docs: Update changelog for new version

Co-authored-by: hashicorp-tsccr[bot] <hashicorp-tsccr[bot]@users.noreply.github.com>

.github/workflows/actionlint.yml

@@ -8,7 +8,7 @@ jobs:
   actionlint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: Check workflow files
         uses: docker://docker.mirror.hashicorp.services/rhysd/actionlint@sha256:02ccb6d91e4cb4a7b21eb99d5274d257e81ae667688d730e89d7ea0d6d35db91
         with:

.github/workflows/jira.yml

@@ -22,7 +22,7 @@ jobs:
       id: boundary-team-role
       run: |
         TEAM="boundary"
-        ROLE="$(hub api orgs/hashicorp/teams/${TEAM}/memberships/${{ github.actor }} | jq -r '.role | select(.!=null)')"
+        ROLE="$(gh api orgs/hashicorp/teams/${TEAM}/memberships/${{ github.actor }} | jq -r '.role | select(.!=null)')"
         if [[ -n "${ROLE}" ]]; then
           echo "Actor ${{ github.actor }} is a ${TEAM} team member, skipping ticket creation"
         else
@@ -32,13 +32,6 @@ jobs:
       env:
         GITHUB_TOKEN: ${{ secrets.JIRA_SYNC_GITHUB_TOKEN }}
 
-    - name: Login
-      uses: atlassian/gajira-login@45fd029b9f1d6d8926c6f04175aa80c0e42c9026 # v3.0.1
-      env:
-        JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
-        JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
-        JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
-
     - name: Set ticket type
       if: github.event.action == 'opened' && !steps.boundary-team-role.outputs.role
       id: set-ticket-type
@@ -52,6 +45,10 @@ jobs:
     - name: Create ticket
       if: github.event.action == 'opened' && !steps.boundary-team-role.outputs.role
       uses: tomhjp/gh-action-jira-create@3ed1789cad3521292e591a7cfa703215ec1348bf # v0.2.1
+      env:
+        JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
+        JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
+        JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
       with:
         project: ICU
         issuetype: "GH Issue"
@@ -64,6 +61,10 @@ jobs:
       if: github.event.action != 'opened'
       id: search
       uses: tomhjp/gh-action-jira-search@04700b457f317c3e341ce90da5a3ff4ce058f2fa # v0.2.2
+      env:
+        JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
+        JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
+        JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
       with:
         # cf[10089] is Issue Link custom field
         jql: 'issuetype = "GH Issue" and cf[10089]="${{ github.event.issue.html_url || github.event.pull_request.html_url }}"'
@@ -71,20 +72,38 @@ jobs:
     - name: Sync comment
       if: github.event.action == 'created' && steps.search.outputs.issue
       uses: tomhjp/gh-action-jira-comment@6eb6b9ead70221916b6badd118c24535ed220bd9 # v0.2.0
+      env:
+        JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
+        JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
+        JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
       with:
         issue: ${{ steps.search.outputs.issue }}
         comment: "${{ github.actor }} ${{ github.event.review.state || 'commented' }}:\n\n${{ github.event.comment.body || github.event.review.body }}\n\n${{ github.event.comment.html_url || github.event.review.html_url }}"
 
-    - name: Close ticket
+    - name: Transitions
-      if: (github.event.action == 'closed' || github.event.action == 'deleted') && steps.search.outputs.issue
+      id: transitions
-      uses: atlassian/gajira-transition@38fc9cd61b03d6a53dd35fcccda172fe04b36de3 # v3.0.1
+      if: steps.search.outputs.issue
-      with:
+      run: |
-        issue: ${{ steps.search.outputs.issue }}
+        if [[ "${{ github.event.action }}" == "closed" || "${{ github.event.action }}" == "deleted" ]]; then
-        transition: Done
+          echo "Closing ticket"
+          echo "name=Done" >> "$GITHUB_OUTPUT"
+        elif [[ "${{ github.event.action }}" == "reopened" ]]; then
+          echo "Reopening ticket"
+          echo "name='Reopen'" >> "$GITHUB_OUTPUT"
+        fi
 
-    - name: Reopen ticket
+    # Transition issue API reference: https://developer.atlassian.com/cloud/jira/platform/rest/v3/api-group-issues/#api-rest-api-3-issue-issueidorkey-transitions-post
-      if: github.event.action == 'reopened' && steps.search.outputs.issue
+    - name: Transition ticket
-      uses: atlassian/gajira-transition@38fc9cd61b03d6a53dd35fcccda172fe04b36de3 # v3.0.1
+      if: steps.transitions.outputs.name
-      with:
+      run: |
-        issue: ${{ steps.search.outputs.issue }}
+        transitions="$(curl --silent \
-        transition: "To Do"
+          --url "${{ secrets.JIRA_BASE_URL }}rest/api/3/issue/${{ steps.search.outputs.issue }}/transitions" \
+          --user "${{ secrets.JIRA_USER_EMAIL }}:${{ secrets.JIRA_API_TOKEN }}" \
+          --header "Accept: application/json")"
+        id="$(echo "${transitions}" | jq -r '.transitions[] | select(.name == "${{ steps.transitions.outputs.name }}") | .id')"
+        curl --silent \
+          --url "${{ secrets.JIRA_BASE_URL }}rest/api/3/issue/${{ steps.search.outputs.issue }}/transitions" \
+          --user "${{ secrets.JIRA_USER_EMAIL }}:${{ secrets.JIRA_API_TOKEN }}" \
+          --header "Accept: application/json" \
+          --header "Content-Type: application/json" \
+          --data "$(printf '{"transition": {"id": "%s"}}' "${id}")"

.github/workflows/make-gen-delta.yml

@@ -13,7 +13,7 @@ jobs:
     name: "Check for uncommitted changes from make gen"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           fetch-depth: '0'
       - name: Determine Go version
@@ -24,7 +24,7 @@ jobs:
           echo "Building with Go $(cat .go-version)"
           echo "go-version=$(cat .go-version)" >> "$GITHUB_OUTPUT"
       - name: Set up Go
-        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
         with:
           go-version: "${{ steps.get-go-version.outputs.go-version }}"
       - name: Running go mod tidy

.github/workflows/release.yml

@@ -14,7 +14,7 @@ jobs:
     outputs:
       version: ${{ steps.go-version.outputs.go-version }}
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - id: go-version
         # We use .go-version as our source of truth for current Go
         # version, because "goenv" can react to it automatically.
@@ -24,12 +24,12 @@ jobs:
   release-notes:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           fetch-depth: 0
       - name: Generate Release Notes
         run: sed -n -e "1{/# /d;}" -e "2{/^$/d;}" -e "/# $(git describe --abbrev=0 --exclude="$(git describe --abbrev=0 --match='v*.*.*' --tags)" --match='v*.*.*' --tags | tr -d v)/q;p" CHANGELOG.md > release-notes.txt
-      - uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
+      - uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
         with:
           name: release-notes
           path: release-notes.txt
@@ -37,7 +37,7 @@ jobs:
   terraform-provider-release:
     name: 'Terraform Provider Release'
     needs: [go-version, release-notes]
-    uses: hashicorp/ghaction-terraform-provider-release/.github/workflows/hashicorp.yml@v3
+    uses: hashicorp/ghaction-terraform-provider-release/.github/workflows/hashicorp.yml@v4
     secrets:
       hc-releases-github-token: '${{ secrets.HASHI_RELEASES_GITHUB_TOKEN }}'
       hc-releases-host-staging: '${{ secrets.HC_RELEASES_HOST_STAGING }}'

.github/workflows/test.yml

@@ -13,7 +13,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: Determine go version
         id: get-go-version
         # We use .go-version as our source of truth for current Go
@@ -22,7 +22,7 @@ jobs:
           echo "Building with Go $(cat .go-version)"
           echo "go-version=$(cat .go-version)" >> "$GITHUB_OUTPUT"
       - name: Set up Go
-        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
         with:
           go-version: "${{ steps.get-go-version.outputs.go-version }}"
           cache: false
@@ -32,7 +32,7 @@ jobs:
           echo "go-build=$(go env GOCACHE)" >> "$GITHUB_OUTPUT"
           echo "go-mod=$(go env GOMODCACHE)" >> "$GITHUB_OUTPUT"
       - name: Set up Go modules cache
-        uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
         with:
           path: |
             ${{ steps.go-cache-paths.outputs.go-build }}

CHANGELOG.md

@@ -2,6 +2,28 @@
 
 Canonical reference for changes, improvements, and bugfixes for the Boundary Terraform provider.
 
+## 1.2.0 (October 21, 2024)
+
+### New and Improved
+
+* Introduces support for specifying a worker filter in dynamic host catalogs
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/626))
+
+### Deprecations/Changes
+
+* With Boundary 0.15, a deprecation notice was put under the `grant_scope_id`
+  field, and a new `grant_scope_ids` field was introduced to replace it. With
+  Boundary v0.17.1 and Boundary API v0.0.52, `grant_scope_id` support was
+  entirely removed. `grant_scope_id` support has now been removed from this TF
+  provider.
+
+## 1.1.15 (May 1, 2024)
+
+### New and Improved
+
+* Add support for a target alias as a resource
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/571))
+
 ## 1.1.14 (February 14, 2024)
 
 ### New and Improved
@@ -328,4 +350,4 @@ Update provider to handle new domain errors ([PR](https://github.com/hashicorp/t
 
 ## 0.1.0 (October 14, 2020)
 
-Initial release!
+Initial release!

README.md

@@ -97,10 +97,10 @@ Please see our detailed docs for individual resource usage. Below is a complex e
 
 ```hcl
 provider "boundary" {
-  addr                            = "http://127.0.0.1:9200"
+  addr                   = "http://127.0.0.1:9200"
-  auth_method_id                  = "ampw_1234567890"      # changeme
+  auth_method_id         = "ampw_1234567890"      # changeme
-  password_auth_method_login_name = "myuser"               # changeme
+  auth_method_login_name = "myuser"               # changeme
-  password_auth_method_password   = "passpass"             # changeme
+  auth_method_password   = "passpass"             # changeme
 }
 
 variable "users" {

docs/index.md

@@ -15,23 +15,23 @@ Do not keep your authentication password in HCL for production environments, use
 
 ```terraform
 provider "boundary" {
-  addr                            = "http://127.0.0.1:9200"
+  addr                   = "http://127.0.0.1:9200"
-  auth_method_id                  = "ampw_1234567890" # changeme
+  auth_method_id         = "ampw_1234567890" # changeme
-  password_auth_method_login_name = "myuser"          # changeme
+  auth_method_login_name = "myuser"          # changeme
-  password_auth_method_password   = "passpass"        # changeme
+  auth_method_password   = "passpass"        # changeme
 }
 
 provider "boundary" {
-  addr                            = "http://127.0.0.1:9200"
+  addr                   = "http://127.0.0.1:9200"
-  password_auth_method_login_name = "myuser"
+  auth_method_login_name = "myuser"
-  password_auth_method_password   = "passpass"
+  auth_method_password   = "passpass"
 }
 
 provider "boundary" {
-  addr                            = "http://127.0.0.1:9200"
+  addr                   = "http://127.0.0.1:9200"
-  password_auth_method_login_name = "myuser"
+  auth_method_login_name = "myuser"
-  password_auth_method_password   = "passpass"
+  auth_method_password   = "passpass"
-  scope_id                        = "s_1234567890"
+  scope_id               = "s_1234567890"
 }
 ```
 

docs/resources/alias_target.md

@@ -0,0 +1,106 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_alias_target Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The target alias resource allows you to configure a Boundary target alias.
+---
+
+# boundary_alias_target (Resource)
+
+The target alias resource allows you to configure a Boundary target alias.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_host_catalog_static" "foo" {
+  name        = "test"
+  description = "test catalog"
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_host_static" "foo" {
+  name            = "foo"
+  host_catalog_id = boundary_host_catalog_static.foo.id
+  address         = "10.0.0.1"
+}
+
+resource "boundary_host_static" "bar" {
+  name            = "bar"
+  host_catalog_id = boundary_host_catalog_static.foo.id
+  address         = "127.0.0.1"
+}
+
+resource "boundary_host_set_static" "foo" {
+  name            = "foo"
+  host_catalog_id = boundary_host_catalog_static.foo.id
+
+  host_ids = [
+    boundary_host_static.foo.id,
+    boundary_host_static.bar.id,
+  ]
+}
+
+resource "boundary_target" "foo" {
+  name         = "foo"
+  description  = "Foo target"
+  type         = "tcp"
+  default_port = "22"
+  scope_id     = boundary_scope.project.id
+  host_source_ids = [
+    boundary_host_set_static.foo.id,
+  ]
+}
+
+resource "boundary_alias_target" "example_alias_target" {
+  name                      = "example_alias_target"
+  description               = "Example alias to target foo using host boundary_host_static.bar"
+  scope_id                  = "global"
+  value                     = "example.bar.foo.boundary"
+  destination_id            = boundary_target.foo.id
+  authorize_session_host_id = boundary_host_static.bar.id
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `scope_id` (String) The scope ID.
+- `value` (String) The value of the alias.
+
+### Optional
+
+- `authorize_session_host_id` (String) The host id to pass to Boundary when performing an authorize session action.
+- `description` (String) The alias description.
+- `destination_id` (String) The destination of the alias.
+- `name` (String) The alias name. Defaults to the resource name.
+- `type` (String) The type of alias; hardcoded.
+
+### Read-Only
+
+- `id` (String) The ID of the account.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import boundary_alias_target.example_alias_target <my-id>
+```

docs/resources/host_catalog_plugin.md

@@ -94,6 +94,7 @@ resource "boundary_host_catalog_plugin" "azure_example" {
 - `plugin_name` (String) The name of the plugin that should back the resource. This or plugin_id must be defined.
 - `secrets_hmac` (String) The HMAC'd secrets value returned from the server.
 - `secrets_json` (String, Sensitive) The secrets for the host catalog. Either values encoded with the "jsonencode" function, pre-escaped JSON string, or a file:// or env:// path. Set to a string "null" to clear any existing values. NOTE: Unlike "attributes_json", removing this block will NOT clear secrets from the host catalog; this allows injecting secrets for one call, then removing them for storage.
+- `worker_filter` (String) HCP Only. A filter used to control which PKI workers can handle dynamic host catalog requests.
 
 ### Read-Only
 

docs/resources/role.md

@@ -127,7 +127,6 @@ resource "boundary_role" "readonly" {
 ### Optional
 
 - `description` (String) The role description.
-- `grant_scope_id` (String, Deprecated) For Boundary 0.15+, use `grant_scope_ids` instead. The scope for which the grants in the role should apply.
 - `grant_scope_ids` (Set of String) A list of scopes for which the grants in this role should apply, which can include the special values "this", "children", or "descendants"
 - `grant_strings` (Set of String) A list of stringified grants for the role.
 - `name` (String) The role name. Defaults to the resource name.

docs/resources/worker.md

@@ -1,5 +1,4 @@
 ---
-# generated by https://github.com/hashicorp/terraform-plugin-docs
 page_title: "boundary_worker Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
@@ -12,16 +11,22 @@ The resource allows you to create a self-managed worker object.
 
 ## Example Usage
 
+### Controller-led worker
+
 ```terraform
 resource "boundary_worker" "controller_led" {
   scope_id    = "global"
-  name        = "worker 1"
+  name        = "controller-led-worker-1"
   description = "self managed worker with controller led auth"
 }
+```
 
+### Worker-led worker
+
+```terraform
 resource "boundary_worker" "worker_led" {
   scope_id                    = "global"
-  name                        = "worker 2"
+  name                        = "worker-led-worker-1"
   description                 = "self managed worker with worker led auth"
   worker_generated_auth_token = var.worker_generated_auth_token
 }

examples/provider/provider.tf

@@ -1,19 +1,19 @@
 provider "boundary" {
-  addr                            = "http://127.0.0.1:9200"
+  addr                   = "http://127.0.0.1:9200"
-  auth_method_id                  = "ampw_1234567890" # changeme
+  auth_method_id         = "ampw_1234567890" # changeme
-  password_auth_method_login_name = "myuser"          # changeme
+  auth_method_login_name = "myuser"          # changeme
-  password_auth_method_password   = "passpass"        # changeme
+  auth_method_password   = "passpass"        # changeme
 }
 
 provider "boundary" {
-  addr                            = "http://127.0.0.1:9200"
+  addr                   = "http://127.0.0.1:9200"
-  password_auth_method_login_name = "myuser"
+  auth_method_login_name = "myuser"
-  password_auth_method_password   = "passpass"
+  auth_method_password   = "passpass"
 }
 
 provider "boundary" {
-  addr                            = "http://127.0.0.1:9200"
+  addr                   = "http://127.0.0.1:9200"
-  password_auth_method_login_name = "myuser"
+  auth_method_login_name = "myuser"
-  password_auth_method_password   = "passpass"
+  auth_method_password   = "passpass"
-  scope_id                        = "s_1234567890"
+  scope_id               = "s_1234567890"
 }

examples/resources/boundary_alias_target/import.sh

@@ -0,0 +1 @@
+terraform import boundary_alias_target.example_alias_target <my-id>

examples/resources/boundary_alias_target/resource.tf

@@ -0,0 +1,62 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_host_catalog_static" "foo" {
+  name        = "test"
+  description = "test catalog"
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_host_static" "foo" {
+  name            = "foo"
+  host_catalog_id = boundary_host_catalog_static.foo.id
+  address         = "10.0.0.1"
+}
+
+resource "boundary_host_static" "bar" {
+  name            = "bar"
+  host_catalog_id = boundary_host_catalog_static.foo.id
+  address         = "127.0.0.1"
+}
+
+resource "boundary_host_set_static" "foo" {
+  name            = "foo"
+  host_catalog_id = boundary_host_catalog_static.foo.id
+
+  host_ids = [
+    boundary_host_static.foo.id,
+    boundary_host_static.bar.id,
+  ]
+}
+
+resource "boundary_target" "foo" {
+  name         = "foo"
+  description  = "Foo target"
+  type         = "tcp"
+  default_port = "22"
+  scope_id     = boundary_scope.project.id
+  host_source_ids = [
+    boundary_host_set_static.foo.id,
+  ]
+}
+
+resource "boundary_alias_target" "example_alias_target" {
+  name                      = "example_alias_target"
+  description               = "Example alias to target foo using host boundary_host_static.bar"
+  scope_id                  = "global"
+  value                     = "example.bar.foo.boundary"
+  destination_id            = boundary_target.foo.id
+  authorize_session_host_id = boundary_host_static.bar.id
+}

examples/resources/boundary_worker/controller_led.tf

@@ -0,0 +1,5 @@
+resource "boundary_worker" "controller_led" {
+  scope_id    = "global"
+  name        = "controller-led-worker-1"
+  description = "self managed worker with controller led auth"
+}

examples/resources/boundary_worker/main.tf

@@ -1,13 +0,0 @@
-resource "boundary_worker" "controller_led" {
-  scope_id                    = "global"
-  name                        = "worker 1"
-  description                 = "self managed worker with controller-led auth"
-  worker_generated_auth_token = var.worker_generated_auth_token
-}
-
-resource "boundary_worker" "worker_led" {
-  scope_id                    = "global"
-  name                        = "worker 2"
-  description                 = "self managed worker with worker-led auth"
-  worker_generated_auth_token = var.worker_generated_auth_token
-}

examples/resources/boundary_worker/worker_led.tf

@@ -1,12 +1,6 @@
-resource "boundary_worker" "controller_led" {
-  scope_id    = "global"
-  name        = "worker 1"
-  description = "self managed worker with controller led auth"
-}
-
 resource "boundary_worker" "worker_led" {
   scope_id                    = "global"
-  name                        = "worker 2"
+  name                        = "worker-led-worker-1"
   description                 = "self managed worker with worker led auth"
   worker_generated_auth_token = var.worker_generated_auth_token
 }

go.mod

@@ -1,94 +1,95 @@
 module github.com/hashicorp/terraform-provider-boundary
 
-go 1.21.5
+go 1.23.1
 
 require (
 	github.com/YakDriver/regexache v0.23.0
-	github.com/hashicorp/boundary v0.15.0
+	github.com/hashicorp/boundary v0.18.0
-	github.com/hashicorp/boundary/api v0.0.46-0.20240209231500-1b1c8b3bf9a6
+	github.com/hashicorp/boundary/api v0.0.53
-	github.com/hashicorp/boundary/sdk v0.0.43-0.20240209231500-1b1c8b3bf9a6
+	github.com/hashicorp/boundary/sdk v0.0.49
-	github.com/hashicorp/cap v0.5.0
+	github.com/hashicorp/cap v0.5.1-0.20240315182732-faa330bfb8df
 	github.com/hashicorp/cap/ldap v0.0.0-20240206183135-ed8f24513744
 	github.com/hashicorp/go-cty v1.4.1-0.20200723130312-85980079f637
-	github.com/hashicorp/go-kms-wrapping/v2 v2.0.16
+	github.com/hashicorp/go-kms-wrapping/v2 v2.0.17-0.20240313190905-91d44aa8e360
 	github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.11
 	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8
-	github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.6
+	github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.7
 	github.com/hashicorp/terraform-plugin-docs v0.18.0
-	github.com/hashicorp/terraform-plugin-sdk/v2 v2.32.0
+	github.com/hashicorp/terraform-plugin-sdk/v2 v2.33.0
-	github.com/jimlambrt/gldap v0.1.9
+	github.com/jimlambrt/gldap v0.1.11
 	github.com/kr/pretty v0.3.1
 	github.com/mitchellh/go-homedir v1.1.0
-	github.com/stretchr/testify v1.8.4
+	github.com/stretchr/testify v1.9.0
-	golang.org/x/crypto v0.19.0
+	golang.org/x/crypto v0.25.0
 	mvdan.cc/gofumpt v0.6.0
 )
 
 require (
+	dario.cat/mergo v1.0.0 // indirect
 	github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
 	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
-	github.com/DATA-DOG/go-sqlmock v1.5.0 // indirect
+	github.com/DATA-DOG/go-sqlmock v1.5.2 // indirect
 	github.com/Kunde21/markdownfmt/v3 v3.1.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
-	github.com/Masterminds/semver/v3 v3.2.0 // indirect
+	github.com/Masterminds/semver/v3 v3.2.1 // indirect
 	github.com/Masterminds/sprig/v3 v3.2.3 // indirect
 	github.com/Microsoft/go-winio v0.6.1 // indirect
 	github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 // indirect
-	github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371 // indirect
+	github.com/ProtonMail/go-crypto v1.1.0-alpha.0 // indirect
 	github.com/agext/levenshtein v1.2.2 // indirect
-	github.com/alessio/shellescape v1.4.1 // indirect
+	github.com/alessio/shellescape v1.4.2 // indirect
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
 	github.com/armon/go-radix v1.0.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bgentry/speakeasy v0.1.0 // indirect
 	github.com/cenkalti/backoff v2.2.1+incompatible // indirect
-	github.com/cenkalti/backoff/v3 v3.0.0 // indirect
+	github.com/cenkalti/backoff/v3 v3.2.2 // indirect
 	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/cloudflare/circl v1.3.7 // indirect
-	github.com/containerd/continuity v0.3.0 // indirect
+	github.com/containerd/continuity v0.4.3 // indirect
-	github.com/coreos/go-oidc/v3 v3.8.0 // indirect
+	github.com/coreos/go-oidc/v3 v3.9.0 // indirect
-	github.com/danieljoos/wincred v1.2.0 // indirect
+	github.com/danieljoos/wincred v1.2.1 // indirect
-	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/docker/cli v23.0.1+incompatible // indirect
+	github.com/docker/cli v25.0.3+incompatible // indirect
-	github.com/docker/docker v24.0.7+incompatible // indirect
+	github.com/docker/docker v27.1.1+incompatible // indirect
-	github.com/docker/go-connections v0.4.0 // indirect
+	github.com/docker/go-connections v0.5.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/dvsekhvalnov/jose2go v1.5.1-0.20231206184617-48ba0b76bc88 // indirect
+	github.com/dvsekhvalnov/jose2go v1.6.0 // indirect
-	github.com/fatih/color v1.16.0 // indirect
+	github.com/fatih/color v1.17.0 // indirect
 	github.com/fatih/structs v1.1.0 // indirect
-	github.com/glebarez/go-sqlite v1.21.2 // indirect
+	github.com/glebarez/go-sqlite v1.22.0 // indirect
-	github.com/glebarez/sqlite v1.9.0 // indirect
+	github.com/glebarez/sqlite v1.10.0 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.5 // indirect
-	github.com/go-jose/go-jose/v3 v3.0.1 // indirect
+	github.com/go-jose/go-jose/v3 v3.0.3 // indirect
 	github.com/go-ldap/ldap/v3 v3.4.6 // indirect
 	github.com/godbus/dbus/v5 v5.1.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang-migrate/migrate/v4 v4.16.2 // indirect
+	github.com/golang-migrate/migrate/v4 v4.17.0 // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
-	github.com/google/uuid v1.4.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.18.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.1 // indirect
 	github.com/hashicorp/cli v1.1.6 // indirect
 	github.com/hashicorp/dbassert v0.0.0-20231012105025-1bc1bd88e22b // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
-	github.com/hashicorp/eventlogger v0.2.6-0.20231025104552-802587e608f0 // indirect
+	github.com/hashicorp/eventlogger v0.2.9 // indirect
-	github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20231025104552-802587e608f0 // indirect
+	github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20231208142215-efdb51ec090d // indirect
 	github.com/hashicorp/go-bexpr v0.1.13 // indirect
 	github.com/hashicorp/go-checkpoint v0.5.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-dbw v0.1.1 // indirect
+	github.com/hashicorp/go-dbw v0.1.5-0.20240909162114-6cee92b3da36 // indirect
-	github.com/hashicorp/go-hclog v1.5.0 // indirect
+	github.com/hashicorp/go-hclog v1.6.3 // indirect
-	github.com/hashicorp/go-kms-wrapping/extras/kms/v2 v2.0.0-20231124110655-4315424d22d0 // indirect
+	github.com/hashicorp/go-kms-wrapping/extras/kms/v2 v2.0.0-20231219183231-6bac757bb482 // indirect
-	github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.5 // indirect
+	github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.7 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-plugin v1.6.0 // indirect
 	github.com/hashicorp/go-rate v0.0.0-20231204194614-cc8d401f70ab // indirect
-	github.com/hashicorp/go-retryablehttp v0.7.4 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
 	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
 	github.com/hashicorp/go-secure-stdlib/base62 v0.1.2 // indirect
 	github.com/hashicorp/go-secure-stdlib/gatedwriter v0.1.1 // indirect
@@ -98,34 +99,33 @@ require (
 	github.com/hashicorp/go-secure-stdlib/reloadutil v0.1.1 // indirect
 	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
 	github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.3 // indirect
-	github.com/hashicorp/go-sockaddr v1.0.5 // indirect
+	github.com/hashicorp/go-sockaddr v1.0.6 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
 	github.com/hashicorp/go-version v1.6.0 // indirect
-	github.com/hashicorp/hc-install v0.6.2 // indirect
+	github.com/hashicorp/hc-install v0.6.3 // indirect
-	github.com/hashicorp/hcl v1.0.0 // indirect
+	github.com/hashicorp/hcl v1.0.1-vault-5 // indirect
 	github.com/hashicorp/hcl/v2 v2.19.1 // indirect
 	github.com/hashicorp/logutils v1.0.0 // indirect
-	github.com/hashicorp/nodeenrollment v0.2.9 // indirect
+	github.com/hashicorp/nodeenrollment v0.2.13 // indirect
 	github.com/hashicorp/terraform-exec v0.20.0 // indirect
 	github.com/hashicorp/terraform-json v0.21.0 // indirect
-	github.com/hashicorp/terraform-plugin-go v0.21.0 // indirect
+	github.com/hashicorp/terraform-plugin-go v0.22.0 // indirect
 	github.com/hashicorp/terraform-plugin-log v0.9.0 // indirect
 	github.com/hashicorp/terraform-registry-address v0.2.3 // indirect
 	github.com/hashicorp/terraform-svchost v0.1.1 // indirect
-	github.com/hashicorp/vault/api v1.10.0 // indirect
+	github.com/hashicorp/vault/api v1.12.0 // indirect
-	github.com/hashicorp/vault/sdk v0.3.0 // indirect
+	github.com/hashicorp/vault/sdk v0.11.0 // indirect
 	github.com/hashicorp/yamux v0.1.1 // indirect
 	github.com/huandu/xstrings v1.4.0 // indirect
-	github.com/imdario/mergo v0.3.15 // indirect
+	github.com/imdario/mergo v0.3.16 // indirect
 	github.com/jackc/chunkreader/v2 v2.0.1 // indirect
-	github.com/jackc/pgconn v1.14.1 // indirect
+	github.com/jackc/pgconn v1.14.3 // indirect
 	github.com/jackc/pgio v1.0.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
-	github.com/jackc/pgproto3/v2 v2.3.2 // indirect
+	github.com/jackc/pgproto3/v2 v2.3.3 // indirect
-	github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
+	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
-	github.com/jackc/pgtype v1.14.0 // indirect
+	github.com/jackc/pgx/v5 v5.6.0 // indirect
-	github.com/jackc/pgx/v4 v4.18.1 // indirect
+	github.com/jackc/puddle/v2 v2.2.1 // indirect
-	github.com/jackc/pgx/v5 v5.4.3 // indirect
 	github.com/jefferai/go-libsecret v0.0.0-20210525195240-b53481abef97 // indirect
 	github.com/jefferai/isbadcipher v0.0.0-20190226160619-51d2077c035f // indirect
 	github.com/jefferai/keyring v1.1.7-0.20220316160357-58a74bb55891 // indirect
@@ -138,7 +138,6 @@ require (
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-runewidth v0.0.9 // indirect
 	github.com/mattn/go-sqlite3 v2.0.3+incompatible // indirect
-	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
 	github.com/mikesmitty/edkey v0.0.0-20170222072505-3356ea4e686a // indirect
 	github.com/mitchellh/cli v1.1.5 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
@@ -147,65 +146,68 @@ require (
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/mitchellh/pointerstructure v1.2.1 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
+	github.com/moby/docker-image-spec v1.3.1 // indirect
+	github.com/moby/sys/user v0.1.0 // indirect
 	github.com/moby/term v0.5.0 // indirect
 	github.com/mr-tron/base58 v1.2.0 // indirect
 	github.com/mtibben/percent v0.2.1 // indirect
+	github.com/ncruces/go-strftime v0.1.9 // indirect
 	github.com/oklog/run v1.1.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.0.2 // indirect
+	github.com/opencontainers/image-spec v1.1.0-rc6 // indirect
-	github.com/opencontainers/runc v1.1.12 // indirect
+	github.com/opencontainers/runc v1.2.0-rc.3 // indirect
 	github.com/ory/dockertest/v3 v3.10.0 // indirect
 	github.com/pires/go-proxyproto v0.7.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/posener/complete v1.2.3 // indirect
-	github.com/prometheus/client_golang v1.17.0 // indirect
+	github.com/prometheus/client_golang v1.18.0 // indirect
-	github.com/prometheus/client_model v0.4.1-0.20230718164431-9a2bf3000d16 // indirect
+	github.com/prometheus/client_model v0.5.0 // indirect
-	github.com/prometheus/common v0.44.0 // indirect
+	github.com/prometheus/common v0.46.0 // indirect
-	github.com/prometheus/procfs v0.11.1 // indirect
+	github.com/prometheus/procfs v0.12.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rogpeppe/go-internal v1.12.0 // indirect
 	github.com/russross/blackfriday v1.6.0 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
 	github.com/sethvargo/go-diceware v0.3.0 // indirect
 	github.com/shopspring/decimal v1.3.1 // indirect
-	github.com/sirupsen/logrus v1.9.2 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
-	github.com/spf13/cast v1.5.0 // indirect
+	github.com/spf13/cast v1.6.0 // indirect
 	github.com/vmihailenco/msgpack v4.0.4+incompatible // indirect
 	github.com/vmihailenco/msgpack/v5 v5.4.1 // indirect
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
-	github.com/xo/dburl v0.16.0 // indirect
+	github.com/xo/dburl v0.23.1 // indirect
 	github.com/yuin/goldmark v1.6.0 // indirect
 	github.com/yuin/goldmark-meta v1.1.0 // indirect
 	github.com/zalando/go-keyring v0.2.3 // indirect
 	github.com/zclconf/go-cty v1.14.2 // indirect
 	go.uber.org/atomic v1.11.0 // indirect
-	golang.org/x/exp v0.0.0-20231006140011-7918f672742d // indirect
+	golang.org/x/exp v0.0.0-20240205201215-2c58cdc269a3 // indirect
-	golang.org/x/mod v0.14.0 // indirect
+	golang.org/x/mod v0.17.0 // indirect
-	golang.org/x/net v0.20.0 // indirect
+	golang.org/x/net v0.25.0 // indirect
-	golang.org/x/oauth2 v0.14.0 // indirect
+	golang.org/x/oauth2 v0.17.0 // indirect
-	golang.org/x/sync v0.6.0 // indirect
+	golang.org/x/sync v0.7.0 // indirect
-	golang.org/x/sys v0.17.0 // indirect
+	golang.org/x/sys v0.22.0 // indirect
-	golang.org/x/term v0.17.0 // indirect
+	golang.org/x/term v0.22.0 // indirect
-	golang.org/x/text v0.14.0 // indirect
+	golang.org/x/text v0.16.0 // indirect
-	golang.org/x/time v0.3.0 // indirect
+	golang.org/x/time v0.5.0 // indirect
-	golang.org/x/tools v0.17.0 // indirect
+	golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
 	google.golang.org/appengine v1.6.8 // indirect
-	google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17 // indirect
+	google.golang.org/genproto v0.0.0-20240205150955-31a09d347014 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20231106174013-bbf56f31fb17 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20240205150955-31a09d347014 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20231106174013-bbf56f31fb17 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240205150955-31a09d347014 // indirect
-	google.golang.org/grpc v1.61.0 // indirect
+	google.golang.org/grpc v1.61.1 // indirect
-	google.golang.org/protobuf v1.32.0 // indirect
+	google.golang.org/protobuf v1.34.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	gorm.io/driver/postgres v1.5.4 // indirect
+	gorm.io/driver/postgres v1.5.9 // indirect
-	gorm.io/driver/sqlite v1.5.4 // indirect
+	gorm.io/driver/sqlite v1.5.6 // indirect
-	gorm.io/gorm v1.25.5 // indirect
+	gorm.io/gorm v1.25.11 // indirect
-	modernc.org/libc v1.22.5 // indirect
+	modernc.org/libc v1.41.0 // indirect
-	modernc.org/mathutil v1.5.0 // indirect
+	modernc.org/mathutil v1.6.0 // indirect
-	modernc.org/memory v1.5.0 // indirect
+	modernc.org/memory v1.7.2 // indirect
-	modernc.org/sqlite v1.23.1 // indirect
+	modernc.org/sqlite v1.28.0 // indirect
 )

internal/provider/const.go

@@ -56,4 +56,8 @@ const (
 	ParentScopeIdKey = "parent_scope_id"
 	// GroupMemberIdsKey is used for common "member_ids" resource attribute
 	GroupMemberIdsKey = "member_ids"
+	// ValueKey is used for common "value" resource attribute
+	ValueKey = "value"
+	// DestinationIdKey is used for common "destination_id" resource attribute
+	DestinationIdKey = "destination_id"
 )

internal/provider/data_source_user_test.go

@@ -83,7 +83,7 @@ func TestAccUserDataSource_globalAdminUser(t *testing.T) {
 					resource.TestCheckResourceAttr(dataSourceName, LoginNameKey, "testuser"),
 					resource.TestMatchResourceAttr(dataSourceName, IDKey, regexache.MustCompile(`^u_.+`)),
 					resource.TestMatchResourceAttr(dataSourceName, PrimaryAccountIdKey, regexache.MustCompile(`^acctpw_.+`)),
-					resource.TestCheckResourceAttr(dataSourceName, "authorized_actions.#", "7"),
+					resource.TestCheckResourceAttr(dataSourceName, "authorized_actions.#", "8"),
 					resource.TestCheckResourceAttr(dataSourceName, "scope.0.name", "global"),
 					resource.TestCheckResourceAttr(dataSourceName, "scope.0.id", "global"),
 					resource.TestCheckResourceAttr(dataSourceName, "scope.0.type", "global"),

internal/provider/provider.go

@@ -98,6 +98,7 @@ func New() *schema.Provider {
 			"boundary_account_password":                         resourceAccountPassword(),
 			"boundary_account_oidc":                             resourceAccountOidc(),
 			"boundary_account_ldap":                             resourceAccountLdap(),
+			"boundary_alias_target":                             resourceAliasTarget(),
 			"boundary_auth_method":                              resourceAuthMethod(),
 			"boundary_auth_method_password":                     resourceAuthMethodPassword(),
 			"boundary_auth_method_oidc":                         resourceAuthMethodOidc(),

internal/provider/provider_test.go

@@ -106,6 +106,19 @@ provider "boundary" {
 
 func testConfigWithDefaultAuthMethod(url string, res ...string) string {
 	provider := fmt.Sprintf(`
+provider "boundary" {
+	addr  = "%s"
+	auth_method_login_name = "%s"
+	auth_method_password = "%s"
+}`, url, tcLoginName, tcPassword)
+
+	c := []string{provider}
+	c = append(c, res...)
+	return strings.Join(c, "\n")
+}
+
+func testConfigWithDeprecatedAuthMethod(url string, res ...string) string {
+	provider := fmt.Sprintf(`
 provider "boundary" {
 	addr  = "%s"
 	password_auth_method_login_name = "%s"
@@ -256,6 +269,28 @@ func TestConfigWithDefaultAuthMethod(t *testing.T) {
 	})
 }
 
+func TestConfigWithDeprecatedAuthMethod(t *testing.T) {
+	tc := controller.NewTestController(t, tcConfig...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		IsUnitTest:        true,
+		ProviderFactories: providerFactories(&provider),
+		CheckDestroy:      testAccCheckScopeResourceDestroy(t, provider),
+		Steps: []resource.TestStep{
+			{
+				Config: testConfigWithDeprecatedAuthMethod(url, fooOrg, firstProjectFoo, secondProject),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckScopeResourceExists(provider, "boundary_scope.org1"),
+					testProviderTokenExists(provider),
+				),
+			},
+		},
+	})
+}
+
 func TestConfigWithoutAMPWCredentials(t *testing.T) {
 	tc := controller.NewTestController(t, tcConfig...)
 	defer tc.Shutdown()

internal/provider/resource_alias_target.go

@@ -0,0 +1,269 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package provider
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/aliases"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+const (
+	aliasTypeTarget = "target"
+
+	aliasTargetAuthorizeSessionHostIdKey = "authorize_session_host_id"
+)
+
+func resourceAliasTarget() *schema.Resource {
+	return &schema.Resource{
+		Description: "The target alias resource allows you to configure a Boundary target alias.",
+
+		CreateContext: resourceTargetAliasCreate,
+		ReadContext:   resourceTargetAliasRead,
+		UpdateContext: resourceTargetAliasUpdate,
+		DeleteContext: resourceTargetAliasDelete,
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			IDKey: {
+				Description: "The ID of the account.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			NameKey: {
+				Description: "The alias name. Defaults to the resource name.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			DescriptionKey: {
+				Description: "The alias description.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			ScopeIdKey: {
+				Description: "The scope ID.",
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+			},
+			ValueKey: {
+				Description: "The value of the alias.",
+				Type:        schema.TypeString,
+				Required:    true,
+			},
+			DestinationIdKey: {
+				Description: "The destination of the alias.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+
+			// Target specific configurable parameters
+			aliasTargetAuthorizeSessionHostIdKey: {
+				Description: "The host id to pass to Boundary when performing an authorize session action.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+
+			TypeKey: {
+				Description: "The type of alias; hardcoded.",
+				Type:        schema.TypeString,
+				Default:     aliasTypeTarget,
+				Optional:    true,
+			},
+		},
+	}
+}
+
+func setFromTargetAliasResponseMap(d *schema.ResourceData, raw map[string]interface{}) error {
+	if err := d.Set(NameKey, raw["name"]); err != nil {
+		return err
+	}
+	if err := d.Set(DescriptionKey, raw["description"]); err != nil {
+		return err
+	}
+	if err := d.Set(ScopeIdKey, raw["scope_id"]); err != nil {
+		return err
+	}
+	if err := d.Set(ValueKey, raw["value"]); err != nil {
+		return err
+	}
+	if err := d.Set(DestinationIdKey, raw["destination_id"]); err != nil {
+		return err
+	}
+	if err := d.Set(TypeKey, raw["type"]); err != nil {
+		return err
+	}
+
+	if attrsVal, ok := raw["attributes"]; ok {
+		attrs := attrsVal.(map[string]interface{})
+		tarAttrs, err := aliases.AttributesMapToTargetAliasAttributes(attrs)
+		if err != nil {
+			return err
+		}
+		if tarAttrs.AuthorizeSessionArguments != nil && tarAttrs.AuthorizeSessionArguments.HostId != "" {
+			if err := d.Set(aliasTargetAuthorizeSessionHostIdKey, tarAttrs.AuthorizeSessionArguments.HostId); err != nil {
+				return err
+			}
+		}
+	}
+
+	d.SetId(raw["id"].(string))
+
+	return nil
+}
+
+func resourceTargetAliasCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+
+	var scopeId string
+	if scopeIdVal, ok := d.GetOk(ScopeIdKey); ok {
+		scopeId = scopeIdVal.(string)
+	} else {
+		return diag.Errorf("no scope ID provided")
+	}
+
+	var typeStr string
+	if typeVal, ok := d.GetOk(TypeKey); ok {
+		typeStr = typeVal.(string)
+	} else {
+		return diag.Errorf("no type provided")
+	}
+
+	opts := []aliases.Option{}
+
+	if typeVal, ok := d.GetOk(ValueKey); ok {
+		opts = append(opts, aliases.WithValue(typeVal.(string)))
+	} else {
+		return diag.Errorf("no alias value provided")
+	}
+
+	if nameVal, ok := d.GetOk(NameKey); ok {
+		opts = append(opts, aliases.WithName(nameVal.(string)))
+	}
+
+	if descVal, ok := d.GetOk(DescriptionKey); ok {
+		opts = append(opts, aliases.WithDescription(descVal.(string)))
+	}
+
+	if destVal, ok := d.GetOk(DestinationIdKey); ok {
+		opts = append(opts, aliases.WithDestinationId(destVal.(string)))
+	}
+
+	if hostIdVal, ok := d.GetOk(aliasTargetAuthorizeSessionHostIdKey); ok {
+		opts = append(opts, aliases.WithTargetAliasAuthorizeSessionArgumentsHostId(hostIdVal.(string)))
+	}
+
+	aliasClient := aliases.NewClient(md.client)
+
+	alcr, err := aliasClient.Create(ctx, typeStr, scopeId, opts...)
+	if err != nil {
+		return diag.Errorf("error creating alias: %v", err)
+	}
+	if alcr == nil {
+		return diag.Errorf("nil alias after create")
+	}
+
+	if err := setFromTargetAliasResponseMap(d, alcr.GetResponse().Map); err != nil {
+		return diag.FromErr(err)
+	}
+
+	return nil
+}
+
+func resourceTargetAliasRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	alClient := aliases.NewClient(md.client)
+
+	alrr, err := alClient.Read(ctx, d.Id())
+	if err != nil {
+		if apiErr := api.AsServerError(err); apiErr.Response().StatusCode() == http.StatusNotFound {
+			d.SetId("")
+			return nil
+		}
+		return diag.Errorf("error reading auth method: %v", err)
+	}
+	if alrr == nil {
+		return diag.Errorf("auth method nil after read")
+	}
+
+	if err := setFromTargetAliasResponseMap(d, alrr.GetResponse().Map); err != nil {
+		return diag.FromErr(err)
+	}
+	return nil
+}
+
+func resourceTargetAliasUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	alClient := aliases.NewClient(md.client)
+
+	opts := []aliases.Option{}
+
+	if d.HasChange(NameKey) {
+		opts = append(opts, aliases.DefaultName())
+		if nameVal, ok := d.GetOk(NameKey); ok {
+			opts = append(opts, aliases.WithName(nameVal.(string)))
+		}
+	}
+
+	if d.HasChange(DescriptionKey) {
+		opts = append(opts, aliases.DefaultDescription())
+		if descVal, ok := d.GetOk(DescriptionKey); ok {
+			opts = append(opts, aliases.WithDescription(descVal.(string)))
+		}
+	}
+
+	if d.HasChange(ValueKey) {
+		if valVal, ok := d.GetOk(ValueKey); ok {
+			opts = append(opts, aliases.WithValue(valVal.(string)))
+		} else {
+			return diag.Errorf("no value provided")
+		}
+	}
+
+	if d.HasChange(DestinationIdKey) {
+		opts = append(opts, aliases.DefaultDestinationId())
+		if destId, ok := d.GetOk(DestinationIdKey); ok {
+			opts = append(opts, aliases.WithDestinationId(destId.(string)))
+		}
+	}
+
+	if d.HasChange(aliasTargetAuthorizeSessionHostIdKey) {
+		opts = append(opts, aliases.DefaultTargetAliasAuthorizeSessionArgumentsHostId())
+		if authSessHostId, ok := d.GetOk(aliasTargetAuthorizeSessionHostIdKey); ok {
+			opts = append(opts, aliases.WithTargetAliasAuthorizeSessionArgumentsHostId(authSessHostId.(string)))
+		}
+	}
+
+	if len(opts) > 0 {
+		opts = append(opts, aliases.WithAutomaticVersioning(true))
+		alur, err := alClient.Update(ctx, d.Id(), 0, opts...)
+		if err != nil {
+			return diag.Errorf("error updating auth method: %v", err)
+		}
+
+		if err := setFromTargetAliasResponseMap(d, alur.GetResponse().Map); err != nil {
+			return diag.FromErr(err)
+		}
+		return nil
+	}
+	return nil
+}
+
+func resourceTargetAliasDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	client := aliases.NewClient(md.client)
+
+	_, err := client.Delete(ctx, d.Id())
+	if err != nil {
+		return diag.Errorf("error deleting alias: %v", err)
+	}
+
+	return nil
+}

internal/provider/resource_alias_target_test.go

@@ -0,0 +1,187 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package provider
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/aliases"
+	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+)
+
+type aliasDestroyType string
+
+const (
+	targetAliasType aliasDestroyType = "boundary_alias_target"
+
+	targetAliasResc         = "boundary_alias_target.example"
+	targetAliasName         = "foo"
+	targetAliasDesc         = "the foo"
+	targetAliasValue        = "value.example"
+	targetAliasValueUpdated = "value.example.updated"
+	targetAliasNamespace    = "target"
+	targetAliasUpdate       = "_random"
+)
+
+var fooBarTarget = `
+resource "boundary_target" "foo" {
+	type         = "tcp"
+	name         = "test"
+	description  = "test target"
+	default_port = 22
+	address      = "127.0.0.1"
+	scope_id     = boundary_scope.proj1.id
+	depends_on   = [boundary_role.proj1_admin]
+}`
+
+var aliasId string
+
+func targetAliasResource(name string, description string, value string) string {
+	return fmt.Sprintf(`
+resource "boundary_alias_target" "example" {
+	name  = "%s"
+	description = "%s"
+	value = "%s"
+	scope_id = "global"
+	destination_id = boundary_target.foo.id
+	authorize_session_host_id = "hst_1234567890"
+	depends_on = [boundary_target.foo]
+}`, name, description, value)
+}
+
+func TestAccAliasTarget(t *testing.T) {
+	tc := controller.NewTestController(t, tcConfig...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	res := targetAliasResource(targetAliasName, targetAliasDesc, targetAliasValue)
+
+	resUpdate := targetAliasResource(targetAliasName+targetAliasUpdate,
+		targetAliasDesc+targetAliasUpdate, targetAliasValueUpdated)
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		ProviderFactories: providerFactories(&provider),
+		CheckDestroy:      testAccCheckAliasResourceDestroy(t, provider, targetAliasType),
+		Steps: []resource.TestStep{
+			{
+				// create
+				Config: testConfig(url, fooOrg, firstProjectFoo, fooBarTarget, res),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(targetAliasResc, NameKey, targetAliasName),
+					resource.TestCheckResourceAttr(targetAliasResc, DescriptionKey, targetAliasDesc),
+					resource.TestCheckResourceAttr(targetAliasResc, ValueKey, targetAliasValue),
+
+					testAccCheckAliasResourceExists(provider, targetAliasResc),
+				),
+			},
+			importStep(targetAliasResc),
+			{
+				// update
+				Config: testConfig(url, fooOrg, firstProjectFoo, fooBarTarget, resUpdate),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(targetAliasResc, NameKey, targetAliasName+targetAliasUpdate),
+					resource.TestCheckResourceAttr(targetAliasResc, DescriptionKey, targetAliasDesc+targetAliasUpdate),
+					resource.TestCheckResourceAttr(targetAliasResc, ValueKey, targetAliasValueUpdated),
+
+					testAccCheckAliasResourceExists(provider, targetAliasResc),
+				),
+			},
+			importStep(targetAliasResc),
+			{
+				// Run a plan only update and verify no changes
+				PlanOnly: true,
+				Config:   testConfig(url, fooOrg, firstProjectFoo, fooBarTarget, resUpdate),
+			},
+			importStep(targetAliasResc),
+			{
+				// update again but apply a preConfig to externally update resource
+				// TODO: Boundary currently causes an error on moving back to a previously
+				// used token, for now verify that a plan only step had changes
+				PreConfig:          func() { targetAliasExternalUpdate(t, provider) },
+				PlanOnly:           true,
+				ExpectNonEmptyPlan: true,
+				Config:             testConfig(url, fooOrg, firstProjectFoo, fooBarTarget, resUpdate),
+			},
+			importStep(targetAliasResc),
+		},
+	})
+}
+
+func targetAliasExternalUpdate(t *testing.T, testProvider *schema.Provider) {
+	if aliasId == "" {
+		t.Fatal("aliasId must be set before testing an external update")
+	}
+
+	md := testProvider.Meta().(*metaData)
+	ac := aliases.NewClient(md.client)
+	ar, err := ac.Read(context.Background(), aliasId)
+	if err != nil {
+		t.Fatal(fmt.Errorf("got an error reading %q: %w", storeId, err))
+	}
+
+	// update alias options
+	var opts []aliases.Option
+	opts = append(opts, aliases.WithDescription("this is an updated description, my guy"))
+
+	_, err = ac.Update(context.Background(), ar.Item.Id, ar.Item.Version, opts...)
+	if err != nil {
+		t.Fatal(fmt.Errorf("got an error updating %q: %w", ar.Item.Id, err))
+	}
+}
+
+func testAccCheckAliasResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("not found: %s", name)
+		}
+
+		id := rs.Primary.ID
+		if id == "" {
+			return fmt.Errorf("no ID is set")
+		}
+		aliasId = id
+
+		md := testProvider.Meta().(*metaData)
+		c := aliases.NewClient(md.client)
+		if _, err := c.Read(context.Background(), id); err != nil {
+			return fmt.Errorf("got an error reading %q: %w", id, err)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckAliasResourceDestroy(t *testing.T, testProvider *schema.Provider, typ aliasDestroyType) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if testProvider.Meta() == nil {
+			t.Fatal("got nil provider metadata")
+		}
+		md := testProvider.Meta().(*metaData)
+
+		for _, rs := range s.RootModule().Resources {
+			switch rs.Type {
+			case string(typ):
+				id := rs.Primary.ID
+
+				c := aliases.NewClient(md.client)
+				_, err := c.Read(context.Background(), id)
+				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
+					return fmt.Errorf("didn't get a 404 when reading destroyed target alias %q: %v", id, err)
+				}
+			default:
+				continue
+			}
+		}
+		return nil
+	}
+}

internal/provider/resource_host_catalog_plugin.go

@@ -118,6 +118,11 @@ func resourceHostCatalogPlugin() *schema.Resource {
 				Optional:    true,
 				Computed:    true,
 			},
+			WorkerFilterKey: {
+				Description: "HCP Only. A filter used to control which PKI workers can handle dynamic host catalog requests.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
 			internalSecretsConfigHmacKey: {
 				Description: "Internal only. HMAC of (serverSecretsHmac + config secrets). Used for proper secrets handling.",
 				Type:        schema.TypeString,
@@ -294,6 +299,9 @@ func setFromHostCatalogPluginResponseMap(d *schema.ResourceData, raw map[string]
 	if err := d.Set(ScopeIdKey, raw[ScopeIdKey]); err != nil {
 		return err
 	}
+	if err := d.Set(WorkerFilterKey, raw[WorkerFilterKey]); err != nil {
+		return err
+	}
 	// Plugin stuff
 	{
 		if err := d.Set(PluginIdKey, raw[PluginIdKey]); err != nil {
@@ -399,6 +407,12 @@ func resourceHostCatalogPluginCreate(ctx context.Context, d *schema.ResourceData
 		opts = append(opts, hostcatalogs.WithDescription(descStr))
 	}
 
+	workerFilterVal, ok := d.GetOk(WorkerFilterKey)
+	if ok {
+		workerFilterStr := workerFilterVal.(string)
+		opts = append(opts, hostcatalogs.WithWorkerFilter(workerFilterStr))
+	}
+
 	attrsVal, ok := d.GetOk(AttributesJsonKey)
 	if ok {
 		attrsStr, err := parseutil.ParsePath(attrsVal.(string))
@@ -556,6 +570,15 @@ func resourceHostCatalogPluginUpdate(ctx context.Context, d *schema.ResourceData
 		}
 	}
 
+	if d.HasChange(WorkerFilterKey) {
+		opts = append(opts, hostcatalogs.DefaultWorkerFilter())
+		workerFilterVal, ok := d.GetOk(WorkerFilterKey)
+		if ok {
+			workerFilterStr := workerFilterVal.(string)
+			opts = append(opts, hostcatalogs.WithWorkerFilter(workerFilterStr))
+		}
+	}
+
 	if d.HasChange(AttributesJsonKey) {
 		attrsVal, ok := d.GetOk(AttributesJsonKey)
 		if ok {

internal/provider/resource_host_catalog_plugin_test.go

@@ -22,6 +22,9 @@ const (
 	testPluginHostCatalogDescription        = "bar"
 	testPluginHostCatalogDescriptionUpdate  = "bar foo"
 	testPluginHostCatalogDescriptionUpdate2 = "bar foo foo"
+
+	testPluginHostCatalogWorkerFilterUpdate  = "\"dev\" in \"/tags/type\""
+	testPluginHostCatalogWorkerFilterUpdate2 = "\"pki\" in \"/tags/type\""
 )
 
 // expectedAttributesState is used here and in plugin host sets to control how
@@ -244,6 +247,212 @@ func TestAccPluginHostCatalog(t *testing.T) {
 	})
 }
 
+func TestAccPluginHostCatalogWithWorkerFilter(t *testing.T) {
+	t.Skip("Skipping test until Boundary Terraform Provider can unit tests for Boundary Enterprise only features")
+
+	tc := controller.NewTestController(t, tcConfig...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	resName := "boundary_host_catalog_plugin.foo"
+	initialValuesStr := fmt.Sprintf(`
+	description = "%s"
+	attributes_json = jsonencode({
+		foo = "bar"
+		zip = "zap"
+	})
+	secrets_json = jsonencode({
+		hush = "puppies"
+	})
+	`,
+		testPluginHostCatalogDescription,
+	)
+
+	// Changed description, secrets and added worker filter.
+	valuesStrUpdate1 := fmt.Sprintf(`
+	description = "%s"
+	worker_filter = %q
+	attributes_json = jsonencode({
+		foo = "bar"
+		zip = "zoop"
+	})
+	secrets_json = jsonencode({
+		flush = "fluppies"
+	})
+	`,
+		testPluginHostCatalogDescriptionUpdate,
+		testPluginHostCatalogWorkerFilterUpdate,
+	)
+
+	// Changed description, no secrets update, nullify worker filter.
+	valuesStrUpdate2 := fmt.Sprintf(`
+	description = "%s"
+	worker_filter = null
+	attributes_json = jsonencode({
+		foo = "bar"
+		zip = "zoop"
+	})
+	secrets_json = jsonencode({
+		flush = "fluppies"
+	})
+	`,
+		testPluginHostCatalogDescriptionUpdate2,
+	)
+
+	// Same description and set a worker filter again, now empty secrets.
+	valuesStrUpdate3 := fmt.Sprintf(`
+		description = "%s"
+		worker_filter = %q
+		attributes_json = jsonencode({
+			foo = "bar"
+			zip = "zoop"
+		})
+		`,
+		testPluginHostCatalogDescriptionUpdate2,
+		testPluginHostCatalogWorkerFilterUpdate2,
+	)
+
+	// Same description, now explicitly unset secrets and blankify attrs and
+	// worker filter.
+	valuesStrUpdate4 := fmt.Sprintf(`
+		description = "%s"
+		secrets_json = "null"
+		`,
+		testPluginHostCatalogDescriptionUpdate2,
+	)
+
+	// Set values again
+	valuesStrUpdate5 := fmt.Sprintf(`
+		description = "%s"
+		worker_filter = %q
+		attributes_json = jsonencode({
+			foo = "bar"
+			zip = "zoop"
+		})
+		secrets_json = jsonencode({
+			flush = "fluppies"
+		})
+		`,
+		testPluginHostCatalogDescriptionUpdate2,
+		testPluginHostCatalogWorkerFilterUpdate2,
+	)
+
+	// Explicitly set both secrets and attributes to null
+	valuesStrUpdate6 := fmt.Sprintf(`
+		description = "%s"
+		worker_filter = %q
+		attributes_json = "null"
+		secrets_json = "null"
+		`,
+		testPluginHostCatalogDescriptionUpdate2,
+		testPluginHostCatalogWorkerFilterUpdate2,
+	)
+
+	initialHcl := fmt.Sprintf(projPluginHostCatalogBase, initialValuesStr)
+	update1Hcl := fmt.Sprintf(projPluginHostCatalogBase, valuesStrUpdate1)
+	update2Hcl := fmt.Sprintf(projPluginHostCatalogBase, valuesStrUpdate2)
+	update3Hcl := fmt.Sprintf(projPluginHostCatalogBase, valuesStrUpdate3)
+	update4Hcl := fmt.Sprintf(projPluginHostCatalogBase, valuesStrUpdate4)
+	update5Hcl := fmt.Sprintf(projPluginHostCatalogBase, valuesStrUpdate5)
+	update6Hcl := fmt.Sprintf(projPluginHostCatalogBase, valuesStrUpdate6)
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		ProviderFactories: providerFactories(&provider),
+		CheckDestroy:      testAccCheckHostCatalogResourceDestroy(t, provider, baseHostCatalogType),
+		Steps: []resource.TestStep{
+			{
+				// test create
+				Config: testConfig(url, fooOrg, firstProjectFoo, initialHcl),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckScopeResourceExists(provider, "boundary_scope.org1"),
+					testAccCheckScopeResourceExists(provider, "boundary_scope.proj1"),
+					testAccCheckPluginHostCatalogResourceExists(provider, resName, expectedAttributesStatePreviouslyEmptyNowSet),
+					resource.TestCheckResourceAttr(resName, DescriptionKey, testPluginHostCatalogDescription),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
+			{
+				// test update
+				Config: testConfig(url, fooOrg, firstProjectFoo, update1Hcl),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckPluginHostCatalogResourceExists(provider, resName, expectedAttributesStatePreviouslySetButChanged),
+					resource.TestCheckResourceAttr(resName, DescriptionKey, testPluginHostCatalogDescriptionUpdate),
+					resource.TestCheckResourceAttr(resName, WorkerFilterKey, testPluginHostCatalogWorkerFilterUpdate),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
+			{
+				// test update
+				Config: testConfig(url, fooOrg, firstProjectFoo, update2Hcl),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckPluginHostCatalogResourceExists(provider, resName, expectedAttributesStatePreviouslySetNoChange),
+					resource.TestCheckResourceAttr(resName, DescriptionKey, testPluginHostCatalogDescriptionUpdate2),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
+			{
+				// this runs the same HCL; mostly used in some manual checking
+				// to ensure update is still called even when nothing has
+				// changed (as we need for secrets)
+				Config: testConfig(url, fooOrg, firstProjectFoo, update2Hcl),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckPluginHostCatalogResourceExists(provider, resName, expectedAttributesStatePreviouslySetNoChange),
+					resource.TestCheckResourceAttr(resName, DescriptionKey, testPluginHostCatalogDescriptionUpdate2),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
+			{
+				// test update
+				Config: testConfig(url, fooOrg, firstProjectFoo, update3Hcl),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckPluginHostCatalogResourceExists(provider, resName, expectedAttributesStatePreviouslySetNoChange),
+					resource.TestCheckResourceAttr(resName, DescriptionKey, testPluginHostCatalogDescriptionUpdate2),
+					resource.TestCheckResourceAttr(resName, WorkerFilterKey, testPluginHostCatalogWorkerFilterUpdate2),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
+			{
+				// test update
+				Config: testConfig(url, fooOrg, firstProjectFoo, update4Hcl),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckPluginHostCatalogResourceExists(provider, resName, expectedAttributesStatePreviouslySetNowEmpty),
+					resource.TestCheckResourceAttr(resName, DescriptionKey, testPluginHostCatalogDescriptionUpdate2),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
+			{
+				// test update
+				Config: testConfig(url, fooOrg, firstProjectFoo, update5Hcl),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckPluginHostCatalogResourceExists(provider, resName, expectedAttributesStatePreviouslyEmptyNowSet),
+					resource.TestCheckResourceAttr(resName, DescriptionKey, testPluginHostCatalogDescriptionUpdate2),
+					resource.TestCheckResourceAttr(resName, WorkerFilterKey, testPluginHostCatalogWorkerFilterUpdate2),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
+			{
+				// test update
+				Config: testConfig(url, fooOrg, firstProjectFoo, update6Hcl),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckPluginHostCatalogResourceExists(provider, resName, expectedAttributesStatePreviouslySetNowEmpty),
+					resource.TestCheckResourceAttr(resName, DescriptionKey, testPluginHostCatalogDescriptionUpdate2),
+					resource.TestCheckResourceAttr(resName, WorkerFilterKey, testPluginHostCatalogWorkerFilterUpdate2),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
+		},
+	})
+}
+
 func testAccCheckPluginHostCatalogResourceExists(testProvider *schema.Provider, name string, expAttrState expectedAttributesState) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[name]

internal/provider/resource_role.go

@@ -19,7 +19,6 @@ import (
 )
 
 const (
-	roleGrantScopeIdKey  = "grant_scope_id"
 	roleGrantScopeIdsKey = "grant_scope_ids"
 	rolePrincipalIdsKey  = "principal_ids"
 	roleGrantStringsKey  = "grant_strings"
@@ -71,13 +70,6 @@ func resourceRole() *schema.Resource {
 				Optional:    true,
 				Elem:        &schema.Schema{Type: schema.TypeString},
 			},
-			roleGrantScopeIdKey: {
-				Description: "For Boundary 0.15+, use `grant_scope_ids` instead. The scope for which the grants in the role should apply.",
-				Type:        schema.TypeString,
-				Optional:    true,
-				Computed:    true,
-				Deprecated:  "In Boundary 0.15+, please use `grant_scope_ids` instead. This field will be removed in a future release.",
-			},
 			roleGrantScopeIdsKey: {
 				Description: `A list of scopes for which the grants in this role should apply, which can include the special values "this", "children", or "descendants"`,
 				Type:        schema.TypeSet,
@@ -108,9 +100,6 @@ func setFromRoleResponseMap(d *schema.ResourceData, raw map[string]interface{})
 	if err := d.Set(roleGrantScopeIdsKey, raw["grant_scope_ids"]); err != nil {
 		return err
 	}
-	if err := d.Set(roleGrantScopeIdKey, raw["grant_scope_id"]); err != nil {
-		return err
-	}
 
 	d.SetId(raw["id"].(string))
 	return nil
@@ -140,11 +129,6 @@ func resourceRoleCreate(ctx context.Context, d *schema.ResourceData, meta interf
 		opts = append(opts, roles.WithDescription(descStr))
 	}
 
-	grantScopeIdVal := d.Get(roleGrantScopeIdKey)
-	if grantScopeIdVal != "" {
-		grantScopeIdStr := grantScopeIdVal.(string)
-		opts = append(opts, roles.WithGrantScopeId(grantScopeIdStr))
-	}
 	var grantScopeIds []string
 	if grantScopeIdsVal, ok := d.GetOk(roleGrantScopeIdsKey); ok {
 		list := grantScopeIdsVal.(*schema.Set).List()
@@ -288,22 +272,6 @@ func resourceRoleUpdate(ctx context.Context, d *schema.ResourceData, meta interf
 		}
 	}
 
-	var grantScopeId *string
-	if d.HasChange(roleGrantScopeIdKey) {
-		// If it is an update to use the multi-value grant_scope_ids, and this
-		// has changed to "", then don't set it on the API. Instead let it fall
-		// through and below it'll be updated to be "".
-		if !d.HasChange(roleGrantScopeIdsKey) {
-			opts = append(opts, roles.DefaultGrantScopeId())
-			grantScopeIdVal, ok := d.GetOk(roleGrantScopeIdKey)
-			if ok {
-				grantScopeIdStr := grantScopeIdVal.(string)
-				grantScopeId = &grantScopeIdStr
-				opts = append(opts, roles.WithGrantScopeId(grantScopeIdStr))
-			}
-		}
-	}
-
 	if len(opts) > 0 {
 		opts = append(opts, roles.WithAutomaticVersioning(true))
 		_, err := rc.Update(ctx, d.Id(), 0, opts...)
@@ -322,11 +290,6 @@ func resourceRoleUpdate(ctx context.Context, d *schema.ResourceData, meta interf
 			return diag.FromErr(err)
 		}
 	}
-	if d.HasChange(roleGrantScopeIdKey) {
-		if err := d.Set(roleGrantScopeIdKey, grantScopeId); err != nil {
-			return diag.FromErr(err)
-		}
-	}
 
 	var diags diag.Diagnostics
 	if d.HasChange(roleGrantStringsKey) {

internal/provider/resource_role_grant_scope_ids_upgrade_test.go

@@ -47,22 +47,6 @@ var (
 		grant_scope_ids = ["this", "children", "p_foobar1234"]
 	}`
 
-	conversionOrgRoleWithGrantScopeId = `
-resource "boundary_role" "with_grant_scope_id" {
-	name            = "grant scope id role"
-	scope_id        = boundary_scope.org1.id
-	depends_on      = [boundary_role.org1_admin]
-	grant_scope_id  = boundary_scope.org1.id
-}`
-
-	conversionOrgRoleWithGrantScopeIdUpdate = `
-resource "boundary_role" "with_grant_scope_id" {
-	name            = "grant scope id role"
-	scope_id        = boundary_scope.org1.id
-	depends_on      = [boundary_role.org1_admin]
-	grant_scope_id  = boundary_scope.proj1.id
-}`
-
 	conversionOrgRoleWithGrantScopeIdsConversion = `
 resource "boundary_role" "with_grant_scope_id" {
 	name             = "grant scope id role"
@@ -132,106 +116,6 @@ func TestAccRoleWithGrantScopes(t *testing.T) {
 	})
 }
 
-// TestAccRoleGrantScopeUpgrade exercises some specific upgrade scenarios around
-// grant_scope_id -> grant_scope_ids
-func TestAccRoleWithGrantScopesUpdate(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
-	t.Cleanup(tc.Shutdown)
-	url := tc.ApiAddrs()[0]
-
-	var provider *schema.Provider
-	resource.Test(t, resource.TestCase{
-		IsUnitTest:        true,
-		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckRoleResourceDestroy(t, provider),
-		Steps: []resource.TestStep{
-			{
-				// Create
-				Config: testConfig(url, fooOrg, firstProjectFoo, fooUser, conversionOrgRoleWithGrantScopeId),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckScopeResourceExists(provider, "boundary_scope.org1"),
-					testAccCheckRoleResourceExists(provider, "boundary_role.with_grant_scope_id"),
-					testAccCheckUserResourceExists(provider, "boundary_user.foo"),
-					testAccCheckRoleResourceGrantScopesSet(provider, "boundary_role.with_grant_scope_id", []string{"boundary_scope.org1"}),
-					testAccCheckRoleResourceGrantScopeSet(provider, "boundary_role.with_grant_scope_id", "boundary_scope.org1"),
-				),
-			},
-			importStep("boundary_role.with_grant_scope_id"),
-			{
-				Config: testConfig(url, fooOrg, firstProjectFoo, fooUser, conversionOrgRoleWithGrantScopeIdUpdate),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckScopeResourceExists(provider, "boundary_scope.org1"),
-					testAccCheckRoleResourceExists(provider, "boundary_role.with_grant_scope_id"),
-					testAccCheckUserResourceExists(provider, "boundary_user.foo"),
-					testAccCheckRoleResourceGrantScopesSet(provider, "boundary_role.with_grant_scope_id", []string{"boundary_scope.proj1"}),
-					testAccCheckRoleResourceGrantScopeSet(provider, "boundary_role.with_grant_scope_id", "boundary_scope.proj1"),
-				),
-			},
-			importStep("boundary_role.with_grant_scope_id"),
-			{
-				Config: testConfig(url, fooOrg, firstProjectFoo, fooUser, conversionOrgRoleWithGrantScopeIdsConversion),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckScopeResourceExists(provider, "boundary_scope.org1"),
-					testAccCheckRoleResourceExists(provider, "boundary_role.with_grant_scope_id"),
-					testAccCheckUserResourceExists(provider, "boundary_user.foo"),
-					testAccCheckRoleResourceGrantScopesSet(provider, "boundary_role.with_grant_scope_id", []string{"this", "boundary_scope.proj1"}),
-					testAccCheckRoleResourceGrantScopeSet(provider, "boundary_role.with_grant_scope_id", ""),
-				),
-			},
-			importStep("boundary_role.with_grant_scope_id"),
-			{
-				Config: testConfig(url, fooOrg, firstProjectFoo, fooUser, conversionOrgRoleWithGrantScopeIdsUpdate),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckScopeResourceExists(provider, "boundary_scope.org1"),
-					testAccCheckRoleResourceExists(provider, "boundary_role.with_grant_scope_id"),
-					testAccCheckUserResourceExists(provider, "boundary_user.foo"),
-					testAccCheckRoleResourceGrantScopesSet(provider, "boundary_role.with_grant_scope_id", []string{"this", "children"}),
-					testAccCheckRoleResourceGrantScopeSet(provider, "boundary_role.with_grant_scope_id", ""),
-				),
-			},
-			importStep("boundary_role.with_grant_scope_id"),
-		},
-	})
-}
-
-func testAccCheckRoleResourceGrantScopeSet(testProvider *schema.Provider, name string, grantScope string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[name]
-		if !ok {
-			return fmt.Errorf("role resource not found: %s", name)
-		}
-
-		roleId := rs.Primary.ID
-
-		scopeId := grantScope
-		if grantScope != "children" && grantScope != "this" && grantScope != "descendants" && grantScope != "" {
-			scope, ok := s.RootModule().Resources[grantScope]
-			if !ok {
-				return fmt.Errorf("scope resource not found: %s", grantScope)
-			}
-
-			scopeId = scope.Primary.ID
-			if scopeId == "" {
-				return fmt.Errorf("role resource ID is not set")
-			}
-		}
-
-		md := testProvider.Meta().(*metaData)
-		rolesClient := roles.NewClient(md.client)
-
-		rr, err := rolesClient.Read(context.Background(), roleId)
-		if err != nil {
-			return fmt.Errorf("Got an error when reading role %q: %v", roleId, err)
-		}
-
-		if rr.Item.GrantScopeId != scopeId {
-			return fmt.Errorf("grant scope id in state is %s but in boundary is %s", scopeId, rr.Item.GrantScopeId)
-		}
-
-		return nil
-	}
-}
-
 func testAccCheckRoleResourceGrantScopesSet(testProvider *schema.Provider, name string, grantScopeIds []string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[name]

templates/resources/worker.md.tmpl

@@ -0,0 +1,28 @@
+---
+page_title: "boundary_worker Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+{{ .Description | plainmarkdown | trimspace | prefixlines "  " }}
+---
+
+# boundary_worker (Resource)
+
+{{ .Description | trimspace }}
+
+## Example Usage
+
+### Controller-led worker
+
+{{tffile "examples/resources/boundary_worker/controller_led.tf"}}
+
+### Worker-led worker
+
+{{tffile "examples/resources/boundary_worker/worker_led.tf"}}
+
+{{ .SchemaMarkdown | trimspace }}
+
+## Import
+
+Import is supported using the following syntax:
+
+{{codefile "shell" "examples/resources/boundary_worker/import.sh" }}