateKeyCredResc, credentialSshPrivateKeyPrivateKeyKey, credentialSshPrivateKeyPassphraseKey),
+			{
+				// update
+				Config: testConfig(url, fooOrg, firstProjectFoo, staticStore, resUpdate),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, NameKey, sshPrivateKeyCredName+sshPrivateKeyUpdate),
+					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, DescriptionKey, sshPrivateKeyCredDesc+sshPrivateKeyUpdate),
+					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, credentialSshPrivateKeyUsernameKey, sshPrivateKeyUsername+sshPrivateKeyUpdate),
+					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, credentialSshPrivateKeyPrivateKeyKey, privKeyUpdate),
+					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, credentialSshPrivateKeyPassphraseKey, privKeyUpdatePassphrase),
+
+					testAccCheckCredentialStoreSshPrivateKeyHmac(provider),
+					testAccCheckCredentialSshPrivateKeyResourceExists(provider, sshPrivateKeyCredResc),
+				),
+			},
+		},
+	})
+}
+
+func testAccCheckCredentialSshPrivateKeyResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("not found: %s", name)
+		}
+
+		id := rs.Primary.ID
+		if id == "" {
+			return fmt.Errorf("no ID is set")
+		}
+		storeId = id
+
+		md := testProvider.Meta().(*metaData)
+		c := credentials.NewClient(md.client)
+		if _, err := c.Read(context.Background(), id); err != nil {
+			return fmt.Errorf("got an error reading %q: %w", id, err)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckCredentialSshPrivateKeyResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if testProvider.Meta() == nil {
+			t.Fatal("got nil provider metadata")
+		}
+		md := testProvider.Meta().(*metaData)
+
+		for _, rs := range s.RootModule().Resources {
+			switch rs.Type {
+			case "boundary_credential_ssh_private_key":
+				id := rs.Primary.ID
+
+				c := credentials.NewClient(md.client)
+				_, err := c.Read(context.Background(), id)
+				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
+					return fmt.Errorf("didn't get a 404 when reading destroyed credential %q: %v", id, err)
+				}
+			default:
+				continue
+			}
+		}
+		return nil
+	}
+}
+
+func testAccCheckCredentialStoreSshPrivateKeyHmac(testProvider *schema.Provider) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[sshPrivateKeyCredResc]
+		if !ok {
+			return fmt.Errorf("not found: %s", sshPrivateKeyCredResc)
+		}
+
+		computed := rs.Primary.Attributes["private_key_hmac"]
+		if len(computed) != 43 {
+			return fmt.Errorf("computed private key hmac not the expected length of 43 characters, got: %q", computed)
+		}
+
+		if rs.Primary.Attributes["private_key_passphrase"] != "" {
+			// We set a passphrase, validate the computed hmac is expected length
+			computed := rs.Primary.Attributes["private_key_passphrase_hmac"]
+			if len(computed) != 43 {
+				return fmt.Errorf("computed private key passphrase hmac not the expected length of 43 characters, got: %q", computed)
+			}
+		}
+
+		return nil
+	}
+}

internal/provider/resource_credential_store_static.go

@@ -0,0 +1,176 @@
+package provider
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/credentialstores"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+const staticCredentialStoreType = "static"
+
+func resourceCredentialStoreStatic() *schema.Resource {
+	return &schema.Resource{
+		Description: "The static credential store resource allows you to configure a Boundary static credential store.",
+
+		CreateContext: resourceStaticCredentialStoreCreate,
+		ReadContext:   resourceStaticCredentialStoreRead,
+		UpdateContext: resourceStaticCredentialStoreUpdate,
+		DeleteContext: resourceStaticCredentialStoreDelete,
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			IDKey: {
+				Description: "The ID of the static credential store.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			NameKey: {
+				Description: "The static credential store name. Defaults to the resource name.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			DescriptionKey: {
+				Description: "The static credential store description.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			ScopeIdKey: {
+				Description: "The scope for this credential store.",
+				Type:        schema.TypeString,
+				ForceNew:    true,
+				Required:    true,
+			},
+		},
+	}
+}
+
+func setFromStaticCredentialStoreResponseMap(d *schema.ResourceData, raw map[string]interface{}, fromRead bool) error {
+	if err := d.Set(NameKey, raw[NameKey]); err != nil {
+		return err
+	}
+	if err := d.Set(DescriptionKey, raw[DescriptionKey]); err != nil {
+		return err
+	}
+	if err := d.Set(ScopeIdKey, raw[ScopeIdKey]); err != nil {
+		return err
+	}
+
+	d.SetId(raw["id"].(string))
+
+	return nil
+}
+
+func resourceStaticCredentialStoreCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+
+	var opts []credentialstores.Option
+	if v, ok := d.GetOk(NameKey); ok {
+		opts = append(opts, credentialstores.WithName(v.(string)))
+	}
+	if v, ok := d.GetOk(DescriptionKey); ok {
+		opts = append(opts, credentialstores.WithDescription(v.(string)))
+	}
+
+	var scope string
+	gotScope, ok := d.GetOk(ScopeIdKey)
+	if ok {
+		scope = gotScope.(string)
+	} else {
+		return diag.Errorf("no scope is set")
+	}
+
+	client := credentialstores.NewClient(md.client)
+	cr, err := client.Create(ctx, staticCredentialStoreType, scope, opts...)
+	if err != nil {
+		return diag.Errorf("error creating credential store: %v", err)
+	}
+	if cr == nil {
+		return diag.Errorf("nil credential store after create")
+	}
+
+	if err := setFromStaticCredentialStoreResponseMap(d, cr.GetResponse().Map, false); err != nil {
+		return diag.Errorf("error generating credential store from response map: %v", err)
+	}
+
+	return nil
+}
+
+func resourceStaticCredentialStoreRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	client := credentialstores.NewClient(md.client)
+
+	cr, err := client.Read(ctx, d.Id())
+	if err != nil {
+		if apiErr := api.AsServerError(err); apiErr != nil && apiErr.Response().StatusCode() == http.StatusNotFound {
+			d.SetId("")
+			return nil
+		}
+		return diag.Errorf("error reading credential store: %v", err)
+	}
+	if cr == nil {
+		return diag.Errorf("credential store nil after read")
+	}
+
+	if err := setFromStaticCredentialStoreResponseMap(d, cr.GetResponse().Map, true); err != nil {
+		return diag.Errorf("error generating credential store from response map: %v", err)
+	}
+
+	return nil
+}
+
+func resourceStaticCredentialStoreUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	client := credentialstores.NewClient(md.client)
+
+	var opts []credentialstores.Option
+	if d.HasChange(NameKey) {
+		opts = append(opts, credentialstores.DefaultName())
+		nameVal, ok := d.GetOk(NameKey)
+		if ok {
+			opts = append(opts, credentialstores.WithName(nameVal.(string)))
+		}
+	}
+
+	if d.HasChange(DescriptionKey) {
+		opts = append(opts, credentialstores.DefaultDescription())
+		descVal, ok := d.GetOk(DescriptionKey)
+		if ok {
+			opts = append(opts, credentialstores.WithDescription(descVal.(string)))
+		}
+	}
+
+	if len(opts) > 0 {
+		opts = append(opts, credentialstores.WithAutomaticVersioning(true))
+		crUpdate, err := client.Update(ctx, d.Id(), 0, opts...)
+		if err != nil {
+			return diag.Errorf("error updating credential store: %v", err)
+		}
+		if crUpdate == nil {
+			return diag.Errorf("credential store nil after update")
+		}
+
+		if err = setFromStaticCredentialStoreResponseMap(d, crUpdate.GetResponse().Map, false); err != nil {
+			return diag.Errorf("error generating credential store from response map: %v", err)
+		}
+	}
+
+	return nil
+}
+
+func resourceStaticCredentialStoreDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	client := credentialstores.NewClient(md.client)
+
+	_, err := client.Delete(ctx, d.Id())
+	if err != nil {
+		return diag.Errorf("error deleting credential store: %v", err)
+	}
+
+	return nil
+}

internal/provider/resource_credential_store_static_test.go

@@ -0,0 +1,139 @@
+package provider
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/credentialstores"
+	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+)
+
+const (
+	staticCredStoreResc      = "boundary_credential_store_static.example"
+	staticCredStoreName      = "foo"
+	staticCredStoreDesc      = "the foo"
+	staticCredStoreNamespace = "static"
+	staticCredStoreUpdate    = "_random"
+)
+
+func staticCredStoreResource(name string, description string) string {
+	return fmt.Sprintf(`
+resource "boundary_credential_store_static" "example" {
+	name  = "%s"
+	description = "%s"
+	scope_id = boundary_scope.proj1.id
+	depends_on = [boundary_role.proj1_admin]
+}`, name,
+		description)
+}
+
+func TestAccCredentialStoreStatic(t *testing.T) {
+	tc := controller.NewTestController(t, tcConfig...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	res := staticCredStoreResource(staticCredStoreName,
+		staticCredStoreDesc)
+
+	resUpdate := staticCredStoreResource(staticCredStoreName+staticCredStoreUpdate,
+		staticCredStoreDesc+staticCredStoreUpdate)
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		ProviderFactories: providerFactories(&provider),
+		CheckDestroy:      testAccCheckCredentialStoreStaticResourceDestroy(t, provider),
+		Steps: []resource.TestStep{
+			{
+				// create
+				Config: testConfig(url, fooOrg, firstProjectFoo, res),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(staticCredStoreResc, NameKey, staticCredStoreName),
+					resource.TestCheckResourceAttr(staticCredStoreResc, DescriptionKey, staticCredStoreDesc),
+
+					testAccCheckCredentialStoreVaultResourceExists(provider, staticCredStoreResc),
+				),
+			},
+			importStep(staticCredStoreResc),
+			{
+				// update
+				Config: testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(staticCredStoreResc, NameKey, staticCredStoreName+staticCredStoreUpdate),
+					resource.TestCheckResourceAttr(staticCredStoreResc, DescriptionKey, staticCredStoreDesc+staticCredStoreUpdate),
+
+					testAccCheckCredentialStoreVaultResourceExists(provider, staticCredStoreResc),
+				),
+			},
+			importStep(staticCredStoreResc),
+			{
+				// Run a plan only update and verify no changes
+				PlanOnly: true,
+				Config:   testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+			},
+			importStep(staticCredStoreResc),
+			{
+				// update again but apply a preConfig to externally update resource
+				// TODO: Boundary currently causes an error on moving back to a previously
+				// used token, for now verify that a plan only step had changes
+				PreConfig:          func() { staticCredentialStoreExternalUpdate(t, provider) },
+				PlanOnly:           true,
+				ExpectNonEmptyPlan: true,
+				Config:             testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+			},
+			importStep(staticCredStoreResc),
+		},
+	})
+}
+
+func staticCredentialStoreExternalUpdate(t *testing.T, testProvider *schema.Provider) {
+	if storeId == "" {
+		t.Fatal("storeId must be set before testing an external update")
+	}
+
+	md := testProvider.Meta().(*metaData)
+	c := credentialstores.NewClient(md.client)
+	cr, err := c.Read(context.Background(), storeId)
+	if err != nil {
+		t.Fatal(fmt.Errorf("got an error reading %q: %w", storeId, err))
+	}
+
+	// update credential store options
+	var opts []credentialstores.Option
+	opts = append(opts, credentialstores.WithDescription("this is an updated description, my guy"))
+
+	_, err = c.Update(context.Background(), cr.Item.Id, cr.Item.Version, opts...)
+	if err != nil {
+		t.Fatal(fmt.Errorf("got an error updating %q: %w", cr.Item.Id, err))
+	}
+}
+
+func testAccCheckCredentialStoreStaticResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if testProvider.Meta() == nil {
+			t.Fatal("got nil provider metadata")
+		}
+		md := testProvider.Meta().(*metaData)
+
+		for _, rs := range s.RootModule().Resources {
+			switch rs.Type {
+			case "boundary_credential_store_static":
+				id := rs.Primary.ID
+
+				c := credentialstores.NewClient(md.client)
+				_, err := c.Read(context.Background(), id)
+				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
+					return fmt.Errorf("didn't get a 404 when reading destroyed static credential store %q: %v", id, err)
+				}
+			default:
+				continue
+			}
+		}
+		return nil
+	}
+}

internal/provider/resource_credential_username_password.go

@@ -0,0 +1,236 @@
+package provider
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/credentials"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+const (
+	credentialUsernamePasswordUsernameKey     = "username"
+	credentialUsernamePasswordPasswordKey     = "password"
+	credentialUsernamePasswordPasswordHmacKey = "password_hmac"
+	credentialUsernamePasswordCredentialType  = "username_password"
+)
+
+func resourceCredentialUsernamePassword() *schema.Resource {
+	return &schema.Resource{
+		Description: "The username/password credential resource allows you to configure a credential using a username and password pair.",
+
+		CreateContext: resourceCredentialUsernamePasswordCreate,
+		ReadContext:   resourceCredentialUsernamePasswordRead,
+		UpdateContext: resourceCredentialUsernamePasswordUpdate,
+		DeleteContext: resourceCredentialUsernamePasswordDelete,
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			IDKey: {
+				Description: "The ID of this username/password credential.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			NameKey: {
+				Description: "The name of this username/password credential. Defaults to the resource name.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			DescriptionKey: {
+				Description: "The description of this username/password credential.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			credentialStoreIdKey: {
+				Description: "The credential store in which to save this username/password credential.",
+				Type:        schema.TypeString,
+				ForceNew:    true,
+				Required:    true,
+			},
+			credentialUsernamePasswordUsernameKey: {
+				Description: "The username of this username/password credential.",
+				Type:        schema.TypeString,
+				Required:    true,
+			},
+			credentialUsernamePasswordPasswordKey: {
+				Description: "The password of this username/password credential.",
+				Type:        schema.TypeString,
+				Required:    true,
+			},
+			credentialUsernamePasswordPasswordHmacKey: {
+				Description: "The password hmac.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+		},
+	}
+}
+
+func setFromCredentialUsernamePasswordResponseMap(d *schema.ResourceData, raw map[string]interface{}, fromRead bool) error {
+	if err := d.Set(NameKey, raw[NameKey]); err != nil {
+		return err
+	}
+	if err := d.Set(DescriptionKey, raw[DescriptionKey]); err != nil {
+		return err
+	}
+	if err := d.Set(credentialStoreIdKey, raw[credentialStoreIdKey]); err != nil {
+		return err
+	}
+
+	if attrsVal, ok := raw["attributes"]; ok {
+		attrs := attrsVal.(map[string]interface{})
+		if err := d.Set(credentialUsernamePasswordUsernameKey, attrs[credentialUsernamePasswordUsernameKey]); err != nil {
+			return err
+		}
+
+		statePasswordHmac := d.Get(credentialUsernamePasswordPasswordHmacKey)
+		boundaryPasswordHmac := attrs[credentialUsernamePasswordPasswordHmacKey].(string)
+		if statePasswordHmac.(string) != boundaryPasswordHmac && fromRead {
+			// PasswordHmac has changed in Boundary, therefore the password has changed.
+			// Update password value to force tf to attempt update.
+			if err := d.Set(credentialUsernamePasswordPasswordKey, "(changed in Boundary)"); err != nil {
+				return err
+			}
+		}
+		if err := d.Set(credentialUsernamePasswordPasswordHmacKey, boundaryPasswordHmac); err != nil {
+			return err
+		}
+	}
+
+	d.SetId(raw["id"].(string))
+
+	return nil
+}
+
+func resourceCredentialUsernamePasswordCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+
+	var opts []credentials.Option
+	if v, ok := d.GetOk(NameKey); ok {
+		opts = append(opts, credentials.WithName(v.(string)))
+	}
+	if v, ok := d.GetOk(DescriptionKey); ok {
+		opts = append(opts, credentials.WithDescription(v.(string)))
+	}
+	if v, ok := d.GetOk(credentialUsernamePasswordUsernameKey); ok {
+		opts = append(opts, credentials.WithUsernamePasswordCredentialUsername(v.(string)))
+	}
+	if v, ok := d.GetOk(credentialUsernamePasswordPasswordKey); ok {
+		opts = append(opts, credentials.WithUsernamePasswordCredentialPassword(v.(string)))
+	}
+
+	var credentialStoreId string
+	retrievedStoreId, ok := d.GetOk(credentialStoreIdKey)
+	if ok {
+		credentialStoreId = retrievedStoreId.(string)
+	} else {
+		return diag.Errorf("credential store id is unset")
+	}
+
+	client := credentials.NewClient(md.client)
+	cr, err := client.Create(ctx, credentialUsernamePasswordCredentialType, credentialStoreId, opts...)
+	if err != nil {
+		return diag.Errorf("error creating credential: %v", err)
+	}
+	if cr == nil {
+		return diag.Errorf("nil credential after create")
+	}
+
+	if err := setFromCredentialUsernamePasswordResponseMap(d, cr.GetResponse().Map, false); err != nil {
+		return diag.Errorf("error generating credential from response map: %v", err)
+	}
+
+	return nil
+}
+
+func resourceCredentialUsernamePasswordRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	client := credentials.NewClient(md.client)
+
+	cr, err := client.Read(ctx, d.Id())
+	if err != nil {
+		if apiErr := api.AsServerError(err); apiErr != nil && apiErr.Response().StatusCode() == http.StatusNotFound {
+			d.SetId("")
+			return nil
+		}
+		return diag.Errorf("error reading credential: %v", err)
+	}
+	if cr == nil {
+		return diag.Errorf("credential nil after read")
+	}
+
+	if err := setFromCredentialUsernamePasswordResponseMap(d, cr.GetResponse().Map, true); err != nil {
+		return diag.Errorf("error generating credential from response map: %v", err)
+	}
+
+	return nil
+}
+
+func resourceCredentialUsernamePasswordUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	client := credentials.NewClient(md.client)
+
+	var opts []credentials.Option
+	if d.HasChange(NameKey) {
+		opts = append(opts, credentials.DefaultName())
+		nameVal, ok := d.GetOk(NameKey)
+		if ok {
+			opts = append(opts, credentials.WithName(nameVal.(string)))
+		}
+	}
+
+	if d.HasChange(DescriptionKey) {
+		opts = append(opts, credentials.DefaultDescription())
+		descVal, ok := d.GetOk(DescriptionKey)
+		if ok {
+			opts = append(opts, credentials.WithDescription(descVal.(string)))
+		}
+	}
+
+	if d.HasChange(credentialUsernamePasswordUsernameKey) {
+		usernameVal, ok := d.GetOk(credentialUsernamePasswordUsernameKey)
+		if ok {
+			opts = append(opts, credentials.WithUsernamePasswordCredentialUsername(usernameVal.(string)))
+		}
+	}
+
+	if d.HasChange(credentialUsernamePasswordPasswordKey) {
+		passwordVal, ok := d.GetOk(credentialUsernamePasswordPasswordKey)
+		if ok {
+			opts = append(opts, credentials.WithUsernamePasswordCredentialPassword(passwordVal.(string)))
+		}
+	}
+
+	if len(opts) > 0 {
+		opts = append(opts, credentials.WithAutomaticVersioning(true))
+		crUpdate, err := client.Update(ctx, d.Id(), 0, opts...)
+		if err != nil {
+			return diag.Errorf("error updating credential: %v", err)
+		}
+		if crUpdate == nil {
+			return diag.Errorf("credential nil after update")
+		}
+
+		if err = setFromCredentialUsernamePasswordResponseMap(d, crUpdate.GetResponse().Map, false); err != nil {
+			return diag.Errorf("error generating credential from response map: %v", err)
+		}
+	}
+
+	return nil
+}
+
+func resourceCredentialUsernamePasswordDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	client := credentials.NewClient(md.client)
+
+	_, err := client.Delete(ctx, d.Id())
+	if err != nil {
+		return diag.Errorf("error deleting credential: %v", err)
+	}
+
+	return nil
+}

internal/provider/resource_credential_username_password_test.go

@@ -0,0 +1,199 @@
+package provider
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/credentials"
+	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+)
+
+const (
+	usernamePasswordCredResc     = "boundary_credential_username_password.example"
+	usernamePasswordCredName     = "foo"
+	usernamePasswordCredDesc     = "the foo"
+	usernamePasswordCredUsername = "default_username"
+	usernamePasswordCredPassword = "default_password"
+	usernamePasswordCredUpdate   = "_random"
+)
+
+func usernamePasswordCredResource(name, description, username, password string) string {
+	return fmt.Sprintf(`
+resource "boundary_credential_store_static" "example" {
+	name  = "static store name"
+	description = "static store description"
+	scope_id = boundary_scope.proj1.id
+	depends_on = [boundary_role.proj1_admin]
+}
+
+resource "boundary_credential_username_password" "example" {
+	name  = "%s"
+	description = "%s"
+	credential_store_id = boundary_credential_store_static.example.id
+	username = "%s"
+	password = "%s"
+}`, name,
+		description,
+		username,
+		password)
+}
+
+func TestAccCredentialUsernamePassword(t *testing.T) {
+	tc := controller.NewTestController(t, tcConfig...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	res := usernamePasswordCredResource(
+		usernamePasswordCredName,
+		usernamePasswordCredDesc,
+		usernamePasswordCredUsername,
+		usernamePasswordCredPassword,
+	)
+
+	resUpdate := usernamePasswordCredResource(
+		usernamePasswordCredName,
+		usernamePasswordCredDesc,
+		usernamePasswordCredUsername+usernamePasswordCredUpdate,
+		usernamePasswordCredPassword+usernamePasswordCredUpdate,
+	)
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		ProviderFactories: providerFactories(&provider),
+		CheckDestroy:      testAccCheckCredentialUsernamePasswordResourceDestroy(t, provider),
+		Steps: []resource.TestStep{
+			{
+				// create
+				Config: testConfig(url, fooOrg, firstProjectFoo, res),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(usernamePasswordCredResc, NameKey, usernamePasswordCredName),
+					resource.TestCheckResourceAttr(usernamePasswordCredResc, DescriptionKey, usernamePasswordCredDesc),
+					resource.TestCheckResourceAttr(usernamePasswordCredResc, credentialUsernamePasswordUsernameKey, usernamePasswordCredUsername),
+					resource.TestCheckResourceAttr(usernamePasswordCredResc, credentialUsernamePasswordPasswordKey, usernamePasswordCredPassword),
+
+					testAccCheckCredentialStoreUsernamePasswordHmac(provider),
+					testAccCheckCredentialUsernamePasswordResourceExists(provider, usernamePasswordCredResc),
+				),
+			},
+			importStep(usernamePasswordCredResc, credentialUsernamePasswordPasswordKey),
+			{
+				// update
+				Config: testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(usernamePasswordCredResc, NameKey, usernamePasswordCredName),
+					resource.TestCheckResourceAttr(usernamePasswordCredResc, DescriptionKey, usernamePasswordCredDesc),
+					resource.TestCheckResourceAttr(usernamePasswordCredResc, credentialUsernamePasswordUsernameKey, usernamePasswordCredUsername+usernamePasswordCredUpdate),
+					resource.TestCheckResourceAttr(usernamePasswordCredResc, credentialUsernamePasswordPasswordKey, usernamePasswordCredPassword+usernamePasswordCredUpdate),
+
+					testAccCheckCredentialStoreUsernamePasswordHmac(provider),
+					testAccCheckCredentialUsernamePasswordResourceExists(provider, usernamePasswordCredResc),
+				),
+			},
+			importStep(usernamePasswordCredResc, credentialUsernamePasswordPasswordKey),
+			{
+				// Run a plan only update and verify no changes
+				PlanOnly: true,
+				Config:   testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+			},
+			importStep(usernamePasswordCredResc, credentialUsernamePasswordPasswordKey),
+			{
+				// update again but apply a preConfig to externally update resource
+				PreConfig: func() { usernamePasswordCredExternalUpdate(t, provider) },
+				Config:    testConfig(url, fooOrg, firstProjectFoo, resUpdate),
+			},
+			importStep(usernamePasswordCredResc, credentialUsernamePasswordPasswordKey),
+		},
+	})
+}
+
+func usernamePasswordCredExternalUpdate(t *testing.T, testProvider *schema.Provider) {
+	if storeId == "" {
+		t.Fatal("storeId must be set before testing an external update")
+	}
+
+	md := testProvider.Meta().(*metaData)
+	c := credentials.NewClient(md.client)
+	cr, err := c.Read(context.Background(), storeId)
+	if err != nil {
+		t.Fatal(fmt.Errorf("got an error reading %q: %w", storeId, err))
+	}
+
+	// update credential options
+	var opts []credentials.Option
+	opts = append(opts, credentials.WithDescription("this is an updated description, my guy"))
+
+	_, err = c.Update(context.Background(), cr.Item.Id, cr.Item.Version, opts...)
+	if err != nil {
+		t.Fatal(fmt.Errorf("got an error updating %q: %w", cr.Item.Id, err))
+	}
+}
+
+func testAccCheckCredentialUsernamePasswordResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("not found: %s", name)
+		}
+
+		id := rs.Primary.ID
+		if id == "" {
+			return fmt.Errorf("no ID is set")
+		}
+		storeId = id
+
+		md := testProvider.Meta().(*metaData)
+		c := credentials.NewClient(md.client)
+		if _, err := c.Read(context.Background(), id); err != nil {
+			return fmt.Errorf("got an error reading %q: %w", id, err)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckCredentialUsernamePasswordResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if testProvider.Meta() == nil {
+			t.Fatal("got nil provider metadata")
+		}
+		md := testProvider.Meta().(*metaData)
+
+		for _, rs := range s.RootModule().Resources {
+			switch rs.Type {
+			case "boundary_credential_username_password":
+				id := rs.Primary.ID
+
+				c := credentials.NewClient(md.client)
+				_, err := c.Read(context.Background(), id)
+				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
+					return fmt.Errorf("didn't get a 404 when reading destroyed username password credential %q: %v", id, err)
+				}
+			default:
+				continue
+			}
+		}
+		return nil
+	}
+}
+
+func testAccCheckCredentialStoreUsernamePasswordHmac(testProvider *schema.Provider) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[usernamePasswordCredResc]
+		if !ok {
+			return fmt.Errorf("not found: %s", usernamePasswordCredResc)
+		}
+
+		computed := rs.Primary.Attributes["password_hmac"]
+		if len(computed) != 43 {
+			return fmt.Errorf("Computed password hmac not the expected length of 43 characters. hmac: %q", computed)
+		}
+
+		return nil
+	}
+}

internal/provider/resource_host_catalog_static.go

@@ -16,8 +16,8 @@ const (
 
 func resourceHostCatalog() *schema.Resource {
 	return &schema.Resource{
-		DeprecationMessage: "Deprecated: use `resource_host_catalog_static` instead.",
-		Description:        "Deprecated: use `resource_host_catalog_static` instead.",
+		DeprecationMessage: "Deprecated: use `boundary_host_catalog_static` instead.",
+		Description:        "Deprecated: use `boundary_host_catalog_static` instead.",
 
 		CreateContext: resourceHostCatalogStaticCreate(true),
 		ReadContext:   resourceHostCatalogStaticRead(true),

internal/provider/resource_host_set_static.go

@@ -17,8 +17,8 @@ const (
 
 func resourceHostSet() *schema.Resource {
 	return &schema.Resource{
-		DeprecationMessage: "Deprecated: use `resource_host_set_static` instead.",
-		Description:        "Deprecated: use `resource_host_set_static` instead.",
+		DeprecationMessage: "Deprecated: use `boundary_host_set_static` instead.",
+		Description:        "Deprecated: use `boundary_host_set_static` instead.",
 
 		CreateContext: resourceHostSetStaticCreate,
 		ReadContext:   resourceHostSetStaticRead,

internal/provider/resource_host_static.go

@@ -17,8 +17,8 @@ const (
 
 func resourceHost() *schema.Resource {
 	return &schema.Resource{
-		DeprecationMessage: "Deprecated: use `resource_host_static` instead.",
-		Description:        "Deprecated: use `resource_host_static` instead.",
+		DeprecationMessage: "Deprecated: use `boundary_host_static` instead.",
+		Description:        "Deprecated: use `boundary_host_static` instead.",
 
 		CreateContext: resourceHostStaticCreate,
 		ReadContext:   resourceHostStaticRead,

internal/provider/resource_target.go

@@ -13,13 +13,15 @@ import (
 
 const (
 	targetHostSourceIdsKey                  = "host_source_ids"
-	targetApplicationCredentialSourceIdsKey = "application_credential_source_ids"
+	targetBrokeredCredentialSourceIdsKey    = "brokered_credential_source_ids"
+	targetInjectedAppCredentialSourceIdsKey = "injected_application_credential_source_ids"
 	targetDefaultPortKey                    = "default_port"
 	targetSessionMaxSecondsKey              = "session_max_seconds"
 	targetSessionConnectionLimitKey         = "session_connection_limit"
 	targetWorkerFilterKey                   = "worker_filter"
 
 	targetTypeTcp = "tcp"
+	targetTypeSsh = "ssh"
 )
 
 func resourceTarget() *schema.Resource {
@@ -73,8 +75,23 @@ func resourceTarget() *schema.Resource {
 				Optional:    true,
 				Elem:        &schema.Schema{Type: schema.TypeString},
 			},
-			targetApplicationCredentialSourceIdsKey: {
-				Description: "A list of application credential source ID's.",
+			"application_credential_source_ids": {
+				Description:   "A list of application credential source ID's.",
+				Type:          schema.TypeSet,
+				Optional:      true,
+				Deprecated:    "Please use 'brokered_credential_source_ids' instead",
+				ConflictsWith: []string{targetBrokeredCredentialSourceIdsKey},
+				Elem:          &schema.Schema{Type: schema.TypeString},
+			},
+			targetBrokeredCredentialSourceIdsKey: {
+				Description:   "A list of brokered credential source ID's.",
+				Type:          schema.TypeSet,
+				Optional:      true,
+				ConflictsWith: []string{"application_credential_source_ids"},
+				Elem:          &schema.Schema{Type: schema.TypeString},
+			},
+			targetInjectedAppCredentialSourceIdsKey: {
+				Description: "A list of injected application credential source ID's.",
 				Type:        schema.TypeSet,
 				Optional:    true,
 				Elem:        &schema.Schema{Type: schema.TypeString},
@@ -114,7 +131,17 @@ func setFromTargetResponseMap(d *schema.ResourceData, raw map[string]interface{}
 	if err := d.Set(targetHostSourceIdsKey, raw["host_source_ids"]); err != nil {
 		return err
 	}
-	if err := d.Set(targetApplicationCredentialSourceIdsKey, raw["application_credential_source_ids"]); err != nil {
+	// TODO: remove when fully deprecating 'application_credential_source_ids'
+	if _, ok := d.GetOk("application_credential_source_ids"); ok {
+		if err := d.Set("application_credential_source_ids", raw["application_credential_source_ids"]); err != nil {
+			return err
+		}
+	} else {
+		if err := d.Set(targetBrokeredCredentialSourceIdsKey, raw["brokered_credential_source_ids"]); err != nil {
+			return err
+		}
+	}
+	if err := d.Set(targetInjectedAppCredentialSourceIdsKey, raw["injected_application_credential_source_ids"]); err != nil {
 		return err
 	}
 	if err := d.Set(targetSessionMaxSecondsKey, raw["session_max_seconds"]); err != nil {
@@ -128,7 +155,7 @@ func setFromTargetResponseMap(d *schema.ResourceData, raw map[string]interface{}
 	}
 
 	switch raw["type"].(string) {
-	case targetTypeTcp:
+	case targetTypeTcp, targetTypeSsh:
 		if attrsVal, ok := raw["attributes"]; ok {
 			attrs := attrsVal.(map[string]interface{})
 			if defPort, ok := attrs["default_port"].(json.Number); ok {
@@ -161,7 +188,7 @@ func resourceTargetCreate(ctx context.Context, d *schema.ResourceData, meta inte
 		return diag.Errorf("no type provided")
 	}
 	switch typeStr {
-	case targetTypeTcp:
+	case targetTypeTcp, targetTypeSsh:
 	default:
 		return diag.Errorf("invalid type provided")
 	}
@@ -182,10 +209,15 @@ func resourceTargetCreate(ctx context.Context, d *schema.ResourceData, meta inte
 	defaultPortVal, ok := d.GetOk(targetDefaultPortKey)
 	if ok {
 		defaultPortInt := defaultPortVal.(int)
-		if defaultPortInt < 0 {
-			return diag.Errorf(`"default_port" cannot be less than zero`)
+		if defaultPortInt < 0 || defaultPortInt > 65535 {
+			return diag.Errorf(`"default_port" must be a valid tcp port`)
+		}
+		switch typeStr {
+		case targetTypeTcp:
+			opts = append(opts, targets.WithTcpTargetDefaultPort(uint32(defaultPortInt)))
+		case targetTypeSsh:
+			opts = append(opts, targets.WithSshTargetDefaultPort(uint32(defaultPortInt)))
 		}
-		opts = append(opts, targets.WithTcpTargetDefaultPort(uint32(defaultPortInt)))
 	}
 
 	sessionMaxSecondsVal, ok := d.GetOk(targetSessionMaxSecondsKey)
@@ -215,12 +247,28 @@ func resourceTargetCreate(ctx context.Context, d *schema.ResourceData, meta inte
 		}
 	}
 
-	var credentialSourceIds []string
-	if credentialSourceIdsVal, ok := d.GetOk(targetApplicationCredentialSourceIdsKey); ok {
+	var brokeredCreds []string
+	if credentialSourceIdsVal, ok := d.GetOk(targetBrokeredCredentialSourceIdsKey); ok {
 		list := credentialSourceIdsVal.(*schema.Set).List()
-		credentialSourceIds = make([]string, 0, len(list))
+		brokeredCreds = make([]string, 0, len(list))
 		for _, i := range list {
-			credentialSourceIds = append(credentialSourceIds, i.(string))
+			brokeredCreds = append(brokeredCreds, i.(string))
+		}
+	} else if credentialSourceIdsVal, ok := d.GetOk("application_credential_source_ids"); ok {
+		// TODO: remove when fully deprecating 'application_credential_source_ids'
+		list := credentialSourceIdsVal.(*schema.Set).List()
+		brokeredCreds = make([]string, 0, len(list))
+		for _, i := range list {
+			brokeredCreds = append(brokeredCreds, i.(string))
+		}
+	}
+
+	var injectedCreds []string
+	if credentialSourceIdsVal, ok := d.GetOk(targetInjectedAppCredentialSourceIdsKey); ok {
+		list := credentialSourceIdsVal.(*schema.Set).List()
+		injectedCreds = make([]string, 0, len(list))
+		for _, i := range list {
+			injectedCreds = append(injectedCreds, i.(string))
 		}
 	}
 
@@ -251,8 +299,15 @@ func resourceTargetCreate(ctx context.Context, d *schema.ResourceData, meta inte
 		version = tur.Item.Version
 	}
 
-	if credentialSourceIds != nil {
-		tur, err := tc.SetCredentialSources(ctx, tcr.Item.Id, version, targets.WithApplicationCredentialSourceIds(credentialSourceIds))
+	var credOpts []targets.Option
+	if brokeredCreds != nil {
+		credOpts = append(credOpts, targets.WithBrokeredCredentialSourceIds(brokeredCreds))
+	}
+	if injectedCreds != nil {
+		credOpts = append(credOpts, targets.WithInjectedApplicationCredentialSourceIds(injectedCreds))
+	}
+	if len(credOpts) > 0 {
+		tur, err := tc.SetCredentialSources(ctx, tcr.Item.Id, version, credOpts...)
 		if err != nil {
 			return diag.Errorf("error setting credential sources on target: %v", err)
 		}
@@ -295,6 +350,16 @@ func resourceTargetUpdate(ctx context.Context, d *schema.ResourceData, meta inte
 
 	var opts []targets.Option
 
+	var typeStr string
+	if typeVal, ok := d.GetOk(TypeKey); ok {
+		typeStr = typeVal.(string)
+	}
+	switch typeStr {
+	case targetTypeTcp, targetTypeSsh:
+	default:
+		return diag.Errorf("invalid type provided")
+	}
+
 	var name *string
 	if d.HasChange(NameKey) {
 		opts = append(opts, targets.DefaultName())
@@ -319,15 +384,30 @@ func resourceTargetUpdate(ctx context.Context, d *schema.ResourceData, meta inte
 
 	var defaultPort *int
 	if d.HasChange(targetDefaultPortKey) {
-		opts = append(opts, targets.DefaultTcpTargetDefaultPort())
-		defaultPortVal, ok := d.GetOk(targetDefaultPortKey)
-		if ok {
-			defaultPortInt := defaultPortVal.(int)
-			if defaultPortInt < 0 {
-				return diag.Errorf(`"default_port" cannot be less than zero`)
+		switch typeStr {
+		case targetTypeTcp:
+			opts = append(opts, targets.DefaultTcpTargetDefaultPort())
+			defaultPortVal, ok := d.GetOk(targetDefaultPortKey)
+			if ok {
+				defaultPortInt := defaultPortVal.(int)
+				if defaultPortInt < 0 || defaultPortInt > 65535 {
+					return diag.Errorf(`"default_port" must be a valid tcp port`)
+				}
+				defaultPort = &defaultPortInt
+				opts = append(opts, targets.WithTcpTargetDefaultPort(uint32(defaultPortInt)))
+			}
+
+		case targetTypeSsh:
+			opts = append(opts, targets.DefaultSshTargetDefaultPort())
+			defaultPortVal, ok := d.GetOk(targetDefaultPortKey)
+			if ok {
+				defaultPortInt := defaultPortVal.(int)
+				if defaultPortInt < 0 || defaultPortInt > 65535 {
+					return diag.Errorf(`"default_port" must be a valid tcp port`)
+				}
+				defaultPort = &defaultPortInt
+				opts = append(opts, targets.WithSshTargetDefaultPort(uint32(defaultPortInt)))
 			}
-			defaultPort = &defaultPortInt
-			opts = append(opts, targets.WithTcpTargetDefaultPort(uint32(defaultPortInt)))
 		}
 	}
 
@@ -430,9 +510,10 @@ func resourceTargetUpdate(ctx context.Context, d *schema.ResourceData, meta inte
 
 	// The above calls may not actually happen, so we use d.Id() and automatic
 	// versioning here
-	if d.HasChange(targetApplicationCredentialSourceIdsKey) {
+	// TODO: remove when fully deprecating 'application_credential_source_ids'
+	if d.HasChange("application_credential_source_ids") {
 		var credentialSourceIds []string
-		if credentialSourceIdsVal, ok := d.GetOk(targetApplicationCredentialSourceIdsKey); ok {
+		if credentialSourceIdsVal, ok := d.GetOk("application_credential_source_ids"); ok {
 			credSourceIds := credentialSourceIdsVal.(*schema.Set).List()
 			for _, credSourceId := range credSourceIds {
 				credentialSourceIds = append(credentialSourceIds, credSourceId.(string))
@@ -451,7 +532,59 @@ func resourceTargetUpdate(ctx context.Context, d *schema.ResourceData, meta inte
 		if err != nil {
 			return diag.Errorf("error updating credential sources in target: %v", err)
 		}
-		if err := d.Set(targetApplicationCredentialSourceIdsKey, credentialSourceIds); err != nil {
+		if err := d.Set("application_credential_source_ids", credentialSourceIds); err != nil {
+			return diag.FromErr(err)
+		}
+	}
+
+	if d.HasChange(targetBrokeredCredentialSourceIdsKey) {
+		var credentialSourceIds []string
+		if credentialSourceIdsVal, ok := d.GetOk(targetBrokeredCredentialSourceIdsKey); ok {
+			credSourceIds := credentialSourceIdsVal.(*schema.Set).List()
+			for _, credSourceId := range credSourceIds {
+				credentialSourceIds = append(credentialSourceIds, credSourceId.(string))
+			}
+		}
+
+		opts := []targets.Option{
+			targets.WithAutomaticVersioning(true),
+			targets.DefaultBrokeredCredentialSourceIds(),
+		}
+		if len(credentialSourceIds) > 0 {
+			opts = append(opts, targets.WithBrokeredCredentialSourceIds(credentialSourceIds))
+		}
+
+		_, err := tc.SetCredentialSources(ctx, d.Id(), 0, opts...)
+		if err != nil {
+			return diag.Errorf("error updating brokered credential sources in target: %v", err)
+		}
+		if err := d.Set(targetBrokeredCredentialSourceIdsKey, credentialSourceIds); err != nil {
+			return diag.FromErr(err)
+		}
+	}
+
+	if d.HasChange(targetInjectedAppCredentialSourceIdsKey) {
+		var credentialSourceIds []string
+		if credentialSourceIdsVal, ok := d.GetOk(targetInjectedAppCredentialSourceIdsKey); ok {
+			credSourceIds := credentialSourceIdsVal.(*schema.Set).List()
+			for _, credSourceId := range credSourceIds {
+				credentialSourceIds = append(credentialSourceIds, credSourceId.(string))
+			}
+		}
+
+		opts := []targets.Option{
+			targets.WithAutomaticVersioning(true),
+			targets.DefaultInjectedApplicationCredentialSourceIds(),
+		}
+		if len(credentialSourceIds) > 0 {
+			opts = append(opts, targets.WithInjectedApplicationCredentialSourceIds(credentialSourceIds))
+		}
+
+		_, err := tc.SetCredentialSources(ctx, d.Id(), 0, opts...)
+		if err != nil {
+			return diag.Errorf("error updating injected application credential sources in target: %v", err)
+		}
+		if err := d.Set(targetInjectedAppCredentialSourceIdsKey, credentialSourceIds); err != nil {
 			return diag.FromErr(err)
 		}
 	}

internal/provider/resource_target_test.go

@@ -89,7 +89,7 @@ resource "boundary_target" "foo" {
 	host_source_ids = [
 		boundary_host_set.foo.id
 	]
-	application_credential_source_ids = [
+	brokered_credential_source_ids = [
 		boundary_credential_library_vault.foo.id
 	]
 	default_port = 22
@@ -108,7 +108,7 @@ resource "boundary_target" "foo" {
 	host_source_ids = [
 		boundary_host_set.bar.id
 	]
-	application_credential_source_ids = [
+	brokered_credential_source_ids = [
 		boundary_credential_library_vault.bar.id
 	]
 	default_port = 80
@@ -166,7 +166,7 @@ func TestAccTarget(t *testing.T) {
 					resource.TestCheckResourceAttr("boundary_target.foo", targetSessionConnectionLimitKey, "6"),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetWorkerFilterKey, `type == "foo"`),
 					testAccCheckTargetResourceHostSource(provider, "boundary_target.foo", []string{"boundary_host_set.foo"}),
-					testAccCheckTargetResourceAppCredSources(provider, "boundary_target.foo", []string{"boundary_credential_library_vault.foo"}),
+					testAccCheckTargetResourceBrokeredCredSources(provider, "boundary_target.foo", []string{"boundary_credential_library_vault.foo"}),
 				),
 			},
 			importStep("boundary_target.foo"),
@@ -181,7 +181,7 @@ func TestAccTarget(t *testing.T) {
 					resource.TestCheckResourceAttr("boundary_target.foo", targetSessionConnectionLimitKey, "7"),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetWorkerFilterKey, `type == "bar"`),
 					testAccCheckTargetResourceHostSource(provider, "boundary_target.foo", []string{"boundary_host_set.bar"}),
-					testAccCheckTargetResourceAppCredSources(provider, "boundary_target.foo", []string{"boundary_credential_library_vault.bar"}),
+					testAccCheckTargetResourceBrokeredCredSources(provider, "boundary_target.foo", []string{"boundary_credential_library_vault.bar"}),
 				),
 			},
 			importStep("boundary_target.foo"),
@@ -196,7 +196,7 @@ func TestAccTarget(t *testing.T) {
 					resource.TestCheckResourceAttr("boundary_target.foo", targetSessionConnectionLimitKey, "7"),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetWorkerFilterKey, `type == "bar"`),
 					testAccCheckTargetResourceHostSource(provider, "boundary_target.foo", nil),
-					testAccCheckTargetResourceAppCredSources(provider, "boundary_target.foo", nil),
+					testAccCheckTargetResourceBrokeredCredSources(provider, "boundary_target.foo", nil),
 				),
 			},
 			importStep("boundary_target.foo"),
@@ -261,7 +261,7 @@ func testAccCheckTargetResourceHostSource(testProvider *schema.Provider, name st
 	}
 }
 
-func testAccCheckTargetResourceAppCredSources(testProvider *schema.Provider, name string, credSources []string) resource.TestCheckFunc {
+func testAccCheckTargetResourceBrokeredCredSources(testProvider *schema.Provider, name string, credSources []string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[name]
 		if !ok {
@@ -298,11 +298,11 @@ func testAccCheckTargetResourceAppCredSources(testProvider *schema.Provider, nam
 			return fmt.Errorf("got an error when reading target %q: %w", id, err)
 		}
 
-		if len(t.Item.ApplicationCredentialSourceIds) != len(credSourceIDs) {
-			return fmt.Errorf("tf state and boundary have different number of application credential sources")
+		if len(t.Item.BrokeredCredentialSourceIds) != len(credSourceIDs) {
+			return fmt.Errorf("tf state and boundary have different number of brokered credential sources")
 		}
 
-		for _, stateCredSourceId := range t.Item.ApplicationCredentialSourceIds {
+		for _, stateCredSourceId := range t.Item.BrokeredCredentialSourceIds {
 			ok := false
 			for _, gotCredSourceID := range credSourceIDs {
 				if gotCredSourceID == stateCredSourceId {
@@ -310,7 +310,7 @@ func testAccCheckTargetResourceAppCredSources(testProvider *schema.Provider, nam
 				}
 			}
 			if !ok {
-				return fmt.Errorf("application credential source id in state not set in boundary: %s", stateCredSourceId)
+				return fmt.Errorf("brokered credential source id in state not set in boundary: %s", stateCredSourceId)
 			}
 		}
 

plugins/kms/assets_darwin_amd64.go

@@ -5,5 +5,6 @@ import (
 )
 
 // content is our static kms plugin content.
+//
 //go:embed assets/darwin/amd64
 var content embed.FS

plugins/kms/assets_darwin_arm64.go

@@ -5,5 +5,6 @@ import (
 )
 
 // content is our static kms plugin content.
+//
 //go:embed assets/darwin/arm64
 var content embed.FS

plugins/kms/assets_freebsd_386.go

@@ -5,5 +5,6 @@ import (
 )
 
 // content is our static kms plugin content.
+//
 //go:embed assets/freebsd/386
 var content embed.FS

plugins/kms/assets_freebsd_amd64.go

@@ -5,5 +5,6 @@ import (
 )
 
 // content is our static kms plugin content.
+//
 //go:embed assets/freebsd/amd64
 var content embed.FS

plugins/kms/assets_freebsd_arm.go

@@ -5,5 +5,6 @@ import (
 )
 
 // content is our static kms plugin content.
+//
 //go:embed assets/freebsd/arm
 var content embed.FS

plugins/kms/assets_linux_386.go

@@ -5,5 +5,6 @@ import (
 )
 
 // content is our static kms plugin content.
+//
 //go:embed assets/linux/386
 var content embed.FS

plugins/kms/assets_linux_amd64.go

@@ -5,5 +5,6 @@ import (
 )
 
 // content is our static kms plugin content.
+//
 //go:embed assets/linux/amd64
 var content embed.FS

plugins/kms/assets_linux_arm.go

@@ -5,5 +5,6 @@ import (
 )
 
 // content is our static kms plugin content.
+//
 //go:embed assets/linux/arm
 var content embed.FS

plugins/kms/assets_linux_arm64.go

@@ -5,5 +5,6 @@ import (
 )
 
 // content is our static kms plugin content.
+//
 //go:embed assets/linux/arm64
 var content embed.FS

plugins/kms/assets_windows_386.go

@@ -5,5 +5,6 @@ import (
 )
 
 // content is our static kms plugin content.
+//
 //go:embed assets/windows/386
 var content embed.FS

plugins/kms/assets_windows_amd64.go

@@ -5,5 +5,6 @@ import (
 )
 
 // content is our static kms plugin content.
+//
 //go:embed assets/windows/amd64
 var content embed.FS

tools/tools.go

@@ -1,3 +1,4 @@
+//go:build tools
 // +build tools
 
 package tools