chore: Prep for release

Add support for boundary_self_managed_worker resource. (#293 )
* add initial prototype of self managed worker resource and associated tests * Add self managed worker resource and associated tests * Update internal/provider/resource_self_managed_worker.go Accept suggested schema changes for tags Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com> * add environment variable check for worker led auth testing * change resource name from self_managed_worker to worker for consistency with the api * update tag schemas, ensure all attributes have descriptions * add generated docs for worker * add examples for worker resource * add examples for worker resource * remove merge conflict * Remove funtionality for reflecting tags in the schema * remove unused attributes (all tags) from schema, updates tests to use 'boundary_worker' on resource checks Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
2022-11-29 14:03:43 -08:00 · 2022-11-24 11:28:27 -05:00 · 2022-10-18 14:43:20 -07:00 · 2022-10-17 22:00:23 -07:00 · 2022-10-17 11:13:45 -07:00 · 2022-10-13 09:53:42 -07:00
19 changed files with 921 additions and 120 deletions
@@ -2,6 +2,27 @@

 Canonical reference for changes, improvements, and bugfixes for the Boundary Terraform provider.

+## 1.1.3 (November 29, 2022)
+
+### New and Improved
+
+* Add support for a workers as a resource
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/293)).
+
+## 1.1.2 (October 18, 2022)
+
+### New and Improved
+
+* Add support for setting mapping overrides for vault credential libraries
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/287)).
+
+### Bug Fixes
+
+* Improve error message when authenticating to boundary
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/290)).
+* Set state before returning an error when creating a resource
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/289))
+
 ## 1.1.1 (October 12, 2022)

 ### Bug Fixes
@@ -56,6 +56,33 @@ resource "boundary_credential_library_vault" "bar" {
 }
 EOT
 }
+
+resource "boundary_credential_library_vault" "baz" {
+  name                = "baz"
+  description         = "vault username password credential with mapping overrides"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "my/secret/baz" # change to Vault backend path
+  http_method         = "GET"
+  credential_type     = "username_password"
+  credential_mapping_overrides = {
+    password_attribute = "alternative_password_label"
+    username_attribute = "alternative_username_label"
+  }
+}
+
+resource "boundary_credential_library_vault" "quz" {
+  name                = "quz"
+  description         = "vault ssh private key credential with mapping overrides"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "my/secret/quz" # change to Vault backend path
+  http_method         = "GET"
+  credential_type     = "ssh_private_key"
+  credential_mapping_overrides = {
+    private_key_attribute            = "alternative_key_label"
+    private_key_passphrase_attribute = "alternative_passphrase_label"
+    username_attribute               = "alternative_username_label"
+  }
+}
 ```

 <!-- schema generated by tfplugindocs -->
@@ -68,6 +95,7 @@ EOT

 ### Optional

+- `credential_mapping_overrides` (Map of String) The credential mapping override.
 - `credential_type` (String) The type of credential the library generates.
 - `description` (String) The Vault credential library description.
 - `http_method` (String) The HTTP method the library uses when requesting credentials from Vault. Defaults to 'GET'
@@ -0,0 +1,42 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_worker Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The resource allows you to create a self-managed worker object.
+---
+
+# boundary_worker (Resource)
+
+The resource allows you to create a self-managed worker object.
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `scope_id` (String) The scope for the worker.
+
+### Optional
+
+- `description` (String) The description for the worker.
+- `name` (String) The name for the worker.
+- `worker_generated_auth_token` (String) The worker authentication token required to register the worker for the worker-led authentication flow. Leaving this blank will result in a controller generated token.
+
+### Read-Only
+
+- `address` (String) The accessible address of the self managed worker.
+- `authorized_actions` (List of String) A list of actions that the worker is entitled to perform.
+- `controller_generated_activation_token` (String) A single use token generated by the controller to be passed to the self-managed worker.
+- `id` (String) The ID of the worker.
+- `release_version` (Number) The version of the Boundary binary running on the self managed worker.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_worker.foo <my-id>
+```
@@ -41,3 +41,30 @@ resource "boundary_credential_library_vault" "bar" {
 }
 EOT
 }
+
+resource "boundary_credential_library_vault" "baz" {
+  name                = "baz"
+  description         = "vault username password credential with mapping overrides"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "my/secret/baz" # change to Vault backend path
+  http_method         = "GET"
+  credential_type     = "username_password"
+  credential_mapping_overrides = {
+    password_attribute = "alternative_password_label"
+    username_attribute = "alternative_username_label"
+  }
+}
+
+resource "boundary_credential_library_vault" "quz" {
+  name                = "quz"
+  description         = "vault ssh private key credential with mapping overrides"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "my/secret/quz" # change to Vault backend path
+  http_method         = "GET"
+  credential_type     = "ssh_private_key"
+  credential_mapping_overrides = {
+    private_key_attribute            = "alternative_key_label"
+    private_key_passphrase_attribute = "alternative_passphrase_label"
+    username_attribute               = "alternative_username_label"
+  }
+}
@@ -0,0 +1 @@
+terraform import boundary_worker.foo <my-id>
@@ -0,0 +1,13 @@
+resource "boundary_worker" "controller_led" {
+  scope_id                    = "global"
+  name                        = "worker 1"
+  description                 = "self managed worker with controlled led auth"
+  worker_generated_auth_token = var.worker_generated_auth_token
+}
+
+resource "boundary_self_managed_worker" "worker_led" {
+  scope_id                    = "global"
+  name                        = "worker 2"
+  description                 = "self managed worker with controlled led auth"
+  worker_generated_auth_token = var.worker_generated_auth_token
+}
@@ -3,20 +3,20 @@ module github.com/hashicorp/terraform-provider-boundary
 go 1.19

 require (
-	github.com/hashicorp/boundary v0.11.0
-	github.com/hashicorp/boundary/api v0.0.30
-	github.com/hashicorp/boundary/sdk v0.0.24
+	github.com/hashicorp/boundary v0.11.1
+	github.com/hashicorp/boundary/api v0.0.32
+	github.com/hashicorp/boundary/sdk v0.0.26
 	github.com/hashicorp/cap v0.2.0
 	github.com/hashicorp/go-cty v1.4.1-0.20200723130312-85980079f637
-	github.com/hashicorp/go-kms-wrapping/v2 v2.0.6-0.20220722192355-a843f53fa48d
+	github.com/hashicorp/go-kms-wrapping/v2 v2.0.6-0.20221122211539-47c893099f13
 	github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.5
 	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7
 	github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.3
 	github.com/hashicorp/terraform-plugin-docs v0.13.0
-	github.com/hashicorp/terraform-plugin-sdk/v2 v2.23.0
+	github.com/hashicorp/terraform-plugin-sdk/v2 v2.24.1
 	github.com/kr/pretty v0.3.1
 	github.com/mitchellh/go-homedir v1.1.0
-	github.com/stretchr/testify v1.8.0
+	github.com/stretchr/testify v1.8.1
 	golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa
 )

@@ -67,13 +67,13 @@ require (
 	github.com/hashicorp/go-bexpr v0.1.10 // indirect
 	github.com/hashicorp/go-checkpoint v0.5.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-dbw v0.0.0-20220725170111-b7cb3aa3d628 // indirect
+	github.com/hashicorp/go-dbw v0.0.0-20220910135738-ed4505749995 // indirect
 	github.com/hashicorp/go-hclog v1.2.2 // indirect
 	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
-	github.com/hashicorp/go-kms-wrapping/extras/kms/v2 v2.0.0-20220711120347-32232bae6803 // indirect
+	github.com/hashicorp/go-kms-wrapping/extras/kms/v2 v2.0.0-20221122211539-47c893099f13 // indirect
 	github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.2 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/hashicorp/go-plugin v1.4.4 // indirect
+	github.com/hashicorp/go-plugin v1.4.6 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.0 // indirect
 	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
 	github.com/hashicorp/go-secure-stdlib/base62 v0.1.2 // indirect
@@ -90,12 +90,12 @@ require (
 	github.com/hashicorp/golang-lru v0.5.4 // indirect
 	github.com/hashicorp/hc-install v0.4.0 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
-	github.com/hashicorp/hcl/v2 v2.14.0 // indirect
+	github.com/hashicorp/hcl/v2 v2.15.0 // indirect
 	github.com/hashicorp/logutils v1.0.0 // indirect
 	github.com/hashicorp/nodeenrollment v0.1.17 // indirect
 	github.com/hashicorp/terraform-exec v0.17.3 // indirect
 	github.com/hashicorp/terraform-json v0.14.0 // indirect
-	github.com/hashicorp/terraform-plugin-go v0.14.0 // indirect
+	github.com/hashicorp/terraform-plugin-go v0.14.1 // indirect
 	github.com/hashicorp/terraform-plugin-log v0.7.0 // indirect
 	github.com/hashicorp/terraform-registry-address v0.0.0-20220623143253-7d51757b572c // indirect
 	github.com/hashicorp/terraform-svchost v0.0.0-20200729002733-f050f53b9734 // indirect
@@ -163,17 +163,18 @@ require (
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	github.com/xo/dburl v0.11.0 // indirect
 	github.com/zalando/go-keyring v0.2.1 // indirect
-	github.com/zclconf/go-cty v1.11.0 // indirect
+	github.com/zclconf/go-cty v1.12.1 // indirect
 	go.uber.org/atomic v1.9.0 // indirect
-	golang.org/x/net v0.0.0-20220624214902-1bab6f366d9e // indirect
+	golang.org/x/exp v0.0.0-20220921164117-439092de6870 // indirect
+	golang.org/x/net v0.0.0-20220722155237-a158d28d115b // indirect
 	golang.org/x/oauth2 v0.0.0-20220722155238-128564f6959c // indirect
-	golang.org/x/sys v0.0.0-20220627191245-f75cf1eec38b // indirect
+	golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10 // indirect
 	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 // indirect
 	golang.org/x/text v0.3.7 // indirect
 	golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e // indirect
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/genproto v0.0.0-20220805133916-01dd62135a58 // indirect
-	google.golang.org/grpc v1.48.0 // indirect
+	google.golang.org/grpc v1.50.1 // indirect
 	google.golang.org/protobuf v1.28.1 // indirect
 	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
@@ -216,12 +216,8 @@ github.com/cloudflare/golz4 v0.0.0-20150217214814-ef862a3cdc58/go.mod h1:EOBUe0h
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
 github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20211001041855-01bcc9b48dfe/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cockroachdb/apd v1.1.0 h1:3LFP3629v+1aKXU5Q37mxmRxX/pIu1nijXydLShEq5I=
 github.com/cockroachdb/apd v1.1.0/go.mod h1:8Sl8LxpKi29FqWXR16WEFZRNSz3SoPzUzeMeY4+DwBQ=
 github.com/cockroachdb/cockroach-go/v2 v2.1.1/go.mod h1:7NtUnP6eK+l6k483WSYNrq3Kb23bWV10IRV1TyeSpwM=
@@ -396,7 +392,6 @@ github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.m
 github.com/envoyproxy/go-control-plane v0.9.9-0.20210217033140-668b12f5399d/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
 github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
-github.com/envoyproxy/go-control-plane v0.10.2-0.20220325020618-49ff273808a1/go.mod h1:KJwIaB5Mv44NWtYuAOFCVOjcI94vtpEz2JU/D2v6IjE=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/erikstmartin/go-testdb v0.0.0-20160219214506-8d10e4a1bae5 h1:Yzb9+7DPaBjB8zlTR87/ElzFsnQfuHnVUVqpZZIcV5Y=
 github.com/erikstmartin/go-testdb v0.0.0-20160219214506-8d10e4a1bae5/go.mod h1:a2zkGnVExMxdzMo3M0Hi/3sEU+cWnZpSni0O6/Yb/P0=
@@ -636,12 +631,12 @@ github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFb
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.2 h1:BqHID5W5qnMkug0Z8UmL8tN0gAy4jQ+B4WFt8cCgluU=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.2/go.mod h1:ZbS3MZTZq/apAfAEHGoB5HbsQQstoqP92SjAqtQ9zeg=
 github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed/go.mod h1:tMWxXQ9wFIaZeTI9F+hmhFiGpFmhOHzyShyFUhRm0H4=
-github.com/hashicorp/boundary v0.11.0 h1:JiqfBY2PKDGmnq//3rFtvOjjb7lK8m1u6nwYx3S+Qq4=
-github.com/hashicorp/boundary v0.11.0/go.mod h1:A5di0ps0ovurUNyhjoF8Ehog5ZzP0DlPluF2jKaniQc=
-github.com/hashicorp/boundary/api v0.0.30 h1:LEjxKnJHgsf/oaYFjLD4PAvc8osFmnrrvpTr9Co7SxU=
-github.com/hashicorp/boundary/api v0.0.30/go.mod h1:yroNrsyCVCSEKnrbyDeyS2iO0aMq7BTYtAptZWgIb60=
-github.com/hashicorp/boundary/sdk v0.0.24 h1:FX5YiZ6tKXIuqQDcLQPpCcAKP6dWQwRPpoyG28JhCJY=
-github.com/hashicorp/boundary/sdk v0.0.24/go.mod h1:rriE6QxdGmK8zDenGdeKDcZewVl8tzUdXOYTBf8uj+Y=
+github.com/hashicorp/boundary v0.11.1 h1:uv6tJDeO3/tLSs/KusCBtpaN5788HaAgLWSQkdJWgVw=
+github.com/hashicorp/boundary v0.11.1/go.mod h1:P/dLuatZTHoXDVABg4kqIreX+sspe3ww+QdTgpYRuwo=
+github.com/hashicorp/boundary/api v0.0.32 h1:vgz8rCkqCgXYX65646WXf+Mu+jiXOw766woOwUGY2Bs=
+github.com/hashicorp/boundary/api v0.0.32/go.mod h1:yroNrsyCVCSEKnrbyDeyS2iO0aMq7BTYtAptZWgIb60=
+github.com/hashicorp/boundary/sdk v0.0.26 h1:8L1sZnpVcWB2b8IrSAVuDTP+WEOt63pYlBvRi2Q8pWA=
+github.com/hashicorp/boundary/sdk v0.0.26/go.mod h1:rriE6QxdGmK8zDenGdeKDcZewVl8tzUdXOYTBf8uj+Y=
 github.com/hashicorp/cap v0.2.0 h1:Cgr1iDczX17y0PNF5VG+bWTtDiimYL8F18izMPbWNy4=
 github.com/hashicorp/cap v0.2.0/go.mod h1:zb3VvIFA0lM2lbmO69NjowV9dJzJnZS89TaM9blXPJA=
 github.com/hashicorp/dbassert v0.0.0-20210708202608-ecf920cf1ed8 h1:/3iubtqEdLgdXB6ue+WAKvbcpn313jjL5mQvU5ByymE=
@@ -664,8 +659,8 @@ github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9n
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
 github.com/hashicorp/go-cty v1.4.1-0.20200723130312-85980079f637 h1:Ud/6/AdmJ1R7ibdS0Wo5MWPj0T1R0fkpaD087bBaW8I=
 github.com/hashicorp/go-cty v1.4.1-0.20200723130312-85980079f637/go.mod h1:EiZBMaudVLy8fmjf9Npq1dq9RalhveqZG5w/yz3mHWs=
-github.com/hashicorp/go-dbw v0.0.0-20220725170111-b7cb3aa3d628 h1:+K6QNSsNVaiSWoNKqs1omUzhIWiKLxGuK6sRK3Ch+84=
-github.com/hashicorp/go-dbw v0.0.0-20220725170111-b7cb3aa3d628/go.mod h1:kRCoWMcOV6AHTOYq9ZILAD7xPzd5fU2M1QKJnhmOH6g=
+github.com/hashicorp/go-dbw v0.0.0-20220910135738-ed4505749995 h1:+cSg/gVZ1RMFeZbZoQTbNu8pnb30bDQ6jysmKBKDSvg=
+github.com/hashicorp/go-dbw v0.0.0-20220910135738-ed4505749995/go.mod h1:+GVM0D4y16TzXQWrVZKv3cjNHF2M7cHEBPaDAON3V6I=
 github.com/hashicorp/go-hclog v0.0.0-20180709165350-ff2cf002a8dd/go.mod h1:9bjs9uLqI8l75knNv3lV1kA55veR+WUPSiKIWcQHudI=
 github.com/hashicorp/go-hclog v0.8.0/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
 github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
@@ -678,12 +673,12 @@ github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjh
 github.com/hashicorp/go-immutable-radix v1.3.1 h1:DKHmCUm2hRBK510BaiZlwvpD40f8bJFeZnpfm2KLowc=
 github.com/hashicorp/go-immutable-radix v1.3.1/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
 github.com/hashicorp/go-kms-wrapping/entropy v0.1.0/go.mod h1:d1g9WGtAunDNpek8jUIEJnBlbgKS1N2Q61QkHiZyR1g=
-github.com/hashicorp/go-kms-wrapping/extras/kms/v2 v2.0.0-20220711120347-32232bae6803 h1:PdSXkY+aAn/19A+lorRNXkfu5zQ9eZTBMNyLdHpeW0c=
-github.com/hashicorp/go-kms-wrapping/extras/kms/v2 v2.0.0-20220711120347-32232bae6803/go.mod h1:tTUGkZXcXW2y6A2Z8o2CVxHKSPNgDfUHLBhHCJb0Lts=
+github.com/hashicorp/go-kms-wrapping/extras/kms/v2 v2.0.0-20221122211539-47c893099f13 h1:486QccSsJAKonkWSZmBn5GWzZCW3UV3OwMoOGUXJBO4=
+github.com/hashicorp/go-kms-wrapping/extras/kms/v2 v2.0.0-20221122211539-47c893099f13/go.mod h1:qbLdiZhFd182vRSOlhBV/OarUcJVTOF2WklPwHs8mYQ=
 github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.2 h1:it114Kjpk79JVh6AfxFMP5oi1gb+RPzcSLiG3zF/J0w=
 github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.2/go.mod h1:b9mq0bG5xJ10ZcTEQJLZ22O9y71hIt2MGTLqROA/SAM=
-github.com/hashicorp/go-kms-wrapping/v2 v2.0.6-0.20220722192355-a843f53fa48d h1:mOtPXWIp4cWKNt9S55IuYAdyUgNtCfUAEVIjcXDx59E=
-github.com/hashicorp/go-kms-wrapping/v2 v2.0.6-0.20220722192355-a843f53fa48d/go.mod h1:sDQAfwJGv25uGPZA04x87ERglCG6avnRcBT9wYoMII8=
+github.com/hashicorp/go-kms-wrapping/v2 v2.0.6-0.20221122211539-47c893099f13 h1:4YewFQjQJNAzXtahRax77IFi0emoYvPZGESfi+KCpGg=
+github.com/hashicorp/go-kms-wrapping/v2 v2.0.6-0.20221122211539-47c893099f13/go.mod h1:sDQAfwJGv25uGPZA04x87ERglCG6avnRcBT9wYoMII8=
 github.com/hashicorp/go-multierror v0.0.0-20161216184304-ed905158d874/go.mod h1:JMRHfdO9jKNzS/+BTlxCjKNQHg/jZAft8U7LloJvN7I=
 github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
 github.com/hashicorp/go-multierror v1.1.0/go.mod h1:spPvp8C1qA32ftKqdAHm4hHTbPw+vmowP0z+KUhOZdA=
@@ -691,8 +686,8 @@ github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+l
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/hashicorp/go-plugin v1.0.1/go.mod h1:++UyYGoz3o5w9ZzAdZxtQKrWWP+iqPBn3cQptSMzBuY=
 github.com/hashicorp/go-plugin v1.4.3/go.mod h1:5fGEH17QVwTTcR0zV7yhDPLLmFX9YSZ38b18Udy6vYQ=
-github.com/hashicorp/go-plugin v1.4.4 h1:NVdrSdFRt3SkZtNckJ6tog7gbpRrcbOjQi/rgF7JYWQ=
-github.com/hashicorp/go-plugin v1.4.4/go.mod h1:viDMjcLJuDui6pXb8U4HVfb8AamCWhHGUjr2IrTF67s=
+github.com/hashicorp/go-plugin v1.4.6 h1:MDV3UrKQBM3du3G7MApDGvOsMYy3JQJ4exhSoKBAeVA=
+github.com/hashicorp/go-plugin v1.4.6/go.mod h1:viDMjcLJuDui6pXb8U4HVfb8AamCWhHGUjr2IrTF67s=
 github.com/hashicorp/go-retryablehttp v0.5.3/go.mod h1:9B5zBasrRhHXnJnui7y6sL7es7NDiJgTc6Er0maI1Xs=
 github.com/hashicorp/go-retryablehttp v0.6.6/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
 github.com/hashicorp/go-retryablehttp v0.7.0 h1:eu1EI/mbirUgP5C8hVsTNaGZreBDlYiwC1FZWkvQPQ4=
@@ -745,8 +740,8 @@ github.com/hashicorp/hc-install v0.4.0 h1:cZkRFr1WVa0Ty6x5fTvL1TuO1flul231rWkGH9
 github.com/hashicorp/hc-install v0.4.0/go.mod h1:5d155H8EC5ewegao9A4PUTMNPZaq+TbOzkJJZ4vrXeI=
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
-github.com/hashicorp/hcl/v2 v2.14.0 h1:jX6+Q38Ly9zaAJlAjnFVyeNSNCKKW8D0wvyg7vij5Wc=
-github.com/hashicorp/hcl/v2 v2.14.0/go.mod h1:e4z5nxYlWNPdDSNYX+ph14EvWYMFm3eP0zIUqPc2jr0=
+github.com/hashicorp/hcl/v2 v2.15.0 h1:CPDXO6+uORPjKflkWCCwoWc9uRp+zSIPcCQ+BrxV7m8=
+github.com/hashicorp/hcl/v2 v2.15.0/go.mod h1:JRmR89jycNkrrqnMmvPDMd56n1rQJ2Q6KocSLCMCXng=
 github.com/hashicorp/logutils v1.0.0 h1:dLEQVugN8vlakKOUE3ihGLTZJRB4j+M2cdTm/ORI65Y=
 github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
 github.com/hashicorp/nodeenrollment v0.1.17 h1:ZaGNugd3EOZIdJxgC5bUA1CbHZ/OKZcgXnquzoFql6E=
@@ -757,12 +752,12 @@ github.com/hashicorp/terraform-json v0.14.0 h1:sh9iZ1Y8IFJLx+xQiKHGud6/TSUCM0N8e
 github.com/hashicorp/terraform-json v0.14.0/go.mod h1:5A9HIWPkk4e5aeeXIBbkcOvaZbIYnAIkEyqP2pNSckM=
 github.com/hashicorp/terraform-plugin-docs v0.13.0 h1:6e+VIWsVGb6jYJewfzq2ok2smPzZrt1Wlm9koLeKazY=
 github.com/hashicorp/terraform-plugin-docs v0.13.0/go.mod h1:W0oCmHAjIlTHBbvtppWHe8fLfZ2BznQbuv8+UD8OucQ=
-github.com/hashicorp/terraform-plugin-go v0.14.0 h1:ttnSlS8bz3ZPYbMb84DpcPhY4F5DsQtcAS7cHo8uvP4=
-github.com/hashicorp/terraform-plugin-go v0.14.0/go.mod h1:2nNCBeRLaenyQEi78xrGrs9hMbulveqG/zDMQSvVJTE=
+github.com/hashicorp/terraform-plugin-go v0.14.1 h1:cwZzPYla82XwAqpLhSzdVsOMU+6H29tczAwrB0z9Zek=
+github.com/hashicorp/terraform-plugin-go v0.14.1/go.mod h1:Bc/K6K26BQ2FHqIELPbpKtt2CzzbQou+0UQF3/0NsCQ=
 github.com/hashicorp/terraform-plugin-log v0.7.0 h1:SDxJUyT8TwN4l5b5/VkiTIaQgY6R+Y2BQ0sRZftGKQs=
 github.com/hashicorp/terraform-plugin-log v0.7.0/go.mod h1:p4R1jWBXRTvL4odmEkFfDdhUjHf9zcs/BCoNHAc7IK4=
-github.com/hashicorp/terraform-plugin-sdk/v2 v2.23.0 h1:D4EeQm0piYXIHp6ZH3zjyP2Elq6voC64x3GZptaiefA=
-github.com/hashicorp/terraform-plugin-sdk/v2 v2.23.0/go.mod h1:xkJGavPvP9kYS/VbiW8o7JuTNgPwm7Tiw/Ie/b46r4c=
+github.com/hashicorp/terraform-plugin-sdk/v2 v2.24.1 h1:zHcMbxY0+rFO9gY99elV/XC/UnQVg7FhRCbj1i5b7vM=
+github.com/hashicorp/terraform-plugin-sdk/v2 v2.24.1/go.mod h1:+tNlb0wkfdsDJ7JEiERLz4HzM19HyiuIoGzTsM7rPpw=
 github.com/hashicorp/terraform-registry-address v0.0.0-20220623143253-7d51757b572c h1:D8aRO6+mTqHfLsK/BC3j5OAoogv1WLRWzY1AaTo3rBg=
 github.com/hashicorp/terraform-registry-address v0.0.0-20220623143253-7d51757b572c/go.mod h1:Wn3Na71knbXc1G8Lh+yu/dQWWJeFQEpDeJMtWMtlmNI=
 github.com/hashicorp/terraform-svchost v0.0.0-20200729002733-f050f53b9734 h1:HKLsbzeOsfXmKNpr3GiT18XAblV0BjCbzL8KQAMZGa0=
@@ -1240,8 +1235,9 @@ github.com/stretchr/objx v0.0.0-20180129172003-8a3f7159479f/go.mod h1:HFkY916IF+
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
-github.com/stretchr/objx v0.4.0 h1:M2gUjqZET1qApGOWNSnZ49BAIMX4F/1plDv3+l31EJ4=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/testify v0.0.0-20180303142811-b89eecf5ca5d/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
@@ -1252,8 +1248,9 @@ github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
-github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/syndtr/gocapability v0.0.0-20170704070218-db04d3cc01c8/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
 github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
 github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
@@ -1314,8 +1311,8 @@ github.com/zalando/go-keyring v0.2.1/go.mod h1:g63M2PPn0w5vjmEbwAX3ib5I+41zdm4es
 github.com/zclconf/go-cty v1.1.0/go.mod h1:xnAOWiHeOqg2nWS62VtQ7pbOu17FtxJNW8RLEih+O3s=
 github.com/zclconf/go-cty v1.2.0/go.mod h1:hOPWgoHbaTUnI5k4D2ld+GRpFJSCe6bCM7m1q/N4PQ8=
 github.com/zclconf/go-cty v1.10.0/go.mod h1:vVKLxnk3puL4qRAv72AO+W99LUD4da90g3uUAzyuvAk=
-github.com/zclconf/go-cty v1.11.0 h1:726SxLdi2SDnjY+BStqB9J1hNp4+2WlzyXLuimibIe0=
-github.com/zclconf/go-cty v1.11.0/go.mod h1:s9IfD1LK5ccNMSWCVFCE2rJfHiZgi7JijgeWIMfhLvA=
+github.com/zclconf/go-cty v1.12.1 h1:PcupnljUm9EIvbgSHQnHhUr3fO6oFmkOrvs2BAFNXXY=
+github.com/zclconf/go-cty v1.12.1/go.mod h1:s9IfD1LK5ccNMSWCVFCE2rJfHiZgi7JijgeWIMfhLvA=
 github.com/zclconf/go-cty-debug v0.0.0-20191215020915-b22d67c1ba0b/go.mod h1:ZRKQfBXbGkpdV6QMzT3rU1kSTAnfu1dO8dPKjYprgj8=
 github.com/zenazn/goji v0.9.0/go.mod h1:7S9M489iMyHBNxwZnk9/EHS098H4/F6TATF2mIxtB1Q=
 gitlab.com/nyarla/go-crypt v0.0.0-20160106005555-d9a5dc2b789b/go.mod h1:T3BPAOm2cqquPa0MKWeNkmOM5RQsRhkrwMWonFMN7fE=
@@ -1397,6 +1394,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
+golang.org/x/exp v0.0.0-20220921164117-439092de6870 h1:j8b6j9gzSigH28O5SjSpQSSh9lFd6f5D/q0aHjNTulc=
+golang.org/x/exp v0.0.0-20220921164117-439092de6870/go.mod h1:cyybsKvd6eL0RnXn6p/Grxp8F5bW7iYuBgsNCOHpMYE=
 golang.org/x/image v0.0.0-20180708004352-c73c2afc3b81/go.mod h1:ux5Hcp/YLpHSI86hEcLt0YII63i6oz57MZXIpbrjZUs=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
@@ -1494,8 +1493,8 @@ golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d/go.mod h1:9nx3DQGgdP8bBQD5qx
 golang.org/x/net v0.0.0-20211013171255-e13a2654a71e/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211216030914-fe4d6282115f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20220624214902-1bab6f366d9e h1:TsQ7F31D3bUCLeqPT0u+yjp1guoArKaNKmCr22PYgTQ=
-golang.org/x/net v0.0.0-20220624214902-1bab6f366d9e/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b h1:PxfKdU9lEEDYjdIzOtC4qFWgkU2rGHdKlKowJSMN9h0=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/oauth2 v0.0.0-20180227000427-d7d64896b5ff/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181106182150-f42d05182288/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
@@ -1525,8 +1524,8 @@ golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20210220032951-036812b2e83c h1:5KslGYwFpkhGh+Q16bwMP3cOontH8FOep7tGV86Y7SQ=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4 h1:uVc8UZUe6tr40fFVnUP5Oj+veunVezqYl9z7DYw9xzw=
 golang.org/x/sys v0.0.0-20180224232135-f6cff0780e54/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1636,8 +1635,8 @@ golang.org/x/sys v0.0.0-20211013075003-97ac67df715c/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220627191245-f75cf1eec38b h1:2n253B2r0pYSmEV+UNCQoPfU/FiaizQEK5Gu4Bq4JE8=
-golang.org/x/sys v0.0.0-20220627191245-f75cf1eec38b/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10 h1:WIoqL4EROvwiPdUtaip4VcDdpZ4kha7wBWZrbVKCIZg=
+golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 h1:JGgROgKl9N8DuW20oFS5gxc+lE67/N3FcwmBPMe7ArY=
@@ -1733,7 +1732,7 @@ golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.10 h1:QjFRCZxdOhBJ/UNgnBZLbNV13DlbnK0quyivTnXJM20=
+golang.org/x/tools v0.1.12 h1:VveCTK38A2rkS8ZqFY25HIDFscX5X9OoEhJd3quQmXU=
 golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1875,8 +1874,8 @@ google.golang.org/grpc v1.38.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQ
 google.golang.org/grpc v1.39.0/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
 google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
 google.golang.org/grpc v1.41.0/go.mod h1:U3l9uK9J0sini8mHphKoXyaqDA/8VyGnDee1zzIUK6k=
-google.golang.org/grpc v1.48.0 h1:rQOsyJ/8+ufEDJd/Gdsz7HG220Mh9HAhFHRGnIjda0w=
-google.golang.org/grpc v1.48.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
+google.golang.org/grpc v1.50.1 h1:DS/BukOZWp8s6p4Dt/tOaJaTQyPyOoCcrjroHuCeLzY=
+google.golang.org/grpc v1.50.1/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCDK+GI=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"net/http"
 	"strings"

 	"github.com/hashicorp/boundary/api"
@@ -93,6 +94,7 @@ func New() *schema.Provider {
 			"boundary_scope":                        resourceScope(),
 			"boundary_target":                       resourceTarget(),
 			"boundary_user":                         resourceUser(),
+			"boundary_worker":                       resourceWorker(),
 		},
 	}

@@ -176,6 +178,15 @@ func providerAuthenticate(ctx context.Context, d *schema.ResourceData, md *metaD

 		at, err := am.Authenticate(ctx, authMethodId.(string), "login", credentials)
 		if err != nil {
+			if apiErr := api.AsServerError(err); apiErr != nil {
+				statusCode := apiErr.Response().StatusCode()
+				if statusCode == http.StatusNotFound {
+					return fmt.Errorf("unknown auth_method_id: %s", err.Error())
+				}
+				if statusCode == http.StatusUnauthorized {
+					return fmt.Errorf("invalid login name or password: %s", err.Error())
+				}
+			}
 			return err
 		}
 		md.client.SetToken(at.Attributes["token"].(string))
@@ -11,11 +11,12 @@ import (
 )

 const (
-	credentialStoreIdKey                     = "credential_store_id"
-	credentialLibraryVaultHttpMethodKey      = "http_method"
-	credentialLibraryVaultHttpRequestBodyKey = "http_request_body"
-	credentialLibraryVaultPathKey            = "path"
-	credentialLibraryCredentialTypeKey       = "credential_type"
+	credentialStoreIdKey                           = "credential_store_id"
+	credentialLibraryVaultHttpMethodKey            = "http_method"
+	credentialLibraryVaultHttpRequestBodyKey       = "http_request_body"
+	credentialLibraryVaultPathKey                  = "path"
+	credentialLibraryCredentialTypeKey             = "credential_type"
+	credentialLibraryCredentialMappingOverridesKey = "credential_mapping_overrides"
 )

 var libraryVaultAttrs = []string{
@@ -78,6 +79,11 @@ func resourceCredentialLibraryVault() *schema.Resource {
 				Type:        schema.TypeString,
 				Optional:    true,
 			},
+			credentialLibraryCredentialMappingOverridesKey: {
+				Description: "The credential mapping override.",
+				Type:        schema.TypeMap,
+				Optional:    true,
+			},
 		},
 	}
 }
@@ -93,6 +99,10 @@ func setFromVaultCredentialLibraryResponseMap(d *schema.ResourceData, raw map[st
 		return err
 	}

+	if err := d.Set(credentialLibraryCredentialMappingOverridesKey, raw[credentialLibraryCredentialMappingOverridesKey]); err != nil {
+		return err
+	}
+
 	if attrsVal, ok := raw["attributes"]; ok {
 		attrs := attrsVal.(map[string]interface{})
 		for _, v := range libraryVaultAttrs {
@@ -129,6 +139,10 @@ func resourceCredentialLibraryCreateVault(ctx context.Context, d *schema.Resourc
 	if v, ok := d.GetOk(credentialLibraryCredentialTypeKey); ok {
 		opts = append(opts, credentiallibraries.WithCredentialType(v.(string)))
 	}
+	if v, ok := d.GetOk(credentialLibraryCredentialMappingOverridesKey); ok {
+		mappingOverrides := v.(map[string]interface{})
+		opts = append(opts, credentiallibraries.WithCredentialMappingOverrides(mappingOverrides))
+	}

 	var credentialStoreId string
 	cid, ok := d.GetOk(credentialStoreIdKey)
@@ -216,6 +230,40 @@ func resourceCredentialLibraryUpdateVault(ctx context.Context, d *schema.Resourc
 			opts = append(opts, credentiallibraries.WithVaultCredentialLibraryPath(v.(string)))
 		}
 	}
+	if d.HasChange(credentialLibraryCredentialMappingOverridesKey) {
+		var oldMapping, newMapping map[string]interface{}
+		old, new := d.GetChange(credentialLibraryCredentialMappingOverridesKey)
+
+		if old == nil {
+			old = map[string]interface{}{}
+		}
+		oldMapping = old.(map[string]interface{})
+
+		if new == nil {
+			new = map[string]interface{}{}
+		}
+		newMapping = new.(map[string]interface{})
+
+		newAttrs := []string{}
+		for k := range newMapping {
+			newAttrs = append(newAttrs, k)
+		}
+
+		for oldAttr := range oldMapping {
+			isRemoved := true
+			for _, newAttr := range newAttrs {
+				if oldAttr == newAttr {
+					isRemoved = false
+					break
+				}
+			}
+			if isRemoved {
+				newMapping[oldAttr] = nil
+			}
+		}
+
+		opts = append(opts, credentiallibraries.WithCredentialMappingOverrides(newMapping))
+	}

 	if len(opts) > 0 {
 		opts = append(opts, credentiallibraries.WithAutomaticVersioning(true))
@@ -16,24 +16,26 @@ import (
 )

 const (
-	vaultCredResc            = "boundary_credential_library_vault.example"
-	vaultCredTypedResc       = "boundary_credential_library_vault.typed_example"
-	vaultCredLibName         = "foo"
-	vaultCredLibDesc         = "the foo"
-	vaultCredLibPath         = "/foo/bar"
-	vaultCredLibMethodGet    = "GET"
-	vaultCredLibMethodPost   = "POST"
-	vaultCredLibRequestBody  = "foobar"
-	vaultCredLibStringUpdate = "_random"
+	vaultCredResc                 = "boundary_credential_library_vault.example"
+	vaultCredTypedResc            = "boundary_credential_library_vault.typed_example"
+	vaultCredUsernamePasswordResc = "boundary_credential_library_vault.username_password_mapping_override"
+	vaultCredSshPrivateKeyResc    = "boundary_credential_library_vault.ssh_private_key_mapping_override"
+	vaultCredLibName              = "foo"
+	vaultCredLibDesc              = "the foo"
+	vaultCredLibPath              = "/foo/bar"
+	vaultCredLibMethodGet         = "GET"
+	vaultCredLibMethodPost        = "POST"
+	vaultCredLibRequestBody       = "foobar"
+	vaultCredLibStringUpdate      = "_random"
 )

 var vaultCredLibResource = fmt.Sprintf(`
 resource "boundary_credential_library_vault" "example" {
-	name  = "%s"
-	description = "%s"
+	name                = "%s"
+	description         = "%s"
 	credential_store_id = boundary_credential_store_vault.example.id
-  	path = "%s"
-  	http_method = "%s"
+  	path                = "%s"
+  	http_method         = "%s"
 }`, vaultCredLibName,
 	vaultCredLibDesc,
 	vaultCredLibPath,
@@ -41,12 +43,12 @@ resource "boundary_credential_library_vault" "example" {

 var vaultCredLibResourceUpdate = fmt.Sprintf(`
 resource "boundary_credential_library_vault" "example" {
-  	name  = "%s"
-	description = "%s"
+  	name                = "%s"
+	description         = "%s"
  	credential_store_id = boundary_credential_store_vault.example.id
-  	path = "%s"
-  	http_method = "%s"
-  	http_request_body = "%s"
+  	path                = "%s"
+  	http_method         = "%s"
+  	http_request_body   = "%s"
 }`, vaultCredLibName+vaultCredLibStringUpdate,
 	vaultCredLibDesc+vaultCredLibStringUpdate,
 	vaultCredLibPath+vaultCredLibStringUpdate,
@@ -66,6 +68,71 @@ resource "boundary_credential_library_vault" "typed_example" {
 	vaultCredLibPath,
 	vaultCredLibMethodGet)

+var vaultUsernamePasswordMappingOverrideCredLibResource = fmt.Sprintf(`
+resource "boundary_credential_library_vault" "username_password_mapping_override" {
+	name                         = "%s"
+	description                  = "%s"
+	credential_store_id          = boundary_credential_store_vault.example.id
+	path                         = "%s"
+	http_method                  = "%s"
+	credential_type              = "username_password"
+	credential_mapping_overrides = {
+		password_attribute = "alternative_password_label"
+		username_attribute = "alternative_username_label"
+	}
+}`, vaultCredLibName,
+	vaultCredLibDesc,
+	vaultCredLibPath,
+	vaultCredLibMethodGet)
+
+var vaultUsernamePasswordMappingOverrideCredLibResourceUpdate = fmt.Sprintf(`
+	resource "boundary_credential_library_vault" "username_password_mapping_override" {
+		name                         = "%s"
+		description                  = "%s"
+		credential_store_id          = boundary_credential_store_vault.example.id
+		path                         = "%s"
+		http_method                  = "%s"
+		credential_type              = "username_password"
+		credential_mapping_overrides = {
+			password_attribute = "updated_password_label"
+			username_attribute = "updated_username_label"
+		}
+	}`, vaultCredLibName,
+	vaultCredLibDesc,
+	vaultCredLibPath,
+	vaultCredLibMethodGet)
+
+var vaultUsernamePasswordMappingOverrideCredLibResourceRemove = fmt.Sprintf(`
+	resource "boundary_credential_library_vault" "username_password_mapping_override" {
+		name                         = "%s"
+		description                  = "%s"
+		credential_store_id          = boundary_credential_store_vault.example.id
+		path                         = "%s"
+		http_method                  = "%s"
+		credential_type              = "username_password"
+	}`, vaultCredLibName,
+	vaultCredLibDesc,
+	vaultCredLibPath,
+	vaultCredLibMethodGet)
+
+var vaultSshPrivateKeyMappingOverrideCredLibResource = fmt.Sprintf(`
+resource "boundary_credential_library_vault" "ssh_private_key_mapping_override" {
+	name                         = "%s"
+	description                  = "%s"
+	credential_store_id          = boundary_credential_store_vault.example.id
+	path                         = "%s"
+	http_method                  = "%s"
+	credential_type              = "ssh_private_key"
+	credential_mapping_overrides = {
+		private_key_attribute 			 = "alternative_key_label"
+		private_key_passphrase_attribute = "alternative_passphrase_label"
+		username_attribute 				 = "alternative_username_label"
+	}
+}`, vaultCredLibName,
+	vaultCredLibDesc,
+	vaultCredLibPath,
+	vaultCredLibMethodGet)
+
 func TestAccCredentialLibraryVault(t *testing.T) {
 	tc := controller.NewTestController(t, tcConfig...)
 	defer tc.Shutdown()
@@ -132,6 +199,74 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 				),
 			},
 			importStep(vaultCredResc),
+
+			{
+				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate, vaultUsernamePasswordMappingOverrideCredLibResource),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, NameKey, vaultCredLibName),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, DescriptionKey, vaultCredLibDesc),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultPathKey, vaultCredLibPath),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultHttpMethodKey, vaultCredLibMethodGet),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultHttpRequestBodyKey, ""),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryCredentialTypeKey, "username_password"),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, "credential_mapping_overrides.password_attribute", "alternative_password_label"),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, "credential_mapping_overrides.username_attribute", "alternative_username_label"),
+
+					testAccCheckCredentialLibraryVaultResourceExists(provider, vaultCredUsernamePasswordResc),
+				),
+			},
+			importStep(vaultCredResc),
+
+			{
+				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate, vaultUsernamePasswordMappingOverrideCredLibResourceUpdate),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, NameKey, vaultCredLibName),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, DescriptionKey, vaultCredLibDesc),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultPathKey, vaultCredLibPath),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultHttpMethodKey, vaultCredLibMethodGet),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultHttpRequestBodyKey, ""),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryCredentialTypeKey, "username_password"),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, "credential_mapping_overrides.password_attribute", "updated_password_label"),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, "credential_mapping_overrides.username_attribute", "updated_username_label"),
+
+					testAccCheckCredentialLibraryVaultResourceExists(provider, vaultCredUsernamePasswordResc),
+				),
+			},
+			importStep(vaultCredResc),
+
+			{
+				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate, vaultUsernamePasswordMappingOverrideCredLibResourceRemove),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, NameKey, vaultCredLibName),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, DescriptionKey, vaultCredLibDesc),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultPathKey, vaultCredLibPath),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultHttpMethodKey, vaultCredLibMethodGet),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultHttpRequestBodyKey, ""),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryCredentialTypeKey, "username_password"),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryCredentialMappingOverridesKey+".%", "0"),
+
+					testAccCheckCredentialLibraryVaultResourceExists(provider, vaultCredUsernamePasswordResc),
+				),
+			},
+			importStep(vaultCredResc),
+
+			{
+				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate, vaultSshPrivateKeyMappingOverrideCredLibResource),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, NameKey, vaultCredLibName),
+					resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, DescriptionKey, vaultCredLibDesc),
+					resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, credentialLibraryVaultPathKey, vaultCredLibPath),
+					resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, credentialLibraryVaultHttpMethodKey, vaultCredLibMethodGet),
+					resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, credentialLibraryVaultHttpRequestBodyKey, ""),
+					resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, credentialLibraryCredentialTypeKey, "ssh_private_key"),
+					resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, "credential_mapping_overrides.private_key_attribute", "alternative_key_label"),
+					resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, "credential_mapping_overrides.private_key_passphrase_attribute", "alternative_passphrase_label"),
+					resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, "credential_mapping_overrides.username_attribute", "alternative_username_label"),
+
+					testAccCheckCredentialLibraryVaultResourceExists(provider, vaultCredSshPrivateKeyResc),
+				),
+			},
+			importStep(vaultCredResc),
 		},
 	})
 }
@@ -75,7 +75,7 @@ func setFromGroupResponseMap(d *schema.ResourceData, raw map[string]interface{})
 	return nil
 }

-func resourceGroupCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceGroupCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) (errs diag.Diagnostics) {
 	md := meta.(*metaData)

 	var scopeId string
@@ -108,7 +108,12 @@ func resourceGroupCreate(ctx context.Context, d *schema.ResourceData, meta inter
 	if gcr == nil {
 		return diag.Errorf("group nil after create")
 	}
-	raw := gcr.GetResponse().Map
+	apiResponse := gcr.GetResponse().Map
+	defer func() {
+		if err := setFromGroupResponseMap(d, apiResponse); err != nil {
+			errs = append(errs, diag.FromErr(err)...)
+		}
+	}()

 	if val, ok := d.GetOk(groupMemberIdsKey); ok {
 		list := val.(*schema.Set).List()
@@ -118,16 +123,12 @@ func resourceGroupCreate(ctx context.Context, d *schema.ResourceData, meta inter
 		}
 		gcsmr, err := grps.SetMembers(ctx, gcr.Item.Id, gcr.Item.Version, memberIds)
 		if err != nil {
-			return diag.Errorf("error setting principals on role: %v", err)
+			return diag.Errorf("error setting members on group: %v", err)
 		}
 		if gcsmr == nil {
 			return diag.Errorf("group nil after setting members")
 		}
-		raw = gcsmr.GetResponse().Map
-	}
-
-	if err := setFromGroupResponseMap(d, raw); err != nil {
-		return diag.FromErr(err)
+		apiResponse = gcsmr.GetResponse().Map
 	}

 	return nil
@@ -139,7 +139,7 @@ func setFromHostSetStaticResponseMap(d *schema.ResourceData, raw map[string]inte
 	return nil
 }

-func resourceHostSetStaticCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceHostSetStaticCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) (errs diag.Diagnostics) {
 	md := meta.(*metaData)

 	var hostsetHostCatalogId string
@@ -195,7 +195,12 @@ func resourceHostSetStaticCreate(ctx context.Context, d *schema.ResourceData, me
 	if hscr == nil {
 		return diag.Errorf("nil host set after create")
 	}
-	raw := hscr.GetResponse().Map
+	apiResponse := hscr.GetResponse().Map
+	defer func() {
+		if err := setFromHostSetStaticResponseMap(d, apiResponse); err != nil {
+			errs = append(errs, diag.FromErr(err)...)
+		}
+	}()

 	if hostIds != nil {
 		hsshr, err := hsClient.SetHosts(ctx, hscr.Item.Id, hscr.Item.Version, hostIds)
@@ -205,11 +210,7 @@ func resourceHostSetStaticCreate(ctx context.Context, d *schema.ResourceData, me
 		if hsshr == nil {
 			return diag.Errorf("nil host set after setting hosts")
 		}
-		raw = hsshr.GetResponse().Map
-	}
-
-	if err := setFromHostSetStaticResponseMap(d, raw); err != nil {
-		return diag.FromErr(err)
+		apiResponse = hsshr.GetResponse().Map
 	}

 	return nil
@@ -94,7 +94,7 @@ func setFromRoleResponseMap(d *schema.ResourceData, raw map[string]interface{})
 	return nil
 }

-func resourceRoleCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceRoleCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) (errs diag.Diagnostics) {
 	md := meta.(*metaData)

 	var scopeId string
@@ -151,18 +151,22 @@ func resourceRoleCreate(ctx context.Context, d *schema.ResourceData, meta interf
 	if tcr == nil {
 		return diag.Errorf("nil role after create")
 	}
-	raw := tcr.GetResponse().Map
+	apiResponse := tcr.GetResponse().Map
+	defer func() {
+		if err := setFromRoleResponseMap(d, apiResponse); err != nil {
+			errs = append(errs, diag.FromErr(err)...)
+		}
+	}()

-	var diags diag.Diagnostics
 	if principalIds != nil {
 		tspr, err := rc.SetPrincipals(ctx, tcr.Item.Id, 0, principalIds, roles.WithAutomaticVersioning(true))
 		switch {
 		case err != nil:
-			diags = append(diags, diag.Diagnostic{Severity: diag.Error, Summary: "error setting principals", Detail: err.Error()})
+			errs = append(errs, diag.Diagnostic{Severity: diag.Error, Summary: "error setting principals", Detail: err.Error()})
 		case tspr == nil:
-			diags = append(diags, diag.Diagnostic{Severity: diag.Error, Summary: "nil role after setting principal IDs"})
+			errs = append(errs, diag.Diagnostic{Severity: diag.Error, Summary: "nil role after setting principals"})
 		default:
-			raw = tspr.GetResponse().Map
+			apiResponse = tspr.GetResponse().Map
 		}
 	}

@@ -170,19 +174,15 @@ func resourceRoleCreate(ctx context.Context, d *schema.ResourceData, meta interf
 		tsgr, err := rc.SetGrants(ctx, tcr.Item.Id, 0, grantStrings, roles.WithAutomaticVersioning(true))
 		switch {
 		case err != nil:
-			diags = append(diags, diag.Diagnostic{Severity: diag.Error, Summary: "error setting grants", Detail: err.Error()})
+			errs = append(errs, diag.Diagnostic{Severity: diag.Error, Summary: "error setting grants", Detail: err.Error()})
 		case tsgr == nil:
-			diags = append(diags, diag.Diagnostic{Severity: diag.Error, Summary: "nil role after setting grant strings"})
+			errs = append(errs, diag.Diagnostic{Severity: diag.Error, Summary: "nil role after setting grants"})
 		default:
-			raw = tsgr.GetResponse().Map
+			apiResponse = tsgr.GetResponse().Map
 		}
 	}

-	if err := setFromRoleResponseMap(d, raw); err != nil {
-		return diag.FromErr(err)
-	}
-
-	return diags
+	return errs
 }

 func resourceRoleRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
@@ -155,7 +155,7 @@ func setFromTargetResponseMap(d *schema.ResourceData, raw map[string]interface{}
 	return nil
 }

-func resourceTargetCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceTargetCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) (errs diag.Diagnostics) {
 	md := meta.(*metaData)

 	var scopeId string
@@ -256,7 +256,6 @@ func resourceTargetCreate(ctx context.Context, d *schema.ResourceData, meta inte
 	}

 	tc := targets.NewClient(md.client)
-
 	tcr, err := tc.Create(ctx, typeStr, scopeId, opts...)
 	if err != nil {
 		return diag.Errorf("error creating target: %v", err)
@@ -264,7 +263,12 @@ func resourceTargetCreate(ctx context.Context, d *schema.ResourceData, meta inte
 	if tcr == nil {
 		return diag.Errorf("target nil after create")
 	}
-	raw := tcr.GetResponse().Map
+	apiResponse := tcr.GetResponse().Map
+	defer func() {
+		if err := setFromTargetResponseMap(d, apiResponse); err != nil {
+			errs = append(errs, diag.FromErr(err)...)
+		}
+	}()

 	version := tcr.Item.Version
 	if hostSourceIds != nil {
@@ -272,7 +276,10 @@ func resourceTargetCreate(ctx context.Context, d *schema.ResourceData, meta inte
 		if err != nil {
 			return diag.Errorf("error setting host sources on target: %v", err)
 		}
-		raw = tur.GetResponse().Map
+		if tur == nil {
+			return diag.Errorf("nil target after setting host sources")
+		}
+		apiResponse = tur.GetResponse().Map
 		version = tur.Item.Version
 	}

@@ -288,11 +295,10 @@ func resourceTargetCreate(ctx context.Context, d *schema.ResourceData, meta inte
 		if err != nil {
 			return diag.Errorf("error setting credential sources on target: %v", err)
 		}
-		raw = tur.GetResponse().Map
-	}
-
-	if err := setFromTargetResponseMap(d, raw); err != nil {
-		return diag.FromErr(err)
+		if tur == nil {
+			return diag.Errorf("nil target after setting credential sources")
+		}
+		apiResponse = tur.GetResponse().Map
 	}

 	return nil
@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"net/http"
+	"regexp"
 	"testing"

 	"github.com/hashicorp/boundary/api"
@@ -130,6 +131,21 @@ resource "boundary_target" "foo" {
 	session_connection_limit = 7
 	worker_filter = "type == \"bar\""
 }`, fooTargetDescriptionUpdate)
+
+	fooTargetPartialSuccess = fmt.Sprintf(`
+resource "boundary_target" "foo" {
+	name                                       = "expected_to_fail"
+	description                                = "%s"
+	type                                       = "tcp"
+	scope_id                                   = boundary_scope.proj1.id
+	default_port                               = 80
+	depends_on                                 = [boundary_role.proj1_admin]
+	session_max_seconds                        = 7000
+	session_connection_limit                   = 7
+	injected_application_credential_source_ids = [
+		boundary_credential_library_vault.bar.id
+	]
+}`, fooTargetDescription)
 )

 func TestAccTarget(t *testing.T) {
@@ -200,6 +216,37 @@ func TestAccTarget(t *testing.T) {
 				),
 			},
 			importStep("boundary_target.foo"),
+			{
+				// test updating state file when the target is created, but fails on associating an invalid injected credential source to a tcp target type
+				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, fooBarCredLibs, fooTargetPartialSuccess),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTargetResourceExists(provider, "boundary_target.foo"),
+					resource.TestCheckResourceAttr("boundary_target.foo", DescriptionKey, ""),
+					resource.TestCheckResourceAttr("boundary_target.foo", targetDefaultPortKey, "80"),
+					resource.TestCheckResourceAttr("boundary_target.foo", targetSessionMaxSecondsKey, "7000"),
+					resource.TestCheckResourceAttr("boundary_target.foo", targetSessionConnectionLimitKey, "7"),
+					resource.TestCheckResourceAttr("boundary_target.foo", targetHostSourceIdsKey+".%", "0"),
+					resource.TestCheckResourceAttr("boundary_target.foo", targetInjectedAppCredentialSourceIdsKey+".%", "0"),
+				),
+				ExpectError: regexp.MustCompile("Unable to set credential sources in target: tcp.VetCredentialSources: tcp.Target only supports credential purpose"),
+			},
+			importStep("boundary_target.foo", targetInjectedAppCredentialSourceIdsKey),
+			{
+				// test resolving invalid injected credential source error without raising duplicate name error, due to state file not being in sync.
+				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, fooBarCredLibs, fooTargetUpdateUnsetHostAndCredSources),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTargetResourceExists(provider, "boundary_target.foo"),
+					resource.TestCheckResourceAttr("boundary_target.foo", DescriptionKey, fooTargetDescriptionUpdate),
+					resource.TestCheckResourceAttr("boundary_target.foo", targetDefaultPortKey, "80"),
+					resource.TestCheckResourceAttr("boundary_target.foo", targetSessionMaxSecondsKey, "7000"),
+					resource.TestCheckResourceAttr("boundary_target.foo", targetSessionConnectionLimitKey, "7"),
+					resource.TestCheckResourceAttr("boundary_target.foo", targetWorkerFilterKey, `type == "bar"`),
+					resource.TestCheckResourceAttr("boundary_target.foo", targetHostSourceIdsKey+".%", "0"),
+					resource.TestCheckResourceAttr("boundary_target.foo", targetInjectedAppCredentialSourceIdsKey+".%", "0"),
+					resource.TestCheckResourceAttr("boundary_target.foo", targetBrokeredCredentialSourceIdsKey+".%", "0"),
+				),
+			},
+			importStep("boundary_target.foo"),
 		},
 	})
 }
@@ -73,7 +73,7 @@ func setFromUserResponseMap(d *schema.ResourceData, raw map[string]interface{})
 	return nil
 }

-func resourceUserCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func resourceUserCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) (errs diag.Diagnostics) {
 	md := meta.(*metaData)

 	var scopeId string
@@ -106,7 +106,12 @@ func resourceUserCreate(ctx context.Context, d *schema.ResourceData, meta interf
 	if ucr == nil {
 		return diag.Errorf("user nil after create")
 	}
-	raw := ucr.GetResponse().Map
+	apiResponse := ucr.GetResponse().Map
+	defer func() {
+		if err := setFromUserResponseMap(d, apiResponse); err != nil {
+			errs = append(errs, diag.FromErr(err)...)
+		}
+	}()

 	if val, ok := d.GetOk(userAccountIDsKey); ok {
 		list := val.(*schema.Set).List()
@@ -121,11 +126,7 @@ func resourceUserCreate(ctx context.Context, d *schema.ResourceData, meta interf
 		if usrac == nil {
 			return diag.Errorf("user nil after setting accounts")
 		}
-		raw = usrac.GetResponse().Map
-	}
-
-	if err := setFromUserResponseMap(d, raw); err != nil {
-		return diag.FromErr(err)
+		apiResponse = usrac.GetResponse().Map
 	}

 	return nil
@@ -0,0 +1,239 @@
+package provider
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/workers"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+const (
+	scope                              = "scope"
+	scopeId                            = "global"
+	version                            = "version"
+	address                            = "address"
+	canonicalTags                      = "canonical_tags"
+	configTags                         = "config_tags"
+	workerGeneratedAuthToken           = "worker_generated_auth_token"
+	controllerGeneratedActivationToken = "controller_generated_activation_token"
+	apiTags                            = "api_tags"
+	releaseVersion                     = "release_version"
+	authorizedActions                  = "authorized_actions"
+)
+
+func resourceWorker() *schema.Resource {
+	return &schema.Resource{
+		Description: "The resource allows you to create a self-managed worker object.",
+
+		CreateContext: resourceWorkerCreate,
+		ReadContext:   resourceWorkerRead,
+		UpdateContext: resourceWorkerUpdate,
+		DeleteContext: resourceWorkerDelete,
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			IDKey: {
+				Description: "The ID of the worker.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			ScopeIdKey: {
+				Description: "The scope for the worker.",
+				Type:        schema.TypeString,
+				Required:    true,
+			},
+			NameKey: {
+				Description: "The name for the worker.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			DescriptionKey: {
+				Description: "The description for the worker.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			address: {
+				Description: "The accessible address of the self managed worker.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			workerGeneratedAuthToken: {
+				Description: "The worker authentication token required to register the worker for the worker-led authentication flow. Leaving this blank will result in a controller generated token.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			controllerGeneratedActivationToken: {
+				Description: "A single use token generated by the controller to be passed to the self-managed worker.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			releaseVersion: {
+				Description: "The version of the Boundary binary running on the self managed worker.",
+				Type:        schema.TypeInt,
+				Computed:    true,
+			},
+			authorizedActions: {
+				Description: "A list of actions that the worker is entitled to perform.",
+				Type:        schema.TypeList,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+				Computed: true,
+			},
+		},
+	}
+}
+
+func setFromWorkerResponseMap(d *schema.ResourceData, raw map[string]interface{}) error {
+	d.SetId(raw["id"].(string))
+	d.Set(ScopeIdKey, raw["scope_id"])
+	d.Set(NameKey, raw["name"])
+	d.Set(DescriptionKey, raw["description"])
+	d.Set(address, raw["address"])
+	d.Set(workerGeneratedAuthToken, raw["worker_generated_auth_token"])
+	d.Set(controllerGeneratedActivationToken, raw["controller_generated_activation_token"])
+	d.Set(releaseVersion, raw["release_version"])
+	d.Set(authorizedActions, raw["authorized_actions"])
+
+	return nil
+}
+
+func resourceWorkerRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	wkrs := workers.NewClient(md.client)
+
+	wrr, err := wkrs.Read(ctx, d.Id())
+	if err != nil {
+		if apiErr := api.AsServerError(err); apiErr != nil && apiErr.Response().StatusCode() == http.StatusNotFound {
+			d.SetId("")
+			return nil
+		}
+		return diag.Errorf("error calling read worker: %v", err)
+	}
+	if wrr == nil {
+		return diag.Errorf("worker nil after read")
+	}
+
+	if err := setFromWorkerResponseMap(d, wrr.GetResponse().Map); err != nil {
+		return diag.FromErr(err)
+	}
+
+	return nil
+}
+
+func resourceWorkerCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	opts := []workers.Option{}
+
+	if v, ok := d.GetOk(NameKey); ok {
+		opts = append(opts, workers.WithName(v.(string)))
+	}
+
+	if v, ok := d.GetOk(DescriptionKey); ok {
+		opts = append(opts, workers.WithDescription(v.(string)))
+	}
+
+	var workerAuthToken string
+	if v, ok := d.GetOk(workerGeneratedAuthToken); ok {
+		workerAuthToken = v.(string)
+	}
+
+	wkr := workers.NewClient(md.client)
+
+	if len(workerAuthToken) > 0 {
+		wkrc, err := wkr.CreateWorkerLed(ctx, workerAuthToken, scopeId, opts...)
+		if err != nil {
+			return diag.Errorf("error creating worker: %v", err)
+		}
+		if wkrc == nil {
+			return diag.Errorf("worker nil after create")
+		}
+		if err := setFromWorkerResponseMap(d, wkrc.GetResponse().Map); err != nil {
+			return diag.FromErr(err)
+		}
+	} else {
+		wkrc, err := wkr.CreateControllerLed(ctx, scopeId, opts...)
+		if err != nil {
+			return diag.Errorf("error creating worker: %v", err)
+		}
+		if wkrc == nil {
+			return diag.Errorf("worker nil after create")
+		}
+		if err := setFromWorkerResponseMap(d, wkrc.GetResponse().Map); err != nil {
+			return diag.FromErr(err)
+		}
+	}
+	return nil
+}
+
+func resourceWorkerUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	wkr := workers.NewClient(md.client)
+
+	opts := []workers.Option{}
+
+	var name *string
+	if d.HasChange(NameKey) {
+		opts = append(opts, workers.DefaultName())
+		nameVal, ok := d.GetOk(NameKey)
+		if ok {
+			nameStr := nameVal.(string)
+			name = &nameStr
+			opts = append(opts, workers.WithName(nameStr))
+		}
+	}
+
+	var desc *string
+	if d.HasChange(DescriptionKey) {
+		opts = append(opts, workers.DefaultDescription())
+		descVal, ok := d.GetOk(DescriptionKey)
+		if ok {
+			descStr := descVal.(string)
+			desc = &descStr
+			opts = append(opts, workers.WithDescription(descStr))
+		}
+	}
+
+	var versionInt int
+	if versionVal, ok := d.GetOk(version); ok {
+		versionInt = versionVal.(int)
+	}
+
+	if len(opts) > 0 {
+		opts = append(opts, workers.WithAutomaticVersioning(true))
+		_, err := wkr.Update(ctx, d.Id(), uint32(versionInt), opts...)
+		if err != nil {
+			return diag.Errorf("error updating worker: %v", err)
+		}
+	}
+
+	if d.HasChange(NameKey) {
+		if err := d.Set(NameKey, name); err != nil {
+			return diag.FromErr(err)
+		}
+	}
+	if d.HasChange(DescriptionKey) {
+		if err := d.Set(DescriptionKey, desc); err != nil {
+			return diag.FromErr(err)
+		}
+	}
+
+	return nil
+}
+
+func resourceWorkerDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	wClient := workers.NewClient(md.client)
+
+	_, err := wClient.Delete(ctx, d.Id())
+	if err != nil {
+		return diag.Errorf("error deleting worker: %v", err)
+	}
+
+	return nil
+}
@@ -0,0 +1,180 @@
+package provider
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"os"
+	"testing"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/workers"
+	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+)
+
+const (
+	workerName       = "self managed worker"
+	workerNameUpdate = "self managed worker update"
+	workerDesc       = "self managed worker description"
+	workerDescUpdate = "self managed worker description update"
+	workerToken      = "GzusqckarbczHoLGQ4UA25uSRGy7e7hUk4Qgz8T3NmSZF4oXBc1dKMRyH7Mr6W5u2QWggkZi1wsnfYMufb5LZJJnxEdywUxpE8RgAbVTahMhJm8oeH3nagrAKfWJkrTt8QuoqiupcTrFmJtDPZ5WBtqKSXiW3jdG8esCt7ZNKVaKV1Hq6MBXUf7duj9KfAy4Y3B31jDTzoF1uVnK1AsaLkEhgbHbuAH33L2KG5ivo7YeFeE6PknNoVavPSRSkoEpcXSfjvoPMAz9ttpNvH7jGWPwLti8r48NcVj41ftXWg"
+)
+
+var (
+	workerLedCreate = fmt.Sprintf(`
+	resource "boundary_worker" "worker_led" {
+		scope_id = "global"
+		name = "%s"
+		description = "%s"
+		worker_generated_auth_token = "%s"
+	}`, workerName, workerDesc, workerToken)
+
+	workerLedUpdate = fmt.Sprintf(`
+	resource "boundary_worker" "worker_led" {
+		scope_id = "global"
+		name = "%s"
+		description = "%s"
+		worker_generated_auth_token = "%s"
+	}`, workerNameUpdate, workerDescUpdate, workerToken)
+
+	controllerLedCreate = fmt.Sprintf(`
+resource "boundary_worker" "controller_led" {
+	scope_id = "global"
+	name = "%s"
+	description = "%s"
+}`, workerName, workerDesc)
+	controllerLedUpdate = fmt.Sprintf(`
+resource "boundary_worker" "controller_led" {
+	scope_id = "global"
+	name = "%s"
+	description = "%s"
+}`, workerNameUpdate, workerDescUpdate)
+)
+
+func TestWorkerWorkerLed(t *testing.T) {
+	token := os.Getenv("BOUNDARY_TF_PROVIDER_TEST_WORKER_LED_TOKEN")
+	if token == "" {
+		t.Skip("Not running worker led activation test without worker led token present")
+	}
+
+	tc := controller.NewTestController(t, tcConfig...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		ProviderFactories: providerFactories(&provider),
+		CheckDestroy:      testAccCheckworkerResourceDestroy(t, provider),
+		Steps: []resource.TestStep{
+			{
+				// create
+				Config: testConfig(url, workerLedCreate),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckworkerResourceExists(provider, "boundary_worker.worker_led"),
+					resource.TestCheckResourceAttr("boundary_worker.worker_led", "description", workerDesc),
+					resource.TestCheckResourceAttr("boundary_worker.worker_led", "name", workerName),
+				),
+			},
+			importStep("boundary_worker.worker_led"),
+			{
+				// update
+				Config: testConfig(url, workerLedUpdate),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckworkerResourceExists(provider, "boundary_worker.worker_led"),
+					resource.TestCheckResourceAttr("boundary_worker.worker_led", "description", workerDescUpdate),
+					resource.TestCheckResourceAttr("boundary_worker.worker_led", "name", workerNameUpdate),
+				),
+			},
+			importStep("boundary_worker.worker_led"),
+		},
+	})
+}
+
+func TestWorkerControllerLed(t *testing.T) {
+	tc := controller.NewTestController(t, tcConfig...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		ProviderFactories: providerFactories(&provider),
+		CheckDestroy:      testAccCheckworkerResourceDestroy(t, provider),
+		Steps: []resource.TestStep{
+			{
+				// create
+				Config: testConfig(url, controllerLedCreate),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckworkerResourceExists(provider, "boundary_worker.controller_led"),
+					resource.TestCheckResourceAttr("boundary_worker.controller_led", "description", workerDesc),
+					resource.TestCheckResourceAttr("boundary_worker.controller_led", "name", workerName),
+					resource.TestCheckResourceAttrSet("boundary_worker.controller_led", "controller_generated_activation_token"),
+				),
+			},
+			importStep("boundary_worker.controller_led"),
+			{
+				// update
+				Config: testConfig(url, controllerLedUpdate),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckworkerResourceExists(provider, "boundary_worker.controller_led"),
+					resource.TestCheckResourceAttr("boundary_worker.controller_led", "description", workerDescUpdate),
+					resource.TestCheckResourceAttr("boundary_worker.controller_led", "name", workerNameUpdate),
+				),
+			},
+			importStep("boundary_worker.controller_led"),
+		},
+	})
+}
+
+func testAccCheckworkerResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Not found: %s", name)
+		}
+
+		id := rs.Primary.ID
+		if id == "" {
+			return fmt.Errorf("No ID is set")
+		}
+
+		md := testProvider.Meta().(*metaData)
+
+		wkrClient := workers.NewClient(md.client)
+
+		if _, err := wkrClient.Read(context.Background(), id); err != nil {
+			return fmt.Errorf("Got an error when reading worker %q: %v", id, err)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckworkerResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if testProvider.Meta() == nil {
+			t.Fatal("got nil provider metadata")
+		}
+		md := testProvider.Meta().(*metaData)
+
+		for _, rs := range s.RootModule().Resources {
+			switch rs.Type {
+			case "boundary_worker":
+				id := rs.Primary.ID
+
+				wkrClient := workers.NewClient(md.client)
+
+				_, err := wkrClient.Read(context.Background(), id)
+				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
+					return fmt.Errorf("didn't get a 404 when reading destroyed worker %q: %v", id, err)
+				}
+
+			default:
+				continue
+			}
+		}
+		return nil
+	}
+}
Author	SHA1	Message	Date
Louis Ruch	5e20d1005e	chore: Prep for release Release / go-version (push) Successful in 9s Details Release / release-notes (push) Successful in 25s Details Release / Terraform Provider Release (push) Failing after 0s Details	2022-11-29 14:03:43 -08:00
grantorchardandJohan Brandhorst-Satzkorn	cfc57d5e25	Add support for boundary_self_managed_worker resource. (#293 ) * add initial prototype of self managed worker resource and associated tests * Add self managed worker resource and associated tests * Update internal/provider/resource_self_managed_worker.go Accept suggested schema changes for tags Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com> * add environment variable check for worker led auth testing * change resource name from self_managed_worker to worker for consistency with the api * update tag schemas, ensure all attributes have descriptions * add generated docs for worker * add examples for worker resource * add examples for worker resource * remove merge conflict * Remove funtionality for reflecting tags in the schema * remove unused attributes (all tags) from schema, updates tests to use 'boundary_worker' on resource checks Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>	2022-11-24 11:28:27 -05:00
Damian Debkowski	79951499ec	chore: update changelog (#291 )	2022-10-18 14:43:20 -07:00
Damian Debkowski	f95954c83d	fix: update resource state even if a subtask fails on resource creation (#289 ) Release / go-version (push) Successful in 9s Details Release / release-notes (push) Successful in 32s Details Release / Terraform Provider Release (push) Failing after 0s Details	2022-10-17 22:00:23 -07:00
Damian Debkowski	1882beff3c	fix: improve error message for invalid provider credentials (#290 )	2022-10-17 11:13:45 -07:00
Damian Debkowski	807db1bef1	Support Vault Credential Library Mapping Overrides (#287 )	2022-10-13 09:53:42 -07:00
				`@@ -0,0 +1 @@`
				`terraform import boundary_worker.foo <my-id>`