chore: bump grpc go version to 1.82.1 to fix the vulnerability (#832)

* Add default permissions for build workflow (#826)

Add workflow level read-only permission for build workflow to support new default permissions github policy.

* feat(proj-alias): support project scoped alias via suffixes (#824)

* feat(proj-alias): support project scoped alias via suffixes

* fix: generate resouce docs using make gen

* fix: address review comments

* chore: make gen changes

* fix(proja-alias): validate scope id before calling remove alias suffix

* fix: filter unknown scopes in validation

* chore: update version and changelog (#828)

* chore: update version and changelog

* fix: update version number to 1.6.1

* fix: update changelog description for project alias changes

---------

Co-authored-by: Susmitha Girumala <susmitha@hashicorp.com>

.github/dependabot.yml

@@ -9,12 +9,36 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      # Check for updates to GitHub Actions every weekday
-      interval: "daily"
+      # Check for updates to GitHub Actions every Sunday
+      interval: "weekly"
+      day: "sunday"
+    groups:
+      # Group all GitHub Actions updates into a single PR
+      actions:
+        patterns:
+          - "*"
 
-  # Maintain dependencies for Go modules
   - package-ecosystem: "gomod"
-    directory: "/"
+    directories: 
+      - "/"
+      - "/plugins/kms/mains/alicloudkms"
+      - "/plugins/kms/mains/awskms"
+      - "/plugins/kms/mains/azurekeyvault"
+      - "/plugins/kms/mains/gcpckms"
+      - "/plugins/kms/mains/ocikms"
+      - "/plugins/kms/mains/transit"
     schedule:
-      # Check for updates to Go modules every weekday
-      interval: "daily"
+      # Check for updates to Go modules every Sunday
+      interval: "weekly"
+      day: "sunday"
+    groups:
+      # Group all Go module updates into one PR for version updates
+      # and one for security updates.
+      go:
+        patterns:
+          - "*"
+        applies-to: "version-updates"
+      go-security:
+        patterns:
+          - "*"
+        applies-to: "security-updates"

.github/pull_request_template.md

@@ -0,0 +1,11 @@
+## PCI review checklist
+
+<!-- heimdall_github_prtemplate:grc-pci_dss-2024-01-05 -->
+
+- [ ] I have documented a clear reason for, and description of, the change I am making.
+
+- [ ] If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
+
+- [ ] If applicable, I've documented the impact of any changes to security controls.
+
+  Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.

.github/workflows/actionlint.yml

@@ -8,7 +8,7 @@ jobs:
   actionlint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Check workflow files
         uses: docker://docker.mirror.hashicorp.services/rhysd/actionlint@sha256:02ccb6d91e4cb4a7b21eb99d5274d257e81ae667688d730e89d7ea0d6d35db91
         with:

.github/workflows/build.yaml

@@ -0,0 +1,200 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+#
+# This workflow builds the product for all supported platforms and uploads the resulting
+# binaries as Actions artifacts. The workflow also uploads a build metadata file
+# (metadata.json) -- and a Terraform Registry manifest file (terraform-registry-manifest.json).
+#
+# Reference: https://github.com/hashicorp/terraform-provider-crt-example/blob/main/.github/workflows/README.md
+#
+
+name: build
+
+# We default to running this workflow on every push to every branch.
+# This provides fast feedback when build issues occur, so they can be
+# fixed prior to being merged to the main branch.
+#
+# If you want to opt out of this, and only run the build on certain branches
+# please refer to the documentation on branch filtering here:
+#
+#   https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onpushbranchestagsbranches-ignoretags-ignore
+#
+on: [workflow_dispatch, push]
+
+env:
+  PKG_NAME: "terraform-provider-boundary"
+
+permissions:
+  contents: read
+
+jobs:
+  # Detects the Go version to use for builds.
+  get-go-version:
+    name: "Detect Go toolchain version"
+    runs-on: ubuntu-latest
+    outputs:
+      go-version: ${{ steps.get-go-version.outputs.go-version }}
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Detect Go version
+        id: get-go-version
+        # We use .go-version as our source of truth for current Go version,
+        # because "goenv" can react to it automatically.
+        run: |
+          echo "Building with Go $(cat .go-version)"
+          echo "go-version=$(cat .go-version)" >> "$GITHUB_OUTPUT"
+      - name: Set up Go
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        with:
+          go-version: "${{ steps.get-go-version.outputs.go-version }}"
+          cache: false
+
+  # Parses the version/VERSION file. Reference: https://github.com/hashicorp/actions-set-product-version/blob/main/README.md
+  #
+  # > This action should be implemented in product repo `build.yml` files. The action is intended to grab the version
+  # > from the version file at the beginning of the build, then passes those versions (along with metadata, where
+  # > necessary) to any workflow jobs that need version information.
+  set-product-version:
+    name: "Parse version file"
+    runs-on: ubuntu-latest
+    outputs:
+      product-version: ${{ steps.set-product-version.outputs.product-version }}
+      product-base-version: ${{ steps.set-product-version.outputs.base-product-version }}
+      product-prerelease-version: ${{ steps.set-product-version.outputs.prerelease-product-version }}
+      product-minor-version: ${{ steps.set-product-version.outputs.minor-product-version }}
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Set variables
+        id: set-product-version
+        uses: hashicorp/actions-set-product-version@v2
+        with:
+          checkout: false
+
+  # Creates metadata.json file containing build metadata for consumption by CRT workflows.
+  #
+  # Reference: https://github.com/hashicorp/actions-generate-metadata/blob/main/README.md
+  generate-metadata-file:
+    needs: set-product-version
+    runs-on: ubuntu-latest
+    outputs:
+      filepath: ${{ steps.generate-metadata-file.outputs.filepath }}
+    steps:
+      - name: "Checkout directory"
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Generate metadata file
+        id: generate-metadata-file
+        uses: hashicorp/actions-generate-metadata@v1
+        with:
+          version: ${{ needs.set-product-version.outputs.product-version }}
+          product: ${{ env.PKG_NAME }}
+          repositoryOwner: "hashicorp"
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: metadata.json
+          path: ${{ steps.generate-metadata-file.outputs.filepath }}
+
+  # Uploads an Actions artifact named terraform-registry-manifest.json.zip.
+  #
+  # The artifact contains a single file with a filename that Terraform Registry expects
+  # (example: terraform-provider-crt-example_2.3.6-alpha1_manifest.json). The file contents
+  # are identical to the terraform-registry-manifest.json file in the source repository.
+  upload-terraform-registry-manifest-artifact:
+    needs: set-product-version
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Checkout directory"
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          path: ${{ env.PKG_NAME }}
+      - name: "Copy manifest from checkout directory to a file with the desired name"
+        id: terraform-registry-manifest
+        run: |
+          name="${{ env.PKG_NAME }}"
+          version="${{ needs.set-product-version.outputs.product-version }}"
+
+          source="${name}/terraform-registry-manifest.json"
+          destination="${name}_${version}_manifest.json"
+
+          cp "$source" "$destination"
+          echo "filename=$destination" >> "$GITHUB_OUTPUT"
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: terraform-registry-manifest.json
+          path: ${{ steps.terraform-registry-manifest.outputs.filename }}
+          if-no-files-found: error
+
+  # Builds the product for supported platforms.
+  #
+  # With `reproducible: report`, this job also reports whether the build is reproducible,
+  # but does not enforce it.
+  #
+  # Reference: https://github.com/hashicorp/actions-go-build/blob/main/README.md
+  build:
+    needs:
+      - get-go-version
+      - set-product-version
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: true
+      matrix:
+        goos: [freebsd, windows, linux, darwin]
+        goarch: ["386", "amd64", "arm", "arm64"]
+        exclude:
+          - goos: freebsd
+            goarch: arm64
+          - goos: windows
+            goarch: arm64
+          - goos: windows
+            goarch: arm
+          - goos: darwin
+            goarch: 386
+          - goos: darwin
+            goarch: arm
+
+    name: Go ${{ needs.get-go-version.outputs.go-version }} ${{ matrix.goos }} ${{ matrix.goarch }} build
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: hashicorp/actions-go-build@v1
+        env:
+          CGO_ENABLED: 0
+          BASE_VERSION: ${{ needs.set-product-version.outputs.product-base-version }}
+          PRERELEASE_VERSION: ${{ needs.set-product-version.outputs.product-prerelease-version}}
+          METADATA_VERSION: ${{ env.METADATA }}
+        with:
+          bin_name: "${{ env.PKG_NAME }}_v${{ needs.set-product-version.outputs.product-version }}_x5"
+          product_name: ${{ env.PKG_NAME }}
+          product_version: ${{ needs.set-product-version.outputs.product-version }}
+          go_version: ${{ needs.get-go-version.outputs.go-version }}
+          os: ${{ matrix.goos }}
+          arch: ${{ matrix.goarch }}
+          reproducible: report
+          instructions: |
+            go mod download && ./scripts/plugins-all.sh
+            go build \
+              -o "$BIN_PATH" \
+              -trimpath \
+              -buildvcs=false \
+              -ldflags "-s -w -X 'main.version=${{ needs.set-product-version.outputs.product-version }}'"
+            cp LICENSE "$TARGET_DIR/LICENSE.txt"
+
+  whats-next:
+    needs:
+      - build
+      - generate-metadata-file
+      - upload-terraform-registry-manifest-artifact
+    runs-on: ubuntu-latest
+    name: "What's next?"
+    steps:
+      - name: "Write a helpful summary"
+        run: |
+          github_dot_com="${{ github.server_url }}"
+          owner_with_name="${{ github.repository }}"
+          ref="${{ github.ref }}"
+
+          {
+            echo "### What's next?"
+            echo "#### For a release branch (see \`.release/ci.hcl\`)"
+            echo "After this \`build\` workflow run completes succesfully, you can expect the CRT \`prepare\` workflow to begin momentarily."
+            echo "To find the \`prepare\` workflow run, [view the checks for this commit]($github_dot_com/$owner_with_name/commits/$ref)"
+          }  >> "$GITHUB_STEP_SUMMARY"
+

.github/workflows/jira.yml

@@ -1,90 +0,0 @@
-on:
-  issues:
-    types: [opened, closed, deleted, reopened]
-  pull_request_target:
-    types: [opened, closed, reopened]
-  issue_comment: # Also triggers when commenting on a PR from the conversation view
-    types: [created]
-  workflow_dispatch:
-
-name: Jira Sync
-
-permissions:
-  contents: read
-
-jobs:
-  sync:
-    runs-on: ubuntu-latest
-    name: Jira sync
-    steps:
-    - name: Check if community user
-      if: github.event.action == 'opened'
-      id: boundary-team-role
-      run: |
-        TEAM="boundary"
-        ROLE="$(hub api orgs/hashicorp/teams/${TEAM}/memberships/${{ github.actor }} | jq -r '.role | select(.!=null)')"
-        if [[ -n "${ROLE}" ]]; then
-          echo "Actor ${{ github.actor }} is a ${TEAM} team member, skipping ticket creation"
-        else
-          echo "Actor ${{ github.actor }} is not a ${TEAM} team member"
-        fi
-        echo "name=role::${ROLE}" >> "$GITHUB_OUTPUT"
-      env:
-        GITHUB_TOKEN: ${{ secrets.JIRA_SYNC_GITHUB_TOKEN }}
-
-    - name: Login
-      uses: atlassian/gajira-login@45fd029b9f1d6d8926c6f04175aa80c0e42c9026 # v3.0.1
-      env:
-        JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
-        JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
-        JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
-
-    - name: Set ticket type
-      if: github.event.action == 'opened' && !steps.boundary-team-role.outputs.role
-      id: set-ticket-type
-      run: |
-        if [[ "${{ github.event_name }}" == "pull_request_target" ]]; then
-          echo "name=type::PR" >> "$GITHUB_OUTPUT"
-        else
-          echo "name=type::ISS" >> "$GITHUB_OUTPUT"
-        fi
-
-    - name: Create ticket
-      if: github.event.action == 'opened' && !steps.boundary-team-role.outputs.role
-      uses: tomhjp/gh-action-jira-create@3ed1789cad3521292e591a7cfa703215ec1348bf # v0.2.1
-      with:
-        project: ICU
-        issuetype: "GH Issue"
-        summary: "${{ github.event.repository.name }} [${{ steps.set-ticket-type.outputs.type }} #${{ github.event.issue.number || github.event.pull_request.number }}]: ${{ github.event.issue.title || github.event.pull_request.title }}"
-        description: "${{ github.event.issue.body || github.event.pull_request.body }}\n\n_Created from GitHub Action for ${{ github.event.issue.html_url || github.event.pull_request.html_url }} from ${{ github.actor }}_"
-        # customfield_10089 is Issue Link custom field
-        extraFields: '{"customfield_10089": "${{ github.event.issue.html_url || github.event.pull_request.html_url }}"}'
-
-    - name: Search
-      if: github.event.action != 'opened'
-      id: search
-      uses: tomhjp/gh-action-jira-search@04700b457f317c3e341ce90da5a3ff4ce058f2fa # v0.2.2
-      with:
-        # cf[10089] is Issue Link custom field
-        jql: 'issuetype = "GH Issue" and cf[10089]="${{ github.event.issue.html_url || github.event.pull_request.html_url }}"'
-
-    - name: Sync comment
-      if: github.event.action == 'created' && steps.search.outputs.issue
-      uses: tomhjp/gh-action-jira-comment@6eb6b9ead70221916b6badd118c24535ed220bd9 # v0.2.0
-      with:
-        issue: ${{ steps.search.outputs.issue }}
-        comment: "${{ github.actor }} ${{ github.event.review.state || 'commented' }}:\n\n${{ github.event.comment.body || github.event.review.body }}\n\n${{ github.event.comment.html_url || github.event.review.html_url }}"
-
-    - name: Close ticket
-      if: (github.event.action == 'closed' || github.event.action == 'deleted') && steps.search.outputs.issue
-      uses: atlassian/gajira-transition@38fc9cd61b03d6a53dd35fcccda172fe04b36de3 # v3.0.1
-      with:
-        issue: ${{ steps.search.outputs.issue }}
-        transition: Done
-
-    - name: Reopen ticket
-      if: github.event.action == 'reopened' && steps.search.outputs.issue
-      uses: atlassian/gajira-transition@38fc9cd61b03d6a53dd35fcccda172fe04b36de3 # v3.0.1
-      with:
-        issue: ${{ steps.search.outputs.issue }}
-        transition: "To Do"

.github/workflows/make-gen-delta.yml

@@ -13,7 +13,7 @@ jobs:
     name: "Check for uncommitted changes from make gen"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: '0'
       - name: Determine Go version
@@ -24,7 +24,7 @@ jobs:
           echo "Building with Go $(cat .go-version)"
           echo "go-version=$(cat .go-version)" >> "$GITHUB_OUTPUT"
       - name: Set up Go
-        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version: "${{ steps.get-go-version.outputs.go-version }}"
       - name: Running go mod tidy

.github/workflows/release.yml

@@ -1,55 +0,0 @@
-name: Release
-
-on:
-  push:
-    tags:
-      - 'v[0-9]+.[0-9]+.[0-9]+*'
-
-permissions:
-  contents: write
-
-jobs:
-  go-version:
-    runs-on: ubuntu-latest
-    outputs:
-      version: ${{ steps.go-version.outputs.go-version }}
-    steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      - id: go-version
-        # We use .go-version as our source of truth for current Go
-        # version, because "goenv" can react to it automatically.
-        run: |
-          echo "Building with Go $(cat .go-version)"
-          echo "go-version=$(cat .go-version)" >> "$GITHUB_OUTPUT"
-  release-notes:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-        with:
-          fetch-depth: 0
-      - name: Generate Release Notes
-        run: sed -n -e "1{/# /d;}" -e "2{/^$/d;}" -e "/# $(git describe --abbrev=0 --exclude="$(git describe --abbrev=0 --match='v*.*.*' --tags)" --match='v*.*.*' --tags | tr -d v)/q;p" CHANGELOG.md > release-notes.txt
-      - uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
-        with:
-          name: release-notes
-          path: release-notes.txt
-          retention-days: 1
-  terraform-provider-release:
-    name: 'Terraform Provider Release'
-    needs: [go-version, release-notes]
-    uses: hashicorp/ghaction-terraform-provider-release/.github/workflows/hashicorp.yml@v3
-    secrets:
-      hc-releases-github-token: '${{ secrets.HASHI_RELEASES_GITHUB_TOKEN }}'
-      hc-releases-host-staging: '${{ secrets.HC_RELEASES_HOST_STAGING }}'
-      hc-releases-host-prod: '${{ secrets.HC_RELEASES_HOST_PROD }}'
-      hc-releases-key-prod: '${{ secrets.HC_RELEASES_KEY_PROD }}'
-      hc-releases-key-staging: '${{ secrets.HC_RELEASES_KEY_STAGING }}'
-      hc-releases-terraform-registry-sync-token: '${{ secrets.TF_PROVIDER_RELEASE_TERRAFORM_REGISTRY_SYNC_TOKEN }}'
-      setup-signore-github-token: '${{ secrets.HASHI_SIGNORE_GITHUB_TOKEN }}'
-      signore-client-id: '${{ secrets.SIGNORE_CLIENT_ID }}'
-      signore-client-secret: '${{ secrets.SIGNORE_CLIENT_SECRET }}'
-    with:
-      release-notes: true
-      setup-go-version: '${{ needs.go-version.outputs.version }}'
-      # Product Version (e.g. v1.2.3 or github.ref_name)
-      product-version: '${{ github.ref_name }}'

.github/workflows/test.yml

@@ -13,7 +13,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Determine go version
         id: get-go-version
         # We use .go-version as our source of truth for current Go
@@ -22,7 +22,7 @@ jobs:
           echo "Building with Go $(cat .go-version)"
           echo "go-version=$(cat .go-version)" >> "$GITHUB_OUTPUT"
       - name: Set up Go
-        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version: "${{ steps.get-go-version.outputs.go-version }}"
           cache: false
@@ -32,7 +32,7 @@ jobs:
           echo "go-build=$(go env GOCACHE)" >> "$GITHUB_OUTPUT"
           echo "go-mod=$(go env GOMODCACHE)" >> "$GITHUB_OUTPUT"
       - name: Set up Go modules cache
-        uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ${{ steps.go-cache-paths.outputs.go-build }}

.go-version

@@ -1 +1 @@
-1.21.5
+1.26.4

.goreleaser.yml

@@ -1,78 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: MPL-2.0
-
-archives:
-  - files:
-      # Ensure only built binary is archived
-      - 'none*'
-    format: zip
-    name_template: '{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}'
-before:
-  hooks:
-    - 'go mod download'
-    - './scripts/plugins-all.sh'
-builds:
-  - # Binary naming only required for Terraform CLI 0.12
-    binary: '{{ .ProjectName }}_v{{ .Version }}_x5'
-    env:
-      - CGO_ENABLED=0
-    flags:
-      - -trimpath
-    goos:
-      - darwin
-      - freebsd
-      - linux
-      - windows
-    goarch:
-      - '386'
-      - amd64
-      - arm
-      - arm64
-    ignore:
-      - goarch: arm
-        goos: windows
-      - goarch: arm64
-        goos: freebsd
-      - goarch: arm64
-        goos: windows
-    ldflags:
-      - -s -w -X main.Version={{.Version}}
-    mod_timestamp: '{{ .CommitTimestamp }}'
-checksum:
-  algorithm: sha256
-  extra_files:
-    - glob: 'terraform-registry-manifest.json'
-      name_template: '{{ .ProjectName }}_{{ .Version }}_manifest.json'
-  name_template: '{{ .ProjectName }}_{{ .Version }}_SHA256SUMS'
-publishers:
-  - checksum: true
-    # Terraform CLI 0.10 - 0.11 perform discovery via HTTP headers on releases.hashicorp.com
-    # For providers which have existed since those CLI versions, exclude
-    # discovery by setting the protocol version headers to 5.
-    cmd: hc-releases upload -product {{ .ProjectName }} -version {{ .Version }} -file={{ .ArtifactPath }}={{ .ArtifactName }} -header=x-terraform-protocol-version=5 -header=x-terraform-protocol-versions=5.0
-    env:
-      - HC_RELEASES_HOST={{ .Env.HC_RELEASES_HOST }}
-      - HC_RELEASES_KEY={{ .Env.HC_RELEASES_KEY }}
-    extra_files:
-      - glob: 'terraform-registry-manifest.json'
-        name_template: '{{ .ProjectName }}_{{ .Version }}_manifest.json'
-    name: upload
-    signature: true
-release:
-  extra_files:
-    - glob: 'terraform-registry-manifest.json'
-      name_template: '{{ .ProjectName }}_{{ .Version }}_manifest.json'
-  ids:
-    - none
-signs:
-  - args: ["sign", "--dearmor", "--file", "${artifact}", "--out", "${signature}"]
-    artifacts: checksum
-    cmd: signore
-    signature: ${artifact}.sig
-  - args: ["sign", "--dearmor", "--file", "${artifact}", "--out", "${signature}"]
-    artifacts: checksum
-    cmd: signore
-    id: key-id
-    signature: ${artifact}.72D7468F.sig
-snapshot:
-  name_template: "{{ .Tag }}-next"

.release/ci.hcl

@@ -0,0 +1,96 @@
+# Copyright IBM Corp. 2020, 2026
+# SPDX-License-Identifier: MPL-2.0
+# 
+# Reference: https://github.com/hashicorp/crt-core-helloworld/blob/main/.release/ci.hcl (private repository)
+# 
+# One way to validate this file, with a local build of the orchestrator (an internal repo):
+# 
+# $ GITHUB_TOKEN="not-used" orchestrator parse config -use-v2 -local-config=.release/ci.hcl
+
+schema = "2"
+
+project "terraform-provider-boundary" {
+  // team is currently unused and has no meaning
+  // but is required to be non-empty by CRT orchestator
+  team = "_UNUSED_"
+
+  slack {
+    notification_channel = "C01BWLSMJ03" // #proj-boundary-release-engineering
+  }
+
+  github {
+    organization     = "hashicorp"
+    repository       = "terraform-provider-boundary"
+    release_branches = ["main", "release/**"]
+  }
+}
+
+event "merge" {
+}
+
+event "build" {
+  action "build" {
+    depends = ["merge"]
+
+    organization = "hashicorp"
+    repository   = "terraform-provider-boundary"
+    workflow     = "build"
+  }
+}
+
+event "prepare" {
+  # `prepare` is the Common Release Tooling (CRT) artifact processing workflow.
+  # It prepares artifacts for potential promotion to staging and production.
+  # For example, it scans and signs artifacts.
+
+  depends = ["build"]
+
+  action "prepare" {
+    organization = "hashicorp"
+    repository   = "crt-workflows-common"
+    workflow     = "prepare"
+    depends      = ["build"]
+  }
+
+  notification {
+    on = "fail"
+  }
+}
+
+event "trigger-staging" {
+}
+
+event "promote-staging" {
+  action "promote-staging" {
+    organization = "hashicorp"
+    repository   = "crt-workflows-common"
+    workflow     = "promote-staging"
+    depends      = null
+    config       = "release-metadata.hcl"
+  }
+
+  depends = ["trigger-staging"]
+
+  notification {
+    on = "always"
+  }
+}
+
+event "trigger-production" {
+}
+
+event "promote-production" {
+  action "promote-production" {
+    organization = "hashicorp"
+    repository   = "crt-workflows-common"
+    workflow     = "promote-production"
+    depends      = null
+    config       = ""
+  }
+
+  depends = ["trigger-production"]
+
+  notification {
+    on = "always"
+  }
+}

.release/release-metadata.hcl

@@ -1,5 +1,7 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2020, 2026
 # SPDX-License-Identifier: MPL-2.0
 
 url_source_repository      = "https://github.com/hashicorp/terraform-provider-boundary"
+url_project_website        = "https://registry.terraform.io/providers/hashicorp/boundary"
 url_license                = "https://github.com/hashicorp/terraform-provider-boundary/blob/main/LICENSE"
+url_release_notes          = "https://github.com/hashicorp/terraform-provider-boundary/blob/main/CHANGELOG.md"

.release/security-scan.hcl

@@ -0,0 +1,28 @@
+# Copyright IBM Corp. 2020, 2026
+# SPDX-License-Identifier: MPL-2.0
+#
+# Reference: https://github.com/hashicorp/security-scanner/blob/main/CONFIG.md#binary (private repository)
+
+binary {
+  secrets {
+    all = true
+  }
+  go_modules   = true
+  osv          = true
+  oss_index    = false
+  nvd          = false
+
+    triage {
+    suppress {
+      vulnerabilities = [
+        // golang.org/x/crypto/openpgp is deprecated/unmaintained with no fixed
+        // version. The provider does not use this package (confirmed via
+        // `go mod why golang.org/x/crypto/openpgp`); it imports the maintained
+        // fork github.com/ProtonMail/go-crypto/openpgp instead. x/crypto is
+        // only pulled in for the unaffected golang.org/x/crypto/cryptobyte
+        // package. Not reachable in the built binary.
+        "GO-2026-5932",
+      ]
+    }
+  }
+}

.release/terraform-provider-boundary-artifacts.hcl

@@ -0,0 +1,20 @@
+# Copyright IBM Corp. 2020, 2026
+# SPDX-License-Identifier: MPL-2.0
+
+schema = 1
+artifacts {
+  # This should match the `matrix` in .github/workflows/build.yml
+  zip = [
+    "terraform-provider-boundary_${version}_darwin_amd64.zip",
+    "terraform-provider-boundary_${version}_darwin_arm64.zip",
+    "terraform-provider-boundary_${version}_freebsd_386.zip",
+    "terraform-provider-boundary_${version}_freebsd_amd64.zip",
+    "terraform-provider-boundary_${version}_freebsd_arm.zip",
+    "terraform-provider-boundary_${version}_linux_386.zip",
+    "terraform-provider-boundary_${version}_linux_amd64.zip",
+    "terraform-provider-boundary_${version}_linux_arm.zip",
+    "terraform-provider-boundary_${version}_linux_arm64.zip",
+    "terraform-provider-boundary_${version}_windows_386.zip",
+    "terraform-provider-boundary_${version}_windows_amd64.zip",
+  ]
+}

CHANGELOG.md

@@ -2,6 +2,86 @@
 
 Canonical reference for changes, improvements, and bugfixes for the Boundary Terraform provider.
 
+## Next
+## 1.6.1 (Jul 24th, 2026)
+
+### New and Improved
+
+* Adds support to enable set/remove alias suffix and aliases at project scope
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/824))
+
+## 1.6.0 (Jul 8th, 2026)
+
+### New and Improved
+
+* Adds support to enable Session Recording for RDP Targets
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/818))
+
+
+## 1.5.1 (Feb 2nd, 2026)
+
+### New and Improved
+
+* Adds support for Vault LDAP Credential Store.
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/778))
+
+## 1.5.0 (December 19th, 2025)
+
+### New and Improved
+
+* Adds support for Password credentials.
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/758))
+
+## 1.4.0 (September 25th, 2025)
+
+### New and Improved
+
+* Adds support for new RDP target type and Username, Password, and Domain credentials.
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/735))
+
+## 1.3.1 (July 11th, 2025)
+
+### Bug Fix
+
+* Fixes a problem where the KMS plugins were not being bundled in the provider's
+  binary ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/717))
+
+## 1.3.0 (July 9th, 2025)
+
+### Known Issues
+
+* `Error configuring kms: plugin is nil`: This error message may occur when you
+  attempt to use KMS plugin functionality. The [KMS plugins](plugins/kms/mains)
+  were not bundled in this Terraform provider release and thus any functionality
+  related to this will not work.
+
+### New and Improved
+
+* Updates various dependencies across the provider
+  ([Example PR](https://github.com/hashicorp/terraform-provider-boundary/pull/708))
+
+## 1.2.0 (October 21, 2024)
+
+### New and Improved
+
+* Introduces support for specifying a worker filter in dynamic host catalogs
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/626))
+
+### Deprecations/Changes
+
+* With Boundary 0.15, a deprecation notice was put under the `grant_scope_id`
+  field, and a new `grant_scope_ids` field was introduced to replace it. With
+  Boundary v0.17.1 and Boundary API v0.0.52, `grant_scope_id` support was
+  entirely removed. `grant_scope_id` support has now been removed from this TF
+  provider.
+
+## 1.1.15 (May 1, 2024)
+
+### New and Improved
+
+* Add support for a target alias as a resource
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/571))
+
 ## 1.1.14 (February 14, 2024)
 
 ### New and Improved
@@ -328,4 +408,4 @@ Update provider to handle new domain errors ([PR](https://github.com/hashicorp/t
 
 ## 0.1.0 (October 14, 2020)
 
-Initial release!
+Initial release!

CODEOWNERS

@@ -1,4 +1,4 @@
 # These owners will be the default owners for everything in
 # the repo, unless a later match takes precedence.
 
-@hashicorp/boundary
+* @hashicorp/boundary

Dockerfile

@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2020, 2026
 # SPDX-License-Identifier: MPL-2.0
 
 FROM golang:1.20

README.md

@@ -97,10 +97,10 @@ Please see our detailed docs for individual resource usage. Below is a complex e
 
 ```hcl
 provider "boundary" {
-  addr                            = "http://127.0.0.1:9200"
-  auth_method_id                  = "ampw_1234567890"      # changeme
-  password_auth_method_login_name = "myuser"               # changeme
-  password_auth_method_password   = "passpass"             # changeme
+  addr                   = "http://127.0.0.1:9200"
+  auth_method_id         = "ampw_1234567890"      # changeme
+  auth_method_login_name = "myuser"               # changeme
+  auth_method_password   = "passpass"             # changeme
 }
 
 variable "users" {

docs/data-sources/auth_method.md

@@ -3,7 +3,7 @@
 page_title: "boundary_auth_method Data Source - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The boundaryauthmethod data source allows you to find a Boundary auth method.
+  The boundary_auth_method data source allows you to find a Boundary auth method.
 ---
 
 # boundary_auth_method (Data Source)

docs/data-sources/role.md

@@ -0,0 +1,62 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_role Data Source - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The boundary_role data source allows you to find a Boundary role.
+---
+
+# boundary_role (Data Source)
+
+The boundary_role data source allows you to find a Boundary role.
+
+## Example Usage
+
+```terraform
+# Role from the global scope
+data "boundary_role" "global_role" {
+  name = "global_role_one"
+}
+
+# Role from an org scope
+data "boundary_scope" "org" {
+  name     = "org_one"
+  scope_id = "global"
+}
+
+data "boundary_role" "org_role" {
+  name     = "org_role_one"
+  scope_id = data.boundary_scope.org.id
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `name` (String) The name of the role to retrieve.
+
+### Optional
+
+- `scope_id` (String) The scope ID in which the resource is created. Defaults `global` if unset.
+
+### Read-Only
+
+- `description` (String) The description of the retrieved role.
+- `grant_scope_ids` (Set of String) The list of scope IDs for the role's grants.
+- `grant_strings` (Set of String) The list of stringified grants for the role.
+- `id` (String) The ID of the retrieved role.
+- `principal_ids` (Set of String) The list of principal (user or group) IDs added as principals on the role.
+- `scope` (List of Object) (see [below for nested schema](#nestedatt--scope))
+
+<a id="nestedatt--scope"></a>
+### Nested Schema for `scope`
+
+Read-Only:
+
+- `description` (String)
+- `id` (String)
+- `name` (String)
+- `parent_scope_id` (String)
+- `type` (String)

docs/index.md

@@ -15,23 +15,23 @@ Do not keep your authentication password in HCL for production environments, use
 
 ```terraform
 provider "boundary" {
-  addr                            = "http://127.0.0.1:9200"
-  auth_method_id                  = "ampw_1234567890" # changeme
-  password_auth_method_login_name = "myuser"          # changeme
-  password_auth_method_password   = "passpass"        # changeme
+  addr                   = "http://127.0.0.1:9200"
+  auth_method_id         = "ampw_1234567890" # changeme
+  auth_method_login_name = "myuser"          # changeme
+  auth_method_password   = "passpass"        # changeme
 }
 
 provider "boundary" {
-  addr                            = "http://127.0.0.1:9200"
-  password_auth_method_login_name = "myuser"
-  password_auth_method_password   = "passpass"
+  addr                   = "http://127.0.0.1:9200"
+  auth_method_login_name = "myuser"
+  auth_method_password   = "passpass"
 }
 
 provider "boundary" {
-  addr                            = "http://127.0.0.1:9200"
-  password_auth_method_login_name = "myuser"
-  password_auth_method_password   = "passpass"
-  scope_id                        = "s_1234567890"
+  addr                   = "http://127.0.0.1:9200"
+  auth_method_login_name = "myuser"
+  auth_method_password   = "passpass"
+  scope_id               = "s_1234567890"
 }
 ```
 

docs/resources/account_ldap.md

@@ -71,6 +71,8 @@ resource "boundary_user" "einstein" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_account_ldap.foo <my-id>
 ```

docs/resources/account_password.md

@@ -56,6 +56,8 @@ resource "boundary_account_password" "jeff" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_account_password.foo <my-id>
 ```

docs/resources/alias_target.md

@@ -0,0 +1,132 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_alias_target Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The target alias resource allows you to configure a Boundary target alias at project and global scopes.
+---
+
+# boundary_alias_target (Resource)
+
+The target alias resource allows you to configure a Boundary target alias at project and global scopes.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_scope_alias_suffix" "org" {
+  scope_id     = boundary_scope.org.id
+  alias_suffix = "org"
+}
+
+resource "boundary_scope_alias_suffix" "project" {
+  scope_id     = boundary_scope.project.id
+  alias_suffix = "projectone"
+}
+
+resource "boundary_host_catalog_static" "foo" {
+  name        = "test"
+  description = "test catalog"
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_host_static" "foo" {
+  name            = "foo"
+  host_catalog_id = boundary_host_catalog_static.foo.id
+  address         = "10.0.0.1"
+}
+
+resource "boundary_host_static" "bar" {
+  name            = "bar"
+  host_catalog_id = boundary_host_catalog_static.foo.id
+  address         = "127.0.0.1"
+}
+
+resource "boundary_host_set_static" "foo" {
+  name            = "foo"
+  host_catalog_id = boundary_host_catalog_static.foo.id
+
+  host_ids = [
+    boundary_host_static.foo.id,
+    boundary_host_static.bar.id,
+  ]
+}
+
+resource "boundary_target" "foo" {
+  name         = "foo"
+  description  = "Foo target"
+  type         = "tcp"
+  default_port = "22"
+  scope_id     = boundary_scope.project.id
+  host_source_ids = [
+    boundary_host_set_static.foo.id,
+  ]
+}
+
+resource "boundary_alias_target" "example_alias_target" {
+  name                      = "example_alias_target"
+  description               = "Example alias to target foo using host boundary_host_static.bar"
+  scope_id                  = "global"
+  value                     = "example.bar.foo.boundary"
+  destination_id            = boundary_target.foo.id
+  authorize_session_host_id = boundary_host_static.bar.id
+}
+
+resource "boundary_alias_target" "example_alias_target_project" {
+  name                      = "example_alias_target_project"
+  description               = "Example project-scoped alias to target foo"
+  scope_id                  = boundary_scope.project.id
+  value                     = "prodops.projectone.org"
+  destination_id            = boundary_target.foo.id
+  authorize_session_host_id = boundary_host_static.bar.id
+  depends_on = [
+    boundary_scope_alias_suffix.org,
+    boundary_scope_alias_suffix.project,
+  ]
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `scope_id` (String) The scope ID. Org scopes are not supported for aliases.
+- `value` (String) The value of the alias.
+
+### Optional
+
+- `authorize_session_host_id` (String) The host id to pass to Boundary when performing an authorize session action.
+- `description` (String) The alias description.
+- `destination_id` (String) The destination of the alias.
+- `name` (String) The alias name. Defaults to the resource name.
+- `type` (String) The type of alias; hardcoded.
+
+### Read-Only
+
+- `id` (String) The ID of the account.
+
+## Import
+
+Import is supported using the following syntax:
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
+```shell
+terraform import boundary_alias_target.example_alias_target <my-id>
+terraform import boundary_alias_target.example_alias_target_project <my-id>
+```

docs/resources/auth_method.md

@@ -25,6 +25,12 @@ resource "boundary_auth_method" "password" {
   scope_id = boundary_scope.org.id
   type     = "password"
 }
+
+resource "boundary_auth_method" "password_is_primary" {
+  scope_id = boundary_scope.org.id
+  type     = "password"
+  is_primary_for_scope = true
+}
 ```
 
 <!-- schema generated by tfplugindocs -->
@@ -38,6 +44,7 @@ resource "boundary_auth_method" "password" {
 ### Optional
 
 - `description` (String) The auth method description.
+- `is_primary_for_scope` (Boolean) When true, makes this auth method the primary auth method for the scope in which it resides.
 - `min_login_name_length` (Number, Deprecated) The minimum login name length.
 - `min_password_length` (Number, Deprecated) The minimum password length.
 - `name` (String) The auth method name. Defaults to the resource name.
@@ -50,6 +57,8 @@ resource "boundary_auth_method" "password" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_auth_method.foo <my-id>
 ```

docs/resources/auth_method_ldap.md

@@ -3,7 +3,7 @@
 page_title: "boundary_auth_method_ldap Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The LDAP auth method resource allows you to configure a Boundary authmethodldap.
+  The LDAP auth method resource allows you to configure a Boundary auth_method_ldap.
 ---
 
 # boundary_auth_method_ldap (Resource)
@@ -83,6 +83,8 @@ resource "boundary_auth_method_ldap" "forumsys_ldap" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_auth_method_ldap.foo <my-id>
 ```

docs/resources/auth_method_oidc.md

@@ -3,7 +3,7 @@
 page_title: "boundary_auth_method_oidc Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The OIDC auth method resource allows you to configure a Boundary authmethodoidc.
+  The OIDC auth method resource allows you to configure a Boundary auth_method_oidc.
 ---
 
 # boundary_auth_method_oidc (Resource)
@@ -94,6 +94,8 @@ resource "boundary_auth_method_oidc" "oidc_with_multiple_prompts" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_auth_method_oidc.foo <my-id>
 ```

docs/resources/auth_method_password.md

@@ -3,14 +3,33 @@
 page_title: "boundary_auth_method_password Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The auth method resource allows you to configure a Boundary authmethodpassword.
+  The auth method resource allows you to configure a Boundary auth_method_password.
 ---
 
 # boundary_auth_method_password (Resource)
 
 The auth method resource allows you to configure a Boundary auth_method_password.
 
+## Example Usage
 
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_auth_method_password" "password" {
+  scope_id = boundary_scope.org.id
+}
+
+resource "boundary_auth_method_password" "password_is_primary" {
+  scope_id = boundary_scope.org.id
+  is_primary_for_scope = true
+}
+```
 
 <!-- schema generated by tfplugindocs -->
 ## Schema
@@ -22,6 +41,7 @@ The auth method resource allows you to configure a Boundary auth_method_password
 ### Optional
 
 - `description` (String) The auth method description.
+- `is_primary_for_scope` (Boolean) When true, makes this auth method the primary auth method for the scope in which it resides.
 - `min_login_name_length` (Number) The minimum login name length.
 - `min_password_length` (Number) The minimum password length.
 - `name` (String) The auth method name. Defaults to the resource name.
@@ -30,3 +50,13 @@ The auth method resource allows you to configure a Boundary auth_method_password
 ### Read-Only
 
 - `id` (String) The ID of the account.
+
+## Import
+
+Import is supported using the following syntax:
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
+```shell
+terraform import boundary_auth_method_password.foo <my-id>
+```

docs/resources/credential_json.md

@@ -64,6 +64,8 @@ resource "boundary_credential_json" "example" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_credential_json.example_json <my-id>
 ```

docs/resources/credential_library_vault.md

@@ -110,6 +110,8 @@ resource "boundary_credential_library_vault" "quz" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_credential_library_vault.foo <my-id>
 ```

docs/resources/credential_library_vault_ldap.md

@@ -0,0 +1,79 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_credential_library_vault_ldap Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The credential library for Vault LDAP resource allows you to configure a Boundary credential library for Vault LDAP.
+---
+
+# boundary_credential_library_vault_ldap (Resource)
+
+The credential library for Vault LDAP resource allows you to configure a Boundary credential library for Vault LDAP.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_vault" "foo" {
+  name        = "foo"
+  description = "My first Vault credential store!"
+  address     = "http://127.0.0.1:8200"      # change to Vault address
+  token       = "s.0ufRo6XEGU2jOqnIr7OlFYP5" # change to valid Vault token
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_library_vault_ldap" "foo-static" {
+  name                = "foo"
+  description         = "My first static Vault LDAP credential library!"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "ldap/static-cred/foo" # change to Vault backend path
+}
+
+resource "boundary_credential_library_vault_ldap" "bar-dynamic" {
+  name                = "bar"
+  description         = "My first dynamic Vault LDAP credential library!"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "ldap/creds/bar" # change to Vault backend path
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `credential_store_id` (String) The ID of the credential store that this library belongs to.
+- `path` (String) The path in Vault to request credentials from.
+
+### Optional
+
+- `description` (String) The Vault LDAP credential library description.
+- `name` (String) The Vault LDAP credential library name. Defaults to the resource name.
+
+### Read-Only
+
+- `id` (String) The ID of the Vault LDAP credential library.
+
+## Import
+
+Import is supported using the following syntax:
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
+```shell
+terraform import boundary_credential_library_vault_ldap.foo <my-id>
+```

docs/resources/credential_library_vault_ssh_certificate.md

@@ -107,6 +107,8 @@ resource "boundary_credential_library_vault_ssh_certificate" "baz" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_credential_library_vault_ssh_certificate.foo <my-id>
 ```

docs/resources/credential_password.md

@@ -0,0 +1,71 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_credential_password Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The password credential resource allows you to configure a credential using a password.
+---
+
+# boundary_credential_password (Resource)
+
+The password credential resource allows you to configure a credential using a password.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_static" "example" {
+  name        = "example_static_credential_store"
+  description = "My first static credential store!"
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_password" "example" {
+  name                = "example_password"
+  description         = "My first password credential!"
+  credential_store_id = boundary_credential_store_static.example.id
+  password            = "my-password"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `credential_store_id` (String) The credential store in which to save this password credential.
+- `password` (String, Sensitive) The password of this password credential.
+
+### Optional
+
+- `description` (String) The description of this password credential.
+- `name` (String) The name of this password credential. Defaults to the resource name.
+
+### Read-Only
+
+- `id` (String) The ID of this password credential.
+- `password_hmac` (String) The password hmac.
+
+## Import
+
+Import is supported using the following syntax:
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
+```shell
+terraform import boundary_credential_password.example <my-id>
+```

docs/resources/credential_ssh_private_key.md

@@ -69,6 +69,8 @@ resource "boundary_credential_ssh_private_key" "example" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_credential_ssh_private_key.example_ssh_private_key <my-id>
 ```

docs/resources/credential_store_static.md

@@ -55,6 +55,8 @@ resource "boundary_credential_store_static" "example" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_credential_store_static.example_static_credential_store <my-id>
 ```

docs/resources/credential_store_vault.md

@@ -68,6 +68,8 @@ resource "boundary_credential_store_vault" "example" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_credential_store_vault.foo <my-id>
 ```

docs/resources/credential_username_password.md

@@ -66,6 +66,8 @@ resource "boundary_credential_username_password" "example" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_credential_username_password.example_username_password <my-id>
 ```

docs/resources/credential_username_password_domain.md

@@ -0,0 +1,75 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_credential_username_password_domain Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The username-password-domain credential resource allows you to configure a credential using a username, password and domain.
+---
+
+# boundary_credential_username_password_domain (Resource)
+
+The username-password-domain credential resource allows you to configure a credential using a username, password and domain.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_static" "example" {
+  name        = "example_static_credential_store"
+  description = "My first static credential store!"
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_username_password_domain" "example" {
+  name                = "example_username_password_domain"
+  description         = "My first username password domain credential!"
+  credential_store_id = boundary_credential_store_static.example.id
+  username            = "my-username"
+  password            = "my-password"
+  domain              = "my-domain"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `credential_store_id` (String) The credential store in which to save this username-password-domain credential.
+- `password` (String, Sensitive) The password of this username-password-domain credential.
+
+### Optional
+
+- `description` (String) The description of this username-password-domain credential.
+- `domain` (String) The domain of this username-password-domain credential. This field is required unless provided as part of the username field instead (see username field description).
+- `name` (String) The name of this username-password-domain credential. Defaults to the resource name.
+- `username` (String) This field is required even though it is marked as optional. The username of this username-password-domain credential. Can also contain a domain if provided as username@domain or domain\username
+
+### Read-Only
+
+- `id` (String) The ID of this username-password-domain credential.
+- `password_hmac` (String) The password hmac.
+
+## Import
+
+Import is supported using the following syntax:
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
+```shell
+terraform import boundary_credential_username_password_domain.example_username_password_domain <my-id>
+```

docs/resources/host.md

@@ -66,6 +66,8 @@ resource "boundary_host" "example" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_host.foo <my-id>
 ```

docs/resources/host_catalog.md

@@ -57,6 +57,8 @@ resource "boundary_host_catalog" "example" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_host_catalog.foo <my-id>
 ```

docs/resources/host_catalog_plugin.md

@@ -94,6 +94,7 @@ resource "boundary_host_catalog_plugin" "azure_example" {
 - `plugin_name` (String) The name of the plugin that should back the resource. This or plugin_id must be defined.
 - `secrets_hmac` (String) The HMAC'd secrets value returned from the server.
 - `secrets_json` (String, Sensitive) The secrets for the host catalog. Either values encoded with the "jsonencode" function, pre-escaped JSON string, or a file:// or env:// path. Set to a string "null" to clear any existing values. NOTE: Unlike "attributes_json", removing this block will NOT clear secrets from the host catalog; this allows injecting secrets for one call, then removing them for storage.
+- `worker_filter` (String) HCP Only. A filter used to control which PKI workers can handle dynamic host catalog requests.
 
 ### Read-Only
 
@@ -103,6 +104,8 @@ resource "boundary_host_catalog_plugin" "azure_example" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_host_catalog_plugin.foo <my-id>
 ```

docs/resources/host_catalog_static.md

@@ -55,6 +55,8 @@ resource "boundary_host_catalog_static" "example" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_host_catalog_static.foo <my-id>
 ```

docs/resources/host_set.md

@@ -81,6 +81,8 @@ resource "boundary_host_set" "web" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_host_set.foo <my-id>
 ```

docs/resources/host_set_plugin.md

@@ -3,7 +3,7 @@
 page_title: "boundary_host_set_plugin Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The hostsetplugin resource allows you to configure a Boundary host set. Host sets are always part of a host catalog, so a host catalog resource should be used inline or you should have the host catalog ID in hand to successfully configure a host set.
+  The host_set_plugin resource allows you to configure a Boundary host set. Host sets are always part of a host catalog, so a host catalog resource should be used inline or you should have the host catalog ID in hand to successfully configure a host set.
 ---
 
 # boundary_host_set_plugin (Resource)
@@ -140,6 +140,8 @@ resource "boundary_host_set_plugin" "foodev" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_host_set_plugin.foo <my-id>
 ```

docs/resources/host_set_static.md

@@ -3,7 +3,7 @@
 page_title: "boundary_host_set_static Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The hostsetstatic resource allows you to configure a Boundary host set. Host sets are always part of a host catalog, so a host catalog resource should be used inline or you should have the host catalog ID in hand to successfully configure a host set.
+  The host_set_static resource allows you to configure a Boundary host set. Host sets are always part of a host catalog, so a host catalog resource should be used inline or you should have the host catalog ID in hand to successfully configure a host set.
 ---
 
 # boundary_host_set_static (Resource)
@@ -77,6 +77,8 @@ resource "boundary_host_set_static" "web" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_host_set_static.foo <my-id>
 ```

docs/resources/host_static.md

@@ -64,6 +64,8 @@ resource "boundary_host_static" "example" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_host_static.foo <my-id>
 ```

docs/resources/managed_group_ldap.md

@@ -64,6 +64,8 @@ resource "boundary_managed_group_ldap" "forumsys_scientists" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_managed_group_ldap.foo <my-id>
 ```

docs/resources/role.md

@@ -127,7 +127,6 @@ resource "boundary_role" "readonly" {
 ### Optional
 
 - `description` (String) The role description.
-- `grant_scope_id` (String, Deprecated) For Boundary 0.15+, use `grant_scope_ids` instead. The scope for which the grants in the role should apply.
 - `grant_scope_ids` (Set of String) A list of scopes for which the grants in this role should apply, which can include the special values "this", "children", or "descendants"
 - `grant_strings` (Set of String) A list of stringified grants for the role.
 - `name` (String) The role name. Defaults to the resource name.

docs/resources/scope_alias_suffix.md

@@ -0,0 +1,67 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_scope_alias_suffix Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The scope alias suffix resource allows you to set an alias suffix for an org or project scope. Global scopes are not valid for alias suffix operations.
+---
+
+# boundary_scope_alias_suffix (Resource)
+
+The scope alias suffix resource allows you to set an alias suffix for an org or project scope. Global scopes are not valid for alias suffix operations.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "global" {
+  global_scope = true
+  scope_id     = "global"
+}
+
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = boundary_scope.global.id
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first project"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_scope_alias_suffix" "org_suffix" {
+  scope_id     = boundary_scope.org.id
+  alias_suffix = "org"
+}
+
+resource "boundary_scope_alias_suffix" "project_suffix" {
+  scope_id     = boundary_scope.project.id
+  alias_suffix = "projectone"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `alias_suffix` (String) The alias suffix value for this scope.
+- `scope_id` (String) The scope ID. Alias suffixes are supported for org and project scopes.
+
+### Read-Only
+
+- `id` (String) The ID of this resource.
+
+## Import
+
+Import is supported using the following syntax:
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
+```shell
+terraform import boundary_scope_alias_suffix.org_suffix <scope-id>
+```

docs/resources/storage_bucket.md

@@ -87,6 +87,8 @@ resource "boundary_storage_bucket" "aws_dynamic_credentials_example" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_storage_bucket.foo <my-id>
 ```

docs/resources/target.md

@@ -50,35 +50,30 @@ resource "boundary_credential_library_vault" "foo" {
   credential_type     = "username_password"
 }
 
-resource "boundary_host_catalog" "foo" {
+resource "boundary_host_catalog_static" "foo" {
   name        = "test"
   description = "test catalog"
   scope_id    = boundary_scope.project.id
-  type        = "static"
 }
 
-resource "boundary_host" "foo" {
-  type            = "static"
+resource "boundary_host_static" "foo" {
   name            = "foo"
-  host_catalog_id = boundary_host_catalog.foo.id
+  host_catalog_id = boundary_host_catalog_static.foo.id
   address         = "10.0.0.1"
 }
 
-resource "boundary_host" "bar" {
-  type            = "static"
+resource "boundary_host_static" "bar" {
   name            = "bar"
-  host_catalog_id = boundary_host_catalog.foo.id
+  host_catalog_id = boundary_host_catalog_static.foo.id
   address         = "10.0.0.1"
 }
 
-resource "boundary_host_set" "foo" {
-  type            = "static"
+resource "boundary_host_set_static" "foo" {
   name            = "foo"
-  host_catalog_id = boundary_host_catalog.foo.id
-
+  host_catalog_id = boundary_host_catalog_static.foo.id
   host_ids = [
-    boundary_host.foo.id,
-    boundary_host.bar.id,
+    boundary_host_static.foo.id,
+    boundary_host_static.bar.id,
   ]
 }
 
@@ -93,7 +88,7 @@ resource "boundary_storage_bucket" "aws_example" {
     "access_key_id"     = "aws_access_key_id_value",
     "secret_access_key" = "aws_secret_access_key_value"
   })
-  worker_filter = "\"pki\" in \"/tags/type\""
+  egress_worker_filter = "\"egress\" in \"/tags/type\""
 }
 
 resource "boundary_target" "foo" {
@@ -103,7 +98,7 @@ resource "boundary_target" "foo" {
   default_port = "22"
   scope_id     = boundary_scope.project.id
   host_source_ids = [
-    boundary_host_set.foo.id
+    boundary_host_set_static.foo.id
   ]
   brokered_credential_source_ids = [
     boundary_credential_library_vault.foo.id
@@ -112,12 +107,12 @@ resource "boundary_target" "foo" {
 
 resource "boundary_target" "ssh_foo" {
   name         = "ssh_foo"
-  description  = "Ssh target"
+  description  = "SSH target"
   type         = "ssh"
   default_port = "22"
   scope_id     = boundary_scope.project.id
   host_source_ids = [
-    boundary_host_set.foo.id
+    boundary_host_set_static.foo.id
   ]
   injected_application_credential_source_ids = [
     boundary_credential_library_vault.foo.id
@@ -126,12 +121,12 @@ resource "boundary_target" "ssh_foo" {
 
 resource "boundary_target" "ssh_session_recording_foo" {
   name         = "ssh_foo"
-  description  = "Ssh target"
+  description  = "SSH target"
   type         = "ssh"
   default_port = "22"
   scope_id     = boundary_scope.project.id
   host_source_ids = [
-    boundary_host_set.foo.id
+    boundary_host_set_static.foo.id
   ]
   injected_application_credential_source_ids = [
     boundary_credential_library_vault.foo.id
@@ -140,6 +135,21 @@ resource "boundary_target" "ssh_session_recording_foo" {
   storage_bucket_id        = boundary_storage_bucket.aws_example
 }
 
+resource "boundary_target" "rdp_foo" {
+  name         = "rdp_foo"
+  description  = "RDP target"
+  type         = "rdp"
+  default_port = "3389"
+  scope_id     = boundary_scope.project.id
+  host_source_ids = [
+    boundary_host_set_static.foo.id
+  ]
+  injected_application_credential_source_ids = [
+    boundary_credential_library_vault.foo.id
+  ]
+  egress_worker_filter = "\"egress\" in \"/tags/type\""
+}
+
 resource "boundary_target" "address_foo" {
   name         = "address_foo"
   description  = "Foo target with an address"
@@ -166,14 +176,14 @@ resource "boundary_target" "address_foo" {
 - `default_port` (Number) The default port for this target.
 - `description` (String) The target description.
 - `egress_worker_filter` (String) Boolean expression to filter the workers used to access this target
-- `enable_session_recording` (Boolean) HCP/Ent Only. Enable sessions recording for this target. Only applicable for SSH targets.
+- `enable_session_recording` (Boolean) HCP/Ent Only. Enable sessions recording for this target. Only applicable for SSH and RDP targets.
 - `host_source_ids` (Set of String) A list of host source ID's. Cannot be used alongside address.
 - `ingress_worker_filter` (String) HCP Only. Boolean expression to filter the workers a user will connect to when initiating a session against this target
 - `injected_application_credential_source_ids` (Set of String) A list of injected application credential source ID's.
 - `name` (String) The target name. Defaults to the resource name.
 - `session_connection_limit` (Number)
 - `session_max_seconds` (Number)
-- `storage_bucket_id` (String) HCP/Ent Only. Storage bucket for this target. Only applicable for SSH targets.
+- `storage_bucket_id` (String) HCP/Ent Only. Storage bucket for this target. Only applicable for SSH and RDP targets.
 - `worker_filter` (String, Deprecated) Boolean expression to filter the workers for this target
 
 ### Read-Only
@@ -184,6 +194,8 @@ resource "boundary_target" "address_foo" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_target.foo <my-id>
 ```

docs/resources/user.md

@@ -62,6 +62,8 @@ resource "boundary_user" "jeff" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_user.foo <my-id>
 ```

docs/resources/worker.md

@@ -1,5 +1,4 @@
 ---
-# generated by https://github.com/hashicorp/terraform-plugin-docs
 page_title: "boundary_worker Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
@@ -12,16 +11,22 @@ The resource allows you to create a self-managed worker object.
 
 ## Example Usage
 
+### Controller-led worker
+
 ```terraform
 resource "boundary_worker" "controller_led" {
   scope_id    = "global"
-  name        = "worker 1"
+  name        = "controller-led-worker-1"
   description = "self managed worker with controller led auth"
 }
+```
 
+### Worker-led worker
+
+```terraform
 resource "boundary_worker" "worker_led" {
   scope_id                    = "global"
-  name                        = "worker 2"
+  name                        = "worker-led-worker-1"
   description                 = "self managed worker with worker led auth"
   worker_generated_auth_token = var.worker_generated_auth_token
 }

examples/data-sources/boundary_role/data-source.tf

@@ -0,0 +1,15 @@
+# Role from the global scope
+data "boundary_role" "global_role" {
+  name = "global_role_one"
+}
+
+# Role from an org scope
+data "boundary_scope" "org" {
+  name     = "org_one"
+  scope_id = "global"
+}
+
+data "boundary_role" "org_role" {
+  name     = "org_role_one"
+  scope_id = data.boundary_scope.org.id
+}

examples/provider/provider.tf

@@ -1,19 +1,19 @@
 provider "boundary" {
-  addr                            = "http://127.0.0.1:9200"
-  auth_method_id                  = "ampw_1234567890" # changeme
-  password_auth_method_login_name = "myuser"          # changeme
-  password_auth_method_password   = "passpass"        # changeme
+  addr                   = "http://127.0.0.1:9200"
+  auth_method_id         = "ampw_1234567890" # changeme
+  auth_method_login_name = "myuser"          # changeme
+  auth_method_password   = "passpass"        # changeme
 }
 
 provider "boundary" {
-  addr                            = "http://127.0.0.1:9200"
-  password_auth_method_login_name = "myuser"
-  password_auth_method_password   = "passpass"
+  addr                   = "http://127.0.0.1:9200"
+  auth_method_login_name = "myuser"
+  auth_method_password   = "passpass"
 }
 
 provider "boundary" {
-  addr                            = "http://127.0.0.1:9200"
-  password_auth_method_login_name = "myuser"
-  password_auth_method_password   = "passpass"
-  scope_id                        = "s_1234567890"
+  addr                   = "http://127.0.0.1:9200"
+  auth_method_login_name = "myuser"
+  auth_method_password   = "passpass"
+  scope_id               = "s_1234567890"
 }

examples/resources/boundary_alias_target/import.sh

@@ -0,0 +1,2 @@
+terraform import boundary_alias_target.example_alias_target <my-id>
+terraform import boundary_alias_target.example_alias_target_project <my-id>

examples/resources/boundary_alias_target/resource.tf

@@ -0,0 +1,85 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_scope_alias_suffix" "org" {
+  scope_id     = boundary_scope.org.id
+  alias_suffix = "org"
+}
+
+resource "boundary_scope_alias_suffix" "project" {
+  scope_id     = boundary_scope.project.id
+  alias_suffix = "projectone"
+}
+
+resource "boundary_host_catalog_static" "foo" {
+  name        = "test"
+  description = "test catalog"
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_host_static" "foo" {
+  name            = "foo"
+  host_catalog_id = boundary_host_catalog_static.foo.id
+  address         = "10.0.0.1"
+}
+
+resource "boundary_host_static" "bar" {
+  name            = "bar"
+  host_catalog_id = boundary_host_catalog_static.foo.id
+  address         = "127.0.0.1"
+}
+
+resource "boundary_host_set_static" "foo" {
+  name            = "foo"
+  host_catalog_id = boundary_host_catalog_static.foo.id
+
+  host_ids = [
+    boundary_host_static.foo.id,
+    boundary_host_static.bar.id,
+  ]
+}
+
+resource "boundary_target" "foo" {
+  name         = "foo"
+  description  = "Foo target"
+  type         = "tcp"
+  default_port = "22"
+  scope_id     = boundary_scope.project.id
+  host_source_ids = [
+    boundary_host_set_static.foo.id,
+  ]
+}
+
+resource "boundary_alias_target" "example_alias_target" {
+  name                      = "example_alias_target"
+  description               = "Example alias to target foo using host boundary_host_static.bar"
+  scope_id                  = "global"
+  value                     = "example.bar.foo.boundary"
+  destination_id            = boundary_target.foo.id
+  authorize_session_host_id = boundary_host_static.bar.id
+}
+
+resource "boundary_alias_target" "example_alias_target_project" {
+  name                      = "example_alias_target_project"
+  description               = "Example project-scoped alias to target foo"
+  scope_id                  = boundary_scope.project.id
+  value                     = "prodops.projectone.org"
+  destination_id            = boundary_target.foo.id
+  authorize_session_host_id = boundary_host_static.bar.id
+  depends_on = [
+    boundary_scope_alias_suffix.org,
+    boundary_scope_alias_suffix.project,
+  ]
+}

examples/resources/boundary_auth_method/resource.tf

@@ -10,3 +10,9 @@ resource "boundary_auth_method" "password" {
   scope_id = boundary_scope.org.id
   type     = "password"
 }
+
+resource "boundary_auth_method" "password_is_primary" {
+  scope_id = boundary_scope.org.id
+  type     = "password"
+  is_primary_for_scope = true
+}

examples/resources/boundary_auth_method_password/import.sh

@@ -0,0 +1 @@
+terraform import boundary_auth_method_password.foo <my-id>

examples/resources/boundary_auth_method_password/resource.tf

@@ -0,0 +1,16 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_auth_method_password" "password" {
+  scope_id = boundary_scope.org.id
+}
+
+resource "boundary_auth_method_password" "password_is_primary" {
+  scope_id = boundary_scope.org.id
+  is_primary_for_scope = true
+}

examples/resources/boundary_credential_library_vault_ldap/import.sh

@@ -0,0 +1 @@
+terraform import boundary_credential_library_vault_ldap.foo <my-id>

examples/resources/boundary_credential_library_vault_ldap/resource.tf

@@ -0,0 +1,36 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_vault" "foo" {
+  name        = "foo"
+  description = "My first Vault credential store!"
+  address     = "http://127.0.0.1:8200"      # change to Vault address
+  token       = "s.0ufRo6XEGU2jOqnIr7OlFYP5" # change to valid Vault token
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_library_vault_ldap" "foo-static" {
+  name                = "foo"
+  description         = "My first static Vault LDAP credential library!"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "ldap/static-cred/foo" # change to Vault backend path
+}
+
+resource "boundary_credential_library_vault_ldap" "bar-dynamic" {
+  name                = "bar"
+  description         = "My first dynamic Vault LDAP credential library!"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "ldap/creds/bar" # change to Vault backend path
+}

examples/resources/boundary_credential_password/import.sh

@@ -0,0 +1 @@
+terraform import boundary_credential_password.example <my-id>

examples/resources/boundary_credential_password/resource.tf

@@ -0,0 +1,27 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_static" "example" {
+  name        = "example_static_credential_store"
+  description = "My first static credential store!"
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_password" "example" {
+  name                = "example_password"
+  description         = "My first password credential!"
+  credential_store_id = boundary_credential_store_static.example.id
+  password            = "my-password"
+}

examples/resources/boundary_credential_username_password_domain/import.sh

@@ -0,0 +1 @@
+terraform import boundary_credential_username_password_domain.example_username_password_domain <my-id>

examples/resources/boundary_credential_username_password_domain/resource.tf

@@ -0,0 +1,29 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_static" "example" {
+  name        = "example_static_credential_store"
+  description = "My first static credential store!"
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_username_password_domain" "example" {
+  name                = "example_username_password_domain"
+  description         = "My first username password domain credential!"
+  credential_store_id = boundary_credential_store_static.example.id
+  username            = "my-username"
+  password            = "my-password"
+  domain              = "my-domain"
+}

examples/resources/boundary_scope_alias_suffix/import.sh

@@ -0,0 +1 @@
+terraform import boundary_scope_alias_suffix.org_suffix <scope-id>

examples/resources/boundary_scope_alias_suffix/resource.tf

@@ -0,0 +1,29 @@
+resource "boundary_scope" "global" {
+  global_scope = true
+  scope_id     = "global"
+}
+
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = boundary_scope.global.id
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first project"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_scope_alias_suffix" "org_suffix" {
+  scope_id     = boundary_scope.org.id
+  alias_suffix = "org"
+}
+
+resource "boundary_scope_alias_suffix" "project_suffix" {
+  scope_id     = boundary_scope.project.id
+  alias_suffix = "projectone"
+}

examples/resources/boundary_target/resource.tf

@@ -35,35 +35,30 @@ resource "boundary_credential_library_vault" "foo" {
   credential_type     = "username_password"
 }
 
-resource "boundary_host_catalog" "foo" {
+resource "boundary_host_catalog_static" "foo" {
   name        = "test"
   description = "test catalog"
   scope_id    = boundary_scope.project.id
-  type        = "static"
 }
 
-resource "boundary_host" "foo" {
-  type            = "static"
+resource "boundary_host_static" "foo" {
   name            = "foo"
-  host_catalog_id = boundary_host_catalog.foo.id
+  host_catalog_id = boundary_host_catalog_static.foo.id
   address         = "10.0.0.1"
 }
 
-resource "boundary_host" "bar" {
-  type            = "static"
+resource "boundary_host_static" "bar" {
   name            = "bar"
-  host_catalog_id = boundary_host_catalog.foo.id
+  host_catalog_id = boundary_host_catalog_static.foo.id
   address         = "10.0.0.1"
 }
 
-resource "boundary_host_set" "foo" {
-  type            = "static"
+resource "boundary_host_set_static" "foo" {
   name            = "foo"
-  host_catalog_id = boundary_host_catalog.foo.id
-
+  host_catalog_id = boundary_host_catalog_static.foo.id
   host_ids = [
-    boundary_host.foo.id,
-    boundary_host.bar.id,
+    boundary_host_static.foo.id,
+    boundary_host_static.bar.id,
   ]
 }
 
@@ -78,7 +73,7 @@ resource "boundary_storage_bucket" "aws_example" {
     "access_key_id"     = "aws_access_key_id_value",
     "secret_access_key" = "aws_secret_access_key_value"
   })
-  worker_filter = "\"pki\" in \"/tags/type\""
+  egress_worker_filter = "\"egress\" in \"/tags/type\""
 }
 
 resource "boundary_target" "foo" {
@@ -88,7 +83,7 @@ resource "boundary_target" "foo" {
   default_port = "22"
   scope_id     = boundary_scope.project.id
   host_source_ids = [
-    boundary_host_set.foo.id
+    boundary_host_set_static.foo.id
   ]
   brokered_credential_source_ids = [
     boundary_credential_library_vault.foo.id
@@ -97,12 +92,12 @@ resource "boundary_target" "foo" {
 
 resource "boundary_target" "ssh_foo" {
   name         = "ssh_foo"
-  description  = "Ssh target"
+  description  = "SSH target"
   type         = "ssh"
   default_port = "22"
   scope_id     = boundary_scope.project.id
   host_source_ids = [
-    boundary_host_set.foo.id
+    boundary_host_set_static.foo.id
   ]
   injected_application_credential_source_ids = [
     boundary_credential_library_vault.foo.id
@@ -111,12 +106,12 @@ resource "boundary_target" "ssh_foo" {
 
 resource "boundary_target" "ssh_session_recording_foo" {
   name         = "ssh_foo"
-  description  = "Ssh target"
+  description  = "SSH target"
   type         = "ssh"
   default_port = "22"
   scope_id     = boundary_scope.project.id
   host_source_ids = [
-    boundary_host_set.foo.id
+    boundary_host_set_static.foo.id
   ]
   injected_application_credential_source_ids = [
     boundary_credential_library_vault.foo.id
@@ -125,6 +120,21 @@ resource "boundary_target" "ssh_session_recording_foo" {
   storage_bucket_id        = boundary_storage_bucket.aws_example
 }
 
+resource "boundary_target" "rdp_foo" {
+  name         = "rdp_foo"
+  description  = "RDP target"
+  type         = "rdp"
+  default_port = "3389"
+  scope_id     = boundary_scope.project.id
+  host_source_ids = [
+    boundary_host_set_static.foo.id
+  ]
+  injected_application_credential_source_ids = [
+    boundary_credential_library_vault.foo.id
+  ]
+  egress_worker_filter = "\"egress\" in \"/tags/type\""
+}
+
 resource "boundary_target" "address_foo" {
   name         = "address_foo"
   description  = "Foo target with an address"

examples/resources/boundary_worker/controller_led.tf

@@ -0,0 +1,5 @@
+resource "boundary_worker" "controller_led" {
+  scope_id    = "global"
+  name        = "controller-led-worker-1"
+  description = "self managed worker with controller led auth"
+}

examples/resources/boundary_worker/main.tf

@@ -1,13 +0,0 @@
-resource "boundary_worker" "controller_led" {
-  scope_id                    = "global"
-  name                        = "worker 1"
-  description                 = "self managed worker with controller-led auth"
-  worker_generated_auth_token = var.worker_generated_auth_token
-}
-
-resource "boundary_worker" "worker_led" {
-  scope_id                    = "global"
-  name                        = "worker 2"
-  description                 = "self managed worker with worker-led auth"
-  worker_generated_auth_token = var.worker_generated_auth_token
-}

examples/resources/boundary_worker/worker_led.tf

@@ -1,12 +1,6 @@
-resource "boundary_worker" "controller_led" {
-  scope_id    = "global"
-  name        = "worker 1"
-  description = "self managed worker with controller led auth"
-}
-
 resource "boundary_worker" "worker_led" {
   scope_id                    = "global"
-  name                        = "worker 2"
+  name                        = "worker-led-worker-1"
   description                 = "self managed worker with worker led auth"
   worker_generated_auth_token = var.worker_generated_auth_token
 }

go.mod

@@ -1,131 +1,135 @@
 module github.com/hashicorp/terraform-provider-boundary
 
-go 1.21.5
+go 1.26.4
 
 require (
-	github.com/YakDriver/regexache v0.23.0
-	github.com/hashicorp/boundary v0.15.0
-	github.com/hashicorp/boundary/api v0.0.46-0.20240209231500-1b1c8b3bf9a6
-	github.com/hashicorp/boundary/sdk v0.0.43-0.20240209231500-1b1c8b3bf9a6
-	github.com/hashicorp/cap v0.5.0
+	github.com/YakDriver/regexache v0.25.0
+	github.com/hashicorp/boundary v0.18.1-0.20260708165146-a1e2c87b8a14
+	github.com/hashicorp/boundary/api v0.0.62
+	github.com/hashicorp/boundary/sdk v0.0.60
+	github.com/hashicorp/cap v0.13.0
 	github.com/hashicorp/cap/ldap v0.0.0-20240206183135-ed8f24513744
-	github.com/hashicorp/go-cty v1.4.1-0.20200723130312-85980079f637
-	github.com/hashicorp/go-kms-wrapping/v2 v2.0.16
-	github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.11
-	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8
-	github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.6
-	github.com/hashicorp/terraform-plugin-docs v0.18.0
-	github.com/hashicorp/terraform-plugin-sdk/v2 v2.32.0
-	github.com/jimlambrt/gldap v0.1.9
+	github.com/hashicorp/go-cty v1.5.0
+	github.com/hashicorp/go-kms-wrapping/v2 v2.0.22
+	github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.13
+	github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0
+	github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.8
+	github.com/hashicorp/terraform-plugin-docs v0.25.0
+	github.com/hashicorp/terraform-plugin-sdk/v2 v2.40.1
+	github.com/jimlambrt/gldap v0.1.14
 	github.com/kr/pretty v0.3.1
 	github.com/mitchellh/go-homedir v1.1.0
-	github.com/stretchr/testify v1.8.4
-	golang.org/x/crypto v0.19.0
-	mvdan.cc/gofumpt v0.6.0
+	github.com/stretchr/testify v1.11.1
+	golang.org/x/crypto v0.54.0
+	mvdan.cc/gofumpt v0.10.0
 )
 
 require (
+	al.essio.dev/pkg/shellescape v1.5.1 // indirect
+	dario.cat/mergo v1.0.1 // indirect
 	github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 // indirect
-	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
-	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
-	github.com/DATA-DOG/go-sqlmock v1.5.0 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
+	github.com/Azure/go-ntlmssp v0.1.1 // indirect
+	github.com/BurntSushi/toml v1.4.0 // indirect
+	github.com/DATA-DOG/go-sqlmock v1.5.2 // indirect
 	github.com/Kunde21/markdownfmt/v3 v3.1.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
-	github.com/Masterminds/semver/v3 v3.2.0 // indirect
+	github.com/Masterminds/semver/v3 v3.4.0 // indirect
 	github.com/Masterminds/sprig/v3 v3.2.3 // indirect
-	github.com/Microsoft/go-winio v0.6.1 // indirect
+	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 // indirect
-	github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371 // indirect
+	github.com/ProtonMail/go-crypto v1.4.1 // indirect
 	github.com/agext/levenshtein v1.2.2 // indirect
-	github.com/alessio/shellescape v1.4.1 // indirect
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
 	github.com/armon/go-radix v1.0.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bgentry/speakeasy v0.1.0 // indirect
+	github.com/bmatcuk/doublestar/v4 v4.10.0 // indirect
 	github.com/cenkalti/backoff v2.2.1+incompatible // indirect
-	github.com/cenkalti/backoff/v3 v3.0.0 // indirect
-	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
-	github.com/cespare/xxhash/v2 v2.2.0 // indirect
-	github.com/cloudflare/circl v1.3.7 // indirect
-	github.com/containerd/continuity v0.3.0 // indirect
-	github.com/coreos/go-oidc/v3 v3.8.0 // indirect
-	github.com/danieljoos/wincred v1.2.0 // indirect
-	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/docker/cli v23.0.1+incompatible // indirect
-	github.com/docker/docker v24.0.7+incompatible // indirect
-	github.com/docker/go-connections v0.4.0 // indirect
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/cloudflare/circl v1.6.3 // indirect
+	github.com/containerd/continuity v0.4.5 // indirect
+	github.com/containerd/errdefs v1.0.0 // indirect
+	github.com/containerd/errdefs/pkg v0.3.0 // indirect
+	github.com/coreos/go-oidc/v3 v3.11.0 // indirect
+	github.com/danieljoos/wincred v1.2.2 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/distribution/reference v0.6.0 // indirect
+	github.com/docker/cli v29.2.0+incompatible // indirect
+	github.com/docker/go-connections v0.6.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/dvsekhvalnov/jose2go v1.5.1-0.20231206184617-48ba0b76bc88 // indirect
-	github.com/fatih/color v1.16.0 // indirect
+	github.com/dvsekhvalnov/jose2go v1.7.0 // indirect
+	github.com/fatih/color v1.18.0 // indirect
 	github.com/fatih/structs v1.1.0 // indirect
-	github.com/glebarez/go-sqlite v1.21.2 // indirect
-	github.com/glebarez/sqlite v1.9.0 // indirect
-	github.com/go-asn1-ber/asn1-ber v1.5.5 // indirect
-	github.com/go-jose/go-jose/v3 v3.0.1 // indirect
-	github.com/go-ldap/ldap/v3 v3.4.6 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/glebarez/go-sqlite v1.22.0 // indirect
+	github.com/glebarez/sqlite v1.11.0 // indirect
+	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
+	github.com/go-jose/go-jose/v3 v3.0.5 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
+	github.com/go-ldap/ldap/v3 v3.4.12 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/godbus/dbus/v5 v5.1.0 // indirect
-	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang-migrate/migrate/v4 v4.16.2 // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
-	github.com/google/go-cmp v0.6.0 // indirect
+	github.com/golang-migrate/migrate/v4 v4.19.1 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
-	github.com/google/uuid v1.4.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.18.0 // indirect
-	github.com/hashicorp/cli v1.1.6 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.8 // indirect
+	github.com/hashicorp/cli v1.1.7 // indirect
 	github.com/hashicorp/dbassert v0.0.0-20231012105025-1bc1bd88e22b // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
-	github.com/hashicorp/eventlogger v0.2.6-0.20231025104552-802587e608f0 // indirect
-	github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20231025104552-802587e608f0 // indirect
-	github.com/hashicorp/go-bexpr v0.1.13 // indirect
+	github.com/hashicorp/eventlogger v0.2.11 // indirect
+	github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20231208142215-efdb51ec090d // indirect
+	github.com/hashicorp/go-bexpr v0.1.15 // indirect
 	github.com/hashicorp/go-checkpoint v0.5.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-dbw v0.1.1 // indirect
-	github.com/hashicorp/go-hclog v1.5.0 // indirect
-	github.com/hashicorp/go-kms-wrapping/extras/kms/v2 v2.0.0-20231124110655-4315424d22d0 // indirect
-	github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.5 // indirect
+	github.com/hashicorp/go-dbw v0.1.5 // indirect
+	github.com/hashicorp/go-hclog v1.6.3 // indirect
+	github.com/hashicorp/go-kms-wrapping/extras/kms/v2 v2.0.0-20241126174344-f3b1a41a15fd // indirect
+	github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.9 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/hashicorp/go-plugin v1.6.0 // indirect
+	github.com/hashicorp/go-plugin v1.7.0 // indirect
 	github.com/hashicorp/go-rate v0.0.0-20231204194614-cc8d401f70ab // indirect
-	github.com/hashicorp/go-retryablehttp v0.7.4 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
 	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
 	github.com/hashicorp/go-secure-stdlib/base62 v0.1.2 // indirect
 	github.com/hashicorp/go-secure-stdlib/gatedwriter v0.1.1 // indirect
 	github.com/hashicorp/go-secure-stdlib/kv-builder v0.1.2 // indirect
-	github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.9 // indirect
+	github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.10 // indirect
 	github.com/hashicorp/go-secure-stdlib/mlock v0.1.3 // indirect
+	github.com/hashicorp/go-secure-stdlib/permitpool v1.0.0 // indirect
 	github.com/hashicorp/go-secure-stdlib/reloadutil v0.1.1 // indirect
 	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
 	github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.3 // indirect
-	github.com/hashicorp/go-sockaddr v1.0.5 // indirect
+	github.com/hashicorp/go-sockaddr v1.0.7 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
-	github.com/hashicorp/go-version v1.6.0 // indirect
-	github.com/hashicorp/hc-install v0.6.2 // indirect
-	github.com/hashicorp/hcl v1.0.0 // indirect
-	github.com/hashicorp/hcl/v2 v2.19.1 // indirect
+	github.com/hashicorp/go-version v1.9.0 // indirect
+	github.com/hashicorp/hc-install v0.9.4 // indirect
+	github.com/hashicorp/hcl v1.0.1-vault-7 // indirect
+	github.com/hashicorp/hcl/v2 v2.24.0 // indirect
 	github.com/hashicorp/logutils v1.0.0 // indirect
-	github.com/hashicorp/nodeenrollment v0.2.9 // indirect
-	github.com/hashicorp/terraform-exec v0.20.0 // indirect
-	github.com/hashicorp/terraform-json v0.21.0 // indirect
-	github.com/hashicorp/terraform-plugin-go v0.21.0 // indirect
-	github.com/hashicorp/terraform-plugin-log v0.9.0 // indirect
-	github.com/hashicorp/terraform-registry-address v0.2.3 // indirect
+	github.com/hashicorp/nodeenrollment v0.2.15 // indirect
+	github.com/hashicorp/terraform-exec v0.25.1 // indirect
+	github.com/hashicorp/terraform-json v0.27.3-0.20260213134036-298b8f6b673a // indirect
+	github.com/hashicorp/terraform-plugin-go v0.31.0 // indirect
+	github.com/hashicorp/terraform-plugin-log v0.10.0 // indirect
+	github.com/hashicorp/terraform-registry-address v0.4.0 // indirect
 	github.com/hashicorp/terraform-svchost v0.1.1 // indirect
-	github.com/hashicorp/vault/api v1.10.0 // indirect
-	github.com/hashicorp/vault/sdk v0.3.0 // indirect
-	github.com/hashicorp/yamux v0.1.1 // indirect
+	github.com/hashicorp/vault/api v1.22.0 // indirect
+	github.com/hashicorp/vault/sdk v0.11.0 // indirect
+	github.com/hashicorp/yamux v0.1.2 // indirect
 	github.com/huandu/xstrings v1.4.0 // indirect
-	github.com/imdario/mergo v0.3.15 // indirect
-	github.com/jackc/chunkreader/v2 v2.0.1 // indirect
-	github.com/jackc/pgconn v1.14.1 // indirect
-	github.com/jackc/pgio v1.0.0 // indirect
+	github.com/imdario/mergo v0.3.16 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
-	github.com/jackc/pgproto3/v2 v2.3.2 // indirect
-	github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
-	github.com/jackc/pgtype v1.14.0 // indirect
-	github.com/jackc/pgx/v4 v4.18.1 // indirect
-	github.com/jackc/pgx/v5 v5.4.3 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
+	github.com/jackc/pgx/v5 v5.9.2 // indirect
+	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/jefferai/go-libsecret v0.0.0-20210525195240-b53481abef97 // indirect
 	github.com/jefferai/isbadcipher v0.0.0-20190226160619-51d2077c035f // indirect
 	github.com/jefferai/keyring v1.1.7-0.20220316160357-58a74bb55891 // indirect
@@ -133,12 +137,11 @@ require (
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
 	github.com/kr/text v0.2.0 // indirect
-	github.com/lib/pq v1.10.9 // indirect
-	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/lib/pq v1.11.2 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-runewidth v0.0.9 // indirect
 	github.com/mattn/go-sqlite3 v2.0.3+incompatible // indirect
-	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
 	github.com/mikesmitty/edkey v0.0.0-20170222072505-3356ea4e686a // indirect
 	github.com/mitchellh/cli v1.1.5 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
@@ -147,65 +150,77 @@ require (
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/mitchellh/pointerstructure v1.2.1 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
-	github.com/moby/term v0.5.0 // indirect
+	github.com/moby/docker-image-spec v1.3.1 // indirect
+	github.com/moby/moby/api v1.53.0 // indirect
+	github.com/moby/moby/client v0.2.2 // indirect
+	github.com/moby/sys/user v0.4.0 // indirect
+	github.com/moby/term v0.5.2 // indirect
 	github.com/mr-tron/base58 v1.2.0 // indirect
 	github.com/mtibben/percent v0.2.1 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/ncruces/go-strftime v0.1.9 // indirect
 	github.com/oklog/run v1.1.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.0.2 // indirect
-	github.com/opencontainers/runc v1.1.12 // indirect
-	github.com/ory/dockertest/v3 v3.10.0 // indirect
-	github.com/pires/go-proxyproto v0.7.0 // indirect
-	github.com/pkg/errors v0.9.1 // indirect
-	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
+	github.com/opencontainers/runc v1.3.6 // indirect
+	github.com/ory/dockertest/v3 v3.12.0 // indirect
+	github.com/pires/go-proxyproto v0.11.0 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/posener/complete v1.2.3 // indirect
-	github.com/prometheus/client_golang v1.17.0 // indirect
-	github.com/prometheus/client_model v0.4.1-0.20230718164431-9a2bf3000d16 // indirect
-	github.com/prometheus/common v0.44.0 // indirect
-	github.com/prometheus/procfs v0.11.1 // indirect
+	github.com/prometheus/client_golang v1.23.2 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.66.1 // indirect
+	github.com/prometheus/procfs v0.16.1 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
-	github.com/rogpeppe/go-internal v1.12.0 // indirect
-	github.com/russross/blackfriday v1.6.0 // indirect
+	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
-	github.com/sethvargo/go-diceware v0.3.0 // indirect
+	github.com/sethvargo/go-diceware v0.5.0 // indirect
 	github.com/shopspring/decimal v1.3.1 // indirect
-	github.com/sirupsen/logrus v1.9.2 // indirect
-	github.com/spf13/cast v1.5.0 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/spf13/cast v1.6.0 // indirect
 	github.com/vmihailenco/msgpack v4.0.4+incompatible // indirect
 	github.com/vmihailenco/msgpack/v5 v5.4.1 // indirect
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
-	github.com/xo/dburl v0.16.0 // indirect
-	github.com/yuin/goldmark v1.6.0 // indirect
+	github.com/xo/dburl v0.23.7 // indirect
+	github.com/yuin/goldmark v1.7.7 // indirect
 	github.com/yuin/goldmark-meta v1.1.0 // indirect
-	github.com/zalando/go-keyring v0.2.3 // indirect
-	github.com/zclconf/go-cty v1.14.2 // indirect
+	github.com/zalando/go-keyring v0.2.6 // indirect
+	github.com/zclconf/go-cty v1.18.1 // indirect
+	go.abhg.dev/goldmark/frontmatter v0.2.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
+	go.opentelemetry.io/otel v1.43.0 // indirect
+	go.opentelemetry.io/otel/metric v1.43.0 // indirect
+	go.opentelemetry.io/otel/trace v1.43.0 // indirect
 	go.uber.org/atomic v1.11.0 // indirect
-	golang.org/x/exp v0.0.0-20231006140011-7918f672742d // indirect
-	golang.org/x/mod v0.14.0 // indirect
-	golang.org/x/net v0.20.0 // indirect
-	golang.org/x/oauth2 v0.14.0 // indirect
-	golang.org/x/sync v0.6.0 // indirect
-	golang.org/x/sys v0.17.0 // indirect
-	golang.org/x/term v0.17.0 // indirect
-	golang.org/x/text v0.14.0 // indirect
-	golang.org/x/time v0.3.0 // indirect
-	golang.org/x/tools v0.17.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/exp v0.0.0-20250506013437-ce4c2cf36ca6 // indirect
+	golang.org/x/mod v0.37.0 // indirect
+	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/oauth2 v0.36.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/term v0.45.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
+	golang.org/x/time v0.14.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
 	google.golang.org/appengine v1.6.8 // indirect
-	google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20231106174013-bbf56f31fb17 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20231106174013-bbf56f31fb17 // indirect
-	google.golang.org/grpc v1.61.0 // indirect
-	google.golang.org/protobuf v1.32.0 // indirect
+	google.golang.org/genproto v0.0.0-20250603155806-513f23925822 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
+	google.golang.org/grpc v1.82.1 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	gorm.io/driver/postgres v1.5.4 // indirect
-	gorm.io/driver/sqlite v1.5.4 // indirect
-	gorm.io/gorm v1.25.5 // indirect
-	modernc.org/libc v1.22.5 // indirect
-	modernc.org/mathutil v1.5.0 // indirect
-	modernc.org/memory v1.5.0 // indirect
-	modernc.org/sqlite v1.23.1 // indirect
+	gorm.io/driver/postgres v1.6.0 // indirect
+	gorm.io/driver/sqlite v1.5.7 // indirect
+	gorm.io/gorm v1.25.12 // indirect
+	modernc.org/libc v1.41.0 // indirect
+	modernc.org/mathutil v1.6.0 // indirect
+	modernc.org/memory v1.7.2 // indirect
+	modernc.org/sqlite v1.28.0 // indirect
 )

internal/provider/const.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider
@@ -56,4 +56,8 @@ const (
 	ParentScopeIdKey = "parent_scope_id"
 	// GroupMemberIdsKey is used for common "member_ids" resource attribute
 	GroupMemberIdsKey = "member_ids"
+	// ValueKey is used for common "value" resource attribute
+	ValueKey = "value"
+	// DestinationIdKey is used for common "destination_id" resource attribute
+	DestinationIdKey = "destination_id"
 )

internal/provider/data_source_account.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider
@@ -86,7 +86,8 @@ func dataSourceAccountRead(ctx context.Context, d *schema.ResourceData, meta int
 	authMethodId := d.Get(AuthMethodIdKey).(string)
 
 	acl := accounts.NewClient(md.client)
-	accountsList, err := acl.List(ctx, authMethodId,
+	accountsList, err := acl.List(
+		ctx, authMethodId,
 		accounts.WithFilter(FilterWithItemNameMatches(name)),
 	)
 	if err != nil {

internal/provider/data_source_account_test.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider

internal/provider/data_source_auth_method.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider
@@ -87,7 +87,8 @@ func dataSourceAuthMethodRead(ctx context.Context, d *schema.ResourceData, meta
 	scopeId := d.Get(ScopeIdKey).(string)
 
 	amcl := authmethods.NewClient(md.client)
-	authMethodsList, err := amcl.List(ctx, scopeId,
+	authMethodsList, err := amcl.List(
+		ctx, scopeId,
 		authmethods.WithFilter(FilterWithItemNameMatches(name)),
 	)
 	if err != nil {

internal/provider/data_source_auth_method_test.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider

internal/provider/data_source_group.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider
@@ -88,7 +88,8 @@ func dataSourceGroupRead(ctx context.Context, d *schema.ResourceData, meta inter
 	scopeId := d.Get(ScopeIdKey).(string)
 
 	gcl := groups.NewClient(md.client)
-	groupsList, err := gcl.List(ctx, scopeId,
+	groupsList, err := gcl.List(
+		ctx, scopeId,
 		groups.WithFilter(FilterWithItemNameMatches(name)),
 	)
 	if err != nil {

internal/provider/data_source_group_test.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider

internal/provider/data_source_role.go

@@ -0,0 +1,163 @@
+// Copyright IBM Corp. 2020, 2026
+// SPDX-License-Identifier: MPL-2.0
+
+package provider
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/roles"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+)
+
+func dataSourceRole() *schema.Resource {
+	return &schema.Resource{
+		Description: "The boundary_role data source allows you to find a Boundary role.",
+		ReadContext: dataSourceRoleRead,
+
+		Schema: map[string]*schema.Schema{
+			NameKey: {
+				Description:  "The name of the role to retrieve.",
+				Type:         schema.TypeString,
+				Required:     true,
+				ValidateFunc: validation.StringIsNotEmpty,
+			},
+			ScopeIdKey: {
+				Description:  "The scope ID in which the resource is created. Defaults `global` if unset.",
+				Type:         schema.TypeString,
+				Optional:     true,
+				Default:      "global",
+				ValidateFunc: validation.StringIsNotEmpty,
+			},
+			IDKey: {
+				Description: "The ID of the retrieved role.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			DescriptionKey: {
+				Description: "The description of the retrieved role.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			ScopeKey: {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						IDKey: {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						NameKey: {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						TypeKey: {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						DescriptionKey: {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						ParentScopeIdKey: {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+					},
+				},
+			},
+			rolePrincipalIdsKey: {
+				Description: "The list of principal (user or group) IDs added as principals on the role.",
+				Type:        schema.TypeSet,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+				Computed:    true,
+			},
+			roleGrantStringsKey: {
+				Description: "The list of stringified grants for the role.",
+				Type:        schema.TypeSet,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+				Computed:    true,
+			},
+			roleGrantScopeIdsKey: {
+				Description: "The list of scope IDs for the role's grants.",
+				Type:        schema.TypeSet,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+				Computed:    true,
+			},
+		},
+	}
+}
+
+func dataSourceRoleRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+
+	name := d.Get(NameKey).(string)
+	scopeId := d.Get(ScopeIdKey).(string)
+
+	rcl := roles.NewClient(md.client)
+	rolesList, err := rcl.List(
+		ctx, scopeId,
+		roles.WithFilter(FilterWithItemNameMatches(name)),
+	)
+	if err != nil {
+		return diag.Errorf("error calling list role: %v", err)
+	}
+	roles := rolesList.GetItems()
+	if roles == nil {
+		return diag.Errorf("no roles found")
+	}
+	if len(roles) == 0 {
+		return diag.Errorf("no matching role found")
+	}
+	if len(roles) > 1 {
+		return diag.Errorf("error found more than 1 role")
+	}
+
+	rrr, err := rcl.Read(ctx, roles[0].Id)
+	if err != nil {
+		if apiErr := api.AsServerError(err); apiErr != nil && apiErr.Response().StatusCode() == http.StatusNotFound {
+			d.SetId("")
+			return nil
+		}
+		return diag.Errorf("error calling read role: %v", err)
+	}
+	if rrr == nil {
+		return diag.Errorf("role nil after read")
+	}
+
+	if err := setFromRoleRead(d, *rrr.Item); err != nil {
+		return diag.FromErr(err)
+	}
+
+	return nil
+}
+
+func setFromRoleRead(d *schema.ResourceData, role roles.Role) error {
+	if err := d.Set(NameKey, role.Name); err != nil {
+		return err
+	}
+	if err := d.Set(DescriptionKey, role.Description); err != nil {
+		return err
+	}
+	if err := d.Set(ScopeIdKey, role.ScopeId); err != nil {
+		return err
+	}
+	if err := d.Set(roleGrantStringsKey, role.GrantStrings); err != nil {
+		return err
+	}
+	if err := d.Set(roleGrantScopeIdsKey, role.GrantScopeIds); err != nil {
+		return err
+	}
+	if err := d.Set(rolePrincipalIdsKey, role.PrincipalIds); err != nil {
+		return err
+	}
+
+	d.Set(ScopeKey, flattenScopeInfo(role.Scope))
+	d.SetId(role.Id)
+	return nil
+}

internal/provider/data_source_role_test.go

@@ -0,0 +1,126 @@
+// Copyright IBM Corp. 2020, 2026
+// SPDX-License-Identifier: MPL-2.0
+
+package provider
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+const (
+	testRoleName = "my_role"
+)
+
+var roleReadGlobal = fmt.Sprintf(`
+resource "boundary_user" "user" {
+  name     = "my_user"
+  scope_id    = "global"
+}
+
+resource "boundary_role" "role" {
+  name        = "%s"
+  description = "test role global"
+  scope_id    = "global"
+  grant_strings = [
+    "ids=*;type=*;actions=read"
+  ]
+  principal_ids = [ boundary_user.user.id ]
+}
+
+data "boundary_role" "role" {
+  depends_on = [ boundary_role.role ]
+  name       = "%s"
+}
+`, testRoleName, testRoleName)
+
+var roleReadOrg = fmt.Sprintf(`
+resource "boundary_user" "user" {
+  name     = "my_user"
+  scope_id    = "global"
+}
+
+resource "boundary_role" "role" {
+  name        = "%s"
+  description = "test role org"
+  scope_id    = boundary_scope.org1.id
+  grant_strings = [
+    "ids=*;type=*;actions=read"
+  ]
+  principal_ids = [ boundary_user.user.id ]
+}
+
+data "boundary_role" "role" {
+  depends_on = [ boundary_role.role ]
+  name       = "%s"
+  scope_id   = boundary_scope.org1.id
+}
+`, testRoleName, testRoleName)
+
+func TestAccRoleReadGlobal(t *testing.T) {
+	tc := controller.NewTestController(t, tcConfig...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	dataSourceName := "data.boundary_role.role"
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		ProviderFactories: providerFactories(&provider),
+		Steps: []resource.TestStep{
+			{
+				Config: testConfig(url, roleReadGlobal),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrSet(dataSourceName, IDKey),
+					resource.TestCheckResourceAttrSet(dataSourceName, ScopeIdKey),
+					resource.TestCheckResourceAttr(dataSourceName, NameKey, testRoleName),
+					resource.TestCheckResourceAttrSet(dataSourceName, DescriptionKey),
+					resource.TestCheckResourceAttr(dataSourceName, fmt.Sprintf("%s.#", roleGrantStringsKey), "1"),
+					resource.TestCheckResourceAttr(dataSourceName, fmt.Sprintf("%s.0", roleGrantStringsKey), "ids=*;type=*;actions=read"),
+					resource.TestCheckResourceAttr(dataSourceName, fmt.Sprintf("%s.#", roleGrantScopeIdsKey), "1"),
+					resource.TestCheckResourceAttrSet(dataSourceName, "scope.0.id"),
+					resource.TestCheckResourceAttr(dataSourceName, "scope.0.name", "global"),
+					resource.TestCheckResourceAttr(dataSourceName, "scope.0.type", "global"),
+					resource.TestCheckResourceAttr(dataSourceName, fmt.Sprintf("%s.#", rolePrincipalIdsKey), "1"),
+					resource.TestCheckResourceAttrPair(dataSourceName, fmt.Sprintf("%s.0", rolePrincipalIdsKey), "boundary_user.user", "id"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccRoleReadOrg(t *testing.T) {
+	tc := controller.NewTestController(t, tcConfig...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	dataSourceName := "data.boundary_role.role"
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		ProviderFactories: providerFactories(&provider),
+		Steps: []resource.TestStep{
+			{
+				Config: testConfig(url, fooOrg, roleReadOrg),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrSet(dataSourceName, IDKey),
+					resource.TestCheckResourceAttrSet(dataSourceName, ScopeIdKey),
+					resource.TestCheckResourceAttr(dataSourceName, NameKey, testRoleName),
+					resource.TestCheckResourceAttrSet(dataSourceName, DescriptionKey),
+					resource.TestCheckResourceAttr(dataSourceName, fmt.Sprintf("%s.#", roleGrantStringsKey), "1"),
+					resource.TestCheckResourceAttr(dataSourceName, fmt.Sprintf("%s.0", roleGrantStringsKey), "ids=*;type=*;actions=read"),
+					resource.TestCheckResourceAttr(dataSourceName, fmt.Sprintf("%s.#", roleGrantScopeIdsKey), "1"),
+					resource.TestCheckResourceAttrSet(dataSourceName, "scope.0.id"),
+					resource.TestCheckResourceAttr(dataSourceName, "scope.0.name", "org1"),
+					resource.TestCheckResourceAttr(dataSourceName, "scope.0.type", "org"),
+					resource.TestCheckResourceAttr(dataSourceName, fmt.Sprintf("%s.#", rolePrincipalIdsKey), "1"),
+					resource.TestCheckResourceAttrPair(dataSourceName, fmt.Sprintf("%s.0", rolePrincipalIdsKey), "boundary_user.user", "id"),
+				),
+			},
+		},
+	})
+}

internal/provider/data_source_scope.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider

internal/provider/data_source_scope_test.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider

internal/provider/data_source_user.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider

internal/provider/data_source_user_test.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider
@@ -83,7 +83,7 @@ func TestAccUserDataSource_globalAdminUser(t *testing.T) {
 					resource.TestCheckResourceAttr(dataSourceName, LoginNameKey, "testuser"),
 					resource.TestMatchResourceAttr(dataSourceName, IDKey, regexache.MustCompile(`^u_.+`)),
 					resource.TestMatchResourceAttr(dataSourceName, PrimaryAccountIdKey, regexache.MustCompile(`^acctpw_.+`)),
-					resource.TestCheckResourceAttr(dataSourceName, "authorized_actions.#", "7"),
+					resource.TestCheckResourceAttr(dataSourceName, "authorized_actions.#", "8"),
 					resource.TestCheckResourceAttr(dataSourceName, "scope.0.name", "global"),
 					resource.TestCheckResourceAttr(dataSourceName, "scope.0.id", "global"),
 					resource.TestCheckResourceAttr(dataSourceName, "scope.0.type", "global"),

internal/provider/filter.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider

internal/provider/pathorcontents.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 // Helpers for dealing with file paths and their contents

internal/provider/provider.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider
@@ -98,15 +98,19 @@ func New() *schema.Provider {
 			"boundary_account_password":                         resourceAccountPassword(),
 			"boundary_account_oidc":                             resourceAccountOidc(),
 			"boundary_account_ldap":                             resourceAccountLdap(),
+			"boundary_alias_target":                             resourceAliasTarget(),
 			"boundary_auth_method":                              resourceAuthMethod(),
 			"boundary_auth_method_password":                     resourceAuthMethodPassword(),
 			"boundary_auth_method_oidc":                         resourceAuthMethodOidc(),
 			"boundary_auth_method_ldap":                         resourceAuthMethodLdap(),
 			"boundary_credential_library_vault":                 resourceCredentialLibraryVault(),
 			"boundary_credential_library_vault_ssh_certificate": resourceCredentialLibraryVaultSshCertificate(),
+			"boundary_credential_library_vault_ldap":            resourceCredentialLibraryVaultLdap(),
 			"boundary_credential_store_vault":                   resourceCredentialStoreVault(),
 			"boundary_credential_store_static":                  resourceCredentialStoreStatic(),
 			"boundary_credential_username_password":             resourceCredentialUsernamePassword(),
+			"boundary_credential_username_password_domain":      resourceCredentialUsernamePasswordDomain(),
+			"boundary_credential_password":                      resourceCredentialPassword(),
 			"boundary_credential_ssh_private_key":               resourceCredentialSshPrivateKey(),
 			"boundary_credential_json":                          resourceCredentialJson(),
 			"boundary_managed_group":                            resourceManagedGroup(),
@@ -121,6 +125,7 @@ func New() *schema.Provider {
 			"boundary_host_set_static":                          resourceHostSetStatic(),
 			"boundary_host_set_plugin":                          resourceHostSetPlugin(),
 			"boundary_policy_storage":                           resourcePolicyStorage(),
+			"boundary_scope_alias_suffix":                       resourceScopeAliasSuffix(),
 			"boundary_scope_policy_attachment":                  resourceScopePolicyAttachment(),
 			"boundary_role":                                     resourceRole(),
 			"boundary_scope":                                    resourceScope(),
@@ -135,6 +140,7 @@ func New() *schema.Provider {
 			"boundary_group":       dataSourceGroup(),
 			"boundary_scope":       dataSourceScope(),
 			"boundary_user":        dataSourceUser(),
+			"boundary_role":        dataSourceRole(),
 		},
 	}
 
@@ -199,7 +205,8 @@ func providerAuthenticate(ctx context.Context, d *schema.ResourceData, md *metaD
 			ctx,
 			recoveryHclStr,
 			"recovery",
-			configutil.WithPluginOptions(opts...))
+			configutil.WithPluginOptions(opts...),
+		)
 		if err != nil {
 			return fmt.Errorf(`error reading wrappers from "recovery_kms_hcl": %v`, err)
 		}

internal/provider/provider_test.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider
@@ -106,6 +106,19 @@ provider "boundary" {
 
 func testConfigWithDefaultAuthMethod(url string, res ...string) string {
 	provider := fmt.Sprintf(`
+provider "boundary" {
+	addr  = "%s"
+	auth_method_login_name = "%s"
+	auth_method_password = "%s"
+}`, url, tcLoginName, tcPassword)
+
+	c := []string{provider}
+	c = append(c, res...)
+	return strings.Join(c, "\n")
+}
+
+func testConfigWithDeprecatedAuthMethod(url string, res ...string) string {
+	provider := fmt.Sprintf(`
 provider "boundary" {
 	addr  = "%s"
 	password_auth_method_login_name = "%s"
@@ -256,6 +269,28 @@ func TestConfigWithDefaultAuthMethod(t *testing.T) {
 	})
 }
 
+func TestConfigWithDeprecatedAuthMethod(t *testing.T) {
+	tc := controller.NewTestController(t, tcConfig...)
+	defer tc.Shutdown()
+	url := tc.ApiAddrs()[0]
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		IsUnitTest:        true,
+		ProviderFactories: providerFactories(&provider),
+		CheckDestroy:      testAccCheckScopeResourceDestroy(t, provider),
+		Steps: []resource.TestStep{
+			{
+				Config: testConfigWithDeprecatedAuthMethod(url, fooOrg, firstProjectFoo, secondProject),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckScopeResourceExists(provider, "boundary_scope.org1"),
+					testProviderTokenExists(provider),
+				),
+			},
+		},
+	})
+}
+
 func TestConfigWithoutAMPWCredentials(t *testing.T) {
 	tc := controller.NewTestController(t, tcConfig...)
 	defer tc.Shutdown()
@@ -352,7 +387,8 @@ func testProviderTokenExists(testProvider *schema.Provider) resource.TestCheckFu
 }
 
 func createDefaultLdap(t *testing.T) *testdirectory.Directory {
-	td := testdirectory.Start(t,
+	td := testdirectory.Start(
+		t,
 		testdirectory.WithDefaults(t, &testdirectory.Defaults{AllowAnonymousBind: true}),
 		testdirectory.WithNoTLS(t),
 	)
@@ -364,7 +400,8 @@ func createDefaultLdap(t *testing.T) *testdirectory.Directory {
 	users := testdirectory.NewUsers(t, []string{"alice"}, testdirectory.WithMembersOf(t, "admin"))
 
 	for _, u := range users {
-		u.Attributes = append(u.Attributes,
+		u.Attributes = append(
+			u.Attributes,
 			gldap.NewEntryAttribute(ldap.DefaultADUserPasswordAttribute, []string{"password"}),
 			gldap.NewEntryAttribute(ldap.DefaultOpenLDAPUserPasswordAttribute, []string{"password"}),
 			gldap.NewEntryAttribute("fullName", []string{"test-full-name"}),

internal/provider/resource_account.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider

internal/provider/resource_account_ldap.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider

internal/provider/resource_account_ldap_test.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider
@@ -92,7 +92,7 @@ resource "boundary_user" "alice" {
 
 resource "boundary_role" "ldap_principal" {
 	scope_id = boundary_scope.global.id
-	grant_scope_ids = [boundary_scope.global.id]
+	grant_scope_ids = ["this"]
 	grant_strings = ["ids=*;type=*;actions=*"]
 	principal_ids = [boundary_user.alice.id]
 }`

internal/provider/resource_account_oidc.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider

internal/provider/resource_account_oidc_test.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider

internal/provider/resource_account_password.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider

internal/provider/resource_account_password_test.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider

internal/provider/resource_account_test.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider

internal/provider/resource_alias_target.go

@@ -0,0 +1,297 @@
+// Copyright IBM Corp. 2020, 2026
+// SPDX-License-Identifier: MPL-2.0
+
+package provider
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/aliases"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+const (
+	aliasTypeTarget = "target"
+
+	aliasTargetAuthorizeSessionHostIdKey = "authorize_session_host_id"
+
+	globalScopeId      = "global"
+	orgScopePrefix     = "o_"
+	projectScopePrefix = "p_"
+)
+
+func resourceAliasTarget() *schema.Resource {
+	return &schema.Resource{
+		Description: "The target alias resource allows you to configure a Boundary target alias at project and global scopes.",
+
+		CreateContext: resourceTargetAliasCreate,
+		ReadContext:   resourceTargetAliasRead,
+		UpdateContext: resourceTargetAliasUpdate,
+		DeleteContext: resourceTargetAliasDelete,
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+
+		Schema: map[string]*schema.Schema{
+			IDKey: {
+				Description: "The ID of the account.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			NameKey: {
+				Description: "The alias name. Defaults to the resource name.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			DescriptionKey: {
+				Description: "The alias description.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+			ScopeIdKey: {
+				Description: "The scope ID. Org scopes are not supported for aliases.",
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+			},
+			ValueKey: {
+				Description: "The value of the alias.",
+				Type:        schema.TypeString,
+				Required:    true,
+			},
+			DestinationIdKey: {
+				Description: "The destination of the alias.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+
+			// Target specific configurable parameters
+			aliasTargetAuthorizeSessionHostIdKey: {
+				Description: "The host id to pass to Boundary when performing an authorize session action.",
+				Type:        schema.TypeString,
+				Optional:    true,
+			},
+
+			TypeKey: {
+				Description: "The type of alias; hardcoded.",
+				Type:        schema.TypeString,
+				Default:     aliasTypeTarget,
+				Optional:    true,
+			},
+		},
+	}
+}
+
+func setFromTargetAliasResponseMap(d *schema.ResourceData, raw map[string]interface{}) error {
+	if err := d.Set(NameKey, raw["name"]); err != nil {
+		return err
+	}
+	if err := d.Set(DescriptionKey, raw["description"]); err != nil {
+		return err
+	}
+	if err := d.Set(ScopeIdKey, raw["scope_id"]); err != nil {
+		return err
+	}
+	if err := d.Set(ValueKey, raw["value"]); err != nil {
+		return err
+	}
+	if err := d.Set(DestinationIdKey, raw["destination_id"]); err != nil {
+		return err
+	}
+	if err := d.Set(TypeKey, raw["type"]); err != nil {
+		return err
+	}
+
+	if attrsVal, ok := raw["attributes"]; ok {
+		attrs := attrsVal.(map[string]interface{})
+		tarAttrs, err := aliases.AttributesMapToTargetAliasAttributes(attrs)
+		if err != nil {
+			return err
+		}
+		if tarAttrs.AuthorizeSessionArguments != nil && tarAttrs.AuthorizeSessionArguments.HostId != "" {
+			if err := d.Set(aliasTargetAuthorizeSessionHostIdKey, tarAttrs.AuthorizeSessionArguments.HostId); err != nil {
+				return err
+			}
+		}
+	}
+
+	d.SetId(raw["id"].(string))
+
+	return nil
+}
+
+func resourceTargetAliasCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+
+	var scopeId string
+	if scopeIdVal, ok := d.GetOk(ScopeIdKey); ok {
+		scopeId = scopeIdVal.(string)
+	} else {
+		return diag.Errorf("no scope ID provided")
+	}
+
+	var typeStr string
+	if typeVal, ok := d.GetOk(TypeKey); ok {
+		typeStr = typeVal.(string)
+	} else {
+		return diag.Errorf("no type provided")
+	}
+
+	opts := []aliases.Option{}
+
+	if typeVal, ok := d.GetOk(ValueKey); ok {
+		opts = append(opts, aliases.WithValue(typeVal.(string)))
+	} else {
+		return diag.Errorf("no alias value provided")
+	}
+
+	if err := validateTargetAliasScope(scopeId); err != nil {
+		return diag.FromErr(err)
+	}
+
+	if nameVal, ok := d.GetOk(NameKey); ok {
+		opts = append(opts, aliases.WithName(nameVal.(string)))
+	}
+
+	if descVal, ok := d.GetOk(DescriptionKey); ok {
+		opts = append(opts, aliases.WithDescription(descVal.(string)))
+	}
+
+	if destVal, ok := d.GetOk(DestinationIdKey); ok {
+		opts = append(opts, aliases.WithDestinationId(destVal.(string)))
+	}
+
+	if hostIdVal, ok := d.GetOk(aliasTargetAuthorizeSessionHostIdKey); ok {
+		opts = append(opts, aliases.WithTargetAliasAuthorizeSessionArgumentsHostId(hostIdVal.(string)))
+	}
+
+	aliasClient := aliases.NewClient(md.client)
+
+	alcr, err := aliasClient.Create(ctx, typeStr, scopeId, opts...)
+	if err != nil {
+		return diag.Errorf("error creating alias: %v", err)
+	}
+	if alcr == nil {
+		return diag.Errorf("nil alias after create")
+	}
+
+	if err := setFromTargetAliasResponseMap(d, alcr.GetResponse().Map); err != nil {
+		return diag.FromErr(err)
+	}
+
+	return nil
+}
+
+func resourceTargetAliasRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	alClient := aliases.NewClient(md.client)
+
+	alrr, err := alClient.Read(ctx, d.Id())
+	if err != nil {
+		if apiErr := api.AsServerError(err); apiErr.Response().StatusCode() == http.StatusNotFound {
+			d.SetId("")
+			return nil
+		}
+		return diag.Errorf("error reading auth method: %v", err)
+	}
+	if alrr == nil {
+		return diag.Errorf("auth method nil after read")
+	}
+
+	if err := setFromTargetAliasResponseMap(d, alrr.GetResponse().Map); err != nil {
+		return diag.FromErr(err)
+	}
+	return nil
+}
+
+func resourceTargetAliasUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	alClient := aliases.NewClient(md.client)
+
+	opts := []aliases.Option{}
+
+	if d.HasChange(NameKey) {
+		opts = append(opts, aliases.DefaultName())
+		if nameVal, ok := d.GetOk(NameKey); ok {
+			opts = append(opts, aliases.WithName(nameVal.(string)))
+		}
+	}
+
+	if d.HasChange(DescriptionKey) {
+		opts = append(opts, aliases.DefaultDescription())
+		if descVal, ok := d.GetOk(DescriptionKey); ok {
+			opts = append(opts, aliases.WithDescription(descVal.(string)))
+		}
+	}
+
+	if d.HasChange(ValueKey) {
+		if valVal, ok := d.GetOk(ValueKey); ok {
+			aliasValue := valVal.(string)
+			scopeId := d.Get(ScopeIdKey).(string)
+			if err := validateTargetAliasScope(scopeId); err != nil {
+				return diag.FromErr(err)
+			}
+			opts = append(opts, aliases.WithValue(aliasValue))
+		} else {
+			return diag.Errorf("no value provided")
+		}
+	}
+
+	if d.HasChange(DestinationIdKey) {
+		opts = append(opts, aliases.DefaultDestinationId())
+		if destId, ok := d.GetOk(DestinationIdKey); ok {
+			opts = append(opts, aliases.WithDestinationId(destId.(string)))
+		}
+	}
+
+	if d.HasChange(aliasTargetAuthorizeSessionHostIdKey) {
+		opts = append(opts, aliases.DefaultTargetAliasAuthorizeSessionArgumentsHostId())
+		if authSessHostId, ok := d.GetOk(aliasTargetAuthorizeSessionHostIdKey); ok {
+			opts = append(opts, aliases.WithTargetAliasAuthorizeSessionArgumentsHostId(authSessHostId.(string)))
+		}
+	}
+
+	if len(opts) > 0 {
+		opts = append(opts, aliases.WithAutomaticVersioning(true))
+		alur, err := alClient.Update(ctx, d.Id(), 0, opts...)
+		if err != nil {
+			return diag.Errorf("error updating auth method: %v", err)
+		}
+
+		if err := setFromTargetAliasResponseMap(d, alur.GetResponse().Map); err != nil {
+			return diag.FromErr(err)
+		}
+		return nil
+	}
+	return nil
+}
+
+func resourceTargetAliasDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+	client := aliases.NewClient(md.client)
+
+	_, err := client.Delete(ctx, d.Id())
+	if err != nil {
+		return diag.Errorf("error deleting alias: %v", err)
+	}
+
+	return nil
+}
+
+func validateTargetAliasScope(scopeId string) error {
+	switch {
+	case scopeId == globalScopeId:
+		return nil
+	case strings.HasPrefix(scopeId, projectScopePrefix):
+		return nil
+	case strings.HasPrefix(scopeId, orgScopePrefix):
+		return fmt.Errorf("target aliases are not supported for org scopes; use a project or global scope ID")
+	default:
+		return fmt.Errorf("target aliases are supported only for project and global scopes")
+	}
+}