chore: Create changelog for v1.1.9 (#434)

Target for release on July 19, 2023

.circleci/config.yml

@@ -1,25 +0,0 @@
-version: 2.1
-jobs:
-  build:
-    resource_class: large
-    machine:
-      image: 'ubuntu-2004:202107-02'
-    working_directory: ~/terraform-provider-watchtower
-    steps:
-    - add_ssh_keys:
-        fingerprints:
-        # hc-github-team-secure-boundary github user,TF_ACC=1 ~/.go/bin/go test ./... -v $(TESTARGS) -timeout 120m to read private modules
-          - "d4:7f:b2:f7:6f:4d:e7:21:cc:d2:b7:6a:8b:68:e6:d4"
-    - checkout
-    - run:
-        name: "Install go"
-        command: |
-          unset GOPATH # ci image has done strange things with GOPATH, unset it so install-go can fix it
-          make install-go
-          source ~/.bashrc
-          go mod download
-    - run:
-        name: "Run Acceptance Tests"
-        command: |
-          source ~/.bashrc
-          make testacc-ci

.copywrite.hcl

@@ -0,0 +1,16 @@
+schema_version = 1
+
+project {
+  license = "MPL-2.0"
+
+  copyright_year = 2020
+
+  # (OPTIONAL) A list of globs that should not have copyright or license headers.
+  # Supports doublestar glob patterns for more flexibility in defining which
+  # files or folders should be ignored
+  # Default: []
+  header_ignore = [
+    "examples/**/*.tf",
+    "examples/**/*.sh",
+  ]
+}

.github/dependabot.yml

@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 # See GitHub's docs for more information on this file:
 # https://docs.github.com/en/free-pro-team@latest/github/administering-a-repository/configuration-options-for-dependency-updates
 version: 2

.github/workflows/actionlint.yml

@@ -0,0 +1,15 @@
+name: Lint GitHub Actions workflows
+on: push
+
+permissions:
+  contents: read
+
+jobs:
+  actionlint:
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
+    steps:
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - name: Check workflow files
+        uses: docker://docker.mirror.hashicorp.services/rhysd/actionlint@sha256:02ccb6d91e4cb4a7b21eb99d5274d257e81ae667688d730e89d7ea0d6d35db91
+        with:
+          args: -color

.github/workflows/jira.yml

@@ -9,6 +9,9 @@ on:
 
 name: Jira Sync
 
+permissions:
+  contents: read
+
 jobs:
   sync:
     runs-on: ubuntu-latest
@@ -18,19 +21,19 @@ jobs:
       if: github.event.action == 'opened'
       id: boundary-team-role
       run: |
-        TEAM=boundary
+        TEAM="boundary"
         ROLE="$(hub api orgs/hashicorp/teams/${TEAM}/memberships/${{ github.actor }} | jq -r '.role | select(.!=null)')"
-        if [[ -n ${ROLE} ]]; then
+        if [[ -n "${ROLE}" ]]; then
           echo "Actor ${{ github.actor }} is a ${TEAM} team member, skipping ticket creation"
         else
           echo "Actor ${{ github.actor }} is not a ${TEAM} team member"
         fi
-        echo "::set-output name=role::${ROLE}"
+        echo "name=role::${ROLE}" >> "$GITHUB_OUTPUT"
       env:
         GITHUB_TOKEN: ${{ secrets.JIRA_SYNC_GITHUB_TOKEN }}
 
     - name: Login
-      uses: atlassian/gajira-login@v2.0.0
+      uses: atlassian/gajira-login@45fd029b9f1d6d8926c6f04175aa80c0e42c9026 # v3.0.1
       env:
         JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
         JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
@@ -41,14 +44,14 @@ jobs:
       id: set-ticket-type
       run: |
         if [[ "${{ github.event_name }}" == "pull_request_target" ]]; then
-          echo "::set-output name=type::PR"
+          echo "name=type::PR" >> "$GITHUB_OUTPUT"
         else
-          echo "::set-output name=type::ISS"
+          echo "name=type::ISS" >> "$GITHUB_OUTPUT"
         fi
 
     - name: Create ticket
       if: github.event.action == 'opened' && !steps.boundary-team-role.outputs.role
-      uses: tomhjp/gh-action-jira-create@v0.2.0
+      uses: tomhjp/gh-action-jira-create@3ed1789cad3521292e591a7cfa703215ec1348bf # v0.2.1
       with:
         project: ICU
         issuetype: "GH Issue"
@@ -60,28 +63,28 @@ jobs:
     - name: Search
       if: github.event.action != 'opened'
       id: search
-      uses: tomhjp/gh-action-jira-search@v0.2.1
+      uses: tomhjp/gh-action-jira-search@04700b457f317c3e341ce90da5a3ff4ce058f2fa # v0.2.2
       with:
         # cf[10089] is Issue Link custom field
         jql: 'issuetype = "GH Issue" and cf[10089]="${{ github.event.issue.html_url || github.event.pull_request.html_url }}"'
 
     - name: Sync comment
       if: github.event.action == 'created' && steps.search.outputs.issue
-      uses: tomhjp/gh-action-jira-comment@v0.2.0
+      uses: tomhjp/gh-action-jira-comment@6eb6b9ead70221916b6badd118c24535ed220bd9 # v0.2.0
       with:
         issue: ${{ steps.search.outputs.issue }}
         comment: "${{ github.actor }} ${{ github.event.review.state || 'commented' }}:\n\n${{ github.event.comment.body || github.event.review.body }}\n\n${{ github.event.comment.html_url || github.event.review.html_url }}"
 
     - name: Close ticket
       if: (github.event.action == 'closed' || github.event.action == 'deleted') && steps.search.outputs.issue
-      uses: atlassian/gajira-transition@v2.0.2
+      uses: atlassian/gajira-transition@38fc9cd61b03d6a53dd35fcccda172fe04b36de3 # v3
       with:
         issue: ${{ steps.search.outputs.issue }}
         transition: Done
 
     - name: Reopen ticket
       if: github.event.action == 'reopened' && steps.search.outputs.issue
-      uses: atlassian/gajira-transition@v2.0.2
+      uses: atlassian/gajira-transition@38fc9cd61b03d6a53dd35fcccda172fe04b36de3 # v3
       with:
         issue: ${{ steps.search.outputs.issue }}
         transition: "To Do"

.github/workflows/release.yml

@@ -14,18 +14,18 @@ jobs:
     outputs:
       version: ${{ steps.go-version.outputs.version }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
       - id: go-version
-        run: echo "::set-output name=version::$(cat ./.go-version)"
+        run: echo "name=version::$(cat ./.go-version)" >> "$GITHUB_OUTPUT"
   release-notes:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
         with:
           fetch-depth: 0
       - name: Generate Release Notes
         run: sed -n -e "1{/# /d;}" -e "2{/^$/d;}" -e "/# $(git describe --abbrev=0 --exclude="$(git describe --abbrev=0 --match='v*.*.*' --tags)" --match='v*.*.*' --tags | tr -d v)/q;p" CHANGELOG.md > release-notes.txt
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
         with:
           name: release-notes
           path: release-notes.txt

.github/workflows/test.yml

@@ -0,0 +1,43 @@
+name: test
+
+on:
+  - push
+  - workflow_dispatch
+  - workflow_call
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
+    steps:
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - name: Determine go version
+        id: get-go-version
+        # We use .go-version as our source of truth for current Go
+        # version, because "goenv" can react to it automatically.
+        run: |
+          echo "Building with Go $(cat .go-version)"
+          echo "go-version=$(cat .go-version)" >> "$GITHUB_OUTPUT"
+      - name: Set up Go
+        uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
+        with:
+          go-version: "${{ steps.get-go-version.outputs.go-version }}"
+      - name: Determine Go cache paths
+        id: go-cache-paths
+        run: |
+          echo "go-build=$(go env GOCACHE)" >> "$GITHUB_OUTPUT"
+          echo "go-mod=$(go env GOMODCACHE)" >> "$GITHUB_OUTPUT"
+      - name: Set up Go modules cache
+        uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
+        with:
+          path: |
+            ${{ steps.go-cache-paths.outputs.go-build }}
+            ${{ steps.go-cache-paths.outputs.go-mod }}
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go
+      - name: Acceptance Tests
+        run: |
+          make testacc

.go-version

@@ -1 +1 @@
-1.19.1
+1.20.5

.goreleaser.yml

@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 archives:
   - files:
       # Ensure only built binary is archived

.release/release-metadata.hcl

@@ -1,2 +1,5 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 url_source_repository      = "https://github.com/hashicorp/terraform-provider-boundary"
 url_license                = "https://github.com/hashicorp/terraform-provider-boundary/blob/main/LICENSE"

CHANGELOG.md

@@ -2,6 +2,103 @@
 
 Canonical reference for changes, improvements, and bugfixes for the Boundary Terraform provider.
 
+## 1.1.9 (July 19, 2023)
+
+### New and Improved
+
+* Add support for a storage bucket as a resource
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/417))
+* Add option to enable session recording on a target resource
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/421))
+* Update docs for host set plugin filters examples
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/420))  
+
+## 1.1.8 (June 13, 2023)
+
+### New and Improved
+
+* Add support for target default client port
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/379))
+* Add support for using ldap primary auth method
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/392))
+
+### Deprecations/Changes
+
+* Deprecate `password_auth_method_login_name` & `password_auth_method_password` for Terraform Provider.
+  `password_auth_method_login_name` & `password_auth_method_password` fields have been set to deprecated 
+  with a recommendation to use `auth_method_login_name` & `auth_method_password` fields instead.
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/392))
+* Deprecate type field for `boundary_account_password`
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/396))
+* Deprecate type field for `boundary_account_ldap`
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/400))
+
+## 1.1.7 (May 12, 2023)
+
+### Bug Fix
+* Fix default auth method with recovery kms
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/406))  
+
+## 1.1.6 (May 5, 2023)
+
+### New and Improved
+* Add support for using default auth method if no auth method ID is provided for provider
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/385))
+* Fix typo in Managed Group resource page
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/370))
+
+### Bug Fix
+* Force new resource on credential_type change
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/389))
+
+## 1.1.5 (April 21, 2023)
+
+### New and Improved
+* Add support for credential store vault worker filters ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/375))
+
+### Bug Fix
+* Allow users to set OIDC maxAge value to 0 to require immediate reauth ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/364))
+
+## 1.1.4 (February 15, 2023)
+
+### New and Improved
+
+* Add support for worker egress and ingress filters
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/319))
+* Add support for vault ssh certificate credential libraries
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/320))
+* Add support for targets with address configurations
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/308))
+
+## 1.1.3 (November 29, 2022)
+
+### New and Improved
+
+* Add support for a workers as a resource
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/293)).
+
+## 1.1.2 (October 18, 2022)
+
+### New and Improved
+
+* Add support for setting mapping overrides for vault credential libraries
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/287)).
+
+### Bug Fixes
+
+* Improve error message when authenticating to boundary
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/290)).
+* Set state before returning an error when creating a resource
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/289))
+
+## 1.1.1 (October 12, 2022)
+
+### Bug Fixes
+
+* The plugin cleanup function is being called before the entire Terraform workflow is complete.
+  ([Issue](https://github.com/hashicorp/terraform-provider-boundary/issues/282)),
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/285)).
+
 ## 1.1.0 (October 4, 2022)
 
 ### New and Improved
@@ -178,4 +275,4 @@ Update provider to handle new domain errors ([PR](https://github.com/hashicorp/t
 
 ## 0.1.0 (October 14, 2020)
 
-Initial release!
+Initial release!

CODEOWNERS

@@ -0,0 +1,4 @@
+# These owners will be the default owners for everything in
+# the repo, unless a later match takes precedence.
+
+@hashicorp/boundary

Dockerfile

@@ -1,4 +1,7 @@
-FROM golang:1.19
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+FROM golang:1.20
 
 WORKDIR /go/src/terraform-provider-boundary
 COPY . .

LICENSE

@@ -1,3 +1,5 @@
+Copyright (c) 2020 HashiCorp, Inc.
+
 Mozilla Public License Version 2.0
 ==================================
 

Makefile

@@ -34,15 +34,6 @@ test:
 testacc:
 	TF_ACC=1 go test ./... -v $(TESTARGS) -timeout 120m
 
-testacc-ci:
-	git config --global --add url."git@github.com:".insteadOf "https://github.com/"
-	TF_ACC=1 ~/.go/bin/go test ./... -v $(TESTARGS) -timeout 120m
-
-install-go: ~/.go/bin/go
-
-~/.go/bin/go:
-	./ci/goinstall.sh
-
 dev:
 	GOOS=${GOOS} GOARCH=${GOARCH} ./scripts/plugins.sh
 	mkdir -p $(INSTALL_PATH)

README.md

@@ -9,7 +9,7 @@ Requirements
 ------------
 
 -	[Terraform](https://www.terraform.io/downloads.html) >= 0.12.x
--	[Go](https://golang.org/doc/install) >= 1.19
+-	[Go](https://golang.org/doc/install) >= 1.20
 
 Building The Provider
 ---------------------

ci/goinstall.sh

@@ -1,118 +0,0 @@
-#!/bin/bash
-set -e
-
-VERSION="1.19.1"
-
-[ -z "$GOROOT" ] && GOROOT="$HOME/.go"
-[ -z "$GOPATH" ] && GOPATH="$HOME/go"
-
-OS="$(uname -s)"
-ARCH="$(uname -m)"
-
-case $OS in
-    "Linux")
-        case $ARCH in
-        "x86_64")
-            ARCH=amd64
-            ;;
-        "aarch64")
-            ARCH=arm64
-            ;;
-        "armv6")
-            ARCH=armv6l
-            ;;
-        "armv8")
-            ARCH=arm64
-            ;;
-        .*386.*)
-            ARCH=386
-            ;;
-        esac
-        PLATFORM="linux-$ARCH"
-    ;;
-    "Darwin")
-        PLATFORM="darwin-amd64"
-    ;;
-esac
-
-print_help() {
-    echo "Usage: bash goinstall.sh OPTIONS"
-    echo -e "\nOPTIONS:"
-    echo -e "  --remove\tRemove currently installed version"
-    echo -e "  --version\tSpecify a version number to install"
-}
-
-if [ -n "`$SHELL -c 'echo $ZSH_VERSION'`" ]; then
-    shell_profile="zshrc"
-elif [ -n "`$SHELL -c 'echo $BASH_VERSION'`" ]; then
-    shell_profile="bashrc"
-fi
-
-if [ "$1" == "--remove" ]; then
-    rm -rf "$GOROOT"
-    if [ "$OS" == "Darwin" ]; then
-        sed -i "" '/# GoLang/d' "$HOME/.${shell_profile}"
-        sed -i "" '/export GOROOT/d' "$HOME/.${shell_profile}"
-        sed -i "" '/$GOROOT\/bin/d' "$HOME/.${shell_profile}"
-        sed -i "" '/export GOPATH/d' "$HOME/.${shell_profile}"
-        sed -i "" '/$GOPATH\/bin/d' "$HOME/.${shell_profile}"
-    else
-        sed -i '/# GoLang/d' "$HOME/.${shell_profile}"
-        sed -i '/export GOROOT/d' "$HOME/.${shell_profile}"
-        sed -i '/$GOROOT\/bin/d' "$HOME/.${shell_profile}"
-        sed -i '/export GOPATH/d' "$HOME/.${shell_profile}"
-        sed -i '/$GOPATH\/bin/d' "$HOME/.${shell_profile}"
-    fi
-    echo "Go removed."
-    exit 0
-elif [ "$1" == "--help" ]; then
-    print_help
-    exit 0
-elif [ "$1" == "--version" ]; then
-    if [ -z "$2" ]; then # Check if --version has a second positional parameter
-        echo "Please provide a version number for: $1"
-    else
-        VERSION=$2
-    fi
-elif [ ! -z "$1" ]; then
-    echo "Unrecognized option: $1"
-    exit 1
-fi
-
-if [ -d "$GOROOT" ]; then
-    echo "The Go install directory ($GOROOT) already exists. Exiting."
-    exit 1
-fi
-
-PACKAGE_NAME="go$VERSION.$PLATFORM.tar.gz"
-TEMP_DIRECTORY=$(mktemp -d)
-
-echo "Downloading $PACKAGE_NAME ..."
-if hash wget 2>/dev/null; then
-    wget https://storage.googleapis.com/golang/$PACKAGE_NAME -O "$TEMP_DIRECTORY/go.tar.gz"
-else
-    curl -o "$TEMP_DIRECTORY/go.tar.gz" https://storage.googleapis.com/golang/$PACKAGE_NAME
-fi
-
-if [ $? -ne 0 ]; then
-    echo "Download failed! Exiting."
-    exit 1
-fi
-
-echo "Extracting File..."
-mkdir -p "$GOROOT"
-tar -C "$GOROOT" --strip-components=1 -xzf "$TEMP_DIRECTORY/go.tar.gz"
-touch "$HOME/.${shell_profile}"
-{
-    echo '# GoLang'
-    echo "export GOROOT=${GOROOT}"
-    echo 'export PATH=$GOROOT/bin:$PATH'
-    echo "export GOPATH=$GOPATH"
-    echo 'export PATH=$GOPATH/bin:$PATH'
-} >> "$HOME/.${shell_profile}"
-
-mkdir -p $GOPATH/{src,pkg,bin}
-echo -e "\nGo $VERSION was installed into $GOROOT.\nMake sure to relogin into your shell or run:"
-echo -e "\n\tsource $HOME/.${shell_profile}\n\nto update your environment variables."
-echo "Tip: Opening a new terminal window usually just works. :)"
-rm -f "$TEMP_DIRECTORY/go.tar.gz"

docs/index.md

@@ -20,6 +20,19 @@ provider "boundary" {
   password_auth_method_login_name = "myuser"          # changeme
   password_auth_method_password   = "passpass"        # changeme
 }
+
+provider "boundary" {
+  addr                            = "http://127.0.0.1:9200"
+  password_auth_method_login_name = "myuser"
+  password_auth_method_password   = "passpass"
+}
+
+provider "boundary" {
+  addr                            = "http://127.0.0.1:9200"
+  password_auth_method_login_name = "myuser"
+  password_auth_method_password   = "passpass"
+  scope_id                        = "s_1234567890"
+}
 ```
 
 <!-- schema generated by tfplugindocs -->
@@ -31,10 +44,13 @@ provider "boundary" {
 
 ### Optional
 
-- `auth_method_id` (String) The auth method ID e.g. ampw_1234567890
-- `password_auth_method_login_name` (String) The auth method login name for password-style auth methods
-- `password_auth_method_password` (String) The auth method password for password-style auth methods
+- `auth_method_id` (String) The auth method ID e.g. ampw_1234567890. If not set, the default auth method for the given scope ID will be used.
+- `auth_method_login_name` (String) The auth method login name for password-style or ldap-style auth methods
+- `auth_method_password` (String) The auth method password for password-style or ldap-style auth methods
+- `password_auth_method_login_name` (String, Deprecated) The auth method login name for password-style auth methods
+- `password_auth_method_password` (String, Deprecated) The auth method password for password-style auth methods
 - `plugin_execution_dir` (String) Specifies a directory that the Boundary provider can use to write and execute its built-in plugins.
 - `recovery_kms_hcl` (String) Can be a heredoc string or a path on disk. If set, the string/file will be parsed as HCL and used with the recovery KMS mechanism. While this is set, it will override any other authentication information; the KMS mechanism will always be used. See Boundary's KMS docs for examples: https://boundaryproject.io/docs/configuration/kms
+- `scope_id` (String) The scope ID for the default auth method.
 - `tls_insecure` (Boolean) When set to true, does not validate the Boundary API endpoint certificate
 - `token` (String) The Boundary token to use, as a string or path on disk containing just the string. If set, the token read here will be used in place of authenticating with the auth method specified in "auth_method_id", although the recovery KMS mechanism will still override this. Can also be set with the BOUNDARY_TOKEN environment variable.

docs/resources/account_ldap.md

@@ -0,0 +1,33 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_account_ldap Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The account resource allows you to configure a Boundary account.
+---
+
+# boundary_account_ldap (Resource)
+
+The account resource allows you to configure a Boundary account.
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `auth_method_id` (String) The resource ID for the auth method.
+
+### Optional
+
+- `description` (String) The account description.
+- `login_name` (String) The login name for this account.
+- `name` (String) The account name. Defaults to the resource name.
+- `type` (String, Deprecated) The resource type.
+
+### Read-Only
+
+- `id` (String) The ID of the account.
+
+

docs/resources/account_password.md

@@ -28,7 +28,6 @@ resource "boundary_auth_method" "password" {
 
 resource "boundary_account_password" "jeff" {
   auth_method_id = boundary_auth_method.password.id
-  type           = "password"
   login_name     = "jeff"
   password       = "$uper$ecure"
 }
@@ -40,7 +39,6 @@ resource "boundary_account_password" "jeff" {
 ### Required
 
 - `auth_method_id` (String) The resource ID for the auth method.
-- `type` (String) The resource type.
 
 ### Optional
 
@@ -48,6 +46,7 @@ resource "boundary_account_password" "jeff" {
 - `login_name` (String) The login name for this account.
 - `name` (String) The account name. Defaults to the resource name.
 - `password` (String, Sensitive) The account password. Only set on create, changes will not be reflected when updating account.
+- `type` (String, Deprecated) The resource type.
 
 ### Read-Only
 

docs/resources/auth_method_ldap.md

@@ -0,0 +1,56 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_auth_method_ldap Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The LDAP auth method resource allows you to configure a Boundary authmethodldap.
+---
+
+# boundary_auth_method_ldap (Resource)
+
+The LDAP auth method resource allows you to configure a Boundary auth_method_ldap.
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `scope_id` (String) The scope ID.
+
+### Optional
+
+- `account_attribute_maps` (List of String) Account attribute maps fullname and email.
+- `anon_group_search` (Boolean) Use anon bind when performing LDAP group searches (optional).
+- `bind_dn` (String) The distinguished name of entry to bind when performing user and group searches (optional).
+- `bind_password` (String) The password to use along with bind-dn performing user and group searches (optional).
+- `bind_password_hmac` (String) The HMAC of the bind password returned by the Boundary controller, which is used for comparison after initial setting of the value.
+- `certificates` (List of String) PEM-encoded X.509 CA certificate in ASN.1 DER form that can be used as a trust anchor when connecting to an LDAP server(optional).  This may be specified multiple times
+- `client_certificate` (String) PEM-encoded X.509 client certificate in ASN.1 DER form that can be used to authenticate against an LDAP server(optional).
+- `client_certificate_key` (String) PEM-encoded X.509 client certificate key in PKCS #8, ASN.1 DER form used with the client certificate (optional).
+- `client_certificate_key_hmac` (String) The HMAC of the client certificate key returned by the Boundary controller, which is used for comparison after initial setting of the value.
+- `description` (String) The auth method description.
+- `discover_dn` (Boolean) Use anon bind to discover the bind DN of a user (optional).
+- `enable_groups` (Boolean) Find the authenticated user's groups during authentication (optional).
+- `group_attr` (String) The attribute that enumerates a user's group membership from entries returned by a group search (optional).
+- `group_dn` (String) The base DN under which to perform group search.
+- `group_filter` (String) A go template used to construct a LDAP group search filter (optional).
+- `insecure_tls` (Boolean) Skip the LDAP server SSL certificate validation (optional) - insecure and use with caution.
+- `is_primary_for_scope` (Boolean) When true, makes this auth method the primary auth method for the scope in which it resides. The primary auth method for a scope means the the user will be automatically created when they login using an LDAP account.
+- `name` (String) The auth method name. Defaults to the resource name.
+- `start_tls` (Boolean) Issue StartTLS command after connecting (optional).
+- `state` (String) Can be one of 'inactive', 'active-private', or 'active-public'. Defaults to active-public.
+- `type` (String) The type of auth method; hardcoded.
+- `upn_domain` (String) The userPrincipalDomain used to construct the UPN string for the authenticating user (optional).
+- `urls` (List of String) The LDAP URLs that specify LDAP servers to connect to (required).  May be specified multiple times.
+- `use_token_groups` (Boolean) Use the Active Directory tokenGroups constructed attribute of the user to find the group memberships (optional).
+- `user_attr` (String) The attribute on user entry matching the username passed when authenticating (optional).
+- `user_dn` (String) The base DN under which to perform user search (optional).
+- `user_filter` (String) A go template used to construct a LDAP user search filter (optional).
+
+### Read-Only
+
+- `id` (String) The ID of the auth method.
+
+

docs/resources/auth_method_oidc.md

@@ -32,9 +32,9 @@ The OIDC auth method resource allows you to configure a Boundary auth_method_oid
 - `description` (String) The auth method description.
 - `disable_discovered_config_validation` (Boolean) Disables validation logic ensuring that the OIDC provider's information from its discovery endpoint matches the information here. The validation is only performed at create or update time.
 - `idp_ca_certs` (List of String) A list of CA certificates to trust when validating the IdP's token signatures.
-- `is_primary_for_scope` (Boolean) When true, makes this auth method the primary auth method for the scope in which it resides. The primary auth method for a scope means the the user will be automatically created when they login using an OIDC account.
+- `is_primary_for_scope` (Boolean) When true, makes this auth method the primary auth method for the scope in which it resides. The primary auth method for a scope means the user will be automatically created when they login using an OIDC account.
 - `issuer` (String) The issuer corresponding to the provider, which must match the issuer field in generated tokens.
-- `max_age` (Number) The max age to provide to the provider, indicating how much time is allowed to have passed since the last authentication before the user is challenged again.
+- `max_age` (Number) The max age to provide to the provider, indicating how much time is allowed to have passed since the last authentication before the user is challenged again. A value of 0 sets an immediate requirement for all users to reauthenticate, and an unset maxAge results in a Terraform value of -1 and the default TTL of the chosen OIDC will be used.
 - `name` (String) The auth method name. Defaults to the resource name.
 - `signing_algorithms` (List of String) Allowed signing algorithms for the provider's issued tokens.
 - `state` (String) Can be one of 'inactive', 'active-private', or 'active-public'. Currently automatically set to active-public.

docs/resources/credential_library_vault.md

@@ -56,6 +56,33 @@ resource "boundary_credential_library_vault" "bar" {
 }
 EOT
 }
+
+resource "boundary_credential_library_vault" "baz" {
+  name                = "baz"
+  description         = "vault username password credential with mapping overrides"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "my/secret/baz" # change to Vault backend path
+  http_method         = "GET"
+  credential_type     = "username_password"
+  credential_mapping_overrides = {
+    password_attribute = "alternative_password_label"
+    username_attribute = "alternative_username_label"
+  }
+}
+
+resource "boundary_credential_library_vault" "quz" {
+  name                = "quz"
+  description         = "vault ssh private key credential with mapping overrides"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "my/secret/quz" # change to Vault backend path
+  http_method         = "GET"
+  credential_type     = "ssh_private_key"
+  credential_mapping_overrides = {
+    private_key_attribute            = "alternative_key_label"
+    private_key_passphrase_attribute = "alternative_passphrase_label"
+    username_attribute               = "alternative_username_label"
+  }
+}
 ```
 
 <!-- schema generated by tfplugindocs -->
@@ -68,7 +95,8 @@ EOT
 
 ### Optional
 
-- `credential_type` (String) The type of credential the library generates.
+- `credential_mapping_overrides` (Map of String) The credential mapping override.
+- `credential_type` (String) The type of credential the library generates. Cannot be updated on an existing resource.
 - `description` (String) The Vault credential library description.
 - `http_method` (String) The HTTP method the library uses when requesting credentials from Vault. Defaults to 'GET'
 - `http_request_body` (String) The body of the HTTP request the library sends to Vault when requesting credentials. Only valid if `http_method` is set to `POST`.

docs/resources/credential_library_vault_ssh_certificate.md

@@ -0,0 +1,111 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_credential_library_vault_ssh_certificate Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The credential library for Vault resource allows you to configure a Boundary credential library for Vault.
+---
+
+# boundary_credential_library_vault_ssh_certificate (Resource)
+
+The credential library for Vault resource allows you to configure a Boundary credential library for Vault.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_vault" "foo" {
+  name        = "foo"
+  description = "My first Vault credential store!"
+  address     = "http://127.0.0.1:8200"      # change to Vault address
+  token       = "s.0ufRo6XEGU2jOqnIr7OlFYP5" # change to valid Vault token
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_library_vault_ssh_certificate" "foo" {
+  name                = "foo"
+  description         = "My first Vault SSH certificate credential library!"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "ssh/sign/foo" # change to correct Vault endpoint and role
+  username            = "foo"          # change to valid username
+}
+
+resource "boundary_credential_library_vault_ssh_certificate" "bar" {
+  name                = "bar"
+  description         = "My second Vault SSH certificate credential library!"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "ssh/sign/foo" # change to correct Vault endpoint and role
+  username            = "foo"
+  key_type            = "ecdsa"
+  key_bits            = 384
+
+  extensions = {
+    permit-pty = ""
+  }
+}
+
+resource "boundary_credential_library_vault_ssh_certificate" "baz" {
+  name                = "baz"
+  description         = "vault "
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "ssh/issue/foo" # change to correct Vault endpoint and role
+  username            = "foo"
+  key_type            = "rsa"
+  key_bits            = 4096
+
+  extensions = {
+    permit-pty            = ""
+    permit-X11-forwarding = ""
+  }
+
+  critical_options = {
+    force-command = "/bin/some_script"
+  }
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `credential_store_id` (String) The ID of the credential store that this library belongs to.
+- `path` (String) The path in Vault to request credentials from.
+- `username` (String) The username to use with the certificate returned by the library.
+
+### Optional
+
+- `critical_options` (Map of String) Specifies a map of the critical options that the certificate should be signed for.
+- `description` (String) The Vault credential library description.
+- `extensions` (Map of String) Specifies a map of the extensions that the certificate should be signed for.
+- `key_bits` (Number) Specifies the number of bits to use for the generated keys.
+- `key_id` (String) Specifies the key id a certificate should have.
+- `key_type` (String) Specifies the desired key type; must be ed25519, ecdsa, or rsa.
+- `name` (String) The Vault credential library name. Defaults to the resource name.
+- `ttl` (String) Specifies the requested time to live for a certificate returned from the library.
+
+### Read-Only
+
+- `id` (String) The ID of the Vault credential library.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_credential_library_vault_ssh_certificate.foo <my-id>
+```

docs/resources/credential_store_vault.md

@@ -56,6 +56,7 @@ resource "boundary_credential_store_vault" "example" {
 - `namespace` (String) The namespace within Vault to use.
 - `tls_server_name` (String) Name to use as the SNI host when connecting to Vault via TLS.
 - `tls_skip_verify` (Boolean) Whether or not to skip TLS verification.
+- `worker_filter` (String) HCP Only. A filter used to control which PKI workers can handle Vault requests. This allows the use of private Vault instances with Boundary.
 
 ### Read-Only
 

docs/resources/host_catalog_plugin.md

@@ -67,7 +67,7 @@ resource "boundary_host_catalog_plugin" "azure_example" {
     "client_id"                   = "ARM_CLIENT_ID"
   })
 
-  # recommended to pass in aws secrets using a file() or using environment variables
+  # recommended to pass in azure secrets using a file() or using environment variables
   # the secrets below must be generated in azure by creating an ad application
   secrets_json = jsonencode({
     "secret_value" = "ARM_CLIENT_SECRET"

docs/resources/host_set_plugin.md

@@ -50,27 +50,25 @@ resource "boundary_host_catalog_plugin" "aws_example" {
 
 resource "boundary_host_set_plugin" "web" {
   name            = "My web host set plugin"
-  host_catalog_id = boundary_host_catalog_plugin.aws_exmaple.id
-  attributes_json = jsonencode({ "filters" = "tag:service-type=web" })
+  host_catalog_id = boundary_host_catalog_plugin.aws_example.id
+  attributes_json = jsonencode({ "filters" = ["tag:service-type=web"] })
 }
 
 resource "boundary_host_set_plugin" "foobar" {
   name                = "My foobar host set plugin"
-  host_catalog_id     = boundary_host_catalog_plugin.aws_exmaple.id
+  host_catalog_id     = boundary_host_catalog_plugin.aws_example.id
   preferred_endpoints = ["cidr:54.0.0.0/8"]
   attributes_json = jsonencode({
-    "filters" = "tag-key=foo",
-    "filters" = "tag-key=bar"
+    "filters" = ["tag-key=foo", "tag-key=bar"]
   })
 }
 
 resource "boundary_host_set_plugin" "launch" {
   name                  = "My launch host set plugin"
-  host_catalog_id       = boundary_host_catalog_plugin.aws_exmaple.id
+  host_catalog_id       = boundary_host_catalog_plugin.aws_example.id
   sync_interval_seconds = 60
   attributes_json = jsonencode({
-    "filters" = "tag:development=prod,dev",
-    "filters" = "launch-time=2022-01-04T*"
+    "filters" = ["tag:development=prod,dev", "launch-time=2022-01-04T*"]
   })
 }
 
@@ -93,7 +91,7 @@ resource "boundary_host_catalog_plugin" "azure_example" {
     "client_id"                   = "ARM_CLIENT_ID"
   })
 
-  # recommended to pass in aws secrets using a file() or using environment variables
+  # recommended to pass in azure secrets using a file() or using environment variables
   # the secrets below must be generated in azure by creating an ad application
   secrets_json = jsonencode({
     "secret_value" = "ARM_CLIENT_SECRET"
@@ -102,13 +100,13 @@ resource "boundary_host_catalog_plugin" "azure_example" {
 
 resource "boundary_host_set_plugin" "database" {
   name            = "My database host set plugin"
-  host_catalog_id = boundary_host_catalog_plugin.azure_exmaple.id
+  host_catalog_id = boundary_host_catalog_plugin.azure_example.id
   attributes_json = jsonencode({ "filter" = "tagName eq 'service-type' and tagValue eq 'database'" })
 }
 
 resource "boundary_host_set_plugin" "foodev" {
   name                  = "My foodev host set plugin"
-  host_catalog_id       = boundary_host_catalog_plugin.azure_exmaple.id
+  host_catalog_id       = boundary_host_catalog_plugin.azure_example.id
   preferred_endpoints   = ["cidr:54.0.0.0/8"]
   sync_interval_seconds = 60
   attributes_json = jsonencode({

docs/resources/managed_group_ldap.md

@@ -0,0 +1,32 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_managed_group_ldap Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The managed group resource allows you to configure a Boundary group.
+---
+
+# boundary_managed_group_ldap (Resource)
+
+The managed group resource allows you to configure a Boundary group.
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `auth_method_id` (String) The resource ID for the auth method.
+- `group_names` (List of String) The list of groups that make up the managed group.
+
+### Optional
+
+- `description` (String) The managed group description.
+- `name` (String) The managed group name. Defaults to the resource name.
+
+### Read-Only
+
+- `id` (String) The ID of the group.
+
+

docs/resources/storage_bucket.md

@@ -0,0 +1,75 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_storage_bucket Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The storage bucket resource allows you to configure a Boundary storage bucket. A storage bucket can only belong to the Global scope or an Org scope. At this time, the only supported storage for storage buckets is AWS S3. This feature requires Boundary Enterprise or Boundary HCP.
+---
+
+# boundary_storage_bucket (Resource)
+
+The storage bucket resource allows you to configure a Boundary storage bucket. A storage bucket can only belong to the Global scope or an Org scope. At this time, the only supported storage for storage buckets is AWS S3. This feature requires Boundary Enterprise or Boundary HCP.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = boundary_scope.global.id
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_storage_bucket" "aws_example" {
+  name            = "My aws storage bucket"
+  description     = "My first storage bucket!"
+  scope_id        = boundary_scope.org.id
+  plugin_name     = "aws"
+  bucket_name     = "mybucket"
+  attributes_json = jsonencode({ "region" = "us-east-1" })
+
+  # recommended to pass in aws secrets using a file() or using environment variables
+  # the secrets below must be generated in aws by creating a aws iam user with programmatic access
+  secrets_json = jsonencode({
+    "access_key_id"     = "aws_access_key_id_value",
+    "secret_access_key" = "aws_secret_access_key_value"
+  })
+  worker_filter = "\"pki\" in \"/tags/type\""
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `bucket_name` (String) The name of the bucket within the external object store service.
+- `scope_id` (String) The scope for this storage bucket.
+- `secrets_json` (String, Sensitive) The secrets for the storage bucket. Either values encoded with the "jsonencode" function, pre-escaped JSON string, or a file:// or env:// path. Set to a string "null" to clear any existing values. NOTE: Unlike "attributes_json", removing this block will NOT clear secrets from the storage bucket; this allows injecting secrets for one call, then removing them for storage.
+- `worker_filter` (String) Filters to the worker(s) that can handle requests for this storage bucket. The filter must match an existing worker in order to create a storage bucket.
+
+### Optional
+
+- `attributes_json` (String) The attributes for the storage bucket. The "region" attribute field is required when creating an AWS storage bucket. Values are either encoded with the "jsonencode" function, pre-escaped JSON string, or a file:// or env:// path. Set to a string "null" or remove the block to clear all attributes in the storage bucket.
+- `bucket_prefix` (String) The prefix used to organize the data held within the external object store.
+- `description` (String) The storage bucket description.
+- `name` (String) The storage bucket name. Defaults to the resource name.
+- `plugin_id` (String) The ID of the plugin that should back the resource. This or plugin_name must be defined.
+- `plugin_name` (String) The name of the plugin that should back the resource. This or plugin_id must be defined.
+
+### Read-Only
+
+- `id` (String) The ID of the storage bucket.
+- `internal_force_update` (String) Internal only. Used to force update so that we can always check the value of secrets.
+- `internal_hmac_used_for_secrets_config_hmac` (String) Internal only. The Boundary-provided HMAC used to calculate the current value of the HMAC'd config. Used for drift detection.
+- `internal_secrets_config_hmac` (String) Internal only. HMAC of (serverSecretsHmac + config secrets). Used for proper secrets handling.
+- `secrets_hmac` (String) The HMAC'd secrets value returned from the server.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_storage_bucket.foo <my-id>
+```

docs/resources/target.md

@@ -84,6 +84,20 @@ resource "boundary_host_set" "foo" {
   ]
 }
 
+resource "boundary_storage_bucket" "aws_example" {
+  name            = "My aws storage bucket"
+  description     = "My first storage bucket!"
+  scope_id        = boundary_scope.org.id
+  plugin_name     = "aws"
+  bucket_name     = "mybucket"
+  attributes_json = jsonencode({ "region" = "us-east-1" })
+  secrets_json = jsonencode({
+    "access_key_id"     = "aws_access_key_id_value",
+    "secret_access_key" = "aws_secret_access_key_value"
+  })
+  worker_filter = "\"pki\" in \"/tags/type\""
+}
+
 resource "boundary_target" "foo" {
   name         = "foo"
   description  = "Foo target"
@@ -111,6 +125,31 @@ resource "boundary_target" "ssh_foo" {
     boundary_credential_library_vault.foo.id
   ]
 }
+
+resource "boundary_target" "ssh_session_recording_foo" {
+  name         = "ssh_foo"
+  description  = "Ssh target"
+  type         = "ssh"
+  default_port = "22"
+  scope_id     = boundary_scope.project.id
+  host_source_ids = [
+    boundary_host_set.foo.id
+  ]
+  injected_application_credential_source_ids = [
+    boundary_credential_library_vault.foo.id
+  ]
+  enable_session_recording = true
+  storage_bucket_id        = boundary_storage_bucket.aws_example
+}
+
+resource "boundary_target" "address_foo" {
+  name         = "address_foo"
+  description  = "Foo target with an address"
+  type         = "tcp"
+  default_port = "22"
+  scope_id     = boundary_scope.project.id
+  address      = "127.0.0.1"
+}
 ```
 
 <!-- schema generated by tfplugindocs -->
@@ -123,15 +162,21 @@ resource "boundary_target" "ssh_foo" {
 
 ### Optional
 
+- `address` (String) Optionally, a valid network address to connect to for this target. Cannot be used alongside host_source_ids.
 - `brokered_credential_source_ids` (Set of String) A list of brokered credential source ID's.
+- `default_client_port` (Number) The default client port for this target.
 - `default_port` (Number) The default port for this target.
 - `description` (String) The target description.
-- `host_source_ids` (Set of String) A list of host source ID's.
+- `egress_worker_filter` (String) Boolean expression to filter the workers used to access this target
+- `enable_session_recording` (Boolean) HCP/Ent Only. Enable sessions recording for this target. Only applicable for SSH targets.
+- `host_source_ids` (Set of String) A list of host source ID's. Cannot be used alongside address.
+- `ingress_worker_filter` (String) HCP Only. Boolean expression to filter the workers a user will connect to when initiating a session against this target
 - `injected_application_credential_source_ids` (Set of String) A list of injected application credential source ID's.
 - `name` (String) The target name. Defaults to the resource name.
 - `session_connection_limit` (Number)
 - `session_max_seconds` (Number)
-- `worker_filter` (String) Boolean expression to filter the workers for this target
+- `storage_bucket_id` (String) HCP/Ent Only. Storage bucket for this target. Only applicable for SSH targets.
+- `worker_filter` (String, Deprecated) Boolean expression to filter the workers for this target
 
 ### Read-Only
 

docs/resources/worker.md

@@ -0,0 +1,54 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_worker Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The resource allows you to create a self-managed worker object.
+---
+
+# boundary_worker (Resource)
+
+The resource allows you to create a self-managed worker object.
+
+## Example Usage
+
+```terraform
+resource "boundary_worker" "controller_led" {
+  scope_id    = "global"
+  name        = "worker 1"
+  description = "self managed worker with controller led auth"
+}
+
+resource "boundary_self_managed_worker" "worker_led" {
+  scope_id                    = "global"
+  name                        = "worker 2"
+  description                 = "self managed worker with worker led auth"
+  worker_generated_auth_token = var.worker_generated_auth_token
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Optional
+
+- `description` (String) The description for the worker.
+- `name` (String) The name for the worker.
+- `scope_id` (String) The scope for the worker. Defaults to `global`.
+- `worker_generated_auth_token` (String) The worker authentication token required to register the worker for the worker-led authentication flow. Leaving this blank will result in a controller generated token.
+
+### Read-Only
+
+- `address` (String) The accessible address of the self managed worker.
+- `authorized_actions` (List of String) A list of actions that the worker is entitled to perform.
+- `controller_generated_activation_token` (String) A single use token generated by the controller to be passed to the self-managed worker.
+- `id` (String) The ID of the worker.
+- `release_version` (Number) The version of the Boundary binary running on the self managed worker.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_worker.foo <my-id>
+```

examples/provider/provider.tf

@@ -4,3 +4,16 @@ provider "boundary" {
   password_auth_method_login_name = "myuser"          # changeme
   password_auth_method_password   = "passpass"        # changeme
 }
+
+provider "boundary" {
+  addr                            = "http://127.0.0.1:9200"
+  password_auth_method_login_name = "myuser"
+  password_auth_method_password   = "passpass"
+}
+
+provider "boundary" {
+  addr                            = "http://127.0.0.1:9200"
+  password_auth_method_login_name = "myuser"
+  password_auth_method_password   = "passpass"
+  scope_id                        = "s_1234567890"
+}

examples/resources/boundary_account_password/resource.tf

@@ -13,7 +13,6 @@ resource "boundary_auth_method" "password" {
 
 resource "boundary_account_password" "jeff" {
   auth_method_id = boundary_auth_method.password.id
-  type           = "password"
   login_name     = "jeff"
   password       = "$uper$ecure"
 }

examples/resources/boundary_credential_library_vault/resource.tf

@@ -41,3 +41,30 @@ resource "boundary_credential_library_vault" "bar" {
 }
 EOT
 }
+
+resource "boundary_credential_library_vault" "baz" {
+  name                = "baz"
+  description         = "vault username password credential with mapping overrides"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "my/secret/baz" # change to Vault backend path
+  http_method         = "GET"
+  credential_type     = "username_password"
+  credential_mapping_overrides = {
+    password_attribute = "alternative_password_label"
+    username_attribute = "alternative_username_label"
+  }
+}
+
+resource "boundary_credential_library_vault" "quz" {
+  name                = "quz"
+  description         = "vault ssh private key credential with mapping overrides"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "my/secret/quz" # change to Vault backend path
+  http_method         = "GET"
+  credential_type     = "ssh_private_key"
+  credential_mapping_overrides = {
+    private_key_attribute            = "alternative_key_label"
+    private_key_passphrase_attribute = "alternative_passphrase_label"
+    username_attribute               = "alternative_username_label"
+  }
+}

examples/resources/boundary_credential_library_vault_ssh_certificate/import.sh

@@ -0,0 +1 @@
+terraform import boundary_credential_library_vault_ssh_certificate.foo <my-id>

examples/resources/boundary_credential_library_vault_ssh_certificate/resource.tf

@@ -0,0 +1,63 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_vault" "foo" {
+  name        = "foo"
+  description = "My first Vault credential store!"
+  address     = "http://127.0.0.1:8200"      # change to Vault address
+  token       = "s.0ufRo6XEGU2jOqnIr7OlFYP5" # change to valid Vault token
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_library_vault_ssh_certificate" "foo" {
+  name                = "foo"
+  description         = "My first Vault SSH certificate credential library!"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "ssh/sign/foo" # change to correct Vault endpoint and role
+  username            = "foo"          # change to valid username
+}
+
+resource "boundary_credential_library_vault_ssh_certificate" "bar" {
+  name                = "bar"
+  description         = "My second Vault SSH certificate credential library!"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "ssh/sign/foo" # change to correct Vault endpoint and role
+  username            = "foo"
+  key_type            = "ecdsa"
+  key_bits            = 384
+
+  extensions = {
+    permit-pty = ""
+  }
+}
+
+resource "boundary_credential_library_vault_ssh_certificate" "baz" {
+  name                = "baz"
+  description         = "vault "
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "ssh/issue/foo" # change to correct Vault endpoint and role
+  username            = "foo"
+  key_type            = "rsa"
+  key_bits            = 4096
+
+  extensions = {
+    permit-pty            = ""
+    permit-X11-forwarding = ""
+  }
+
+  critical_options = {
+    force-command = "/bin/some_script"
+  }
+}

examples/resources/boundary_host_catalog_plugin/resource.tf

@@ -52,7 +52,7 @@ resource "boundary_host_catalog_plugin" "azure_example" {
     "client_id"                   = "ARM_CLIENT_ID"
   })
 
-  # recommended to pass in aws secrets using a file() or using environment variables
+  # recommended to pass in azure secrets using a file() or using environment variables
   # the secrets below must be generated in azure by creating an ad application
   secrets_json = jsonencode({
     "secret_value" = "ARM_CLIENT_SECRET"

examples/resources/boundary_host_set_plugin/resource.tf

@@ -35,27 +35,25 @@ resource "boundary_host_catalog_plugin" "aws_example" {
 
 resource "boundary_host_set_plugin" "web" {
   name            = "My web host set plugin"
-  host_catalog_id = boundary_host_catalog_plugin.aws_exmaple.id
-  attributes_json = jsonencode({ "filters" = "tag:service-type=web" })
+  host_catalog_id = boundary_host_catalog_plugin.aws_example.id
+  attributes_json = jsonencode({ "filters" = ["tag:service-type=web"] })
 }
 
 resource "boundary_host_set_plugin" "foobar" {
   name                = "My foobar host set plugin"
-  host_catalog_id     = boundary_host_catalog_plugin.aws_exmaple.id
+  host_catalog_id     = boundary_host_catalog_plugin.aws_example.id
   preferred_endpoints = ["cidr:54.0.0.0/8"]
   attributes_json = jsonencode({
-    "filters" = "tag-key=foo",
-    "filters" = "tag-key=bar"
+    "filters" = ["tag-key=foo", "tag-key=bar"]
   })
 }
 
 resource "boundary_host_set_plugin" "launch" {
   name                  = "My launch host set plugin"
-  host_catalog_id       = boundary_host_catalog_plugin.aws_exmaple.id
+  host_catalog_id       = boundary_host_catalog_plugin.aws_example.id
   sync_interval_seconds = 60
   attributes_json = jsonencode({
-    "filters" = "tag:development=prod,dev",
-    "filters" = "launch-time=2022-01-04T*"
+    "filters" = ["tag:development=prod,dev", "launch-time=2022-01-04T*"]
   })
 }
 
@@ -78,7 +76,7 @@ resource "boundary_host_catalog_plugin" "azure_example" {
     "client_id"                   = "ARM_CLIENT_ID"
   })
 
-  # recommended to pass in aws secrets using a file() or using environment variables
+  # recommended to pass in azure secrets using a file() or using environment variables
   # the secrets below must be generated in azure by creating an ad application
   secrets_json = jsonencode({
     "secret_value" = "ARM_CLIENT_SECRET"
@@ -87,17 +85,17 @@ resource "boundary_host_catalog_plugin" "azure_example" {
 
 resource "boundary_host_set_plugin" "database" {
   name            = "My database host set plugin"
-  host_catalog_id = boundary_host_catalog_plugin.azure_exmaple.id
+  host_catalog_id = boundary_host_catalog_plugin.azure_example.id
   attributes_json = jsonencode({ "filter" = "tagName eq 'service-type' and tagValue eq 'database'" })
 }
 
 resource "boundary_host_set_plugin" "foodev" {
   name                  = "My foodev host set plugin"
-  host_catalog_id       = boundary_host_catalog_plugin.azure_exmaple.id
+  host_catalog_id       = boundary_host_catalog_plugin.azure_example.id
   preferred_endpoints   = ["cidr:54.0.0.0/8"]
   sync_interval_seconds = 60
   attributes_json = jsonencode({
     "filter" = "tagName eq 'tag-key' and tagValue eq 'foo'",
     "filter" = "tagName eq 'application' and tagValue eq 'dev'",
   })
-}
+}

examples/resources/boundary_storage_bucket/import.sh

@@ -0,0 +1 @@
+terraform import boundary_storage_bucket.foo <my-id>

examples/resources/boundary_storage_bucket/resource.tf

@@ -0,0 +1,24 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = boundary_scope.global.id
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_storage_bucket" "aws_example" {
+  name            = "My aws storage bucket"
+  description     = "My first storage bucket!"
+  scope_id        = boundary_scope.org.id
+  plugin_name     = "aws"
+  bucket_name     = "mybucket"
+  attributes_json = jsonencode({ "region" = "us-east-1" })
+
+  # recommended to pass in aws secrets using a file() or using environment variables
+  # the secrets below must be generated in aws by creating a aws iam user with programmatic access
+  secrets_json = jsonencode({
+    "access_key_id"     = "aws_access_key_id_value",
+    "secret_access_key" = "aws_secret_access_key_value"
+  })
+  worker_filter = "\"pki\" in \"/tags/type\""
+}

examples/resources/boundary_target/resource.tf

@@ -69,6 +69,20 @@ resource "boundary_host_set" "foo" {
   ]
 }
 
+resource "boundary_storage_bucket" "aws_example" {
+  name            = "My aws storage bucket"
+  description     = "My first storage bucket!"
+  scope_id        = boundary_scope.org.id
+  plugin_name     = "aws"
+  bucket_name     = "mybucket"
+  attributes_json = jsonencode({ "region" = "us-east-1" })
+  secrets_json = jsonencode({
+    "access_key_id"     = "aws_access_key_id_value",
+    "secret_access_key" = "aws_secret_access_key_value"
+  })
+  worker_filter = "\"pki\" in \"/tags/type\""
+}
+
 resource "boundary_target" "foo" {
   name         = "foo"
   description  = "Foo target"
@@ -96,3 +110,28 @@ resource "boundary_target" "ssh_foo" {
     boundary_credential_library_vault.foo.id
   ]
 }
+
+resource "boundary_target" "ssh_session_recording_foo" {
+  name         = "ssh_foo"
+  description  = "Ssh target"
+  type         = "ssh"
+  default_port = "22"
+  scope_id     = boundary_scope.project.id
+  host_source_ids = [
+    boundary_host_set.foo.id
+  ]
+  injected_application_credential_source_ids = [
+    boundary_credential_library_vault.foo.id
+  ]
+  enable_session_recording = true
+  storage_bucket_id        = boundary_storage_bucket.aws_example
+}
+
+resource "boundary_target" "address_foo" {
+  name         = "address_foo"
+  description  = "Foo target with an address"
+  type         = "tcp"
+  default_port = "22"
+  scope_id     = boundary_scope.project.id
+  address      = "127.0.0.1"
+}

examples/resources/boundary_worker/import.sh

@@ -0,0 +1 @@
+terraform import boundary_worker.foo <my-id>

examples/resources/boundary_worker/main.tf

@@ -0,0 +1,13 @@
+resource "boundary_worker" "controller_led" {
+  scope_id                    = "global"
+  name                        = "worker 1"
+  description                 = "self managed worker with controlled led auth"
+  worker_generated_auth_token = var.worker_generated_auth_token
+}
+
+resource "boundary_self_managed_worker" "worker_led" {
+  scope_id                    = "global"
+  name                        = "worker 2"
+  description                 = "self managed worker with controlled led auth"
+  worker_generated_auth_token = var.worker_generated_auth_token
+}

examples/resources/boundary_worker/resource.tf

@@ -0,0 +1,12 @@
+resource "boundary_worker" "controller_led" {
+  scope_id    = "global"
+  name        = "worker 1"
+  description = "self managed worker with controller led auth"
+}
+
+resource "boundary_self_managed_worker" "worker_led" {
+  scope_id                    = "global"
+  name                        = "worker 2"
+  description                 = "self managed worker with worker led auth"
+  worker_generated_auth_token = var.worker_generated_auth_token
+}

go.mod

@@ -1,117 +1,121 @@
 module github.com/hashicorp/terraform-provider-boundary
 
-go 1.19
+go 1.20
 
 require (
-	github.com/hashicorp/boundary v0.11.0
-	github.com/hashicorp/boundary/api v0.0.30
-	github.com/hashicorp/boundary/sdk v0.0.24
-	github.com/hashicorp/cap v0.2.0
+	github.com/hashicorp/boundary v0.13.0
+	github.com/hashicorp/boundary/api v0.0.39
+	github.com/hashicorp/boundary/sdk v0.0.35
+	github.com/hashicorp/cap v0.3.1
+	github.com/hashicorp/cap/ldap v0.0.0-20230420150311-6d1e00a6c5e0
 	github.com/hashicorp/go-cty v1.4.1-0.20200723130312-85980079f637
-	github.com/hashicorp/go-kms-wrapping/v2 v2.0.6-0.20220722192355-a843f53fa48d
-	github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.5
+	github.com/hashicorp/go-kms-wrapping/v2 v2.0.10-0.20230601143830-08d524b564ba
+	github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.10
 	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7
-	github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.3
-	github.com/hashicorp/terraform-plugin-docs v0.13.0
-	github.com/hashicorp/terraform-plugin-sdk/v2 v2.23.0
-	github.com/kr/pretty v0.3.0
+	github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.4
+	github.com/hashicorp/terraform-plugin-docs v0.14.1
+	github.com/hashicorp/terraform-plugin-sdk/v2 v2.26.1
+	github.com/jimlambrt/gldap v0.1.6
+	github.com/kr/pretty v0.3.1
 	github.com/mitchellh/go-homedir v1.1.0
-	github.com/stretchr/testify v1.8.0
-	golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa
+	github.com/stretchr/testify v1.8.4
+	golang.org/x/crypto v0.9.0
 )
 
 require (
 	github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 // indirect
-	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
+	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
 	github.com/DATA-DOG/go-sqlmock v1.5.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
-	github.com/Masterminds/semver/v3 v3.1.1 // indirect
-	github.com/Masterminds/sprig/v3 v3.2.2 // indirect
-	github.com/Microsoft/go-winio v0.5.0 // indirect
+	github.com/Masterminds/semver/v3 v3.2.0 // indirect
+	github.com/Masterminds/sprig/v3 v3.2.3 // indirect
+	github.com/Microsoft/go-winio v0.6.0 // indirect
 	github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 // indirect
 	github.com/agext/levenshtein v1.2.2 // indirect
 	github.com/alessio/shellescape v1.4.1 // indirect
 	github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
-	github.com/armon/go-metrics v0.3.9 // indirect
 	github.com/armon/go-radix v1.0.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bgentry/speakeasy v0.1.0 // indirect
+	github.com/cenkalti/backoff v2.2.1+incompatible // indirect
 	github.com/cenkalti/backoff/v3 v3.0.0 // indirect
-	github.com/cenkalti/backoff/v4 v4.1.0 // indirect
-	github.com/cespare/xxhash/v2 v2.1.2 // indirect
-	github.com/containerd/continuity v0.1.0 // indirect
-	github.com/coreos/go-oidc/v3 v3.1.0 // indirect
-	github.com/danieljoos/wincred v1.1.2 // indirect
+	github.com/cenkalti/backoff/v4 v4.2.0 // indirect
+	github.com/cespare/xxhash/v2 v2.2.0 // indirect
+	github.com/containerd/continuity v0.3.0 // indirect
+	github.com/coreos/go-oidc/v3 v3.5.0 // indirect
+	github.com/danieljoos/wincred v1.2.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/docker/cli v20.10.7+incompatible // indirect
-	github.com/docker/docker v20.10.9+incompatible // indirect
+	github.com/docker/cli v23.0.1+incompatible // indirect
+	github.com/docker/docker v23.0.3+incompatible // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
-	github.com/docker/go-units v0.4.0 // indirect
+	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dvsekhvalnov/jose2go v1.5.0 // indirect
-	github.com/fatih/color v1.13.0 // indirect
+	github.com/fatih/color v1.15.0 // indirect
 	github.com/fatih/structs v1.1.0 // indirect
-	github.com/godbus/dbus/v5 v5.0.6 // indirect
+	github.com/go-asn1-ber/asn1-ber v1.5.4 // indirect
+	github.com/go-jose/go-jose/v3 v3.0.0 // indirect
+	github.com/go-ldap/ldap/v3 v3.4.4 // indirect
+	github.com/godbus/dbus/v5 v5.1.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang-migrate/migrate/v4 v4.15.1 // indirect
-	github.com/golang/protobuf v1.5.2 // indirect
-	github.com/golang/snappy v0.0.4 // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/google/go-cmp v0.5.9 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/google/uuid v1.3.0 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.2 // indirect
-	github.com/hashicorp/dbassert v0.0.0-20210708202608-ecf920cf1ed8 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 // indirect
+	github.com/hashicorp/dbassert v0.0.0-20230405175854-2d88acd5134b // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
-	github.com/hashicorp/eventlogger v0.1.1-0.20211106154408-4ff8da3a890c // indirect
-	github.com/hashicorp/eventlogger/filters/encrypt v0.1.7 // indirect
-	github.com/hashicorp/go-bexpr v0.1.10 // indirect
+	github.com/hashicorp/eventlogger v0.1.2-0.20230428153751-cca445805f24 // indirect
+	github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20230428153751-cca445805f24 // indirect
+	github.com/hashicorp/go-bexpr v0.1.12 // indirect
 	github.com/hashicorp/go-checkpoint v0.5.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-dbw v0.0.0-20220725170111-b7cb3aa3d628 // indirect
-	github.com/hashicorp/go-hclog v1.2.2 // indirect
-	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
-	github.com/hashicorp/go-kms-wrapping/extras/kms/v2 v2.0.0-20220711120347-32232bae6803 // indirect
-	github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.2 // indirect
+	github.com/hashicorp/go-dbw v0.0.0-20230605211904-d40e5c9d5995 // indirect
+	github.com/hashicorp/go-hclog v1.5.0 // indirect
+	github.com/hashicorp/go-kms-wrapping/extras/kms/v2 v2.0.0-20221122211539-47c893099f13 // indirect
+	github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.4 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/hashicorp/go-plugin v1.4.4 // indirect
-	github.com/hashicorp/go-retryablehttp v0.7.0 // indirect
+	github.com/hashicorp/go-plugin v1.4.9 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.2 // indirect
 	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
 	github.com/hashicorp/go-secure-stdlib/base62 v0.1.2 // indirect
 	github.com/hashicorp/go-secure-stdlib/gatedwriter v0.1.1 // indirect
-	github.com/hashicorp/go-secure-stdlib/kv-builder v0.1.1 // indirect
-	github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.4 // indirect
-	github.com/hashicorp/go-secure-stdlib/mlock v0.1.1 // indirect
+	github.com/hashicorp/go-secure-stdlib/kv-builder v0.1.2 // indirect
+	github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.7 // indirect
+	github.com/hashicorp/go-secure-stdlib/mlock v0.1.3 // indirect
 	github.com/hashicorp/go-secure-stdlib/reloadutil v0.1.1 // indirect
 	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
-	github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.1 // indirect
+	github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.2 // indirect
 	github.com/hashicorp/go-sockaddr v1.0.2 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
 	github.com/hashicorp/go-version v1.6.0 // indirect
-	github.com/hashicorp/golang-lru v0.5.4 // indirect
-	github.com/hashicorp/hc-install v0.4.0 // indirect
+	github.com/hashicorp/hc-install v0.5.0 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
-	github.com/hashicorp/hcl/v2 v2.14.0 // indirect
+	github.com/hashicorp/hcl/v2 v2.16.2 // indirect
 	github.com/hashicorp/logutils v1.0.0 // indirect
-	github.com/hashicorp/nodeenrollment v0.1.17 // indirect
-	github.com/hashicorp/terraform-exec v0.17.3 // indirect
-	github.com/hashicorp/terraform-json v0.14.0 // indirect
-	github.com/hashicorp/terraform-plugin-go v0.14.0 // indirect
-	github.com/hashicorp/terraform-plugin-log v0.7.0 // indirect
-	github.com/hashicorp/terraform-registry-address v0.0.0-20220623143253-7d51757b572c // indirect
+	github.com/hashicorp/nodeenrollment v0.2.4 // indirect
+	github.com/hashicorp/terraform-exec v0.18.1 // indirect
+	github.com/hashicorp/terraform-json v0.16.0 // indirect
+	github.com/hashicorp/terraform-plugin-go v0.14.3 // indirect
+	github.com/hashicorp/terraform-plugin-log v0.8.0 // indirect
+	github.com/hashicorp/terraform-registry-address v0.1.0 // indirect
 	github.com/hashicorp/terraform-svchost v0.0.0-20200729002733-f050f53b9734 // indirect
-	github.com/hashicorp/vault/api v1.3.1 // indirect
+	github.com/hashicorp/vault/api v1.9.1 // indirect
 	github.com/hashicorp/vault/sdk v0.3.0 // indirect
-	github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d // indirect
-	github.com/huandu/xstrings v1.3.2 // indirect
+	github.com/hashicorp/yamux v0.1.1 // indirect
+	github.com/huandu/xstrings v1.4.0 // indirect
 	github.com/imdario/mergo v0.3.13 // indirect
 	github.com/jackc/chunkreader/v2 v2.0.1 // indirect
-	github.com/jackc/pgconn v1.12.1 // indirect
+	github.com/jackc/pgconn v1.14.0 // indirect
 	github.com/jackc/pgio v1.0.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
-	github.com/jackc/pgproto3/v2 v2.3.0 // indirect
-	github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b // indirect
-	github.com/jackc/pgtype v1.11.0 // indirect
-	github.com/jackc/pgx/v4 v4.16.1 // indirect
+	github.com/jackc/pgproto3/v2 v2.3.2 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
+	github.com/jackc/pgtype v1.14.0 // indirect
+	github.com/jackc/pgx/v4 v4.18.1 // indirect
+	github.com/jackc/pgx/v5 v5.3.1 // indirect
 	github.com/jefferai/go-libsecret v0.0.0-20210525195240-b53481abef97 // indirect
 	github.com/jefferai/isbadcipher v0.0.0-20190226160619-51d2077c035f // indirect
 	github.com/jefferai/keyring v1.1.7-0.20220316160357-58a74bb55891 // indirect
@@ -119,28 +123,28 @@ require (
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
 	github.com/kr/text v0.2.0 // indirect
-	github.com/lib/pq v1.10.2 // indirect
-	github.com/mattn/go-colorable v0.1.12 // indirect
-	github.com/mattn/go-isatty v0.0.14 // indirect
+	github.com/lib/pq v1.10.7 // indirect
+	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-isatty v0.0.19 // indirect
 	github.com/mattn/go-sqlite3 v2.0.3+incompatible // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
-	github.com/mitchellh/cli v1.1.4 // indirect
+	github.com/mikesmitty/edkey v0.0.0-20170222072505-3356ea4e686a // indirect
+	github.com/mitchellh/cli v1.1.5 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/go-testing-interface v1.14.1 // indirect
 	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
-	github.com/mitchellh/pointerstructure v1.2.0 // indirect
+	github.com/mitchellh/pointerstructure v1.2.1 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
-	github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6 // indirect
+	github.com/moby/term v0.0.0-20221205130635-1aeaba878587 // indirect
 	github.com/mr-tron/base58 v1.2.0 // indirect
 	github.com/mtibben/percent v0.2.1 // indirect
-	github.com/oklog/run v1.0.0 // indirect
+	github.com/oklog/run v1.1.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.0.1 // indirect
-	github.com/opencontainers/runc v1.0.2 // indirect
-	github.com/ory/dockertest/v3 v3.7.0 // indirect
-	github.com/pierrec/lz4 v2.5.2+incompatible // indirect
-	github.com/pires/go-proxyproto v0.6.1 // indirect
+	github.com/opencontainers/image-spec v1.0.2 // indirect
+	github.com/opencontainers/runc v1.1.5 // indirect
+	github.com/ory/dockertest/v3 v3.9.1 // indirect
+	github.com/pires/go-proxyproto v0.7.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/posener/complete v1.2.3 // indirect
@@ -148,37 +152,42 @@ require (
 	github.com/prometheus/client_model v0.2.0 // indirect
 	github.com/prometheus/common v0.32.1 // indirect
 	github.com/prometheus/procfs v0.7.3 // indirect
-	github.com/rogpeppe/go-internal v1.8.1 // indirect
+	github.com/rogpeppe/go-internal v1.9.0 // indirect
 	github.com/russross/blackfriday v1.6.0 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
 	github.com/sethvargo/go-diceware v0.3.0 // indirect
 	github.com/shopspring/decimal v1.3.1 // indirect
-	github.com/sirupsen/logrus v1.8.1 // indirect
+	github.com/sirupsen/logrus v1.9.0 // indirect
 	github.com/spf13/cast v1.5.0 // indirect
 	github.com/vmihailenco/msgpack v4.0.4+incompatible // indirect
 	github.com/vmihailenco/msgpack/v4 v4.3.12 // indirect
 	github.com/vmihailenco/tagparser v0.1.1 // indirect
-	github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f // indirect
+	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
-	github.com/xo/dburl v0.11.0 // indirect
-	github.com/zalando/go-keyring v0.2.1 // indirect
-	github.com/zclconf/go-cty v1.11.0 // indirect
+	github.com/xo/dburl v0.14.2 // indirect
+	github.com/zalando/go-keyring v0.2.3 // indirect
+	github.com/zclconf/go-cty v1.13.1 // indirect
 	go.uber.org/atomic v1.9.0 // indirect
-	golang.org/x/net v0.0.0-20220624214902-1bab6f366d9e // indirect
-	golang.org/x/oauth2 v0.0.0-20220722155238-128564f6959c // indirect
-	golang.org/x/sys v0.0.0-20220627191245-f75cf1eec38b // indirect
-	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 // indirect
-	golang.org/x/text v0.3.7 // indirect
-	golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e // indirect
+	golang.org/x/exp v0.0.0-20230425010034-47ecfdc1ba53 // indirect
+	golang.org/x/mod v0.8.0 // indirect
+	golang.org/x/net v0.10.0 // indirect
+	golang.org/x/oauth2 v0.8.0 // indirect
+	golang.org/x/sys v0.8.0 // indirect
+	golang.org/x/term v0.8.0 // indirect
+	golang.org/x/text v0.9.0 // indirect
+	golang.org/x/time v0.3.0 // indirect
+	golang.org/x/tools v0.6.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20220805133916-01dd62135a58 // indirect
-	google.golang.org/grpc v1.48.0 // indirect
-	google.golang.org/protobuf v1.28.1 // indirect
+	google.golang.org/genproto v0.0.0-20230526203410-71b5a4ffd15e // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20230530153820-e85fd2cbaebc // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc // indirect
+	google.golang.org/grpc v1.55.0 // indirect
+	google.golang.org/protobuf v1.30.0 // indirect
 	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	gorm.io/driver/postgres v1.3.8 // indirect
-	gorm.io/driver/sqlite v1.3.6 // indirect
-	gorm.io/gorm v1.23.8 // indirect
+	gorm.io/driver/postgres v1.5.2 // indirect
+	gorm.io/driver/sqlite v1.5.1 // indirect
+	gorm.io/gorm v1.25.1 // indirect
 )

internal/provider/const.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 const (
@@ -41,4 +44,6 @@ const (
 	// internalForceUpdateKey is used to force updates so we can always check
 	// the value of secrets
 	internalForceUpdateKey = "internal_force_update"
+	// workerFilter is used for common "worker_filter" resource attribute
+	WorkerFilterKey = "worker_filter"
 )

internal/provider/pathorcontents.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // Helpers for dealing with file paths and their contents
 //
 // Originally from Terraform; see

internal/provider/provider.go

@@ -1,9 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
 	"context"
 	"errors"
 	"fmt"
+	"net/http"
 	"strings"
 
 	"github.com/hashicorp/boundary/api"
@@ -17,6 +21,12 @@ import (
 	kms_plugin_assets "github.com/hashicorp/terraform-provider-boundary/plugins/kms"
 )
 
+const (
+	PASSWORD_AUTH_METHOD_PREFIX = "ampw"
+	LDAP_AUTH_METHOD_PREFIX     = "amldap"
+	DEFAULT_PROVIDER_SCOPE      = "global"
+)
+
 func init() {
 	// descriptions are written in markdown for docs
 	schema.DescriptionKind = schema.StringMarkdown
@@ -43,17 +53,29 @@ func New() *schema.Provider {
 			"auth_method_id": {
 				Type:        schema.TypeString,
 				Optional:    true,
-				Description: "The auth method ID e.g. ampw_1234567890",
+				Description: "The auth method ID e.g. ampw_1234567890. If not set, the default auth method for the given scope ID will be used.",
 			},
 			"password_auth_method_login_name": {
 				Type:        schema.TypeString,
 				Optional:    true,
 				Description: "The auth method login name for password-style auth methods",
+				Deprecated:  "Use auth_method_login_name instead",
 			},
 			"password_auth_method_password": {
 				Type:        schema.TypeString,
 				Optional:    true,
 				Description: "The auth method password for password-style auth methods",
+				Deprecated:  "Use auth_method_password instead",
+			},
+			"auth_method_login_name": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Description: "The auth method login name for password-style or ldap-style auth methods",
+			},
+			"auth_method_password": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Description: "The auth method password for password-style or ldap-style auth methods",
 			},
 			"tls_insecure": {
 				Type:        schema.TypeBool,
@@ -65,34 +87,45 @@ func New() *schema.Provider {
 				Optional:    true,
 				Description: `Specifies a directory that the Boundary provider can use to write and execute its built-in plugins.`,
 			},
+			"scope_id": {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Description: `The scope ID for the default auth method.`,
+			},
 		},
 		ResourcesMap: map[string]*schema.Resource{
-			"boundary_account":                      resourceAccount(),
-			"boundary_account_password":             resourceAccountPassword(),
-			"boundary_account_oidc":                 resourceAccountOidc(),
-			"boundary_auth_method":                  resourceAuthMethod(),
-			"boundary_auth_method_password":         resourceAuthMethodPassword(),
-			"boundary_auth_method_oidc":             resourceAuthMethodOidc(),
-			"boundary_credential_library_vault":     resourceCredentialLibraryVault(),
-			"boundary_credential_store_vault":       resourceCredentialStoreVault(),
-			"boundary_credential_store_static":      resourceCredentialStoreStatic(),
-			"boundary_credential_username_password": resourceCredentialUsernamePassword(),
-			"boundary_credential_ssh_private_key":   resourceCredentialSshPrivateKey(),
-			"boundary_credential_json":              resourceCredentialJson(),
-			"boundary_managed_group":                resourceManagedGroup(),
-			"boundary_group":                        resourceGroup(),
-			"boundary_host":                         resourceHost(),
-			"boundary_host_static":                  resourceHostStatic(),
-			"boundary_host_catalog":                 resourceHostCatalog(),
-			"boundary_host_catalog_static":          resourceHostCatalogStatic(),
-			"boundary_host_catalog_plugin":          resourceHostCatalogPlugin(),
-			"boundary_host_set":                     resourceHostSet(),
-			"boundary_host_set_static":              resourceHostSetStatic(),
-			"boundary_host_set_plugin":              resourceHostSetPlugin(),
-			"boundary_role":                         resourceRole(),
-			"boundary_scope":                        resourceScope(),
-			"boundary_target":                       resourceTarget(),
-			"boundary_user":                         resourceUser(),
+			"boundary_account":                                  resourceAccount(),
+			"boundary_account_password":                         resourceAccountPassword(),
+			"boundary_account_oidc":                             resourceAccountOidc(),
+			"boundary_account_ldap":                             resourceAccountLdap(),
+			"boundary_auth_method":                              resourceAuthMethod(),
+			"boundary_auth_method_password":                     resourceAuthMethodPassword(),
+			"boundary_auth_method_oidc":                         resourceAuthMethodOidc(),
+			"boundary_auth_method_ldap":                         resourceAuthMethodLdap(),
+			"boundary_credential_library_vault":                 resourceCredentialLibraryVault(),
+			"boundary_credential_library_vault_ssh_certificate": resourceCredentialLibraryVaultSshCertificate(),
+			"boundary_credential_store_vault":                   resourceCredentialStoreVault(),
+			"boundary_credential_store_static":                  resourceCredentialStoreStatic(),
+			"boundary_credential_username_password":             resourceCredentialUsernamePassword(),
+			"boundary_credential_ssh_private_key":               resourceCredentialSshPrivateKey(),
+			"boundary_credential_json":                          resourceCredentialJson(),
+			"boundary_managed_group":                            resourceManagedGroup(),
+			"boundary_managed_group_ldap":                       resourceManagedGroupLdap(),
+			"boundary_group":                                    resourceGroup(),
+			"boundary_host":                                     resourceHost(),
+			"boundary_host_static":                              resourceHostStatic(),
+			"boundary_host_catalog":                             resourceHostCatalog(),
+			"boundary_host_catalog_static":                      resourceHostCatalogStatic(),
+			"boundary_host_catalog_plugin":                      resourceHostCatalogPlugin(),
+			"boundary_host_set":                                 resourceHostSet(),
+			"boundary_host_set_static":                          resourceHostSetStatic(),
+			"boundary_host_set_plugin":                          resourceHostSetPlugin(),
+			"boundary_role":                                     resourceRole(),
+			"boundary_scope":                                    resourceScope(),
+			"boundary_storage_bucket":                           resourceStorageBucket(),
+			"boundary_target":                                   resourceTarget(),
+			"boundary_user":                                     resourceUser(),
+			"boundary_worker":                                   resourceWorker(),
 		},
 	}
 
@@ -108,13 +141,34 @@ type metaData struct {
 
 func providerAuthenticate(ctx context.Context, d *schema.ResourceData, md *metaData) error {
 	var credentials map[string]interface{}
+	amClient := authmethods.NewClient(md.client)
+
+	var providerScope string
+	scopeId, scopeIdOk := d.GetOk("scope_id")
+	switch {
+	case scopeIdOk:
+		providerScope = scopeId.(string)
+	default:
+		providerScope = DEFAULT_PROVIDER_SCOPE
+	}
 
-	authMethodId, authMethodIdOk := d.GetOk("auth_method_id")
 	recoveryKmsHcl, recoveryKmsHclOk := d.GetOk("recovery_kms_hcl")
 	if token, ok := d.GetOk("token"); ok {
 		md.client.SetToken(token.(string))
 	}
 
+	// If auth_method_id is not set, get the default auth method ID for the given scope ID.
+	// Skip fetching default auth method when recovery_kms_hcl is set or the client token isn't null.
+	authMethodId, authMethodIdOk := d.GetOk("auth_method_id")
+	if !authMethodIdOk && !recoveryKmsHclOk && md.client.Token() == "" {
+		defaultAuthMethodId, err := getDefaultAuthMethodId(ctx, amClient, providerScope, "")
+		if err != nil {
+			return err
+		}
+		authMethodIdOk = true
+		authMethodId = defaultAuthMethodId
+	}
+
 	switch {
 	case recoveryKmsHclOk:
 		recoveryHclStr, _, err := ReadPathOrContents(recoveryKmsHcl.(string))
@@ -131,7 +185,8 @@ func providerAuthenticate(ctx context.Context, d *schema.ResourceData, md *metaD
 			opts = append(opts, pluginutil.WithPluginExecutionDirectory(execDir.(string)))
 		}
 
-		wrapper, cleanUp, err := wrapper.GetWrapperFromHcl(
+		// TODO: cleanup plugin when finished
+		wrapper, _, err := wrapper.GetWrapperFromHcl(
 			ctx,
 			recoveryHclStr,
 			"recovery",
@@ -142,15 +197,6 @@ func providerAuthenticate(ctx context.Context, d *schema.ResourceData, md *metaD
 		if wrapper == nil {
 			return errors.New(`No "kms" block with purpose "recovery" found in "recovery_kms_hcl"`)
 		}
-		if cleanUp != nil {
-			// Terraform will cancel the context when work is complete.
-			go func() {
-				select {
-				case <-ctx.Done():
-					_ = cleanUp()
-				}
-			}()
-		}
 
 		md.recoveryKmsWrapper = wrapper
 		md.client.SetRecoveryKmsWrapper(wrapper)
@@ -161,29 +207,44 @@ func providerAuthenticate(ctx context.Context, d *schema.ResourceData, md *metaD
 
 	case authMethodIdOk:
 		switch {
-		case strings.HasPrefix(authMethodId.(string), "ampw"):
-			// Password-style
-			authMethodLoginName, ok := d.GetOk("password_auth_method_login_name")
+		case strings.HasPrefix(authMethodId.(string), PASSWORD_AUTH_METHOD_PREFIX) || strings.HasPrefix(authMethodId.(string), LDAP_AUTH_METHOD_PREFIX):
+			// Password-style & LDAP-style
+			authMethodLoginName, ok := d.GetOk("auth_method_login_name")
 			if !ok {
-				return errors.New("password-style auth method login name not set, please set password_auth_method_login_name on the provider")
+				authMethodLoginName, ok = d.GetOk("password_auth_method_login_name")
+				if !ok {
+					return errors.New("auth method login name not set, please set auth_method_login_name on the provider")
+				}
 			}
-			authMethodPassword, ok := d.GetOk("password_auth_method_password")
+			authMethodPassword, ok := d.GetOk("auth_method_password")
 			if !ok {
-				return errors.New("password-style auth method password not set, please set password_auth_method_password on the provider")
+				authMethodPassword, ok = d.GetOk("password_auth_method_password")
+				if !ok {
+					return errors.New("auth method password not set, please set auth_method_password on the provider")
+				}
 			}
 			credentials = map[string]interface{}{
 				"login_name": authMethodLoginName,
 				"password":   authMethodPassword,
 			}
-
+		case strings.HasPrefix(authMethodId.(string), "amoidc"):
+			// OIDC-style
+			return errors.New("OIDC auth method is currently not supported by Boundary Terraform Provider. only password auth method is supported at this time")
 		default:
 			return errors.New("no suitable typed auth method information found")
 		}
 
-		am := authmethods.NewClient(md.client)
-
-		at, err := am.Authenticate(ctx, authMethodId.(string), "login", credentials)
+		at, err := amClient.Authenticate(ctx, authMethodId.(string), "login", credentials)
 		if err != nil {
+			if apiErr := api.AsServerError(err); apiErr != nil {
+				statusCode := apiErr.Response().StatusCode()
+				if statusCode == http.StatusNotFound {
+					return fmt.Errorf("unknown auth_method_id: %s", err.Error())
+				}
+				if statusCode == http.StatusUnauthorized {
+					return fmt.Errorf("invalid login name or password: %s", err.Error())
+				}
+			}
 			return err
 		}
 		md.client.SetToken(at.Attributes["token"].(string))
@@ -230,3 +291,40 @@ func providerConfigure(p *schema.Provider) schema.ConfigureContextFunc {
 		return md, nil
 	}
 }
+
+// getDefaultAuthMethodId iterates over boundary client.List() to find the default auth method ID for the given scopeId.
+// If there is only one auth method, it'll return it even if it's not the primary auth method
+// If scope ID is empty or no primary auth method is found, it returns an error.
+func getDefaultAuthMethodId(ctx context.Context, client *authmethods.Client, scopeId, amType string) (string, error) {
+	if scopeId == "" {
+		return "", fmt.Errorf("must pass a non empty scope ID string to get default auth method ID")
+	}
+	authMethodListResult, err := client.List(ctx, scopeId)
+	if err != nil {
+		return "", err
+	}
+
+	authMethodItems := authMethodListResult.GetItems()
+
+	// If there is only one auth method that matches the auth method prefix, return it even if it's not the primary auth method
+	if len(authMethodItems) == 1 {
+		authMethod := authMethodItems[0]
+		if !strings.HasPrefix(authMethod.Id, amType) {
+			return "", fmt.Errorf("error looking up default auth method for scope ID: '%s'. got '%s' but the provider requires an auth method prefix of '%s'", scopeId, authMethod.Id, amType)
+		}
+
+		return authMethod.Id, nil
+	}
+
+	// find the primary auth method that matches auth method prefix
+	for _, m := range authMethodItems {
+		if m.IsPrimary {
+			if !strings.HasPrefix(m.Id, amType) {
+				return "", fmt.Errorf("error looking up primary auth method for scope ID: '%s'. got '%s' but the provider requires an auth method prefix of '%s'", scopeId, m.Id, amType)
+			}
+
+			return m.Id, nil
+		}
+	}
+	return "", fmt.Errorf("default auth method not found for scope ID: '%s'. Please set a primary auth method on this scope or pass one explicitly using the `auth_method_id` field", scopeId)
+}

internal/provider/provider_test.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
@@ -5,14 +8,20 @@ import (
 	"crypto/rand"
 	"encoding/base64"
 	"fmt"
+	"regexp"
 	"strings"
 	"testing"
 
 	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/cap/ldap"
+	"github.com/hashicorp/cap/oidc"
 	wrapping "github.com/hashicorp/go-kms-wrapping/v2"
 	"github.com/hashicorp/go-kms-wrapping/v2/aead"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/jimlambrt/gldap"
+	"github.com/jimlambrt/gldap/testdirectory"
 )
 
 var (
@@ -95,13 +104,46 @@ provider "boundary" {
 	return strings.Join(c, "\n")
 }
 
+func testConfigWithDefaultAuthMethod(url string, res ...string) string {
+	provider := fmt.Sprintf(`
+provider "boundary" {
+	addr  = "%s"
+	password_auth_method_login_name = "%s"
+	password_auth_method_password = "%s"
+}`, url, tcLoginName, tcPassword)
+
+	c := []string{provider}
+	c = append(c, res...)
+	return strings.Join(c, "\n")
+}
+
+func testConfigWithOIDCAuthMethod(url string, res ...string) string {
+	provider := fmt.Sprintf(`
+provider "boundary" {
+	addr  = "%s"
+	auth_method_id = "amoidc_0000000000"
+}`, url)
+
+	c := []string{provider}
+	c = append(c, res...)
+	return strings.Join(c, "\n")
+}
+
+func testConfigWithoutAMPWCredentials(url string, res ...string) string {
+	provider := fmt.Sprintf(`
+provider "boundary" {
+	addr  = "%s"
+}`, url)
+
+	c := []string{provider}
+	c = append(c, res...)
+	return strings.Join(c, "\n")
+}
+
 func testConfigWithRecovery(url string, res ...string) string {
 	provider := fmt.Sprintf(`
 provider "boundary" {
 	addr             = "%s"
-	auth_method_id       = "%s"
-	password_auth_method_login_name = "%s"
-	password_auth_method_password = "%s"
 	recovery_kms_hcl = <<DOC
 	kms "aead" {
 		purpose = ["recovery", "config"]
@@ -110,7 +152,20 @@ provider "boundary" {
 		key_id = "global_recovery"
 	}
 	DOC
-}`, url, tcPAUM, tcLoginName, tcPassword)
+}`, url)
+
+	c := []string{provider}
+	c = append(c, res...)
+	return strings.Join(c, "\n")
+}
+
+func testConfigWithLDAPAuthMethod(url string, loginName string, password string, res ...string) string {
+	provider := fmt.Sprintf(`
+provider "boundary" {
+	addr             = "%s"
+	auth_method_login_name = "%s"
+	auth_method_password = "%s"
+}`, url, loginName, password)
 
 	c := []string{provider}
 	c = append(c, res...)
@@ -136,3 +191,188 @@ func TestProvider(t *testing.T) {
 		t.Fatalf("err: %s", err)
 	}
 }
+
+func TestConfigWithLdapAuthMethod(t *testing.T) {
+	td := createDefaultLdap(t)
+	defer td.Stop()
+	tc := controller.NewTestController(t, tcConfig...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+	ldapLoginName := "alice"
+	ldapPassword := "password"
+
+	createLdapAMConfig := fmt.Sprintf(testPrimaryAuthMethodLdap, td.Host(), td.Port(), testdirectory.DefaultUserDN, testdirectory.DefaultGroupDN)
+	createLdapAccountConfig := fmt.Sprintf(testProviderLdapAccountConfig, ldapLoginName)
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		ProviderFactories: providerFactories(&provider),
+		CheckDestroy:      testAccCheckAuthMethodResourceDestroy(t, provider, ldapAuthMethodType),
+		Steps: []resource.TestStep{
+			{
+				// create ldap auth method
+				Config: testConfig(url, fooOrg, createLdapAMConfig, createLdapAccountConfig),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapInsecureTlsField, "true"),
+				),
+			},
+			{
+				// authenticate with LDAP auth method and ensure auth token exists
+				Config: testConfigWithLDAPAuthMethod(url, ldapLoginName, ldapPassword, fooOrg, createLdapAMConfig, createLdapAccountConfig),
+				Check: resource.ComposeTestCheckFunc(
+					testProviderTokenExists(provider),
+				),
+			},
+			{
+				// check if authentication with password auth method works after
+				Config: testConfig(url, fooOrg),
+				Check: resource.ComposeTestCheckFunc(
+					testProviderTokenExists(provider),
+				),
+			},
+		},
+	})
+}
+
+func TestConfigWithDefaultAuthMethod(t *testing.T) {
+	tc := controller.NewTestController(t, tcConfig...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		IsUnitTest:        true,
+		ProviderFactories: providerFactories(&provider),
+		CheckDestroy:      testAccCheckScopeResourceDestroy(t, provider),
+		Steps: []resource.TestStep{
+			{
+				Config: testConfigWithDefaultAuthMethod(url, fooOrg, firstProjectFoo, secondProject),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckScopeResourceExists(provider, "boundary_scope.org1"),
+					testProviderTokenExists(provider),
+				),
+			},
+		},
+	})
+}
+
+func TestConfigWithoutAMPWCredentials(t *testing.T) {
+	tc := controller.NewTestController(t, tcConfig...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		IsUnitTest:        true,
+		ProviderFactories: providerFactories(&provider),
+		Steps: []resource.TestStep{
+			{
+				Config:      testConfigWithoutAMPWCredentials(url, fooOrg, firstProjectFoo, secondProject),
+				ExpectError: regexp.MustCompile("auth method login name not set, please set auth_method_login_name on the provider"),
+			},
+		},
+	})
+}
+
+func TestConfigWithOIDCAuthMethod(t *testing.T) {
+	tc := controller.NewTestController(t, tcConfig...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		IsUnitTest:        true,
+		ProviderFactories: providerFactories(&provider),
+		Steps: []resource.TestStep{
+			{
+				Config:      testConfigWithOIDCAuthMethod(url, fooOrg, firstProjectFoo, secondProject),
+				ExpectError: regexp.MustCompile("OIDC auth method is currently not supported by Boundary Terraform Provider. only password auth method is supported at this time"),
+			},
+		},
+	})
+}
+
+// Create OIDC auth method and set it as the primary auth method.
+// Attempt to authenticate with recovery to test checks for default auth method
+func TestRecoveryWithOIDCDefaultAuthMethod(t *testing.T) {
+	tp := oidc.StartTestProvider(t)
+	wrapper := testWrapper(context.Background(), t, tcRecoveryKey)
+	tc := controller.NewTestController(t, append(tcConfig, controller.WithRecoveryKms(wrapper))...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	tpCert := strings.TrimSpace(tp.CACert())
+	createConfig := fmt.Sprintf(fooAuthMethodOidc, fooAuthMethodOidcDesc, tp.Addr(), tpCert)
+	updateConfig := fmt.Sprintf(fooAuthMethodOidcUpdate, fooAuthMethodOidcDescUpdate, fooAuthMethodOidcCaCerts)
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		ProviderFactories: providerFactories(&provider),
+		CheckDestroy:      testAccCheckAuthMethodResourceDestroy(t, provider, oidcAuthMethodType),
+		Steps: []resource.TestStep{
+			{
+				// create auth method
+				Config: testConfig(url, fooOrg, createConfig),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", "description", fooAuthMethodOidcDesc),
+					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", "name", "test"),
+					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcIssuerKey, tp.Addr()),
+				),
+			},
+			importStep("boundary_auth_method_oidc.foo", "client_secret", "is_primary_for_scope"),
+			{
+				// set auth method as primary auth method
+				Config: testConfig(url, fooOrg, updateConfig),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", "name", "test"),
+					testAccIsPrimaryForScope(provider, "boundary_auth_method_oidc.foo", true),
+				),
+			},
+			{
+				// authenticate provider with recovery kms with unsupported OIDC primary auth method
+				Config: testConfigWithRecovery(url, fooOrg, updateConfig),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", "name", "test"),
+					testAccIsPrimaryForScope(provider, "boundary_auth_method_oidc.foo", true),
+				),
+			},
+			importStep("boundary_auth_method_oidc.foo", "client_secret", "is_primary_for_scope", authmethodOidcMaxAgeKey),
+		},
+	})
+}
+
+func testProviderTokenExists(testProvider *schema.Provider) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		md := testProvider.Meta().(*metaData)
+		if md.client.Token() == "" {
+			return fmt.Errorf("token not set")
+		}
+		return nil
+	}
+}
+
+func createDefaultLdap(t *testing.T) *testdirectory.Directory {
+	td := testdirectory.Start(t,
+		testdirectory.WithDefaults(t, &testdirectory.Defaults{AllowAnonymousBind: true}),
+		testdirectory.WithNoTLS(t),
+	)
+
+	groups := []*gldap.Entry{
+		testdirectory.NewGroup(t, "admin", []string{"alice"}),
+	}
+
+	users := testdirectory.NewUsers(t, []string{"alice"}, testdirectory.WithMembersOf(t, "admin"))
+
+	for _, u := range users {
+		u.Attributes = append(u.Attributes,
+			gldap.NewEntryAttribute(ldap.DefaultADUserPasswordAttribute, []string{"password"}),
+			gldap.NewEntryAttribute(ldap.DefaultOpenLDAPUserPasswordAttribute, []string{"password"}),
+			gldap.NewEntryAttribute("fullName", []string{"test-full-name"}),
+		)
+	}
+
+	td.SetUsers(users...)
+	td.SetGroups(groups...)
+
+	return td
+}

internal/provider/resource_account.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (

internal/provider/resource_account_ldap.go

@@ -0,0 +1,248 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package provider
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/accounts"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+const (
+	accountTypeLdap = "ldap"
+)
+
+func resourceAccountLdap() *schema.Resource {
+	return &schema.Resource{
+		Description: "The account resource allows you to configure a Boundary account.",
+
+		CreateContext: resourceAccountLdapCreate,
+		ReadContext:   resourceAccountLdapRead,
+		UpdateContext: resourceAccountLdapUpdate,
+		DeleteContext: resourceAccountDelete,
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			IDKey: {
+				Description: "The ID of the account.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			NameKey: {
+				Description: "The account name. Defaults to the resource name.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			DescriptionKey: {
+				Description: "The account description.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			AuthMethodIdKey: {
+				Description: "The resource ID for the auth method.",
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+			},
+			TypeKey: {
+				Description: "The resource type.",
+				Type:        schema.TypeString,
+				Deprecated:  "The value for this field will be infered since 'ldap' is the only possible value.",
+				Default:     accountTypeLdap,
+				Optional:    true,
+				ForceNew:    true,
+			},
+			accountLoginNameKey: {
+				Description: "The login name for this account.",
+				Type:        schema.TypeString,
+				Optional:    true,
+				ForceNew:    true,
+			},
+		},
+	}
+}
+
+func setFromAccountLdapResponseMap(d *schema.ResourceData, raw map[string]interface{}) error {
+	if err := d.Set(NameKey, raw["name"]); err != nil {
+		return err
+	}
+	if err := d.Set(DescriptionKey, raw["description"]); err != nil {
+		return err
+	}
+	if err := d.Set(AuthMethodIdKey, raw["auth_method_id"]); err != nil {
+		return err
+	}
+	if err := d.Set(TypeKey, raw["type"]); err != nil {
+		return err
+	}
+
+	switch raw["type"].(string) {
+	case accountTypeLdap:
+		if attrsVal, ok := raw["attributes"]; ok {
+			attrs := attrsVal.(map[string]interface{})
+			if err := d.Set(accountLoginNameKey, attrs["login_name"]); err != nil {
+				return err
+			}
+		}
+	}
+
+	d.SetId(raw["id"].(string))
+	return nil
+}
+
+func resourceAccountLdapCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+
+	var authMethodId string
+	if authMethodIdVal, ok := d.GetOk(AuthMethodIdKey); ok {
+		authMethodId = authMethodIdVal.(string)
+	} else {
+		return diag.Errorf("no auth method ID provided")
+	}
+
+	var loginName *string
+	if keyVal, ok := d.GetOk(accountLoginNameKey); ok {
+		key := keyVal.(string)
+		loginName = &key
+	}
+
+	opts := []accounts.Option{}
+
+	var typeStr string
+	if typeVal, ok := d.GetOk(TypeKey); ok {
+		typeStr = typeVal.(string)
+	} else {
+		return diag.Errorf("no type provided")
+	}
+	switch typeStr {
+	case accountTypeLdap:
+		if loginName != nil {
+			opts = append(opts, accounts.WithLdapAccountLoginName(*loginName))
+		}
+	default:
+		return diag.Errorf("invalid type provided")
+	}
+
+	nameVal, ok := d.GetOk(NameKey)
+	if ok {
+		nameStr := nameVal.(string)
+		opts = append(opts, accounts.WithName(nameStr))
+	}
+
+	descVal, ok := d.GetOk(DescriptionKey)
+	if ok {
+		descStr := descVal.(string)
+		opts = append(opts, accounts.WithDescription(descStr))
+	}
+
+	aClient := accounts.NewClient(md.client)
+
+	acr, err := aClient.Create(ctx, authMethodId, opts...)
+	if err != nil {
+		return diag.Errorf("error creating account: %v", err)
+	}
+	if acr == nil {
+		return diag.Errorf("nil account after create")
+	}
+
+	if err := setFromAccountLdapResponseMap(d, acr.GetResponse().Map); err != nil {
+		return diag.FromErr(err)
+	}
+
+	return nil
+}
+
+func resourceAccountLdapRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	aClient := accounts.NewClient(md.client)
+
+	arr, err := aClient.Read(ctx, d.Id())
+	if err != nil {
+		if apiErr := api.AsServerError(err); apiErr != nil && apiErr.Response().StatusCode() == http.StatusNotFound {
+			d.SetId("")
+			return nil
+		}
+		return diag.Errorf("error reading account: %v", err)
+	}
+	if arr == nil {
+		return diag.Errorf("account nil after read")
+	}
+
+	if err := setFromAccountLdapResponseMap(d, arr.GetResponse().Map); err != nil {
+		return diag.FromErr(err)
+	}
+
+	return nil
+}
+
+func resourceAccountLdapUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	aClient := accounts.NewClient(md.client)
+
+	opts := []accounts.Option{}
+
+	var name *string
+	if d.HasChange(NameKey) {
+		opts = append(opts, accounts.DefaultName())
+		nameVal, ok := d.GetOk(NameKey)
+		if ok {
+			nameStr := nameVal.(string)
+			name = &nameStr
+			opts = append(opts, accounts.WithName(nameStr))
+		}
+	}
+
+	var desc *string
+	if d.HasChange(DescriptionKey) {
+		opts = append(opts, accounts.DefaultDescription())
+		descVal, ok := d.GetOk(DescriptionKey)
+		if ok {
+			descStr := descVal.(string)
+			desc = &descStr
+			opts = append(opts, accounts.WithDescription(descStr))
+		}
+	}
+
+	var loginName *string
+	if d.HasChange(accountLoginNameKey) {
+		switch d.Get(TypeKey).(string) {
+		case accountTypeLdap:
+			opts = append(opts, accounts.DefaultLdapAccountLoginName())
+			keyVal, ok := d.GetOk(accountLoginNameKey)
+			if ok {
+				keyStr := keyVal.(string)
+				loginName = &keyStr
+				opts = append(opts, accounts.WithLdapAccountLoginName(keyStr))
+			}
+		default:
+			return diag.Errorf(`"login_name" cannot be used with this type of account`)
+		}
+	}
+
+	if len(opts) > 0 {
+		opts = append(opts, accounts.WithAutomaticVersioning(true))
+		_, err := aClient.Update(ctx, d.Id(), 0, opts...)
+		if err != nil {
+			return diag.Errorf("error updating account: %v", err)
+		}
+	}
+
+	if d.HasChange(NameKey) {
+		d.Set(NameKey, name)
+	}
+	if d.HasChange(DescriptionKey) {
+		d.Set(DescriptionKey, desc)
+	}
+	if d.HasChange(accountLoginNameKey) {
+		d.Set(accountLoginNameKey, loginName)
+	}
+
+	return nil
+}

internal/provider/resource_account_ldap_test.go

@@ -0,0 +1,150 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package provider
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+const (
+	testAccountLdapDesc       = "test account"
+	testAccountLdapDescUpdate = "test account update"
+	testAccountLdapName       = "test account name"
+	testAccountLdapNameUpdate = "test account name updated"
+)
+
+var (
+	testAccountLdap = fmt.Sprintf(`
+resource "boundary_auth_method_ldap" "foo" {
+	name        = "test"
+	description = "test account"
+	type        = "ldap"
+	scope_id    = boundary_scope.org1.id
+	depends_on  = [boundary_role.org1_admin]
+
+	urls        = ["ldaps://ldap1", "ldaps://ldap2"]
+}
+
+resource "boundary_account_ldap" "foo" {
+	name           = "%s"
+	description    = "%s"
+	type           = "ldap"
+	login_name     = "foo"
+	auth_method_id = boundary_auth_method_ldap.foo.id
+}`, testAccountLdapName, testAccountLdapDesc)
+
+	testAccountLdapUpdate = fmt.Sprintf(`
+resource "boundary_auth_method_ldap" "foo" {
+	name        = "test"
+	description = "test account"
+	type        = "ldap"
+	scope_id    = boundary_scope.org1.id
+	depends_on = [boundary_role.org1_admin]
+	urls         	  = ["ldaps://ldap1", "ldaps://ldap2"]
+}
+
+resource "boundary_account_ldap" "foo" {
+	name           = "%s"
+	description    = "%s"
+	type           = "ldap"
+	login_name     = "foo"
+	auth_method_id = boundary_auth_method_ldap.foo.id
+}`, testAccountLdapNameUpdate, testAccountLdapDescUpdate)
+
+	testAccountLdapWithoutTypeField = fmt.Sprintf(`
+resource "boundary_auth_method_ldap" "foo" {
+	name        = "test"
+	description = "test account"
+	type        = "ldap"
+	scope_id    = boundary_scope.org1.id
+	depends_on = [boundary_role.org1_admin]
+	urls         	  = ["ldaps://ldap1", "ldaps://ldap2"]
+}
+
+resource "boundary_account_ldap" "foo" {
+	name           = "%s"
+	description    = "%s"
+	login_name     = "foo"
+	auth_method_id = boundary_auth_method_ldap.foo.id
+}`, testAccountLdapNameUpdate, testAccountLdapDescUpdate)
+
+	testProviderLdapAccountConfig = `
+resource "boundary_account_ldap" "test-ldap" {
+	name           = "alice"
+	description    = "test"
+	type           = "ldap"
+	login_name     = "%s"
+	auth_method_id = boundary_auth_method_ldap.test-ldap.id
+}
+
+resource "boundary_user" "alice" {
+	name        = "alice"
+	description = "test user resource"
+	account_ids = [boundary_account_ldap.test-ldap.id]
+	scope_id = boundary_scope.global.id
+}
+
+resource "boundary_role" "ldap_principal" {
+	scope_id = boundary_scope.global.id
+	grant_scope_id = boundary_scope.global.id
+	grant_strings = ["id=*;type=*;actions=*"]
+	principal_ids = [boundary_user.alice.id]
+}`
+)
+
+func TestAccLdapAccount(t *testing.T) {
+	tc := controller.NewTestController(t, tcConfig...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	var provider *schema.Provider
+
+	resource.Test(t, resource.TestCase{
+		ProviderFactories: providerFactories(&provider),
+		CheckDestroy:      testAccCheckAccountResourceDestroy(t, provider, baseAccountType),
+		Steps: []resource.TestStep{
+			{
+				// create
+				Config: testConfig(url, fooOrg, testAccountLdap),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "description", testAccountLdapDesc),
+					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "name", testAccountLdapName),
+					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "type", "ldap"),
+					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "login_name", "foo"),
+					testAccCheckAccountResourceExists(provider, "boundary_account_ldap.foo"),
+				),
+			},
+			importStep("boundary_account_ldap.foo", "ldap"),
+			{
+				// update
+				Config: testConfig(url, fooOrg, testAccountLdapUpdate),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "description", testAccountLdapDescUpdate),
+					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "name", testAccountLdapNameUpdate),
+					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "type", "ldap"),
+					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "login_name", "foo"),
+					testAccCheckAccountResourceExists(provider, "boundary_account_ldap.foo"),
+				),
+			},
+			importStep("boundary_account_ldap.foo", "ldap"),
+			{
+				// update without passing type field
+				Config: testConfig(url, fooOrg, testAccountLdapWithoutTypeField),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "description", testAccountLdapDescUpdate),
+					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "name", testAccountLdapNameUpdate),
+					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "type", "ldap"),
+					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "login_name", "foo"),
+					testAccCheckAccountResourceExists(provider, "boundary_account_ldap.foo"),
+				),
+			},
+			importStep("boundary_account_ldap.foo", "ldap"),
+		},
+	})
+}

internal/provider/resource_account_oidc.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (

internal/provider/resource_account_oidc_test.go

@@ -0,0 +1,97 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package provider
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/cap/oidc"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+const (
+	fooAccountOidcDesc       = "test account oidc"
+	fooAccountOidcDescUpdate = "test account oidc update"
+)
+
+var (
+	fooAccountOidc = `
+resource "boundary_auth_method_oidc" "foo" {
+	name        = "test"
+	description = "test account oidc auth method"
+	scope_id    = boundary_scope.org1.id
+	depends_on  = [boundary_role.org1_admin]
+
+	issuer            = "%s"
+	client_id         = "foo_id"
+	client_secret     = "foo_secret"
+	max_age           = 0
+	api_url_prefix    = "http://localhost:9200"
+	idp_ca_certs   = [
+<<EOT
+%s
+EOT
+	]
+	allowed_audiences = ["foo_aud"]
+	signing_algorithms = ["ES256"]
+	account_claim_maps = ["oid=sub"]
+	claims_scopes = ["profile"]
+}
+
+resource "boundary_account_oidc" "foo" {
+	name           = "test"
+	description    = "%s"
+	subject		   = "%s"
+	issuer		   = "%s"
+	auth_method_id = boundary_auth_method_oidc.foo.id
+}`
+)
+
+func TestAccOidcAccount(t *testing.T) {
+	tp := oidc.StartTestProvider(t)
+	tc := controller.NewTestController(t, tcConfig...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	var provider *schema.Provider
+
+	tpCert := strings.TrimSpace(tp.CACert())
+	createConfig := fmt.Sprintf(fooAccountOidc, tp.Addr(), tpCert, fooAccountOidcDesc, tp.ExpectedSubject(), tp.Addr())
+	updateConfig := fmt.Sprintf(fooAccountOidc, tp.Addr(), tpCert, fooAccountOidcDescUpdate, tp.ExpectedSubject(), tp.Addr())
+
+	resource.Test(t, resource.TestCase{
+		ProviderFactories: providerFactories(&provider),
+		CheckDestroy:      testAccCheckAccountResourceDestroy(t, provider, oidcAccountType),
+		Steps: []resource.TestStep{
+			{
+				// create
+				Config: testConfig(url, fooOrg, createConfig),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("boundary_account_oidc.foo", "description", fooAccountOidcDesc),
+					resource.TestCheckResourceAttr("boundary_account_oidc.foo", "name", "test"),
+					resource.TestCheckResourceAttr("boundary_account_oidc.foo", "issuer", tp.Addr()),
+					resource.TestCheckResourceAttr("boundary_account_oidc.foo", "subject", tp.ExpectedSubject()),
+					testAccCheckAccountResourceExists(provider, "boundary_account_oidc.foo"),
+				),
+			},
+			importStep("boundary_account_oidc.foo", "oidc"),
+			{
+				// update
+				Config: testConfig(url, fooOrg, updateConfig),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("boundary_account_oidc.foo", "description", fooAccountOidcDescUpdate),
+					resource.TestCheckResourceAttr("boundary_account_oidc.foo", "name", "test"),
+					resource.TestCheckResourceAttr("boundary_account_oidc.foo", "issuer", tp.Addr()),
+					resource.TestCheckResourceAttr("boundary_account_oidc.foo", "subject", tp.ExpectedSubject()),
+					testAccCheckAccountResourceExists(provider, "boundary_account_oidc.foo"),
+				),
+			},
+			importStep("boundary_account_oidc.foo", "oidc"),
+		},
+	})
+}

internal/provider/resource_account_password.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
@@ -53,7 +56,9 @@ func resourceAccountPassword() *schema.Resource {
 			TypeKey: {
 				Description: "The resource type.",
 				Type:        schema.TypeString,
-				Required:    true,
+				Deprecated:  "The value for this field will be infered since 'password' is the only possible value.",
+				Default:     accountTypePassword,
+				Optional:    true,
 				ForceNew:    true,
 			},
 			accountLoginNameKey: {

internal/provider/resource_account_password_test.go

@@ -1,17 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
-	"context"
 	"fmt"
-	"net/http"
 	"testing"
 
-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/accounts"
 	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
 )
 
 const (
@@ -55,6 +53,23 @@ resource "boundary_account_password" "foo" {
 	password       = "foofoofoo"
 	auth_method_id = boundary_auth_method.foo.id
 }`, fooAccountPasswordDescUpdate)
+
+	fooAccountPasswordWithoutTypeField = fmt.Sprintf(`
+	resource "boundary_auth_method" "foo" {
+		name        = "test"
+		description = "test account"
+		type        = "password"
+		scope_id    = boundary_scope.org1.id
+		depends_on = [boundary_role.org1_admin]
+	}
+	
+	resource "boundary_account_password" "foo" {
+		name           = "test"
+		description    = "%s"
+		login_name     = "foo"
+		password       = "foofoofoo"
+		auth_method_id = boundary_auth_method.foo.id
+	}`, fooAccountPasswordDescUpdate)
 )
 
 func TestAccAccount(t *testing.T) {
@@ -66,7 +81,7 @@ func TestAccAccount(t *testing.T) {
 
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckAccountPasswordResourceDestroy(t, provider),
+		CheckDestroy:      testAccCheckAccountResourceDestroy(t, provider, passwordAccountType),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -77,7 +92,7 @@ func TestAccAccount(t *testing.T) {
 					resource.TestCheckResourceAttr("boundary_account_password.foo", "type", "password"),
 					resource.TestCheckResourceAttr("boundary_account_password.foo", "login_name", "foo"),
 					resource.TestCheckResourceAttr("boundary_account_password.foo", "password", "foofoofoo"),
-					testAccCheckAccountPasswordResourceExists(provider, "boundary_account_password.foo"),
+					testAccCheckAccountResourceExists(provider, "boundary_account_password.foo"),
 				),
 			},
 			importStep("boundary_account_password.foo", "password"),
@@ -90,61 +105,23 @@ func TestAccAccount(t *testing.T) {
 					resource.TestCheckResourceAttr("boundary_account_password.foo", "type", "password"),
 					resource.TestCheckResourceAttr("boundary_account_password.foo", "login_name", "foo"),
 					resource.TestCheckResourceAttr("boundary_account_password.foo", "password", "foofoofoo"),
-					testAccCheckAccountPasswordResourceExists(provider, "boundary_account_password.foo"),
+					testAccCheckAccountResourceExists(provider, "boundary_account_password.foo"),
+				),
+			},
+			importStep("boundary_account_password.foo", "password"),
+			{
+				// update without passing type field
+				Config: testConfig(url, fooOrg, fooAccountPasswordWithoutTypeField),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("boundary_account_password.foo", "description", fooAccountPasswordDescUpdate),
+					resource.TestCheckResourceAttr("boundary_account_password.foo", "name", "test"),
+					resource.TestCheckResourceAttr("boundary_account_password.foo", "type", "password"),
+					resource.TestCheckResourceAttr("boundary_account_password.foo", "login_name", "foo"),
+					resource.TestCheckResourceAttr("boundary_account_password.foo", "password", "foofoofoo"),
+					testAccCheckAccountResourceExists(provider, "boundary_account_password.foo"),
 				),
 			},
 			importStep("boundary_account_password.foo", "password"),
 		},
 	})
 }
-
-func testAccCheckAccountPasswordResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[name]
-		if !ok {
-			return fmt.Errorf("Not found: %s", name)
-		}
-
-		id := rs.Primary.ID
-		if id == "" {
-			return fmt.Errorf("No ID is set")
-		}
-
-		md := testProvider.Meta().(*metaData)
-
-		amClient := accounts.NewClient(md.client)
-
-		if _, err := amClient.Read(context.Background(), id); err != nil {
-			return fmt.Errorf("Got an error when reading account %q: %v", id, err)
-		}
-
-		return nil
-	}
-}
-
-func testAccCheckAccountPasswordResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if testProvider.Meta() == nil {
-			t.Fatal("got nil provider metadata")
-		}
-		md := testProvider.Meta().(*metaData)
-
-		for _, rs := range s.RootModule().Resources {
-			switch rs.Type {
-			case "boundary_account_password":
-				id := rs.Primary.ID
-
-				amClient := accounts.NewClient(md.client)
-
-				_, err := amClient.Read(context.Background(), id)
-				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
-					return fmt.Errorf("didn't get a 404 when reading destroyed account %q: %v", id, err)
-				}
-
-			default:
-				continue
-			}
-		}
-		return nil
-	}
-}

internal/provider/resource_account_test.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
@@ -66,7 +69,7 @@ func TestAccAccountBase(t *testing.T) {
 
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckAccountResourceDestroy(t, provider),
+		CheckDestroy:      testAccCheckAccountResourceDestroy(t, provider, baseAccountType),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -122,7 +125,15 @@ func testAccCheckAccountResourceExists(testProvider *schema.Provider, name strin
 	}
 }
 
-func testAccCheckAccountResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
+type accountType string
+
+const (
+	baseAccountType     accountType = "boundary_account"
+	passwordAccountType accountType = "boundary_account_password"
+	oidcAccountType     accountType = "boundary_account_oidc"
+)
+
+func testAccCheckAccountResourceDestroy(t *testing.T, testProvider *schema.Provider, typ accountType) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if testProvider.Meta() == nil {
 			t.Fatal("got nil provider metadata")
@@ -131,7 +142,7 @@ func testAccCheckAccountResourceDestroy(t *testing.T, testProvider *schema.Provi
 
 		for _, rs := range s.RootModule().Resources {
 			switch rs.Type {
-			case "boundary_account":
+			case string(typ):
 				id := rs.Primary.ID
 
 				amClient := accounts.NewClient(md.client)

internal/provider/resource_auth_method.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (

internal/provider/resource_auth_method_ldap.go

@@ -0,0 +1,817 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package provider
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/authmethods"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+const (
+	authMethodTypeLdap = "ldap"
+
+	authMethodLdapStartTlsField                  = "start_tls"
+	authMethodLdapInsecureTlsField               = "insecure_tls"
+	authMethodLdapDiscoverDnField                = "discover_dn"
+	authMethodLdapAnonGrpSearchField             = "anon_group_search"
+	authMethodLdapUpnDomainField                 = "upn_domain"
+	authMethodLdapUrlsField                      = "urls"
+	authMethodLdapUserDnField                    = "user_dn"
+	authMethodLdapUserAttrField                  = "user_attr"
+	authMethodLdapUserFilterField                = "user_filter"
+	authMethodLdapEnableGrpsField                = "enable_groups"
+	authMethodLdapGroupDnField                   = "group_dn"
+	authMethodLdapGroupAttrField                 = "group_attr"
+	authMethodLdapGroupFilterField               = "group_filter"
+	authMethodLdapCertificatesField              = "certificates"
+	authMethodLdapClientCertField                = "client_certificate"
+	authMethodLdapClientCertKeyField             = "client_certificate_key"
+	authMethodLdapBindDnField                    = "bind_dn"
+	authMethodLdapBindPasswordField              = "bind_password"
+	authMethodLdapUseTokenGrpsField              = "use_token_groups"
+	authMethodLdapAccountAttrMapsField           = "account_attribute_maps"
+	authMethodLdapPrimaryAuthMethodForScopeField = "is_primary_for_scope"
+	authMethodLdapStateField                     = "state"
+
+	// computed-only parameters
+	authMethodLdapClientCertKeyHmacKey = "client_certificate_key_hmac"
+	authMethodLdapBindPasswordHmacKey  = "bind_password_hmac"
+)
+
+func resourceAuthMethodLdap() *schema.Resource {
+	return &schema.Resource{
+		Description: "The LDAP auth method resource allows you to configure a Boundary auth_method_ldap.",
+
+		CreateContext: resourceAuthMethodLdapCreate,
+		ReadContext:   resourceAuthMethodLdapRead,
+		UpdateContext: resourceAuthMethodLdapUpdate,
+		DeleteContext: resourceAuthMethodDelete,
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			IDKey: {
+				Description: "The ID of the auth method.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			NameKey: {
+				Description: "The auth method name. Defaults to the resource name.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			DescriptionKey: {
+				Description: "The auth method description.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			ScopeIdKey: {
+				Description: "The scope ID.",
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+			},
+
+			// LDAP specific configurable parameters
+			authMethodLdapStartTlsField: {
+				Description: "Issue StartTLS command after connecting (optional).",
+				Type:        schema.TypeBool,
+				Optional:    true,
+			},
+			authMethodLdapInsecureTlsField: {
+				Description: "Skip the LDAP server SSL certificate validation (optional) - insecure and use with caution.",
+				Type:        schema.TypeBool,
+				Optional:    true,
+			},
+			authMethodLdapDiscoverDnField: {
+				Description: "Use anon bind to discover the bind DN of a user (optional).",
+				Type:        schema.TypeBool,
+				Optional:    true,
+			},
+			authMethodLdapAnonGrpSearchField: {
+				Description: "Use anon bind when performing LDAP group searches (optional).",
+				Type:        schema.TypeBool,
+				Optional:    true,
+			},
+			authMethodLdapUpnDomainField: {
+				Description: "The userPrincipalDomain used to construct the UPN string for the authenticating user (optional).",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			authMethodLdapUrlsField: {
+				Description: "The LDAP URLs that specify LDAP servers to connect to (required).  May be specified multiple times.",
+				Type:        schema.TypeList,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+				Optional: true,
+			},
+			authMethodLdapUserDnField: {
+				Description: "The base DN under which to perform user search (optional).",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			authMethodLdapUserAttrField: {
+				Description: "The attribute on user entry matching the username passed when authenticating (optional).",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			authMethodLdapUserFilterField: {
+				Description: "A go template used to construct a LDAP user search filter (optional).",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			authMethodLdapEnableGrpsField: {
+				Description: "Find the authenticated user's groups during authentication (optional).",
+				Type:        schema.TypeBool,
+				Optional:    true,
+			},
+			authMethodLdapGroupDnField: {
+				Description: "The base DN under which to perform group search.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			authMethodLdapGroupAttrField: {
+				Description: "The attribute that enumerates a user's group membership from entries returned by a group search (optional).",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			authMethodLdapGroupFilterField: {
+				Description: "A go template used to construct a LDAP group search filter (optional).",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			authMethodLdapCertificatesField: {
+				Description: "PEM-encoded X.509 CA certificate in ASN.1 DER form that can be used as a trust anchor when connecting to an LDAP server(optional).  This may be specified multiple times",
+				Type:        schema.TypeList,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+				Optional: true,
+			},
+			authMethodLdapClientCertField: {
+				Description: "PEM-encoded X.509 client certificate in ASN.1 DER form that can be used to authenticate against an LDAP server(optional).",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			authMethodLdapClientCertKeyField: {
+				Description: "PEM-encoded X.509 client certificate key in PKCS #8, ASN.1 DER form used with the client certificate (optional).",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			authMethodLdapBindDnField: {
+				Description: "The distinguished name of entry to bind when performing user and group searches (optional).",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			authMethodLdapBindPasswordField: {
+				Description: "The password to use along with bind-dn performing user and group searches (optional).",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			authMethodLdapUseTokenGrpsField: {
+				Description: "Use the Active Directory tokenGroups constructed attribute of the user to find the group memberships (optional).",
+				Type:        schema.TypeBool,
+				Optional:    true,
+			},
+			authMethodLdapAccountAttrMapsField: {
+				Description: "Account attribute maps fullname and email.",
+				Type:        schema.TypeList,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+				Optional: true,
+			},
+			authMethodLdapStateField: {
+				Description: "Can be one of 'inactive', 'active-private', or 'active-public'. Defaults to active-public.",
+				Type:        schema.TypeString,
+				Optional:    true,
+				Computed:    true,
+			},
+
+			// LDAP specific immutable and computed parameters
+			authMethodLdapClientCertKeyHmacKey: {
+				Description: "The HMAC of the client certificate key returned by the Boundary controller, which is used for comparison after initial setting of the value.",
+				Type:        schema.TypeString,
+				Optional:    true,
+				Computed:    true,
+			},
+			authMethodLdapBindPasswordHmacKey: {
+				Description: "The HMAC of the bind password returned by the Boundary controller, which is used for comparison after initial setting of the value.",
+				Type:        schema.TypeString,
+				Optional:    true,
+				Computed:    true,
+			},
+
+			authMethodLdapPrimaryAuthMethodForScopeField: {
+				Description: "When true, makes this auth method the primary auth method for the scope in which it resides. The primary auth method for a scope means the the user will be automatically created when they login using an LDAP account.",
+				Type:        schema.TypeBool,
+				Optional:    true,
+			},
+
+			TypeKey: {
+				Description: "The type of auth method; hardcoded.",
+				Type:        schema.TypeString,
+				Default:     authMethodTypeLdap,
+				Optional:    true,
+			},
+		},
+	}
+}
+
+func setFromLdapAuthMethodResponseMap(d *schema.ResourceData, raw map[string]interface{}) error {
+	if err := d.Set(NameKey, raw[NameKey]); err != nil {
+		return err
+	}
+	if err := d.Set(DescriptionKey, raw[DescriptionKey]); err != nil {
+		return err
+	}
+	if err := d.Set(ScopeIdKey, raw[ScopeIdKey]); err != nil {
+		return err
+	}
+	if err := d.Set(TypeKey, raw[TypeKey]); err != nil {
+		return err
+	}
+
+	if attrsVal, ok := raw["attributes"]; ok {
+		attrs := attrsVal.(map[string]interface{})
+
+		// these are always set
+		if err := d.Set(authMethodLdapUrlsField, attrs[authMethodLdapUrlsField].([]interface{})); err != nil {
+			return err
+		}
+		if err := d.Set(authMethodLdapStateField, attrs[authMethodLdapStateField].(string)); err != nil {
+			return err
+		}
+
+		// optional attributes
+		if v, ok := attrs[authMethodLdapStartTlsField]; ok {
+			if err := d.Set(authMethodLdapStartTlsField, v.(bool)); err != nil {
+				return err
+			}
+		} else {
+			d.Set(authMethodLdapStartTlsField, false)
+		}
+
+		if v, ok := attrs[authMethodLdapInsecureTlsField]; ok {
+			if err := d.Set(authMethodLdapInsecureTlsField, v.(bool)); err != nil {
+				return err
+			}
+		} else {
+			if err := d.Set(authMethodLdapInsecureTlsField, false); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapDiscoverDnField]; ok {
+			if err := d.Set(authMethodLdapDiscoverDnField, v.(bool)); err != nil {
+				return err
+			}
+		} else {
+			if err := d.Set(authMethodLdapDiscoverDnField, false); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapAnonGrpSearchField]; ok {
+			if err := d.Set(authMethodLdapAnonGrpSearchField, v.(bool)); err != nil {
+				return err
+			}
+		} else {
+			if err := d.Set(authMethodLdapAnonGrpSearchField, false); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapUpnDomainField]; ok {
+			if err := d.Set(authMethodLdapUpnDomainField, v.(string)); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapUserDnField]; ok {
+			if err := d.Set(authMethodLdapUserDnField, v.(string)); err != nil {
+				return err
+			}
+		}
+		if v, ok := attrs[authMethodLdapUserAttrField]; ok {
+			if err := d.Set(authMethodLdapUserAttrField, v.(string)); err != nil {
+				return err
+			}
+		}
+		if v, ok := attrs[authMethodLdapUserFilterField]; ok {
+			if err := d.Set(authMethodLdapUserFilterField, v.(string)); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapEnableGrpsField]; ok {
+			if err := d.Set(authMethodLdapEnableGrpsField, v.(bool)); err != nil {
+				return err
+			}
+		} else {
+			if err := d.Set(authMethodLdapEnableGrpsField, false); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapGroupDnField]; ok {
+			if err := d.Set(authMethodLdapGroupDnField, v.(string)); err != nil {
+				return err
+			}
+		}
+		if v, ok := attrs[authMethodLdapGroupAttrField]; ok {
+			if err := d.Set(authMethodLdapGroupAttrField, v.(string)); err != nil {
+				return err
+			}
+		}
+		if v, ok := attrs[authMethodLdapGroupFilterField]; ok {
+			if err := d.Set(authMethodLdapGroupFilterField, v.(string)); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapCertificatesField]; ok {
+			if err := d.Set(authMethodLdapCertificatesField, v.([]interface{})); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapClientCertField]; ok {
+			if err := d.Set(authMethodLdapClientCertField, v.(string)); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapClientCertKeyField]; ok {
+			if err := d.Set(authMethodLdapClientCertKeyField, v.(string)); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapClientCertKeyHmacKey]; ok {
+			if err := d.Set(authMethodLdapClientCertKeyHmacKey, v.(string)); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapBindDnField]; ok {
+			if err := d.Set(authMethodLdapBindDnField, v.(string)); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapBindPasswordField]; ok {
+			if err := d.Set(authMethodLdapBindPasswordField, v.(string)); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapBindPasswordHmacKey]; ok {
+			if err := d.Set(authMethodLdapBindPasswordHmacKey, v.(string)); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapUseTokenGrpsField]; ok {
+			if err := d.Set(authMethodLdapUseTokenGrpsField, v.(bool)); err != nil {
+				return err
+			}
+		} else {
+			if err := d.Set(authMethodLdapUseTokenGrpsField, false); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapAccountAttrMapsField]; ok {
+			if err := d.Set(authMethodLdapAccountAttrMapsField, v.([]interface{})); err != nil {
+				return err
+			}
+		}
+
+		if v, ok := attrs[authMethodLdapStateField]; ok {
+			if err := d.Set(authMethodLdapStateField, v.(string)); err != nil {
+				return err
+			}
+		}
+	}
+
+	d.SetId(raw["id"].(string))
+
+	return nil
+}
+
+func resourceAuthMethodLdapCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+
+	var typeStr string
+	if typeVal, ok := d.GetOk(TypeKey); ok {
+		typeStr = typeVal.(string)
+	} else {
+		return diag.Errorf("no type provided")
+	}
+
+	opts := []authmethods.Option{}
+
+	opts = append(opts, authmethods.WithAutomaticVersioning(true))
+
+	if rawUrls, ok := d.GetOk(authMethodLdapUrlsField); ok {
+		urls := []string{}
+		for _, u := range rawUrls.([]interface{}) {
+			urls = append(urls, u.(string))
+		}
+		opts = append(opts, authmethods.WithLdapAuthMethodUrls(urls))
+	}
+
+	if startTls, ok := d.GetOk(authMethodLdapStartTlsField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodStartTls(startTls.(bool)))
+	}
+
+	if insecureTls, ok := d.GetOk(authMethodLdapInsecureTlsField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodInsecureTls(insecureTls.(bool)))
+	}
+
+	if discoverDn, ok := d.GetOk(authMethodLdapDiscoverDnField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodDiscoverDn(discoverDn.(bool)))
+	}
+
+	if anonGrpSearch, ok := d.GetOk(authMethodLdapAnonGrpSearchField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodAnonGroupSearch(anonGrpSearch.(bool)))
+	}
+
+	if upnDomain, ok := d.GetOk(authMethodLdapUpnDomainField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodUpnDomain(upnDomain.(string)))
+	}
+
+	if userDn, ok := d.GetOk(authMethodLdapUserDnField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodUserDn(userDn.(string)))
+	}
+
+	if userAttr, ok := d.GetOk(authMethodLdapUserAttrField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodUserAttr(userAttr.(string)))
+	}
+
+	if userFilter, ok := d.GetOk(authMethodLdapUserFilterField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodUserFilter(userFilter.(string)))
+	}
+
+	if enableGrps, ok := d.GetOk(authMethodLdapEnableGrpsField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodEnableGroups(enableGrps.(bool)))
+	}
+
+	if groupDn, ok := d.GetOk(authMethodLdapGroupDnField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodGroupDn(groupDn.(string)))
+	}
+
+	if groupAttr, ok := d.GetOk(authMethodLdapGroupAttrField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodGroupAttr(groupAttr.(string)))
+	}
+
+	if groupFilter, ok := d.GetOk(authMethodLdapGroupFilterField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodGroupFilter(groupFilter.(string)))
+	}
+
+	if rawCerts, ok := d.GetOk(authMethodLdapCertificatesField); ok {
+		certs := []string{}
+		for _, u := range rawCerts.([]interface{}) {
+			certs = append(certs, u.(string))
+		}
+		opts = append(opts, authmethods.WithLdapAuthMethodCertificates(certs))
+	}
+
+	if clientCert, ok := d.GetOk(authMethodLdapClientCertField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodClientCertificate(clientCert.(string)))
+	}
+
+	if clientCertKey, ok := d.GetOk(authMethodLdapClientCertKeyField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodClientCertificateKey(clientCertKey.(string)))
+	}
+
+	if bindDn, ok := d.GetOk(authMethodLdapBindDnField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodBindDn(bindDn.(string)))
+	}
+
+	if bindPassword, ok := d.GetOk(authMethodLdapBindPasswordField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodBindPassword(bindPassword.(string)))
+	}
+
+	if useTokenGrps, ok := d.GetOk(authMethodLdapUseTokenGrpsField); ok {
+		opts = append(opts, authmethods.WithLdapAuthMethodUseTokenGroups(useTokenGrps.(bool)))
+	}
+
+	if rawAccountAttrMaps, ok := d.GetOk(authMethodLdapAccountAttrMapsField); ok {
+		accountAttrMaps := []string{}
+		for _, u := range rawAccountAttrMaps.([]interface{}) {
+			accountAttrMaps = append(accountAttrMaps, u.(string))
+		}
+		opts = append(opts, authmethods.WithLdapAuthMethodAccountAttributeMaps(accountAttrMaps))
+	}
+
+	state, ok := d.GetOk(authMethodLdapStateField)
+	switch ok {
+	case true:
+		opts = append(opts, authmethods.WithLdapAuthMethodState(state.(string)))
+	default:
+		opts = append(opts, authmethods.WithLdapAuthMethodState("active-public"))
+	}
+
+	if nameVal, ok := d.GetOk(NameKey); ok {
+		nameStr := nameVal.(string)
+		opts = append(opts, authmethods.WithName(nameStr))
+	}
+
+	if descVal, ok := d.GetOk(DescriptionKey); ok {
+		descStr := descVal.(string)
+		opts = append(opts, authmethods.WithDescription(descStr))
+	}
+
+	var scopeId string
+	scopeIdVal, ok := d.GetOk(ScopeIdKey)
+	switch ok {
+	case true:
+		scopeId = scopeIdVal.(string)
+	default:
+		return diag.Errorf("no scope ID provided")
+	}
+
+	amClient := authmethods.NewClient(md.client)
+
+	amcr, err := amClient.Create(ctx, typeStr, scopeId, opts...)
+	switch {
+	case err != nil:
+		return diag.Errorf("error creating auth method: %v", err)
+	case amcr == nil:
+		return diag.Errorf("nil auth method after create")
+	}
+
+	if err := setFromLdapAuthMethodResponseMap(d, amcr.GetResponse().Map); err != nil {
+		return diag.Errorf("%v", err)
+	}
+
+	amid := amcr.GetResponse().Map["id"].(string)
+
+	// update scope when set to primary
+	if p, ok := d.GetOk(authMethodLdapPrimaryAuthMethodForScopeField); ok {
+		if p.(bool) {
+			if err := updateScopeWithPrimaryAuthMethodId(ctx, scopeId, amid, meta); err != nil {
+				return diag.Errorf("%v", err)
+			}
+
+			amcr.GetResponse().Map[authMethodLdapPrimaryAuthMethodForScopeField] = true
+		}
+	}
+
+	if err := setFromLdapAuthMethodResponseMap(d, amcr.GetResponse().Map); err != nil {
+		return diag.FromErr(err)
+	}
+	return nil
+}
+
+func resourceAuthMethodLdapRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	amClient := authmethods.NewClient(md.client)
+
+	amrr, err := amClient.Read(ctx, d.Id())
+	if err != nil {
+		if apiErr := api.AsServerError(err); apiErr.Response().StatusCode() == http.StatusNotFound {
+			d.SetId("")
+			return nil
+		}
+		return diag.Errorf("error reading auth method: %v", err)
+	}
+	if amrr == nil {
+		return diag.Errorf("auth method nil after read")
+	}
+
+	serr, isPrimary := readScopeIsPrimaryAuthMethodId(ctx, amrr.GetResponse().Map["scope_id"].(string), amrr.GetResponse().Map["id"].(string), meta)
+	if err != nil {
+		return diag.Errorf("%v", serr)
+	}
+
+	if isPrimary {
+		amrr.GetResponse().Map[authMethodLdapPrimaryAuthMethodForScopeField] = true
+	}
+
+	if err := setFromLdapAuthMethodResponseMap(d, amrr.GetResponse().Map); err != nil {
+		return diag.FromErr(err)
+	}
+	return nil
+}
+
+func resourceAuthMethodLdapUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	amClient := authmethods.NewClient(md.client)
+
+	opts := []authmethods.Option{}
+
+	if d.HasChange(NameKey) {
+		opts = append(opts, authmethods.DefaultName())
+		nameVal, ok := d.GetOk(NameKey)
+		if ok {
+			opts = append(opts, authmethods.WithName(nameVal.(string)))
+		}
+	}
+
+	if d.HasChange(DescriptionKey) {
+		opts = append(opts, authmethods.DefaultDescription())
+		descVal, ok := d.GetOk(DescriptionKey)
+		if ok {
+			opts = append(opts, authmethods.WithDescription(descVal.(string)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapUrlsField) {
+		if rawUrls, ok := d.GetOk(authMethodLdapUrlsField); ok {
+			urls := []string{}
+			for _, u := range rawUrls.([]interface{}) {
+				urls = append(urls, u.(string))
+			}
+			opts = append(opts, authmethods.WithLdapAuthMethodUrls(urls))
+		}
+	}
+
+	if d.HasChange(authMethodLdapStartTlsField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodStartTls())
+		if startTls, ok := d.GetOk(authMethodLdapStartTlsField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodStartTls(startTls.(bool)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapInsecureTlsField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodInsecureTls())
+		if insecureTls, ok := d.GetOk(authMethodLdapInsecureTlsField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodInsecureTls(insecureTls.(bool)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapDiscoverDnField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodDiscoverDn())
+		if discoverDn, ok := d.GetOk(authMethodLdapDiscoverDnField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodDiscoverDn(discoverDn.(bool)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapAnonGrpSearchField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodAnonGroupSearch())
+		if AnonGrpSearch, ok := d.GetOk(authMethodLdapAnonGrpSearchField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodAnonGroupSearch(AnonGrpSearch.(bool)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapUpnDomainField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodUpnDomain())
+		if upnDomain, ok := d.GetOk(authMethodLdapUpnDomainField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodUpnDomain(upnDomain.(string)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapUserDnField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodUserDn())
+		if userDn, ok := d.GetOk(authMethodLdapUserDnField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodUserDn(userDn.(string)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapUserAttrField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodUserAttr())
+		if userAttr, ok := d.GetOk(authMethodLdapUserAttrField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodUserAttr(userAttr.(string)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapUserFilterField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodUserFilter())
+		if userFilter, ok := d.GetOk(authMethodLdapUserFilterField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodUserFilter(userFilter.(string)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapEnableGrpsField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodEnableGroups())
+		if enableGrps, ok := d.GetOk(authMethodLdapEnableGrpsField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodEnableGroups(enableGrps.(bool)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapGroupDnField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodGroupDn())
+		if groupDn, ok := d.GetOk(authMethodLdapGroupDnField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodGroupDn(groupDn.(string)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapGroupAttrField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodGroupAttr())
+		if groupAttr, ok := d.GetOk(authMethodLdapGroupAttrField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodGroupAttr(groupAttr.(string)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapGroupFilterField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodGroupFilter())
+		if groupFilter, ok := d.GetOk(authMethodLdapGroupFilterField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodGroupFilter(groupFilter.(string)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapCertificatesField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodCertificates())
+		if rawCerts, ok := d.GetOk(authMethodLdapCertificatesField); ok {
+			certs := []string{}
+			for _, u := range rawCerts.([]interface{}) {
+				certs = append(certs, u.(string))
+			}
+			opts = append(opts, authmethods.WithLdapAuthMethodCertificates(certs))
+		}
+	}
+
+	if d.HasChange(authMethodLdapClientCertField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodClientCertificate())
+		if clientCert, ok := d.GetOk(authMethodLdapClientCertField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodClientCertificate(clientCert.(string)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapClientCertKeyField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodClientCertificateKey())
+		if clientCertKey, ok := d.GetOk(authMethodLdapClientCertKeyField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodClientCertificateKey(clientCertKey.(string)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapBindDnField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodBindDn())
+		if bindDn, ok := d.GetOk(authMethodLdapBindDnField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodBindDn(bindDn.(string)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapBindPasswordField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodBindPassword())
+		if bindPassword, ok := d.GetOk(authMethodLdapBindPasswordField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodBindPassword(bindPassword.(string)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapUseTokenGrpsField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodUseTokenGroups())
+		if useTokenGrps, ok := d.GetOk(authMethodLdapUseTokenGrpsField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodUseTokenGroups(useTokenGrps.(bool)))
+		}
+	}
+
+	if d.HasChange(authMethodLdapAccountAttrMapsField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodAccountAttributeMaps())
+		if rawAccountAttrMaps, ok := d.GetOk(authMethodLdapAccountAttrMapsField); ok {
+			accountAttrMaps := []string{}
+			for _, u := range rawAccountAttrMaps.([]interface{}) {
+				accountAttrMaps = append(accountAttrMaps, u.(string))
+			}
+			opts = append(opts, authmethods.WithLdapAuthMethodAccountAttributeMaps(accountAttrMaps))
+		}
+	}
+
+	if d.HasChange(authMethodLdapStateField) {
+		opts = append(opts, authmethods.DefaultLdapAuthMethodState())
+		if state, ok := d.GetOk(authMethodLdapStateField); ok {
+			opts = append(opts, authmethods.WithLdapAuthMethodState(state.(string)))
+		}
+	}
+
+	if len(opts) > 0 {
+		opts = append(opts, authmethods.WithAutomaticVersioning(true))
+		amur, err := amClient.Update(ctx, d.Id(), 0, opts...)
+		if err != nil {
+			return diag.Errorf("error updating auth method: %v", err)
+		}
+
+		if d.HasChange(authMethodLdapPrimaryAuthMethodForScopeField) {
+			if p, ok := d.GetOk(authMethodLdapPrimaryAuthMethodForScopeField); ok {
+				if p.(bool) {
+					if err := updateScopeWithPrimaryAuthMethodId(
+						ctx,
+						amur.GetResponse().Map["scope_id"].(string),
+						amur.GetResponse().Map["id"].(string),
+						meta); err != nil {
+						return diag.Errorf("%v", err)
+					}
+
+					amur.GetResponse().Map[authMethodLdapPrimaryAuthMethodForScopeField] = true
+				}
+			}
+		}
+
+		if err := setFromLdapAuthMethodResponseMap(d, amur.GetResponse().Map); err != nil {
+			return diag.FromErr(err)
+		}
+		return nil
+	}
+	return nil
+}

internal/provider/resource_auth_method_ldap_test.go

@@ -0,0 +1,199 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package provider
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/jimlambrt/gldap/testdirectory"
+)
+
+const (
+	testAuthMethodLdapDesc = "test auth method ldap"
+
+	testAuthMethodLdapDescUpdate = "test auth method ldap update"
+
+	testAuthMethodLdapCert = `-----BEGIN CERTIFICATE-----
+MIIDsjCCApoCCQCslgm7fAu/VzANBgkqhkiG9w0BAQsFADCBmjELMAkGA1UEBhMC
+VVMxCzAJBgNVBAgMAldBMRMwEQYDVQQHDApCZWxsaW5naGFtMRIwEAYDVQQKDAlI
+YXNoaUNvcnAxETAPBgNVBAsMCEJvdW5kYXJ5MRswGQYDVQQDDBJib3VuZGFyeXBy
+b2plY3QuaW8xJTAjBgkqhkiG9w0BCQEWFmptYWxuaWNrQGhhc2hpY29ycC5jb20w
+HhcNMjEwNDA2MjMzNTIxWhcNMjYwNDA1MjMzNTIxWjCBmjELMAkGA1UEBhMCVVMx
+CzAJBgNVBAgMAldBMRMwEQYDVQQHDApCZWxsaW5naGFtMRIwEAYDVQQKDAlIYXNo
+aUNvcnAxETAPBgNVBAsMCEJvdW5kYXJ5MRswGQYDVQQDDBJib3VuZGFyeXByb2pl
+Y3QuaW8xJTAjBgkqhkiG9w0BCQEWFmptYWxuaWNrQGhhc2hpY29ycC5jb20wggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDUa/ZLwYhTQ2hGzlwy/sB9xY9h
+dM4qzY8DUF3Sin/+J2j59q3/vXZA7PS+o1GhoG1nW3J51zgyNFOY/EKHdtxVBken
+YTTG+JswzrcTxsMV7/sYDgCLq6W8dPMV72gPH/3dRi3/0KUHtA6rBOf0Shf0f6Sz
+7VmgTWcNmLvXpHKOs4YkjOL/tyflTgNm5j1dOa53TtwtMyvCcpGrB7PGL8m5+E2U
+qxOzQ9kWfA6zr4Gl5rIm+Us8Ez3n1yGwjwFBteexk1Fot8zWKhoy7pZ3ZjWRpjwL
+hfGs5eJs4kERQVAGONt39ZIR6OzOFxAsvI9WrMvxAsdCK63RtF2k4r0X21yDAgMB
+AAEwDQYJKoZIhvcNAQELBQADggEBAJZcl7Zxjya23IcOV8jZDdCHtqnbcg9TcQb+
+kpX1uEKJMFJoNmNK1q//nJxG1YBn3G8t9XtO6Kc6egdGHXWnOsM37N9hbYPJ2kW1
+WWAwqWkQbV3wb0cc6MuU1S9xivOqwM046ZIcjrWR4T4tEUSUfYc3I+Yd8APdapn8
+vePgWnmi/aSsx9RxVOUrzmVhzgN7rQJZGwnYYnxl4cwy2jxpysmXzg/grfXCZs/V
+Kkc7Y5Ph6vRQ+vPCeB7QUxHxjlr8aq+rYDIaSiZ+/4+qyme0ergfvZmMSU8A3NNS
+tYIMds5s2lIqVwOoyzpBEOjWBhUThH+aZu1A5c7Cb7s1eLSRX70=
+-----END CERTIFICATE-----`
+)
+
+var (
+	testAuthMethodLdap = `
+resource "boundary_auth_method_ldap" "test-ldap" {
+	name        = "test"
+	description = "%s"
+	scope_id    = boundary_scope.org1.id
+	depends_on  = [boundary_role.org1_admin]
+
+	start_tls   	  = true
+	discover_dn 	  = true
+	anon_group_search = true
+	upn_domain  	  = "upn-domain-test"
+  	urls         	  = ["ldaps://ldap1", "ldaps://ldap2"]
+	user_dn           = "user-dn"
+	user_attr         = "user-attr"
+	user_filter       = "user-filter"
+	enable_groups     = true
+	group_dn          = "group-dn"
+	group_attr        = "group-attr"
+	group_filter      = "group-filter"
+	bind_dn           = "bind-dn"
+	bind_password     = "bind-password"
+	use_token_groups  = true
+  	certificates 	  = [
+<<EOT
+%s
+EOT
+  ]
+}`
+
+	testPrimaryAuthMethodLdap = `
+resource "boundary_auth_method_ldap" "test-ldap" {
+	name        		 = "test"
+	description 		 = "test auth method ldap"
+	scope_id    		 = "global"
+	is_primary_for_scope = true
+  	urls         	  	 = ["ldap://%s:%d"]
+	user_dn           	 = "%s"
+	group_dn          	 = "%s"
+	discover_dn 	  	 = true
+	enable_groups    	 = true
+	insecure_tls	 	 = true
+}`
+
+	testAuthMethodLdapUpdate = `
+resource "boundary_auth_method_ldap" "test-ldap" {
+	name                 = "test"
+	description          = "%s"
+	scope_id             = boundary_scope.org1.id
+	is_primary_for_scope = true
+	depends_on           = [boundary_role.org1_admin]
+
+	start_tls            = false
+	insecure_tls  		 = true
+	discover_dn 		 = false
+	anon_group_search 	 = false
+	upn_domain  		 = "upn-domain-test-updated"
+	urls                 = ["ldaps://ldap1-updated", "ldaps://ldap2-updated"]
+	user_dn              = "user-dn-updated"
+	user_attr            = "user-attr-updated"
+	user_filter          = "user-filter-updated"
+	enable_groups        = false
+	group_dn             = "group-dn-updated"
+	group_attr           = "group-attr-updated"
+	group_filter         = "group-filter-updated"
+	bind_dn              = "bind-dn-updated"
+	bind_password        = "bind-password-updated" 
+	use_token_groups     = false
+	state                = "inactive"
+  	certificates         = [
+<<EOT
+%s
+EOT
+  ]
+	}`
+)
+
+func TestAccAuthMethodLdap(t *testing.T) {
+	td := testdirectory.Start(t,
+		testdirectory.WithDefaults(t, &testdirectory.Defaults{AllowAnonymousBind: true}),
+	)
+	tc := controller.NewTestController(t, tcConfig...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	tdCert := strings.TrimSpace(td.Cert())
+	createConfig := fmt.Sprintf(testAuthMethodLdap, testAuthMethodLdapDesc, tdCert)
+	updateConfig := fmt.Sprintf(testAuthMethodLdapUpdate, testAuthMethodLdapDescUpdate, testAuthMethodLdapCert)
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		ProviderFactories: providerFactories(&provider),
+		CheckDestroy:      testAccCheckAuthMethodResourceDestroy(t, provider, ldapAuthMethodType),
+		Steps: []resource.TestStep{
+			{
+				// create
+				Config: testConfig(url, fooOrg, createConfig),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", "description", testAuthMethodLdapDesc),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", "name", "test"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapStateField, "active-public"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapStartTlsField, "true"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapInsecureTlsField, "false"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapDiscoverDnField, "true"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapAnonGrpSearchField, "true"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUpnDomainField, "upn-domain-test"),
+					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_ldap.test-ldap", authMethodLdapUrlsField, []string{"ldaps://ldap1", "ldaps://ldap2"}),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUserDnField, "user-dn"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUserAttrField, "user-attr"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUserFilterField, "user-filter"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapEnableGrpsField, "true"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapGroupDnField, "group-dn"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapGroupAttrField, "group-attr"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapGroupFilterField, "group-filter"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapBindDnField, "bind-dn"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapBindPasswordField, "bind-password"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUseTokenGrpsField, "true"),
+					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_ldap.test-ldap", authMethodLdapCertificatesField, []string{tdCert}),
+				),
+			},
+			importStep("boundary_auth_method_ldap.test-ldap", "is_primary_for_scope", "bind_password", "client_certificate_key"),
+			{
+				// update
+				Config: testConfig(url, fooOrg, updateConfig),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapStateField, "inactive"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", "description", testAuthMethodLdapDescUpdate),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", "name", "test"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapStartTlsField, "false"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapInsecureTlsField, "true"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapDiscoverDnField, "false"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapAnonGrpSearchField, "false"), resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUpnDomainField, "upn-domain-test-updated"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUpnDomainField, "upn-domain-test-updated"),
+					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_ldap.test-ldap", authMethodLdapUrlsField, []string{"ldaps://ldap1-updated", "ldaps://ldap2-updated"}),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUserDnField, "user-dn-updated"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUserAttrField, "user-attr-updated"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUserFilterField, "user-filter-updated"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapEnableGrpsField, "false"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapGroupDnField, "group-dn-updated"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapGroupAttrField, "group-attr-updated"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapGroupFilterField, "group-filter-updated"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapBindDnField, "bind-dn-updated"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapBindPasswordField, "bind-password-updated"),
+					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUseTokenGrpsField, "false"),
+					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_ldap.test-ldap", authMethodLdapCertificatesField, []string{testAuthMethodLdapCert}),
+					testAccCheckAuthMethodResourceExists(provider, "boundary_auth_method_ldap.test-ldap"),
+					testAccIsPrimaryForScope(provider, "boundary_auth_method_ldap.test-ldap", true),
+					testAccCheckAuthMethodResourceExists(provider, "boundary_auth_method_ldap.test-ldap"),
+				),
+			},
+			importStep("boundary_auth_method_ldap.test-ldap", "is_primary_for_scope", "bind_password", "client_certificate_key"),
+		},
+	})
+}

internal/provider/resource_auth_method_oidc.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
@@ -112,9 +115,11 @@ func resourceAuthMethodOidc() *schema.Resource {
 				Optional:    true,
 			},
 			authmethodOidcMaxAgeKey: {
-				Description: "The max age to provide to the provider, indicating how much time is allowed to have passed since the last authentication before the user is challenged again.",
-				Type:        schema.TypeInt,
-				Optional:    true,
+				Description: `The max age to provide to the provider, indicating how much time is allowed to have passed since the last authentication before the user is challenged again. ` +
+					`A value of 0 sets an immediate requirement for all users to reauthenticate, and an unset maxAge results in a Terraform value of -1 and the default TTL of the chosen OIDC will be used.`,
+				Type:     schema.TypeInt,
+				Optional: true,
+				Default:  -1,
 			},
 			authmethodOidcSigningAlgorithmsKey: {
 				Description: "Allowed signing algorithms for the provider's issued tokens.",
@@ -163,7 +168,7 @@ func resourceAuthMethodOidc() *schema.Resource {
 				Computed:    true,
 			},
 			authmethodOidcIsPrimaryAuthMethodForScope: {
-				Description: "When true, makes this auth method the primary auth method for the scope in which it resides. The primary auth method for a scope means the the user will be automatically created when they login using an OIDC account.",
+				Description: "When true, makes this auth method the primary auth method for the scope in which it resides. The primary auth method for a scope means the user will be automatically created when they login using an OIDC account.",
 				Type:        schema.TypeBool,
 				Optional:    true,
 			},
@@ -264,8 +269,12 @@ func resourceAuthMethodOidcCreate(ctx context.Context, d *schema.ResourceData, m
 	if clientSecret, ok := d.GetOk(authmethodOidcClientSecretKey); ok {
 		opts = append(opts, authmethods.WithOidcAuthMethodClientSecret(clientSecret.(string)))
 	}
-	if maxAge, ok := d.GetOk(authmethodOidcMaxAgeKey); ok {
+	// null values are not correctly recognized by the Terraform SDK, so we instead check here for maxAge value
+	// if maxAge is unset it will default and set the terraform state to -1 and clear the maxAge param in Boundary
+	if maxAge, _ := d.GetOk(authmethodOidcMaxAgeKey); maxAge.(int) >= 0 {
 		opts = append(opts, authmethods.WithOidcAuthMethodMaxAge(uint32(maxAge.(int))))
+	} else {
+		opts = append(opts, authmethods.DefaultOidcAuthMethodMaxAge())
 	}
 	if prefix, ok := d.GetOk(authmethodOidcApiUrlPrefixKey); ok {
 		opts = append(opts, authmethods.WithOidcAuthMethodApiUrlPrefix(prefix.(string)))
@@ -468,8 +477,12 @@ func resourceAuthMethodOidcUpdate(ctx context.Context, d *schema.ResourceData, m
 		}
 	}
 	if d.HasChange(authmethodOidcMaxAgeKey) {
-		if maxAge, ok := d.GetOk(authmethodOidcMaxAgeKey); ok {
+		// null values are not correctly recognized by the Terraform SDK, so we instead check here for maxAge value
+		// if maxAge is unset it will default and set the terraform state to -1 and clear the maxAge param in Boundary
+		if maxAge, _ := d.GetOk(authmethodOidcMaxAgeKey); maxAge.(int) >= 0 {
 			opts = append(opts, authmethods.WithOidcAuthMethodMaxAge(uint32(maxAge.(int))))
+		} else {
+			opts = append(opts, authmethods.DefaultOidcAuthMethodMaxAge())
 		}
 	}
 	if d.HasChange(authmethodOidcSigningAlgorithmsKey) {

internal/provider/resource_auth_method_oidc_test.go

@@ -1,13 +1,14 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
 	"context"
 	"fmt"
-	"net/http"
 	"strings"
 	"testing"
 
-	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/authmethods"
 	"github.com/hashicorp/boundary/api/scopes"
 	"github.com/hashicorp/boundary/testing/controller"
@@ -49,13 +50,13 @@ var (
 resource "boundary_auth_method_oidc" "foo" {
 	name        = "test"
 	description = "%s"
-	scope_id    = boundary_scope.org1.id
+	scope_id    = "global"
 	depends_on  = [boundary_role.org1_admin]
 
   issuer            = "%s"
   client_id         = "foo_id"
   client_secret     = "foo_secret"
-  max_age           = 10
+  max_age           = 0
   api_url_prefix    = "http://localhost:9200"
   idp_ca_certs   = [
 <<EOT
@@ -72,14 +73,13 @@ EOT
 resource "boundary_auth_method_oidc" "foo" {
 	name                 = "test"
 	description          = "%s"
-	scope_id             = boundary_scope.org1.id
+	scope_id             = "global"
 	is_primary_for_scope = true
 	depends_on           = [boundary_role.org1_admin]
 
   issuer            = "https://test-update.com"
   client_id         = "foo_id_update"
   client_secret     = "foo_secret_update"
-  max_age           = 1
   api_url_prefix    = "http://localhost:9200"
   idp_ca_certs   = [
 <<EOT
@@ -91,7 +91,7 @@ EOT
   account_claim_maps = ["oid=sub"]
 	claims_scopes = ["profile"]
 
-  // we need to disable this validatin, since the updated issuer isn't discoverable
+  // we need to disable this validation, since the updated issuer isn't discoverable
   disable_discovered_config_validation = true 
 }`
 )
@@ -109,7 +109,7 @@ func TestAccAuthMethodOidc(t *testing.T) {
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckAuthMethodOidcResourceDestroy(t, provider),
+		CheckDestroy:      testAccCheckAuthMethodResourceDestroy(t, provider, oidcAuthMethodType),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -119,13 +119,13 @@ func TestAccAuthMethodOidc(t *testing.T) {
 					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", "name", "test"),
 					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcIssuerKey, tp.Addr()),
 					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcClientIdKey, "foo_id"),
-					testAccCheckAuthMethodOidcAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcIdpCaCertsKey, []string{tpCert}),
-					testAccCheckAuthMethodOidcAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcAllowedAudiencesKey, []string{"foo_aud"}),
-					testAccCheckAuthMethodOidcAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcSigningAlgorithmsKey, []string{"ES256"}),
-					testAccCheckAuthMethodOidcAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcAccountClaimMapsKey, []string{"oid=sub"}),
-					testAccCheckAuthMethodOidcAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcClaimsScopesKey, []string{"profile"}),
-					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcMaxAgeKey, "10"),
-					testAccCheckAuthMethodOidcResourceExists(provider, "boundary_auth_method_oidc.foo"),
+					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcMaxAgeKey, "0"),
+					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcIdpCaCertsKey, []string{tpCert}),
+					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcAllowedAudiencesKey, []string{"foo_aud"}),
+					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcSigningAlgorithmsKey, []string{"ES256"}),
+					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcAccountClaimMapsKey, []string{"oid=sub"}),
+					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcClaimsScopesKey, []string{"profile"}),
+					testAccCheckAuthMethodResourceExists(provider, "boundary_auth_method_oidc.foo"),
 					testAccIsPrimaryForScope(provider, "boundary_auth_method_oidc.foo", false),
 				),
 			},
@@ -138,71 +138,20 @@ func TestAccAuthMethodOidc(t *testing.T) {
 					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", "name", "test"),
 					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcIssuerKey, "https://test-update.com"),
 					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcClientIdKey, "foo_id_update"),
-					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcMaxAgeKey, "1"),
-					testAccCheckAuthMethodOidcAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcIdpCaCertsKey, []string{fooAuthMethodOidcCaCerts}),
-					testAccCheckAuthMethodOidcAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcAllowedAudiencesKey, []string{"foo_aud_update"}),
-					testAccCheckAuthMethodOidcResourceExists(provider, "boundary_auth_method_oidc.foo"),
+					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", authmethodOidcMaxAgeKey, "-1"),
+					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcIdpCaCertsKey, []string{fooAuthMethodOidcCaCerts}),
+					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_oidc.foo", authmethodOidcAllowedAudiencesKey, []string{"foo_aud_update"}),
+					testAccCheckAuthMethodResourceExists(provider, "boundary_auth_method_oidc.foo"),
 					testAccIsPrimaryForScope(provider, "boundary_auth_method_oidc.foo", true),
-					testAccCheckAuthMethodOidcResourceExists(provider, "boundary_auth_method_oidc.foo"),
+					testAccCheckAuthMethodResourceExists(provider, "boundary_auth_method_oidc.foo"),
 				),
 			},
-			importStep("boundary_auth_method_oidc.foo", "client_secret", "is_primary_for_scope"),
+			importStep("boundary_auth_method_oidc.foo", "client_secret", "is_primary_for_scope", authmethodOidcMaxAgeKey),
 		},
 	})
 }
 
-func testAccCheckAuthMethodOidcResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[name]
-		if !ok {
-			return fmt.Errorf("Not found: %s", name)
-		}
-
-		id := rs.Primary.ID
-		if id == "" {
-			return fmt.Errorf("No ID is set")
-		}
-
-		md := testProvider.Meta().(*metaData)
-
-		amClient := authmethods.NewClient(md.client)
-
-		if _, err := amClient.Read(context.Background(), id); err != nil {
-			return fmt.Errorf("Got an error when reading auth method %q: %w", id, err)
-		}
-
-		return nil
-	}
-}
-
-func testAccCheckAuthMethodOidcResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if testProvider.Meta() == nil {
-			t.Fatal("got nil provider metadata")
-		}
-		md := testProvider.Meta().(*metaData)
-
-		for _, rs := range s.RootModule().Resources {
-			switch rs.Type {
-			case "boundary_auth_method_oidc":
-				id := rs.Primary.ID
-
-				amClient := authmethods.NewClient(md.client)
-
-				_, err := amClient.Read(context.Background(), id)
-				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
-					return fmt.Errorf("didn't get a 404 when reading destroyed auth method %q: %v", id, err)
-				}
-
-			default:
-				continue
-			}
-		}
-		return nil
-	}
-}
-
-func testAccCheckAuthMethodOidcAttrAryValueSet(testProvider *schema.Provider, name string, key string, strAry []string) resource.TestCheckFunc {
+func testAccCheckAuthMethodAttrAryValueSet(testProvider *schema.Provider, name string, key string, strAry []string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[name]
 		if !ok {

internal/provider/resource_auth_method_password.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (

internal/provider/resource_auth_method_password_test.go

@@ -1,17 +1,15 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
-	"context"
 	"fmt"
-	"net/http"
 	"testing"
 
-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/authmethods"
 	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
 )
 
 const (
@@ -47,7 +45,7 @@ func TestAccAuthMethodPassword(t *testing.T) {
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckAuthMethodResourceDestroy(t, provider),
+		CheckDestroy:      testAccCheckAuthMethodResourceDestroy(t, provider, passwordAuthMethodType),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -74,54 +72,3 @@ func TestAccAuthMethodPassword(t *testing.T) {
 		},
 	})
 }
-
-func testAccCheckAuthMethodResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[name]
-		if !ok {
-			return fmt.Errorf("Not found: %s", name)
-		}
-
-		id := rs.Primary.ID
-		if id == "" {
-			return fmt.Errorf("No ID is set")
-		}
-
-		md := testProvider.Meta().(*metaData)
-
-		amClient := authmethods.NewClient(md.client)
-
-		if _, err := amClient.Read(context.Background(), id); err != nil {
-			return fmt.Errorf("Got an error when reading auth method %q: %w", id, err)
-		}
-
-		return nil
-	}
-}
-
-func testAccCheckAuthMethodResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if testProvider.Meta() == nil {
-			t.Fatal("got nil provider metadata")
-		}
-		md := testProvider.Meta().(*metaData)
-
-		for _, rs := range s.RootModule().Resources {
-			switch rs.Type {
-			case "boundary_auth_method_password":
-				id := rs.Primary.ID
-
-				amClient := authmethods.NewClient(md.client)
-
-				_, err := amClient.Read(context.Background(), id)
-				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
-					return fmt.Errorf("didn't get a 404 when reading destroyed auth method %q: %v", id, err)
-				}
-
-			default:
-				continue
-			}
-		}
-		return nil
-	}
-}

internal/provider/resource_auth_method_test.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
@@ -49,7 +52,7 @@ func TestAccBaseAuthMethodPassword(t *testing.T) {
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckAuthMethodResourceDestroy(t, provider),
+		CheckDestroy:      testAccCheckAuthMethodResourceDestroy(t, provider, baseAuthMethodType),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -58,7 +61,7 @@ func TestAccBaseAuthMethodPassword(t *testing.T) {
 					resource.TestCheckResourceAttr("boundary_auth_method.foo", "description", fooBaseAuthMethodDesc),
 					resource.TestCheckResourceAttr("boundary_auth_method.foo", "name", "test"),
 					resource.TestCheckResourceAttr("boundary_auth_method.foo", "type", "password"),
-					testAccCheckBaseAuthMethodResourceExists(provider, "boundary_auth_method.foo"),
+					testAccCheckAuthMethodResourceExists(provider, "boundary_auth_method.foo"),
 				),
 			},
 			importStep("boundary_auth_method.foo"),
@@ -70,7 +73,7 @@ func TestAccBaseAuthMethodPassword(t *testing.T) {
 					resource.TestCheckResourceAttr("boundary_auth_method.foo", "description", fooBaseAuthMethodDescUpdate),
 					resource.TestCheckResourceAttr("boundary_auth_method.foo", "name", "test"),
 					resource.TestCheckResourceAttr("boundary_auth_method.foo", "type", "password"),
-					testAccCheckBaseAuthMethodResourceExists(provider, "boundary_auth_method.foo"),
+					testAccCheckAuthMethodResourceExists(provider, "boundary_auth_method.foo"),
 				),
 			},
 			importStep("boundary_auth_method.foo"),
@@ -78,7 +81,7 @@ func TestAccBaseAuthMethodPassword(t *testing.T) {
 	})
 }
 
-func testAccCheckBaseAuthMethodResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
+func testAccCheckAuthMethodResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[name]
 		if !ok {
@@ -102,7 +105,16 @@ func testAccCheckBaseAuthMethodResourceExists(testProvider *schema.Provider, nam
 	}
 }
 
-func testAccCheckBaseAuthMethodResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
+type authMethodType string
+
+const (
+	baseAuthMethodType     authMethodType = "boundary_auth_method"
+	passwordAuthMethodType authMethodType = "boundary_auth_method_password"
+	ldapAuthMethodType     authMethodType = "boundary_auth_method_ldap"
+	oidcAuthMethodType     authMethodType = "boundary_auth_method_oidc"
+)
+
+func testAccCheckAuthMethodResourceDestroy(t *testing.T, testProvider *schema.Provider, typ authMethodType) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if testProvider.Meta() == nil {
 			t.Fatal("got nil provider metadata")
@@ -111,7 +123,7 @@ func testAccCheckBaseAuthMethodResourceDestroy(t *testing.T, testProvider *schem
 
 		for _, rs := range s.RootModule().Resources {
 			switch rs.Type {
-			case "boundary_auth_method":
+			case string(typ):
 				id := rs.Primary.ID
 
 				amClient := authmethods.NewClient(md.client)

internal/provider/resource_credential_json.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (

internal/provider/resource_credential_json_test.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
@@ -67,7 +70,7 @@ func TestAccCredentialJson(t *testing.T) {
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckCredentialJsonResourceDestroy(t, provider),
+		CheckDestroy:      testAccCheckCredentialResourceDestroy(t, provider, jsonCredentialType),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -77,8 +80,8 @@ func TestAccCredentialJson(t *testing.T) {
 					resource.TestCheckResourceAttr(jsonCredResc, DescriptionKey, jsonCredDesc),
 					resource.TestCheckResourceAttr(jsonCredResc, credentialJsonObjectKey, `{"password":"password","username":"admin"}`),
 
-					testAccCheckCredentialJsonObjectHmac(provider),
-					testAccCheckCredentialJsonResourceExists(provider, jsonCredResc),
+					testAccCheckCredentialJsonObjectHmac(),
+					testAccCheckCredentialResourceExists(provider, jsonCredResc),
 				),
 			},
 			importStep(jsonCredResc, credentialJsonObjectKey),
@@ -90,8 +93,8 @@ func TestAccCredentialJson(t *testing.T) {
 					resource.TestCheckResourceAttr(jsonCredResc, DescriptionKey, jsonCredDescUpdate),
 					resource.TestCheckResourceAttr(jsonCredResc, credentialJsonObjectKey, `{"password":"password","username":"db-admin"}`),
 
-					testAccCheckCredentialJsonObjectHmac(provider),
-					testAccCheckCredentialJsonResourceExists(provider, jsonCredResc),
+					testAccCheckCredentialJsonObjectHmac(),
+					testAccCheckCredentialResourceExists(provider, jsonCredResc),
 				),
 			},
 			importStep(jsonCredResc, credentialJsonObjectKey),
@@ -111,32 +114,7 @@ func TestAccCredentialJson(t *testing.T) {
 	})
 }
 
-func testAccCheckCredentialJsonResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if testProvider.Meta() == nil {
-			t.Fatal("got nil provider metadata")
-		}
-		md := testProvider.Meta().(*metaData)
-
-		for _, rs := range s.RootModule().Resources {
-			switch rs.Type {
-			case "boundary_credential_json":
-				id := rs.Primary.ID
-
-				c := credentials.NewClient(md.client)
-				_, err := c.Read(context.Background(), id)
-				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
-					return fmt.Errorf("didn't get a 404 when reading destroyed json credential %q: %v", id, err)
-				}
-			default:
-				continue
-			}
-		}
-		return nil
-	}
-}
-
-func testAccCheckCredentialJsonResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
+func testAccCheckCredentialResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[name]
 		if !ok {
@@ -159,7 +137,40 @@ func testAccCheckCredentialJsonResourceExists(testProvider *schema.Provider, nam
 	}
 }
 
-func testAccCheckCredentialJsonObjectHmac(testProvider *schema.Provider) resource.TestCheckFunc {
+type credentialType string
+
+const (
+	jsonCredentialType             credentialType = "boundary_credential_json"
+	sshPrivateKeyCredentialType    credentialType = "boundary_credential_ssh_private_key"
+	usernamePasswordCredentialType credentialType = "boundary_credential_username_password"
+)
+
+func testAccCheckCredentialResourceDestroy(t *testing.T, testProvider *schema.Provider, typ credentialType) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if testProvider.Meta() == nil {
+			t.Fatal("got nil provider metadata")
+		}
+		md := testProvider.Meta().(*metaData)
+
+		for _, rs := range s.RootModule().Resources {
+			switch rs.Type {
+			case string(typ):
+				id := rs.Primary.ID
+
+				c := credentials.NewClient(md.client)
+				_, err := c.Read(context.Background(), id)
+				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
+					return fmt.Errorf("didn't get a 404 when reading destroyed credential %q: %v", id, err)
+				}
+			default:
+				continue
+			}
+		}
+		return nil
+	}
+}
+
+func testAccCheckCredentialJsonObjectHmac() resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[jsonCredResc]
 		if !ok {

internal/provider/resource_credential_library_vault.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
@@ -11,11 +14,13 @@ import (
 )
 
 const (
-	credentialStoreIdKey                     = "credential_store_id"
-	credentialLibraryVaultHttpMethodKey      = "http_method"
-	credentialLibraryVaultHttpRequestBodyKey = "http_request_body"
-	credentialLibraryVaultPathKey            = "path"
-	credentialLibraryCredentialTypeKey       = "credential_type"
+	credentialStoreIdKey                           = "credential_store_id"
+	credentialLibraryVaultType                     = "vault-generic"
+	credentialLibraryVaultHttpMethodKey            = "http_method"
+	credentialLibraryVaultHttpRequestBodyKey       = "http_request_body"
+	credentialLibraryVaultPathKey                  = "path"
+	credentialLibraryCredentialTypeKey             = "credential_type"
+	credentialLibraryCredentialMappingOverridesKey = "credential_mapping_overrides"
 )
 
 var libraryVaultAttrs = []string{
@@ -74,9 +79,15 @@ func resourceCredentialLibraryVault() *schema.Resource {
 				Required:    true,
 			},
 			credentialLibraryCredentialTypeKey: {
-				Description: "The type of credential the library generates.",
+				Description: "The type of credential the library generates. Cannot be updated on an existing resource.",
 				Type:        schema.TypeString,
 				Optional:    true,
+				ForceNew:    true,
+			},
+			credentialLibraryCredentialMappingOverridesKey: {
+				Description: "The credential mapping override.",
+				Type:        schema.TypeMap,
+				Optional:    true,
 			},
 		},
 	}
@@ -93,6 +104,10 @@ func setFromVaultCredentialLibraryResponseMap(d *schema.ResourceData, raw map[st
 		return err
 	}
 
+	if err := d.Set(credentialLibraryCredentialMappingOverridesKey, raw[credentialLibraryCredentialMappingOverridesKey]); err != nil {
+		return err
+	}
+
 	if attrsVal, ok := raw["attributes"]; ok {
 		attrs := attrsVal.(map[string]interface{})
 		for _, v := range libraryVaultAttrs {
@@ -129,6 +144,10 @@ func resourceCredentialLibraryCreateVault(ctx context.Context, d *schema.Resourc
 	if v, ok := d.GetOk(credentialLibraryCredentialTypeKey); ok {
 		opts = append(opts, credentiallibraries.WithCredentialType(v.(string)))
 	}
+	if v, ok := d.GetOk(credentialLibraryCredentialMappingOverridesKey); ok {
+		mappingOverrides := v.(map[string]interface{})
+		opts = append(opts, credentiallibraries.WithCredentialMappingOverrides(mappingOverrides))
+	}
 
 	var credentialStoreId string
 	cid, ok := d.GetOk(credentialStoreIdKey)
@@ -139,7 +158,7 @@ func resourceCredentialLibraryCreateVault(ctx context.Context, d *schema.Resourc
 	}
 
 	client := credentiallibraries.NewClient(md.client)
-	cr, err := client.Create(ctx, credentialStoreId, opts...)
+	cr, err := client.Create(ctx, credentialLibraryVaultType, credentialStoreId, opts...)
 	if err != nil {
 		return diag.Errorf("error creating credential library: %v", err)
 	}
@@ -216,6 +235,40 @@ func resourceCredentialLibraryUpdateVault(ctx context.Context, d *schema.Resourc
 			opts = append(opts, credentiallibraries.WithVaultCredentialLibraryPath(v.(string)))
 		}
 	}
+	if d.HasChange(credentialLibraryCredentialMappingOverridesKey) {
+		var oldMapping, newMapping map[string]interface{}
+		old, new := d.GetChange(credentialLibraryCredentialMappingOverridesKey)
+
+		if old == nil {
+			old = map[string]interface{}{}
+		}
+		oldMapping = old.(map[string]interface{})
+
+		if new == nil {
+			new = map[string]interface{}{}
+		}
+		newMapping = new.(map[string]interface{})
+
+		newAttrs := []string{}
+		for k := range newMapping {
+			newAttrs = append(newAttrs, k)
+		}
+
+		for oldAttr := range oldMapping {
+			isRemoved := true
+			for _, newAttr := range newAttrs {
+				if oldAttr == newAttr {
+					isRemoved = false
+					break
+				}
+			}
+			if isRemoved {
+				newMapping[oldAttr] = nil
+			}
+		}
+
+		opts = append(opts, credentiallibraries.WithCredentialMappingOverrides(newMapping))
+	}
 
 	if len(opts) > 0 {
 		opts = append(opts, credentiallibraries.WithAutomaticVersioning(true))

internal/provider/resource_credential_library_vault_ssh_certificate.go

@@ -0,0 +1,404 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package provider
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/credentiallibraries"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+const (
+	credentialLibraryVaultSshCertificateType               = "vault-ssh-certificate"
+	credentialLibraryVaultSshCertificatePathKey            = "path"
+	credentialLibraryVaultSshCertificateUsernameKey        = "username"
+	credentialLibraryVaultSshCertificateKeyTypeKey         = "key_type"
+	credentialLibraryVaultSshCertificateKeyBitsKey         = "key_bits"
+	credentialLibraryVaultSshCertificateTtlKey             = "ttl"
+	credentialLibraryVaultSshCertificateKeyIdKey           = "key_id"
+	credentialLibraryVaultSshCertificateCriticalOptionsKey = "critical_options"
+	credentialLibraryVaultSshCertificateExtensionsKey      = "extensions"
+)
+
+var libraryVaultSshCertificateAttrs = []string{
+	credentialLibraryVaultSshCertificatePathKey,
+	credentialLibraryVaultSshCertificateUsernameKey,
+	credentialLibraryVaultSshCertificateKeyTypeKey,
+	credentialLibraryVaultSshCertificateKeyBitsKey,
+	credentialLibraryVaultSshCertificateTtlKey,
+	credentialLibraryVaultSshCertificateKeyIdKey,
+	credentialLibraryVaultSshCertificateCriticalOptionsKey,
+	credentialLibraryVaultSshCertificateExtensionsKey,
+}
+
+func resourceCredentialLibraryVaultSshCertificate() *schema.Resource {
+	return &schema.Resource{
+		Description: "The credential library for Vault resource allows you to configure a Boundary credential library for Vault.",
+
+		CreateContext: resourceCredentialLibraryCreateVaultSshCertificate,
+		ReadContext:   resourceCredentialLibraryReadVaultSshCertificate,
+		UpdateContext: resourceCredentialLibraryUpdateVaultSshCertificate,
+		DeleteContext: resourceCredentialLibraryDeleteVaultSshCertificate,
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			IDKey: {
+				Description: "The ID of the Vault credential library.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			NameKey: {
+				Description: "The Vault credential library name. Defaults to the resource name.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			DescriptionKey: {
+				Description: "The Vault credential library description.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			credentialStoreIdKey: {
+				Description: "The ID of the credential store that this library belongs to.",
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+			},
+			credentialLibraryVaultSshCertificatePathKey: {
+				Description: "The path in Vault to request credentials from.",
+				Type:        schema.TypeString,
+				Required:    true,
+			},
+			credentialLibraryVaultSshCertificateUsernameKey: {
+				Description: "The username to use with the certificate returned by the library.",
+				Type:        schema.TypeString,
+				Required:    true,
+			},
+			credentialLibraryVaultSshCertificateKeyTypeKey: {
+				Description: "Specifies the desired key type; must be ed25519, ecdsa, or rsa.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			credentialLibraryVaultSshCertificateKeyBitsKey: {
+				Description: "Specifies the number of bits to use for the generated keys.",
+				Type:        schema.TypeInt,
+				Optional:    true,
+			},
+			credentialLibraryVaultSshCertificateTtlKey: {
+				Description: "Specifies the requested time to live for a certificate returned from the library.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			credentialLibraryVaultSshCertificateKeyIdKey: {
+				Description: "Specifies the key id a certificate should have.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			credentialLibraryVaultSshCertificateCriticalOptionsKey: {
+				Description: "Specifies a map of the critical options that the certificate should be signed for.",
+				Type:        schema.TypeMap,
+				Optional:    true,
+			},
+			credentialLibraryVaultSshCertificateExtensionsKey: {
+				Description: "Specifies a map of the extensions that the certificate should be signed for.",
+				Type:        schema.TypeMap,
+				Optional:    true,
+			},
+		},
+	}
+}
+
+func setFromVaultSshCertificateCredentialLibraryResponseMap(d *schema.ResourceData, raw map[string]interface{}) error {
+	if err := d.Set(NameKey, raw[NameKey]); err != nil {
+		return err
+	}
+	if err := d.Set(DescriptionKey, raw[DescriptionKey]); err != nil {
+		return err
+	}
+	if err := d.Set(credentialStoreIdKey, raw[credentialStoreIdKey]); err != nil {
+		return err
+	}
+
+	if attrsVal, ok := raw["attributes"]; ok {
+		attrs := attrsVal.(map[string]interface{})
+		for _, v := range libraryVaultSshCertificateAttrs {
+			if err := d.Set(v, attrs[v]); err != nil {
+				return err
+			}
+		}
+	}
+
+	d.SetId(raw["id"].(string))
+
+	return nil
+}
+
+func resourceCredentialLibraryCreateVaultSshCertificate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+
+	var opts []credentiallibraries.Option
+	if v, ok := d.GetOk(NameKey); ok {
+		opts = append(opts, credentiallibraries.WithName(v.(string)))
+	}
+	if v, ok := d.GetOk(DescriptionKey); ok {
+		opts = append(opts, credentiallibraries.WithDescription(v.(string)))
+	}
+	if v, ok := d.GetOk(credentialLibraryVaultSshCertificatePathKey); ok {
+		opts = append(opts, credentiallibraries.WithVaultCredentialLibraryPath(v.(string)))
+	}
+	if v, ok := d.GetOk(credentialLibraryVaultSshCertificateUsernameKey); ok {
+		opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryUsername(v.(string)))
+	}
+	if v, ok := d.GetOk(credentialLibraryVaultSshCertificateKeyTypeKey); ok {
+		opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryKeyType(v.(string)))
+	}
+	if v, ok := d.GetOk(credentialLibraryVaultSshCertificateKeyBitsKey); ok {
+		opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryKeyBits(uint32(v.(int))))
+	}
+	if v, ok := d.GetOk(credentialLibraryVaultSshCertificateTtlKey); ok {
+		opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryTtl(v.(string)))
+	}
+	if v, ok := d.GetOk(credentialLibraryVaultSshCertificateKeyIdKey); ok {
+		opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryKeyId(v.(string)))
+	}
+	if v, ok := d.GetOk(credentialLibraryVaultSshCertificateCriticalOptionsKey); ok {
+		if vv, ok := v.(map[string]any); ok {
+			co := make(map[string]string, len(vv))
+			for k, vvv := range vv {
+				co[k] = vvv.(string)
+			}
+			opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryCriticalOptions(co))
+		}
+	}
+	if v, ok := d.GetOk(credentialLibraryVaultSshCertificateExtensionsKey); ok {
+		if vv, ok := v.(map[string]any); ok {
+			e := make(map[string]string, len(vv))
+			for k, vvv := range vv {
+				e[k] = vvv.(string)
+			}
+			opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryExtensions(e))
+		}
+	}
+
+	var credentialStoreId string
+	cid, ok := d.GetOk(credentialStoreIdKey)
+	if ok {
+		credentialStoreId = cid.(string)
+	} else {
+		return diag.Errorf("no credential store ID is set")
+	}
+
+	client := credentiallibraries.NewClient(md.client)
+	cr, err := client.Create(ctx, credentialLibraryVaultSshCertificateType, credentialStoreId, opts...)
+	if err != nil {
+		return diag.Errorf("error creating credential library: %v", err)
+	}
+	if cr == nil {
+		return diag.Errorf("nil credential library after create")
+	}
+
+	if err := setFromVaultSshCertificateCredentialLibraryResponseMap(d, cr.GetResponse().Map); err != nil {
+		return diag.FromErr(err)
+	}
+
+	return nil
+}
+
+func resourceCredentialLibraryReadVaultSshCertificate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	client := credentiallibraries.NewClient(md.client)
+
+	cr, err := client.Read(ctx, d.Id())
+	if err != nil {
+		if apiErr := api.AsServerError(err); apiErr != nil && apiErr.Response().StatusCode() == http.StatusNotFound {
+			d.SetId("")
+			return nil
+		}
+		return diag.Errorf("error reading credential library: %v", err)
+	}
+	if cr == nil {
+		return diag.Errorf("credential library nil after read")
+	}
+
+	if err := setFromVaultSshCertificateCredentialLibraryResponseMap(d, cr.GetResponse().Map); err != nil {
+		return diag.FromErr(err)
+	}
+
+	return nil
+}
+
+func resourceCredentialLibraryUpdateVaultSshCertificate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	client := credentiallibraries.NewClient(md.client)
+
+	var opts []credentiallibraries.Option
+	if d.HasChange(NameKey) {
+		opts = append(opts, credentiallibraries.DefaultName())
+		nameVal, ok := d.GetOk(NameKey)
+		if ok {
+			opts = append(opts, credentiallibraries.WithName(nameVal.(string)))
+		}
+	}
+	if d.HasChange(DescriptionKey) {
+		opts = append(opts, credentiallibraries.DefaultDescription())
+		descVal, ok := d.GetOk(DescriptionKey)
+		if ok {
+			opts = append(opts, credentiallibraries.WithDescription(descVal.(string)))
+		}
+	}
+	if d.HasChange(credentialLibraryVaultSshCertificatePathKey) {
+		v, ok := d.GetOk(credentialLibraryVaultSshCertificatePathKey)
+		if ok {
+			opts = append(opts, credentiallibraries.WithVaultCredentialLibraryPath(v.(string)))
+		}
+	}
+	if d.HasChange(credentialLibraryVaultSshCertificateUsernameKey) {
+		v, ok := d.GetOk(credentialLibraryVaultSshCertificateUsernameKey)
+		if ok {
+			opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryUsername(v.(string)))
+		}
+	}
+	if d.HasChange(credentialLibraryVaultSshCertificateKeyTypeKey) {
+		v, ok := d.GetOk(credentialLibraryVaultSshCertificateKeyTypeKey)
+		if ok {
+			opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryKeyType(v.(string)))
+		}
+	}
+	if d.HasChange(credentialLibraryVaultSshCertificateKeyBitsKey) {
+		v, ok := d.GetOk(credentialLibraryVaultSshCertificateKeyBitsKey)
+		if ok {
+			opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryKeyBits(uint32(v.(int))))
+		}
+	}
+	if d.HasChange(credentialLibraryVaultSshCertificateTtlKey) {
+		v, ok := d.GetOk(credentialLibraryVaultSshCertificateTtlKey)
+		if ok {
+			opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryTtl(v.(string)))
+		}
+	}
+	if d.HasChange(credentialLibraryVaultSshCertificateKeyIdKey) {
+		v, ok := d.GetOk(credentialLibraryVaultSshCertificateKeyIdKey)
+		if ok {
+			opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryKeyId(v.(string)))
+		}
+	}
+	if d.HasChange(credentialLibraryVaultSshCertificateCriticalOptionsKey) {
+		var oldCriticalOptions, newCriticalOptions map[string]interface{}
+		old, new := d.GetChange(credentialLibraryVaultSshCertificateCriticalOptionsKey)
+
+		if old == nil {
+			old = map[string]interface{}{}
+		}
+		oldCriticalOptions = old.(map[string]interface{})
+
+		if new == nil {
+			new = map[string]interface{}{}
+		}
+		newCriticalOptions = new.(map[string]interface{})
+
+		newAttrs := []string{}
+		for k := range newCriticalOptions {
+			newAttrs = append(newAttrs, k)
+		}
+
+		for oldAttr := range oldCriticalOptions {
+			isRemoved := true
+			for _, newAttr := range newAttrs {
+				if oldAttr == newAttr {
+					isRemoved = false
+					break
+				}
+			}
+			if isRemoved {
+				newCriticalOptions[oldAttr] = nil
+			}
+		}
+
+		co := make(map[string]string, 0)
+		for k, v := range newCriticalOptions {
+			if v != nil {
+				co[k] = v.(string)
+			}
+		}
+		if len(co) == 0 {
+			co = nil
+		}
+		opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryCriticalOptions(co))
+
+	}
+	if d.HasChange(credentialLibraryVaultSshCertificateExtensionsKey) {
+		var oldExtensions, newExtensions map[string]interface{}
+		old, new := d.GetChange(credentialLibraryVaultSshCertificateExtensionsKey)
+
+		if old == nil {
+			old = map[string]interface{}{}
+		}
+		oldExtensions = old.(map[string]interface{})
+
+		if new == nil {
+			new = map[string]interface{}{}
+		}
+		newExtensions = new.(map[string]interface{})
+
+		newAttrs := []string{}
+		for k := range newExtensions {
+			newAttrs = append(newAttrs, k)
+		}
+
+		for oldAttr := range oldExtensions {
+			isRemoved := true
+			for _, newAttr := range newAttrs {
+				if oldAttr == newAttr {
+					isRemoved = false
+					break
+				}
+			}
+			if isRemoved {
+				newExtensions[oldAttr] = nil
+			}
+		}
+
+		e := make(map[string]string, 0)
+		for k, v := range newExtensions {
+			if v != nil {
+				e[k] = v.(string)
+			}
+		}
+		if len(e) == 0 {
+			e = nil
+		}
+		opts = append(opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryExtensions(e))
+	}
+
+	if len(opts) > 0 {
+		opts = append(opts, credentiallibraries.WithAutomaticVersioning(true))
+		aur, err := client.Update(ctx, d.Id(), 0, opts...)
+		if err != nil {
+			return diag.Errorf("error updating credential library: %v", err)
+		}
+
+		if err := setFromVaultSshCertificateCredentialLibraryResponseMap(d, aur.GetResponse().Map); err != nil {
+			return diag.Errorf("error setting credential library from response: %v", err)
+		}
+	}
+
+	return nil
+}
+
+func resourceCredentialLibraryDeleteVaultSshCertificate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	client := credentiallibraries.NewClient(md.client)
+
+	_, err := client.Delete(ctx, d.Id())
+	if err != nil {
+		return diag.Errorf("error deleting credential library: %v", err)
+	}
+
+	return nil
+}

internal/provider/resource_credential_library_vault_ssh_certificate_test.go

@@ -0,0 +1,208 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package provider
+
+import (
+	"fmt"
+	"strconv"
+	"testing"
+
+	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/boundary/testing/vault"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+const (
+	vaultSshCertCredResc            = "boundary_credential_library_vault_ssh_certificate.example"
+	vaultSshCertCredExtCOResc       = "boundary_credential_library_vault_ssh_certificate.ext_co_example"
+	vaultSshCertCredLibName         = "foo"
+	vaultSshCertCredLibDesc         = "the foo"
+	vaultSshCertCredLibPath         = "/ssh/sign/foo"
+	vaultSshCertCredUsername        = "bar"
+	vaultSshCertCredLibStringUpdate = "_random"
+	vaultSshCertCredKeyType         = "ecdsa"
+	vaultSshCertCredKeyBits         = 256
+)
+
+var vaultSshCertCredLibResource = fmt.Sprintf(`
+resource "boundary_credential_library_vault_ssh_certificate" "example" {
+	name                = "%s"
+	description         = "%s"
+	credential_store_id = boundary_credential_store_vault.example.id
+  	path                = "%s"
+  	username            = "%s"
+	key_type            = "ed25519"
+}`, vaultSshCertCredLibName,
+	vaultSshCertCredLibDesc,
+	vaultSshCertCredLibPath,
+	vaultSshCertCredUsername)
+
+var vaultSshCertCredLibResourceUpdate = fmt.Sprintf(`
+resource "boundary_credential_library_vault_ssh_certificate" "example" {
+  	name                = "%s"
+	description         = "%s"
+  	credential_store_id = boundary_credential_store_vault.example.id
+  	path                = "%s"
+  	username            = "%s"
+	key_type            = "%s"
+	key_bits            = %d
+}`, vaultSshCertCredLibName+vaultSshCertCredLibStringUpdate,
+	vaultSshCertCredLibDesc+vaultSshCertCredLibStringUpdate,
+	vaultSshCertCredLibPath+vaultSshCertCredLibStringUpdate,
+	vaultSshCertCredUsername+vaultSshCertCredLibStringUpdate,
+	vaultSshCertCredKeyType,
+	vaultSshCertCredKeyBits)
+
+var vaultSshCertCredLibResourceExtensionsCriticalOpts = fmt.Sprintf(`
+resource "boundary_credential_library_vault_ssh_certificate" "ext_co_example" {
+	name                = "%s"
+	description         = "%s"
+	credential_store_id = boundary_credential_store_vault.example.id
+  	path                = "%s"
+  	username            = "%s"
+	key_type            = "ed25519"
+	extensions = {
+	  permit-pty = ""
+    }
+	critical_options = {
+	  force-command = "/bin/foo"
+	}
+}`, vaultSshCertCredLibName,
+	vaultSshCertCredLibDesc,
+	vaultSshCertCredLibPath,
+	vaultSshCertCredUsername)
+
+var vaultSshCertCredLibResourceExtensionsCriticalOptsUpdate = fmt.Sprintf(`
+resource "boundary_credential_library_vault_ssh_certificate" "ext_co_example" {
+	name                = "%s"
+	description         = "%s"
+	credential_store_id = boundary_credential_store_vault.example.id
+  	path                = "%s"
+  	username            = "%s"
+	key_type            = "ed25519"
+	extensions = {
+	  permit-pty            = ""
+	  permit-X11-forwarding = ""
+    }
+}`, vaultSshCertCredLibName,
+	vaultSshCertCredLibDesc,
+	vaultSshCertCredLibPath,
+	vaultSshCertCredUsername)
+
+var vaultSshCertCredLibResourceExtensionsCriticalOptsUpdate2 = fmt.Sprintf(`
+resource "boundary_credential_library_vault_ssh_certificate" "ext_co_example" {
+	name                = "%s"
+	description         = "%s"
+	credential_store_id = boundary_credential_store_vault.example.id
+  	path                = "%s"
+  	username            = "%s"
+	key_type            = "ed25519"
+	extensions = {
+	  permit-pty = ""
+    }
+	critical_options = {
+	  force-command  = "/bin/foo"
+	  source-address = "10.10.0.0/16"
+	}
+}`, vaultSshCertCredLibName,
+	vaultSshCertCredLibDesc,
+	vaultSshCertCredLibPath,
+	vaultSshCertCredUsername)
+
+func TestAccCredentialLibraryVaultSshCertificate(t *testing.T) {
+	tc := controller.NewTestController(t, tcConfig...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	vc := vault.NewTestVaultServer(t)
+	_, token := vc.CreateToken(t)
+	credStoreRes := vaultCredStoreResource(vc,
+		vaultCredStoreName,
+		vaultCredStoreDesc,
+		vaultCredStoreNamespace,
+		"www.original.com",
+		token,
+		true)
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		IsUnitTest:        true,
+		ProviderFactories: providerFactories(&provider),
+		CheckDestroy:      testAccCheckCredentialLibraryVaultResourceDestroy(t, provider, sshCertVaultCredentialLibraryType),
+		Steps: []resource.TestStep{
+			{
+				// create
+				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultSshCertCredLibResource),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(vaultSshCertCredResc, NameKey, vaultSshCertCredLibName),
+					resource.TestCheckResourceAttr(vaultSshCertCredResc, DescriptionKey, vaultSshCertCredLibDesc),
+					resource.TestCheckResourceAttr(vaultSshCertCredResc, credentialLibraryVaultPathKey, vaultSshCertCredLibPath),
+					resource.TestCheckResourceAttr(vaultSshCertCredResc, credentialLibraryVaultSshCertificateUsernameKey, vaultSshCertCredUsername),
+
+					testAccCheckCredentialLibraryResourceExists(provider, vaultSshCertCredResc),
+				),
+			},
+			importStep(vaultSshCertCredResc),
+			{
+				// update
+				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultSshCertCredLibResourceUpdate),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(vaultSshCertCredResc, NameKey, vaultSshCertCredLibName+vaultSshCertCredLibStringUpdate),
+					resource.TestCheckResourceAttr(vaultSshCertCredResc, DescriptionKey, vaultSshCertCredLibDesc+vaultSshCertCredLibStringUpdate),
+					resource.TestCheckResourceAttr(vaultSshCertCredResc, credentialLibraryVaultPathKey, vaultSshCertCredLibPath+vaultSshCertCredLibStringUpdate),
+					resource.TestCheckResourceAttr(vaultSshCertCredResc, credentialLibraryVaultSshCertificateUsernameKey, vaultSshCertCredUsername+vaultSshCertCredLibStringUpdate),
+					resource.TestCheckResourceAttr(vaultSshCertCredResc, credentialLibraryVaultSshCertificateKeyTypeKey, vaultSshCertCredKeyType),
+					resource.TestCheckResourceAttr(vaultSshCertCredResc, credentialLibraryVaultSshCertificateKeyBitsKey, strconv.Itoa(vaultSshCertCredKeyBits)),
+
+					testAccCheckCredentialLibraryResourceExists(provider, vaultSshCertCredResc),
+				),
+			},
+			importStep(vaultSshCertCredResc),
+			{
+				// create with extensions and critical options
+				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultSshCertCredLibResourceExtensionsCriticalOpts),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, NameKey, vaultSshCertCredLibName),
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, DescriptionKey, vaultSshCertCredLibDesc),
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultPathKey, vaultSshCertCredLibPath),
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateUsernameKey, vaultSshCertCredUsername),
+
+					testAccCheckCredentialLibraryResourceExists(provider, vaultSshCertCredExtCOResc),
+				),
+			},
+			importStep(vaultSshCertCredExtCOResc),
+			{
+				// update with extensions and remove critical options
+				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultSshCertCredLibResourceExtensionsCriticalOptsUpdate),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, NameKey, vaultSshCertCredLibName),
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, DescriptionKey, vaultSshCertCredLibDesc),
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultPathKey, vaultSshCertCredLibPath),
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateUsernameKey, vaultSshCertCredUsername),
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateCriticalOptionsKey+".%", "0"),
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateExtensionsKey+".%", "2"),
+
+					testAccCheckCredentialLibraryResourceExists(provider, vaultSshCertCredExtCOResc),
+				),
+			},
+			importStep(vaultSshCertCredExtCOResc),
+			{
+				// update with extensions and remove critical options
+				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultSshCertCredLibResourceExtensionsCriticalOptsUpdate2),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, NameKey, vaultSshCertCredLibName),
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, DescriptionKey, vaultSshCertCredLibDesc),
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultPathKey, vaultSshCertCredLibPath),
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateUsernameKey, vaultSshCertCredUsername),
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateCriticalOptionsKey+".%", "2"),
+					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateExtensionsKey+".%", "1"),
+
+					testAccCheckCredentialLibraryResourceExists(provider, vaultSshCertCredExtCOResc),
+				),
+			},
+			importStep(vaultSshCertCredExtCOResc),
+		},
+	})
+}

internal/provider/resource_credential_library_vault_test.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
@@ -16,24 +19,27 @@ import (
 )
 
 const (
-	vaultCredResc            = "boundary_credential_library_vault.example"
-	vaultCredTypedResc       = "boundary_credential_library_vault.typed_example"
-	vaultCredLibName         = "foo"
-	vaultCredLibDesc         = "the foo"
-	vaultCredLibPath         = "/foo/bar"
-	vaultCredLibMethodGet    = "GET"
-	vaultCredLibMethodPost   = "POST"
-	vaultCredLibRequestBody  = "foobar"
-	vaultCredLibStringUpdate = "_random"
+	vaultCredResc                 = "boundary_credential_library_vault.example"
+	vaultCredTypedResc            = "boundary_credential_library_vault.typed_example"
+	vaultCredUsernamePasswordResc = "boundary_credential_library_vault.username_password_mapping_override"
+	vaultCredSshPrivateKeyResc    = "boundary_credential_library_vault.ssh_private_key_mapping_override"
+	vaultCredLibName              = "foo"
+	vaultCredLibNameOverride      = "base foo"
+	vaultCredLibDesc              = "the foo"
+	vaultCredLibPath              = "/foo/bar"
+	vaultCredLibMethodGet         = "GET"
+	vaultCredLibMethodPost        = "POST"
+	vaultCredLibRequestBody       = "foobar"
+	vaultCredLibStringUpdate      = "_random"
 )
 
 var vaultCredLibResource = fmt.Sprintf(`
 resource "boundary_credential_library_vault" "example" {
-	name  = "%s"
-	description = "%s"
+	name                = "%s"
+	description         = "%s"
 	credential_store_id = boundary_credential_store_vault.example.id
-  	path = "%s"
-  	http_method = "%s"
+  	path                = "%s"
+  	http_method         = "%s"
 }`, vaultCredLibName,
 	vaultCredLibDesc,
 	vaultCredLibPath,
@@ -41,12 +47,12 @@ resource "boundary_credential_library_vault" "example" {
 
 var vaultCredLibResourceUpdate = fmt.Sprintf(`
 resource "boundary_credential_library_vault" "example" {
-  	name  = "%s"
-	description = "%s"
+  	name                = "%s"
+	description         = "%s"
   	credential_store_id = boundary_credential_store_vault.example.id
-  	path = "%s"
-  	http_method = "%s"
-  	http_request_body = "%s"
+  	path                = "%s"
+  	http_method         = "%s"
+  	http_request_body   = "%s"
 }`, vaultCredLibName+vaultCredLibStringUpdate,
 	vaultCredLibDesc+vaultCredLibStringUpdate,
 	vaultCredLibPath+vaultCredLibStringUpdate,
@@ -66,6 +72,71 @@ resource "boundary_credential_library_vault" "typed_example" {
 	vaultCredLibPath,
 	vaultCredLibMethodGet)
 
+var vaultUsernamePasswordMappingOverrideCredLibResource = fmt.Sprintf(`
+resource "boundary_credential_library_vault" "username_password_mapping_override" {
+	name                         = "%s"
+	description                  = "%s"
+	credential_store_id          = boundary_credential_store_vault.example.id
+	path                         = "%s"
+	http_method                  = "%s"
+	credential_type              = "username_password"
+	credential_mapping_overrides = {
+		password_attribute = "alternative_password_label"
+		username_attribute = "alternative_username_label"
+	}
+}`, vaultCredLibNameOverride,
+	vaultCredLibDesc,
+	vaultCredLibPath,
+	vaultCredLibMethodGet)
+
+var vaultUsernamePasswordMappingOverrideCredLibResourceUpdate = fmt.Sprintf(`
+	resource "boundary_credential_library_vault" "username_password_mapping_override" {
+		name                         = "%s"
+		description                  = "%s"
+		credential_store_id          = boundary_credential_store_vault.example.id
+		path                         = "%s"
+		http_method                  = "%s"
+		credential_type              = "username_password"
+		credential_mapping_overrides = {
+			password_attribute = "updated_password_label"
+			username_attribute = "updated_username_label"
+		}
+	}`, vaultCredLibNameOverride,
+	vaultCredLibDesc,
+	vaultCredLibPath,
+	vaultCredLibMethodGet)
+
+var vaultUsernamePasswordMappingOverrideCredLibResourceRemove = fmt.Sprintf(`
+	resource "boundary_credential_library_vault" "username_password_mapping_override" {
+		name                         = "%s"
+		description                  = "%s"
+		credential_store_id          = boundary_credential_store_vault.example.id
+		path                         = "%s"
+		http_method                  = "%s"
+		credential_type              = "username_password"
+	}`, vaultCredLibNameOverride,
+	vaultCredLibDesc,
+	vaultCredLibPath,
+	vaultCredLibMethodGet)
+
+var vaultSshPrivateKeyMappingOverrideCredLibResource = fmt.Sprintf(`
+resource "boundary_credential_library_vault" "ssh_private_key_mapping_override" {
+	name                         = "%s"
+	description                  = "%s"
+	credential_store_id          = boundary_credential_store_vault.example.id
+	path                         = "%s"
+	http_method                  = "%s"
+	credential_type              = "ssh_private_key"
+	credential_mapping_overrides = {
+		private_key_attribute 			 = "alternative_key_label"
+		private_key_passphrase_attribute = "alternative_passphrase_label"
+		username_attribute 				 = "alternative_username_label"
+	}
+}`, vaultCredLibName,
+	vaultCredLibDesc,
+	vaultCredLibPath,
+	vaultCredLibMethodGet)
+
 func TestAccCredentialLibraryVault(t *testing.T) {
 	tc := controller.NewTestController(t, tcConfig...)
 	defer tc.Shutdown()
@@ -85,7 +156,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		IsUnitTest:        true,
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckCredentialLibraryVaultResourceDestroy(t, provider),
+		CheckDestroy:      testAccCheckCredentialLibraryVaultResourceDestroy(t, provider, baseVaultCredentialLibraryType),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -97,7 +168,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 					resource.TestCheckResourceAttr(vaultCredResc, credentialLibraryVaultHttpMethodKey, vaultCredLibMethodGet),
 					resource.TestCheckResourceAttr(vaultCredResc, credentialLibraryVaultHttpRequestBodyKey, ""),
 
-					testAccCheckCredentialLibraryVaultResourceExists(provider, vaultCredResc),
+					testAccCheckCredentialLibraryResourceExists(provider, vaultCredResc),
 				),
 			},
 			importStep(vaultCredResc),
@@ -112,7 +183,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 					resource.TestCheckResourceAttr(vaultCredResc, credentialLibraryVaultHttpMethodKey, vaultCredLibMethodPost),
 					resource.TestCheckResourceAttr(vaultCredResc, credentialLibraryVaultHttpRequestBodyKey, vaultCredLibRequestBody),
 
-					testAccCheckCredentialLibraryVaultResourceExists(provider, vaultCredResc),
+					testAccCheckCredentialLibraryResourceExists(provider, vaultCredResc),
 				),
 			},
 			importStep(vaultCredResc),
@@ -128,7 +199,75 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 					resource.TestCheckResourceAttr(vaultCredTypedResc, credentialLibraryVaultHttpRequestBodyKey, ""),
 					resource.TestCheckResourceAttr(vaultCredTypedResc, credentialLibraryCredentialTypeKey, "ssh_private_key"),
 
-					testAccCheckCredentialLibraryVaultResourceExists(provider, vaultCredTypedResc),
+					testAccCheckCredentialLibraryResourceExists(provider, vaultCredTypedResc),
+				),
+			},
+			importStep(vaultCredResc),
+
+			{
+				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate, vaultUsernamePasswordMappingOverrideCredLibResource),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, NameKey, vaultCredLibNameOverride),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, DescriptionKey, vaultCredLibDesc),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultPathKey, vaultCredLibPath),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultHttpMethodKey, vaultCredLibMethodGet),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultHttpRequestBodyKey, ""),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryCredentialTypeKey, "username_password"),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, "credential_mapping_overrides.password_attribute", "alternative_password_label"),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, "credential_mapping_overrides.username_attribute", "alternative_username_label"),
+
+					testAccCheckCredentialLibraryResourceExists(provider, vaultCredUsernamePasswordResc),
+				),
+			},
+			importStep(vaultCredResc),
+
+			{
+				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate, vaultUsernamePasswordMappingOverrideCredLibResourceUpdate),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, NameKey, vaultCredLibNameOverride),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, DescriptionKey, vaultCredLibDesc),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultPathKey, vaultCredLibPath),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultHttpMethodKey, vaultCredLibMethodGet),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultHttpRequestBodyKey, ""),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryCredentialTypeKey, "username_password"),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, "credential_mapping_overrides.password_attribute", "updated_password_label"),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, "credential_mapping_overrides.username_attribute", "updated_username_label"),
+
+					testAccCheckCredentialLibraryResourceExists(provider, vaultCredUsernamePasswordResc),
+				),
+			},
+			importStep(vaultCredResc),
+
+			{
+				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate, vaultUsernamePasswordMappingOverrideCredLibResourceRemove),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, NameKey, vaultCredLibNameOverride),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, DescriptionKey, vaultCredLibDesc),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultPathKey, vaultCredLibPath),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultHttpMethodKey, vaultCredLibMethodGet),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultHttpRequestBodyKey, ""),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryCredentialTypeKey, "username_password"),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryCredentialMappingOverridesKey+".%", "0"),
+
+					testAccCheckCredentialLibraryResourceExists(provider, vaultCredUsernamePasswordResc),
+				),
+			},
+			importStep(vaultCredResc),
+
+			{
+				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate, vaultSshPrivateKeyMappingOverrideCredLibResource),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, NameKey, vaultCredLibName),
+					resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, DescriptionKey, vaultCredLibDesc),
+					resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, credentialLibraryVaultPathKey, vaultCredLibPath),
+					resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, credentialLibraryVaultHttpMethodKey, vaultCredLibMethodGet),
+					resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, credentialLibraryVaultHttpRequestBodyKey, ""),
+					resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, credentialLibraryCredentialTypeKey, "ssh_private_key"),
+					resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, "credential_mapping_overrides.private_key_attribute", "alternative_key_label"),
+					resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, "credential_mapping_overrides.private_key_passphrase_attribute", "alternative_passphrase_label"),
+					resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, "credential_mapping_overrides.username_attribute", "alternative_username_label"),
+
+					testAccCheckCredentialLibraryResourceExists(provider, vaultCredSshPrivateKeyResc),
 				),
 			},
 			importStep(vaultCredResc),
@@ -136,7 +275,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 	})
 }
 
-func testAccCheckCredentialLibraryVaultResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
+func testAccCheckCredentialLibraryResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[name]
 		if !ok {
@@ -158,7 +297,14 @@ func testAccCheckCredentialLibraryVaultResourceExists(testProvider *schema.Provi
 	}
 }
 
-func testAccCheckCredentialLibraryVaultResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
+type vaultCredentialLibraryType string
+
+const (
+	baseVaultCredentialLibraryType    vaultCredentialLibraryType = "boundary_credential_library_vault"
+	sshCertVaultCredentialLibraryType vaultCredentialLibraryType = "boundary_credential_library_vault_ssh_certificate"
+)
+
+func testAccCheckCredentialLibraryVaultResourceDestroy(t *testing.T, testProvider *schema.Provider, typ vaultCredentialLibraryType) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if testProvider.Meta() == nil {
 			t.Fatal("got nil provider metadata")
@@ -167,7 +313,7 @@ func testAccCheckCredentialLibraryVaultResourceDestroy(t *testing.T, testProvide
 
 		for _, rs := range s.RootModule().Resources {
 			switch rs.Type {
-			case "boundary_credential_library_vault":
+			case string(typ):
 				id := rs.Primary.ID
 
 				c := credentiallibraries.NewClient(md.client)

internal/provider/resource_credential_ssh_private_key.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (

internal/provider/resource_credential_ssh_private_key_test.go

@@ -1,13 +1,12 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
-	"context"
 	"fmt"
-	"net/http"
 	"testing"
 
-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/credentials"
 	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -72,7 +71,7 @@ func TestAccCredentialSshPrivateKey(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		IsUnitTest:        true,
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckCredentialSshPrivateKeyResourceDestroy(t, provider),
+		CheckDestroy:      testAccCheckCredentialResourceDestroy(t, provider, sshPrivateKeyCredentialType),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -84,8 +83,8 @@ func TestAccCredentialSshPrivateKey(t *testing.T) {
 					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, credentialSshPrivateKeyPrivateKeyKey, privKey),
 					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, credentialSshPrivateKeyPassphraseKey, ""),
 
-					testAccCheckCredentialStoreSshPrivateKeyHmac(provider),
-					testAccCheckCredentialSshPrivateKeyResourceExists(provider, sshPrivateKeyCredResc),
+					testAccCheckCredentialStoreSshPrivateKeyHmac(),
+					testAccCheckCredentialResourceExists(provider, sshPrivateKeyCredResc),
 				),
 			},
 			importStep(sshPrivateKeyCredResc, credentialSshPrivateKeyPrivateKeyKey, credentialSshPrivateKeyPassphraseKey),
@@ -99,63 +98,15 @@ func TestAccCredentialSshPrivateKey(t *testing.T) {
 					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, credentialSshPrivateKeyPrivateKeyKey, privKeyUpdate),
 					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, credentialSshPrivateKeyPassphraseKey, privKeyUpdatePassphrase),
 
-					testAccCheckCredentialStoreSshPrivateKeyHmac(provider),
-					testAccCheckCredentialSshPrivateKeyResourceExists(provider, sshPrivateKeyCredResc),
+					testAccCheckCredentialStoreSshPrivateKeyHmac(),
+					testAccCheckCredentialResourceExists(provider, sshPrivateKeyCredResc),
 				),
 			},
 		},
 	})
 }
 
-func testAccCheckCredentialSshPrivateKeyResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[name]
-		if !ok {
-			return fmt.Errorf("not found: %s", name)
-		}
-
-		id := rs.Primary.ID
-		if id == "" {
-			return fmt.Errorf("no ID is set")
-		}
-		storeId = id
-
-		md := testProvider.Meta().(*metaData)
-		c := credentials.NewClient(md.client)
-		if _, err := c.Read(context.Background(), id); err != nil {
-			return fmt.Errorf("got an error reading %q: %w", id, err)
-		}
-
-		return nil
-	}
-}
-
-func testAccCheckCredentialSshPrivateKeyResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if testProvider.Meta() == nil {
-			t.Fatal("got nil provider metadata")
-		}
-		md := testProvider.Meta().(*metaData)
-
-		for _, rs := range s.RootModule().Resources {
-			switch rs.Type {
-			case "boundary_credential_ssh_private_key":
-				id := rs.Primary.ID
-
-				c := credentials.NewClient(md.client)
-				_, err := c.Read(context.Background(), id)
-				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
-					return fmt.Errorf("didn't get a 404 when reading destroyed credential %q: %v", id, err)
-				}
-			default:
-				continue
-			}
-		}
-		return nil
-	}
-}
-
-func testAccCheckCredentialStoreSshPrivateKeyHmac(testProvider *schema.Provider) resource.TestCheckFunc {
+func testAccCheckCredentialStoreSshPrivateKeyHmac() resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[sshPrivateKeyCredResc]
 		if !ok {

internal/provider/resource_credential_store_static.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (

internal/provider/resource_credential_store_static_test.go

@@ -1,17 +1,17 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
 	"context"
 	"fmt"
-	"net/http"
 	"testing"
 
-	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/credentialstores"
 	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
 )
 
 const (
@@ -47,7 +47,7 @@ func TestAccCredentialStoreStatic(t *testing.T) {
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckCredentialStoreStaticResourceDestroy(t, provider),
+		CheckDestroy:      testAccCheckCredentialStoreResourceDestroy(t, provider, staticStoreCredentialStoreType),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -56,7 +56,7 @@ func TestAccCredentialStoreStatic(t *testing.T) {
 					resource.TestCheckResourceAttr(staticCredStoreResc, NameKey, staticCredStoreName),
 					resource.TestCheckResourceAttr(staticCredStoreResc, DescriptionKey, staticCredStoreDesc),
 
-					testAccCheckCredentialStoreVaultResourceExists(provider, staticCredStoreResc),
+					testAccCheckCredentialStoreResourceExists(provider, staticCredStoreResc),
 				),
 			},
 			importStep(staticCredStoreResc),
@@ -67,7 +67,7 @@ func TestAccCredentialStoreStatic(t *testing.T) {
 					resource.TestCheckResourceAttr(staticCredStoreResc, NameKey, staticCredStoreName+staticCredStoreUpdate),
 					resource.TestCheckResourceAttr(staticCredStoreResc, DescriptionKey, staticCredStoreDesc+staticCredStoreUpdate),
 
-					testAccCheckCredentialStoreVaultResourceExists(provider, staticCredStoreResc),
+					testAccCheckCredentialStoreResourceExists(provider, staticCredStoreResc),
 				),
 			},
 			importStep(staticCredStoreResc),
@@ -112,28 +112,3 @@ func staticCredentialStoreExternalUpdate(t *testing.T, testProvider *schema.Prov
 		t.Fatal(fmt.Errorf("got an error updating %q: %w", cr.Item.Id, err))
 	}
 }
-
-func testAccCheckCredentialStoreStaticResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if testProvider.Meta() == nil {
-			t.Fatal("got nil provider metadata")
-		}
-		md := testProvider.Meta().(*metaData)
-
-		for _, rs := range s.RootModule().Resources {
-			switch rs.Type {
-			case "boundary_credential_store_static":
-				id := rs.Primary.ID
-
-				c := credentialstores.NewClient(md.client)
-				_, err := c.Read(context.Background(), id)
-				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
-					return fmt.Errorf("didn't get a 404 when reading destroyed static credential store %q: %v", id, err)
-				}
-			default:
-				continue
-			}
-		}
-		return nil
-	}
-}

internal/provider/resource_credential_store_vault.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
@@ -23,6 +26,7 @@ const (
 	credentialStoreVaultClientCertificateKeyKey     = "client_certificate_key"
 	credentialStoreVaultClientCertificateKeyHmacKey = "client_certificate_key_hmac"
 	credentialStoreType                             = "vault"
+	credentialStoreVaultWorkerFilterKey             = "worker_filter"
 )
 
 var storeVaultAttrs = []string{
@@ -120,6 +124,11 @@ func resourceCredentialStoreVault() *schema.Resource {
 				Type:        schema.TypeString,
 				Computed:    true,
 			},
+			credentialStoreVaultWorkerFilterKey: {
+				Description: "HCP Only. A filter used to control which PKI workers can handle Vault requests. This allows the use of private Vault instances with Boundary.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
 		},
 	}
 }
@@ -134,6 +143,9 @@ func setFromVaultCredentialStoreResponseMap(d *schema.ResourceData, raw map[stri
 	if err := d.Set(ScopeIdKey, raw[ScopeIdKey]); err != nil {
 		return diag.FromErr(err)
 	}
+	if err := d.Set(credentialStoreVaultWorkerFilterKey, raw[credentialStoreVaultWorkerFilterKey]); err != nil {
+		return diag.FromErr(err)
+	}
 
 	var diags diag.Diagnostics
 	csId := raw["id"]
@@ -225,6 +237,9 @@ func resourceCredentialStoreVaultCreate(ctx context.Context, d *schema.ResourceD
 	if v, ok := d.GetOk(credentialStoreVaultTokenKey); ok {
 		opts = append(opts, credentialstores.WithVaultCredentialStoreToken(v.(string)))
 	}
+	if v, ok := d.GetOk(credentialStoreVaultWorkerFilterKey); ok {
+		opts = append(opts, credentialstores.WithVaultCredentialStoreWorkerFilter(v.(string)))
+	}
 
 	var scope string
 	gotScope, ok := d.GetOk(ScopeIdKey)
@@ -356,6 +371,14 @@ func resourceCredentialStoreVaultUpdate(ctx context.Context, d *schema.ResourceD
 		}
 	}
 
+	if d.HasChange(credentialStoreVaultWorkerFilterKey) {
+		opts = append(opts, credentialstores.DefaultVaultCredentialStoreWorkerFilter())
+		v, ok := d.GetOk(credentialStoreVaultWorkerFilterKey)
+		if ok {
+			opts = append(opts, credentialstores.WithVaultCredentialStoreWorkerFilter(v.(string)))
+		}
+	}
+
 	if len(opts) > 0 {
 		opts = append(opts, credentialstores.WithAutomaticVersioning(true))
 		crUpdate, err := client.Update(ctx, d.Id(), 0, opts...)

internal/provider/resource_credential_store_vault_test.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
@@ -6,11 +9,11 @@ import (
 	"crypto/sha256"
 	"encoding/base64"
 	"fmt"
+	"github.com/hashicorp/boundary/api"
 	"net/http"
 	"strings"
 	"testing"
 
-	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/credentialstores"
 	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/boundary/testing/vault"
@@ -97,7 +100,7 @@ func TestAccCredentialStoreVault(t *testing.T) {
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckCredentialStoreVaultResourceDestroy(t, provider),
+		CheckDestroy:      testAccCheckCredentialStoreResourceDestroy(t, provider, vaultStoreCredentialStoreType),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -115,7 +118,7 @@ func TestAccCredentialStoreVault(t *testing.T) {
 					resource.TestCheckResourceAttr(vaultCredStoreResc, credentialStoreVaultClientCertificateKey, ""),
 					resource.TestCheckResourceAttr(vaultCredStoreResc, credentialStoreVaultClientCertificateKeyKey, ""),
 
-					testAccCheckCredentialStoreVaultResourceExists(provider, vaultCredStoreResc),
+					testAccCheckCredentialStoreResourceExists(provider, vaultCredStoreResc),
 				),
 			},
 			importStep(vaultCredStoreResc, credentialStoreVaultTokenKey, credentialStoreVaultClientCertificateKeyKey),
@@ -135,7 +138,7 @@ func TestAccCredentialStoreVault(t *testing.T) {
 					resource.TestCheckResourceAttr(vaultCredStoreResc, credentialStoreVaultClientCertificateKey, string(vcUpdate.ClientCert)),
 					resource.TestCheckResourceAttr(vaultCredStoreResc, credentialStoreVaultClientCertificateKeyKey, string(vcUpdate.ClientKey)),
 
-					testAccCheckCredentialStoreVaultResourceExists(provider, vaultCredStoreResc),
+					testAccCheckCredentialStoreResourceExists(provider, vaultCredStoreResc),
 				),
 			},
 			importStep(vaultCredStoreResc, credentialStoreVaultTokenKey, credentialStoreVaultClientCertificateKeyKey),
@@ -191,7 +194,7 @@ func externalUpdate(t *testing.T, testProvider *schema.Provider) {
 	}
 }
 
-func testAccCheckCredentialStoreVaultResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
+func testAccCheckCredentialStoreResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[name]
 		if !ok {
@@ -214,7 +217,14 @@ func testAccCheckCredentialStoreVaultResourceExists(testProvider *schema.Provide
 	}
 }
 
-func testAccCheckCredentialStoreVaultResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
+type credentialDestroyStoreType string
+
+const (
+	staticStoreCredentialStoreType credentialDestroyStoreType = "boundary_credential_store_static"
+	vaultStoreCredentialStoreType  credentialDestroyStoreType = "boundary_credential_store_vault"
+)
+
+func testAccCheckCredentialStoreResourceDestroy(t *testing.T, testProvider *schema.Provider, typ credentialDestroyStoreType) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if testProvider.Meta() == nil {
 			t.Fatal("got nil provider metadata")
@@ -223,13 +233,13 @@ func testAccCheckCredentialStoreVaultResourceDestroy(t *testing.T, testProvider
 
 		for _, rs := range s.RootModule().Resources {
 			switch rs.Type {
-			case "boundary_credential_store_vault":
+			case string(typ):
 				id := rs.Primary.ID
 
 				c := credentialstores.NewClient(md.client)
 				_, err := c.Read(context.Background(), id)
 				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
-					return fmt.Errorf("didn't get a 404 when reading destroyed Vault credential store %q: %v", id, err)
+					return fmt.Errorf("didn't get a 404 when reading destroyed static credential store %q: %v", id, err)
 				}
 			default:
 				continue

internal/provider/resource_credential_username_password.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (

internal/provider/resource_credential_username_password_test.go

@@ -1,12 +1,13 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
 	"context"
 	"fmt"
-	"net/http"
 	"testing"
 
-	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/credentials"
 	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
@@ -66,7 +67,7 @@ func TestAccCredentialUsernamePassword(t *testing.T) {
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckCredentialUsernamePasswordResourceDestroy(t, provider),
+		CheckDestroy:      testAccCheckCredentialResourceDestroy(t, provider, usernamePasswordCredentialType),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -77,8 +78,8 @@ func TestAccCredentialUsernamePassword(t *testing.T) {
 					resource.TestCheckResourceAttr(usernamePasswordCredResc, credentialUsernamePasswordUsernameKey, usernamePasswordCredUsername),
 					resource.TestCheckResourceAttr(usernamePasswordCredResc, credentialUsernamePasswordPasswordKey, usernamePasswordCredPassword),
 
-					testAccCheckCredentialStoreUsernamePasswordHmac(provider),
-					testAccCheckCredentialUsernamePasswordResourceExists(provider, usernamePasswordCredResc),
+					testAccCheckCredentialStoreUsernamePasswordHmac(),
+					testAccCheckCredentialResourceExists(provider, usernamePasswordCredResc),
 				),
 			},
 			importStep(usernamePasswordCredResc, credentialUsernamePasswordPasswordKey),
@@ -91,8 +92,8 @@ func TestAccCredentialUsernamePassword(t *testing.T) {
 					resource.TestCheckResourceAttr(usernamePasswordCredResc, credentialUsernamePasswordUsernameKey, usernamePasswordCredUsername+usernamePasswordCredUpdate),
 					resource.TestCheckResourceAttr(usernamePasswordCredResc, credentialUsernamePasswordPasswordKey, usernamePasswordCredPassword+usernamePasswordCredUpdate),
 
-					testAccCheckCredentialStoreUsernamePasswordHmac(provider),
-					testAccCheckCredentialUsernamePasswordResourceExists(provider, usernamePasswordCredResc),
+					testAccCheckCredentialStoreUsernamePasswordHmac(),
+					testAccCheckCredentialResourceExists(provider, usernamePasswordCredResc),
 				),
 			},
 			importStep(usernamePasswordCredResc, credentialUsernamePasswordPasswordKey),
@@ -134,55 +135,7 @@ func usernamePasswordCredExternalUpdate(t *testing.T, testProvider *schema.Provi
 	}
 }
 
-func testAccCheckCredentialUsernamePasswordResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[name]
-		if !ok {
-			return fmt.Errorf("not found: %s", name)
-		}
-
-		id := rs.Primary.ID
-		if id == "" {
-			return fmt.Errorf("no ID is set")
-		}
-		storeId = id
-
-		md := testProvider.Meta().(*metaData)
-		c := credentials.NewClient(md.client)
-		if _, err := c.Read(context.Background(), id); err != nil {
-			return fmt.Errorf("got an error reading %q: %w", id, err)
-		}
-
-		return nil
-	}
-}
-
-func testAccCheckCredentialUsernamePasswordResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if testProvider.Meta() == nil {
-			t.Fatal("got nil provider metadata")
-		}
-		md := testProvider.Meta().(*metaData)
-
-		for _, rs := range s.RootModule().Resources {
-			switch rs.Type {
-			case "boundary_credential_username_password":
-				id := rs.Primary.ID
-
-				c := credentials.NewClient(md.client)
-				_, err := c.Read(context.Background(), id)
-				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
-					return fmt.Errorf("didn't get a 404 when reading destroyed username password credential %q: %v", id, err)
-				}
-			default:
-				continue
-			}
-		}
-		return nil
-	}
-}
-
-func testAccCheckCredentialStoreUsernamePasswordHmac(testProvider *schema.Provider) resource.TestCheckFunc {
+func testAccCheckCredentialStoreUsernamePasswordHmac() resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[usernamePasswordCredResc]
 		if !ok {

internal/provider/resource_group.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
@@ -75,7 +78,7 @@ func setFromGroupResponseMap(d *schema.ResourceData, raw map[string]interface{})
 	return nil
 }
 
-func resourceGroupCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceGroupCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) (errs diag.Diagnostics) {
 	md := meta.(*metaData)
 
 	var scopeId string
@@ -108,7 +111,12 @@ func resourceGroupCreate(ctx context.Context, d *schema.ResourceData, meta inter
 	if gcr == nil {
 		return diag.Errorf("group nil after create")
 	}
-	raw := gcr.GetResponse().Map
+	apiResponse := gcr.GetResponse().Map
+	defer func() {
+		if err := setFromGroupResponseMap(d, apiResponse); err != nil {
+			errs = append(errs, diag.FromErr(err)...)
+		}
+	}()
 
 	if val, ok := d.GetOk(groupMemberIdsKey); ok {
 		list := val.(*schema.Set).List()
@@ -118,16 +126,12 @@ func resourceGroupCreate(ctx context.Context, d *schema.ResourceData, meta inter
 		}
 		gcsmr, err := grps.SetMembers(ctx, gcr.Item.Id, gcr.Item.Version, memberIds)
 		if err != nil {
-			return diag.Errorf("error setting principals on role: %v", err)
+			return diag.Errorf("error setting members on group: %v", err)
 		}
 		if gcsmr == nil {
 			return diag.Errorf("group nil after setting members")
 		}
-		raw = gcsmr.GetResponse().Map
-	}
-
-	if err := setFromGroupResponseMap(d, raw); err != nil {
-		return diag.FromErr(err)
+		apiResponse = gcsmr.GetResponse().Map
 	}
 
 	return nil

internal/provider/resource_group_test.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (

internal/provider/resource_host_catalog_plugin.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (

internal/provider/resource_host_catalog_plugin_test.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
@@ -5,10 +8,8 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"net/http"
 	"testing"
 
-	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/hostcatalogs"
 	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
@@ -153,7 +154,7 @@ func TestAccPluginHostCatalog(t *testing.T) {
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckPluginHostCatalogResourceDestroy(t, provider),
+		CheckDestroy:      testAccCheckHostCatalogResourceDestroy(t, provider, baseHostCatalogType),
 		Steps: []resource.TestStep{
 			{
 				// test create
@@ -365,27 +366,3 @@ func testAccCheckPluginHostCatalogResourceExists(testProvider *schema.Provider,
 		return nil
 	}
 }
-
-func testAccCheckPluginHostCatalogResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		md := testProvider.Meta().(*metaData)
-
-		for _, rs := range s.RootModule().Resources {
-			switch rs.Type {
-			case "boundary_host_catalog":
-
-				id := rs.Primary.ID
-				hcClient := hostcatalogs.NewClient(md.client)
-
-				_, err := hcClient.Read(context.Background(), id)
-				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
-					return fmt.Errorf("didn't get a 404 when reading destroyed host catalog %q: %v", id, err)
-				}
-
-			default:
-				continue
-			}
-		}
-		return nil
-	}
-}

internal/provider/resource_host_catalog_static.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (

internal/provider/resource_host_catalog_static_test.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
@@ -67,7 +70,7 @@ func testAccHostCatalog(t *testing.T, static bool) {
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckHostCatalogResourceDestroy(t, provider),
+		CheckDestroy:      testAccCheckHostCatalogResourceDestroy(t, provider, staticHostCatalogType),
 		Steps: []resource.TestStep{
 			{
 				// test create
@@ -116,13 +119,23 @@ func testAccCheckHostCatalogResourceExists(testProvider *schema.Provider, name s
 	}
 }
 
-func testAccCheckHostCatalogResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
+type hostCatalogType string
+
+const (
+	baseHostCatalogType   hostCatalogType = "boundary_host_catalog"
+	staticHostCatalogType hostCatalogType = "boundary_host_catalog_static"
+)
+
+func testAccCheckHostCatalogResourceDestroy(t *testing.T, testProvider *schema.Provider, typ hostCatalogType) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
+		if testProvider.Meta() == nil {
+			t.Fatal("got nil provider metadata")
+		}
 		md := testProvider.Meta().(*metaData)
 
 		for _, rs := range s.RootModule().Resources {
 			switch rs.Type {
-			case "boundary_host_catalog", "boundary_host_catalog_static":
+			case string(typ):
 
 				id := rs.Primary.ID
 				hcClient := hostcatalogs.NewClient(md.client)

internal/provider/resource_host_set_plugin.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (

internal/provider/resource_host_set_plugin_test.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
@@ -5,10 +8,8 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"net/http"
 	"testing"
 
-	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/hostsets"
 	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
@@ -86,7 +87,7 @@ func TestAccHostSetPlugin(t *testing.T) {
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckHostSetPluginResourceDestroy(t, provider),
+		CheckDestroy:      testAccCheckHostSetResourceDestroy(t, provider, baseHostSetType),
 		Steps: []resource.TestStep{
 			{
 				// test project hostset create
@@ -253,34 +254,6 @@ func testAccCheckHostSetPluginResourceExists(testProvider *schema.Provider, name
 	}
 }
 
-func testAccCheckHostSetPluginResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if testProvider.Meta() == nil {
-			t.Fatal("got nil provider metadata")
-		}
-		md := testProvider.Meta().(*metaData)
-
-		for _, rs := range s.RootModule().Resources {
-			switch rs.Type {
-			case "boundary_host_set":
-
-				id := rs.Primary.ID
-
-				hostsetsClient := hostsets.NewClient(md.client)
-
-				_, err := hostsetsClient.Read(context.Background(), id)
-				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
-					return fmt.Errorf("didn't get a 404 when reading destroyed host set %q: %v", id, apiErr)
-				}
-
-			default:
-				continue
-			}
-		}
-		return nil
-	}
-}
-
 func testAccCheckHostSetPluginPreferredEndpoints(t *testing.T, testProvider *schema.Provider, name string, wantPreferredEndpoints []string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[name]

internal/provider/resource_host_set_static.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
@@ -139,7 +142,7 @@ func setFromHostSetStaticResponseMap(d *schema.ResourceData, raw map[string]inte
 	return nil
 }
 
-func resourceHostSetStaticCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceHostSetStaticCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) (errs diag.Diagnostics) {
 	md := meta.(*metaData)
 
 	var hostsetHostCatalogId string
@@ -195,7 +198,12 @@ func resourceHostSetStaticCreate(ctx context.Context, d *schema.ResourceData, me
 	if hscr == nil {
 		return diag.Errorf("nil host set after create")
 	}
-	raw := hscr.GetResponse().Map
+	apiResponse := hscr.GetResponse().Map
+	defer func() {
+		if err := setFromHostSetStaticResponseMap(d, apiResponse); err != nil {
+			errs = append(errs, diag.FromErr(err)...)
+		}
+	}()
 
 	if hostIds != nil {
 		hsshr, err := hsClient.SetHosts(ctx, hscr.Item.Id, hscr.Item.Version, hostIds)
@@ -205,11 +213,7 @@ func resourceHostSetStaticCreate(ctx context.Context, d *schema.ResourceData, me
 		if hsshr == nil {
 			return diag.Errorf("nil host set after setting hosts")
 		}
-		raw = hsshr.GetResponse().Map
-	}
-
-	if err := setFromHostSetStaticResponseMap(d, raw); err != nil {
-		return diag.FromErr(err)
+		apiResponse = hsshr.GetResponse().Map
 	}
 
 	return nil

internal/provider/resource_host_set_static_test.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
@@ -83,7 +86,7 @@ func testAccHostSetStatic(t *testing.T, static bool) {
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckHostSetStaticResourceDestroy(t, provider),
+		CheckDestroy:      testAccCheckHostSetResourceDestroy(t, provider, baseHostSetType),
 		Steps: []resource.TestStep{
 			{
 				// test project hostset create
@@ -192,7 +195,11 @@ func testAccCheckHostSetStaticHostIDsSet(testProvider *schema.Provider, name str
 	}
 }
 
-func testAccCheckHostSetStaticResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
+type hostSetType string
+
+const baseHostSetType hostSetType = "boundary_host_set"
+
+func testAccCheckHostSetResourceDestroy(t *testing.T, testProvider *schema.Provider, typ hostSetType) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if testProvider.Meta() == nil {
 			t.Fatal("got nil provider metadata")
@@ -201,7 +208,7 @@ func testAccCheckHostSetStaticResourceDestroy(t *testing.T, testProvider *schema
 
 		for _, rs := range s.RootModule().Resources {
 			switch rs.Type {
-			case "boundary_host_set":
+			case string(typ):
 
 				id := rs.Primary.ID
 

internal/provider/resource_host_static.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (

internal/provider/resource_host_static_test.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (

internal/provider/resource_managed_group.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (

internal/provider/resource_managed_group_ldap.go

@@ -0,0 +1,221 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package provider
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/managedgroups"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+const managedGroupLdapGroupNamesKey = "group_names"
+
+func resourceManagedGroupLdap() *schema.Resource {
+	return &schema.Resource{
+		Description: "The managed group resource allows you to configure a Boundary group.",
+
+		CreateContext: resourceManagedGroupLdapCreate,
+		ReadContext:   resourceManagedGroupLdapRead,
+		UpdateContext: resourceManagedGroupLdapUpdate,
+		DeleteContext: resourceManagedGroupDelete,
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			IDKey: {
+				Description: "The ID of the group.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			NameKey: {
+				Description: "The managed group name. Defaults to the resource name.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			DescriptionKey: {
+				Description: "The managed group description.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			AuthMethodIdKey: {
+				Description: "The resource ID for the auth method.",
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+			},
+			managedGroupLdapGroupNamesKey: {
+				Description: "The list of groups that make up the managed group.",
+				Type:        schema.TypeList,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+				Required: true,
+			},
+		},
+	}
+}
+
+func setFromManagedGroupLdapResponseMap(d *schema.ResourceData, raw map[string]any) error {
+	if err := d.Set(NameKey, raw[NameKey]); err != nil {
+		return err
+	}
+	if err := d.Set(DescriptionKey, raw[DescriptionKey]); err != nil {
+		return err
+	}
+	if err := d.Set(AuthMethodIdKey, raw[AuthMethodIdKey]); err != nil {
+		return err
+	}
+
+	if attrsVal, ok := raw["attributes"]; ok {
+		attrs := attrsVal.(map[string]interface{})
+		if err := d.Set(managedGroupLdapGroupNamesKey, attrs[managedGroupLdapGroupNamesKey].([]interface{})); err != nil {
+			return err
+		}
+	}
+
+	d.SetId(raw[IDKey].(string))
+
+	return nil
+}
+
+func resourceManagedGroupLdapCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	grpClient := managedgroups.NewClient(md.client)
+
+	var authMethodId string
+	authMethodVal, ok := d.GetOk(AuthMethodIdKey)
+	if !ok {
+		return diag.Errorf("no auth method ID provided")
+	}
+	authMethodId = authMethodVal.(string)
+
+	var opts []managedgroups.Option
+	nameVal, ok := d.GetOk(NameKey)
+	if ok {
+		nameStr := nameVal.(string)
+		opts = append(opts, managedgroups.WithName(nameStr))
+	}
+
+	descVal, ok := d.GetOk(DescriptionKey)
+	if ok {
+		descStr := descVal.(string)
+		opts = append(opts, managedgroups.WithDescription(descStr))
+	}
+
+	if v, ok := d.GetOk(managedGroupLdapGroupNamesKey); ok {
+		names := make([]string, 0, len(v.([]any)))
+		for _, n := range v.([]any) {
+			names = append(names, n.(string))
+		}
+		opts = append(opts, managedgroups.WithLdapManagedGroupGroupNames(names))
+	}
+
+	grp, err := grpClient.Create(ctx, authMethodId, opts...)
+	if err != nil {
+		return diag.Errorf("error creating ldap managed group: %v", err)
+	}
+	if grp == nil {
+		return diag.Errorf("managed group nil after create")
+	}
+	raw := grp.GetResponse().Map
+
+	if err := setFromManagedGroupLdapResponseMap(d, raw); err != nil {
+		return diag.FromErr(err)
+	}
+
+	return nil
+}
+
+func resourceManagedGroupLdapRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	grpClient := managedgroups.NewClient(md.client)
+
+	grp, err := grpClient.Read(ctx, d.Id())
+	if err != nil {
+		if apiErr := api.AsServerError(err); apiErr.Response().StatusCode() == http.StatusNotFound {
+			d.SetId("")
+			return nil
+		}
+		return diag.Errorf("error reading managed group: %v", err)
+	}
+	if grp == nil {
+		return diag.Errorf("managed group nil after read")
+	}
+
+	if err := setFromManagedGroupLdapResponseMap(d, grp.GetResponse().Map); err != nil {
+		return diag.FromErr(err)
+	}
+
+	return nil
+}
+
+func resourceManagedGroupLdapUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	grpClient := managedgroups.NewClient(md.client)
+
+	var opts []managedgroups.Option
+	var name *string
+	if d.HasChange(NameKey) {
+		opts = append(opts, managedgroups.DefaultName())
+		nameVal, ok := d.GetOk(NameKey)
+		if ok {
+			nameStr := nameVal.(string)
+			name = &nameStr
+			opts = append(opts, managedgroups.WithName(nameStr))
+		}
+	}
+
+	var desc *string
+	if d.HasChange(DescriptionKey) {
+		opts = append(opts, managedgroups.DefaultDescription())
+		descVal, ok := d.GetOk(DescriptionKey)
+		if ok {
+			descStr := descVal.(string)
+			desc = &descStr
+			opts = append(opts, managedgroups.WithDescription(descStr))
+		}
+	}
+
+	var names []string
+	if d.HasChange(managedGroupLdapGroupNamesKey) {
+		if v, ok := d.GetOk(managedGroupLdapGroupNamesKey); ok {
+			names = make([]string, 0, len(v.([]any)))
+			for _, n := range v.([]any) {
+				names = append(names, n.(string))
+			}
+			opts = append(opts, managedgroups.WithLdapManagedGroupGroupNames(names))
+		}
+	}
+
+	if len(opts) > 0 {
+		opts = append(opts, managedgroups.WithAutomaticVersioning(true))
+		_, err := grpClient.Update(ctx, d.Id(), 0, opts...)
+		if err != nil {
+			return diag.Errorf("error updating managed group: %v", err)
+		}
+	}
+
+	if d.HasChange(NameKey) {
+		if err := d.Set(NameKey, name); err != nil {
+			return diag.FromErr(err)
+		}
+	}
+	if d.HasChange(DescriptionKey) {
+		if err := d.Set(DescriptionKey, desc); err != nil {
+			return diag.FromErr(err)
+		}
+	}
+	if d.HasChange(managedGroupLdapGroupNamesKey) {
+		if err := d.Set(managedGroupLdapGroupNamesKey, names); err != nil {
+			return diag.FromErr(err)
+		}
+	}
+
+	return nil
+}

internal/provider/resource_managed_group_ldap_test.go

@@ -0,0 +1,111 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package provider
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/hashicorp/boundary/api/managedgroups"
+	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+)
+
+var (
+	fooManagedGroupLdap = fmt.Sprintf(`
+resource "boundary_managed_group_ldap" "foo" {
+	name           = "%s"
+	description    = "%s"
+	auth_method_id = boundary_auth_method_ldap.test-ldap.id
+	group_names    = ["admin", "users"]
+}`, managedGroupName, managedGroupDescription)
+
+	fooManagedGroupLdapUpdate = fmt.Sprintf(`
+resource "boundary_managed_group_ldap" "foo" {
+	name           = "%s"
+	description    = "%s"
+	auth_method_id = boundary_auth_method_ldap.test-ldap.id
+	group_names    = ["admin-updated", "users-updated"]
+}`, managedGroupName+managedGroupUpdate, managedGroupDescription+managedGroupUpdate)
+)
+
+func TestAccManagedGroupLdap(t *testing.T) {
+	wrapper := testWrapper(context.Background(), t, tcRecoveryKey)
+	tc := controller.NewTestController(t, append(tcConfig, controller.WithRecoveryKms(wrapper))...)
+
+	createConfig := fmt.Sprintf(testAuthMethodLdap, testAuthMethodLdapDesc, testAuthMethodLdapCert)
+
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		ProviderFactories: providerFactories(&provider),
+		CheckDestroy:      testAccCheckManagedGroupResourceDestroy(t, provider, ldapManagedGroupType),
+		Steps: []resource.TestStep{
+			{
+				// test create
+				Config: testConfig(url, fooOrg, createConfig, fooManagedGroupLdap),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckManagedGroupResourceExists(provider, "boundary_managed_group_ldap.foo"),
+					resource.TestCheckResourceAttr("boundary_managed_group_ldap.foo", DescriptionKey, managedGroupDescription),
+					resource.TestCheckResourceAttr("boundary_managed_group_ldap.foo", NameKey, managedGroupName),
+					testAccCheckManagedGrpAttrAryValueSet(provider, "boundary_managed_group_ldap.foo", managedGroupLdapGroupNamesKey, []string{"admin", "users"}),
+				),
+			},
+			importStep("boundary_managed_group_ldap.foo"),
+			{
+				// test update
+				Config: testConfig(url, fooOrg, createConfig, fooManagedGroupLdapUpdate),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckManagedGroupResourceExists(provider, "boundary_managed_group_ldap.foo"),
+					resource.TestCheckResourceAttr("boundary_managed_group_ldap.foo", DescriptionKey, managedGroupDescription+managedGroupUpdate),
+					resource.TestCheckResourceAttr("boundary_managed_group_ldap.foo", NameKey, managedGroupName+managedGroupUpdate),
+					testAccCheckManagedGrpAttrAryValueSet(provider, "boundary_managed_group_ldap.foo", managedGroupLdapGroupNamesKey, []string{"admin-updated", "users-updated"}),
+				),
+			},
+			importStep("boundary_managed_group_ldap.foo"),
+		},
+	})
+}
+
+func testAccCheckManagedGrpAttrAryValueSet(testProvider *schema.Provider, name string, key string, strAry []string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("auth method resource not found: %s", name)
+		}
+
+		id := rs.Primary.ID
+		if id == "" {
+			return fmt.Errorf("auth method resource ID is not set")
+		}
+
+		md := testProvider.Meta().(*metaData)
+		grpClient := managedgroups.NewClient(md.client)
+
+		amr, err := grpClient.Read(context.Background(), id)
+		if err != nil {
+			return fmt.Errorf("Got an error when reading auth method %q: %v", id, err)
+		}
+
+		for _, got := range amr.Item.Attributes[key].([]interface{}) {
+			ok := false
+			for _, expected := range strAry {
+				if strings.TrimSpace(got.(string)) == strings.TrimSpace(expected) {
+					ok = true
+				}
+			}
+			if !ok {
+				return fmt.Errorf("value not found in boundary\n %s: %s\n", key, got.(string))
+			}
+		}
+
+		return nil
+	}
+}

internal/provider/resource_managed_group_test.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
@@ -54,7 +57,7 @@ func TestAccManagedGroup(t *testing.T) {
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckManagedGroupResourceDestroy(t, provider),
+		CheckDestroy:      testAccCheckManagedGroupResourceDestroy(t, provider, baseManagedGroupType),
 		Steps: []resource.TestStep{
 			{
 				// test create
@@ -105,7 +108,14 @@ func testAccCheckManagedGroupResourceExists(testProvider *schema.Provider, name
 	}
 }
 
-func testAccCheckManagedGroupResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
+type managedGroupType string
+
+const (
+	baseManagedGroupType managedGroupType = "boundary_managed_group"
+	ldapManagedGroupType managedGroupType = "boundary_managed_group_ldap"
+)
+
+func testAccCheckManagedGroupResourceDestroy(t *testing.T, testProvider *schema.Provider, typ managedGroupType) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if testProvider.Meta() == nil {
 			t.Fatal("got nil provider metadata")
@@ -115,7 +125,7 @@ func testAccCheckManagedGroupResourceDestroy(t *testing.T, testProvider *schema.
 
 		for _, rs := range s.RootModule().Resources {
 			switch rs.Type {
-			case "boundary_managed_group":
+			case string(typ):
 				grpClient := managedgroups.NewClient(md.client)
 				id := rs.Primary.ID
 

internal/provider/resource_role.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (
@@ -94,7 +97,7 @@ func setFromRoleResponseMap(d *schema.ResourceData, raw map[string]interface{})
 	return nil
 }
 
-func resourceRoleCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceRoleCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) (errs diag.Diagnostics) {
 	md := meta.(*metaData)
 
 	var scopeId string
@@ -151,18 +154,22 @@ func resourceRoleCreate(ctx context.Context, d *schema.ResourceData, meta interf
 	if tcr == nil {
 		return diag.Errorf("nil role after create")
 	}
-	raw := tcr.GetResponse().Map
+	apiResponse := tcr.GetResponse().Map
+	defer func() {
+		if err := setFromRoleResponseMap(d, apiResponse); err != nil {
+			errs = append(errs, diag.FromErr(err)...)
+		}
+	}()
 
-	var diags diag.Diagnostics
 	if principalIds != nil {
 		tspr, err := rc.SetPrincipals(ctx, tcr.Item.Id, 0, principalIds, roles.WithAutomaticVersioning(true))
 		switch {
 		case err != nil:
-			diags = append(diags, diag.Diagnostic{Severity: diag.Error, Summary: "error setting principals", Detail: err.Error()})
+			errs = append(errs, diag.Diagnostic{Severity: diag.Error, Summary: "error setting principals", Detail: err.Error()})
 		case tspr == nil:
-			diags = append(diags, diag.Diagnostic{Severity: diag.Error, Summary: "nil role after setting principal IDs"})
+			errs = append(errs, diag.Diagnostic{Severity: diag.Error, Summary: "nil role after setting principals"})
 		default:
-			raw = tspr.GetResponse().Map
+			apiResponse = tspr.GetResponse().Map
 		}
 	}
 
@@ -170,19 +177,15 @@ func resourceRoleCreate(ctx context.Context, d *schema.ResourceData, meta interf
 		tsgr, err := rc.SetGrants(ctx, tcr.Item.Id, 0, grantStrings, roles.WithAutomaticVersioning(true))
 		switch {
 		case err != nil:
-			diags = append(diags, diag.Diagnostic{Severity: diag.Error, Summary: "error setting grants", Detail: err.Error()})
+			errs = append(errs, diag.Diagnostic{Severity: diag.Error, Summary: "error setting grants", Detail: err.Error()})
 		case tsgr == nil:
-			diags = append(diags, diag.Diagnostic{Severity: diag.Error, Summary: "nil role after setting grant strings"})
+			errs = append(errs, diag.Diagnostic{Severity: diag.Error, Summary: "nil role after setting grants"})
 		default:
-			raw = tsgr.GetResponse().Map
+			apiResponse = tsgr.GetResponse().Map
 		}
 	}
 
-	if err := setFromRoleResponseMap(d, raw); err != nil {
-		return diag.FromErr(err)
-	}
-
-	return diags
+	return errs
 }
 
 func resourceRoleRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {

internal/provider/resource_role_test.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (

internal/provider/resource_scope.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (

internal/provider/resource_scope_test.go

@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package provider
 
 import (