update changelog to include policies feat

Co-authored-by: Danielle Miu <29378233+DanielleMiu@users.noreply.github.com>

.github/workflows/release.yml

@@ -12,11 +12,15 @@ jobs:
   go-version:
     runs-on: ubuntu-latest
     outputs:
-      version: ${{ steps.go-version.outputs.version }}
+      version: ${{ steps.go-version.outputs.go-version }}
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - id: go-version
-        run: echo "name=version::$(cat ./.go-version)" >> "$GITHUB_OUTPUT"
+        # We use .go-version as our source of truth for current Go
+        # version, because "goenv" can react to it automatically.
+        run: |
+          echo "Building with Go $(cat .go-version)"
+          echo "go-version=$(cat .go-version)" >> "$GITHUB_OUTPUT"
   release-notes:
     runs-on: ubuntu-latest
     steps:
@@ -25,7 +29,7 @@ jobs:
           fetch-depth: 0
       - name: Generate Release Notes
         run: sed -n -e "1{/# /d;}" -e "2{/^$/d;}" -e "/# $(git describe --abbrev=0 --exclude="$(git describe --abbrev=0 --match='v*.*.*' --tags)" --match='v*.*.*' --tags | tr -d v)/q;p" CHANGELOG.md > release-notes.txt
-      - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+      - uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
         with:
           name: release-notes
           path: release-notes.txt
@@ -33,7 +37,7 @@ jobs:
   terraform-provider-release:
     name: 'Terraform Provider Release'
     needs: [go-version, release-notes]
-    uses: hashicorp/ghaction-terraform-provider-release/.github/workflows/hashicorp.yml@v2
+    uses: hashicorp/ghaction-terraform-provider-release/.github/workflows/hashicorp.yml@v3
     secrets:
       hc-releases-github-token: '${{ secrets.HASHI_RELEASES_GITHUB_TOKEN }}'
       hc-releases-host-staging: '${{ secrets.HC_RELEASES_HOST_STAGING }}'

.github/workflows/test.yml

@@ -32,7 +32,7 @@ jobs:
           echo "go-build=$(go env GOCACHE)" >> "$GITHUB_OUTPUT"
           echo "go-mod=$(go env GOMODCACHE)" >> "$GITHUB_OUTPUT"
       - name: Set up Go modules cache
-        uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+        uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
         with:
           path: |
             ${{ steps.go-cache-paths.outputs.go-build }}

.go-version

@@ -1 +1 @@
-1.21.3
+1.21.5

CHANGELOG.md

@@ -2,9 +2,25 @@
 
 Canonical reference for changes, improvements, and bugfixes for the Boundary Terraform provider.
 
-## Next
+## 1.1.14 (February 14, 2024)
+
+### New and Improved
+
+* Support the multi-value `grant_scope_ids` field in the role provider
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/562))
+
+* Support Boundary [Storage Policies](https://developer.hashicorp.com/boundary/docs/configuration/session-recording/configure-storage-policy)
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/558))
+
+## 1.1.13 (February 1, 2024)
+
+### New and Improved
+
+* Allow dynamic credentials when configuring storage buckets
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/549))
 
 ## 1.1.12 (January 8, 2024)
+
 ### New and Improved
 
 * Add support to configure valid_principals with Vault SSH Certificate Credential Library

README.md

@@ -163,7 +163,7 @@ resource "boundary_role" "organization_readonly" {
   name        = "readonly"
   description = "Read-only role"
   principal_ids = [boundary_group.readonly_users.id]
-  grant_strings = ["id=*;type=*;actions=read"]
+  grant_strings = ["ids=*;type=*;actions=read"]
   scope_id    = boundary_scope.corp.id
 }
 
@@ -174,7 +174,7 @@ resource "boundary_role" "organization_admin" {
   principal_ids = concat(
     [for user in boundary_user.user: user.id]
   )
-  grant_strings   = ["id=*;type=*;actions=create,read,update,delete"]
+  grant_strings   = ["ids=*;type=*;actions=create,read,update,delete"]
   scope_id = boundary_scope.corp.id
 }
 

docs/resources/policy_storage.md

@@ -0,0 +1,33 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_policy_storage Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The storage policy resource allows you to configure a Boundary storage policy. Storage policies allow an admin to configure how long session recordings must be stored and when to delete them. Storage policies must be applied to the global scope or an org scope in order to take effect.
+---
+
+# boundary_policy_storage (Resource)
+
+The storage policy resource allows you to configure a Boundary storage policy. Storage policies allow an admin to configure how long session recordings must be stored and when to delete them. Storage policies must be applied to the global scope or an org scope in order to take effect.
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `scope_id` (String) The scope for this policy.
+
+### Optional
+
+- `delete_after_days` (Number) The number of days after which a session recording will be automatically deleted. Defaults to 0: never automatically delete. However, delete_after_days and retain_for_days cannot both be 0.
+- `delete_after_overridable` (Boolean) Whether or not the associated delete_after_days value can be overridden by org scopes. Note: if the associated delete_after_days value is 0, overridable is ignored
+- `description` (String) The policy description.
+- `name` (String) The policy name. Defaults to the resource name.
+- `retain_for_days` (Number) The number of days a session recording is required to be stored. Defaults to 0: allow deletions at any time. However, retain_for_days and delete_after_days cannot both be 0.
+- `retain_for_overridable` (Boolean) Whether or not the associated retain_for_days value can be overridden by org scopes. Note: if the associated retain_for_days value is 0, overridable is ignored.
+
+### Read-Only
+
+- `id` (String) The ID of the policy.

docs/resources/role.md

@@ -79,7 +79,7 @@ resource "boundary_role" "readonly" {
   name          = "readonly"
   description   = "A readonly role"
   principal_ids = [boundary_user.readonly.id]
-  grant_strings = ["id=*;type=*;actions=read"]
+  grant_strings = ["ids=*;type=*;actions=read"]
   scope_id      = boundary_scope.org.id
 }
 ```
@@ -112,7 +112,7 @@ resource "boundary_role" "readonly" {
   name          = "readonly"
   description   = "A readonly role"
   principal_ids = [boundary_user.readonly.id]
-  grant_strings = ["id=*;type=*;actions=read"]
+  grant_strings = ["ids=*;type=*;actions=read"]
   scope_id      = boundary_scope.project.id
 }
 ```
@@ -127,7 +127,8 @@ resource "boundary_role" "readonly" {
 ### Optional
 
 - `description` (String) The role description.
-- `grant_scope_id` (String)
+- `grant_scope_id` (String, Deprecated) For Boundary 0.15+, use `grant_scope_ids` instead. The scope for which the grants in the role should apply.
+- `grant_scope_ids` (Set of String) A list of scopes for which the grants in this role should apply, which can include the special values "this", "children", or "descendants"
 - `grant_strings` (Set of String) A list of stringified grants for the role.
 - `name` (String) The role name. Defaults to the resource name.
 - `principal_ids` (Set of String) A list of principal (user or group) IDs to add as principals on the role.

docs/resources/scope.md

@@ -53,10 +53,10 @@ resource "boundary_scope" "org" {
 }
 
 resource "boundary_role" "org_admin" {
-  scope_id       = boundary_scope.global.id
-  grant_scope_id = boundary_scope.org.id
-  grant_strings  = ["id=*;type=*;actions=*"]
-  principal_ids  = ["u_auth"]
+  scope_id        = boundary_scope.global.id
+  grant_scope_ids = [boundary_scope.org.id]
+  grant_strings   = ["ids=*;type=*;actions=*"]
+  principal_ids   = ["u_auth"]
 }
 ```
 

docs/resources/scope_policy_attachment.md

@@ -0,0 +1,25 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_scope_policy_attachment Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  
+---
+
+# boundary_scope_policy_attachment (Resource)
+
+
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `policy_id` (String)
+- `scope_id` (String)
+
+### Read-Only
+
+- `id` (String) The ID of this resource.

docs/resources/storage_bucket.md

@@ -21,8 +21,8 @@ resource "boundary_scope" "org" {
   auto_create_default_role = true
 }
 
-resource "boundary_storage_bucket" "aws_example" {
-  name            = "My aws storage bucket"
+resource "boundary_storage_bucket" "aws_static_credentials_example" {
+  name            = "My aws storage bucket with static credentials"
   description     = "My first storage bucket!"
   scope_id        = boundary_scope.org.id
   plugin_name     = "aws"
@@ -37,6 +37,23 @@ resource "boundary_storage_bucket" "aws_example" {
   })
   worker_filter = "\"pki\" in \"/tags/type\""
 }
+
+resource "boundary_storage_bucket" "aws_dynamic_credentials_example" {
+  name        = "My aws storage bucket with dynamic credentials"
+  description = "My first storage bucket!"
+  scope_id    = boundary_scope.org.id
+  plugin_name = "aws"
+  bucket_name = "mybucket"
+
+  # the role_arn value should be the same arn used as the instance profile that is attached to the ec2 instance
+  # https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html
+  attributes_json = jsonencode({
+    "region"                      = "us-east-1"
+    "role_arn"                    = "arn:aws:iam::123456789012:role/S3Access"
+    "disable_credential_rotation" = "true"
+  })
+  worker_filter = "\"pki\" in \"/tags/type\""
+}
 ```
 
 <!-- schema generated by tfplugindocs -->
@@ -46,7 +63,6 @@ resource "boundary_storage_bucket" "aws_example" {
 
 - `bucket_name` (String) The name of the bucket within the external object store service.
 - `scope_id` (String) The scope for this storage bucket.
-- `secrets_json` (String, Sensitive) The secrets for the storage bucket. Either values encoded with the "jsonencode" function, pre-escaped JSON string, or a file:// or env:// path. Set to a string "null" to clear any existing values. NOTE: Unlike "attributes_json", removing this block will NOT clear secrets from the storage bucket; this allows injecting secrets for one call, then removing them for storage.
 - `worker_filter` (String) Filters to the worker(s) that can handle requests for this storage bucket. The filter must match an existing worker in order to create a storage bucket.
 
 ### Optional
@@ -57,6 +73,7 @@ resource "boundary_storage_bucket" "aws_example" {
 - `name` (String) The storage bucket name. Defaults to the resource name.
 - `plugin_id` (String) The ID of the plugin that should back the resource. This or plugin_name must be defined.
 - `plugin_name` (String) The name of the plugin that should back the resource. This or plugin_id must be defined.
+- `secrets_json` (String, Sensitive) The secrets for the storage bucket. Either values encoded with the "jsonencode" function, pre-escaped JSON string, or a file:// or env:// path. Set to a string "null" to clear any existing values. NOTE: Unlike "attributes_json", removing this block will NOT clear secrets from the storage bucket; this allows injecting secrets for one call, then removing them for storage.
 
 ### Read-Only
 

examples/resources/boundary_policy/resource.tf

@@ -0,0 +1,27 @@
+resource "boundary_scope" "global" {
+  global_scope = true
+  scope_id     = "global"
+}
+
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = boundary_scope.global.id
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_policy_storage" "foo" {
+  name                     = "foo"
+  description              = "Foo policy"
+  scope_id                 = boundary_scope.org.id
+  retain_for_days          = 10
+  retain_for_overridable   = false
+  delete_after_days        = 10
+  delete_after_overridable = true
+}
+
+resource "boundary_scope_policy_attachment" "foo_attachment" {
+  scope_id  = boundary_scope.org.id
+  policy_id = boundary_policy_storage.foo.id
+}

examples/resources/boundary_role/project-specific/resource.tf

@@ -23,6 +23,6 @@ resource "boundary_role" "readonly" {
   name          = "readonly"
   description   = "A readonly role"
   principal_ids = [boundary_user.readonly.id]
-  grant_strings = ["id=*;type=*;actions=read"]
+  grant_strings = ["ids=*;type=*;actions=read"]
   scope_id      = boundary_scope.project.id
 }

examples/resources/boundary_role/user-grants/resource.tf

@@ -16,6 +16,6 @@ resource "boundary_role" "readonly" {
   name          = "readonly"
   description   = "A readonly role"
   principal_ids = [boundary_user.readonly.id]
-  grant_strings = ["id=*;type=*;actions=read"]
+  grant_strings = ["ids=*;type=*;actions=read"]
   scope_id      = boundary_scope.org.id
 }

examples/resources/boundary_scope/role.tf

@@ -5,8 +5,8 @@ resource "boundary_scope" "org" {
 }
 
 resource "boundary_role" "org_admin" {
-  scope_id       = boundary_scope.global.id
-  grant_scope_id = boundary_scope.org.id
-  grant_strings  = ["id=*;type=*;actions=*"]
-  principal_ids  = ["u_auth"]
+  scope_id        = boundary_scope.global.id
+  grant_scope_ids = [boundary_scope.org.id]
+  grant_strings   = ["ids=*;type=*;actions=*"]
+  principal_ids   = ["u_auth"]
 }

examples/resources/boundary_storage_bucket/resource.tf

@@ -6,8 +6,8 @@ resource "boundary_scope" "org" {
   auto_create_default_role = true
 }
 
-resource "boundary_storage_bucket" "aws_example" {
-  name            = "My aws storage bucket"
+resource "boundary_storage_bucket" "aws_static_credentials_example" {
+  name            = "My aws storage bucket with static credentials"
   description     = "My first storage bucket!"
   scope_id        = boundary_scope.org.id
   plugin_name     = "aws"
@@ -22,3 +22,20 @@ resource "boundary_storage_bucket" "aws_example" {
   })
   worker_filter = "\"pki\" in \"/tags/type\""
 }
+
+resource "boundary_storage_bucket" "aws_dynamic_credentials_example" {
+  name        = "My aws storage bucket with dynamic credentials"
+  description = "My first storage bucket!"
+  scope_id    = boundary_scope.org.id
+  plugin_name = "aws"
+  bucket_name = "mybucket"
+
+  # the role_arn value should be the same arn used as the instance profile that is attached to the ec2 instance
+  # https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html
+  attributes_json = jsonencode({
+    "region"                      = "us-east-1"
+    "role_arn"                    = "arn:aws:iam::123456789012:role/S3Access"
+    "disable_credential_rotation" = "true"
+  })
+  worker_filter = "\"pki\" in \"/tags/type\""
+}

go.mod

@@ -1,27 +1,27 @@
 module github.com/hashicorp/terraform-provider-boundary
 
-go 1.21
+go 1.21.5
 
 require (
 	github.com/YakDriver/regexache v0.23.0
-	github.com/hashicorp/boundary v0.14.3
-	github.com/hashicorp/boundary/api v0.0.44-0.20231208155124-8fb3f31f8102
-	github.com/hashicorp/boundary/sdk v0.0.41-0.20231208155124-8fb3f31f8102
-	github.com/hashicorp/cap v0.4.1
-	github.com/hashicorp/cap/ldap v0.0.0-20231012003312-273118a6e3b8
+	github.com/hashicorp/boundary v0.15.0
+	github.com/hashicorp/boundary/api v0.0.46-0.20240209231500-1b1c8b3bf9a6
+	github.com/hashicorp/boundary/sdk v0.0.43-0.20240209231500-1b1c8b3bf9a6
+	github.com/hashicorp/cap v0.5.0
+	github.com/hashicorp/cap/ldap v0.0.0-20240206183135-ed8f24513744
 	github.com/hashicorp/go-cty v1.4.1-0.20200723130312-85980079f637
-	github.com/hashicorp/go-kms-wrapping/v2 v2.0.15
+	github.com/hashicorp/go-kms-wrapping/v2 v2.0.16
 	github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.11
 	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8
 	github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.6
-	github.com/hashicorp/terraform-plugin-docs v0.16.0
-	github.com/hashicorp/terraform-plugin-sdk/v2 v2.31.0
+	github.com/hashicorp/terraform-plugin-docs v0.18.0
+	github.com/hashicorp/terraform-plugin-sdk/v2 v2.32.0
 	github.com/jimlambrt/gldap v0.1.9
 	github.com/kr/pretty v0.3.1
 	github.com/mitchellh/go-homedir v1.1.0
 	github.com/stretchr/testify v1.8.4
-	golang.org/x/crypto v0.16.0
-	mvdan.cc/gofumpt v0.5.0
+	golang.org/x/crypto v0.19.0
+	mvdan.cc/gofumpt v0.6.0
 )
 
 require (
@@ -29,6 +29,7 @@ require (
 	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
 	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
 	github.com/DATA-DOG/go-sqlmock v1.5.0 // indirect
+	github.com/Kunde21/markdownfmt/v3 v3.1.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.2.0 // indirect
 	github.com/Masterminds/sprig/v3 v3.2.3 // indirect
@@ -43,9 +44,9 @@ require (
 	github.com/bgentry/speakeasy v0.1.0 // indirect
 	github.com/cenkalti/backoff v2.2.1+incompatible // indirect
 	github.com/cenkalti/backoff/v3 v3.0.0 // indirect
-	github.com/cenkalti/backoff/v4 v4.2.0 // indirect
+	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
-	github.com/cloudflare/circl v1.3.3 // indirect
+	github.com/cloudflare/circl v1.3.7 // indirect
 	github.com/containerd/continuity v0.3.0 // indirect
 	github.com/coreos/go-oidc/v3 v3.8.0 // indirect
 	github.com/danieljoos/wincred v1.2.0 // indirect
@@ -54,9 +55,12 @@ require (
 	github.com/docker/docker v24.0.7+incompatible // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
-	github.com/dvsekhvalnov/jose2go v1.5.0 // indirect
-	github.com/fatih/color v1.15.0 // indirect
+	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/dvsekhvalnov/jose2go v1.5.1-0.20231206184617-48ba0b76bc88 // indirect
+	github.com/fatih/color v1.16.0 // indirect
 	github.com/fatih/structs v1.1.0 // indirect
+	github.com/glebarez/go-sqlite v1.21.2 // indirect
+	github.com/glebarez/sqlite v1.9.0 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.5 // indirect
 	github.com/go-jose/go-jose/v3 v3.0.1 // indirect
 	github.com/go-ldap/ldap/v3 v3.4.6 // indirect
@@ -66,17 +70,18 @@ require (
 	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
-	github.com/google/uuid v1.3.1 // indirect
-	github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 // indirect
+	github.com/google/uuid v1.4.0 // indirect
+	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.18.0 // indirect
+	github.com/hashicorp/cli v1.1.6 // indirect
 	github.com/hashicorp/dbassert v0.0.0-20231012105025-1bc1bd88e22b // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/eventlogger v0.2.6-0.20231025104552-802587e608f0 // indirect
 	github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20231025104552-802587e608f0 // indirect
-	github.com/hashicorp/go-bexpr v0.1.12 // indirect
+	github.com/hashicorp/go-bexpr v0.1.13 // indirect
 	github.com/hashicorp/go-checkpoint v0.5.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-dbw v0.1.1-0.20231011231112-ed00db42814c // indirect
+	github.com/hashicorp/go-dbw v0.1.1 // indirect
 	github.com/hashicorp/go-hclog v1.5.0 // indirect
 	github.com/hashicorp/go-kms-wrapping/extras/kms/v2 v2.0.0-20231124110655-4315424d22d0 // indirect
 	github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.5 // indirect
@@ -100,14 +105,14 @@ require (
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/hashicorp/hcl/v2 v2.19.1 // indirect
 	github.com/hashicorp/logutils v1.0.0 // indirect
-	github.com/hashicorp/nodeenrollment v0.2.7 // indirect
-	github.com/hashicorp/terraform-exec v0.19.0 // indirect
-	github.com/hashicorp/terraform-json v0.18.0 // indirect
-	github.com/hashicorp/terraform-plugin-go v0.20.0 // indirect
+	github.com/hashicorp/nodeenrollment v0.2.9 // indirect
+	github.com/hashicorp/terraform-exec v0.20.0 // indirect
+	github.com/hashicorp/terraform-json v0.21.0 // indirect
+	github.com/hashicorp/terraform-plugin-go v0.21.0 // indirect
 	github.com/hashicorp/terraform-plugin-log v0.9.0 // indirect
 	github.com/hashicorp/terraform-registry-address v0.2.3 // indirect
 	github.com/hashicorp/terraform-svchost v0.1.1 // indirect
-	github.com/hashicorp/vault/api v1.9.1 // indirect
+	github.com/hashicorp/vault/api v1.10.0 // indirect
 	github.com/hashicorp/vault/sdk v0.3.0 // indirect
 	github.com/hashicorp/yamux v0.1.1 // indirect
 	github.com/huandu/xstrings v1.4.0 // indirect
@@ -124,15 +129,16 @@ require (
 	github.com/jefferai/go-libsecret v0.0.0-20210525195240-b53481abef97 // indirect
 	github.com/jefferai/isbadcipher v0.0.0-20190226160619-51d2077c035f // indirect
 	github.com/jefferai/keyring v1.1.7-0.20220316160357-58a74bb55891 // indirect
-	github.com/jinzhu/gorm v1.9.12 // indirect
+	github.com/jinzhu/gorm v1.9.16 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
 	github.com/kr/text v0.2.0 // indirect
 	github.com/lib/pq v1.10.9 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-isatty v0.0.19 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-runewidth v0.0.9 // indirect
 	github.com/mattn/go-sqlite3 v2.0.3+incompatible // indirect
-	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
 	github.com/mikesmitty/edkey v0.0.0-20170222072505-3356ea4e686a // indirect
 	github.com/mitchellh/cli v1.1.5 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
@@ -147,17 +153,18 @@ require (
 	github.com/oklog/run v1.1.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.0.2 // indirect
-	github.com/opencontainers/runc v1.1.5 // indirect
-	github.com/ory/dockertest/v3 v3.9.1 // indirect
+	github.com/opencontainers/runc v1.1.12 // indirect
+	github.com/ory/dockertest/v3 v3.10.0 // indirect
 	github.com/pires/go-proxyproto v0.7.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/posener/complete v1.2.3 // indirect
-	github.com/prometheus/client_golang v1.12.1 // indirect
-	github.com/prometheus/client_model v0.2.0 // indirect
-	github.com/prometheus/common v0.32.1 // indirect
-	github.com/prometheus/procfs v0.7.3 // indirect
-	github.com/rogpeppe/go-internal v1.10.0 // indirect
+	github.com/prometheus/client_golang v1.17.0 // indirect
+	github.com/prometheus/client_model v0.4.1-0.20230718164431-9a2bf3000d16 // indirect
+	github.com/prometheus/common v0.44.0 // indirect
+	github.com/prometheus/procfs v0.11.1 // indirect
+	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
+	github.com/rogpeppe/go-internal v1.12.0 // indirect
 	github.com/russross/blackfriday v1.6.0 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
 	github.com/sethvargo/go-diceware v0.3.0 // indirect
@@ -171,29 +178,34 @@ require (
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	github.com/xo/dburl v0.16.0 // indirect
+	github.com/yuin/goldmark v1.6.0 // indirect
+	github.com/yuin/goldmark-meta v1.1.0 // indirect
 	github.com/zalando/go-keyring v0.2.3 // indirect
-	github.com/zclconf/go-cty v1.14.1 // indirect
+	github.com/zclconf/go-cty v1.14.2 // indirect
 	go.uber.org/atomic v1.11.0 // indirect
 	golang.org/x/exp v0.0.0-20231006140011-7918f672742d // indirect
 	golang.org/x/mod v0.14.0 // indirect
-	golang.org/x/net v0.18.0 // indirect
-	golang.org/x/oauth2 v0.13.0 // indirect
-	golang.org/x/sync v0.4.0 // indirect
-	golang.org/x/sys v0.15.0 // indirect
-	golang.org/x/term v0.15.0 // indirect
+	golang.org/x/net v0.20.0 // indirect
+	golang.org/x/oauth2 v0.14.0 // indirect
+	golang.org/x/sync v0.6.0 // indirect
+	golang.org/x/sys v0.17.0 // indirect
+	golang.org/x/term v0.17.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
-	golang.org/x/tools v0.14.0 // indirect
+	golang.org/x/tools v0.17.0 // indirect
 	google.golang.org/appengine v1.6.8 // indirect
-	google.golang.org/genproto v0.0.0-20231016165738-49dd2c1f3d0b // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20231030173426-d783a09b4405 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20231030173426-d783a09b4405 // indirect
-	google.golang.org/grpc v1.60.0 // indirect
-	google.golang.org/protobuf v1.31.0 // indirect
-	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
+	google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20231106174013-bbf56f31fb17 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20231106174013-bbf56f31fb17 // indirect
+	google.golang.org/grpc v1.61.0 // indirect
+	google.golang.org/protobuf v1.32.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	gorm.io/driver/postgres v1.5.2 // indirect
-	gorm.io/driver/sqlite v1.5.3 // indirect
-	gorm.io/gorm v1.25.4 // indirect
+	gorm.io/driver/postgres v1.5.4 // indirect
+	gorm.io/driver/sqlite v1.5.4 // indirect
+	gorm.io/gorm v1.25.5 // indirect
+	modernc.org/libc v1.22.5 // indirect
+	modernc.org/mathutil v1.5.0 // indirect
+	modernc.org/memory v1.5.0 // indirect
+	modernc.org/sqlite v1.23.1 // indirect
 )

internal/provider/data_source_scope_test.go

@@ -42,8 +42,8 @@ resource "boundary_scope" "project" {
 
 resource "boundary_role" "org_admin" {
 	scope_id = "global"
-	grant_scope_id = boundary_scope.org.id
-	grant_strings = ["id=*;type=*;actions=*"]
+	grant_scope_ids = [boundary_scope.org.id]
+	grant_strings = ["ids=*;type=*;actions=*"]
 	principal_ids = ["u_auth"]
 }
 

internal/provider/provider.go

@@ -120,6 +120,8 @@ func New() *schema.Provider {
 			"boundary_host_set":                                 resourceHostSet(),
 			"boundary_host_set_static":                          resourceHostSetStatic(),
 			"boundary_host_set_plugin":                          resourceHostSetPlugin(),
+			"boundary_policy_storage":                           resourcePolicyStorage(),
+			"boundary_scope_policy_attachment":                  resourceScopePolicyAttachment(),
 			"boundary_role":                                     resourceRole(),
 			"boundary_scope":                                    resourceScope(),
 			"boundary_storage_bucket":                           resourceStorageBucket(),

internal/provider/resource_account_ldap_test.go

@@ -92,8 +92,8 @@ resource "boundary_user" "alice" {
 
 resource "boundary_role" "ldap_principal" {
 	scope_id = boundary_scope.global.id
-	grant_scope_id = boundary_scope.global.id
-	grant_strings = ["id=*;type=*;actions=*"]
+	grant_scope_ids = [boundary_scope.global.id]
+	grant_strings = ["ids=*;type=*;actions=*"]
 	principal_ids = [boundary_user.alice.id]
 }`
 )

internal/provider/resource_policy_storage.go

@@ -0,0 +1,303 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package provider
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/policies"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+const (
+	policyStorageRetainForDaysKey          = "retain_for_days"
+	policyStorageRetainForOverridableKey   = "retain_for_overridable"
+	policyStorageDeleteAfterDaysKey        = "delete_after_days"
+	policyStorageDeleteAfterOverridableKey = "delete_after_overridable"
+	policyTypeStorage                      = "storage"
+	daysField                              = "days"
+	overridableField                       = "overridable"
+)
+
+func resourcePolicyStorage() *schema.Resource {
+	return &schema.Resource{
+		Description: "The storage policy resource allows you to configure a Boundary storage policy. " +
+			"Storage policies allow an admin to configure how long session recordings must be stored and when " +
+			"to delete them. Storage policies must be applied to the global scope or an org scope in order to take effect.",
+		CreateContext: resourcePolicyStorageCreate,
+		ReadContext:   resourcePolicyStorageRead,
+		UpdateContext: resourcePolicyStorageUpdate,
+		DeleteContext: resourcePolicyStorageDelete,
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			IDKey: {
+				Description: "The ID of the policy.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			NameKey: {
+				Description: "The policy name. Defaults to the resource name.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			DescriptionKey: {
+				Description: "The policy description.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			ScopeIdKey: {
+				Description: "The scope for this policy.",
+				Type:        schema.TypeString,
+				Required:    true,
+			},
+			policyStorageRetainForDaysKey: {
+				Description:  "The number of days a session recording is required to be stored. Defaults to 0: allow deletions at any time. However, " + policyStorageRetainForDaysKey + " and " + policyStorageDeleteAfterDaysKey + " cannot both be 0.",
+				Type:         schema.TypeInt,
+				Optional:     true,
+				AtLeastOneOf: []string{policyStorageDeleteAfterDaysKey},
+			},
+			policyStorageRetainForOverridableKey: {
+				Description: "Whether or not the associated " + policyStorageRetainForDaysKey + " value can be overridden by org scopes. Note: if the associated " + policyStorageRetainForDaysKey + " value is 0, overridable is ignored.",
+				Type:        schema.TypeBool,
+				Optional:    true,
+			},
+			policyStorageDeleteAfterDaysKey: {
+				Description:  "The number of days after which a session recording will be automatically deleted. Defaults to 0: never automatically delete. However, " + policyStorageDeleteAfterDaysKey + " and " + policyStorageRetainForDaysKey + " cannot both be 0.",
+				Type:         schema.TypeInt,
+				Optional:     true,
+				AtLeastOneOf: []string{policyStorageRetainForDaysKey},
+			},
+			policyStorageDeleteAfterOverridableKey: {
+				Description: "Whether or not the associated " + policyStorageDeleteAfterDaysKey + " value can be overridden by org scopes. Note: if the associated " + policyStorageDeleteAfterDaysKey + " value is 0, overridable is ignored",
+				Type:        schema.TypeBool,
+				Optional:    true,
+			},
+		},
+	}
+}
+
+func setFromPolicyItem(d *schema.ResourceData, p *policies.Policy) error {
+	d.SetId(p.Id)
+
+	if err := d.Set(NameKey, p.Name); err != nil {
+		return err
+	}
+
+	if err := d.Set(DescriptionKey, p.Description); err != nil {
+		return err
+	}
+
+	if err := d.Set(ScopeIdKey, p.ScopeId); err != nil {
+		return err
+	}
+
+	// parse attributes to the retain/delete values so that the tf syntax is simpler
+	attributes, err := p.GetStoragePolicyAttributes()
+	if err != nil {
+		return err
+	}
+
+	// retain_for attribute
+	if attributes.RetainFor != nil {
+		if err := d.Set(policyStorageRetainForDaysKey, attributes.RetainFor.Days); err != nil {
+			return err
+		}
+		if err := d.Set(policyStorageRetainForOverridableKey, attributes.RetainFor.Overridable); err != nil {
+			return err
+		}
+	} else {
+		// no RetainFor, set to nil
+		if err := d.Set(policyStorageRetainForDaysKey, nil); err != nil {
+			return err
+		}
+		if err := d.Set(policyStorageRetainForOverridableKey, nil); err != nil {
+			return err
+		}
+	}
+
+	// delete_after attribute
+	if attributes.DeleteAfter != nil {
+		if err := d.Set(policyStorageDeleteAfterDaysKey, attributes.DeleteAfter.Days); err != nil {
+			return err
+		}
+		if err := d.Set(policyStorageDeleteAfterOverridableKey, attributes.DeleteAfter.Overridable); err != nil {
+			return err
+		}
+	} else {
+		// no DeleteAfter, set to nil
+		if err := d.Set(policyStorageDeleteAfterDaysKey, nil); err != nil {
+			return err
+		}
+		if err := d.Set(policyStorageDeleteAfterOverridableKey, nil); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func resourcePolicyStorageCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	pClient := policies.NewClient(md.client)
+	opts := []policies.Option{}
+
+	var scopeId string
+	if scopeIdVal, ok := d.GetOk(ScopeIdKey); ok {
+		scopeId = scopeIdVal.(string)
+	} else {
+		return diag.Errorf("no scope ID provided")
+	}
+
+	if nameVal, ok := d.GetOk(NameKey); ok {
+		opts = append(opts, policies.WithName(nameVal.(string)))
+	}
+
+	if descVal, ok := d.GetOk(DescriptionKey); ok {
+		opts = append(opts, policies.WithDescription(descVal.(string)))
+	}
+
+	if retainDaysVal, ok := d.GetOk(policyStorageRetainForDaysKey); ok {
+		opts = append(opts, policies.WithStoragePolicyRetainForDays(int32(retainDaysVal.(int))))
+	} else {
+		opts = append(opts, policies.DefaultStoragePolicyRetainForDays())
+	}
+	if retainOverrideVal, ok := d.GetOk(policyStorageRetainForOverridableKey); ok {
+		opts = append(opts, policies.WithStoragePolicyRetainForOverridable(retainOverrideVal.(bool)))
+	} else {
+		opts = append(opts, policies.DefaultStoragePolicyRetainForOverridable())
+	}
+
+	if deleteDaysVal, ok := d.GetOk(policyStorageDeleteAfterDaysKey); ok {
+		opts = append(opts, policies.WithStoragePolicyDeleteAfterDays(int32(deleteDaysVal.(int))))
+	} else {
+		opts = append(opts, policies.DefaultStoragePolicyDeleteAfterDays())
+	}
+	if deleteOverrideVal, ok := d.GetOk(policyStorageDeleteAfterOverridableKey); ok {
+		opts = append(opts, policies.WithStoragePolicyDeleteAfterOverridable(deleteOverrideVal.(bool)))
+	} else {
+		opts = append(opts, policies.DefaultStoragePolicyDeleteAfterOverridable())
+	}
+
+	p, err := pClient.Create(ctx, policyTypeStorage, scopeId, opts...)
+	if err != nil {
+		return diag.Errorf("error creating storage policy: %v", err)
+	}
+	if p == nil {
+		return diag.Errorf("nil storage policy after create")
+	}
+
+	if err := setFromPolicyItem(d, p.GetItem()); err != nil {
+		return diag.FromErr(err)
+	}
+
+	return nil
+}
+
+func resourcePolicyStorageRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	pClient := policies.NewClient(md.client)
+
+	p, err := pClient.Read(ctx, d.Id())
+	if err != nil {
+		if apiErr := api.AsServerError(err); apiErr != nil && apiErr.Response().StatusCode() == http.StatusNotFound {
+			d.SetId("")
+			return nil
+		}
+		return diag.Errorf("error reading policy: %v", err)
+	}
+	if p == nil {
+		return diag.Errorf("policy nil after read")
+	}
+
+	if err := setFromPolicyItem(d, p.GetItem()); err != nil {
+		return diag.FromErr(err)
+	}
+
+	return nil
+}
+
+func resourcePolicyStorageUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	pClient := policies.NewClient(md.client)
+	opts := []policies.Option{}
+
+	if d.HasChange(NameKey) {
+		if nameVal, ok := d.GetOk(NameKey); ok {
+			name := nameVal.(string)
+			opts = append(opts, policies.WithName(name))
+		} else {
+			opts = append(opts, policies.DefaultName())
+		}
+	}
+
+	if d.HasChange(DescriptionKey) {
+		if descriptionVal, ok := d.GetOk(DescriptionKey); ok {
+			description := descriptionVal.(string)
+			opts = append(opts, policies.WithDescription(description))
+		} else {
+			opts = append(opts, policies.DefaultDescription())
+		}
+	}
+
+	if d.HasChanges(policyStorageRetainForDaysKey, policyStorageRetainForOverridableKey) {
+		if retainDaysVal, ok := d.GetOk(policyStorageRetainForDaysKey); ok {
+			opts = append(opts, policies.WithStoragePolicyRetainForDays(int32(retainDaysVal.(int))))
+		} else {
+			opts = append(opts, policies.DefaultStoragePolicyRetainForDays())
+		}
+		if retainOverrideVal, ok := d.GetOk(policyStorageRetainForOverridableKey); ok {
+			opts = append(opts, policies.WithStoragePolicyRetainForOverridable(retainOverrideVal.(bool)))
+		} else {
+			opts = append(opts, policies.DefaultStoragePolicyRetainForOverridable())
+		}
+	}
+
+	if d.HasChanges(policyStorageDeleteAfterDaysKey, policyStorageDeleteAfterOverridableKey) {
+		if deleteDaysVal, ok := d.GetOk(policyStorageDeleteAfterDaysKey); ok {
+			opts = append(opts, policies.WithStoragePolicyDeleteAfterDays(int32(deleteDaysVal.(int))))
+		} else {
+			opts = append(opts, policies.DefaultStoragePolicyDeleteAfterDays())
+		}
+		if deleteOverrideVal, ok := d.GetOk(policyStorageDeleteAfterOverridableKey); ok {
+			opts = append(opts, policies.WithStoragePolicyDeleteAfterOverridable(deleteOverrideVal.(bool)))
+		} else {
+			opts = append(opts, policies.DefaultStoragePolicyDeleteAfterOverridable())
+		}
+	}
+
+	if len(opts) > 0 {
+		opts = append(opts, policies.WithAutomaticVersioning(true))
+		p, err := pClient.Update(ctx, d.Id(), 0, opts...)
+		if err != nil {
+			return diag.Errorf("error creating storage policy: %v", err)
+		}
+		if p == nil {
+			return diag.Errorf("nil storage policy after create")
+		}
+
+		if err := setFromPolicyItem(d, p.GetItem()); err != nil {
+			return diag.FromErr(err)
+		}
+	}
+
+	return nil
+}
+
+func resourcePolicyStorageDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	pClient := policies.NewClient(md.client)
+
+	_, err := pClient.Delete(ctx, d.Id())
+	if err != nil {
+		return diag.Errorf("error deleting policy: %v", err)
+	}
+
+	return nil
+}

internal/provider/resource_role.go

@@ -5,7 +5,12 @@ package provider
 
 import (
 	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
 	"net/http"
+	"strings"
+	"unicode"
 
 	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/roles"
@@ -14,9 +19,10 @@ import (
 )
 
 const (
-	roleGrantScopeIdKey = "grant_scope_id"
-	rolePrincipalIdsKey = "principal_ids"
-	roleGrantStringsKey = "grant_strings"
+	roleGrantScopeIdKey  = "grant_scope_id"
+	roleGrantScopeIdsKey = "grant_scope_ids"
+	rolePrincipalIdsKey  = "principal_ids"
+	roleGrantStringsKey  = "grant_strings"
 )
 
 func resourceRole() *schema.Resource {
@@ -60,15 +66,24 @@ func resourceRole() *schema.Resource {
 				Elem:        &schema.Schema{Type: schema.TypeString},
 			},
 			roleGrantStringsKey: {
-				Description: " A list of stringified grants for the role.",
+				Description: "A list of stringified grants for the role.",
 				Type:        schema.TypeSet,
 				Optional:    true,
 				Elem:        &schema.Schema{Type: schema.TypeString},
 			},
 			roleGrantScopeIdKey: {
-				Type:     schema.TypeString,
-				Optional: true,
-				Computed: true,
+				Description: "For Boundary 0.15+, use `grant_scope_ids` instead. The scope for which the grants in the role should apply.",
+				Type:        schema.TypeString,
+				Optional:    true,
+				Computed:    true,
+				Deprecated:  "In Boundary 0.15+, please use `grant_scope_ids` instead. This field will be removed in a future release.",
+			},
+			roleGrantScopeIdsKey: {
+				Description: `A list of scopes for which the grants in this role should apply, which can include the special values "this", "children", or "descendants"`,
+				Type:        schema.TypeSet,
+				Optional:    true,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+				Computed:    true,
 			},
 		},
 	}
@@ -90,14 +105,18 @@ func setFromRoleResponseMap(d *schema.ResourceData, raw map[string]interface{})
 	if err := d.Set(roleGrantStringsKey, raw["grant_strings"]); err != nil {
 		return err
 	}
+	if err := d.Set(roleGrantScopeIdsKey, raw["grant_scope_ids"]); err != nil {
+		return err
+	}
 	if err := d.Set(roleGrantScopeIdKey, raw["grant_scope_id"]); err != nil {
 		return err
 	}
+
 	d.SetId(raw["id"].(string))
 	return nil
 }
 
-func resourceRoleCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) (errs diag.Diagnostics) {
+func resourceRoleCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) (diags diag.Diagnostics) {
 	md := meta.(*metaData)
 
 	var scopeId string
@@ -121,11 +140,19 @@ func resourceRoleCreate(ctx context.Context, d *schema.ResourceData, meta interf
 		opts = append(opts, roles.WithDescription(descStr))
 	}
 
-	grantScopeIdVal, ok := d.GetOk(roleGrantScopeIdKey)
-	if ok {
+	grantScopeIdVal := d.Get(roleGrantScopeIdKey)
+	if grantScopeIdVal != "" {
 		grantScopeIdStr := grantScopeIdVal.(string)
 		opts = append(opts, roles.WithGrantScopeId(grantScopeIdStr))
 	}
+	var grantScopeIds []string
+	if grantScopeIdsVal, ok := d.GetOk(roleGrantScopeIdsKey); ok {
+		list := grantScopeIdsVal.(*schema.Set).List()
+		grantScopeIds = make([]string, 0, len(list))
+		for _, i := range list {
+			grantScopeIds = append(grantScopeIds, i.(string))
+		}
+	}
 
 	var principalIds []string
 	if principalIdsVal, ok := d.GetOk(rolePrincipalIdsKey); ok {
@@ -141,6 +168,16 @@ func resourceRoleCreate(ctx context.Context, d *schema.ResourceData, meta interf
 		list := grantStringsVal.(*schema.Set).List()
 		grantStrings = make([]string, 0, len(list))
 		for _, i := range list {
+			for _, grant := range list {
+				deprecationNotice, err := checkGrantForDeprecation(grant.(string))
+				if err != nil {
+					return diag.FromErr(err)
+				}
+				if deprecationNotice != "" {
+					diags = append(diags, diag.Diagnostic{Severity: diag.Warning, Summary: "deprecated field found in grant", Detail: deprecationNotice})
+				}
+				grantStrings = append(grantStrings, grant.(string))
+			}
 			grantStrings = append(grantStrings, i.(string))
 		}
 	}
@@ -157,7 +194,7 @@ func resourceRoleCreate(ctx context.Context, d *schema.ResourceData, meta interf
 	apiResponse := tcr.GetResponse().Map
 	defer func() {
 		if err := setFromRoleResponseMap(d, apiResponse); err != nil {
-			errs = append(errs, diag.FromErr(err)...)
+			diags = append(diags, diag.FromErr(err)...)
 		}
 	}()
 
@@ -165,9 +202,9 @@ func resourceRoleCreate(ctx context.Context, d *schema.ResourceData, meta interf
 		tspr, err := rc.SetPrincipals(ctx, tcr.Item.Id, 0, principalIds, roles.WithAutomaticVersioning(true))
 		switch {
 		case err != nil:
-			errs = append(errs, diag.Diagnostic{Severity: diag.Error, Summary: "error setting principals", Detail: err.Error()})
+			diags = append(diags, diag.Diagnostic{Severity: diag.Error, Summary: "error setting principals", Detail: err.Error()})
 		case tspr == nil:
-			errs = append(errs, diag.Diagnostic{Severity: diag.Error, Summary: "nil role after setting principals"})
+			diags = append(diags, diag.Diagnostic{Severity: diag.Error, Summary: "nil role after setting principals"})
 		default:
 			apiResponse = tspr.GetResponse().Map
 		}
@@ -177,15 +214,27 @@ func resourceRoleCreate(ctx context.Context, d *schema.ResourceData, meta interf
 		tsgr, err := rc.SetGrants(ctx, tcr.Item.Id, 0, grantStrings, roles.WithAutomaticVersioning(true))
 		switch {
 		case err != nil:
-			errs = append(errs, diag.Diagnostic{Severity: diag.Error, Summary: "error setting grants", Detail: err.Error()})
+			diags = append(diags, diag.Diagnostic{Severity: diag.Error, Summary: "error setting grants", Detail: err.Error()})
 		case tsgr == nil:
-			errs = append(errs, diag.Diagnostic{Severity: diag.Error, Summary: "nil role after setting grants"})
+			diags = append(diags, diag.Diagnostic{Severity: diag.Error, Summary: "nil role after setting grants"})
 		default:
 			apiResponse = tsgr.GetResponse().Map
 		}
 	}
 
-	return errs
+	if grantScopeIds != nil {
+		tsgr, err := rc.SetGrantScopes(ctx, tcr.Item.Id, 0, grantScopeIds, roles.WithAutomaticVersioning(true))
+		switch {
+		case err != nil:
+			diags = append(diags, diag.Diagnostic{Severity: diag.Error, Summary: "error setting grant scopes", Detail: err.Error()})
+		case tsgr == nil:
+			diags = append(diags, diag.Diagnostic{Severity: diag.Error, Summary: "nil role after setting grant scope ids"})
+		default:
+			apiResponse = tsgr.GetResponse().Map
+		}
+	}
+
+	return diags
 }
 
 func resourceRoleRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
@@ -241,12 +290,17 @@ func resourceRoleUpdate(ctx context.Context, d *schema.ResourceData, meta interf
 
 	var grantScopeId *string
 	if d.HasChange(roleGrantScopeIdKey) {
-		opts = append(opts, roles.DefaultGrantScopeId())
-		grantScopeIdVal, ok := d.GetOk(roleGrantScopeIdKey)
-		if ok {
-			grantScopeIdStr := grantScopeIdVal.(string)
-			grantScopeId = &grantScopeIdStr
-			opts = append(opts, roles.WithGrantScopeId(grantScopeIdStr))
+		// If it is an update to use the multi-value grant_scope_ids, and this
+		// has changed to "", then don't set it on the API. Instead let it fall
+		// through and below it'll be updated to be "".
+		if !d.HasChange(roleGrantScopeIdsKey) {
+			opts = append(opts, roles.DefaultGrantScopeId())
+			grantScopeIdVal, ok := d.GetOk(roleGrantScopeIdKey)
+			if ok {
+				grantScopeIdStr := grantScopeIdVal.(string)
+				grantScopeId = &grantScopeIdStr
+				opts = append(opts, roles.WithGrantScopeId(grantScopeIdStr))
+			}
 		}
 	}
 
@@ -280,6 +334,13 @@ func resourceRoleUpdate(ctx context.Context, d *schema.ResourceData, meta interf
 		if grantStringsVal, ok := d.GetOk(roleGrantStringsKey); ok {
 			grants := grantStringsVal.(*schema.Set).List()
 			for _, grant := range grants {
+				deprecationNotice, err := checkGrantForDeprecation(grant.(string))
+				if err != nil {
+					return diag.FromErr(err)
+				}
+				if deprecationNotice != "" {
+					diags = append(diags, diag.Diagnostic{Severity: diag.Warning, Summary: "deprecated field found in grant", Detail: deprecationNotice})
+				}
 				grantStrings = append(grantStrings, grant.(string))
 			}
 		}
@@ -311,6 +372,24 @@ func resourceRoleUpdate(ctx context.Context, d *schema.ResourceData, meta interf
 		}
 	}
 
+	if d.HasChange(roleGrantScopeIdsKey) {
+		var grantScopeIds []string
+		if grantScopeIdsVal, ok := d.GetOk(roleGrantScopeIdsKey); ok {
+			grantScopes := grantScopeIdsVal.(*schema.Set).List()
+			for _, grantScope := range grantScopes {
+				grantScopeIds = append(grantScopeIds, grantScope.(string))
+			}
+		}
+		_, err := rc.SetGrantScopes(ctx, d.Id(), 0, grantScopeIds, roles.WithAutomaticVersioning(true))
+		if err != nil {
+			diags = append(diags, diag.Diagnostic{Severity: diag.Error, Summary: "error setting grant scopes", Detail: err.Error()})
+		} else {
+			if err := d.Set(roleGrantScopeIdsKey, grantScopeIds); err != nil {
+				return diag.FromErr(err)
+			}
+		}
+	}
+
 	return diags
 }
 
@@ -325,3 +404,35 @@ func resourceRoleDelete(ctx context.Context, d *schema.ResourceData, meta interf
 
 	return nil
 }
+
+func checkGrantForDeprecation(grantString string) (string, error) {
+	if len(grantString) == 0 {
+		return "", errors.New("missing grant string")
+	}
+	grantString = strings.ToValidUTF8(grantString, string(unicode.ReplacementChar))
+
+	switch {
+	case grantString[0] == '{':
+		raw := make(map[string]any, 4)
+		if err := json.Unmarshal([]byte(grantString), &raw); err != nil {
+			return "", fmt.Errorf("error json unmarshalling grant string: %w", err)
+		}
+		if raw["id"] != nil {
+			return `Grant contains an "id" field which is deprecated and will not be accepted from Boundary 0.15+. Please use "ids" instead.`, nil
+		}
+
+	default:
+		parts := strings.Split(grantString, ";")
+		for _, part := range parts {
+			splitPart := strings.Split(part, "=")
+			if len(splitPart) < 2 {
+				return "", fmt.Errorf("invalid grant part: %s", part)
+			}
+			if splitPart[0] == "id" {
+				return `Grant contains an "id" field which is deprecated and will not be accepted from Boundary 0.15+. Please use "ids" instead.`, nil
+			}
+		}
+	}
+
+	return "", nil
+}

internal/provider/resource_role_grant_scope_ids_upgrade_test.go

@@ -0,0 +1,295 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package provider
+
+import (
+	"context"
+	"fmt"
+	"regexp"
+	"testing"
+
+	"github.com/hashicorp/boundary/api/roles"
+	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+)
+
+var (
+	orgRoleWithGrantScopes = `
+	resource "boundary_role" "with_grant_scopes" {
+		name            = "with_grant_scopes"
+		description     = "with grant scopes"
+		principal_ids   = [boundary_user.foo.id]
+		scope_id        = boundary_scope.org1.id
+		depends_on      = [boundary_role.org1_admin]
+		grant_scope_ids = ["this", "children", boundary_scope.proj1.id]
+	}`
+
+	orgRoleWithGrantScopesUpdate = `
+	resource "boundary_role" "with_grant_scopes" {
+		name            = "with_grant_scopes_update"
+		description     = "with grant scopes update"
+		principal_ids   = [boundary_user.foo.id]
+		scope_id        = boundary_scope.org1.id
+		depends_on      = [boundary_role.org1_admin]
+		grant_scope_ids = ["this"]
+	}`
+
+	orgRoleWithInvalidGrantScopesUpdate = `
+	resource "boundary_role" "with_grant_scopes" {
+		name            = "with_grant_scopes_update"
+		description     = "with grant scopes update"
+		principal_ids   = [boundary_user.foo.id]
+		scope_id        = boundary_scope.org1.id
+		depends_on      = [boundary_role.org1_admin]
+		grant_scope_ids = ["this", "children", "p_foobar1234"]
+	}`
+
+	conversionOrgRoleWithGrantScopeId = `
+resource "boundary_role" "with_grant_scope_id" {
+	name            = "grant scope id role"
+	scope_id        = boundary_scope.org1.id
+	depends_on      = [boundary_role.org1_admin]
+	grant_scope_id  = boundary_scope.org1.id
+}`
+
+	conversionOrgRoleWithGrantScopeIdUpdate = `
+resource "boundary_role" "with_grant_scope_id" {
+	name            = "grant scope id role"
+	scope_id        = boundary_scope.org1.id
+	depends_on      = [boundary_role.org1_admin]
+	grant_scope_id  = boundary_scope.proj1.id
+}`
+
+	conversionOrgRoleWithGrantScopeIdsConversion = `
+resource "boundary_role" "with_grant_scope_id" {
+	name             = "grant scope id role"
+	scope_id         = boundary_scope.org1.id
+	depends_on       = [boundary_role.org1_admin]
+	grant_scope_ids  = ["this", boundary_scope.proj1.id]
+}`
+
+	conversionOrgRoleWithGrantScopeIdsUpdate = `
+resource "boundary_role" "with_grant_scope_id" {
+	name             = "grant scope id role"
+	scope_id         = boundary_scope.org1.id
+	depends_on       = [boundary_role.org1_admin]
+	grant_scope_ids  = ["this", "children"]
+}`
+)
+
+// TestAccRoleWithGrantScopes exercises creation and update with valid and
+// invalid grant scopes
+func TestAccRoleWithGrantScopes(t *testing.T) {
+	tc := controller.NewTestController(t, tcConfig...)
+	t.Cleanup(tc.Shutdown)
+	url := tc.ApiAddrs()[0]
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		IsUnitTest:        true,
+		ProviderFactories: providerFactories(&provider),
+		CheckDestroy:      testAccCheckRoleResourceDestroy(t, provider),
+		Steps: []resource.TestStep{
+			{
+				// Create with valid grant scopes should create role
+				Config: testConfig(url, fooOrg, firstProjectFoo, fooUser, orgRoleWithGrantScopes),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckScopeResourceExists(provider, "boundary_scope.proj1"),
+					testAccCheckRoleResourceExists(provider, "boundary_role.with_grant_scopes"),
+					testAccCheckUserResourceExists(provider, "boundary_user.foo"),
+					testAccCheckRoleResourceGrantScopesSet(provider, "boundary_role.with_grant_scopes", []string{"this", "children", "boundary_scope.proj1"}),
+					resource.TestCheckResourceAttr("boundary_role.with_grant_scopes", DescriptionKey, "with grant scopes"),
+					resource.TestCheckResourceAttr("boundary_role.with_grant_scopes", NameKey, "with_grant_scopes"),
+				),
+			},
+			importStep("boundary_role.with_grant_scopes"),
+			{
+				// Update with invalid grant scopes should update role but return empty plan
+				// since grant scopes were not set correctly.
+				Config: testConfig(url, fooOrg, firstProjectFoo, fooUser, orgRoleWithInvalidGrantScopesUpdate),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRoleResourceExists(provider, "boundary_role.with_grant_scopes"),
+					resource.TestCheckResourceAttr("boundary_role.with_grant_scopes", DescriptionKey, "with grant scopes update"),
+					resource.TestCheckResourceAttr("boundary_role.with_grant_scopes", NameKey, "with_grant_scopes_update"),
+				),
+				ExpectError: regexp.MustCompile(`Unable to set grant scopes on role`),
+			},
+			{
+				// Update again without invalid principal should produce empty plan
+				Config: testConfig(url, fooOrg, firstProjectFoo, fooUser, orgRoleWithGrantScopesUpdate),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRoleResourceExists(provider, "boundary_role.with_grant_scopes"),
+					testAccCheckRoleResourceGrantScopesSet(provider, "boundary_role.with_grant_scopes", []string{"this"}),
+					resource.TestCheckResourceAttr("boundary_role.with_grant_scopes", DescriptionKey, "with grant scopes update"),
+					resource.TestCheckResourceAttr("boundary_role.with_grant_scopes", NameKey, "with_grant_scopes_update"),
+				),
+			},
+			importStep("boundary_role.with_grant_scopes"),
+		},
+	})
+}
+
+// TestAccRoleGrantScopeUpgrade exercises some specific upgrade scenarios around
+// grant_scope_id -> grant_scope_ids
+func TestAccRoleWithGrantScopesUpdate(t *testing.T) {
+	tc := controller.NewTestController(t, tcConfig...)
+	t.Cleanup(tc.Shutdown)
+	url := tc.ApiAddrs()[0]
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		IsUnitTest:        true,
+		ProviderFactories: providerFactories(&provider),
+		CheckDestroy:      testAccCheckRoleResourceDestroy(t, provider),
+		Steps: []resource.TestStep{
+			{
+				// Create
+				Config: testConfig(url, fooOrg, firstProjectFoo, fooUser, conversionOrgRoleWithGrantScopeId),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckScopeResourceExists(provider, "boundary_scope.org1"),
+					testAccCheckRoleResourceExists(provider, "boundary_role.with_grant_scope_id"),
+					testAccCheckUserResourceExists(provider, "boundary_user.foo"),
+					testAccCheckRoleResourceGrantScopesSet(provider, "boundary_role.with_grant_scope_id", []string{"boundary_scope.org1"}),
+					testAccCheckRoleResourceGrantScopeSet(provider, "boundary_role.with_grant_scope_id", "boundary_scope.org1"),
+				),
+			},
+			importStep("boundary_role.with_grant_scope_id"),
+			{
+				Config: testConfig(url, fooOrg, firstProjectFoo, fooUser, conversionOrgRoleWithGrantScopeIdUpdate),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckScopeResourceExists(provider, "boundary_scope.org1"),
+					testAccCheckRoleResourceExists(provider, "boundary_role.with_grant_scope_id"),
+					testAccCheckUserResourceExists(provider, "boundary_user.foo"),
+					testAccCheckRoleResourceGrantScopesSet(provider, "boundary_role.with_grant_scope_id", []string{"boundary_scope.proj1"}),
+					testAccCheckRoleResourceGrantScopeSet(provider, "boundary_role.with_grant_scope_id", "boundary_scope.proj1"),
+				),
+			},
+			importStep("boundary_role.with_grant_scope_id"),
+			{
+				Config: testConfig(url, fooOrg, firstProjectFoo, fooUser, conversionOrgRoleWithGrantScopeIdsConversion),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckScopeResourceExists(provider, "boundary_scope.org1"),
+					testAccCheckRoleResourceExists(provider, "boundary_role.with_grant_scope_id"),
+					testAccCheckUserResourceExists(provider, "boundary_user.foo"),
+					testAccCheckRoleResourceGrantScopesSet(provider, "boundary_role.with_grant_scope_id", []string{"this", "boundary_scope.proj1"}),
+					testAccCheckRoleResourceGrantScopeSet(provider, "boundary_role.with_grant_scope_id", ""),
+				),
+			},
+			importStep("boundary_role.with_grant_scope_id"),
+			{
+				Config: testConfig(url, fooOrg, firstProjectFoo, fooUser, conversionOrgRoleWithGrantScopeIdsUpdate),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckScopeResourceExists(provider, "boundary_scope.org1"),
+					testAccCheckRoleResourceExists(provider, "boundary_role.with_grant_scope_id"),
+					testAccCheckUserResourceExists(provider, "boundary_user.foo"),
+					testAccCheckRoleResourceGrantScopesSet(provider, "boundary_role.with_grant_scope_id", []string{"this", "children"}),
+					testAccCheckRoleResourceGrantScopeSet(provider, "boundary_role.with_grant_scope_id", ""),
+				),
+			},
+			importStep("boundary_role.with_grant_scope_id"),
+		},
+	})
+}
+
+func testAccCheckRoleResourceGrantScopeSet(testProvider *schema.Provider, name string, grantScope string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("role resource not found: %s", name)
+		}
+
+		roleId := rs.Primary.ID
+
+		scopeId := grantScope
+		if grantScope != "children" && grantScope != "this" && grantScope != "descendants" && grantScope != "" {
+			scope, ok := s.RootModule().Resources[grantScope]
+			if !ok {
+				return fmt.Errorf("scope resource not found: %s", grantScope)
+			}
+
+			scopeId = scope.Primary.ID
+			if scopeId == "" {
+				return fmt.Errorf("role resource ID is not set")
+			}
+		}
+
+		md := testProvider.Meta().(*metaData)
+		rolesClient := roles.NewClient(md.client)
+
+		rr, err := rolesClient.Read(context.Background(), roleId)
+		if err != nil {
+			return fmt.Errorf("Got an error when reading role %q: %v", roleId, err)
+		}
+
+		if rr.Item.GrantScopeId != scopeId {
+			return fmt.Errorf("grant scope id in state is %s but in boundary is %s", scopeId, rr.Item.GrantScopeId)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckRoleResourceGrantScopesSet(testProvider *schema.Provider, name string, grantScopeIds []string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("role resource not found: %s", name)
+		}
+
+		id := rs.Primary.ID
+		if id == "" {
+			return fmt.Errorf("role resource ID is not set")
+		}
+
+		scopeIds := []string{}
+		for _, grantScope := range grantScopeIds {
+			if grantScope == "children" || grantScope == "this" || grantScope == "descendants" {
+				scopeIds = append(scopeIds, grantScope)
+				continue
+			}
+
+			scope, ok := s.RootModule().Resources[grantScope]
+			if !ok {
+				return fmt.Errorf("scope resource not found: %s", grantScope)
+			}
+
+			scopeId := scope.Primary.ID
+			if scopeId == "" {
+				return fmt.Errorf("scope resource ID not set")
+			}
+
+			scopeIds = append(scopeIds, scopeId)
+		}
+
+		md := testProvider.Meta().(*metaData)
+		rolesClient := roles.NewClient(md.client)
+
+		rr, err := rolesClient.Read(context.Background(), id)
+		if err != nil {
+			return fmt.Errorf("Got an error when reading role %q: %v", id, err)
+		}
+
+		// for every grant scope set on the role in the state, ensure each role
+		// in boundary has the same setings
+		if len(rr.Item.GrantScopeIds) == 0 {
+			return fmt.Errorf("no grant scope ids found in boundary")
+		}
+
+		for _, stateGrantScopeId := range rr.Item.GrantScopeIds {
+			ok := false
+			for _, gotScopeId := range scopeIds {
+				if gotScopeId == stateGrantScopeId {
+					ok = true
+				}
+			}
+			if !ok {
+				return fmt.Errorf("grant scope id in state not set in boundary: %s", stateGrantScopeId)
+			}
+		}
+
+		return nil
+	}
+}

internal/provider/resource_role_test.go

@@ -146,9 +146,9 @@ resource "boundary_role" "with_groups" {
 	depends_on     = [boundary_role.proj1_admin]
 }`
 
-	readonlyGrant       = "id=*;type=*;actions=read"
-	readonlyGrantUpdate = "id=*;type=*;actions=read,create"
-	invalidGrant        = "id=*;type=*;actions=badaction"
+	readonlyGrant       = "ids=*;type=*;actions=read"
+	readonlyGrantUpdate = "ids=*;type=*;actions=read,create"
+	invalidGrant        = "ids=*;type=*;actions=badaction"
 
 	projRoleWithGrants = fmt.Sprintf(`
 resource "boundary_role" "with_grants" {
@@ -189,7 +189,7 @@ resource "boundary_role" "with_grants" {
 
 func TestAccRoleToOrgToProject(t *testing.T) {
 	tc := controller.NewTestController(t, tcConfig...)
-	defer tc.Shutdown()
+	t.Cleanup(tc.Shutdown)
 	url := tc.ApiAddrs()[0]
 
 	var provider *schema.Provider
@@ -243,7 +243,7 @@ func TestAccRoleToOrgToProject(t *testing.T) {
 
 func TestAccRoleWithGrants(t *testing.T) {
 	tc := controller.NewTestController(t, tcConfig...)
-	defer tc.Shutdown()
+	t.Cleanup(tc.Shutdown)
 	url := tc.ApiAddrs()[0]
 
 	var provider *schema.Provider
@@ -302,7 +302,7 @@ func TestAccRoleWithGrants(t *testing.T) {
 
 func TestAccRoleWithPrincipals(t *testing.T) {
 	tc := controller.NewTestController(t, tcConfig...)
-	defer tc.Shutdown()
+	t.Cleanup(tc.Shutdown)
 	url := tc.ApiAddrs()[0]
 
 	var provider *schema.Provider
@@ -365,7 +365,7 @@ func TestAccRoleWithPrincipals(t *testing.T) {
 
 func TestAccRoleWithGroups(t *testing.T) {
 	tc := controller.NewTestController(t, tcConfig...)
-	defer tc.Shutdown()
+	t.Cleanup(tc.Shutdown)
 	url := tc.ApiAddrs()[0]
 
 	var provider *schema.Provider

internal/provider/resource_scope_policy_attachment.go

@@ -0,0 +1,164 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package provider
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/scopes"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+const (
+	policyIdKey         = "policy_id"
+	storagePolicyPrefix = "pst_"
+)
+
+func resourceScopePolicyAttachment() *schema.Resource {
+	return &schema.Resource{
+		CreateContext:        resourceScopePolicyAttachmentCreate,
+		ReadWithoutTimeout:   resourceScopePolicyAttachmentRead,
+		DeleteWithoutTimeout: resourceScopePolicyAttachmentDelete,
+
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			ScopeIdKey: {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			policyIdKey: {
+				Type:     schema.TypeString,
+				ForceNew: true,
+				Required: true,
+			},
+		},
+	}
+}
+
+func resourceScopePolicyAttachmentCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	scp := scopes.NewClient(md.client)
+	opts := []scopes.Option{scopes.WithAutomaticVersioning(true)}
+
+	var scopeId string
+	if scopeIdVal, ok := d.GetOk(ScopeIdKey); ok {
+		scopeId = scopeIdVal.(string)
+	} else {
+		return diag.Errorf("no scope ID provided")
+	}
+
+	if err := d.Set(ScopeIdKey, scopeId); err != nil {
+		return diag.FromErr(err)
+	}
+
+	var policyId string
+	if policyIdVal, ok := d.GetOk(policyIdKey); ok {
+		policyId = policyIdVal.(string)
+	} else {
+		return diag.Errorf("no policy ID provided")
+	}
+
+	// other policy types may be added here and in other switches with this file
+	switch {
+	case strings.HasPrefix(policyId, storagePolicyPrefix):
+		if _, err := scp.AttachStoragePolicy(ctx, scopeId, 0, policyId, opts...); err != nil {
+			return diag.FromErr(err)
+		}
+	default:
+		return diag.Errorf("unknown policy type provided.")
+	}
+
+	if err := d.Set(policyIdKey, policyId); err != nil {
+		return diag.FromErr(err)
+	}
+
+	d.SetId(fmt.Sprintf("%s:%s", policyId, scopeId))
+
+	return nil
+}
+
+func resourceScopePolicyAttachmentRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	scp := scopes.NewClient(md.client)
+
+	var scopeId string
+	if scopeIdVal, ok := d.GetOk(ScopeIdKey); ok {
+		scopeId = scopeIdVal.(string)
+	} else {
+		return diag.Errorf("no scope ID provided")
+	}
+
+	var policyId string
+	if policyIdVal, ok := d.GetOk(policyIdKey); ok {
+		policyId = policyIdVal.(string)
+	} else {
+		return diag.Errorf("no policy ID provided")
+	}
+
+	s, err := scp.Read(ctx, scopeId)
+	if err != nil {
+		if apiErr := api.AsServerError(err); apiErr != nil && apiErr.Response().StatusCode() == http.StatusNotFound {
+			// the scope is gone, destroy this resource
+			d.SetId("")
+			return nil
+		}
+		return diag.Errorf("error reading scope: %v", err)
+	}
+	if s == nil {
+		return diag.Errorf("scope nil after read")
+	}
+
+	switch {
+	case strings.HasPrefix(policyId, storagePolicyPrefix):
+		if policyId != s.GetItem().StoragePolicyId {
+			// this policy is no longer attached to the scope, destroy this resource
+			d.SetId("")
+			return nil
+		}
+	default:
+		return diag.Errorf("unknown policy type provided.")
+	}
+
+	return nil
+}
+
+func resourceScopePolicyAttachmentDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	scp := scopes.NewClient(md.client)
+	opts := []scopes.Option{scopes.WithAutomaticVersioning(true)}
+
+	var scopeId string
+	if scopeIdVal, ok := d.GetOk(ScopeIdKey); ok {
+		scopeId = scopeIdVal.(string)
+	} else {
+		return diag.Errorf("no scope ID provided")
+	}
+
+	var policyId string
+	if policyIdVal, ok := d.GetOk(policyIdKey); ok {
+		policyId = policyIdVal.(string)
+	} else {
+		return diag.Errorf("no policy ID provided")
+	}
+
+	switch {
+	case strings.HasPrefix(policyId, storagePolicyPrefix):
+		if _, err := scp.DetachStoragePolicy(ctx, scopeId, 0, opts...); err != nil {
+			return diag.FromErr(err)
+		}
+	default:
+		return diag.Errorf("unknown policy type provided.")
+	}
+
+	return nil
+}

internal/provider/resource_scope_test.go

@@ -33,8 +33,8 @@ resource "boundary_scope" "org1" {
 
 resource "boundary_role" "org1_admin" {
 	scope_id = boundary_scope.global.id
-	grant_scope_id = boundary_scope.org1.id
-	grant_strings = ["id=*;type=*;actions=*"]
+	grant_scope_ids = [boundary_scope.org1.id]
+	grant_strings = ["ids=*;type=*;actions=*"]
 	principal_ids = ["u_auth"]
 }
 `
@@ -49,8 +49,8 @@ resource "boundary_scope" "proj1" {
 
 resource "boundary_role" "proj1_admin" {
 	scope_id = boundary_scope.org1.id
-	grant_scope_id = boundary_scope.proj1.id
-	grant_strings = ["id=*;type=*;actions=*"]
+	grant_scope_ids = [boundary_scope.proj1.id]
+	grant_strings = ["ids=*;type=*;actions=*"]
 	principal_ids = ["u_auth"]
 }
 `
@@ -65,8 +65,8 @@ resource "boundary_scope" "proj1" {
 
 resource "boundary_role" "proj1_admin" {
 	scope_id = boundary_scope.org1.id
-	grant_scope_id = boundary_scope.proj1.id
-	grant_strings = ["id=*;type=*;actions=*"]
+	grant_scope_ids = [boundary_scope.proj1.id]
+	grant_strings = ["ids=*;type=*;actions=*"]
 	principal_ids = ["u_auth"]
 }
 `
@@ -80,8 +80,8 @@ resource "boundary_scope" "proj2" {
 
 resource "boundary_role" "proj2_admin" {
 	scope_id = boundary_scope.org1.id
-	grant_scope_id = boundary_scope.proj2.id
-	grant_strings = ["id=*;type=*;actions=*"]
+	grant_scope_ids = [boundary_scope.proj2.id]
+	grant_strings = ["ids=*;type=*;actions=*"]
 	principal_ids = ["u_auth"]
 }
 `

internal/provider/resource_storage_bucket.go

@@ -82,7 +82,7 @@ func resourceStorageBucket() *schema.Resource {
 					`or a file:// or env:// path. Set to a string "null" to clear any existing values. NOTE: Unlike "attributes_json", removing ` +
 					`this block will NOT clear secrets from the storage bucket; this allows injecting secrets for one call, then removing them for storage.`,
 				Type:      schema.TypeString,
-				Required:  true,
+				Optional:  true,
 				Sensitive: true,
 			},
 			SecretsHmacKey: {