fix: default auth method with recovery kms (#405)

* fix bug with getting default auth method when recovery kms is used for provider authentication

* update changelog

.circleci/config.yml

@@ -0,0 +1,24 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+version: 2.1
+jobs:
+  build:
+    resource_class: large
+    machine:
+      image: 'ubuntu-2004:202107-02'
+    working_directory: ~/terraform-provider-watchtower
+    steps:
+    - checkout
+    - run:
+        name: "Install go"
+        command: |
+          unset GOPATH # ci image has done strange things with GOPATH, unset it so install-go can fix it
+          make install-go
+          source ~/.bashrc
+          go mod download
+    - run:
+        name: "Run Acceptance Tests"
+        command: |
+          source ~/.bashrc
+          make testacc-ci

.copywrite.hcl

@@ -10,7 +10,7 @@ project {
   # files or folders should be ignored
   # Default: []
   header_ignore = [
-    "examples/**/*.tf",
-    "examples/**/*.sh",
+    "examples/**.tf",
+    "examples/**.sh",
   ]
 }

.github/workflows/actionlint.yml

@@ -1,15 +0,0 @@
-name: Lint GitHub Actions workflows
-on: push
-
-permissions:
-  contents: read
-
-jobs:
-  actionlint:
-    runs-on: ${{ fromJSON(vars.RUNNER) }}
-    steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
-      - name: Check workflow files
-        uses: docker://docker.mirror.hashicorp.services/rhysd/actionlint@sha256:02ccb6d91e4cb4a7b21eb99d5274d257e81ae667688d730e89d7ea0d6d35db91
-        with:
-          args: -color

.github/workflows/jira.yml

@@ -9,9 +9,6 @@ on:
 
 name: Jira Sync
 
-permissions:
-  contents: read
-
 jobs:
   sync:
     runs-on: ubuntu-latest
@@ -21,19 +18,19 @@ jobs:
       if: github.event.action == 'opened'
       id: boundary-team-role
       run: |
-        TEAM="boundary"
+        TEAM=boundary
         ROLE="$(hub api orgs/hashicorp/teams/${TEAM}/memberships/${{ github.actor }} | jq -r '.role | select(.!=null)')"
-        if [[ -n "${ROLE}" ]]; then
+        if [[ -n ${ROLE} ]]; then
           echo "Actor ${{ github.actor }} is a ${TEAM} team member, skipping ticket creation"
         else
           echo "Actor ${{ github.actor }} is not a ${TEAM} team member"
         fi
-        echo "name=role::${ROLE}" >> "$GITHUB_OUTPUT"
+        echo "::set-output name=role::${ROLE}"
       env:
         GITHUB_TOKEN: ${{ secrets.JIRA_SYNC_GITHUB_TOKEN }}
 
     - name: Login
-      uses: atlassian/gajira-login@45fd029b9f1d6d8926c6f04175aa80c0e42c9026 # v3.0.1
+      uses: atlassian/gajira-login@v3.0.1
       env:
         JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
         JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
@@ -44,14 +41,14 @@ jobs:
       id: set-ticket-type
       run: |
         if [[ "${{ github.event_name }}" == "pull_request_target" ]]; then
-          echo "name=type::PR" >> "$GITHUB_OUTPUT"
+          echo "::set-output name=type::PR"
         else
-          echo "name=type::ISS" >> "$GITHUB_OUTPUT"
+          echo "::set-output name=type::ISS"
         fi
 
     - name: Create ticket
       if: github.event.action == 'opened' && !steps.boundary-team-role.outputs.role
-      uses: tomhjp/gh-action-jira-create@3ed1789cad3521292e591a7cfa703215ec1348bf # v0.2.1
+      uses: tomhjp/gh-action-jira-create@v0.2.0
       with:
         project: ICU
         issuetype: "GH Issue"
@@ -63,28 +60,28 @@ jobs:
     - name: Search
       if: github.event.action != 'opened'
       id: search
-      uses: tomhjp/gh-action-jira-search@04700b457f317c3e341ce90da5a3ff4ce058f2fa # v0.2.2
+      uses: tomhjp/gh-action-jira-search@v0.2.1
       with:
         # cf[10089] is Issue Link custom field
         jql: 'issuetype = "GH Issue" and cf[10089]="${{ github.event.issue.html_url || github.event.pull_request.html_url }}"'
 
     - name: Sync comment
       if: github.event.action == 'created' && steps.search.outputs.issue
-      uses: tomhjp/gh-action-jira-comment@6eb6b9ead70221916b6badd118c24535ed220bd9 # v0.2.0
+      uses: tomhjp/gh-action-jira-comment@v0.2.0
       with:
         issue: ${{ steps.search.outputs.issue }}
         comment: "${{ github.actor }} ${{ github.event.review.state || 'commented' }}:\n\n${{ github.event.comment.body || github.event.review.body }}\n\n${{ github.event.comment.html_url || github.event.review.html_url }}"
 
     - name: Close ticket
       if: (github.event.action == 'closed' || github.event.action == 'deleted') && steps.search.outputs.issue
-      uses: atlassian/gajira-transition@38fc9cd61b03d6a53dd35fcccda172fe04b36de3 # v3
+      uses: atlassian/gajira-transition@v3.0.1
       with:
         issue: ${{ steps.search.outputs.issue }}
         transition: Done
 
     - name: Reopen ticket
       if: github.event.action == 'reopened' && steps.search.outputs.issue
-      uses: atlassian/gajira-transition@38fc9cd61b03d6a53dd35fcccda172fe04b36de3 # v3
+      uses: atlassian/gajira-transition@v3.0.1
       with:
         issue: ${{ steps.search.outputs.issue }}
         transition: "To Do"

.github/workflows/release.yml

@@ -14,18 +14,18 @@ jobs:
     outputs:
       version: ${{ steps.go-version.outputs.version }}
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - uses: actions/checkout@v3
       - id: go-version
-        run: echo "name=version::$(cat ./.go-version)" >> "$GITHUB_OUTPUT"
+        run: echo "::set-output name=version::$(cat ./.go-version)"
   release-notes:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - uses: actions/checkout@v3
         with:
           fetch-depth: 0
       - name: Generate Release Notes
         run: sed -n -e "1{/# /d;}" -e "2{/^$/d;}" -e "/# $(git describe --abbrev=0 --exclude="$(git describe --abbrev=0 --match='v*.*.*' --tags)" --match='v*.*.*' --tags | tr -d v)/q;p" CHANGELOG.md > release-notes.txt
-      - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+      - uses: actions/upload-artifact@v3
         with:
           name: release-notes
           path: release-notes.txt

.github/workflows/test.yml

@@ -1,43 +0,0 @@
-name: test
-
-on:
-  - push
-  - workflow_dispatch
-  - workflow_call
-
-permissions:
-  contents: read
-
-jobs:
-  test:
-    runs-on: ${{ fromJSON(vars.RUNNER) }}
-    steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
-      - name: Determine go version
-        id: get-go-version
-        # We use .go-version as our source of truth for current Go
-        # version, because "goenv" can react to it automatically.
-        run: |
-          echo "Building with Go $(cat .go-version)"
-          echo "go-version=$(cat .go-version)" >> "$GITHUB_OUTPUT"
-      - name: Set up Go
-        uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
-        with:
-          go-version: "${{ steps.get-go-version.outputs.go-version }}"
-      - name: Determine Go cache paths
-        id: go-cache-paths
-        run: |
-          echo "go-build=$(go env GOCACHE)" >> "$GITHUB_OUTPUT"
-          echo "go-mod=$(go env GOMODCACHE)" >> "$GITHUB_OUTPUT"
-      - name: Set up Go modules cache
-        uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
-        with:
-          path: |
-            ${{ steps.go-cache-paths.outputs.go-build }}
-            ${{ steps.go-cache-paths.outputs.go-mod }}
-          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go
-      - name: Acceptance Tests
-        run: |
-          make testacc

.go-version

@@ -1 +1 @@
-1.20.5
+1.20

CHANGELOG.md

@@ -2,42 +2,11 @@
 
 Canonical reference for changes, improvements, and bugfixes for the Boundary Terraform provider.
 
-## 1.1.9 (July 19, 2023)
-
-### New and Improved
-
-* Add support for a storage bucket as a resource
-  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/417))
-* Add option to enable session recording on a target resource
-  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/421))
-* Update docs for host set plugin filters examples
-  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/420))  
-
-## 1.1.8 (June 13, 2023)
-
-### New and Improved
-
-* Add support for target default client port
-  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/379))
-* Add support for using ldap primary auth method
-  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/392))
-
-### Deprecations/Changes
-
-* Deprecate `password_auth_method_login_name` & `password_auth_method_password` for Terraform Provider.
-  `password_auth_method_login_name` & `password_auth_method_password` fields have been set to deprecated 
-  with a recommendation to use `auth_method_login_name` & `auth_method_password` fields instead.
-  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/392))
-* Deprecate type field for `boundary_account_password`
-  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/396))
-* Deprecate type field for `boundary_account_ldap`
-  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/400))
-
 ## 1.1.7 (May 12, 2023)
 
 ### Bug Fix
 * Fix default auth method with recovery kms
-  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/406))  
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/405))
 
 ## 1.1.6 (May 5, 2023)
 
@@ -62,13 +31,9 @@ Canonical reference for changes, improvements, and bugfixes for the Boundary Ter
 ## 1.1.4 (February 15, 2023)
 
 ### New and Improved
-
-* Add support for worker egress and ingress filters
-  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/319))
-* Add support for vault ssh certificate credential libraries
-  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/320))
-* Add support for targets with address configurations
-  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/308))
+* Add support for worker egress and ingress filters ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/319))
+* Add support for vault ssh certificate credential libraries ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/320))
+* Add support for targets with address configurations ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/308))
 
 ## 1.1.3 (November 29, 2022)
 

CODEOWNERS

@@ -1,4 +0,0 @@
-# These owners will be the default owners for everything in
-# the repo, unless a later match takes precedence.
-
-@hashicorp/boundary

Makefile

@@ -34,6 +34,15 @@ test:
 testacc:
 	TF_ACC=1 go test ./... -v $(TESTARGS) -timeout 120m
 
+testacc-ci:
+	git config --global --add url."git@github.com:".insteadOf "https://github.com/"
+	TF_ACC=1 ~/.go/bin/go test ./... -v $(TESTARGS) -timeout 120m
+
+install-go: ~/.go/bin/go
+
+~/.go/bin/go:
+	./ci/goinstall.sh
+
 dev:
 	GOOS=${GOOS} GOARCH=${GOARCH} ./scripts/plugins.sh
 	mkdir -p $(INSTALL_PATH)

ci/goinstall.sh

@@ -0,0 +1,121 @@
+#!/bin/bash
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+set -e
+
+VERSION="1.19.1"
+
+[ -z "$GOROOT" ] && GOROOT="$HOME/.go"
+[ -z "$GOPATH" ] && GOPATH="$HOME/go"
+
+OS="$(uname -s)"
+ARCH="$(uname -m)"
+
+case $OS in
+    "Linux")
+        case $ARCH in
+        "x86_64")
+            ARCH=amd64
+            ;;
+        "aarch64")
+            ARCH=arm64
+            ;;
+        "armv6")
+            ARCH=armv6l
+            ;;
+        "armv8")
+            ARCH=arm64
+            ;;
+        .*386.*)
+            ARCH=386
+            ;;
+        esac
+        PLATFORM="linux-$ARCH"
+    ;;
+    "Darwin")
+        PLATFORM="darwin-amd64"
+    ;;
+esac
+
+print_help() {
+    echo "Usage: bash goinstall.sh OPTIONS"
+    echo -e "\nOPTIONS:"
+    echo -e "  --remove\tRemove currently installed version"
+    echo -e "  --version\tSpecify a version number to install"
+}
+
+if [ -n "`$SHELL -c 'echo $ZSH_VERSION'`" ]; then
+    shell_profile="zshrc"
+elif [ -n "`$SHELL -c 'echo $BASH_VERSION'`" ]; then
+    shell_profile="bashrc"
+fi
+
+if [ "$1" == "--remove" ]; then
+    rm -rf "$GOROOT"
+    if [ "$OS" == "Darwin" ]; then
+        sed -i "" '/# GoLang/d' "$HOME/.${shell_profile}"
+        sed -i "" '/export GOROOT/d' "$HOME/.${shell_profile}"
+        sed -i "" '/$GOROOT\/bin/d' "$HOME/.${shell_profile}"
+        sed -i "" '/export GOPATH/d' "$HOME/.${shell_profile}"
+        sed -i "" '/$GOPATH\/bin/d' "$HOME/.${shell_profile}"
+    else
+        sed -i '/# GoLang/d' "$HOME/.${shell_profile}"
+        sed -i '/export GOROOT/d' "$HOME/.${shell_profile}"
+        sed -i '/$GOROOT\/bin/d' "$HOME/.${shell_profile}"
+        sed -i '/export GOPATH/d' "$HOME/.${shell_profile}"
+        sed -i '/$GOPATH\/bin/d' "$HOME/.${shell_profile}"
+    fi
+    echo "Go removed."
+    exit 0
+elif [ "$1" == "--help" ]; then
+    print_help
+    exit 0
+elif [ "$1" == "--version" ]; then
+    if [ -z "$2" ]; then # Check if --version has a second positional parameter
+        echo "Please provide a version number for: $1"
+    else
+        VERSION=$2
+    fi
+elif [ ! -z "$1" ]; then
+    echo "Unrecognized option: $1"
+    exit 1
+fi
+
+if [ -d "$GOROOT" ]; then
+    echo "The Go install directory ($GOROOT) already exists. Exiting."
+    exit 1
+fi
+
+PACKAGE_NAME="go$VERSION.$PLATFORM.tar.gz"
+TEMP_DIRECTORY=$(mktemp -d)
+
+echo "Downloading $PACKAGE_NAME ..."
+if hash wget 2>/dev/null; then
+    wget https://storage.googleapis.com/golang/$PACKAGE_NAME -O "$TEMP_DIRECTORY/go.tar.gz"
+else
+    curl -o "$TEMP_DIRECTORY/go.tar.gz" https://storage.googleapis.com/golang/$PACKAGE_NAME
+fi
+
+if [ $? -ne 0 ]; then
+    echo "Download failed! Exiting."
+    exit 1
+fi
+
+echo "Extracting File..."
+mkdir -p "$GOROOT"
+tar -C "$GOROOT" --strip-components=1 -xzf "$TEMP_DIRECTORY/go.tar.gz"
+touch "$HOME/.${shell_profile}"
+{
+    echo '# GoLang'
+    echo "export GOROOT=${GOROOT}"
+    echo 'export PATH=$GOROOT/bin:$PATH'
+    echo "export GOPATH=$GOPATH"
+    echo 'export PATH=$GOPATH/bin:$PATH'
+} >> "$HOME/.${shell_profile}"
+
+mkdir -p $GOPATH/{src,pkg,bin}
+echo -e "\nGo $VERSION was installed into $GOROOT.\nMake sure to relogin into your shell or run:"
+echo -e "\n\tsource $HOME/.${shell_profile}\n\nto update your environment variables."
+echo "Tip: Opening a new terminal window usually just works. :)"
+rm -f "$TEMP_DIRECTORY/go.tar.gz"

docs/index.md

@@ -44,11 +44,9 @@ provider "boundary" {
 
 ### Optional
 
-- `auth_method_id` (String) The auth method ID e.g. ampw_1234567890. If not set, the default auth method for the given scope ID will be used.
-- `auth_method_login_name` (String) The auth method login name for password-style or ldap-style auth methods
-- `auth_method_password` (String) The auth method password for password-style or ldap-style auth methods
-- `password_auth_method_login_name` (String, Deprecated) The auth method login name for password-style auth methods
-- `password_auth_method_password` (String, Deprecated) The auth method password for password-style auth methods
+- `auth_method_id` (String) The auth method ID e.g. ampw_1234567890
+- `password_auth_method_login_name` (String) The auth method login name for password-style auth methods
+- `password_auth_method_password` (String) The auth method password for password-style auth methods
 - `plugin_execution_dir` (String) Specifies a directory that the Boundary provider can use to write and execute its built-in plugins.
 - `recovery_kms_hcl` (String) Can be a heredoc string or a path on disk. If set, the string/file will be parsed as HCL and used with the recovery KMS mechanism. While this is set, it will override any other authentication information; the KMS mechanism will always be used. See Boundary's KMS docs for examples: https://boundaryproject.io/docs/configuration/kms
 - `scope_id` (String) The scope ID for the default auth method.

docs/resources/account_ldap.md

@@ -1,33 +0,0 @@
----
-# generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "boundary_account_ldap Resource - terraform-provider-boundary"
-subcategory: ""
-description: |-
-  The account resource allows you to configure a Boundary account.
----
-
-# boundary_account_ldap (Resource)
-
-The account resource allows you to configure a Boundary account.
-
-
-
-<!-- schema generated by tfplugindocs -->
-## Schema
-
-### Required
-
-- `auth_method_id` (String) The resource ID for the auth method.
-
-### Optional
-
-- `description` (String) The account description.
-- `login_name` (String) The login name for this account.
-- `name` (String) The account name. Defaults to the resource name.
-- `type` (String, Deprecated) The resource type.
-
-### Read-Only
-
-- `id` (String) The ID of the account.
-
-

docs/resources/account_password.md

@@ -28,6 +28,7 @@ resource "boundary_auth_method" "password" {
 
 resource "boundary_account_password" "jeff" {
   auth_method_id = boundary_auth_method.password.id
+  type           = "password"
   login_name     = "jeff"
   password       = "$uper$ecure"
 }
@@ -39,6 +40,7 @@ resource "boundary_account_password" "jeff" {
 ### Required
 
 - `auth_method_id` (String) The resource ID for the auth method.
+- `type` (String) The resource type.
 
 ### Optional
 
@@ -46,7 +48,6 @@ resource "boundary_account_password" "jeff" {
 - `login_name` (String) The login name for this account.
 - `name` (String) The account name. Defaults to the resource name.
 - `password` (String, Sensitive) The account password. Only set on create, changes will not be reflected when updating account.
-- `type` (String, Deprecated) The resource type.
 
 ### Read-Only
 

docs/resources/auth_method_ldap.md

@@ -1,56 +0,0 @@
----
-# generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "boundary_auth_method_ldap Resource - terraform-provider-boundary"
-subcategory: ""
-description: |-
-  The LDAP auth method resource allows you to configure a Boundary authmethodldap.
----
-
-# boundary_auth_method_ldap (Resource)
-
-The LDAP auth method resource allows you to configure a Boundary auth_method_ldap.
-
-
-
-<!-- schema generated by tfplugindocs -->
-## Schema
-
-### Required
-
-- `scope_id` (String) The scope ID.
-
-### Optional
-
-- `account_attribute_maps` (List of String) Account attribute maps fullname and email.
-- `anon_group_search` (Boolean) Use anon bind when performing LDAP group searches (optional).
-- `bind_dn` (String) The distinguished name of entry to bind when performing user and group searches (optional).
-- `bind_password` (String) The password to use along with bind-dn performing user and group searches (optional).
-- `bind_password_hmac` (String) The HMAC of the bind password returned by the Boundary controller, which is used for comparison after initial setting of the value.
-- `certificates` (List of String) PEM-encoded X.509 CA certificate in ASN.1 DER form that can be used as a trust anchor when connecting to an LDAP server(optional).  This may be specified multiple times
-- `client_certificate` (String) PEM-encoded X.509 client certificate in ASN.1 DER form that can be used to authenticate against an LDAP server(optional).
-- `client_certificate_key` (String) PEM-encoded X.509 client certificate key in PKCS #8, ASN.1 DER form used with the client certificate (optional).
-- `client_certificate_key_hmac` (String) The HMAC of the client certificate key returned by the Boundary controller, which is used for comparison after initial setting of the value.
-- `description` (String) The auth method description.
-- `discover_dn` (Boolean) Use anon bind to discover the bind DN of a user (optional).
-- `enable_groups` (Boolean) Find the authenticated user's groups during authentication (optional).
-- `group_attr` (String) The attribute that enumerates a user's group membership from entries returned by a group search (optional).
-- `group_dn` (String) The base DN under which to perform group search.
-- `group_filter` (String) A go template used to construct a LDAP group search filter (optional).
-- `insecure_tls` (Boolean) Skip the LDAP server SSL certificate validation (optional) - insecure and use with caution.
-- `is_primary_for_scope` (Boolean) When true, makes this auth method the primary auth method for the scope in which it resides. The primary auth method for a scope means the the user will be automatically created when they login using an LDAP account.
-- `name` (String) The auth method name. Defaults to the resource name.
-- `start_tls` (Boolean) Issue StartTLS command after connecting (optional).
-- `state` (String) Can be one of 'inactive', 'active-private', or 'active-public'. Defaults to active-public.
-- `type` (String) The type of auth method; hardcoded.
-- `upn_domain` (String) The userPrincipalDomain used to construct the UPN string for the authenticating user (optional).
-- `urls` (List of String) The LDAP URLs that specify LDAP servers to connect to (required).  May be specified multiple times.
-- `use_token_groups` (Boolean) Use the Active Directory tokenGroups constructed attribute of the user to find the group memberships (optional).
-- `user_attr` (String) The attribute on user entry matching the username passed when authenticating (optional).
-- `user_dn` (String) The base DN under which to perform user search (optional).
-- `user_filter` (String) A go template used to construct a LDAP user search filter (optional).
-
-### Read-Only
-
-- `id` (String) The ID of the auth method.
-
-

docs/resources/credential_library_vault.md

@@ -96,7 +96,7 @@ resource "boundary_credential_library_vault" "quz" {
 ### Optional
 
 - `credential_mapping_overrides` (Map of String) The credential mapping override.
-- `credential_type` (String) The type of credential the library generates. Cannot be updated on an existing resource.
+- `credential_type` (String) The type of credential the library generates.
 - `description` (String) The Vault credential library description.
 - `http_method` (String) The HTTP method the library uses when requesting credentials from Vault. Defaults to 'GET'
 - `http_request_body` (String) The body of the HTTP request the library sends to Vault when requesting credentials. Only valid if `http_method` is set to `POST`.

docs/resources/host_catalog_plugin.md

@@ -67,7 +67,7 @@ resource "boundary_host_catalog_plugin" "azure_example" {
     "client_id"                   = "ARM_CLIENT_ID"
   })
 
-  # recommended to pass in azure secrets using a file() or using environment variables
+  # recommended to pass in aws secrets using a file() or using environment variables
   # the secrets below must be generated in azure by creating an ad application
   secrets_json = jsonencode({
     "secret_value" = "ARM_CLIENT_SECRET"

docs/resources/host_set_plugin.md

@@ -51,7 +51,7 @@ resource "boundary_host_catalog_plugin" "aws_example" {
 resource "boundary_host_set_plugin" "web" {
   name            = "My web host set plugin"
   host_catalog_id = boundary_host_catalog_plugin.aws_example.id
-  attributes_json = jsonencode({ "filters" = ["tag:service-type=web"] })
+  attributes_json = jsonencode({ "filters" = "tag:service-type=web" })
 }
 
 resource "boundary_host_set_plugin" "foobar" {
@@ -59,7 +59,8 @@ resource "boundary_host_set_plugin" "foobar" {
   host_catalog_id     = boundary_host_catalog_plugin.aws_example.id
   preferred_endpoints = ["cidr:54.0.0.0/8"]
   attributes_json = jsonencode({
-    "filters" = ["tag-key=foo", "tag-key=bar"]
+    "filters" = "tag-key=foo",
+    "filters" = "tag-key=bar"
   })
 }
 
@@ -68,7 +69,8 @@ resource "boundary_host_set_plugin" "launch" {
   host_catalog_id       = boundary_host_catalog_plugin.aws_example.id
   sync_interval_seconds = 60
   attributes_json = jsonencode({
-    "filters" = ["tag:development=prod,dev", "launch-time=2022-01-04T*"]
+    "filters" = "tag:development=prod,dev",
+    "filters" = "launch-time=2022-01-04T*"
   })
 }
 
@@ -91,7 +93,7 @@ resource "boundary_host_catalog_plugin" "azure_example" {
     "client_id"                   = "ARM_CLIENT_ID"
   })
 
-  # recommended to pass in azure secrets using a file() or using environment variables
+  # recommended to pass in aws secrets using a file() or using environment variables
   # the secrets below must be generated in azure by creating an ad application
   secrets_json = jsonencode({
     "secret_value" = "ARM_CLIENT_SECRET"

docs/resources/managed_group.md

@@ -18,7 +18,7 @@ The managed group resource allows you to configure a Boundary group.
 ### Required
 
 - `auth_method_id` (String) The resource ID for the auth method.
-- `filter` (String) Boolean expression to filter the workers for this managed group.
+- `filter` (String) Boolean expression to filter the users for this managed group.
 
 ### Optional
 
@@ -28,5 +28,3 @@ The managed group resource allows you to configure a Boundary group.
 ### Read-Only
 
 - `id` (String) The ID of the group.
-
-

docs/resources/managed_group_ldap.md

@@ -1,32 +0,0 @@
----
-# generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "boundary_managed_group_ldap Resource - terraform-provider-boundary"
-subcategory: ""
-description: |-
-  The managed group resource allows you to configure a Boundary group.
----
-
-# boundary_managed_group_ldap (Resource)
-
-The managed group resource allows you to configure a Boundary group.
-
-
-
-<!-- schema generated by tfplugindocs -->
-## Schema
-
-### Required
-
-- `auth_method_id` (String) The resource ID for the auth method.
-- `group_names` (List of String) The list of groups that make up the managed group.
-
-### Optional
-
-- `description` (String) The managed group description.
-- `name` (String) The managed group name. Defaults to the resource name.
-
-### Read-Only
-
-- `id` (String) The ID of the group.
-
-

docs/resources/storage_bucket.md

@@ -1,75 +0,0 @@
----
-# generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "boundary_storage_bucket Resource - terraform-provider-boundary"
-subcategory: ""
-description: |-
-  The storage bucket resource allows you to configure a Boundary storage bucket. A storage bucket can only belong to the Global scope or an Org scope. At this time, the only supported storage for storage buckets is AWS S3. This feature requires Boundary Enterprise or Boundary HCP.
----
-
-# boundary_storage_bucket (Resource)
-
-The storage bucket resource allows you to configure a Boundary storage bucket. A storage bucket can only belong to the Global scope or an Org scope. At this time, the only supported storage for storage buckets is AWS S3. This feature requires Boundary Enterprise or Boundary HCP.
-
-## Example Usage
-
-```terraform
-resource "boundary_scope" "org" {
-  name                     = "organization_one"
-  description              = "My first scope!"
-  scope_id                 = boundary_scope.global.id
-  auto_create_admin_role   = true
-  auto_create_default_role = true
-}
-
-resource "boundary_storage_bucket" "aws_example" {
-  name            = "My aws storage bucket"
-  description     = "My first storage bucket!"
-  scope_id        = boundary_scope.org.id
-  plugin_name     = "aws"
-  bucket_name     = "mybucket"
-  attributes_json = jsonencode({ "region" = "us-east-1" })
-
-  # recommended to pass in aws secrets using a file() or using environment variables
-  # the secrets below must be generated in aws by creating a aws iam user with programmatic access
-  secrets_json = jsonencode({
-    "access_key_id"     = "aws_access_key_id_value",
-    "secret_access_key" = "aws_secret_access_key_value"
-  })
-  worker_filter = "\"pki\" in \"/tags/type\""
-}
-```
-
-<!-- schema generated by tfplugindocs -->
-## Schema
-
-### Required
-
-- `bucket_name` (String) The name of the bucket within the external object store service.
-- `scope_id` (String) The scope for this storage bucket.
-- `secrets_json` (String, Sensitive) The secrets for the storage bucket. Either values encoded with the "jsonencode" function, pre-escaped JSON string, or a file:// or env:// path. Set to a string "null" to clear any existing values. NOTE: Unlike "attributes_json", removing this block will NOT clear secrets from the storage bucket; this allows injecting secrets for one call, then removing them for storage.
-- `worker_filter` (String) Filters to the worker(s) that can handle requests for this storage bucket. The filter must match an existing worker in order to create a storage bucket.
-
-### Optional
-
-- `attributes_json` (String) The attributes for the storage bucket. The "region" attribute field is required when creating an AWS storage bucket. Values are either encoded with the "jsonencode" function, pre-escaped JSON string, or a file:// or env:// path. Set to a string "null" or remove the block to clear all attributes in the storage bucket.
-- `bucket_prefix` (String) The prefix used to organize the data held within the external object store.
-- `description` (String) The storage bucket description.
-- `name` (String) The storage bucket name. Defaults to the resource name.
-- `plugin_id` (String) The ID of the plugin that should back the resource. This or plugin_name must be defined.
-- `plugin_name` (String) The name of the plugin that should back the resource. This or plugin_id must be defined.
-
-### Read-Only
-
-- `id` (String) The ID of the storage bucket.
-- `internal_force_update` (String) Internal only. Used to force update so that we can always check the value of secrets.
-- `internal_hmac_used_for_secrets_config_hmac` (String) Internal only. The Boundary-provided HMAC used to calculate the current value of the HMAC'd config. Used for drift detection.
-- `internal_secrets_config_hmac` (String) Internal only. HMAC of (serverSecretsHmac + config secrets). Used for proper secrets handling.
-- `secrets_hmac` (String) The HMAC'd secrets value returned from the server.
-
-## Import
-
-Import is supported using the following syntax:
-
-```shell
-terraform import boundary_storage_bucket.foo <my-id>
-```

docs/resources/target.md

@@ -61,7 +61,6 @@ resource "boundary_host" "foo" {
   type            = "static"
   name            = "foo"
   host_catalog_id = boundary_host_catalog.foo.id
-  scope_id        = boundary_scope.project.id
   address         = "10.0.0.1"
 }
 
@@ -69,7 +68,6 @@ resource "boundary_host" "bar" {
   type            = "static"
   name            = "bar"
   host_catalog_id = boundary_host_catalog.foo.id
-  scope_id        = boundary_scope.project.id
   address         = "10.0.0.1"
 }
 
@@ -84,20 +82,6 @@ resource "boundary_host_set" "foo" {
   ]
 }
 
-resource "boundary_storage_bucket" "aws_example" {
-  name            = "My aws storage bucket"
-  description     = "My first storage bucket!"
-  scope_id        = boundary_scope.org.id
-  plugin_name     = "aws"
-  bucket_name     = "mybucket"
-  attributes_json = jsonencode({ "region" = "us-east-1" })
-  secrets_json = jsonencode({
-    "access_key_id"     = "aws_access_key_id_value",
-    "secret_access_key" = "aws_secret_access_key_value"
-  })
-  worker_filter = "\"pki\" in \"/tags/type\""
-}
-
 resource "boundary_target" "foo" {
   name         = "foo"
   description  = "Foo target"
@@ -126,22 +110,6 @@ resource "boundary_target" "ssh_foo" {
   ]
 }
 
-resource "boundary_target" "ssh_session_recording_foo" {
-  name         = "ssh_foo"
-  description  = "Ssh target"
-  type         = "ssh"
-  default_port = "22"
-  scope_id     = boundary_scope.project.id
-  host_source_ids = [
-    boundary_host_set.foo.id
-  ]
-  injected_application_credential_source_ids = [
-    boundary_credential_library_vault.foo.id
-  ]
-  enable_session_recording = true
-  storage_bucket_id        = boundary_storage_bucket.aws_example
-}
-
 resource "boundary_target" "address_foo" {
   name         = "address_foo"
   description  = "Foo target with an address"
@@ -168,14 +136,12 @@ resource "boundary_target" "address_foo" {
 - `default_port` (Number) The default port for this target.
 - `description` (String) The target description.
 - `egress_worker_filter` (String) Boolean expression to filter the workers used to access this target
-- `enable_session_recording` (Boolean) HCP/Ent Only. Enable sessions recording for this target. Only applicable for SSH targets.
 - `host_source_ids` (Set of String) A list of host source ID's. Cannot be used alongside address.
 - `ingress_worker_filter` (String) HCP Only. Boolean expression to filter the workers a user will connect to when initiating a session against this target
 - `injected_application_credential_source_ids` (Set of String) A list of injected application credential source ID's.
 - `name` (String) The target name. Defaults to the resource name.
 - `session_connection_limit` (Number)
 - `session_max_seconds` (Number)
-- `storage_bucket_id` (String) HCP/Ent Only. Storage bucket for this target. Only applicable for SSH targets.
 - `worker_filter` (String, Deprecated) Boolean expression to filter the workers for this target
 
 ### Read-Only

docs/resources/worker.md

@@ -10,22 +10,7 @@ description: |-
 
 The resource allows you to create a self-managed worker object.
 
-## Example Usage
 
-```terraform
-resource "boundary_worker" "controller_led" {
-  scope_id    = "global"
-  name        = "worker 1"
-  description = "self managed worker with controller led auth"
-}
-
-resource "boundary_self_managed_worker" "worker_led" {
-  scope_id                    = "global"
-  name                        = "worker 2"
-  description                 = "self managed worker with worker led auth"
-  worker_generated_auth_token = var.worker_generated_auth_token
-}
-```
 
 <!-- schema generated by tfplugindocs -->
 ## Schema

examples/resources/boundary_account_password/resource.tf

@@ -13,6 +13,7 @@ resource "boundary_auth_method" "password" {
 
 resource "boundary_account_password" "jeff" {
   auth_method_id = boundary_auth_method.password.id
+  type           = "password"
   login_name     = "jeff"
   password       = "$uper$ecure"
 }

examples/resources/boundary_host_catalog_plugin/resource.tf

@@ -52,7 +52,7 @@ resource "boundary_host_catalog_plugin" "azure_example" {
     "client_id"                   = "ARM_CLIENT_ID"
   })
 
-  # recommended to pass in azure secrets using a file() or using environment variables
+  # recommended to pass in aws secrets using a file() or using environment variables
   # the secrets below must be generated in azure by creating an ad application
   secrets_json = jsonencode({
     "secret_value" = "ARM_CLIENT_SECRET"

examples/resources/boundary_host_set_plugin/resource.tf

@@ -36,7 +36,7 @@ resource "boundary_host_catalog_plugin" "aws_example" {
 resource "boundary_host_set_plugin" "web" {
   name            = "My web host set plugin"
   host_catalog_id = boundary_host_catalog_plugin.aws_example.id
-  attributes_json = jsonencode({ "filters" = ["tag:service-type=web"] })
+  attributes_json = jsonencode({ "filters" = "tag:service-type=web" })
 }
 
 resource "boundary_host_set_plugin" "foobar" {
@@ -44,7 +44,8 @@ resource "boundary_host_set_plugin" "foobar" {
   host_catalog_id     = boundary_host_catalog_plugin.aws_example.id
   preferred_endpoints = ["cidr:54.0.0.0/8"]
   attributes_json = jsonencode({
-    "filters" = ["tag-key=foo", "tag-key=bar"]
+    "filters" = "tag-key=foo",
+    "filters" = "tag-key=bar"
   })
 }
 
@@ -53,7 +54,8 @@ resource "boundary_host_set_plugin" "launch" {
   host_catalog_id       = boundary_host_catalog_plugin.aws_example.id
   sync_interval_seconds = 60
   attributes_json = jsonencode({
-    "filters" = ["tag:development=prod,dev", "launch-time=2022-01-04T*"]
+    "filters" = "tag:development=prod,dev",
+    "filters" = "launch-time=2022-01-04T*"
   })
 }
 
@@ -76,7 +78,7 @@ resource "boundary_host_catalog_plugin" "azure_example" {
     "client_id"                   = "ARM_CLIENT_ID"
   })
 
-  # recommended to pass in azure secrets using a file() or using environment variables
+  # recommended to pass in aws secrets using a file() or using environment variables
   # the secrets below must be generated in azure by creating an ad application
   secrets_json = jsonencode({
     "secret_value" = "ARM_CLIENT_SECRET"
@@ -98,4 +100,4 @@ resource "boundary_host_set_plugin" "foodev" {
     "filter" = "tagName eq 'tag-key' and tagValue eq 'foo'",
     "filter" = "tagName eq 'application' and tagValue eq 'dev'",
   })
-}
+}

examples/resources/boundary_storage_bucket/import.sh

@@ -1 +0,0 @@
-terraform import boundary_storage_bucket.foo <my-id>

examples/resources/boundary_storage_bucket/resource.tf

@@ -1,24 +0,0 @@
-resource "boundary_scope" "org" {
-  name                     = "organization_one"
-  description              = "My first scope!"
-  scope_id                 = boundary_scope.global.id
-  auto_create_admin_role   = true
-  auto_create_default_role = true
-}
-
-resource "boundary_storage_bucket" "aws_example" {
-  name            = "My aws storage bucket"
-  description     = "My first storage bucket!"
-  scope_id        = boundary_scope.org.id
-  plugin_name     = "aws"
-  bucket_name     = "mybucket"
-  attributes_json = jsonencode({ "region" = "us-east-1" })
-
-  # recommended to pass in aws secrets using a file() or using environment variables
-  # the secrets below must be generated in aws by creating a aws iam user with programmatic access
-  secrets_json = jsonencode({
-    "access_key_id"     = "aws_access_key_id_value",
-    "secret_access_key" = "aws_secret_access_key_value"
-  })
-  worker_filter = "\"pki\" in \"/tags/type\""
-}

examples/resources/boundary_target/resource.tf

@@ -69,20 +69,6 @@ resource "boundary_host_set" "foo" {
   ]
 }
 
-resource "boundary_storage_bucket" "aws_example" {
-  name            = "My aws storage bucket"
-  description     = "My first storage bucket!"
-  scope_id        = boundary_scope.org.id
-  plugin_name     = "aws"
-  bucket_name     = "mybucket"
-  attributes_json = jsonencode({ "region" = "us-east-1" })
-  secrets_json = jsonencode({
-    "access_key_id"     = "aws_access_key_id_value",
-    "secret_access_key" = "aws_secret_access_key_value"
-  })
-  worker_filter = "\"pki\" in \"/tags/type\""
-}
-
 resource "boundary_target" "foo" {
   name         = "foo"
   description  = "Foo target"
@@ -111,22 +97,6 @@ resource "boundary_target" "ssh_foo" {
   ]
 }
 
-resource "boundary_target" "ssh_session_recording_foo" {
-  name         = "ssh_foo"
-  description  = "Ssh target"
-  type         = "ssh"
-  default_port = "22"
-  scope_id     = boundary_scope.project.id
-  host_source_ids = [
-    boundary_host_set.foo.id
-  ]
-  injected_application_credential_source_ids = [
-    boundary_credential_library_vault.foo.id
-  ]
-  enable_session_recording = true
-  storage_bucket_id        = boundary_storage_bucket.aws_example
-}
-
 resource "boundary_target" "address_foo" {
   name         = "address_foo"
   description  = "Foo target with an address"

examples/resources/boundary_worker/resource.tf

@@ -1,12 +0,0 @@
-resource "boundary_worker" "controller_led" {
-  scope_id    = "global"
-  name        = "worker 1"
-  description = "self managed worker with controller led auth"
-}
-
-resource "boundary_self_managed_worker" "worker_led" {
-  scope_id                    = "global"
-  name                        = "worker 2"
-  description                 = "self managed worker with worker led auth"
-  worker_generated_auth_token = var.worker_generated_auth_token
-}

go.mod

@@ -3,119 +3,115 @@ module github.com/hashicorp/terraform-provider-boundary
 go 1.20
 
 require (
-	github.com/hashicorp/boundary v0.13.0
-	github.com/hashicorp/boundary/api v0.0.39
-	github.com/hashicorp/boundary/sdk v0.0.35
-	github.com/hashicorp/cap v0.3.1
-	github.com/hashicorp/cap/ldap v0.0.0-20230420150311-6d1e00a6c5e0
+	github.com/hashicorp/boundary v0.12.2
+	github.com/hashicorp/boundary/api v0.0.34
+	github.com/hashicorp/boundary/sdk v0.0.30
+	github.com/hashicorp/cap v0.2.0
 	github.com/hashicorp/go-cty v1.4.1-0.20200723130312-85980079f637
-	github.com/hashicorp/go-kms-wrapping/v2 v2.0.10-0.20230601143830-08d524b564ba
-	github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.10
+	github.com/hashicorp/go-kms-wrapping/v2 v2.0.9-0.20230315135303-7bedb33a2280
+	github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.7
 	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7
-	github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.4
+	github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.3
 	github.com/hashicorp/terraform-plugin-docs v0.14.1
-	github.com/hashicorp/terraform-plugin-sdk/v2 v2.26.1
-	github.com/jimlambrt/gldap v0.1.6
+	github.com/hashicorp/terraform-plugin-sdk/v2 v2.24.1
 	github.com/kr/pretty v0.3.1
 	github.com/mitchellh/go-homedir v1.1.0
-	github.com/stretchr/testify v1.8.4
-	golang.org/x/crypto v0.9.0
+	github.com/stretchr/testify v1.8.2
+	golang.org/x/crypto v0.7.0
 )
 
 require (
 	github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 // indirect
-	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
-	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
 	github.com/DATA-DOG/go-sqlmock v1.5.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.2.0 // indirect
 	github.com/Masterminds/sprig/v3 v3.2.3 // indirect
-	github.com/Microsoft/go-winio v0.6.0 // indirect
+	github.com/Microsoft/go-winio v0.5.2 // indirect
 	github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 // indirect
 	github.com/agext/levenshtein v1.2.2 // indirect
 	github.com/alessio/shellescape v1.4.1 // indirect
 	github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
+	github.com/armon/go-metrics v0.3.9 // indirect
 	github.com/armon/go-radix v1.0.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bgentry/speakeasy v0.1.0 // indirect
-	github.com/cenkalti/backoff v2.2.1+incompatible // indirect
 	github.com/cenkalti/backoff/v3 v3.0.0 // indirect
-	github.com/cenkalti/backoff/v4 v4.2.0 // indirect
+	github.com/cenkalti/backoff/v4 v4.1.3 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/containerd/continuity v0.3.0 // indirect
-	github.com/coreos/go-oidc/v3 v3.5.0 // indirect
-	github.com/danieljoos/wincred v1.2.0 // indirect
+	github.com/coreos/go-oidc/v3 v3.1.0 // indirect
+	github.com/danieljoos/wincred v1.1.2 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/docker/cli v23.0.1+incompatible // indirect
-	github.com/docker/docker v23.0.3+incompatible // indirect
+	github.com/docker/cli v20.10.14+incompatible // indirect
+	github.com/docker/docker v20.10.9+incompatible // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
-	github.com/docker/go-units v0.5.0 // indirect
+	github.com/docker/go-units v0.4.0 // indirect
 	github.com/dvsekhvalnov/jose2go v1.5.0 // indirect
-	github.com/fatih/color v1.15.0 // indirect
+	github.com/fatih/color v1.14.1 // indirect
 	github.com/fatih/structs v1.1.0 // indirect
-	github.com/go-asn1-ber/asn1-ber v1.5.4 // indirect
-	github.com/go-jose/go-jose/v3 v3.0.0 // indirect
-	github.com/go-ldap/ldap/v3 v3.4.4 // indirect
-	github.com/godbus/dbus/v5 v5.1.0 // indirect
+	github.com/godbus/dbus/v5 v5.0.6 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang-migrate/migrate/v4 v4.15.1 // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/golang/protobuf v1.5.2 // indirect
+	github.com/golang/snappy v0.0.4 // indirect
 	github.com/google/go-cmp v0.5.9 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/google/uuid v1.3.0 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 // indirect
-	github.com/hashicorp/dbassert v0.0.0-20230405175854-2d88acd5134b // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.2 // indirect
+	github.com/hashicorp/dbassert v0.0.0-20210708202608-ecf920cf1ed8 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
-	github.com/hashicorp/eventlogger v0.1.2-0.20230428153751-cca445805f24 // indirect
-	github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20230428153751-cca445805f24 // indirect
-	github.com/hashicorp/go-bexpr v0.1.12 // indirect
+	github.com/hashicorp/eventlogger v0.1.2-0.20230227112545-f26a3bdf6871 // indirect
+	github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20230227112545-f26a3bdf6871 // indirect
+	github.com/hashicorp/go-bexpr v0.1.10 // indirect
 	github.com/hashicorp/go-checkpoint v0.5.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-dbw v0.0.0-20230605211904-d40e5c9d5995 // indirect
-	github.com/hashicorp/go-hclog v1.5.0 // indirect
+	github.com/hashicorp/go-dbw v0.0.0-20220910135738-ed4505749995 // indirect
+	github.com/hashicorp/go-hclog v1.3.1 // indirect
+	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
 	github.com/hashicorp/go-kms-wrapping/extras/kms/v2 v2.0.0-20221122211539-47c893099f13 // indirect
-	github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.4 // indirect
+	github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.3 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-plugin v1.4.9 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.2 // indirect
 	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
 	github.com/hashicorp/go-secure-stdlib/base62 v0.1.2 // indirect
 	github.com/hashicorp/go-secure-stdlib/gatedwriter v0.1.1 // indirect
-	github.com/hashicorp/go-secure-stdlib/kv-builder v0.1.2 // indirect
-	github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.7 // indirect
-	github.com/hashicorp/go-secure-stdlib/mlock v0.1.3 // indirect
+	github.com/hashicorp/go-secure-stdlib/kv-builder v0.1.1 // indirect
+	github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.5 // indirect
+	github.com/hashicorp/go-secure-stdlib/mlock v0.1.1 // indirect
 	github.com/hashicorp/go-secure-stdlib/reloadutil v0.1.1 // indirect
 	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
 	github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.2 // indirect
 	github.com/hashicorp/go-sockaddr v1.0.2 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
 	github.com/hashicorp/go-version v1.6.0 // indirect
+	github.com/hashicorp/golang-lru v0.5.4 // indirect
 	github.com/hashicorp/hc-install v0.5.0 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/hashicorp/hcl/v2 v2.16.2 // indirect
 	github.com/hashicorp/logutils v1.0.0 // indirect
-	github.com/hashicorp/nodeenrollment v0.2.4 // indirect
+	github.com/hashicorp/nodeenrollment v0.1.18 // indirect
 	github.com/hashicorp/terraform-exec v0.18.1 // indirect
 	github.com/hashicorp/terraform-json v0.16.0 // indirect
 	github.com/hashicorp/terraform-plugin-go v0.14.3 // indirect
-	github.com/hashicorp/terraform-plugin-log v0.8.0 // indirect
+	github.com/hashicorp/terraform-plugin-log v0.7.0 // indirect
 	github.com/hashicorp/terraform-registry-address v0.1.0 // indirect
 	github.com/hashicorp/terraform-svchost v0.0.0-20200729002733-f050f53b9734 // indirect
-	github.com/hashicorp/vault/api v1.9.1 // indirect
+	github.com/hashicorp/vault/api v1.3.1 // indirect
 	github.com/hashicorp/vault/sdk v0.3.0 // indirect
 	github.com/hashicorp/yamux v0.1.1 // indirect
 	github.com/huandu/xstrings v1.4.0 // indirect
 	github.com/imdario/mergo v0.3.13 // indirect
 	github.com/jackc/chunkreader/v2 v2.0.1 // indirect
-	github.com/jackc/pgconn v1.14.0 // indirect
+	github.com/jackc/pgconn v1.12.1 // indirect
 	github.com/jackc/pgio v1.0.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
-	github.com/jackc/pgproto3/v2 v2.3.2 // indirect
-	github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
-	github.com/jackc/pgtype v1.14.0 // indirect
-	github.com/jackc/pgx/v4 v4.18.1 // indirect
-	github.com/jackc/pgx/v5 v5.3.1 // indirect
+	github.com/jackc/pgproto3/v2 v2.3.0 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b // indirect
+	github.com/jackc/pgtype v1.11.0 // indirect
+	github.com/jackc/pgx/v4 v4.16.1 // indirect
 	github.com/jefferai/go-libsecret v0.0.0-20210525195240-b53481abef97 // indirect
 	github.com/jefferai/isbadcipher v0.0.0-20190226160619-51d2077c035f // indirect
 	github.com/jefferai/keyring v1.1.7-0.20220316160357-58a74bb55891 // indirect
@@ -123,9 +119,9 @@ require (
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
 	github.com/kr/text v0.2.0 // indirect
-	github.com/lib/pq v1.10.7 // indirect
+	github.com/lib/pq v1.10.2 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-isatty v0.0.19 // indirect
+	github.com/mattn/go-isatty v0.0.17 // indirect
 	github.com/mattn/go-sqlite3 v2.0.3+incompatible // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
 	github.com/mikesmitty/edkey v0.0.0-20170222072505-3356ea4e686a // indirect
@@ -136,15 +132,16 @@ require (
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/mitchellh/pointerstructure v1.2.1 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
-	github.com/moby/term v0.0.0-20221205130635-1aeaba878587 // indirect
+	github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6 // indirect
 	github.com/mr-tron/base58 v1.2.0 // indirect
 	github.com/mtibben/percent v0.2.1 // indirect
 	github.com/oklog/run v1.1.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.0.2 // indirect
-	github.com/opencontainers/runc v1.1.5 // indirect
+	github.com/opencontainers/runc v1.1.2 // indirect
 	github.com/ory/dockertest/v3 v3.9.1 // indirect
-	github.com/pires/go-proxyproto v0.7.0 // indirect
+	github.com/pierrec/lz4 v2.5.2+incompatible // indirect
+	github.com/pires/go-proxyproto v0.6.1 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/posener/complete v1.2.3 // indirect
@@ -157,37 +154,34 @@ require (
 	github.com/ryanuber/go-glob v1.0.0 // indirect
 	github.com/sethvargo/go-diceware v0.3.0 // indirect
 	github.com/shopspring/decimal v1.3.1 // indirect
-	github.com/sirupsen/logrus v1.9.0 // indirect
+	github.com/sirupsen/logrus v1.8.1 // indirect
 	github.com/spf13/cast v1.5.0 // indirect
 	github.com/vmihailenco/msgpack v4.0.4+incompatible // indirect
 	github.com/vmihailenco/msgpack/v4 v4.3.12 // indirect
 	github.com/vmihailenco/tagparser v0.1.1 // indirect
-	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
+	github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
-	github.com/xo/dburl v0.14.2 // indirect
-	github.com/zalando/go-keyring v0.2.3 // indirect
+	github.com/xo/dburl v0.11.0 // indirect
+	github.com/zalando/go-keyring v0.2.1 // indirect
 	github.com/zclconf/go-cty v1.13.1 // indirect
 	go.uber.org/atomic v1.9.0 // indirect
-	golang.org/x/exp v0.0.0-20230425010034-47ecfdc1ba53 // indirect
+	golang.org/x/exp v0.0.0-20230224173230-c95f2b4c22f2 // indirect
 	golang.org/x/mod v0.8.0 // indirect
-	golang.org/x/net v0.10.0 // indirect
-	golang.org/x/oauth2 v0.8.0 // indirect
-	golang.org/x/sys v0.8.0 // indirect
-	golang.org/x/term v0.8.0 // indirect
-	golang.org/x/text v0.9.0 // indirect
+	golang.org/x/net v0.8.0 // indirect
+	golang.org/x/oauth2 v0.4.0 // indirect
+	golang.org/x/sys v0.6.0 // indirect
+	golang.org/x/term v0.6.0 // indirect
+	golang.org/x/text v0.8.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
-	golang.org/x/tools v0.6.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20230526203410-71b5a4ffd15e // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20230530153820-e85fd2cbaebc // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc // indirect
-	google.golang.org/grpc v1.55.0 // indirect
-	google.golang.org/protobuf v1.30.0 // indirect
+	google.golang.org/genproto v0.0.0-20230303212802-e74f57abe488 // indirect
+	google.golang.org/grpc v1.53.0 // indirect
+	google.golang.org/protobuf v1.29.1 // indirect
 	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	gorm.io/driver/postgres v1.5.2 // indirect
-	gorm.io/driver/sqlite v1.5.1 // indirect
-	gorm.io/gorm v1.25.1 // indirect
+	gorm.io/driver/postgres v1.3.8 // indirect
+	gorm.io/driver/sqlite v1.3.6 // indirect
+	gorm.io/gorm v1.23.8 // indirect
 )

go.sum

@@ -29,7 +29,6 @@ cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvf
 cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
 cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
 cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
-cloud.google.com/go/compute/metadata v0.2.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
 cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
@@ -50,9 +49,8 @@ github.com/Azure/azure-pipeline-go v0.2.3/go.mod h1:x841ezTBIMG6O3lAcl8ATHnsOPVl
 github.com/Azure/azure-sdk-for-go v16.2.1+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
 github.com/Azure/azure-storage-blob-go v0.14.0/go.mod h1:SMqIBi+SuiQH32bvyjngEewEeXoPfKMgWlBDaYf6fck=
 github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78/go.mod h1:LmzpDX56iTiv29bbRTIsUNlaFfuhWRQBWjQdVyAevI8=
+github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 h1:UQHMgLO+TxOElx5B5HZ4hJQsoJ/PvUvKRhJHDQXO8P8=
 github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
-github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25UVaW/CKtUDjefjrs0SPonmDGUVOYP0=
-github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/Azure/go-autorest v10.8.1+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
 github.com/Azure/go-autorest v14.2.0+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
 github.com/Azure/go-autorest/autorest v0.11.1/go.mod h1:JFgpikqFJ/MleTTxwepExTKnFUKKszPS8UavbQYUMuw=
@@ -66,20 +64,20 @@ github.com/Azure/go-autorest/autorest/mocks v0.4.1/go.mod h1:LTp+uSrOhSkaKrUy935
 github.com/Azure/go-autorest/logger v0.2.0/go.mod h1:T9E3cAhj2VqvPOtCYAvby9aBXkZmbF5NWuPV8+WeEW8=
 github.com/Azure/go-autorest/logger v0.2.1/go.mod h1:T9E3cAhj2VqvPOtCYAvby9aBXkZmbF5NWuPV8+WeEW8=
 github.com/Azure/go-autorest/tracing v0.6.0/go.mod h1:+vhtPC754Xsa23ID7GlGsrdKBpUA79WCAKPPZVC2DeU=
-github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
-github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=
-github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/ClickHouse/clickhouse-go v1.4.3/go.mod h1:EaI/sW7Azgz9UATzd5ZdZHRUhHgv5+JMS9NSr2smCJI=
 github.com/DATA-DOG/go-sqlmock v1.5.0 h1:Shsta01QNfFxHCfpW6YH2STWB0MudeXXEWMr20OEh60=
 github.com/DATA-DOG/go-sqlmock v1.5.0/go.mod h1:f/Ixk793poVmq4qj/V1dPUg2JEAKC73Q5eFN3EC/SaM=
 github.com/DataDog/datadog-go v3.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ=
+github.com/Masterminds/goutils v1.1.0/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
+github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
 github.com/Masterminds/semver/v3 v3.1.1/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
 github.com/Masterminds/semver/v3 v3.2.0 h1:3MEsd0SM6jqZojhjLWWeBY+Kcjy9i6MQAeY7YgDP83g=
 github.com/Masterminds/semver/v3 v3.2.0/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
+github.com/Masterminds/sprig v2.22.0+incompatible/go.mod h1:y6hNFY5UBTIWBxnzTeuNhlNS5hqE0NB0E6fgfo2Br3o=
 github.com/Masterminds/sprig/v3 v3.2.1/go.mod h1:UoaO7Yp8KlPnJIYWTFkMaqPUYKTfGFPhxNuwnnxkKlk=
 github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj9n6YA=
 github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBaRMhvYXJNkGuM=
@@ -92,8 +90,8 @@ github.com/Microsoft/go-winio v0.4.17-0.20210211115548-6eac466e5fa3/go.mod h1:JP
 github.com/Microsoft/go-winio v0.4.17-0.20210324224401-5516f17a5958/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
 github.com/Microsoft/go-winio v0.4.17/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
 github.com/Microsoft/go-winio v0.5.0/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
-github.com/Microsoft/go-winio v0.6.0 h1:slsWYD/zyx7lCXoZVlvQrj0hPTM1HI4+v1sIda2yDvg=
-github.com/Microsoft/go-winio v0.6.0/go.mod h1:cTAf44im0RAYeL23bpB+fzCyDH2MJiz2BO69KH/soAE=
+github.com/Microsoft/go-winio v0.5.2 h1:a9IhgEQBCUEk6QCdml9CiJGhAws+YwffDHEMp1VMrpA=
+github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
 github.com/Microsoft/hcsshim v0.8.6/go.mod h1:Op3hHsoHPAvb6lceZHDtd9OkTew38wNoXnJs8iY7rUg=
 github.com/Microsoft/hcsshim v0.8.7-0.20190325164909-8abdbb8205e4/go.mod h1:Op3hHsoHPAvb6lceZHDtd9OkTew38wNoXnJs8iY7rUg=
 github.com/Microsoft/hcsshim v0.8.7/go.mod h1:OHd7sQqRFrYd3RmSgbgji+ctCwkbq2wbEYNSzOYtcBQ=
@@ -125,16 +123,20 @@ github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRF
 github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
 github.com/alessio/shellescape v1.4.1 h1:V7yhSDDn8LP4lc4jS8pFkt0zCnzVJlG5JXy9BVKJUX0=
 github.com/alessio/shellescape v1.4.1/go.mod h1:PZAiSCk0LJaZkiCSkPv8qIobYglO3FPpyFjDCtHLS30=
+github.com/alexbrainman/sspi v0.0.0-20180613141037-e580b900e9f5/go.mod h1:976q2ETgjT2snVCf2ZaBnyBbVoPERGjUz+0sofzEfro=
 github.com/alexflint/go-filemutex v0.0.0-20171022225611-72bdc8eae2ae/go.mod h1:CgnQgUtFrFz9mxFNtED3jI5tLDjKlOM+oUF/sTk6ps0=
 github.com/anmitsu/go-shlex v0.0.0-20161002113705-648efa622239/go.mod h1:2FmKhYUyUczH0OGQWaF5ceTx0UBShxjsH6f8oGKYe2c=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
 github.com/apache/arrow/go/arrow v0.0.0-20210818145353-234c94e4ce64/go.mod h1:2qMFB56yOP3KzkB3PbYZ4AlUFg3a88F67TIx5lB/WwY=
 github.com/apache/arrow/go/arrow v0.0.0-20211013220434-5962184e7a30/go.mod h1:Q7yQnSMnLvcXlZ8RV+jwz/6y1rQTqbX6C82SndT52Zs=
+github.com/apparentlymart/go-dump v0.0.0-20190214190832-042adf3cf4a0 h1:MzVXffFUye+ZcSR6opIgz9Co7WcDx6ZcY+RjfFHoA0I=
 github.com/apparentlymart/go-textseg v1.0.0/go.mod h1:z96Txxhf3xSFMPmb5X/1W05FF/Nj9VFpLOpjS5yuumk=
 github.com/apparentlymart/go-textseg/v12 v12.0.0/go.mod h1:S/4uRK2UtaQttw1GenVJEynmyUenKwP++x/+DdGV/Ec=
 github.com/apparentlymart/go-textseg/v13 v13.0.0 h1:Y+KvPE1NYz0xl601PVImeQfFyEy6iT90AvPUL1NNfNw=
 github.com/apparentlymart/go-textseg/v13 v13.0.0/go.mod h1:ZK2fH7c4NqDTLtiYLvIkEghdlcqw7yxLeM89kiTRPUo=
 github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
+github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
+github.com/armon/go-metrics v0.3.9 h1:O2sNqxBdvq8Eq5xmzljcYzAORli6RWCvEym4cJf9m18=
 github.com/armon/go-metrics v0.3.9/go.mod h1:4O98XIr/9W0sxpJ8UaYkvjk10Iff7SnFrb4QAOwNTFc=
 github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI=
@@ -189,13 +191,11 @@ github.com/buger/jsonparser v0.0.0-20180808090653-f4dd9f5a6b44/go.mod h1:bbYlZJ7
 github.com/bugsnag/bugsnag-go v0.0.0-20141110184014-b1d153021fcd/go.mod h1:2oa8nejYd4cQ/b0hMIopN0lCRxU0bueqREvZLWFrtK8=
 github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b/go.mod h1:obH5gd0BsqsP2LwDJ9aOkm/6J86V6lyAXCoQWGw3K50=
 github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0/go.mod h1:D/8v3kj0zr8ZAKg1AQ6crr+5VwKN5eIywRkfhyM/+dE=
-github.com/cenkalti/backoff v2.2.1+incompatible h1:tNowT99t7UNflLxfYYSlKYsBpXdEet03Pg2g16Swow4=
-github.com/cenkalti/backoff v2.2.1+incompatible/go.mod h1:90ReRw6GdpyfrHakVjL/QHaoyV4aDUVVkXQJJJ3NXXM=
 github.com/cenkalti/backoff/v3 v3.0.0 h1:ske+9nBpD9qZsTBoF41nW5L+AIuFBKMeze18XQ3eG1c=
 github.com/cenkalti/backoff/v3 v3.0.0/go.mod h1:cIeZDE3IrqwwJl6VUwCN6trj1oXrTS4rc0ij+ULvLYs=
 github.com/cenkalti/backoff/v4 v4.0.2/go.mod h1:eEew/i+1Q6OrCDZh3WiXYv3+nJwBASZ8Bog/87DQnVg=
-github.com/cenkalti/backoff/v4 v4.2.0 h1:HN5dHm3WBOgndBH6E8V0q2jIYIR3s9yglV8k/+MN3u4=
-github.com/cenkalti/backoff/v4 v4.2.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/cenkalti/backoff/v4 v4.1.3 h1:cFAlzYUlVYDysBEH2T5hyJZMh3+5+WCBvSnK6Q8UtC4=
+github.com/cenkalti/backoff/v4 v4.1.3/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
@@ -260,10 +260,13 @@ github.com/containerd/containerd v1.5.0-beta.3/go.mod h1:/wr9AVtEM7x9c+n0+stptlo
 github.com/containerd/containerd v1.5.0-beta.4/go.mod h1:GmdgZd2zA2GYIBZ0w09ZvgqEq8EfBp/m3lcVZIvPHhI=
 github.com/containerd/containerd v1.5.0-rc.0/go.mod h1:V/IXoMqNGgBlabz3tHD2TWDoTJseu1FGOKuoA4nNb2s=
 github.com/containerd/containerd v1.5.1/go.mod h1:0DOxVqwDy2iZvrZp2JUx/E+hS0UNTVn7dJnIOwtYR4g=
+github.com/containerd/containerd v1.5.7 h1:rQyoYtj4KddB3bxG6SAqd4+08gePNyJjRqvOIfV3rkM=
 github.com/containerd/containerd v1.5.7/go.mod h1:gyvv6+ugqY25TiXxcZC3L5yOeYgEw0QMhscqVp1AR9c=
 github.com/containerd/continuity v0.0.0-20190426062206-aaeac12a7ffc/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
 github.com/containerd/continuity v0.0.0-20190815185530-f2a389ac0a02/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
+github.com/containerd/continuity v0.0.0-20190827140505-75bee3e2ccb6/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
 github.com/containerd/continuity v0.0.0-20191127005431-f65d91d395eb/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
+github.com/containerd/continuity v0.0.0-20200413184840-d3ef23f19fbb/go.mod h1:Dq467ZllaHgAtVp4p1xUQWBrFXR9s/wyoTpG8zOJGkY=
 github.com/containerd/continuity v0.0.0-20200710164510-efbc4488d8fe/go.mod h1:cECdGN1O8G9bgKTlLhuPJimka6Xb/Gg7vYzCTNVxhvo=
 github.com/containerd/continuity v0.0.0-20201208142359-180525291bb7/go.mod h1:kR3BEg7bDFaEddKm54WSmrol1fKWDU1nKYkgrcgZT7Y=
 github.com/containerd/continuity v0.0.0-20210208174643-50096c924a4e/go.mod h1:EXlVlkqNba9rJe3j7w3Xa924itAMLgZH4UD/Q4PExuQ=
@@ -317,8 +320,8 @@ github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc
 github.com/coreos/go-iptables v0.4.5/go.mod h1:/mVI274lEDI2ns62jHCDnCyBF9Iwsmekav8Dbxlm1MU=
 github.com/coreos/go-iptables v0.5.0/go.mod h1:/mVI274lEDI2ns62jHCDnCyBF9Iwsmekav8Dbxlm1MU=
 github.com/coreos/go-oidc v2.1.0+incompatible/go.mod h1:CgnwVTmzoESiwO9qyAFEMiHoZ1nMCKZlZ9V6mm3/LKc=
-github.com/coreos/go-oidc/v3 v3.5.0 h1:VxKtbccHZxs8juq7RdJntSqtXFtde9YpNpGn0yqgEHw=
-github.com/coreos/go-oidc/v3 v3.5.0/go.mod h1:ecXRtV4romGPeO6ieExAsUK9cb/3fp9hXNz1tlv8PIM=
+github.com/coreos/go-oidc/v3 v3.1.0 h1:6avEvcdvTa1qYsOZ6I5PRkSYHzpTNWgKYmaJfaYbrRw=
+github.com/coreos/go-oidc/v3 v3.1.0/go.mod h1:rEJ/idjfUyfkBit1eI1fvyr+64/g9dcKpAm8MJMesvo=
 github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
 github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
 github.com/coreos/go-systemd v0.0.0-20161114122254-48702e0da86b/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
@@ -334,8 +337,8 @@ github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:ma
 github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/creack/pty v1.1.11 h1:07n33Z8lZxZ2qwegKbObQohDhXDQxiMMz1NOUGYlesw=
 github.com/creack/pty v1.1.11/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
 github.com/cyphar/filepath-securejoin v0.2.2/go.mod h1:FpkQEhXnPnOthhzymB7CGsFk2G9VLXONKD9G7QGMM+4=
 github.com/cyphar/filepath-securejoin v0.2.3/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
 github.com/cznic/mathutil v0.0.0-20180504122225-ca4c9f2c1369/go.mod h1:e6NPNENfs9mPDVNRekM7lKScauxd5kXTr1Mfyig6TDM=
@@ -343,8 +346,9 @@ github.com/d2g/dhcp4 v0.0.0-20170904100407-a1d1b6c41b1c/go.mod h1:Ct2BUK8SB0YC1S
 github.com/d2g/dhcp4client v1.0.0/go.mod h1:j0hNfjhrt2SxUOw55nL0ATM/z4Yt3t2Kd1mW34z5W5s=
 github.com/d2g/dhcp4server v0.0.0-20181031114812-7d4a0a7f59a5/go.mod h1:Eo87+Kg/IX2hfWJfwxMzLyuSZyxSoAug2nGa1G2QAi8=
 github.com/d2g/hardwareaddr v0.0.0-20190221164911-e7d9fbe030e4/go.mod h1:bMl4RjIciD2oAxI7DmWRx6gbeqrkoLqv3MV0vzNad+I=
-github.com/danieljoos/wincred v1.2.0 h1:ozqKHaLK0W/ii4KVbbvluM91W2H3Sh0BncbUNPS7jLE=
-github.com/danieljoos/wincred v1.2.0/go.mod h1:FzQLLMKBFdvu+osBrnFODiv32YGwCfx0SkRa/eYHgec=
+github.com/danieljoos/wincred v1.1.0/go.mod h1:XYlo+eRTsVA9aHGp7NGjFkPla4m+DCL7hqDjlFjiygg=
+github.com/danieljoos/wincred v1.1.2 h1:QLdCxFs1/Yl4zduvBdcHB8goaYk9RARS2SgLLRuAyr0=
+github.com/danieljoos/wincred v1.1.2/go.mod h1:GijpziifJoIBfYh+S7BbkdUTU4LfM+QnGqR5Vl2tAx0=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -358,24 +362,22 @@ github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8
 github.com/dhui/dktest v0.3.7 h1:jWjWgHAPDAdqgUr7lAsB3bqB2DKWC3OaA+isfekjRew=
 github.com/dhui/dktest v0.3.7/go.mod h1:nYMOkafiA07WchSwKnKFUSbGMb2hMm5DrCGiXYG6gwM=
 github.com/dnaeon/go-vcr v1.0.1/go.mod h1:aBB1+wY4s93YsC3HHjMBMrwTj2R9FHDzUr9KyGc8n1E=
-github.com/docker/cli v23.0.1+incompatible h1:LRyWITpGzl2C9e9uGxzisptnxAn1zfZKXy13Ul2Q5oM=
-github.com/docker/cli v23.0.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v20.10.14+incompatible h1:dSBKJOVesDgHo7rbxlYjYsXe7gPzrTT+/cKQgpDAazg=
+github.com/docker/cli v20.10.14+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v0.0.0-20190905152932-14b96e55d84c/go.mod h1:0+TTO4EOBfRPhZXAeF1Vu+W3hHZ8eLp8PgKVZlcvtFY=
 github.com/docker/distribution v2.7.1-0.20190205005809-0d3efadf0154+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/distribution v2.7.1+incompatible h1:a5mlkVzth6W5A4fOsS3D2EO5BUmsJpcB+cRlLU7cSug=
 github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
+github.com/docker/docker v20.10.9+incompatible h1:JlsVnETOjM2RLQa0Cc1XCIspUdXW3Zenq9P54uXBm6k=
 github.com/docker/docker v20.10.9+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker v23.0.3+incompatible h1:9GhVsShNWz1hO//9BNg/dpMnZW25KydO4wtVxWAIbho=
-github.com/docker/docker v23.0.3+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
 github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
 github.com/docker/go-events v0.0.0-20170721190031-9461782956ad/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
 github.com/docker/go-metrics v0.0.0-20180209012529-399ea8c73916/go.mod h1:/u0gXw0Gay3ceNrsHubL3BtdOL2fHf93USgMTe0W5dI=
 github.com/docker/go-metrics v0.0.1/go.mod h1:cG1hvH2utMXtqgqqYE9plW6lDxS3/5ayHzueweSI3Vw=
+github.com/docker/go-units v0.4.0 h1:3uh0PgVws3nIA0Q+MwDC8yjEPf9zjRfZZWXZYDct3Tw=
 github.com/docker/go-units v0.4.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
-github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
-github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/docker/libtrust v0.0.0-20150114040149-fa567046d9b1/go.mod h1:cyGadeNEkKy96OOhEzfZl+yxihPEzKnqJwvfuSUqbZE=
 github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96/go.mod h1:Qh8CwZgvJUkLughtfhJv5dyTYa91l1fOUCrgjqmcifM=
 github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
@@ -404,8 +406,8 @@ github.com/evanphx/json-patch v4.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLi
 github.com/evanphx/json-patch/v5 v5.5.0/go.mod h1:G79N1coSVB93tBe7j6PhzjmR3/2VvlbKOFpnXhI9Bw4=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
-github.com/fatih/color v1.15.0 h1:kOqh6YHBtK8aywxGerMG2Eq3H6Qgoqeo13Bk2Mv/nBs=
-github.com/fatih/color v1.15.0/go.mod h1:0h5ZqXfHYED7Bhv2ZJamyIOUej9KtShiJESRwBDUSsw=
+github.com/fatih/color v1.14.1 h1:qfhVLaG5s+nCROl1zJsZRxFeYrHLqWroPOQ8BWiNb4w=
+github.com/fatih/color v1.14.1/go.mod h1:2oHN61fhTpgcxD3TSWCgKDiH1+x4OiDVVGH8WlgGZGg=
 github.com/fatih/structs v1.1.0 h1:Q7juDM0QtcnhCpeyLGQKyg4TOIghuNXrkL32pHAUMxo=
 github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga6PJ7M=
 github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
@@ -415,6 +417,7 @@ github.com/form3tech-oss/jwt-go v3.2.2+incompatible/go.mod h1:pbq4aXjuKjdthFRnoD
 github.com/form3tech-oss/jwt-go v3.2.5+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
 github.com/frankban/quicktest v1.10.0/go.mod h1:ui7WezCLWMWxVWr1GETZY3smRy0G4KWq9vcPtJmFl7Y=
 github.com/frankban/quicktest v1.11.3/go.mod h1:wRf/ReqHper53s+kmmSZizM8NamnL3IM0I9ntUbOk+k=
+github.com/frankban/quicktest v1.13.0/go.mod h1:qLE0fzW0VuyUAJgPU19zByoIr0HtCHN/r/VLSOOIySU=
 github.com/frankban/quicktest v1.14.3 h1:FJKSZTDHjyhriyC81FLQ0LY93eSai0ZyR/ZIkd3ZUKE=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
@@ -427,8 +430,6 @@ github.com/ghodss/yaml v0.0.0-20150909031657-73d445a93680/go.mod h1:4dBDuWmgqj2H
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/gliderlabs/ssh v0.2.2/go.mod h1:U7qILu1NlMHj9FlMhZLlkCdDnU1DBEAqr0aevW3Awn0=
 github.com/go-asn1-ber/asn1-ber v1.3.1/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
-github.com/go-asn1-ber/asn1-ber v1.5.4 h1:vXT6d/FNDiELJnLb6hGNa309LMsrCoYFvpwHDF0+Y1A=
-github.com/go-asn1-ber/asn1-ber v1.5.4/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
 github.com/go-fonts/dejavu v0.1.0/go.mod h1:4Wt4I4OU2Nq9asgDCteaAaWZOV24E+0/Pwo0gppep4g=
 github.com/go-fonts/latin-modern v0.2.0/go.mod h1:rQVLdDMK+mK1xscDwsqM5J8U2jrRa3T0ecnM9pNujks=
 github.com/go-fonts/liberation v0.1.1/go.mod h1:K6qoJYypsmfVjWg8KOVDQhLc8UDgIK2HYqyqAO9z7GY=
@@ -445,15 +446,12 @@ github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-ini/ini v1.25.4/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
-github.com/go-jose/go-jose/v3 v3.0.0 h1:s6rrhirfEP/CGIoc6p+PZAeogN2SxKav6Wp7+dyMWVo=
-github.com/go-jose/go-jose/v3 v3.0.0/go.mod h1:RNkWWRld676jZEYoV3+XK8L2ZnNSvIsxFMht0mSX+u8=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
 github.com/go-latex/latex v0.0.0-20210118124228-b3d85cf34e07/go.mod h1:CO1AlKB2CSIqUrmQPqA0gdRIlnLEY0gK5JGjh37zN5U=
+github.com/go-ldap/ldap v3.0.2+incompatible/go.mod h1:qfd9rJvER9Q0/D/Sqn1DfHRoBp40uXYvFoEVrNEPqRc=
 github.com/go-ldap/ldap/v3 v3.1.10/go.mod h1:5Zun81jBTabRaI8lzN7E1JjyEl1g6zI6u9pd8luAK4Q=
-github.com/go-ldap/ldap/v3 v3.4.4 h1:qPjipEpt+qDa6SI/h1fzuGWoRUY+qqQ9sOZq67/PYUs=
-github.com/go-ldap/ldap/v3 v3.4.4/go.mod h1:fe1MsuN5eJJ1FeLT/LEBVdWfNWKh459R7aXgXtJC+aI=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
@@ -471,6 +469,7 @@ github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG
 github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
 github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfCHuOE=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/go-test/deep v1.0.2-0.20181118220953-042da051cf31/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
 github.com/go-test/deep v1.0.2/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
 github.com/go-test/deep v1.0.4 h1:u2CU3YKy9I2pmu9pX0eq50wCgjfGIt539SqR7FbHiho=
 github.com/go-test/deep v1.0.4/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
@@ -505,9 +504,8 @@ github.com/godbus/dbus v0.0.0-20180201030542-885f9cc04c9c/go.mod h1:/YcGZj5zSblf
 github.com/godbus/dbus v0.0.0-20190422162347-ade71ed3457e/go.mod h1:bBOAhwG1umN6/6ZUMtDFBMQR8jRg9O75tm9K00oMsK4=
 github.com/godbus/dbus/v5 v5.0.3/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/godbus/dbus/v5 v5.0.6 h1:mkgN1ofwASrYnJ5W6U/BxG15eXXXjirgZc7CLqkcaro=
 github.com/godbus/dbus/v5 v5.0.6/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=
-github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gofrs/uuid v3.2.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
 github.com/gofrs/uuid v4.0.0+incompatible h1:1SD/1F5pU8p29ybwgQSwpQk+mwdRrXCYuPhW6m+TnJw=
 github.com/gofrs/uuid v4.0.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
@@ -526,7 +524,7 @@ github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe h1:lXe2qZdvpiX5WZ
 github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
 github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGwJL78qG/PmXZO1EjYhfJinVAhrmmHX6Z8B9k=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/glog v1.1.0 h1:/d3pCKDPWNnvIWe0vVUpNP32qc8U3PDVxySP/y360qE=
+github.com/golang/glog v1.0.0 h1:nfP3RFugxnNRyKgeWd4oI1nYvXpxrx8ck8ZrcizshdQ=
 github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -559,12 +557,12 @@ github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw
 github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/golang/protobuf v1.5.1/go.mod h1:DopwsBzvsk0Fs44TXzsVbJyPhcCPeIwnvohx4u74HPM=
+github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golang/snappy v0.0.0-20170215233205-553a64147049/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
 github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
@@ -581,7 +579,6 @@ github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-github/v35 v35.2.0/go.mod h1:s0515YVTI+IMrDoy9Y4pHt9ShGpzHvHO8rZ7L7acgvs=
@@ -624,6 +621,8 @@ github.com/gorilla/handlers v1.4.2/go.mod h1:Qkdc/uu4tH4g6mTK6auzZ766c4CA0Ng8+o/
 github.com/gorilla/mux v1.7.2/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
 github.com/gorilla/mux v1.7.3/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
 github.com/gorilla/mux v1.7.4/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
+github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
+github.com/gorilla/sessions v1.2.0/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
 github.com/gorilla/websocket v0.0.0-20170926233335-4201258b820c/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
 github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
 github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
@@ -636,31 +635,29 @@ github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgf
 github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
 github.com/grpc-ecosystem/grpc-gateway v1.9.5/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 h1:YBftPWNWd4WwGqtY2yeZL2ef8rHAxPBD8KFhJpmcqms=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0/go.mod h1:YN5jB8ie0yfIUg6VvR9Kz84aCaG7AsGZnLjhHbUqwPg=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.2 h1:BqHID5W5qnMkug0Z8UmL8tN0gAy4jQ+B4WFt8cCgluU=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.2/go.mod h1:ZbS3MZTZq/apAfAEHGoB5HbsQQstoqP92SjAqtQ9zeg=
 github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed/go.mod h1:tMWxXQ9wFIaZeTI9F+hmhFiGpFmhOHzyShyFUhRm0H4=
-github.com/hashicorp/boundary v0.13.0 h1:7BP7nP4G2Spm3PIfoIJiPziE5Khnzj6OmKpIVpyT04o=
-github.com/hashicorp/boundary v0.13.0/go.mod h1:uPNjB54RTnCAsZTPoEuZBxPfQevg6QWwjV+9l6aD4oc=
-github.com/hashicorp/boundary/api v0.0.39 h1:ySzBcVhvA5uNeZmWJaJZuf+XW0wbpz9+0qUGFogAFrU=
-github.com/hashicorp/boundary/api v0.0.39/go.mod h1:WnI0eRlP03Kw3wlW+z5va2vvG1OAupZHPsPuEm4pLiQ=
-github.com/hashicorp/boundary/sdk v0.0.35 h1:xVMDxUtQMF0p6o2s0DVehSFR9m3ZCkBACYxTEzUI6Lo=
-github.com/hashicorp/boundary/sdk v0.0.35/go.mod h1:jn9j5mM8v2pOk8aLeJNIszdm7WBf4gRSP68iy8Iu5Q0=
-github.com/hashicorp/cap v0.3.1 h1:JwX2vg3KIl2+ka4VIPB0yWB9PoPvHL3ACmVrLJLCHDQ=
-github.com/hashicorp/cap v0.3.1/go.mod h1:dHTmyMIVbzT981XxRoci5G//dfWmd/HhuNiCH6J5+IA=
-github.com/hashicorp/cap/ldap v0.0.0-20230420150311-6d1e00a6c5e0 h1:SFcUsFwjBHGMIXixe/FpNsBlQBJwwXITD936LewHbHs=
-github.com/hashicorp/cap/ldap v0.0.0-20230420150311-6d1e00a6c5e0/go.mod h1:9rAvcOfZF5fAYoN4GRtEI5w0F9Uj/oDAqMndkoRnPrI=
-github.com/hashicorp/dbassert v0.0.0-20230405175854-2d88acd5134b h1:ME5fs1tsrPeLqQj+V4UeV9bf+66rCfHKIOVnwrsQ9xU=
-github.com/hashicorp/dbassert v0.0.0-20230405175854-2d88acd5134b/go.mod h1:HtjQavQIyrfiRZ98IwxIF9Chf99jwa4gcdgI4lss1BA=
+github.com/hashicorp/boundary v0.12.2 h1:YIznMoE/6rOvGNRSD/9hLq2fWqeqAvTG0u4L0xaCnAc=
+github.com/hashicorp/boundary v0.12.2/go.mod h1:9/OSJwoBCKbBqojx2XdGWO0ZC9HH0vD/yq+kYhTenwE=
+github.com/hashicorp/boundary/api v0.0.34 h1:A5G6XtJu6eG8A0sB5alS1fr9Z0jZHZBIqJRF8E5nnI4=
+github.com/hashicorp/boundary/api v0.0.34/go.mod h1:yroNrsyCVCSEKnrbyDeyS2iO0aMq7BTYtAptZWgIb60=
+github.com/hashicorp/boundary/sdk v0.0.30 h1:+EOjA2Xb51Y7c0fG8lw0lmwpl2ZC3b+1M8nJIh6HlVg=
+github.com/hashicorp/boundary/sdk v0.0.30/go.mod h1:q5eFsoCnYMgnX+smkbkOOzqjVWIUupWNMKIa53SQLZA=
+github.com/hashicorp/cap v0.2.0 h1:Cgr1iDczX17y0PNF5VG+bWTtDiimYL8F18izMPbWNy4=
+github.com/hashicorp/cap v0.2.0/go.mod h1:zb3VvIFA0lM2lbmO69NjowV9dJzJnZS89TaM9blXPJA=
+github.com/hashicorp/dbassert v0.0.0-20210708202608-ecf920cf1ed8 h1:/3iubtqEdLgdXB6ue+WAKvbcpn313jjL5mQvU5ByymE=
+github.com/hashicorp/dbassert v0.0.0-20210708202608-ecf920cf1ed8/go.mod h1:+B5eZq7vXqN4Gxkgjm4ub1bwG6OTcYzFL0r+bMvWorg=
 github.com/hashicorp/errwrap v0.0.0-20141028054710-7554cd9344ce/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/eventlogger v0.1.2-0.20230428153751-cca445805f24 h1:vtCJgcxwDMFrpUgVMfjtwXY1YqvHbj8pNA7GsXYEoLg=
-github.com/hashicorp/eventlogger v0.1.2-0.20230428153751-cca445805f24/go.mod h1://CHt6/j+Q2lc0NlUB5af4aS2M0c0aVBg9/JfcpAyhM=
-github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20230428153751-cca445805f24 h1:mopKPTxSaVr24uSysyRwywTDs85L5b05qqZvEkWa0qc=
-github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20230428153751-cca445805f24/go.mod h1:EQPLoX6CONA9BSYUovTQBHfPGE91g7wOxv03sO29FzY=
-github.com/hashicorp/go-bexpr v0.1.12 h1:XrdVhmwu+9iYxIUWxsGVG7NQwrhzJZ0vR6nbN5bLgrA=
-github.com/hashicorp/go-bexpr v0.1.12/go.mod h1:ACktpcSySkFNpcxWSClFrut7wicd9WzisnvHuw+g9K8=
+github.com/hashicorp/eventlogger v0.1.2-0.20230227112545-f26a3bdf6871 h1:F5Q9e2zB5xxItZKb7PI3+DVRHajMyVXnulBgbnQqcDU=
+github.com/hashicorp/eventlogger v0.1.2-0.20230227112545-f26a3bdf6871/go.mod h1://CHt6/j+Q2lc0NlUB5af4aS2M0c0aVBg9/JfcpAyhM=
+github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20230227112545-f26a3bdf6871 h1:PETLEST31DMXHOibJLl/nvcc5Tz4mo6eaXdCxT+lebQ=
+github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20230227112545-f26a3bdf6871/go.mod h1:EQPLoX6CONA9BSYUovTQBHfPGE91g7wOxv03sO29FzY=
+github.com/hashicorp/go-bexpr v0.1.10 h1:9kuI5PFotCboP3dkDYFr/wi0gg0QVbSNz5oFRpxn4uE=
+github.com/hashicorp/go-bexpr v0.1.10/go.mod h1:oxlubA2vC/gFVfX1A6JGp7ls7uCDlfJn732ehYYg+g0=
 github.com/hashicorp/go-checkpoint v0.5.0 h1:MFYpPZCnQqQTE18jFwSII6eUQrD/oxMFp3mlgcqk5mU=
 github.com/hashicorp/go-checkpoint v0.5.0/go.mod h1:7nfLNL10NsxqO4iWuW6tWW0HjZuDrwkBuEQsVcpCOgg=
 github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
@@ -669,31 +666,37 @@ github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9n
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
 github.com/hashicorp/go-cty v1.4.1-0.20200723130312-85980079f637 h1:Ud/6/AdmJ1R7ibdS0Wo5MWPj0T1R0fkpaD087bBaW8I=
 github.com/hashicorp/go-cty v1.4.1-0.20200723130312-85980079f637/go.mod h1:EiZBMaudVLy8fmjf9Npq1dq9RalhveqZG5w/yz3mHWs=
-github.com/hashicorp/go-dbw v0.0.0-20230605211904-d40e5c9d5995 h1:2I5x7ULbjbQVxIvrVhBZU9gXXj/4UcApBuvKf5Rb3Ts=
-github.com/hashicorp/go-dbw v0.0.0-20230605211904-d40e5c9d5995/go.mod h1:5bmfUkVf0I4E3tIftLJdBM8vw1Xqe7pmbeYBzdC1cj8=
+github.com/hashicorp/go-dbw v0.0.0-20220910135738-ed4505749995 h1:+cSg/gVZ1RMFeZbZoQTbNu8pnb30bDQ6jysmKBKDSvg=
+github.com/hashicorp/go-dbw v0.0.0-20220910135738-ed4505749995/go.mod h1:+GVM0D4y16TzXQWrVZKv3cjNHF2M7cHEBPaDAON3V6I=
+github.com/hashicorp/go-hclog v0.0.0-20180709165350-ff2cf002a8dd/go.mod h1:9bjs9uLqI8l75knNv3lV1kA55veR+WUPSiKIWcQHudI=
+github.com/hashicorp/go-hclog v0.8.0/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
 github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
 github.com/hashicorp/go-hclog v0.14.1/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
 github.com/hashicorp/go-hclog v0.16.2/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
-github.com/hashicorp/go-hclog v1.5.0 h1:bI2ocEMgcVlz55Oj1xZNBsVi900c7II+fWDyV9o+13c=
-github.com/hashicorp/go-hclog v1.5.0/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
+github.com/hashicorp/go-hclog v1.0.0/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
+github.com/hashicorp/go-hclog v1.3.1 h1:vDwF1DFNZhntP4DAjuTpOw3uEgMUpXh1pB5fW9DqHpo=
+github.com/hashicorp/go-hclog v1.3.1/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
 github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
+github.com/hashicorp/go-immutable-radix v1.3.1 h1:DKHmCUm2hRBK510BaiZlwvpD40f8bJFeZnpfm2KLowc=
 github.com/hashicorp/go-immutable-radix v1.3.1/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
 github.com/hashicorp/go-kms-wrapping/entropy v0.1.0/go.mod h1:d1g9WGtAunDNpek8jUIEJnBlbgKS1N2Q61QkHiZyR1g=
 github.com/hashicorp/go-kms-wrapping/extras/kms/v2 v2.0.0-20221122211539-47c893099f13 h1:486QccSsJAKonkWSZmBn5GWzZCW3UV3OwMoOGUXJBO4=
 github.com/hashicorp/go-kms-wrapping/extras/kms/v2 v2.0.0-20221122211539-47c893099f13/go.mod h1:qbLdiZhFd182vRSOlhBV/OarUcJVTOF2WklPwHs8mYQ=
-github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.4 h1:8z+Zi0uLYXONkxwWb/D7O5t1IUucB6Ft3uvSOa950bM=
-github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.4/go.mod h1:14nTD5iNDQ8xceINamYjAA2xIgImLGXQSIMaa5tFYQI=
-github.com/hashicorp/go-kms-wrapping/v2 v2.0.10-0.20230601143830-08d524b564ba h1:+bH/GWsIJdPmSuTo3t5kdY0vDxJmUGNFsI9MqkvAx+8=
-github.com/hashicorp/go-kms-wrapping/v2 v2.0.10-0.20230601143830-08d524b564ba/go.mod h1:NtMaPhqSlfQ72XWDD2g80o8HI8RKkowIB8/WZHMyPY4=
+github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.3 h1:RcEyqlOdRXgiTF8pXXbYim1ga7qiWvCEcB+DNsGnxAA=
+github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.3/go.mod h1:e/xXrQ8uKG1GEEseVg6l0XKVaOtYggl75MPd6osZQ0I=
+github.com/hashicorp/go-kms-wrapping/v2 v2.0.9-0.20230315135303-7bedb33a2280 h1:z6DejONsrp3SxXZQ9znFX0g7zf903zndM1NAvr27Sl8=
+github.com/hashicorp/go-kms-wrapping/v2 v2.0.9-0.20230315135303-7bedb33a2280/go.mod h1:VuJDBrF0EOt8JswgdKlvQbRpKu7KBKzmv6++A2vPW7c=
 github.com/hashicorp/go-multierror v0.0.0-20161216184304-ed905158d874/go.mod h1:JMRHfdO9jKNzS/+BTlxCjKNQHg/jZAft8U7LloJvN7I=
 github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
 github.com/hashicorp/go-multierror v1.1.0/go.mod h1:spPvp8C1qA32ftKqdAHm4hHTbPw+vmowP0z+KUhOZdA=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
+github.com/hashicorp/go-plugin v1.0.1/go.mod h1:++UyYGoz3o5w9ZzAdZxtQKrWWP+iqPBn3cQptSMzBuY=
 github.com/hashicorp/go-plugin v1.4.3/go.mod h1:5fGEH17QVwTTcR0zV7yhDPLLmFX9YSZ38b18Udy6vYQ=
 github.com/hashicorp/go-plugin v1.4.9 h1:ESiK220/qE0aGxWdzKIvRH69iLiuN/PjoLTm69RoWtU=
 github.com/hashicorp/go-plugin v1.4.9/go.mod h1:viDMjcLJuDui6pXb8U4HVfb8AamCWhHGUjr2IrTF67s=
 github.com/hashicorp/go-retryablehttp v0.5.3/go.mod h1:9B5zBasrRhHXnJnui7y6sL7es7NDiJgTc6Er0maI1Xs=
+github.com/hashicorp/go-retryablehttp v0.6.6/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
 github.com/hashicorp/go-retryablehttp v0.7.2 h1:AcYqCvkpalPnPF2pn0KamgwamS42TqUDDYFRKq/RAd0=
 github.com/hashicorp/go-retryablehttp v0.7.2/go.mod h1:Jy/gPYAdjqffZ/yFGCFV2doI5wjtH1ewM9u8iYVjtX8=
 github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
@@ -701,23 +704,22 @@ github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR3
 github.com/hashicorp/go-secure-stdlib/base62 v0.1.1/go.mod h1:EdWO6czbmthiwZ3/PUsDV+UD1D5IRU4ActiaWGwt0Yw=
 github.com/hashicorp/go-secure-stdlib/base62 v0.1.2 h1:ET4pqyjiGmY09R5y+rSd70J2w45CtbWDNvGqWp/R3Ng=
 github.com/hashicorp/go-secure-stdlib/base62 v0.1.2/go.mod h1:EdWO6czbmthiwZ3/PUsDV+UD1D5IRU4ActiaWGwt0Yw=
-github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.10 h1:q2vHmzl7Lz2y82PWW2SENDzgXQyM6ii2bAOeovuITYE=
-github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.10/go.mod h1:lc/OP8KkKxXB+v72mtzVnAAtdnlTxFUZmbeeH9qPAOQ=
+github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.7 h1:b1VFIL6LpAh7iVCoQdoZtXAHqfAClpGsESfZULhfGm0=
+github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.7/go.mod h1:3SpPba0gPDe21iawzV368GMEKJyG+MU7NgFwjW33w5o=
 github.com/hashicorp/go-secure-stdlib/gatedwriter v0.1.1 h1:9um9R8i0+HbRHS9d64kdvWR0/LJvo12sIonvR9zr1+U=
 github.com/hashicorp/go-secure-stdlib/gatedwriter v0.1.1/go.mod h1:6RoRTSMDK2H/rKh3P/JIsk1tK8aatKTt3JyvIopi3GQ=
-github.com/hashicorp/go-secure-stdlib/kv-builder v0.1.2 h1:NS6BHieb/pDfx3M9jDdaPpGyyVp+aD4A3DjX3dgRmzs=
-github.com/hashicorp/go-secure-stdlib/kv-builder v0.1.2/go.mod h1:rf5JPE13wi+NwjgsmGkbg4b2CgHq8v7Htn/F0nDe/hg=
-github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.7 h1:7c7yagwpCRKpnz2Ld3+HrZFajx9xgZZettJOkgUrXmU=
-github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.7/go.mod h1:Gbwv+gqdNaKMKQq+1c1Yl4OtX1khZ9qe3eYMhJqtGtI=
+github.com/hashicorp/go-secure-stdlib/kv-builder v0.1.1 h1:IJgULbAXuvWxzKFfu+Au1FUmHIJulS6N4F7Hkn+Kck0=
+github.com/hashicorp/go-secure-stdlib/kv-builder v0.1.1/go.mod h1:rf5JPE13wi+NwjgsmGkbg4b2CgHq8v7Htn/F0nDe/hg=
+github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.5 h1:+vfyObZczNFbpGxHJWTZ+ZdTEF9boRal5rAkwKTc2yg=
+github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.5/go.mod h1:MSXg3Md+eg1hOJFSKuTELy6YnFhfMJBVYu7t07BdPc4=
+github.com/hashicorp/go-secure-stdlib/mlock v0.1.1 h1:cCRo8gK7oq6A2L6LICkUZ+/a5rLiRXFMf1Qd4xSwxTc=
 github.com/hashicorp/go-secure-stdlib/mlock v0.1.1/go.mod h1:zq93CJChV6L9QTfGKtfBxKqD7BqqXx5O04A/ns2p5+I=
-github.com/hashicorp/go-secure-stdlib/mlock v0.1.3 h1:kH3Rhiht36xhAfhuHyWJDgdXXEx9IIZhDGRk24CDhzg=
-github.com/hashicorp/go-secure-stdlib/mlock v0.1.3/go.mod h1:ov1Q0oEDjC3+A4BwsG2YdKltrmEw8sf9Pau4V9JQ4Vo=
 github.com/hashicorp/go-secure-stdlib/parseutil v0.1.1/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=
 github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7 h1:UpiO20jno/eV1eVZcxqWnUohyKRe1g8FPV/xH1s/2qs=
 github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=
 github.com/hashicorp/go-secure-stdlib/password v0.1.1/go.mod h1:9hH302QllNwu1o2TGYtSk8I8kTAN0ca1EHpwhm5Mmzo=
-github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.4 h1:IU2iGcvthrJ53rPbQU6B4+iVs/cLPO89ti5dd2XEj3k=
-github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.4/go.mod h1:TDJ8YE+fJNEW7OQUqL9RjB6SPieLUxvKzrt8u19qOkg=
+github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.3 h1:2RnQ/iL17y9FIwGR+ZaPj7fMn2uzdZT+T5ptCi97q8c=
+github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.3/go.mod h1:M+NBT0f9tDBLuhZFAwUwQjAcxMLmwEyHiPQm1O2pBVs=
 github.com/hashicorp/go-secure-stdlib/reloadutil v0.1.1 h1:SMGUnbpAcat8rIKHkBPjfv81yC46a8eCNZ2hsR2l1EI=
 github.com/hashicorp/go-secure-stdlib/reloadutil v0.1.1/go.mod h1:Ch/bf00Qnx77MZd49JRgHYqHQjtEmTgGU2faufpVZb0=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U=
@@ -729,14 +731,17 @@ github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.2/go.mod h1:l8slYwnJA26yBz+Er
 github.com/hashicorp/go-sockaddr v1.0.2 h1:ztczhD1jLxIRjVejw8gFomI1BQZOe2WoVOu0SyteCQc=
 github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjGlgmH/UkBUC97A=
 github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go-version v1.1.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/go-version v1.2.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/go-version v1.6.0 h1:feTTfFNnjP967rlCxM/I9g701jU+RN74YKx2mOkIeek=
 github.com/hashicorp/go-version v1.6.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+lJfyTc=
 github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
 github.com/hashicorp/hc-install v0.5.0 h1:D9bl4KayIYKEeJ4vUDe9L5huqxZXczKaykSRcmQ0xY0=
 github.com/hashicorp/hc-install v0.5.0/go.mod h1:JyzMfbzfSBSjoDCRPna1vi/24BEDxFaCPfdHtM5SCdo=
@@ -746,8 +751,8 @@ github.com/hashicorp/hcl/v2 v2.16.2 h1:mpkHZh/Tv+xet3sy3F9Ld4FyI2tUpWe9x3XtPx9f1
 github.com/hashicorp/hcl/v2 v2.16.2/go.mod h1:JRmR89jycNkrrqnMmvPDMd56n1rQJ2Q6KocSLCMCXng=
 github.com/hashicorp/logutils v1.0.0 h1:dLEQVugN8vlakKOUE3ihGLTZJRB4j+M2cdTm/ORI65Y=
 github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
-github.com/hashicorp/nodeenrollment v0.2.4 h1:Rhdgtdd26Ng+r2+m6CDVWT8+wwQzN8y+6kApoc5Q91U=
-github.com/hashicorp/nodeenrollment v0.2.4/go.mod h1:Do2FvaFHgnnMaqhdSTBX+TkQP0ep8VVQ0rOr+ZjUbJU=
+github.com/hashicorp/nodeenrollment v0.1.18 h1:fqFMZ5e2cWupeQDxKledF9DGHsk9GoJl7K2Wrdiys6k=
+github.com/hashicorp/nodeenrollment v0.1.18/go.mod h1:N5gYsm8mWiDfIw/j+1IQ6NBO1cWCmhPpvQ9GB1QUnsU=
 github.com/hashicorp/terraform-exec v0.18.1 h1:LAbfDvNQU1l0NOQlTuudjczVhHj061fNX5H8XZxHlH4=
 github.com/hashicorp/terraform-exec v0.18.1/go.mod h1:58wg4IeuAJ6LVsLUeD2DWZZoc/bYi6dzhLHzxM41980=
 github.com/hashicorp/terraform-json v0.16.0 h1:UKkeWRWb23do5LNAFlh/K3N0ymn1qTOO8c+85Albo3s=
@@ -756,19 +761,21 @@ github.com/hashicorp/terraform-plugin-docs v0.14.1 h1:MikFi59KxrP/ewrZoaowrB9he5
 github.com/hashicorp/terraform-plugin-docs v0.14.1/go.mod h1:k2NW8+t113jAus6bb5tQYQgEAX/KueE/u8X2Z45V1GM=
 github.com/hashicorp/terraform-plugin-go v0.14.3 h1:nlnJ1GXKdMwsC8g1Nh05tK2wsC3+3BL/DBBxFEki+j0=
 github.com/hashicorp/terraform-plugin-go v0.14.3/go.mod h1:7ees7DMZ263q8wQ6E4RdIdR6nHHJtrdt4ogX5lPkX1A=
-github.com/hashicorp/terraform-plugin-log v0.8.0 h1:pX2VQ/TGKu+UU1rCay0OlzosNKe4Nz1pepLXj95oyy0=
-github.com/hashicorp/terraform-plugin-log v0.8.0/go.mod h1:1myFrhVsBLeylQzYYEV17VVjtG8oYPRFdaZs7xdW2xs=
-github.com/hashicorp/terraform-plugin-sdk/v2 v2.26.1 h1:G9WAfb8LHeCxu7Ae8nc1agZlQOSCUWsb610iAogBhCs=
-github.com/hashicorp/terraform-plugin-sdk/v2 v2.26.1/go.mod h1:xcOSYlRVdPLmDUoqPhO9fiO/YCN/l6MGYeTzGt5jgkQ=
+github.com/hashicorp/terraform-plugin-log v0.7.0 h1:SDxJUyT8TwN4l5b5/VkiTIaQgY6R+Y2BQ0sRZftGKQs=
+github.com/hashicorp/terraform-plugin-log v0.7.0/go.mod h1:p4R1jWBXRTvL4odmEkFfDdhUjHf9zcs/BCoNHAc7IK4=
+github.com/hashicorp/terraform-plugin-sdk/v2 v2.24.1 h1:zHcMbxY0+rFO9gY99elV/XC/UnQVg7FhRCbj1i5b7vM=
+github.com/hashicorp/terraform-plugin-sdk/v2 v2.24.1/go.mod h1:+tNlb0wkfdsDJ7JEiERLz4HzM19HyiuIoGzTsM7rPpw=
 github.com/hashicorp/terraform-registry-address v0.1.0 h1:W6JkV9wbum+m516rCl5/NjKxCyTVaaUBbzYcMzBDO3U=
 github.com/hashicorp/terraform-registry-address v0.1.0/go.mod h1:EnyO2jYO6j29DTHbJcm00E5nQTFeTtyZH3H5ycydQ5A=
 github.com/hashicorp/terraform-svchost v0.0.0-20200729002733-f050f53b9734 h1:HKLsbzeOsfXmKNpr3GiT18XAblV0BjCbzL8KQAMZGa0=
 github.com/hashicorp/terraform-svchost v0.0.0-20200729002733-f050f53b9734/go.mod h1:kNDNcF7sN4DocDLBkQYz73HGKwN1ANB1blq4lIYLYvg=
-github.com/hashicorp/vault/api v1.9.1 h1:LtY/I16+5jVGU8rufyyAkwopgq/HpUnxFBg+QLOAV38=
-github.com/hashicorp/vault/api v1.9.1/go.mod h1:78kktNcQYbBGSrOjQfHjXN32OhhxXnbYl3zxpd2uPUs=
+github.com/hashicorp/vault/api v1.3.1 h1:pkDkcgTh47PRjY1NEFeofqR4W/HkNUi9qIakESO2aRM=
+github.com/hashicorp/vault/api v1.3.1/go.mod h1:QeJoWxMFt+MsuWcYhmwRLwKEXrjwAFFywzhptMsTIUw=
+github.com/hashicorp/vault/sdk v0.1.13/go.mod h1:B+hVj7TpuQY1Y/GPbCpffmgd+tSEwvhkWnjtSYCaS2M=
 github.com/hashicorp/vault/sdk v0.3.0 h1:kR3dpxNkhh/wr6ycaJYqp6AFT/i2xaftbfnwZduTKEY=
 github.com/hashicorp/vault/sdk v0.3.0/go.mod h1:aZ3fNuL5VNydQk8GcLJ2TV8YCRVvyaakYkhZRoVuhj0=
 github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
+github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
 github.com/hashicorp/yamux v0.1.1 h1:yrQxtgseBDrq9Y652vSRDvsKCJKOUD+GzTS4Y0Y8pvE=
 github.com/hashicorp/yamux v0.1.1/go.mod h1:CtWFDAQgb7dxtzFs4tWbplKIe2jSi3+5vKbgIO0SLnQ=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
@@ -801,8 +808,8 @@ github.com/jackc/pgconn v1.5.1-0.20200601181101-fa742c524853/go.mod h1:QeD3lBfpT
 github.com/jackc/pgconn v1.8.0/go.mod h1:1C2Pb36bGIP9QHGBYCjnyhqu7Rv3sGshaQUvmfGIB/o=
 github.com/jackc/pgconn v1.9.0/go.mod h1:YctiPyvzfU11JFxoXokUOOKQXQmDMoJL9vJzHH8/2JY=
 github.com/jackc/pgconn v1.9.1-0.20210724152538-d89c8390a530/go.mod h1:4z2w8XhRbP1hYxkpTuBjTS3ne3J48K83+u0zoyvg2pI=
-github.com/jackc/pgconn v1.14.0 h1:vrbA9Ud87g6JdFWkHTJXppVce58qPIdP7N8y0Ml/A7Q=
-github.com/jackc/pgconn v1.14.0/go.mod h1:9mBNlny0UvkgJdCDvdVHYSjI+8tD2rnKK69Wz8ti++E=
+github.com/jackc/pgconn v1.12.1 h1:rsDFzIpRk7xT4B8FufgpCCeyjdNpKyghZeSefViE5W8=
+github.com/jackc/pgconn v1.12.1/go.mod h1:ZkhRC59Llhrq3oSfrikvwQ5NaxYExr6twkdkMLaKono=
 github.com/jackc/pgerrcode v0.0.0-20201024163028-a0d42d470451/go.mod h1:a/s9Lp5W7n/DD0VrVoyJ00FbP2ytTPDVOivvn2bMlds=
 github.com/jackc/pgio v1.0.0 h1:g12B9UwVnzGhueNavwioyEEpAmqMe1E/BN9ES+8ovkE=
 github.com/jackc/pgio v1.0.0/go.mod h1:oP+2QK2wFfUWgr+gxjoBH9KGBb31Eio69xUb0w5bYf8=
@@ -821,12 +828,11 @@ github.com/jackc/pgproto3/v2 v2.0.1/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwX
 github.com/jackc/pgproto3/v2 v2.0.6/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
 github.com/jackc/pgproto3/v2 v2.0.7/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
 github.com/jackc/pgproto3/v2 v2.1.1/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
-github.com/jackc/pgproto3/v2 v2.3.2 h1:7eY55bdBeCz1F2fTzSz69QC+pG46jYq9/jtSPiJ5nn0=
-github.com/jackc/pgproto3/v2 v2.3.2/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
+github.com/jackc/pgproto3/v2 v2.3.0 h1:brH0pCGBDkBW07HWlN/oSBXrmo3WB0UvZd1pIuDcL8Y=
+github.com/jackc/pgproto3/v2 v2.3.0/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
 github.com/jackc/pgservicefile v0.0.0-20200307190119-3430c5407db8/go.mod h1:vsD4gTJCa9TptPL8sPkXrLZ+hDuNrZCnj29CQpr4X1E=
+github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b h1:C8S2+VttkHFdOOCXJe+YGfa4vHYwlt4Zx+IVXQ97jYg=
 github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b/go.mod h1:vsD4gTJCa9TptPL8sPkXrLZ+hDuNrZCnj29CQpr4X1E=
-github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a h1:bbPeKD0xmW/Y25WS6cokEszi5g+S0QxI/d45PkRi7Nk=
-github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
 github.com/jackc/pgtype v0.0.0-20190421001408-4ed0de4755e0/go.mod h1:hdSHsc1V01CGwFsrv11mJRHWJ6aifDLfdV3aVjFF0zg=
 github.com/jackc/pgtype v0.0.0-20190824184912-ab885b375b90/go.mod h1:KcahbBH1nCMSo2DXpzsoWOAfFkdEtEJpPbVLq8eE+mc=
 github.com/jackc/pgtype v0.0.0-20190828014616-a8802b16cc59/go.mod h1:MWlu30kVJrUS8lot6TQqcg7mtthZ9T0EoIBFiJcmcyw=
@@ -835,8 +841,8 @@ github.com/jackc/pgtype v1.3.1-0.20200510190516-8cd94a14c75a/go.mod h1:vaogEUkAL
 github.com/jackc/pgtype v1.3.1-0.20200606141011-f6355165a91c/go.mod h1:cvk9Bgu/VzJ9/lxTO5R5sf80p0DiucVtN7ZxvaC4GmQ=
 github.com/jackc/pgtype v1.6.2/go.mod h1:JCULISAZBFGrHaOXIIFiyfzW5VY0GRitRr8NeJsrdig=
 github.com/jackc/pgtype v1.8.1-0.20210724151600-32e20a603178/go.mod h1:C516IlIV9NKqfsMCXTdChteoXmwgUceqaLfjg2e3NlM=
-github.com/jackc/pgtype v1.14.0 h1:y+xUdabmyMkJLyApYuPj38mW+aAIqCe5uuBB51rH3Vw=
-github.com/jackc/pgtype v1.14.0/go.mod h1:LUMuVrfsFfdKGLw+AFFVv6KtHOFMwRgDDzBt76IqCA4=
+github.com/jackc/pgtype v1.11.0 h1:u4uiGPz/1hryuXzyaBhSk6dnIyyG2683olG2OV+UUgs=
+github.com/jackc/pgtype v1.11.0/go.mod h1:LUMuVrfsFfdKGLw+AFFVv6KtHOFMwRgDDzBt76IqCA4=
 github.com/jackc/pgx/v4 v4.0.0-20190420224344-cc3461e65d96/go.mod h1:mdxmSJJuR08CZQyj1PVQBHy9XOp5p8/SHH6a0psbY9Y=
 github.com/jackc/pgx/v4 v4.0.0-20190421002000-1b8f0016e912/go.mod h1:no/Y67Jkk/9WuGR0JG/JseM9irFbnEPbuWV2EELPNuM=
 github.com/jackc/pgx/v4 v4.0.0-pre1.0.20190824185557-6972a5742186/go.mod h1:X+GQnOEnf1dqHGpw7JmHqHc1NxDoalibchSk9/RWuDc=
@@ -845,18 +851,22 @@ github.com/jackc/pgx/v4 v4.6.1-0.20200510190926-94ba730bb1e9/go.mod h1:t3/cdRQl6
 github.com/jackc/pgx/v4 v4.6.1-0.20200606145419-4e5062306904/go.mod h1:ZDaNWkt9sW1JMiNn0kdYBaLelIhw7Pg4qd+Vk6tw7Hg=
 github.com/jackc/pgx/v4 v4.10.1/go.mod h1:QlrWebbs3kqEZPHCTGyxecvzG6tvIsYu+A5b1raylkA=
 github.com/jackc/pgx/v4 v4.12.1-0.20210724153913-640aa07df17c/go.mod h1:1QD0+tgSXP7iUjYm9C1NxKhny7lq6ee99u/z+IHFcgs=
-github.com/jackc/pgx/v4 v4.18.1 h1:YP7G1KABtKpB5IHrO9vYwSrCOhs7p3uqhvhhQBptya0=
-github.com/jackc/pgx/v4 v4.18.1/go.mod h1:FydWkUyadDmdNH/mHnGob881GawxeEm7TcMCzkb+qQE=
-github.com/jackc/pgx/v5 v5.3.1 h1:Fcr8QJ1ZeLi5zsPZqQeUZhNhxfkkKBOgJuYkJHoBOtU=
-github.com/jackc/pgx/v5 v5.3.1/go.mod h1:t3JDKnCBlYIc0ewLF0Q7B8MXmoIaBOZj/ic7iHozM/8=
+github.com/jackc/pgx/v4 v4.16.1 h1:JzTglcal01DrghUqt+PmzWsZx/Yh7SC/CTQmSBMTd0Y=
+github.com/jackc/pgx/v4 v4.16.1/go.mod h1:SIhx0D5hoADaiXZVyv+3gSm3LCIIINTVO0PficsvWGQ=
 github.com/jackc/puddle v0.0.0-20190413234325-e4ced69a3a2b/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jackc/puddle v0.0.0-20190608224051-11cab39313c9/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jackc/puddle v1.1.0/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jackc/puddle v1.1.1/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jackc/puddle v1.1.3/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
-github.com/jackc/puddle v1.3.0/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
+github.com/jackc/puddle v1.2.1/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
+github.com/jcmturner/aescts/v2 v2.0.0/go.mod h1:AiaICIRyfYg35RUkr8yESTqvSy7csK90qZ5xfvvsoNs=
+github.com/jcmturner/dnsutils/v2 v2.0.0/go.mod h1:b0TnjGOvI/n42bZa+hmXL+kFJZsFT7G4t3HTlQ184QM=
+github.com/jcmturner/gofork v1.0.0/go.mod h1:MK8+TM0La+2rjBD4jE12Kj1pCCxK7d2LK/UM3ncEo0o=
+github.com/jcmturner/goidentity/v6 v6.0.1/go.mod h1:X1YW3bgtvwAXju7V3LCIMpY0Gbxyjn/mY9zx4tFonSg=
+github.com/jcmturner/gokrb5/v8 v8.2.0/go.mod h1:T1hnNppQsBtxW0tCHMHTkAt8n/sABdzZgZdoFrZaZNM=
+github.com/jcmturner/rpc/v2 v2.0.2/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
 github.com/jefferai/go-libsecret v0.0.0-20210525195240-b53481abef97 h1:/jVRo4KmyL3FgEYAqFe+S8nxo6xRkFLm+CvIV0qG7PU=
 github.com/jefferai/go-libsecret v0.0.0-20210525195240-b53481abef97/go.mod h1:4oP93ARN1AkyA31rzogqyUoa4u5PBybl8dJQBl2+E7A=
 github.com/jefferai/isbadcipher v0.0.0-20190226160619-51d2077c035f h1:E87tDTVS5W65euzixn7clSzK66puSt1H4I5SC0EmHH4=
@@ -867,14 +877,13 @@ github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJS
 github.com/jessevdk/go-flags v1.5.0/go.mod h1:Fw0T6WPc1dYxT4mKEZRfG5kJhaTDP9pj1c2EWnYs/m4=
 github.com/jhump/protoreflect v1.6.0/go.mod h1:eaTn3RZAmMBcV0fifFvlm6VHNz3wSkYyXYWUh7ymB74=
 github.com/jhump/protoreflect v1.9.1-0.20210817181203-db1a327a393e h1:Yb4fEGk+GtBSNuvy5rs0ZJt/jtopc/z9azQaj3xbies=
-github.com/jimlambrt/gldap v0.1.6 h1:fnpRGhuHxWjavhDvEjwwveneNrQZuoEfOoDxKWYmtF8=
-github.com/jimlambrt/gldap v0.1.6/go.mod h1:BRdefIDhx2uYBjxL0fRBGi3eyOvAkkRIXSJYMCyzCaI=
 github.com/jinzhu/gorm v1.9.12 h1:Drgk1clyWT9t9ERbzHza6Mj/8FY/CqMyVzOiHviMo6Q=
 github.com/jinzhu/gorm v1.9.12/go.mod h1:vhTjlKSJUTWNtcbQtrMBFCxy7eXTzeCAzfL5fBZT/Qs=
 github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
 github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
 github.com/jinzhu/now v1.0.1/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
 github.com/jinzhu/now v1.1.1/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
+github.com/jinzhu/now v1.1.4/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
 github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ=
 github.com/jinzhu/now v1.1.5/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
 github.com/jmespath/go-jmespath v0.0.0-20160202185014-0b12d6b521d8/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
@@ -937,16 +946,17 @@ github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/ktrysmt/go-bitbucket v0.6.4/go.mod h1:9u0v3hsd2rqCHRIpbir1oP7F58uo5dq19sBYvuMoyQ4=
 github.com/kylelemons/godebug v0.0.0-20170820004349-d65d576e9348/go.mod h1:B69LEHPfb2qLo0BaaOLcbitczOKLWTsrBG9LczfCD4k=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
+github.com/lib/pq v0.0.0-20180327071824-d34b9ff171c2/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.1.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.1.1/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.3.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
+github.com/lib/pq v1.6.0/go.mod h1:4vXEAYvW1fRQ2/FhZ78H73A60MHw1geSm145z2mdY1g=
 github.com/lib/pq v1.8.0/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/lib/pq v1.10.0/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/lib/pq v1.10.2 h1:AqzbZs4ZoCBp+GtejcpCpcxM3zlSMx29dXbUSeVtJb8=
 github.com/lib/pq v1.10.2/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-github.com/lib/pq v1.10.7 h1:p7ZhMD+KsSRozJr34udlUrhboJwWAgCg34+/ZZNvZZw=
-github.com/lib/pq v1.10.7/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
@@ -976,12 +986,13 @@ github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcME
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-isatty v0.0.19 h1:JITubQf0MOLdlGRuRq+jtsDlekdYPia9ZFsB8h/APPA=
-github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.17 h1:BTarxUcIeDqL27Mc+vyvdWYSL28zpIhv3RoTdsLMPng=
+github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
 github.com/mattn/go-shellwords v1.0.3/go.mod h1:3xCvwCdWdlDJUrvuMn7Wuy9eWs4pE8vqg+NOMyg4B2o=
 github.com/mattn/go-sqlite3 v1.9.0/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
 github.com/mattn/go-sqlite3 v1.14.6/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
+github.com/mattn/go-sqlite3 v1.14.12/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
 github.com/mattn/go-sqlite3 v2.0.1+incompatible/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
 github.com/mattn/go-sqlite3 v2.0.3+incompatible h1:gXHsfypPkaMZrKbD5209QV9jbUTJKjyR5WD3HYQSd+U=
 github.com/mattn/go-sqlite3 v2.0.3+incompatible/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
@@ -993,6 +1004,7 @@ github.com/mikesmitty/edkey v0.0.0-20170222072505-3356ea4e686a h1:eU8j/ClY2Ty3qd
 github.com/mikesmitty/edkey v0.0.0-20170222072505-3356ea4e686a/go.mod h1:v8eSC2SMp9/7FTKUncp7fH9IwPfw+ysMObcEz5FWheQ=
 github.com/mistifyio/go-zfs v2.1.2-0.20190413222219-f784269be439+incompatible/go.mod h1:8AuVvqP/mXw1px98n46wfvcGfQ4ci2FwoAjKYxuo3Z4=
 github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
+github.com/mitchellh/cli v1.1.2/go.mod h1:6iaV0fGdElS6dPBx0EApTxHrcWvmJphyh2n8YBLPPZ4=
 github.com/mitchellh/cli v1.1.5 h1:OxRIeJXpAMztws/XHlN2vu6imG5Dpq+j61AzAX5fLng=
 github.com/mitchellh/cli v1.1.5/go.mod h1:v8+iFts2sPIKUV1ltktPXMCC8fumSKFItNcD2cLtRR4=
 github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
@@ -1014,6 +1026,7 @@ github.com/mitchellh/mapstructure v1.4.2/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RR
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/osext v0.0.0-20151018003038-5e2d6d41470f/go.mod h1:OkQIRizQZAeMln+1tSwduZz7+Af5oFlKirV/MSYes2A=
+github.com/mitchellh/pointerstructure v1.2.0/go.mod h1:BRAsLI5zgXmw97Lf6s25bs8ohIXc3tViBH44KcwB2g4=
 github.com/mitchellh/pointerstructure v1.2.1 h1:ZhBBeX8tSlRpu/FFhXH4RC4OJzFlqsQhoHZAz4x7TIw=
 github.com/mitchellh/pointerstructure v1.2.1/go.mod h1:BRAsLI5zgXmw97Lf6s25bs8ohIXc3tViBH44KcwB2g4=
 github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
@@ -1025,9 +1038,8 @@ github.com/moby/sys/mountinfo v0.4.1/go.mod h1:rEr8tzG/lsIZHBtN/JjGG+LMYx9eXgW2J
 github.com/moby/sys/mountinfo v0.5.0/go.mod h1:3bMD3Rg+zkqx8MRYPi7Pyb0Ie97QEBmdxbhnCLlSvSU=
 github.com/moby/sys/symlink v0.1.0/go.mod h1:GGDODQmbFOjFsXvfLVn3+ZRxkch54RkSiGqsZeMYowQ=
 github.com/moby/term v0.0.0-20200312100748-672ec06f55cd/go.mod h1:DdlQx2hp0Ss5/fLikoLlEeIYiATotOjgB//nb973jeo=
+github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6 h1:dcztxKSvZ4Id8iPpHERQBbIJfabdt4wUm5qy3wOL2Zc=
 github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6/go.mod h1:E2VnQOmVuvZB6UYnnDB0qG5Nq/1tD9acaOpo6xmt0Kw=
-github.com/moby/term v0.0.0-20221205130635-1aeaba878587 h1:HfkjXDfhgVaN5rmueG8cL8KKeFNecRCXFhaJ2qZ5SKA=
-github.com/moby/term v0.0.0-20221205130635-1aeaba878587/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
@@ -1087,8 +1099,8 @@ github.com/opencontainers/runc v1.0.0-rc8.0.20190926000215-3e425f80a8c9/go.mod h
 github.com/opencontainers/runc v1.0.0-rc9/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
 github.com/opencontainers/runc v1.0.0-rc93/go.mod h1:3NOsor4w32B2tC0Zbl8Knk4Wg84SM2ImC1fxBuqJ/H0=
 github.com/opencontainers/runc v1.0.2/go.mod h1:aTaHFFwQXuA71CiyxOdFFIorAoemI04suvGRQFzWTD0=
-github.com/opencontainers/runc v1.1.5 h1:L44KXEpKmfWDcS02aeGm8QNTFXTo2D+8MYGDIJ/GDEs=
-github.com/opencontainers/runc v1.1.5/go.mod h1:1J5XiS+vdZ3wCyZybsuxXZWGrgSr8fFJHLXuG2PsnNg=
+github.com/opencontainers/runc v1.1.2 h1:2VSZwLx5k/BfsBxMMipG/LYUnmqOD/BPkIVgQUcTlLw=
+github.com/opencontainers/runc v1.1.2/go.mod h1:Tj1hFw6eFWp/o33uxGf5yF2BX5yz2Z6iptFpuvbbKqc=
 github.com/opencontainers/runtime-spec v0.1.2-0.20190507144316-5b71a03e2700/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/runtime-spec v1.0.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/runtime-spec v1.0.2-0.20190207185410-29686dbc5559/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
@@ -1101,8 +1113,10 @@ github.com/opencontainers/selinux v1.8.0/go.mod h1:RScLhm78qiWa2gbVCcGkC7tCGdgk3
 github.com/opencontainers/selinux v1.8.2/go.mod h1:MUIHuUEvKB1wtJjQdOyYRgOnLD2xAPP8dBsCoU0KuF8=
 github.com/opencontainers/selinux v1.10.0/go.mod h1:2i0OySw99QjzBBQByd1Gr9gSjvuho1lHsJxIJ3gGbJI=
 github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
+github.com/ory/dockertest/v3 v3.6.0/go.mod h1:4ZOpj8qBUmh8fcBSVzkH2bws2s91JdGvHUqan4GHEuQ=
 github.com/ory/dockertest/v3 v3.9.1 h1:v4dkG+dlu76goxMiTT2j8zV7s4oPPEppKT8K8p2f1kY=
 github.com/ory/dockertest/v3 v3.9.1/go.mod h1:42Ir9hmvaAPm0Mgibk6mBPi7SFvTXxEcnztDYOJ//uM=
+github.com/pascaldekloe/goe v0.1.0 h1:cBOtyMzM9HTpWjXfbbunk26uA6nG3a8n06Wieeh0MwY=
 github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
 github.com/pelletier/go-toml v1.7.0/go.mod h1:vwGMzjaWMwyfHwgIBhI2YUM4fB6nL6lVAvS1LBMMhTE=
@@ -1111,10 +1125,11 @@ github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR
 github.com/phpdave11/gofpdf v1.4.2/go.mod h1:zpO6xFn9yxo3YLyMvW8HcKWVdbNqgIfOOp2dXMnm1mY=
 github.com/phpdave11/gofpdi v1.0.12/go.mod h1:vBmVV0Do6hSBHC8uKUQ71JGW+ZGQq74llk/7bXwjDoI=
 github.com/pierrec/lz4 v2.0.5+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
+github.com/pierrec/lz4 v2.5.2+incompatible h1:WCjObylUIOlKy/+7Abdn34TLIkXiA4UWUMhxq9m9ZXI=
 github.com/pierrec/lz4 v2.5.2+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
 github.com/pierrec/lz4/v4 v4.1.8/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
-github.com/pires/go-proxyproto v0.7.0 h1:IukmRewDQFWC7kfnb66CSomk2q/seBuilHBYFwyq0Hs=
-github.com/pires/go-proxyproto v0.7.0/go.mod h1:Vz/1JPY/OACxWGQNIRY2BeyDmpoaWmEP40O9LbuiFR4=
+github.com/pires/go-proxyproto v0.6.1 h1:EBupykFmo22SDjv4fQVQd2J9NOoLPmyZA/15ldOGkPw=
+github.com/pires/go-proxyproto v0.6.1/go.mod h1:Odh9VFOZJCf9G8cLW5o435Xf1J95Jw9Gw5rnCjcwzAY=
 github.com/pkg/browser v0.0.0-20210706143420-7d21f8c997e2/go.mod h1:HKlIX3XHQyzLZPlr7++PzdhaXEj94dEiJgZDTsxEqUI=
 github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8/go.mod h1:HKlIX3XHQyzLZPlr7++PzdhaXEj94dEiJgZDTsxEqUI=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
@@ -1192,7 +1207,7 @@ github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIH
 github.com/safchain/ethtool v0.0.0-20190326074333-42ed695e3de8/go.mod h1:Z0q5wiBQGYcxhMZ6gUqHn6pYNLypFAvaL3UvgZLR0U4=
 github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
 github.com/seccomp/libseccomp-golang v0.9.1/go.mod h1:GbW5+tmTXfcxTToHLXlScSlAvWlF4P2Ca7zGrPiEpWo=
-github.com/seccomp/libseccomp-golang v0.9.2-0.20220502022130-f33da4d89646/go.mod h1:JA8cRccbGaA1s33RQf7Y1+q9gHmZX1yB/z9WDN1C6fg=
+github.com/seccomp/libseccomp-golang v0.9.2-0.20210429002308-3879420cc921/go.mod h1:JA8cRccbGaA1s33RQf7Y1+q9gHmZX1yB/z9WDN1C6fg=
 github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
 github.com/sethvargo/go-diceware v0.3.0 h1:UVVEfmN/uF50JfWAN7nbY6CiAlp5xeSx+5U0lWKkMCQ=
@@ -1211,9 +1226,8 @@ github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMB
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
+github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE=
 github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0=
-github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
 github.com/smartystreets/goconvey v0.0.0-20190330032615-68dc04aab96a/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
 github.com/snowflakedb/gosnowflake v1.6.3/go.mod h1:6hLajn6yxuJ4xUHZegMekpq9rnQbGJ7TMwXjgTmA6lg=
@@ -1248,15 +1262,14 @@ github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXf
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
+github.com/stretchr/testify v1.6.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8=
 github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/syndtr/gocapability v0.0.0-20170704070218-db04d3cc01c8/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
 github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
 github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
@@ -1291,18 +1304,18 @@ github.com/xanzy/ssh-agent v0.3.0/go.mod h1:3s9xbODqPuuhK9JV1R321M/FlMZSBvE5aY6e
 github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
 github.com/xdg-go/scram v1.0.2/go.mod h1:1WAq6h33pAW+iRreB34OORO2Nf7qel3VV3fjBj+hCSs=
 github.com/xdg-go/stringprep v1.0.2/go.mod h1:8F9zXuvzgwmyT5DUm4GUfZGDdT3W+LCvS6+da4O5kxM=
+github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f h1:J9EGpcZtP0E/raorCMxlFGSTBrsSlaDGf3jU/qvAE2c=
 github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
-github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
-github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
 github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
 github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
 github.com/xeipuuv/gojsonschema v0.0.0-20180618132009-1d523034197f/go.mod h1:5yf86TLmAcydyeJq5YvxkGPE2fm/u4myDekKRoLuqhs=
 github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
 github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
 github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
-github.com/xo/dburl v0.14.2 h1:tqiXv1glyxFph3LA39RXE4TYidr/yp7kG2YDrgJVjiA=
-github.com/xo/dburl v0.14.2/go.mod h1:B7/G9FGungw6ighV8xJNwWYQPMfn3gsi2sn5SE8Bzco=
+github.com/xo/dburl v0.11.0 h1:AVtiIKI5VpKdfuEBvTEMsLoY3MW6+uHTm5Eeuvt6Olo=
+github.com/xo/dburl v0.11.0/go.mod h1:3i+BAX1bQngTMtk8dtGUTTUviVymLIViDtYHDP5NTMU=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
+github.com/yhat/scrape v0.0.0-20161128144610-24b7890b0945/go.mod h1:4vRFPPNYllgCacoj+0FoKOjTW68rUhEfqPLiEJaK2w8=
 github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d/go.mod h1:rHwXgn7JulP+udvsHwJoVG1YGAP6VLg4y9I5dyZdqmA=
 github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
@@ -1313,8 +1326,8 @@ github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5t
 github.com/yvasiyarov/go-metrics v0.0.0-20140926110328-57bccd1ccd43/go.mod h1:aX5oPXxHm3bOH+xeAttToC8pqch2ScQN/JoXYupl6xs=
 github.com/yvasiyarov/gorelic v0.0.0-20141212073537-a9bba5b9ab50/go.mod h1:NUSPSUX/bi6SeDMUh6brw0nXpxHnc96TguQh0+r/ssA=
 github.com/yvasiyarov/newrelic_platform_go v0.0.0-20140908184405-b21fdbd4370f/go.mod h1:GlGEuHIJweS1mbCqG+7vt2nvWLzLLnRHbXz5JKd/Qbg=
-github.com/zalando/go-keyring v0.2.3 h1:v9CUu9phlABObO4LPWycf+zwMG7nlbb3t/B5wa97yms=
-github.com/zalando/go-keyring v0.2.3/go.mod h1:HL4k+OXQfJUWaMnqyuSOc0drfGPX2b51Du6K+MRgZMk=
+github.com/zalando/go-keyring v0.2.1 h1:MBRN/Z8H4U5wEKXiD67YbDAr5cj/DOStmSga70/2qKc=
+github.com/zalando/go-keyring v0.2.1/go.mod h1:g63M2PPn0w5vjmEbwAX3ib5I+41zdm4esSETOn9Y6Dw=
 github.com/zclconf/go-cty v1.1.0/go.mod h1:xnAOWiHeOqg2nWS62VtQ7pbOu17FtxJNW8RLEih+O3s=
 github.com/zclconf/go-cty v1.13.1 h1:0a6bRwuiSHtAmqCqNOE+c2oHgepv0ctoxU4FUe43kwc=
 github.com/zclconf/go-cty v1.13.1/go.mod h1:YKQzy/7pZ7iq2jNFzy5go57xdxdWoLLpaEp4u238AE0=
@@ -1365,7 +1378,9 @@ golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20190911031432-227b76d455e7/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191205180655-e7c4368fe9dd/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20200117160349-530e935923ad/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200302210943-78000ba7a073/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20200311171314-f7b00557c8c4/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200323165209-0ec3e9974c59/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200414173820-0848c9571904/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
@@ -1379,12 +1394,11 @@ golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5y
 golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.5.0/go.mod h1:NK/OQwhpMQP3MwtdjgLlYHnH9ebylxKWv3e0fK+mkQU=
-golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
-golang.org/x/crypto v0.9.0 h1:LF6fAI+IutBocDJ2OT0Q1g8plpYljMZ4+lty+dsqw3g=
-golang.org/x/crypto v0.9.0/go.mod h1:yrmDGqONDYtNj3tH8X9dzUun2m2lzPa9ngI6/RUPGR0=
+golang.org/x/crypto v0.7.0 h1:AvwMYaRytfdeVt3u6mLaxYtErKYjxA2OXjJ1HHq6t3A=
+golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
 golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -1399,8 +1413,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20230425010034-47ecfdc1ba53 h1:5llv2sWeaMSnA3w2kS57ouQQ4pudlXrR0dCgw51QK9o=
-golang.org/x/exp v0.0.0-20230425010034-47ecfdc1ba53/go.mod h1:V1LtkGg67GoY2N1AnLN78QLrzxkLyJw7RJb1gzOOz9w=
+golang.org/x/exp v0.0.0-20230224173230-c95f2b4c22f2 h1:Jvc7gsqn21cJHCmAWx0LiimpP18LZmUxkT5Mp7EZ1mI=
+golang.org/x/exp v0.0.0-20230224173230-c95f2b4c22f2/go.mod h1:CxIveKay+FTh1D0yPZemJVgC/95VzuuOLq5Qi4xnoYc=
 golang.org/x/image v0.0.0-20180708004352-c73c2afc3b81/go.mod h1:ux5Hcp/YLpHSI86hEcLt0YII63i6oz57MZXIpbrjZUs=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
@@ -1464,6 +1478,7 @@ golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20191003171128-d98b1b443823/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191004110552-13f9640d40b9/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191009170851-d66e71096ffb/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191112182307-2180aed22343/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -1475,6 +1490,7 @@ golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200505041828-1ed23360d12c/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
@@ -1499,14 +1515,12 @@ golang.org/x/net v0.0.0-20210614182718-04defd469f4e/go.mod h1:9nx3DQGgdP8bBQD5qx
 golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211013171255-e13a2654a71e/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20211216030914-fe4d6282115f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
-golang.org/x/net v0.3.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
-golang.org/x/net v0.4.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
 golang.org/x/net v0.5.0/go.mod h1:DivGGAXEgPSlEBzxGzZI+ZLohi+xUj054jfeKui00ws=
-golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.10.0 h1:X2//UzNDwYmtCLn7To6G58Wr6f5ahEAQgKNzv9Y951M=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.8.0 h1:Zrh2ngAOFYneWTAIAPethzeaQLuHwhuBkuV6ZiRnUaQ=
+golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
 golang.org/x/oauth2 v0.0.0-20180227000427-d7d64896b5ff/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181106182150-f42d05182288/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
@@ -1522,9 +1536,9 @@ golang.org/x/oauth2 v0.0.0-20210220000619-9bb904979d93/go.mod h1:KelEdhl1UZF7XfJ
 golang.org/x/oauth2 v0.0.0-20210313182246-cd4f82c27b84/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210628180205-a41e5a781914/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.3.0/go.mod h1:rQrIauxkUhJ6CuwEXwymO2/eh4xz2ZWF1nBkcxS+tGk=
-golang.org/x/oauth2 v0.8.0 h1:6dkIjl3j3LtZ/O3sTgZTMsLKSftL/B8Zgq4huOIIUu8=
-golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE=
+golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.4.0 h1:NF0gk8LVPg1Ml7SSbGyySuoxdsXitj7TvgvuRxIMc/M=
+golang.org/x/oauth2 v0.4.0/go.mod h1:RznEsdpjGAINPTOF0UH/t+xJ75L18YO3Ho6Pyn+uRec=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -1537,8 +1551,8 @@ golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4 h1:uVc8UZUe6tr40fFVnUP5Oj+veunVezqYl9z7DYw9xzw=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
 golang.org/x/sys v0.0.0-20180224232135-f6cff0780e54/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1546,6 +1560,7 @@ golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5h
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181107165924-66b7b1311ac8/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190129075346-302c3dd5f1cc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -1585,6 +1600,7 @@ golang.org/x/sys v0.0.0-20200106162015-b016eb3dc98e/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200120151820-655fe14d7479/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200121082415-34d275377bf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200124204421-9fbb57f87de9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -1638,37 +1654,33 @@ golang.org/x/sys v0.0.0-20210616045830-e2b7044e8c71/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210818153620-00dd8d7831e7/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210819135213-f52c844e1c1c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210906170528-6f6e22806c34/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211013075003-97ac67df715c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211116061358-0a5406a5449c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0 h1:MVltZSvRTcU2ljQOhs94SXPftV6DCNnZViHeQps87pQ=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
-golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA=
 golang.org/x/term v0.4.0/go.mod h1:9P2UbLfCdcvo3p/nzKvsmas4TnlujnuoV9hGgYzW1lQ=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.8.0 h1:n5xxQn2i3PC0yLAbjTpNT85q/Kgzcr2gIoX9OrJUols=
-golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.6.0 h1:clScbb1cHjoCkyRbWwBEUZ5H/tIFu5TAXIqaZD0Gcjw=
+golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.1-0.20181227161524-e6919f6577db/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -1676,15 +1688,14 @@ golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.6.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.8.0 h1:57P1ETyNKtuIjB4SRd15iJxuhj8Gc416Y78H3qgMh68=
+golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
 golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1763,7 +1774,6 @@ golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0 h1:BOw41kyTf3PuCW1pVQf8+Cyg8pMlkYB1oo9iJ6D/lKM=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1816,6 +1826,7 @@ google.golang.org/cloud v0.0.0-20151119220103-975617b05ea8/go.mod h1:0H1ncTHf11K
 google.golang.org/genproto v0.0.0-20170818010345-ee236bd376b0/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190404172233-64821d5d2107/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
 google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
 google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
 google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
@@ -1870,18 +1881,16 @@ google.golang.org/genproto v0.0.0-20210716133855-ce7ef5c701ea/go.mod h1:AxrInvYm
 google.golang.org/genproto v0.0.0-20210721163202-f1cecdd8b78a/go.mod h1:ob2IJxKrgPT52GcgX759i1sleT07tiKowYBGbczaW48=
 google.golang.org/genproto v0.0.0-20210726143408-b02e89920bf0/go.mod h1:ob2IJxKrgPT52GcgX759i1sleT07tiKowYBGbczaW48=
 google.golang.org/genproto v0.0.0-20211013025323-ce878158c4d4/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20230526203410-71b5a4ffd15e h1:Ao9GzfUMPH3zjVfzXG5rlWlk+Q8MXWKwWpwVQE1MXfw=
-google.golang.org/genproto v0.0.0-20230526203410-71b5a4ffd15e/go.mod h1:zqTuNwFlFRsw5zIts5VnzLQxSRqh+CGOTVMlYbY0Eyk=
-google.golang.org/genproto/googleapis/api v0.0.0-20230530153820-e85fd2cbaebc h1:kVKPf/IiYSBWEWtkIn6wZXwWGCnLKcC8oWfZvXjsGnM=
-google.golang.org/genproto/googleapis/api v0.0.0-20230530153820-e85fd2cbaebc/go.mod h1:vHYtlOoi6TsQ3Uk2yxR7NI5z8uoV+3pZtR4jmHIkRig=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc h1:XSJ8Vk1SWuNr8S18z1NZSziL0CPIXLCCMDOEFtHBOFc=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc/go.mod h1:66JfowdXAEgad5O9NnYcsNPLCPZJD++2L9X0PCMODrA=
+google.golang.org/genproto v0.0.0-20230303212802-e74f57abe488 h1:QQF+HdiI4iocoxUjjpLgvTYDHKm99C/VtTBFnfiCJos=
+google.golang.org/genproto v0.0.0-20230303212802-e74f57abe488/go.mod h1:TvhZT5f700eVlTNwND1xoEZQeWTB2RY/65kplwl/bFA=
 google.golang.org/grpc v0.0.0-20160317175043-d3ddb4469d5a/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.8.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
+google.golang.org/grpc v1.14.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.0/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
+google.golang.org/grpc v1.22.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.23.1/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.24.0/go.mod h1:XDChyiUovWa60DnaeDeZmSW86xtLtjtZbwvSiRnRtcA=
@@ -1906,8 +1915,8 @@ google.golang.org/grpc v1.38.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQ
 google.golang.org/grpc v1.39.0/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
 google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
 google.golang.org/grpc v1.41.0/go.mod h1:U3l9uK9J0sini8mHphKoXyaqDA/8VyGnDee1zzIUK6k=
-google.golang.org/grpc v1.55.0 h1:3Oj82/tFSCeUrRTg/5E/7d/W5A1tj6Ky1ABAuZuv5ag=
-google.golang.org/grpc v1.55.0/go.mod h1:iYEXKGkEBhg1PjZQvoYEVPTDkHo1/bjTnfwTeGONTY8=
+google.golang.org/grpc v1.53.0 h1:LAv2ds7cmFV/XTS3XG1NneeENYrXGmorPxsBbptIjNc=
+google.golang.org/grpc v1.53.0/go.mod h1:OnIrk0ipVdj4N5d9IUoFUx72/VlD7+jUsHwZgwSMQpw=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
@@ -1922,11 +1931,11 @@ google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlba
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.30.0 h1:kPPoIgf3TsEvrm0PFe15JQ+570QVxYzEvvHqChK+cng=
-google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.29.1 h1:7QBf+IK2gx70Ap/hDsOmam3GE0v9HicjfEdAxE62UoM=
+google.golang.org/protobuf v1.29.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/airbrake/gobrake.v2 v2.0.9/go.mod h1:/h5ZAUhDkGaJfjzjKLSjv6zCL6O0LLBxU4K+aSYdM/U=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
+gopkg.in/asn1-ber.v1 v1.0.0-20181015200546-f715ec2f112d/go.mod h1:cuepJuh7vyXfUyUwEgHQXw849cJrilpS5NeIjOWESAw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20141024133853-64131543e789/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -1941,6 +1950,11 @@ gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMy
 gopkg.in/gemnasium/logrus-airbrake-hook.v2 v2.1.2/go.mod h1:Xk6kEKp8OKb+X14hQBKWaSkCsqBpgog8nAV2xsGOxlo=
 gopkg.in/inconshreveable/log15.v2 v2.0.0-20180818164646-67afb5ed74ec/go.mod h1:aPpfJ7XW+gOuirDoZ8gHhLh3kZ1B08FtV2bbmy7Jv3s=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/jcmturner/aescts.v1 v1.0.1/go.mod h1:nsR8qBOg+OucoIW+WMhB3GspUQXq9XorLnQb9XtvcOo=
+gopkg.in/jcmturner/dnsutils.v1 v1.0.1/go.mod h1:m3v+5svpVOhtFAP/wSz+yzh4Mc0Fg7eRhxkJMWSIz9Q=
+gopkg.in/jcmturner/goidentity.v3 v3.0.0/go.mod h1:oG2kH0IvSYNIu80dVAyu/yoefjq1mNfM5bm88whjWx4=
+gopkg.in/jcmturner/gokrb5.v7 v7.5.0/go.mod h1:l8VISx+WGYp+Fp7KRbsiUuXTTOnxIc3Tuvyavf11/WM=
+gopkg.in/jcmturner/rpc.v1 v1.1.0/go.mod h1:YIdkC4XfD6GXbzje11McwsDuOlZQSb9W4vfLvuNnlv8=
 gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k=
 gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
 gopkg.in/square/go-jose.v2 v2.2.2/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
@@ -1968,14 +1982,16 @@ gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gorm.io/driver/postgres v1.0.8/go.mod h1:4eOzrI1MUfm6ObJU/UcmbXyiHSs8jSwH95G5P5dxcAg=
-gorm.io/driver/postgres v1.5.2 h1:ytTDxxEv+MplXOfFe3Lzm7SjG09fcdb3Z/c056DTBx0=
-gorm.io/driver/postgres v1.5.2/go.mod h1:fmpX0m2I1PKuR7mKZiEluwrP3hbs+ps7JIGMUBpCgl8=
-gorm.io/driver/sqlite v1.5.1 h1:hYyrLkAWE71bcarJDPdZNTLWtr8XrSjOWyjUYI6xdL4=
-gorm.io/driver/sqlite v1.5.1/go.mod h1:7MZZ2Z8bqyfSQA1gYEV6MagQWj3cpUkJj9Z+d1HEMEQ=
+gorm.io/driver/postgres v1.3.8 h1:8bEphSAB69t3odsCR4NDzt581iZEWQuRM27Cg6KgfPY=
+gorm.io/driver/postgres v1.3.8/go.mod h1:qB98Aj6AhRO/oyu/jmZsi/YM9g6UzVCjMxO/6frFvcA=
+gorm.io/driver/sqlite v1.3.6 h1:Fi8xNYCUplOqWiPa3/GuCeowRNBRGTf62DEmhMDHeQQ=
+gorm.io/driver/sqlite v1.3.6/go.mod h1:Sg1/pvnKtbQ7jLXxfZa+jSHvoX8hoZA8cn4xllOMTgE=
 gorm.io/gorm v1.20.12/go.mod h1:0HFTzE/SqkGTzK6TlDPPQbAYCluiVvhzoA1+aVyzenw=
 gorm.io/gorm v1.21.4/go.mod h1:0HFTzE/SqkGTzK6TlDPPQbAYCluiVvhzoA1+aVyzenw=
-gorm.io/gorm v1.25.1 h1:nsSALe5Pr+cM3V1qwwQ7rOkw+6UeLrX5O4v3llhHa64=
-gorm.io/gorm v1.25.1/go.mod h1:L4uxeKpfBml98NYqVqwAdmV1a2nBtAec/cf3fpucW/k=
+gorm.io/gorm v1.23.4/go.mod h1:l2lP/RyAtc1ynaTjFksBde/O8v9oOGIApu2/xRitmZk=
+gorm.io/gorm v1.23.6/go.mod h1:l2lP/RyAtc1ynaTjFksBde/O8v9oOGIApu2/xRitmZk=
+gorm.io/gorm v1.23.8 h1:h8sGJ+biDgBA1AD1Ha9gFCx7h8npU7AsLdlkX0n2TpE=
+gorm.io/gorm v1.23.8/go.mod h1:l2lP/RyAtc1ynaTjFksBde/O8v9oOGIApu2/xRitmZk=
 gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
 gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
 gotest.tools/v3 v3.0.2/go.mod h1:3SzNCllyD9/Y+b5r9JIKQ474KzkZyqLqEfYqMsX94Bk=

internal/provider/const.go

@@ -44,6 +44,4 @@ const (
 	// internalForceUpdateKey is used to force updates so we can always check
 	// the value of secrets
 	internalForceUpdateKey = "internal_force_update"
-	// workerFilter is used for common "worker_filter" resource attribute
-	WorkerFilterKey = "worker_filter"
 )

internal/provider/provider.go

@@ -23,7 +23,6 @@ import (
 
 const (
 	PASSWORD_AUTH_METHOD_PREFIX = "ampw"
-	LDAP_AUTH_METHOD_PREFIX     = "amldap"
 	DEFAULT_PROVIDER_SCOPE      = "global"
 )
 
@@ -53,29 +52,17 @@ func New() *schema.Provider {
 			"auth_method_id": {
 				Type:        schema.TypeString,
 				Optional:    true,
-				Description: "The auth method ID e.g. ampw_1234567890. If not set, the default auth method for the given scope ID will be used.",
+				Description: "The auth method ID e.g. ampw_1234567890",
 			},
 			"password_auth_method_login_name": {
 				Type:        schema.TypeString,
 				Optional:    true,
 				Description: "The auth method login name for password-style auth methods",
-				Deprecated:  "Use auth_method_login_name instead",
 			},
 			"password_auth_method_password": {
 				Type:        schema.TypeString,
 				Optional:    true,
 				Description: "The auth method password for password-style auth methods",
-				Deprecated:  "Use auth_method_password instead",
-			},
-			"auth_method_login_name": {
-				Type:        schema.TypeString,
-				Optional:    true,
-				Description: "The auth method login name for password-style or ldap-style auth methods",
-			},
-			"auth_method_password": {
-				Type:        schema.TypeString,
-				Optional:    true,
-				Description: "The auth method password for password-style or ldap-style auth methods",
 			},
 			"tls_insecure": {
 				Type:        schema.TypeBool,
@@ -97,11 +84,9 @@ func New() *schema.Provider {
 			"boundary_account":                                  resourceAccount(),
 			"boundary_account_password":                         resourceAccountPassword(),
 			"boundary_account_oidc":                             resourceAccountOidc(),
-			"boundary_account_ldap":                             resourceAccountLdap(),
 			"boundary_auth_method":                              resourceAuthMethod(),
 			"boundary_auth_method_password":                     resourceAuthMethodPassword(),
 			"boundary_auth_method_oidc":                         resourceAuthMethodOidc(),
-			"boundary_auth_method_ldap":                         resourceAuthMethodLdap(),
 			"boundary_credential_library_vault":                 resourceCredentialLibraryVault(),
 			"boundary_credential_library_vault_ssh_certificate": resourceCredentialLibraryVaultSshCertificate(),
 			"boundary_credential_store_vault":                   resourceCredentialStoreVault(),
@@ -110,7 +95,6 @@ func New() *schema.Provider {
 			"boundary_credential_ssh_private_key":               resourceCredentialSshPrivateKey(),
 			"boundary_credential_json":                          resourceCredentialJson(),
 			"boundary_managed_group":                            resourceManagedGroup(),
-			"boundary_managed_group_ldap":                       resourceManagedGroupLdap(),
 			"boundary_group":                                    resourceGroup(),
 			"boundary_host":                                     resourceHost(),
 			"boundary_host_static":                              resourceHostStatic(),
@@ -122,7 +106,6 @@ func New() *schema.Provider {
 			"boundary_host_set_plugin":                          resourceHostSetPlugin(),
 			"boundary_role":                                     resourceRole(),
 			"boundary_scope":                                    resourceScope(),
-			"boundary_storage_bucket":                           resourceStorageBucket(),
 			"boundary_target":                                   resourceTarget(),
 			"boundary_user":                                     resourceUser(),
 			"boundary_worker":                                   resourceWorker(),
@@ -207,21 +190,15 @@ func providerAuthenticate(ctx context.Context, d *schema.ResourceData, md *metaD
 
 	case authMethodIdOk:
 		switch {
-		case strings.HasPrefix(authMethodId.(string), PASSWORD_AUTH_METHOD_PREFIX) || strings.HasPrefix(authMethodId.(string), LDAP_AUTH_METHOD_PREFIX):
-			// Password-style & LDAP-style
-			authMethodLoginName, ok := d.GetOk("auth_method_login_name")
+		case strings.HasPrefix(authMethodId.(string), "ampw"):
+			// Password-style
+			authMethodLoginName, ok := d.GetOk("password_auth_method_login_name")
 			if !ok {
-				authMethodLoginName, ok = d.GetOk("password_auth_method_login_name")
-				if !ok {
-					return errors.New("auth method login name not set, please set auth_method_login_name on the provider")
-				}
+				return errors.New("password-style auth method login name not set, please set password_auth_method_login_name on the provider")
 			}
-			authMethodPassword, ok := d.GetOk("auth_method_password")
+			authMethodPassword, ok := d.GetOk("password_auth_method_password")
 			if !ok {
-				authMethodPassword, ok = d.GetOk("password_auth_method_password")
-				if !ok {
-					return errors.New("auth method password not set, please set auth_method_password on the provider")
-				}
+				return errors.New("password-style auth method password not set, please set password_auth_method_password on the provider")
 			}
 			credentials = map[string]interface{}{
 				"login_name": authMethodLoginName,

internal/provider/provider_test.go

@@ -13,15 +13,12 @@ import (
 	"testing"
 
 	"github.com/hashicorp/boundary/testing/controller"
-	"github.com/hashicorp/cap/ldap"
 	"github.com/hashicorp/cap/oidc"
 	wrapping "github.com/hashicorp/go-kms-wrapping/v2"
 	"github.com/hashicorp/go-kms-wrapping/v2/aead"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
-	"github.com/jimlambrt/gldap"
-	"github.com/jimlambrt/gldap/testdirectory"
 )
 
 var (
@@ -159,19 +156,6 @@ provider "boundary" {
 	return strings.Join(c, "\n")
 }
 
-func testConfigWithLDAPAuthMethod(url string, loginName string, password string, res ...string) string {
-	provider := fmt.Sprintf(`
-provider "boundary" {
-	addr             = "%s"
-	auth_method_login_name = "%s"
-	auth_method_password = "%s"
-}`, url, loginName, password)
-
-	c := []string{provider}
-	c = append(c, res...)
-	return strings.Join(c, "\n")
-}
-
 func importStep(name string, ignore ...string) resource.TestStep {
 	step := resource.TestStep{
 		ResourceName:      name,
@@ -192,48 +176,6 @@ func TestProvider(t *testing.T) {
 	}
 }
 
-func TestConfigWithLdapAuthMethod(t *testing.T) {
-	td := createDefaultLdap(t)
-	defer td.Stop()
-	tc := controller.NewTestController(t, tcConfig...)
-	defer tc.Shutdown()
-	url := tc.ApiAddrs()[0]
-	ldapLoginName := "alice"
-	ldapPassword := "password"
-
-	createLdapAMConfig := fmt.Sprintf(testPrimaryAuthMethodLdap, td.Host(), td.Port(), testdirectory.DefaultUserDN, testdirectory.DefaultGroupDN)
-	createLdapAccountConfig := fmt.Sprintf(testProviderLdapAccountConfig, ldapLoginName)
-
-	var provider *schema.Provider
-	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckAuthMethodResourceDestroy(t, provider, ldapAuthMethodType),
-		Steps: []resource.TestStep{
-			{
-				// create ldap auth method
-				Config: testConfig(url, fooOrg, createLdapAMConfig, createLdapAccountConfig),
-				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapInsecureTlsField, "true"),
-				),
-			},
-			{
-				// authenticate with LDAP auth method and ensure auth token exists
-				Config: testConfigWithLDAPAuthMethod(url, ldapLoginName, ldapPassword, fooOrg, createLdapAMConfig, createLdapAccountConfig),
-				Check: resource.ComposeTestCheckFunc(
-					testProviderTokenExists(provider),
-				),
-			},
-			{
-				// check if authentication with password auth method works after
-				Config: testConfig(url, fooOrg),
-				Check: resource.ComposeTestCheckFunc(
-					testProviderTokenExists(provider),
-				),
-			},
-		},
-	})
-}
-
 func TestConfigWithDefaultAuthMethod(t *testing.T) {
 	tc := controller.NewTestController(t, tcConfig...)
 	defer tc.Shutdown()
@@ -268,7 +210,7 @@ func TestConfigWithoutAMPWCredentials(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				Config:      testConfigWithoutAMPWCredentials(url, fooOrg, firstProjectFoo, secondProject),
-				ExpectError: regexp.MustCompile("auth method login name not set, please set auth_method_login_name on the provider"),
+				ExpectError: regexp.MustCompile("password-style auth method login name not set, please set password_auth_method_login_name on the provider"),
 			},
 		},
 	})
@@ -350,29 +292,3 @@ func testProviderTokenExists(testProvider *schema.Provider) resource.TestCheckFu
 		return nil
 	}
 }
-
-func createDefaultLdap(t *testing.T) *testdirectory.Directory {
-	td := testdirectory.Start(t,
-		testdirectory.WithDefaults(t, &testdirectory.Defaults{AllowAnonymousBind: true}),
-		testdirectory.WithNoTLS(t),
-	)
-
-	groups := []*gldap.Entry{
-		testdirectory.NewGroup(t, "admin", []string{"alice"}),
-	}
-
-	users := testdirectory.NewUsers(t, []string{"alice"}, testdirectory.WithMembersOf(t, "admin"))
-
-	for _, u := range users {
-		u.Attributes = append(u.Attributes,
-			gldap.NewEntryAttribute(ldap.DefaultADUserPasswordAttribute, []string{"password"}),
-			gldap.NewEntryAttribute(ldap.DefaultOpenLDAPUserPasswordAttribute, []string{"password"}),
-			gldap.NewEntryAttribute("fullName", []string{"test-full-name"}),
-		)
-	}
-
-	td.SetUsers(users...)
-	td.SetGroups(groups...)
-
-	return td
-}

internal/provider/resource_account_ldap.go

@@ -1,248 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
-package provider
-
-import (
-	"context"
-	"net/http"
-
-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/accounts"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-)
-
-const (
-	accountTypeLdap = "ldap"
-)
-
-func resourceAccountLdap() *schema.Resource {
-	return &schema.Resource{
-		Description: "The account resource allows you to configure a Boundary account.",
-
-		CreateContext: resourceAccountLdapCreate,
-		ReadContext:   resourceAccountLdapRead,
-		UpdateContext: resourceAccountLdapUpdate,
-		DeleteContext: resourceAccountDelete,
-		Importer: &schema.ResourceImporter{
-			StateContext: schema.ImportStatePassthroughContext,
-		},
-
-		Schema: map[string]*schema.Schema{
-			IDKey: {
-				Description: "The ID of the account.",
-				Type:        schema.TypeString,
-				Computed:    true,
-			},
-			NameKey: {
-				Description: "The account name. Defaults to the resource name.",
-				Type:        schema.TypeString,
-				Optional:    true,
-			},
-			DescriptionKey: {
-				Description: "The account description.",
-				Type:        schema.TypeString,
-				Optional:    true,
-			},
-			AuthMethodIdKey: {
-				Description: "The resource ID for the auth method.",
-				Type:        schema.TypeString,
-				Required:    true,
-				ForceNew:    true,
-			},
-			TypeKey: {
-				Description: "The resource type.",
-				Type:        schema.TypeString,
-				Deprecated:  "The value for this field will be infered since 'ldap' is the only possible value.",
-				Default:     accountTypeLdap,
-				Optional:    true,
-				ForceNew:    true,
-			},
-			accountLoginNameKey: {
-				Description: "The login name for this account.",
-				Type:        schema.TypeString,
-				Optional:    true,
-				ForceNew:    true,
-			},
-		},
-	}
-}
-
-func setFromAccountLdapResponseMap(d *schema.ResourceData, raw map[string]interface{}) error {
-	if err := d.Set(NameKey, raw["name"]); err != nil {
-		return err
-	}
-	if err := d.Set(DescriptionKey, raw["description"]); err != nil {
-		return err
-	}
-	if err := d.Set(AuthMethodIdKey, raw["auth_method_id"]); err != nil {
-		return err
-	}
-	if err := d.Set(TypeKey, raw["type"]); err != nil {
-		return err
-	}
-
-	switch raw["type"].(string) {
-	case accountTypeLdap:
-		if attrsVal, ok := raw["attributes"]; ok {
-			attrs := attrsVal.(map[string]interface{})
-			if err := d.Set(accountLoginNameKey, attrs["login_name"]); err != nil {
-				return err
-			}
-		}
-	}
-
-	d.SetId(raw["id"].(string))
-	return nil
-}
-
-func resourceAccountLdapCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	md := meta.(*metaData)
-
-	var authMethodId string
-	if authMethodIdVal, ok := d.GetOk(AuthMethodIdKey); ok {
-		authMethodId = authMethodIdVal.(string)
-	} else {
-		return diag.Errorf("no auth method ID provided")
-	}
-
-	var loginName *string
-	if keyVal, ok := d.GetOk(accountLoginNameKey); ok {
-		key := keyVal.(string)
-		loginName = &key
-	}
-
-	opts := []accounts.Option{}
-
-	var typeStr string
-	if typeVal, ok := d.GetOk(TypeKey); ok {
-		typeStr = typeVal.(string)
-	} else {
-		return diag.Errorf("no type provided")
-	}
-	switch typeStr {
-	case accountTypeLdap:
-		if loginName != nil {
-			opts = append(opts, accounts.WithLdapAccountLoginName(*loginName))
-		}
-	default:
-		return diag.Errorf("invalid type provided")
-	}
-
-	nameVal, ok := d.GetOk(NameKey)
-	if ok {
-		nameStr := nameVal.(string)
-		opts = append(opts, accounts.WithName(nameStr))
-	}
-
-	descVal, ok := d.GetOk(DescriptionKey)
-	if ok {
-		descStr := descVal.(string)
-		opts = append(opts, accounts.WithDescription(descStr))
-	}
-
-	aClient := accounts.NewClient(md.client)
-
-	acr, err := aClient.Create(ctx, authMethodId, opts...)
-	if err != nil {
-		return diag.Errorf("error creating account: %v", err)
-	}
-	if acr == nil {
-		return diag.Errorf("nil account after create")
-	}
-
-	if err := setFromAccountLdapResponseMap(d, acr.GetResponse().Map); err != nil {
-		return diag.FromErr(err)
-	}
-
-	return nil
-}
-
-func resourceAccountLdapRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	md := meta.(*metaData)
-	aClient := accounts.NewClient(md.client)
-
-	arr, err := aClient.Read(ctx, d.Id())
-	if err != nil {
-		if apiErr := api.AsServerError(err); apiErr != nil && apiErr.Response().StatusCode() == http.StatusNotFound {
-			d.SetId("")
-			return nil
-		}
-		return diag.Errorf("error reading account: %v", err)
-	}
-	if arr == nil {
-		return diag.Errorf("account nil after read")
-	}
-
-	if err := setFromAccountLdapResponseMap(d, arr.GetResponse().Map); err != nil {
-		return diag.FromErr(err)
-	}
-
-	return nil
-}
-
-func resourceAccountLdapUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	md := meta.(*metaData)
-	aClient := accounts.NewClient(md.client)
-
-	opts := []accounts.Option{}
-
-	var name *string
-	if d.HasChange(NameKey) {
-		opts = append(opts, accounts.DefaultName())
-		nameVal, ok := d.GetOk(NameKey)
-		if ok {
-			nameStr := nameVal.(string)
-			name = &nameStr
-			opts = append(opts, accounts.WithName(nameStr))
-		}
-	}
-
-	var desc *string
-	if d.HasChange(DescriptionKey) {
-		opts = append(opts, accounts.DefaultDescription())
-		descVal, ok := d.GetOk(DescriptionKey)
-		if ok {
-			descStr := descVal.(string)
-			desc = &descStr
-			opts = append(opts, accounts.WithDescription(descStr))
-		}
-	}
-
-	var loginName *string
-	if d.HasChange(accountLoginNameKey) {
-		switch d.Get(TypeKey).(string) {
-		case accountTypeLdap:
-			opts = append(opts, accounts.DefaultLdapAccountLoginName())
-			keyVal, ok := d.GetOk(accountLoginNameKey)
-			if ok {
-				keyStr := keyVal.(string)
-				loginName = &keyStr
-				opts = append(opts, accounts.WithLdapAccountLoginName(keyStr))
-			}
-		default:
-			return diag.Errorf(`"login_name" cannot be used with this type of account`)
-		}
-	}
-
-	if len(opts) > 0 {
-		opts = append(opts, accounts.WithAutomaticVersioning(true))
-		_, err := aClient.Update(ctx, d.Id(), 0, opts...)
-		if err != nil {
-			return diag.Errorf("error updating account: %v", err)
-		}
-	}
-
-	if d.HasChange(NameKey) {
-		d.Set(NameKey, name)
-	}
-	if d.HasChange(DescriptionKey) {
-		d.Set(DescriptionKey, desc)
-	}
-	if d.HasChange(accountLoginNameKey) {
-		d.Set(accountLoginNameKey, loginName)
-	}
-
-	return nil
-}

internal/provider/resource_account_ldap_test.go

@@ -1,150 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
-package provider
-
-import (
-	"fmt"
-	"testing"
-
-	"github.com/hashicorp/boundary/testing/controller"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-)
-
-const (
-	testAccountLdapDesc       = "test account"
-	testAccountLdapDescUpdate = "test account update"
-	testAccountLdapName       = "test account name"
-	testAccountLdapNameUpdate = "test account name updated"
-)
-
-var (
-	testAccountLdap = fmt.Sprintf(`
-resource "boundary_auth_method_ldap" "foo" {
-	name        = "test"
-	description = "test account"
-	type        = "ldap"
-	scope_id    = boundary_scope.org1.id
-	depends_on  = [boundary_role.org1_admin]
-
-	urls        = ["ldaps://ldap1", "ldaps://ldap2"]
-}
-
-resource "boundary_account_ldap" "foo" {
-	name           = "%s"
-	description    = "%s"
-	type           = "ldap"
-	login_name     = "foo"
-	auth_method_id = boundary_auth_method_ldap.foo.id
-}`, testAccountLdapName, testAccountLdapDesc)
-
-	testAccountLdapUpdate = fmt.Sprintf(`
-resource "boundary_auth_method_ldap" "foo" {
-	name        = "test"
-	description = "test account"
-	type        = "ldap"
-	scope_id    = boundary_scope.org1.id
-	depends_on = [boundary_role.org1_admin]
-	urls         	  = ["ldaps://ldap1", "ldaps://ldap2"]
-}
-
-resource "boundary_account_ldap" "foo" {
-	name           = "%s"
-	description    = "%s"
-	type           = "ldap"
-	login_name     = "foo"
-	auth_method_id = boundary_auth_method_ldap.foo.id
-}`, testAccountLdapNameUpdate, testAccountLdapDescUpdate)
-
-	testAccountLdapWithoutTypeField = fmt.Sprintf(`
-resource "boundary_auth_method_ldap" "foo" {
-	name        = "test"
-	description = "test account"
-	type        = "ldap"
-	scope_id    = boundary_scope.org1.id
-	depends_on = [boundary_role.org1_admin]
-	urls         	  = ["ldaps://ldap1", "ldaps://ldap2"]
-}
-
-resource "boundary_account_ldap" "foo" {
-	name           = "%s"
-	description    = "%s"
-	login_name     = "foo"
-	auth_method_id = boundary_auth_method_ldap.foo.id
-}`, testAccountLdapNameUpdate, testAccountLdapDescUpdate)
-
-	testProviderLdapAccountConfig = `
-resource "boundary_account_ldap" "test-ldap" {
-	name           = "alice"
-	description    = "test"
-	type           = "ldap"
-	login_name     = "%s"
-	auth_method_id = boundary_auth_method_ldap.test-ldap.id
-}
-
-resource "boundary_user" "alice" {
-	name        = "alice"
-	description = "test user resource"
-	account_ids = [boundary_account_ldap.test-ldap.id]
-	scope_id = boundary_scope.global.id
-}
-
-resource "boundary_role" "ldap_principal" {
-	scope_id = boundary_scope.global.id
-	grant_scope_id = boundary_scope.global.id
-	grant_strings = ["id=*;type=*;actions=*"]
-	principal_ids = [boundary_user.alice.id]
-}`
-)
-
-func TestAccLdapAccount(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
-	defer tc.Shutdown()
-	url := tc.ApiAddrs()[0]
-
-	var provider *schema.Provider
-
-	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckAccountResourceDestroy(t, provider, baseAccountType),
-		Steps: []resource.TestStep{
-			{
-				// create
-				Config: testConfig(url, fooOrg, testAccountLdap),
-				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "description", testAccountLdapDesc),
-					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "name", testAccountLdapName),
-					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "type", "ldap"),
-					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "login_name", "foo"),
-					testAccCheckAccountResourceExists(provider, "boundary_account_ldap.foo"),
-				),
-			},
-			importStep("boundary_account_ldap.foo", "ldap"),
-			{
-				// update
-				Config: testConfig(url, fooOrg, testAccountLdapUpdate),
-				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "description", testAccountLdapDescUpdate),
-					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "name", testAccountLdapNameUpdate),
-					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "type", "ldap"),
-					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "login_name", "foo"),
-					testAccCheckAccountResourceExists(provider, "boundary_account_ldap.foo"),
-				),
-			},
-			importStep("boundary_account_ldap.foo", "ldap"),
-			{
-				// update without passing type field
-				Config: testConfig(url, fooOrg, testAccountLdapWithoutTypeField),
-				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "description", testAccountLdapDescUpdate),
-					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "name", testAccountLdapNameUpdate),
-					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "type", "ldap"),
-					resource.TestCheckResourceAttr("boundary_account_ldap.foo", "login_name", "foo"),
-					testAccCheckAccountResourceExists(provider, "boundary_account_ldap.foo"),
-				),
-			},
-			importStep("boundary_account_ldap.foo", "ldap"),
-		},
-	})
-}

internal/provider/resource_account_oidc_test.go

@@ -1,97 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
-package provider
-
-import (
-	"fmt"
-	"strings"
-	"testing"
-
-	"github.com/hashicorp/boundary/testing/controller"
-	"github.com/hashicorp/cap/oidc"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-)
-
-const (
-	fooAccountOidcDesc       = "test account oidc"
-	fooAccountOidcDescUpdate = "test account oidc update"
-)
-
-var (
-	fooAccountOidc = `
-resource "boundary_auth_method_oidc" "foo" {
-	name        = "test"
-	description = "test account oidc auth method"
-	scope_id    = boundary_scope.org1.id
-	depends_on  = [boundary_role.org1_admin]
-
-	issuer            = "%s"
-	client_id         = "foo_id"
-	client_secret     = "foo_secret"
-	max_age           = 0
-	api_url_prefix    = "http://localhost:9200"
-	idp_ca_certs   = [
-<<EOT
-%s
-EOT
-	]
-	allowed_audiences = ["foo_aud"]
-	signing_algorithms = ["ES256"]
-	account_claim_maps = ["oid=sub"]
-	claims_scopes = ["profile"]
-}
-
-resource "boundary_account_oidc" "foo" {
-	name           = "test"
-	description    = "%s"
-	subject		   = "%s"
-	issuer		   = "%s"
-	auth_method_id = boundary_auth_method_oidc.foo.id
-}`
-)
-
-func TestAccOidcAccount(t *testing.T) {
-	tp := oidc.StartTestProvider(t)
-	tc := controller.NewTestController(t, tcConfig...)
-	defer tc.Shutdown()
-	url := tc.ApiAddrs()[0]
-
-	var provider *schema.Provider
-
-	tpCert := strings.TrimSpace(tp.CACert())
-	createConfig := fmt.Sprintf(fooAccountOidc, tp.Addr(), tpCert, fooAccountOidcDesc, tp.ExpectedSubject(), tp.Addr())
-	updateConfig := fmt.Sprintf(fooAccountOidc, tp.Addr(), tpCert, fooAccountOidcDescUpdate, tp.ExpectedSubject(), tp.Addr())
-
-	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckAccountResourceDestroy(t, provider, oidcAccountType),
-		Steps: []resource.TestStep{
-			{
-				// create
-				Config: testConfig(url, fooOrg, createConfig),
-				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttr("boundary_account_oidc.foo", "description", fooAccountOidcDesc),
-					resource.TestCheckResourceAttr("boundary_account_oidc.foo", "name", "test"),
-					resource.TestCheckResourceAttr("boundary_account_oidc.foo", "issuer", tp.Addr()),
-					resource.TestCheckResourceAttr("boundary_account_oidc.foo", "subject", tp.ExpectedSubject()),
-					testAccCheckAccountResourceExists(provider, "boundary_account_oidc.foo"),
-				),
-			},
-			importStep("boundary_account_oidc.foo", "oidc"),
-			{
-				// update
-				Config: testConfig(url, fooOrg, updateConfig),
-				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttr("boundary_account_oidc.foo", "description", fooAccountOidcDescUpdate),
-					resource.TestCheckResourceAttr("boundary_account_oidc.foo", "name", "test"),
-					resource.TestCheckResourceAttr("boundary_account_oidc.foo", "issuer", tp.Addr()),
-					resource.TestCheckResourceAttr("boundary_account_oidc.foo", "subject", tp.ExpectedSubject()),
-					testAccCheckAccountResourceExists(provider, "boundary_account_oidc.foo"),
-				),
-			},
-			importStep("boundary_account_oidc.foo", "oidc"),
-		},
-	})
-}

internal/provider/resource_account_password.go

@@ -56,9 +56,7 @@ func resourceAccountPassword() *schema.Resource {
 			TypeKey: {
 				Description: "The resource type.",
 				Type:        schema.TypeString,
-				Deprecated:  "The value for this field will be infered since 'password' is the only possible value.",
-				Default:     accountTypePassword,
-				Optional:    true,
+				Required:    true,
 				ForceNew:    true,
 			},
 			accountLoginNameKey: {

internal/provider/resource_account_password_test.go

@@ -4,12 +4,17 @@
 package provider
 
 import (
+	"context"
 	"fmt"
+	"net/http"
 	"testing"
 
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/accounts"
 	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
 )
 
 const (
@@ -53,23 +58,6 @@ resource "boundary_account_password" "foo" {
 	password       = "foofoofoo"
 	auth_method_id = boundary_auth_method.foo.id
 }`, fooAccountPasswordDescUpdate)
-
-	fooAccountPasswordWithoutTypeField = fmt.Sprintf(`
-	resource "boundary_auth_method" "foo" {
-		name        = "test"
-		description = "test account"
-		type        = "password"
-		scope_id    = boundary_scope.org1.id
-		depends_on = [boundary_role.org1_admin]
-	}
-	
-	resource "boundary_account_password" "foo" {
-		name           = "test"
-		description    = "%s"
-		login_name     = "foo"
-		password       = "foofoofoo"
-		auth_method_id = boundary_auth_method.foo.id
-	}`, fooAccountPasswordDescUpdate)
 )
 
 func TestAccAccount(t *testing.T) {
@@ -81,7 +69,7 @@ func TestAccAccount(t *testing.T) {
 
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckAccountResourceDestroy(t, provider, passwordAccountType),
+		CheckDestroy:      testAccCheckAccountPasswordResourceDestroy(t, provider),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -92,7 +80,7 @@ func TestAccAccount(t *testing.T) {
 					resource.TestCheckResourceAttr("boundary_account_password.foo", "type", "password"),
 					resource.TestCheckResourceAttr("boundary_account_password.foo", "login_name", "foo"),
 					resource.TestCheckResourceAttr("boundary_account_password.foo", "password", "foofoofoo"),
-					testAccCheckAccountResourceExists(provider, "boundary_account_password.foo"),
+					testAccCheckAccountPasswordResourceExists(provider, "boundary_account_password.foo"),
 				),
 			},
 			importStep("boundary_account_password.foo", "password"),
@@ -105,23 +93,61 @@ func TestAccAccount(t *testing.T) {
 					resource.TestCheckResourceAttr("boundary_account_password.foo", "type", "password"),
 					resource.TestCheckResourceAttr("boundary_account_password.foo", "login_name", "foo"),
 					resource.TestCheckResourceAttr("boundary_account_password.foo", "password", "foofoofoo"),
-					testAccCheckAccountResourceExists(provider, "boundary_account_password.foo"),
-				),
-			},
-			importStep("boundary_account_password.foo", "password"),
-			{
-				// update without passing type field
-				Config: testConfig(url, fooOrg, fooAccountPasswordWithoutTypeField),
-				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttr("boundary_account_password.foo", "description", fooAccountPasswordDescUpdate),
-					resource.TestCheckResourceAttr("boundary_account_password.foo", "name", "test"),
-					resource.TestCheckResourceAttr("boundary_account_password.foo", "type", "password"),
-					resource.TestCheckResourceAttr("boundary_account_password.foo", "login_name", "foo"),
-					resource.TestCheckResourceAttr("boundary_account_password.foo", "password", "foofoofoo"),
-					testAccCheckAccountResourceExists(provider, "boundary_account_password.foo"),
+					testAccCheckAccountPasswordResourceExists(provider, "boundary_account_password.foo"),
 				),
 			},
 			importStep("boundary_account_password.foo", "password"),
 		},
 	})
 }
+
+func testAccCheckAccountPasswordResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Not found: %s", name)
+		}
+
+		id := rs.Primary.ID
+		if id == "" {
+			return fmt.Errorf("No ID is set")
+		}
+
+		md := testProvider.Meta().(*metaData)
+
+		amClient := accounts.NewClient(md.client)
+
+		if _, err := amClient.Read(context.Background(), id); err != nil {
+			return fmt.Errorf("Got an error when reading account %q: %v", id, err)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckAccountPasswordResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if testProvider.Meta() == nil {
+			t.Fatal("got nil provider metadata")
+		}
+		md := testProvider.Meta().(*metaData)
+
+		for _, rs := range s.RootModule().Resources {
+			switch rs.Type {
+			case "boundary_account_password":
+				id := rs.Primary.ID
+
+				amClient := accounts.NewClient(md.client)
+
+				_, err := amClient.Read(context.Background(), id)
+				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
+					return fmt.Errorf("didn't get a 404 when reading destroyed account %q: %v", id, err)
+				}
+
+			default:
+				continue
+			}
+		}
+		return nil
+	}
+}

internal/provider/resource_account_test.go

@@ -69,7 +69,7 @@ func TestAccAccountBase(t *testing.T) {
 
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckAccountResourceDestroy(t, provider, baseAccountType),
+		CheckDestroy:      testAccCheckAccountResourceDestroy(t, provider),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -125,15 +125,7 @@ func testAccCheckAccountResourceExists(testProvider *schema.Provider, name strin
 	}
 }
 
-type accountType string
-
-const (
-	baseAccountType     accountType = "boundary_account"
-	passwordAccountType accountType = "boundary_account_password"
-	oidcAccountType     accountType = "boundary_account_oidc"
-)
-
-func testAccCheckAccountResourceDestroy(t *testing.T, testProvider *schema.Provider, typ accountType) resource.TestCheckFunc {
+func testAccCheckAccountResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if testProvider.Meta() == nil {
 			t.Fatal("got nil provider metadata")
@@ -142,7 +134,7 @@ func testAccCheckAccountResourceDestroy(t *testing.T, testProvider *schema.Provi
 
 		for _, rs := range s.RootModule().Resources {
 			switch rs.Type {
-			case string(typ):
+			case "boundary_account":
 				id := rs.Primary.ID
 
 				amClient := accounts.NewClient(md.client)

internal/provider/resource_auth_method_ldap.go

@@ -1,817 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
-package provider
-
-import (
-	"context"
-	"net/http"
-
-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/authmethods"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-)
-
-const (
-	authMethodTypeLdap = "ldap"
-
-	authMethodLdapStartTlsField                  = "start_tls"
-	authMethodLdapInsecureTlsField               = "insecure_tls"
-	authMethodLdapDiscoverDnField                = "discover_dn"
-	authMethodLdapAnonGrpSearchField             = "anon_group_search"
-	authMethodLdapUpnDomainField                 = "upn_domain"
-	authMethodLdapUrlsField                      = "urls"
-	authMethodLdapUserDnField                    = "user_dn"
-	authMethodLdapUserAttrField                  = "user_attr"
-	authMethodLdapUserFilterField                = "user_filter"
-	authMethodLdapEnableGrpsField                = "enable_groups"
-	authMethodLdapGroupDnField                   = "group_dn"
-	authMethodLdapGroupAttrField                 = "group_attr"
-	authMethodLdapGroupFilterField               = "group_filter"
-	authMethodLdapCertificatesField              = "certificates"
-	authMethodLdapClientCertField                = "client_certificate"
-	authMethodLdapClientCertKeyField             = "client_certificate_key"
-	authMethodLdapBindDnField                    = "bind_dn"
-	authMethodLdapBindPasswordField              = "bind_password"
-	authMethodLdapUseTokenGrpsField              = "use_token_groups"
-	authMethodLdapAccountAttrMapsField           = "account_attribute_maps"
-	authMethodLdapPrimaryAuthMethodForScopeField = "is_primary_for_scope"
-	authMethodLdapStateField                     = "state"
-
-	// computed-only parameters
-	authMethodLdapClientCertKeyHmacKey = "client_certificate_key_hmac"
-	authMethodLdapBindPasswordHmacKey  = "bind_password_hmac"
-)
-
-func resourceAuthMethodLdap() *schema.Resource {
-	return &schema.Resource{
-		Description: "The LDAP auth method resource allows you to configure a Boundary auth_method_ldap.",
-
-		CreateContext: resourceAuthMethodLdapCreate,
-		ReadContext:   resourceAuthMethodLdapRead,
-		UpdateContext: resourceAuthMethodLdapUpdate,
-		DeleteContext: resourceAuthMethodDelete,
-		Importer: &schema.ResourceImporter{
-			StateContext: schema.ImportStatePassthroughContext,
-		},
-
-		Schema: map[string]*schema.Schema{
-			IDKey: {
-				Description: "The ID of the auth method.",
-				Type:        schema.TypeString,
-				Computed:    true,
-			},
-			NameKey: {
-				Description: "The auth method name. Defaults to the resource name.",
-				Type:        schema.TypeString,
-				Optional:    true,
-			},
-			DescriptionKey: {
-				Description: "The auth method description.",
-				Type:        schema.TypeString,
-				Optional:    true,
-			},
-			ScopeIdKey: {
-				Description: "The scope ID.",
-				Type:        schema.TypeString,
-				Required:    true,
-				ForceNew:    true,
-			},
-
-			// LDAP specific configurable parameters
-			authMethodLdapStartTlsField: {
-				Description: "Issue StartTLS command after connecting (optional).",
-				Type:        schema.TypeBool,
-				Optional:    true,
-			},
-			authMethodLdapInsecureTlsField: {
-				Description: "Skip the LDAP server SSL certificate validation (optional) - insecure and use with caution.",
-				Type:        schema.TypeBool,
-				Optional:    true,
-			},
-			authMethodLdapDiscoverDnField: {
-				Description: "Use anon bind to discover the bind DN of a user (optional).",
-				Type:        schema.TypeBool,
-				Optional:    true,
-			},
-			authMethodLdapAnonGrpSearchField: {
-				Description: "Use anon bind when performing LDAP group searches (optional).",
-				Type:        schema.TypeBool,
-				Optional:    true,
-			},
-			authMethodLdapUpnDomainField: {
-				Description: "The userPrincipalDomain used to construct the UPN string for the authenticating user (optional).",
-				Type:        schema.TypeString,
-				Optional:    true,
-			},
-			authMethodLdapUrlsField: {
-				Description: "The LDAP URLs that specify LDAP servers to connect to (required).  May be specified multiple times.",
-				Type:        schema.TypeList,
-				Elem: &schema.Schema{
-					Type: schema.TypeString,
-				},
-				Optional: true,
-			},
-			authMethodLdapUserDnField: {
-				Description: "The base DN under which to perform user search (optional).",
-				Type:        schema.TypeString,
-				Optional:    true,
-			},
-			authMethodLdapUserAttrField: {
-				Description: "The attribute on user entry matching the username passed when authenticating (optional).",
-				Type:        schema.TypeString,
-				Optional:    true,
-			},
-			authMethodLdapUserFilterField: {
-				Description: "A go template used to construct a LDAP user search filter (optional).",
-				Type:        schema.TypeString,
-				Optional:    true,
-			},
-			authMethodLdapEnableGrpsField: {
-				Description: "Find the authenticated user's groups during authentication (optional).",
-				Type:        schema.TypeBool,
-				Optional:    true,
-			},
-			authMethodLdapGroupDnField: {
-				Description: "The base DN under which to perform group search.",
-				Type:        schema.TypeString,
-				Optional:    true,
-			},
-			authMethodLdapGroupAttrField: {
-				Description: "The attribute that enumerates a user's group membership from entries returned by a group search (optional).",
-				Type:        schema.TypeString,
-				Optional:    true,
-			},
-			authMethodLdapGroupFilterField: {
-				Description: "A go template used to construct a LDAP group search filter (optional).",
-				Type:        schema.TypeString,
-				Optional:    true,
-			},
-			authMethodLdapCertificatesField: {
-				Description: "PEM-encoded X.509 CA certificate in ASN.1 DER form that can be used as a trust anchor when connecting to an LDAP server(optional).  This may be specified multiple times",
-				Type:        schema.TypeList,
-				Elem: &schema.Schema{
-					Type: schema.TypeString,
-				},
-				Optional: true,
-			},
-			authMethodLdapClientCertField: {
-				Description: "PEM-encoded X.509 client certificate in ASN.1 DER form that can be used to authenticate against an LDAP server(optional).",
-				Type:        schema.TypeString,
-				Optional:    true,
-			},
-			authMethodLdapClientCertKeyField: {
-				Description: "PEM-encoded X.509 client certificate key in PKCS #8, ASN.1 DER form used with the client certificate (optional).",
-				Type:        schema.TypeString,
-				Optional:    true,
-			},
-			authMethodLdapBindDnField: {
-				Description: "The distinguished name of entry to bind when performing user and group searches (optional).",
-				Type:        schema.TypeString,
-				Optional:    true,
-			},
-			authMethodLdapBindPasswordField: {
-				Description: "The password to use along with bind-dn performing user and group searches (optional).",
-				Type:        schema.TypeString,
-				Optional:    true,
-			},
-			authMethodLdapUseTokenGrpsField: {
-				Description: "Use the Active Directory tokenGroups constructed attribute of the user to find the group memberships (optional).",
-				Type:        schema.TypeBool,
-				Optional:    true,
-			},
-			authMethodLdapAccountAttrMapsField: {
-				Description: "Account attribute maps fullname and email.",
-				Type:        schema.TypeList,
-				Elem: &schema.Schema{
-					Type: schema.TypeString,
-				},
-				Optional: true,
-			},
-			authMethodLdapStateField: {
-				Description: "Can be one of 'inactive', 'active-private', or 'active-public'. Defaults to active-public.",
-				Type:        schema.TypeString,
-				Optional:    true,
-				Computed:    true,
-			},
-
-			// LDAP specific immutable and computed parameters
-			authMethodLdapClientCertKeyHmacKey: {
-				Description: "The HMAC of the client certificate key returned by the Boundary controller, which is used for comparison after initial setting of the value.",
-				Type:        schema.TypeString,
-				Optional:    true,
-				Computed:    true,
-			},
-			authMethodLdapBindPasswordHmacKey: {
-				Description: "The HMAC of the bind password returned by the Boundary controller, which is used for comparison after initial setting of the value.",
-				Type:        schema.TypeString,
-				Optional:    true,
-				Computed:    true,
-			},
-
-			authMethodLdapPrimaryAuthMethodForScopeField: {
-				Description: "When true, makes this auth method the primary auth method for the scope in which it resides. The primary auth method for a scope means the the user will be automatically created when they login using an LDAP account.",
-				Type:        schema.TypeBool,
-				Optional:    true,
-			},
-
-			TypeKey: {
-				Description: "The type of auth method; hardcoded.",
-				Type:        schema.TypeString,
-				Default:     authMethodTypeLdap,
-				Optional:    true,
-			},
-		},
-	}
-}
-
-func setFromLdapAuthMethodResponseMap(d *schema.ResourceData, raw map[string]interface{}) error {
-	if err := d.Set(NameKey, raw[NameKey]); err != nil {
-		return err
-	}
-	if err := d.Set(DescriptionKey, raw[DescriptionKey]); err != nil {
-		return err
-	}
-	if err := d.Set(ScopeIdKey, raw[ScopeIdKey]); err != nil {
-		return err
-	}
-	if err := d.Set(TypeKey, raw[TypeKey]); err != nil {
-		return err
-	}
-
-	if attrsVal, ok := raw["attributes"]; ok {
-		attrs := attrsVal.(map[string]interface{})
-
-		// these are always set
-		if err := d.Set(authMethodLdapUrlsField, attrs[authMethodLdapUrlsField].([]interface{})); err != nil {
-			return err
-		}
-		if err := d.Set(authMethodLdapStateField, attrs[authMethodLdapStateField].(string)); err != nil {
-			return err
-		}
-
-		// optional attributes
-		if v, ok := attrs[authMethodLdapStartTlsField]; ok {
-			if err := d.Set(authMethodLdapStartTlsField, v.(bool)); err != nil {
-				return err
-			}
-		} else {
-			d.Set(authMethodLdapStartTlsField, false)
-		}
-
-		if v, ok := attrs[authMethodLdapInsecureTlsField]; ok {
-			if err := d.Set(authMethodLdapInsecureTlsField, v.(bool)); err != nil {
-				return err
-			}
-		} else {
-			if err := d.Set(authMethodLdapInsecureTlsField, false); err != nil {
-				return err
-			}
-		}
-
-		if v, ok := attrs[authMethodLdapDiscoverDnField]; ok {
-			if err := d.Set(authMethodLdapDiscoverDnField, v.(bool)); err != nil {
-				return err
-			}
-		} else {
-			if err := d.Set(authMethodLdapDiscoverDnField, false); err != nil {
-				return err
-			}
-		}
-
-		if v, ok := attrs[authMethodLdapAnonGrpSearchField]; ok {
-			if err := d.Set(authMethodLdapAnonGrpSearchField, v.(bool)); err != nil {
-				return err
-			}
-		} else {
-			if err := d.Set(authMethodLdapAnonGrpSearchField, false); err != nil {
-				return err
-			}
-		}
-
-		if v, ok := attrs[authMethodLdapUpnDomainField]; ok {
-			if err := d.Set(authMethodLdapUpnDomainField, v.(string)); err != nil {
-				return err
-			}
-		}
-
-		if v, ok := attrs[authMethodLdapUserDnField]; ok {
-			if err := d.Set(authMethodLdapUserDnField, v.(string)); err != nil {
-				return err
-			}
-		}
-		if v, ok := attrs[authMethodLdapUserAttrField]; ok {
-			if err := d.Set(authMethodLdapUserAttrField, v.(string)); err != nil {
-				return err
-			}
-		}
-		if v, ok := attrs[authMethodLdapUserFilterField]; ok {
-			if err := d.Set(authMethodLdapUserFilterField, v.(string)); err != nil {
-				return err
-			}
-		}
-
-		if v, ok := attrs[authMethodLdapEnableGrpsField]; ok {
-			if err := d.Set(authMethodLdapEnableGrpsField, v.(bool)); err != nil {
-				return err
-			}
-		} else {
-			if err := d.Set(authMethodLdapEnableGrpsField, false); err != nil {
-				return err
-			}
-		}
-
-		if v, ok := attrs[authMethodLdapGroupDnField]; ok {
-			if err := d.Set(authMethodLdapGroupDnField, v.(string)); err != nil {
-				return err
-			}
-		}
-		if v, ok := attrs[authMethodLdapGroupAttrField]; ok {
-			if err := d.Set(authMethodLdapGroupAttrField, v.(string)); err != nil {
-				return err
-			}
-		}
-		if v, ok := attrs[authMethodLdapGroupFilterField]; ok {
-			if err := d.Set(authMethodLdapGroupFilterField, v.(string)); err != nil {
-				return err
-			}
-		}
-
-		if v, ok := attrs[authMethodLdapCertificatesField]; ok {
-			if err := d.Set(authMethodLdapCertificatesField, v.([]interface{})); err != nil {
-				return err
-			}
-		}
-
-		if v, ok := attrs[authMethodLdapClientCertField]; ok {
-			if err := d.Set(authMethodLdapClientCertField, v.(string)); err != nil {
-				return err
-			}
-		}
-
-		if v, ok := attrs[authMethodLdapClientCertKeyField]; ok {
-			if err := d.Set(authMethodLdapClientCertKeyField, v.(string)); err != nil {
-				return err
-			}
-		}
-
-		if v, ok := attrs[authMethodLdapClientCertKeyHmacKey]; ok {
-			if err := d.Set(authMethodLdapClientCertKeyHmacKey, v.(string)); err != nil {
-				return err
-			}
-		}
-
-		if v, ok := attrs[authMethodLdapBindDnField]; ok {
-			if err := d.Set(authMethodLdapBindDnField, v.(string)); err != nil {
-				return err
-			}
-		}
-
-		if v, ok := attrs[authMethodLdapBindPasswordField]; ok {
-			if err := d.Set(authMethodLdapBindPasswordField, v.(string)); err != nil {
-				return err
-			}
-		}
-
-		if v, ok := attrs[authMethodLdapBindPasswordHmacKey]; ok {
-			if err := d.Set(authMethodLdapBindPasswordHmacKey, v.(string)); err != nil {
-				return err
-			}
-		}
-
-		if v, ok := attrs[authMethodLdapUseTokenGrpsField]; ok {
-			if err := d.Set(authMethodLdapUseTokenGrpsField, v.(bool)); err != nil {
-				return err
-			}
-		} else {
-			if err := d.Set(authMethodLdapUseTokenGrpsField, false); err != nil {
-				return err
-			}
-		}
-
-		if v, ok := attrs[authMethodLdapAccountAttrMapsField]; ok {
-			if err := d.Set(authMethodLdapAccountAttrMapsField, v.([]interface{})); err != nil {
-				return err
-			}
-		}
-
-		if v, ok := attrs[authMethodLdapStateField]; ok {
-			if err := d.Set(authMethodLdapStateField, v.(string)); err != nil {
-				return err
-			}
-		}
-	}
-
-	d.SetId(raw["id"].(string))
-
-	return nil
-}
-
-func resourceAuthMethodLdapCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	md := meta.(*metaData)
-
-	var typeStr string
-	if typeVal, ok := d.GetOk(TypeKey); ok {
-		typeStr = typeVal.(string)
-	} else {
-		return diag.Errorf("no type provided")
-	}
-
-	opts := []authmethods.Option{}
-
-	opts = append(opts, authmethods.WithAutomaticVersioning(true))
-
-	if rawUrls, ok := d.GetOk(authMethodLdapUrlsField); ok {
-		urls := []string{}
-		for _, u := range rawUrls.([]interface{}) {
-			urls = append(urls, u.(string))
-		}
-		opts = append(opts, authmethods.WithLdapAuthMethodUrls(urls))
-	}
-
-	if startTls, ok := d.GetOk(authMethodLdapStartTlsField); ok {
-		opts = append(opts, authmethods.WithLdapAuthMethodStartTls(startTls.(bool)))
-	}
-
-	if insecureTls, ok := d.GetOk(authMethodLdapInsecureTlsField); ok {
-		opts = append(opts, authmethods.WithLdapAuthMethodInsecureTls(insecureTls.(bool)))
-	}
-
-	if discoverDn, ok := d.GetOk(authMethodLdapDiscoverDnField); ok {
-		opts = append(opts, authmethods.WithLdapAuthMethodDiscoverDn(discoverDn.(bool)))
-	}
-
-	if anonGrpSearch, ok := d.GetOk(authMethodLdapAnonGrpSearchField); ok {
-		opts = append(opts, authmethods.WithLdapAuthMethodAnonGroupSearch(anonGrpSearch.(bool)))
-	}
-
-	if upnDomain, ok := d.GetOk(authMethodLdapUpnDomainField); ok {
-		opts = append(opts, authmethods.WithLdapAuthMethodUpnDomain(upnDomain.(string)))
-	}
-
-	if userDn, ok := d.GetOk(authMethodLdapUserDnField); ok {
-		opts = append(opts, authmethods.WithLdapAuthMethodUserDn(userDn.(string)))
-	}
-
-	if userAttr, ok := d.GetOk(authMethodLdapUserAttrField); ok {
-		opts = append(opts, authmethods.WithLdapAuthMethodUserAttr(userAttr.(string)))
-	}
-
-	if userFilter, ok := d.GetOk(authMethodLdapUserFilterField); ok {
-		opts = append(opts, authmethods.WithLdapAuthMethodUserFilter(userFilter.(string)))
-	}
-
-	if enableGrps, ok := d.GetOk(authMethodLdapEnableGrpsField); ok {
-		opts = append(opts, authmethods.WithLdapAuthMethodEnableGroups(enableGrps.(bool)))
-	}
-
-	if groupDn, ok := d.GetOk(authMethodLdapGroupDnField); ok {
-		opts = append(opts, authmethods.WithLdapAuthMethodGroupDn(groupDn.(string)))
-	}
-
-	if groupAttr, ok := d.GetOk(authMethodLdapGroupAttrField); ok {
-		opts = append(opts, authmethods.WithLdapAuthMethodGroupAttr(groupAttr.(string)))
-	}
-
-	if groupFilter, ok := d.GetOk(authMethodLdapGroupFilterField); ok {
-		opts = append(opts, authmethods.WithLdapAuthMethodGroupFilter(groupFilter.(string)))
-	}
-
-	if rawCerts, ok := d.GetOk(authMethodLdapCertificatesField); ok {
-		certs := []string{}
-		for _, u := range rawCerts.([]interface{}) {
-			certs = append(certs, u.(string))
-		}
-		opts = append(opts, authmethods.WithLdapAuthMethodCertificates(certs))
-	}
-
-	if clientCert, ok := d.GetOk(authMethodLdapClientCertField); ok {
-		opts = append(opts, authmethods.WithLdapAuthMethodClientCertificate(clientCert.(string)))
-	}
-
-	if clientCertKey, ok := d.GetOk(authMethodLdapClientCertKeyField); ok {
-		opts = append(opts, authmethods.WithLdapAuthMethodClientCertificateKey(clientCertKey.(string)))
-	}
-
-	if bindDn, ok := d.GetOk(authMethodLdapBindDnField); ok {
-		opts = append(opts, authmethods.WithLdapAuthMethodBindDn(bindDn.(string)))
-	}
-
-	if bindPassword, ok := d.GetOk(authMethodLdapBindPasswordField); ok {
-		opts = append(opts, authmethods.WithLdapAuthMethodBindPassword(bindPassword.(string)))
-	}
-
-	if useTokenGrps, ok := d.GetOk(authMethodLdapUseTokenGrpsField); ok {
-		opts = append(opts, authmethods.WithLdapAuthMethodUseTokenGroups(useTokenGrps.(bool)))
-	}
-
-	if rawAccountAttrMaps, ok := d.GetOk(authMethodLdapAccountAttrMapsField); ok {
-		accountAttrMaps := []string{}
-		for _, u := range rawAccountAttrMaps.([]interface{}) {
-			accountAttrMaps = append(accountAttrMaps, u.(string))
-		}
-		opts = append(opts, authmethods.WithLdapAuthMethodAccountAttributeMaps(accountAttrMaps))
-	}
-
-	state, ok := d.GetOk(authMethodLdapStateField)
-	switch ok {
-	case true:
-		opts = append(opts, authmethods.WithLdapAuthMethodState(state.(string)))
-	default:
-		opts = append(opts, authmethods.WithLdapAuthMethodState("active-public"))
-	}
-
-	if nameVal, ok := d.GetOk(NameKey); ok {
-		nameStr := nameVal.(string)
-		opts = append(opts, authmethods.WithName(nameStr))
-	}
-
-	if descVal, ok := d.GetOk(DescriptionKey); ok {
-		descStr := descVal.(string)
-		opts = append(opts, authmethods.WithDescription(descStr))
-	}
-
-	var scopeId string
-	scopeIdVal, ok := d.GetOk(ScopeIdKey)
-	switch ok {
-	case true:
-		scopeId = scopeIdVal.(string)
-	default:
-		return diag.Errorf("no scope ID provided")
-	}
-
-	amClient := authmethods.NewClient(md.client)
-
-	amcr, err := amClient.Create(ctx, typeStr, scopeId, opts...)
-	switch {
-	case err != nil:
-		return diag.Errorf("error creating auth method: %v", err)
-	case amcr == nil:
-		return diag.Errorf("nil auth method after create")
-	}
-
-	if err := setFromLdapAuthMethodResponseMap(d, amcr.GetResponse().Map); err != nil {
-		return diag.Errorf("%v", err)
-	}
-
-	amid := amcr.GetResponse().Map["id"].(string)
-
-	// update scope when set to primary
-	if p, ok := d.GetOk(authMethodLdapPrimaryAuthMethodForScopeField); ok {
-		if p.(bool) {
-			if err := updateScopeWithPrimaryAuthMethodId(ctx, scopeId, amid, meta); err != nil {
-				return diag.Errorf("%v", err)
-			}
-
-			amcr.GetResponse().Map[authMethodLdapPrimaryAuthMethodForScopeField] = true
-		}
-	}
-
-	if err := setFromLdapAuthMethodResponseMap(d, amcr.GetResponse().Map); err != nil {
-		return diag.FromErr(err)
-	}
-	return nil
-}
-
-func resourceAuthMethodLdapRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	md := meta.(*metaData)
-	amClient := authmethods.NewClient(md.client)
-
-	amrr, err := amClient.Read(ctx, d.Id())
-	if err != nil {
-		if apiErr := api.AsServerError(err); apiErr.Response().StatusCode() == http.StatusNotFound {
-			d.SetId("")
-			return nil
-		}
-		return diag.Errorf("error reading auth method: %v", err)
-	}
-	if amrr == nil {
-		return diag.Errorf("auth method nil after read")
-	}
-
-	serr, isPrimary := readScopeIsPrimaryAuthMethodId(ctx, amrr.GetResponse().Map["scope_id"].(string), amrr.GetResponse().Map["id"].(string), meta)
-	if err != nil {
-		return diag.Errorf("%v", serr)
-	}
-
-	if isPrimary {
-		amrr.GetResponse().Map[authMethodLdapPrimaryAuthMethodForScopeField] = true
-	}
-
-	if err := setFromLdapAuthMethodResponseMap(d, amrr.GetResponse().Map); err != nil {
-		return diag.FromErr(err)
-	}
-	return nil
-}
-
-func resourceAuthMethodLdapUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	md := meta.(*metaData)
-	amClient := authmethods.NewClient(md.client)
-
-	opts := []authmethods.Option{}
-
-	if d.HasChange(NameKey) {
-		opts = append(opts, authmethods.DefaultName())
-		nameVal, ok := d.GetOk(NameKey)
-		if ok {
-			opts = append(opts, authmethods.WithName(nameVal.(string)))
-		}
-	}
-
-	if d.HasChange(DescriptionKey) {
-		opts = append(opts, authmethods.DefaultDescription())
-		descVal, ok := d.GetOk(DescriptionKey)
-		if ok {
-			opts = append(opts, authmethods.WithDescription(descVal.(string)))
-		}
-	}
-
-	if d.HasChange(authMethodLdapUrlsField) {
-		if rawUrls, ok := d.GetOk(authMethodLdapUrlsField); ok {
-			urls := []string{}
-			for _, u := range rawUrls.([]interface{}) {
-				urls = append(urls, u.(string))
-			}
-			opts = append(opts, authmethods.WithLdapAuthMethodUrls(urls))
-		}
-	}
-
-	if d.HasChange(authMethodLdapStartTlsField) {
-		opts = append(opts, authmethods.DefaultLdapAuthMethodStartTls())
-		if startTls, ok := d.GetOk(authMethodLdapStartTlsField); ok {
-			opts = append(opts, authmethods.WithLdapAuthMethodStartTls(startTls.(bool)))
-		}
-	}
-
-	if d.HasChange(authMethodLdapInsecureTlsField) {
-		opts = append(opts, authmethods.DefaultLdapAuthMethodInsecureTls())
-		if insecureTls, ok := d.GetOk(authMethodLdapInsecureTlsField); ok {
-			opts = append(opts, authmethods.WithLdapAuthMethodInsecureTls(insecureTls.(bool)))
-		}
-	}
-
-	if d.HasChange(authMethodLdapDiscoverDnField) {
-		opts = append(opts, authmethods.DefaultLdapAuthMethodDiscoverDn())
-		if discoverDn, ok := d.GetOk(authMethodLdapDiscoverDnField); ok {
-			opts = append(opts, authmethods.WithLdapAuthMethodDiscoverDn(discoverDn.(bool)))
-		}
-	}
-
-	if d.HasChange(authMethodLdapAnonGrpSearchField) {
-		opts = append(opts, authmethods.DefaultLdapAuthMethodAnonGroupSearch())
-		if AnonGrpSearch, ok := d.GetOk(authMethodLdapAnonGrpSearchField); ok {
-			opts = append(opts, authmethods.WithLdapAuthMethodAnonGroupSearch(AnonGrpSearch.(bool)))
-		}
-	}
-
-	if d.HasChange(authMethodLdapUpnDomainField) {
-		opts = append(opts, authmethods.DefaultLdapAuthMethodUpnDomain())
-		if upnDomain, ok := d.GetOk(authMethodLdapUpnDomainField); ok {
-			opts = append(opts, authmethods.WithLdapAuthMethodUpnDomain(upnDomain.(string)))
-		}
-	}
-
-	if d.HasChange(authMethodLdapUserDnField) {
-		opts = append(opts, authmethods.DefaultLdapAuthMethodUserDn())
-		if userDn, ok := d.GetOk(authMethodLdapUserDnField); ok {
-			opts = append(opts, authmethods.WithLdapAuthMethodUserDn(userDn.(string)))
-		}
-	}
-
-	if d.HasChange(authMethodLdapUserAttrField) {
-		opts = append(opts, authmethods.DefaultLdapAuthMethodUserAttr())
-		if userAttr, ok := d.GetOk(authMethodLdapUserAttrField); ok {
-			opts = append(opts, authmethods.WithLdapAuthMethodUserAttr(userAttr.(string)))
-		}
-	}
-
-	if d.HasChange(authMethodLdapUserFilterField) {
-		opts = append(opts, authmethods.DefaultLdapAuthMethodUserFilter())
-		if userFilter, ok := d.GetOk(authMethodLdapUserFilterField); ok {
-			opts = append(opts, authmethods.WithLdapAuthMethodUserFilter(userFilter.(string)))
-		}
-	}
-
-	if d.HasChange(authMethodLdapEnableGrpsField) {
-		opts = append(opts, authmethods.DefaultLdapAuthMethodEnableGroups())
-		if enableGrps, ok := d.GetOk(authMethodLdapEnableGrpsField); ok {
-			opts = append(opts, authmethods.WithLdapAuthMethodEnableGroups(enableGrps.(bool)))
-		}
-	}
-
-	if d.HasChange(authMethodLdapGroupDnField) {
-		opts = append(opts, authmethods.DefaultLdapAuthMethodGroupDn())
-		if groupDn, ok := d.GetOk(authMethodLdapGroupDnField); ok {
-			opts = append(opts, authmethods.WithLdapAuthMethodGroupDn(groupDn.(string)))
-		}
-	}
-
-	if d.HasChange(authMethodLdapGroupAttrField) {
-		opts = append(opts, authmethods.DefaultLdapAuthMethodGroupAttr())
-		if groupAttr, ok := d.GetOk(authMethodLdapGroupAttrField); ok {
-			opts = append(opts, authmethods.WithLdapAuthMethodGroupAttr(groupAttr.(string)))
-		}
-	}
-
-	if d.HasChange(authMethodLdapGroupFilterField) {
-		opts = append(opts, authmethods.DefaultLdapAuthMethodGroupFilter())
-		if groupFilter, ok := d.GetOk(authMethodLdapGroupFilterField); ok {
-			opts = append(opts, authmethods.WithLdapAuthMethodGroupFilter(groupFilter.(string)))
-		}
-	}
-
-	if d.HasChange(authMethodLdapCertificatesField) {
-		opts = append(opts, authmethods.DefaultLdapAuthMethodCertificates())
-		if rawCerts, ok := d.GetOk(authMethodLdapCertificatesField); ok {
-			certs := []string{}
-			for _, u := range rawCerts.([]interface{}) {
-				certs = append(certs, u.(string))
-			}
-			opts = append(opts, authmethods.WithLdapAuthMethodCertificates(certs))
-		}
-	}
-
-	if d.HasChange(authMethodLdapClientCertField) {
-		opts = append(opts, authmethods.DefaultLdapAuthMethodClientCertificate())
-		if clientCert, ok := d.GetOk(authMethodLdapClientCertField); ok {
-			opts = append(opts, authmethods.WithLdapAuthMethodClientCertificate(clientCert.(string)))
-		}
-	}
-
-	if d.HasChange(authMethodLdapClientCertKeyField) {
-		opts = append(opts, authmethods.DefaultLdapAuthMethodClientCertificateKey())
-		if clientCertKey, ok := d.GetOk(authMethodLdapClientCertKeyField); ok {
-			opts = append(opts, authmethods.WithLdapAuthMethodClientCertificateKey(clientCertKey.(string)))
-		}
-	}
-
-	if d.HasChange(authMethodLdapBindDnField) {
-		opts = append(opts, authmethods.DefaultLdapAuthMethodBindDn())
-		if bindDn, ok := d.GetOk(authMethodLdapBindDnField); ok {
-			opts = append(opts, authmethods.WithLdapAuthMethodBindDn(bindDn.(string)))
-		}
-	}
-
-	if d.HasChange(authMethodLdapBindPasswordField) {
-		opts = append(opts, authmethods.DefaultLdapAuthMethodBindPassword())
-		if bindPassword, ok := d.GetOk(authMethodLdapBindPasswordField); ok {
-			opts = append(opts, authmethods.WithLdapAuthMethodBindPassword(bindPassword.(string)))
-		}
-	}
-
-	if d.HasChange(authMethodLdapUseTokenGrpsField) {
-		opts = append(opts, authmethods.DefaultLdapAuthMethodUseTokenGroups())
-		if useTokenGrps, ok := d.GetOk(authMethodLdapUseTokenGrpsField); ok {
-			opts = append(opts, authmethods.WithLdapAuthMethodUseTokenGroups(useTokenGrps.(bool)))
-		}
-	}
-
-	if d.HasChange(authMethodLdapAccountAttrMapsField) {
-		opts = append(opts, authmethods.DefaultLdapAuthMethodAccountAttributeMaps())
-		if rawAccountAttrMaps, ok := d.GetOk(authMethodLdapAccountAttrMapsField); ok {
-			accountAttrMaps := []string{}
-			for _, u := range rawAccountAttrMaps.([]interface{}) {
-				accountAttrMaps = append(accountAttrMaps, u.(string))
-			}
-			opts = append(opts, authmethods.WithLdapAuthMethodAccountAttributeMaps(accountAttrMaps))
-		}
-	}
-
-	if d.HasChange(authMethodLdapStateField) {
-		opts = append(opts, authmethods.DefaultLdapAuthMethodState())
-		if state, ok := d.GetOk(authMethodLdapStateField); ok {
-			opts = append(opts, authmethods.WithLdapAuthMethodState(state.(string)))
-		}
-	}
-
-	if len(opts) > 0 {
-		opts = append(opts, authmethods.WithAutomaticVersioning(true))
-		amur, err := amClient.Update(ctx, d.Id(), 0, opts...)
-		if err != nil {
-			return diag.Errorf("error updating auth method: %v", err)
-		}
-
-		if d.HasChange(authMethodLdapPrimaryAuthMethodForScopeField) {
-			if p, ok := d.GetOk(authMethodLdapPrimaryAuthMethodForScopeField); ok {
-				if p.(bool) {
-					if err := updateScopeWithPrimaryAuthMethodId(
-						ctx,
-						amur.GetResponse().Map["scope_id"].(string),
-						amur.GetResponse().Map["id"].(string),
-						meta); err != nil {
-						return diag.Errorf("%v", err)
-					}
-
-					amur.GetResponse().Map[authMethodLdapPrimaryAuthMethodForScopeField] = true
-				}
-			}
-		}
-
-		if err := setFromLdapAuthMethodResponseMap(d, amur.GetResponse().Map); err != nil {
-			return diag.FromErr(err)
-		}
-		return nil
-	}
-	return nil
-}

internal/provider/resource_auth_method_ldap_test.go

@@ -1,199 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
-package provider
-
-import (
-	"fmt"
-	"strings"
-	"testing"
-
-	"github.com/hashicorp/boundary/testing/controller"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/jimlambrt/gldap/testdirectory"
-)
-
-const (
-	testAuthMethodLdapDesc = "test auth method ldap"
-
-	testAuthMethodLdapDescUpdate = "test auth method ldap update"
-
-	testAuthMethodLdapCert = `-----BEGIN CERTIFICATE-----
-MIIDsjCCApoCCQCslgm7fAu/VzANBgkqhkiG9w0BAQsFADCBmjELMAkGA1UEBhMC
-VVMxCzAJBgNVBAgMAldBMRMwEQYDVQQHDApCZWxsaW5naGFtMRIwEAYDVQQKDAlI
-YXNoaUNvcnAxETAPBgNVBAsMCEJvdW5kYXJ5MRswGQYDVQQDDBJib3VuZGFyeXBy
-b2plY3QuaW8xJTAjBgkqhkiG9w0BCQEWFmptYWxuaWNrQGhhc2hpY29ycC5jb20w
-HhcNMjEwNDA2MjMzNTIxWhcNMjYwNDA1MjMzNTIxWjCBmjELMAkGA1UEBhMCVVMx
-CzAJBgNVBAgMAldBMRMwEQYDVQQHDApCZWxsaW5naGFtMRIwEAYDVQQKDAlIYXNo
-aUNvcnAxETAPBgNVBAsMCEJvdW5kYXJ5MRswGQYDVQQDDBJib3VuZGFyeXByb2pl
-Y3QuaW8xJTAjBgkqhkiG9w0BCQEWFmptYWxuaWNrQGhhc2hpY29ycC5jb20wggEi
-MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDUa/ZLwYhTQ2hGzlwy/sB9xY9h
-dM4qzY8DUF3Sin/+J2j59q3/vXZA7PS+o1GhoG1nW3J51zgyNFOY/EKHdtxVBken
-YTTG+JswzrcTxsMV7/sYDgCLq6W8dPMV72gPH/3dRi3/0KUHtA6rBOf0Shf0f6Sz
-7VmgTWcNmLvXpHKOs4YkjOL/tyflTgNm5j1dOa53TtwtMyvCcpGrB7PGL8m5+E2U
-qxOzQ9kWfA6zr4Gl5rIm+Us8Ez3n1yGwjwFBteexk1Fot8zWKhoy7pZ3ZjWRpjwL
-hfGs5eJs4kERQVAGONt39ZIR6OzOFxAsvI9WrMvxAsdCK63RtF2k4r0X21yDAgMB
-AAEwDQYJKoZIhvcNAQELBQADggEBAJZcl7Zxjya23IcOV8jZDdCHtqnbcg9TcQb+
-kpX1uEKJMFJoNmNK1q//nJxG1YBn3G8t9XtO6Kc6egdGHXWnOsM37N9hbYPJ2kW1
-WWAwqWkQbV3wb0cc6MuU1S9xivOqwM046ZIcjrWR4T4tEUSUfYc3I+Yd8APdapn8
-vePgWnmi/aSsx9RxVOUrzmVhzgN7rQJZGwnYYnxl4cwy2jxpysmXzg/grfXCZs/V
-Kkc7Y5Ph6vRQ+vPCeB7QUxHxjlr8aq+rYDIaSiZ+/4+qyme0ergfvZmMSU8A3NNS
-tYIMds5s2lIqVwOoyzpBEOjWBhUThH+aZu1A5c7Cb7s1eLSRX70=
------END CERTIFICATE-----`
-)
-
-var (
-	testAuthMethodLdap = `
-resource "boundary_auth_method_ldap" "test-ldap" {
-	name        = "test"
-	description = "%s"
-	scope_id    = boundary_scope.org1.id
-	depends_on  = [boundary_role.org1_admin]
-
-	start_tls   	  = true
-	discover_dn 	  = true
-	anon_group_search = true
-	upn_domain  	  = "upn-domain-test"
-  	urls         	  = ["ldaps://ldap1", "ldaps://ldap2"]
-	user_dn           = "user-dn"
-	user_attr         = "user-attr"
-	user_filter       = "user-filter"
-	enable_groups     = true
-	group_dn          = "group-dn"
-	group_attr        = "group-attr"
-	group_filter      = "group-filter"
-	bind_dn           = "bind-dn"
-	bind_password     = "bind-password"
-	use_token_groups  = true
-  	certificates 	  = [
-<<EOT
-%s
-EOT
-  ]
-}`
-
-	testPrimaryAuthMethodLdap = `
-resource "boundary_auth_method_ldap" "test-ldap" {
-	name        		 = "test"
-	description 		 = "test auth method ldap"
-	scope_id    		 = "global"
-	is_primary_for_scope = true
-  	urls         	  	 = ["ldap://%s:%d"]
-	user_dn           	 = "%s"
-	group_dn          	 = "%s"
-	discover_dn 	  	 = true
-	enable_groups    	 = true
-	insecure_tls	 	 = true
-}`
-
-	testAuthMethodLdapUpdate = `
-resource "boundary_auth_method_ldap" "test-ldap" {
-	name                 = "test"
-	description          = "%s"
-	scope_id             = boundary_scope.org1.id
-	is_primary_for_scope = true
-	depends_on           = [boundary_role.org1_admin]
-
-	start_tls            = false
-	insecure_tls  		 = true
-	discover_dn 		 = false
-	anon_group_search 	 = false
-	upn_domain  		 = "upn-domain-test-updated"
-	urls                 = ["ldaps://ldap1-updated", "ldaps://ldap2-updated"]
-	user_dn              = "user-dn-updated"
-	user_attr            = "user-attr-updated"
-	user_filter          = "user-filter-updated"
-	enable_groups        = false
-	group_dn             = "group-dn-updated"
-	group_attr           = "group-attr-updated"
-	group_filter         = "group-filter-updated"
-	bind_dn              = "bind-dn-updated"
-	bind_password        = "bind-password-updated" 
-	use_token_groups     = false
-	state                = "inactive"
-  	certificates         = [
-<<EOT
-%s
-EOT
-  ]
-	}`
-)
-
-func TestAccAuthMethodLdap(t *testing.T) {
-	td := testdirectory.Start(t,
-		testdirectory.WithDefaults(t, &testdirectory.Defaults{AllowAnonymousBind: true}),
-	)
-	tc := controller.NewTestController(t, tcConfig...)
-	defer tc.Shutdown()
-	url := tc.ApiAddrs()[0]
-
-	tdCert := strings.TrimSpace(td.Cert())
-	createConfig := fmt.Sprintf(testAuthMethodLdap, testAuthMethodLdapDesc, tdCert)
-	updateConfig := fmt.Sprintf(testAuthMethodLdapUpdate, testAuthMethodLdapDescUpdate, testAuthMethodLdapCert)
-
-	var provider *schema.Provider
-	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckAuthMethodResourceDestroy(t, provider, ldapAuthMethodType),
-		Steps: []resource.TestStep{
-			{
-				// create
-				Config: testConfig(url, fooOrg, createConfig),
-				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", "description", testAuthMethodLdapDesc),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", "name", "test"),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapStateField, "active-public"),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapStartTlsField, "true"),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapInsecureTlsField, "false"),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapDiscoverDnField, "true"),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapAnonGrpSearchField, "true"),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUpnDomainField, "upn-domain-test"),
-					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_ldap.test-ldap", authMethodLdapUrlsField, []string{"ldaps://ldap1", "ldaps://ldap2"}),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUserDnField, "user-dn"),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUserAttrField, "user-attr"),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUserFilterField, "user-filter"),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapEnableGrpsField, "true"),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapGroupDnField, "group-dn"),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapGroupAttrField, "group-attr"),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapGroupFilterField, "group-filter"),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapBindDnField, "bind-dn"),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapBindPasswordField, "bind-password"),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUseTokenGrpsField, "true"),
-					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_ldap.test-ldap", authMethodLdapCertificatesField, []string{tdCert}),
-				),
-			},
-			importStep("boundary_auth_method_ldap.test-ldap", "is_primary_for_scope", "bind_password", "client_certificate_key"),
-			{
-				// update
-				Config: testConfig(url, fooOrg, updateConfig),
-				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapStateField, "inactive"),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", "description", testAuthMethodLdapDescUpdate),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", "name", "test"),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapStartTlsField, "false"),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapInsecureTlsField, "true"),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapDiscoverDnField, "false"),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapAnonGrpSearchField, "false"), resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUpnDomainField, "upn-domain-test-updated"),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUpnDomainField, "upn-domain-test-updated"),
-					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_ldap.test-ldap", authMethodLdapUrlsField, []string{"ldaps://ldap1-updated", "ldaps://ldap2-updated"}),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUserDnField, "user-dn-updated"),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUserAttrField, "user-attr-updated"),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUserFilterField, "user-filter-updated"),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapEnableGrpsField, "false"),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapGroupDnField, "group-dn-updated"),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapGroupAttrField, "group-attr-updated"),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapGroupFilterField, "group-filter-updated"),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapBindDnField, "bind-dn-updated"),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapBindPasswordField, "bind-password-updated"),
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapUseTokenGrpsField, "false"),
-					testAccCheckAuthMethodAttrAryValueSet(provider, "boundary_auth_method_ldap.test-ldap", authMethodLdapCertificatesField, []string{testAuthMethodLdapCert}),
-					testAccCheckAuthMethodResourceExists(provider, "boundary_auth_method_ldap.test-ldap"),
-					testAccIsPrimaryForScope(provider, "boundary_auth_method_ldap.test-ldap", true),
-					testAccCheckAuthMethodResourceExists(provider, "boundary_auth_method_ldap.test-ldap"),
-				),
-			},
-			importStep("boundary_auth_method_ldap.test-ldap", "is_primary_for_scope", "bind_password", "client_certificate_key"),
-		},
-	})
-}

internal/provider/resource_auth_method_password_test.go

@@ -4,12 +4,17 @@
 package provider
 
 import (
+	"context"
 	"fmt"
+	"net/http"
 	"testing"
 
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/authmethods"
 	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
 )
 
 const (
@@ -72,3 +77,61 @@ func TestAccAuthMethodPassword(t *testing.T) {
 		},
 	})
 }
+
+func testAccCheckAuthMethodResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Not found: %s", name)
+		}
+
+		id := rs.Primary.ID
+		if id == "" {
+			return fmt.Errorf("No ID is set")
+		}
+
+		md := testProvider.Meta().(*metaData)
+
+		amClient := authmethods.NewClient(md.client)
+
+		if _, err := amClient.Read(context.Background(), id); err != nil {
+			return fmt.Errorf("Got an error when reading auth method %q: %w", id, err)
+		}
+
+		return nil
+	}
+}
+
+type authMethodType string
+
+const (
+	passwordAuthMethodType authMethodType = "boundary_auth_method_password"
+	oidcAuthMethodType     authMethodType = "boundary_auth_method_oidc"
+)
+
+func testAccCheckAuthMethodResourceDestroy(t *testing.T, testProvider *schema.Provider, typ authMethodType) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if testProvider.Meta() == nil {
+			t.Fatal("got nil provider metadata")
+		}
+		md := testProvider.Meta().(*metaData)
+
+		for _, rs := range s.RootModule().Resources {
+			switch rs.Type {
+			case string(typ):
+				id := rs.Primary.ID
+
+				amClient := authmethods.NewClient(md.client)
+
+				_, err := amClient.Read(context.Background(), id)
+				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
+					return fmt.Errorf("didn't get a 404 when reading destroyed auth method %q: %v", id, err)
+				}
+
+			default:
+				continue
+			}
+		}
+		return nil
+	}
+}

internal/provider/resource_auth_method_test.go

@@ -52,7 +52,7 @@ func TestAccBaseAuthMethodPassword(t *testing.T) {
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckAuthMethodResourceDestroy(t, provider, baseAuthMethodType),
+		CheckDestroy:      testAccCheckAuthMethodResourceDestroy(t, provider, passwordAuthMethodType),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -61,7 +61,7 @@ func TestAccBaseAuthMethodPassword(t *testing.T) {
 					resource.TestCheckResourceAttr("boundary_auth_method.foo", "description", fooBaseAuthMethodDesc),
 					resource.TestCheckResourceAttr("boundary_auth_method.foo", "name", "test"),
 					resource.TestCheckResourceAttr("boundary_auth_method.foo", "type", "password"),
-					testAccCheckAuthMethodResourceExists(provider, "boundary_auth_method.foo"),
+					testAccCheckBaseAuthMethodResourceExists(provider, "boundary_auth_method.foo"),
 				),
 			},
 			importStep("boundary_auth_method.foo"),
@@ -73,7 +73,7 @@ func TestAccBaseAuthMethodPassword(t *testing.T) {
 					resource.TestCheckResourceAttr("boundary_auth_method.foo", "description", fooBaseAuthMethodDescUpdate),
 					resource.TestCheckResourceAttr("boundary_auth_method.foo", "name", "test"),
 					resource.TestCheckResourceAttr("boundary_auth_method.foo", "type", "password"),
-					testAccCheckAuthMethodResourceExists(provider, "boundary_auth_method.foo"),
+					testAccCheckBaseAuthMethodResourceExists(provider, "boundary_auth_method.foo"),
 				),
 			},
 			importStep("boundary_auth_method.foo"),
@@ -81,7 +81,7 @@ func TestAccBaseAuthMethodPassword(t *testing.T) {
 	})
 }
 
-func testAccCheckAuthMethodResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
+func testAccCheckBaseAuthMethodResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[name]
 		if !ok {
@@ -105,16 +105,7 @@ func testAccCheckAuthMethodResourceExists(testProvider *schema.Provider, name st
 	}
 }
 
-type authMethodType string
-
-const (
-	baseAuthMethodType     authMethodType = "boundary_auth_method"
-	passwordAuthMethodType authMethodType = "boundary_auth_method_password"
-	ldapAuthMethodType     authMethodType = "boundary_auth_method_ldap"
-	oidcAuthMethodType     authMethodType = "boundary_auth_method_oidc"
-)
-
-func testAccCheckAuthMethodResourceDestroy(t *testing.T, testProvider *schema.Provider, typ authMethodType) resource.TestCheckFunc {
+func testAccCheckBaseAuthMethodResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if testProvider.Meta() == nil {
 			t.Fatal("got nil provider metadata")
@@ -123,7 +114,7 @@ func testAccCheckAuthMethodResourceDestroy(t *testing.T, testProvider *schema.Pr
 
 		for _, rs := range s.RootModule().Resources {
 			switch rs.Type {
-			case string(typ):
+			case "boundary_auth_method":
 				id := rs.Primary.ID
 
 				amClient := authmethods.NewClient(md.client)

internal/provider/resource_credential_json_test.go

@@ -70,7 +70,7 @@ func TestAccCredentialJson(t *testing.T) {
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckCredentialResourceDestroy(t, provider, jsonCredentialType),
+		CheckDestroy:      testAccCheckCredentialJsonResourceDestroy(t, provider),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -80,8 +80,8 @@ func TestAccCredentialJson(t *testing.T) {
 					resource.TestCheckResourceAttr(jsonCredResc, DescriptionKey, jsonCredDesc),
 					resource.TestCheckResourceAttr(jsonCredResc, credentialJsonObjectKey, `{"password":"password","username":"admin"}`),
 
-					testAccCheckCredentialJsonObjectHmac(),
-					testAccCheckCredentialResourceExists(provider, jsonCredResc),
+					testAccCheckCredentialJsonObjectHmac(provider),
+					testAccCheckCredentialJsonResourceExists(provider, jsonCredResc),
 				),
 			},
 			importStep(jsonCredResc, credentialJsonObjectKey),
@@ -93,8 +93,8 @@ func TestAccCredentialJson(t *testing.T) {
 					resource.TestCheckResourceAttr(jsonCredResc, DescriptionKey, jsonCredDescUpdate),
 					resource.TestCheckResourceAttr(jsonCredResc, credentialJsonObjectKey, `{"password":"password","username":"db-admin"}`),
 
-					testAccCheckCredentialJsonObjectHmac(),
-					testAccCheckCredentialResourceExists(provider, jsonCredResc),
+					testAccCheckCredentialJsonObjectHmac(provider),
+					testAccCheckCredentialJsonResourceExists(provider, jsonCredResc),
 				),
 			},
 			importStep(jsonCredResc, credentialJsonObjectKey),
@@ -114,7 +114,32 @@ func TestAccCredentialJson(t *testing.T) {
 	})
 }
 
-func testAccCheckCredentialResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
+func testAccCheckCredentialJsonResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if testProvider.Meta() == nil {
+			t.Fatal("got nil provider metadata")
+		}
+		md := testProvider.Meta().(*metaData)
+
+		for _, rs := range s.RootModule().Resources {
+			switch rs.Type {
+			case "boundary_credential_json":
+				id := rs.Primary.ID
+
+				c := credentials.NewClient(md.client)
+				_, err := c.Read(context.Background(), id)
+				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
+					return fmt.Errorf("didn't get a 404 when reading destroyed json credential %q: %v", id, err)
+				}
+			default:
+				continue
+			}
+		}
+		return nil
+	}
+}
+
+func testAccCheckCredentialJsonResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[name]
 		if !ok {
@@ -137,40 +162,7 @@ func testAccCheckCredentialResourceExists(testProvider *schema.Provider, name st
 	}
 }
 
-type credentialType string
-
-const (
-	jsonCredentialType             credentialType = "boundary_credential_json"
-	sshPrivateKeyCredentialType    credentialType = "boundary_credential_ssh_private_key"
-	usernamePasswordCredentialType credentialType = "boundary_credential_username_password"
-)
-
-func testAccCheckCredentialResourceDestroy(t *testing.T, testProvider *schema.Provider, typ credentialType) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if testProvider.Meta() == nil {
-			t.Fatal("got nil provider metadata")
-		}
-		md := testProvider.Meta().(*metaData)
-
-		for _, rs := range s.RootModule().Resources {
-			switch rs.Type {
-			case string(typ):
-				id := rs.Primary.ID
-
-				c := credentials.NewClient(md.client)
-				_, err := c.Read(context.Background(), id)
-				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
-					return fmt.Errorf("didn't get a 404 when reading destroyed credential %q: %v", id, err)
-				}
-			default:
-				continue
-			}
-		}
-		return nil
-	}
-}
-
-func testAccCheckCredentialJsonObjectHmac() resource.TestCheckFunc {
+func testAccCheckCredentialJsonObjectHmac(testProvider *schema.Provider) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[jsonCredResc]
 		if !ok {

internal/provider/resource_credential_library_vault_ssh_certificate_test.go

@@ -4,14 +4,19 @@
 package provider
 
 import (
+	"context"
 	"fmt"
+	"net/http"
 	"strconv"
 	"testing"
 
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/credentiallibraries"
 	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/boundary/testing/vault"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
 )
 
 const (
@@ -34,6 +39,7 @@ resource "boundary_credential_library_vault_ssh_certificate" "example" {
   	path                = "%s"
   	username            = "%s"
 	key_type            = "ed25519"
+
 }`, vaultSshCertCredLibName,
 	vaultSshCertCredLibDesc,
 	vaultSshCertCredLibPath,
@@ -63,9 +69,11 @@ resource "boundary_credential_library_vault_ssh_certificate" "ext_co_example" {
   	path                = "%s"
   	username            = "%s"
 	key_type            = "ed25519"
+
 	extensions = {
 	  permit-pty = ""
     }
+
 	critical_options = {
 	  force-command = "/bin/foo"
 	}
@@ -82,6 +90,7 @@ resource "boundary_credential_library_vault_ssh_certificate" "ext_co_example" {
   	path                = "%s"
   	username            = "%s"
 	key_type            = "ed25519"
+
 	extensions = {
 	  permit-pty            = ""
 	  permit-X11-forwarding = ""
@@ -99,9 +108,11 @@ resource "boundary_credential_library_vault_ssh_certificate" "ext_co_example" {
   	path                = "%s"
   	username            = "%s"
 	key_type            = "ed25519"
+
 	extensions = {
 	  permit-pty = ""
     }
+
 	critical_options = {
 	  force-command  = "/bin/foo"
 	  source-address = "10.10.0.0/16"
@@ -130,7 +141,7 @@ func TestAccCredentialLibraryVaultSshCertificate(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		IsUnitTest:        true,
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckCredentialLibraryVaultResourceDestroy(t, provider, sshCertVaultCredentialLibraryType),
+		CheckDestroy:      testAccCheckCredentialLibraryVaultSshCertificateResourceDestroy(t, provider),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -141,7 +152,7 @@ func TestAccCredentialLibraryVaultSshCertificate(t *testing.T) {
 					resource.TestCheckResourceAttr(vaultSshCertCredResc, credentialLibraryVaultPathKey, vaultSshCertCredLibPath),
 					resource.TestCheckResourceAttr(vaultSshCertCredResc, credentialLibraryVaultSshCertificateUsernameKey, vaultSshCertCredUsername),
 
-					testAccCheckCredentialLibraryResourceExists(provider, vaultSshCertCredResc),
+					testAccCheckCredentialLibraryVaultSshCertificateResourceExists(provider, vaultSshCertCredResc),
 				),
 			},
 			importStep(vaultSshCertCredResc),
@@ -156,7 +167,7 @@ func TestAccCredentialLibraryVaultSshCertificate(t *testing.T) {
 					resource.TestCheckResourceAttr(vaultSshCertCredResc, credentialLibraryVaultSshCertificateKeyTypeKey, vaultSshCertCredKeyType),
 					resource.TestCheckResourceAttr(vaultSshCertCredResc, credentialLibraryVaultSshCertificateKeyBitsKey, strconv.Itoa(vaultSshCertCredKeyBits)),
 
-					testAccCheckCredentialLibraryResourceExists(provider, vaultSshCertCredResc),
+					testAccCheckCredentialLibraryVaultSshCertificateResourceExists(provider, vaultSshCertCredResc),
 				),
 			},
 			importStep(vaultSshCertCredResc),
@@ -169,7 +180,7 @@ func TestAccCredentialLibraryVaultSshCertificate(t *testing.T) {
 					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultPathKey, vaultSshCertCredLibPath),
 					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateUsernameKey, vaultSshCertCredUsername),
 
-					testAccCheckCredentialLibraryResourceExists(provider, vaultSshCertCredExtCOResc),
+					testAccCheckCredentialLibraryVaultSshCertificateResourceExists(provider, vaultSshCertCredExtCOResc),
 				),
 			},
 			importStep(vaultSshCertCredExtCOResc),
@@ -184,7 +195,7 @@ func TestAccCredentialLibraryVaultSshCertificate(t *testing.T) {
 					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateCriticalOptionsKey+".%", "0"),
 					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateExtensionsKey+".%", "2"),
 
-					testAccCheckCredentialLibraryResourceExists(provider, vaultSshCertCredExtCOResc),
+					testAccCheckCredentialLibraryVaultSshCertificateResourceExists(provider, vaultSshCertCredExtCOResc),
 				),
 			},
 			importStep(vaultSshCertCredExtCOResc),
@@ -199,10 +210,58 @@ func TestAccCredentialLibraryVaultSshCertificate(t *testing.T) {
 					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateCriticalOptionsKey+".%", "2"),
 					resource.TestCheckResourceAttr(vaultSshCertCredExtCOResc, credentialLibraryVaultSshCertificateExtensionsKey+".%", "1"),
 
-					testAccCheckCredentialLibraryResourceExists(provider, vaultSshCertCredExtCOResc),
+					testAccCheckCredentialLibraryVaultSshCertificateResourceExists(provider, vaultSshCertCredExtCOResc),
 				),
 			},
 			importStep(vaultSshCertCredExtCOResc),
 		},
 	})
 }
+
+func testAccCheckCredentialLibraryVaultSshCertificateResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("not found: %s", name)
+		}
+
+		id := rs.Primary.ID
+		if id == "" {
+			return fmt.Errorf("no ID is set")
+		}
+
+		md := testProvider.Meta().(*metaData)
+		c := credentiallibraries.NewClient(md.client)
+		if _, err := c.Read(context.Background(), id); err != nil {
+			return fmt.Errorf("got an error reading %q: %w", id, err)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckCredentialLibraryVaultSshCertificateResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if testProvider.Meta() == nil {
+			t.Fatal("got nil provider metadata")
+		}
+		md := testProvider.Meta().(*metaData)
+
+		for _, rs := range s.RootModule().Resources {
+			switch rs.Type {
+			case "boundary_credential_library_vault":
+				id := rs.Primary.ID
+
+				c := credentiallibraries.NewClient(md.client)
+				_, err := c.Read(context.Background(), id)
+				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
+					return fmt.Errorf("didn't get a 404 when reading destroyed vault credential library %q: %v", id, err)
+				}
+
+			default:
+				continue
+			}
+		}
+		return nil
+	}
+}

internal/provider/resource_credential_library_vault_test.go

@@ -24,7 +24,6 @@ const (
 	vaultCredUsernamePasswordResc = "boundary_credential_library_vault.username_password_mapping_override"
 	vaultCredSshPrivateKeyResc    = "boundary_credential_library_vault.ssh_private_key_mapping_override"
 	vaultCredLibName              = "foo"
-	vaultCredLibNameOverride      = "base foo"
 	vaultCredLibDesc              = "the foo"
 	vaultCredLibPath              = "/foo/bar"
 	vaultCredLibMethodGet         = "GET"
@@ -84,7 +83,7 @@ resource "boundary_credential_library_vault" "username_password_mapping_override
 		password_attribute = "alternative_password_label"
 		username_attribute = "alternative_username_label"
 	}
-}`, vaultCredLibNameOverride,
+}`, vaultCredLibName,
 	vaultCredLibDesc,
 	vaultCredLibPath,
 	vaultCredLibMethodGet)
@@ -101,7 +100,7 @@ var vaultUsernamePasswordMappingOverrideCredLibResourceUpdate = fmt.Sprintf(`
 			password_attribute = "updated_password_label"
 			username_attribute = "updated_username_label"
 		}
-	}`, vaultCredLibNameOverride,
+	}`, vaultCredLibName,
 	vaultCredLibDesc,
 	vaultCredLibPath,
 	vaultCredLibMethodGet)
@@ -114,7 +113,7 @@ var vaultUsernamePasswordMappingOverrideCredLibResourceRemove = fmt.Sprintf(`
 		path                         = "%s"
 		http_method                  = "%s"
 		credential_type              = "username_password"
-	}`, vaultCredLibNameOverride,
+	}`, vaultCredLibName,
 	vaultCredLibDesc,
 	vaultCredLibPath,
 	vaultCredLibMethodGet)
@@ -156,7 +155,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		IsUnitTest:        true,
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckCredentialLibraryVaultResourceDestroy(t, provider, baseVaultCredentialLibraryType),
+		CheckDestroy:      testAccCheckCredentialLibraryVaultResourceDestroy(t, provider),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -168,7 +167,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 					resource.TestCheckResourceAttr(vaultCredResc, credentialLibraryVaultHttpMethodKey, vaultCredLibMethodGet),
 					resource.TestCheckResourceAttr(vaultCredResc, credentialLibraryVaultHttpRequestBodyKey, ""),
 
-					testAccCheckCredentialLibraryResourceExists(provider, vaultCredResc),
+					testAccCheckCredentialLibraryVaultResourceExists(provider, vaultCredResc),
 				),
 			},
 			importStep(vaultCredResc),
@@ -183,7 +182,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 					resource.TestCheckResourceAttr(vaultCredResc, credentialLibraryVaultHttpMethodKey, vaultCredLibMethodPost),
 					resource.TestCheckResourceAttr(vaultCredResc, credentialLibraryVaultHttpRequestBodyKey, vaultCredLibRequestBody),
 
-					testAccCheckCredentialLibraryResourceExists(provider, vaultCredResc),
+					testAccCheckCredentialLibraryVaultResourceExists(provider, vaultCredResc),
 				),
 			},
 			importStep(vaultCredResc),
@@ -199,7 +198,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 					resource.TestCheckResourceAttr(vaultCredTypedResc, credentialLibraryVaultHttpRequestBodyKey, ""),
 					resource.TestCheckResourceAttr(vaultCredTypedResc, credentialLibraryCredentialTypeKey, "ssh_private_key"),
 
-					testAccCheckCredentialLibraryResourceExists(provider, vaultCredTypedResc),
+					testAccCheckCredentialLibraryVaultResourceExists(provider, vaultCredTypedResc),
 				),
 			},
 			importStep(vaultCredResc),
@@ -207,7 +206,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 			{
 				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate, vaultUsernamePasswordMappingOverrideCredLibResource),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, NameKey, vaultCredLibNameOverride),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, NameKey, vaultCredLibName),
 					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, DescriptionKey, vaultCredLibDesc),
 					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultPathKey, vaultCredLibPath),
 					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultHttpMethodKey, vaultCredLibMethodGet),
@@ -216,7 +215,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, "credential_mapping_overrides.password_attribute", "alternative_password_label"),
 					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, "credential_mapping_overrides.username_attribute", "alternative_username_label"),
 
-					testAccCheckCredentialLibraryResourceExists(provider, vaultCredUsernamePasswordResc),
+					testAccCheckCredentialLibraryVaultResourceExists(provider, vaultCredUsernamePasswordResc),
 				),
 			},
 			importStep(vaultCredResc),
@@ -224,7 +223,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 			{
 				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate, vaultUsernamePasswordMappingOverrideCredLibResourceUpdate),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, NameKey, vaultCredLibNameOverride),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, NameKey, vaultCredLibName),
 					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, DescriptionKey, vaultCredLibDesc),
 					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultPathKey, vaultCredLibPath),
 					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultHttpMethodKey, vaultCredLibMethodGet),
@@ -233,7 +232,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, "credential_mapping_overrides.password_attribute", "updated_password_label"),
 					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, "credential_mapping_overrides.username_attribute", "updated_username_label"),
 
-					testAccCheckCredentialLibraryResourceExists(provider, vaultCredUsernamePasswordResc),
+					testAccCheckCredentialLibraryVaultResourceExists(provider, vaultCredUsernamePasswordResc),
 				),
 			},
 			importStep(vaultCredResc),
@@ -241,7 +240,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 			{
 				Config: testConfig(url, fooOrg, firstProjectFoo, credStoreRes, vaultCredLibResourceUpdate, vaultUsernamePasswordMappingOverrideCredLibResourceRemove),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, NameKey, vaultCredLibNameOverride),
+					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, NameKey, vaultCredLibName),
 					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, DescriptionKey, vaultCredLibDesc),
 					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultPathKey, vaultCredLibPath),
 					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryVaultHttpMethodKey, vaultCredLibMethodGet),
@@ -249,7 +248,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryCredentialTypeKey, "username_password"),
 					resource.TestCheckResourceAttr(vaultCredUsernamePasswordResc, credentialLibraryCredentialMappingOverridesKey+".%", "0"),
 
-					testAccCheckCredentialLibraryResourceExists(provider, vaultCredUsernamePasswordResc),
+					testAccCheckCredentialLibraryVaultResourceExists(provider, vaultCredUsernamePasswordResc),
 				),
 			},
 			importStep(vaultCredResc),
@@ -267,7 +266,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 					resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, "credential_mapping_overrides.private_key_passphrase_attribute", "alternative_passphrase_label"),
 					resource.TestCheckResourceAttr(vaultCredSshPrivateKeyResc, "credential_mapping_overrides.username_attribute", "alternative_username_label"),
 
-					testAccCheckCredentialLibraryResourceExists(provider, vaultCredSshPrivateKeyResc),
+					testAccCheckCredentialLibraryVaultResourceExists(provider, vaultCredSshPrivateKeyResc),
 				),
 			},
 			importStep(vaultCredResc),
@@ -275,7 +274,7 @@ func TestAccCredentialLibraryVault(t *testing.T) {
 	})
 }
 
-func testAccCheckCredentialLibraryResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
+func testAccCheckCredentialLibraryVaultResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[name]
 		if !ok {
@@ -297,14 +296,7 @@ func testAccCheckCredentialLibraryResourceExists(testProvider *schema.Provider,
 	}
 }
 
-type vaultCredentialLibraryType string
-
-const (
-	baseVaultCredentialLibraryType    vaultCredentialLibraryType = "boundary_credential_library_vault"
-	sshCertVaultCredentialLibraryType vaultCredentialLibraryType = "boundary_credential_library_vault_ssh_certificate"
-)
-
-func testAccCheckCredentialLibraryVaultResourceDestroy(t *testing.T, testProvider *schema.Provider, typ vaultCredentialLibraryType) resource.TestCheckFunc {
+func testAccCheckCredentialLibraryVaultResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if testProvider.Meta() == nil {
 			t.Fatal("got nil provider metadata")
@@ -313,7 +305,7 @@ func testAccCheckCredentialLibraryVaultResourceDestroy(t *testing.T, testProvide
 
 		for _, rs := range s.RootModule().Resources {
 			switch rs.Type {
-			case string(typ):
+			case "boundary_credential_library_vault":
 				id := rs.Primary.ID
 
 				c := credentiallibraries.NewClient(md.client)

internal/provider/resource_credential_ssh_private_key_test.go

@@ -4,9 +4,13 @@
 package provider
 
 import (
+	"context"
 	"fmt"
+	"net/http"
 	"testing"
 
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/credentials"
 	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -71,7 +75,7 @@ func TestAccCredentialSshPrivateKey(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		IsUnitTest:        true,
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckCredentialResourceDestroy(t, provider, sshPrivateKeyCredentialType),
+		CheckDestroy:      testAccCheckCredentialSshPrivateKeyResourceDestroy(t, provider),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -83,8 +87,8 @@ func TestAccCredentialSshPrivateKey(t *testing.T) {
 					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, credentialSshPrivateKeyPrivateKeyKey, privKey),
 					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, credentialSshPrivateKeyPassphraseKey, ""),
 
-					testAccCheckCredentialStoreSshPrivateKeyHmac(),
-					testAccCheckCredentialResourceExists(provider, sshPrivateKeyCredResc),
+					testAccCheckCredentialStoreSshPrivateKeyHmac(provider),
+					testAccCheckCredentialSshPrivateKeyResourceExists(provider, sshPrivateKeyCredResc),
 				),
 			},
 			importStep(sshPrivateKeyCredResc, credentialSshPrivateKeyPrivateKeyKey, credentialSshPrivateKeyPassphraseKey),
@@ -98,15 +102,63 @@ func TestAccCredentialSshPrivateKey(t *testing.T) {
 					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, credentialSshPrivateKeyPrivateKeyKey, privKeyUpdate),
 					resource.TestCheckResourceAttr(sshPrivateKeyCredResc, credentialSshPrivateKeyPassphraseKey, privKeyUpdatePassphrase),
 
-					testAccCheckCredentialStoreSshPrivateKeyHmac(),
-					testAccCheckCredentialResourceExists(provider, sshPrivateKeyCredResc),
+					testAccCheckCredentialStoreSshPrivateKeyHmac(provider),
+					testAccCheckCredentialSshPrivateKeyResourceExists(provider, sshPrivateKeyCredResc),
 				),
 			},
 		},
 	})
 }
 
-func testAccCheckCredentialStoreSshPrivateKeyHmac() resource.TestCheckFunc {
+func testAccCheckCredentialSshPrivateKeyResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("not found: %s", name)
+		}
+
+		id := rs.Primary.ID
+		if id == "" {
+			return fmt.Errorf("no ID is set")
+		}
+		storeId = id
+
+		md := testProvider.Meta().(*metaData)
+		c := credentials.NewClient(md.client)
+		if _, err := c.Read(context.Background(), id); err != nil {
+			return fmt.Errorf("got an error reading %q: %w", id, err)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckCredentialSshPrivateKeyResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if testProvider.Meta() == nil {
+			t.Fatal("got nil provider metadata")
+		}
+		md := testProvider.Meta().(*metaData)
+
+		for _, rs := range s.RootModule().Resources {
+			switch rs.Type {
+			case "boundary_credential_ssh_private_key":
+				id := rs.Primary.ID
+
+				c := credentials.NewClient(md.client)
+				_, err := c.Read(context.Background(), id)
+				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
+					return fmt.Errorf("didn't get a 404 when reading destroyed credential %q: %v", id, err)
+				}
+			default:
+				continue
+			}
+		}
+		return nil
+	}
+}
+
+func testAccCheckCredentialStoreSshPrivateKeyHmac(testProvider *schema.Provider) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[sshPrivateKeyCredResc]
 		if !ok {

internal/provider/resource_credential_store_static_test.go

@@ -6,12 +6,15 @@ package provider
 import (
 	"context"
 	"fmt"
+	"net/http"
 	"testing"
 
+	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/credentialstores"
 	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
 )
 
 const (
@@ -47,7 +50,7 @@ func TestAccCredentialStoreStatic(t *testing.T) {
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckCredentialStoreResourceDestroy(t, provider, staticStoreCredentialStoreType),
+		CheckDestroy:      testAccCheckCredentialStoreStaticResourceDestroy(t, provider),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -56,7 +59,7 @@ func TestAccCredentialStoreStatic(t *testing.T) {
 					resource.TestCheckResourceAttr(staticCredStoreResc, NameKey, staticCredStoreName),
 					resource.TestCheckResourceAttr(staticCredStoreResc, DescriptionKey, staticCredStoreDesc),
 
-					testAccCheckCredentialStoreResourceExists(provider, staticCredStoreResc),
+					testAccCheckCredentialStoreVaultResourceExists(provider, staticCredStoreResc),
 				),
 			},
 			importStep(staticCredStoreResc),
@@ -67,7 +70,7 @@ func TestAccCredentialStoreStatic(t *testing.T) {
 					resource.TestCheckResourceAttr(staticCredStoreResc, NameKey, staticCredStoreName+staticCredStoreUpdate),
 					resource.TestCheckResourceAttr(staticCredStoreResc, DescriptionKey, staticCredStoreDesc+staticCredStoreUpdate),
 
-					testAccCheckCredentialStoreResourceExists(provider, staticCredStoreResc),
+					testAccCheckCredentialStoreVaultResourceExists(provider, staticCredStoreResc),
 				),
 			},
 			importStep(staticCredStoreResc),
@@ -112,3 +115,28 @@ func staticCredentialStoreExternalUpdate(t *testing.T, testProvider *schema.Prov
 		t.Fatal(fmt.Errorf("got an error updating %q: %w", cr.Item.Id, err))
 	}
 }
+
+func testAccCheckCredentialStoreStaticResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if testProvider.Meta() == nil {
+			t.Fatal("got nil provider metadata")
+		}
+		md := testProvider.Meta().(*metaData)
+
+		for _, rs := range s.RootModule().Resources {
+			switch rs.Type {
+			case "boundary_credential_store_static":
+				id := rs.Primary.ID
+
+				c := credentialstores.NewClient(md.client)
+				_, err := c.Read(context.Background(), id)
+				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
+					return fmt.Errorf("didn't get a 404 when reading destroyed static credential store %q: %v", id, err)
+				}
+			default:
+				continue
+			}
+		}
+		return nil
+	}
+}

internal/provider/resource_credential_store_vault_test.go

@@ -9,11 +9,11 @@ import (
 	"crypto/sha256"
 	"encoding/base64"
 	"fmt"
-	"github.com/hashicorp/boundary/api"
 	"net/http"
 	"strings"
 	"testing"
 
+	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/credentialstores"
 	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/boundary/testing/vault"
@@ -100,7 +100,7 @@ func TestAccCredentialStoreVault(t *testing.T) {
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckCredentialStoreResourceDestroy(t, provider, vaultStoreCredentialStoreType),
+		CheckDestroy:      testAccCheckCredentialStoreVaultResourceDestroy(t, provider),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -118,7 +118,7 @@ func TestAccCredentialStoreVault(t *testing.T) {
 					resource.TestCheckResourceAttr(vaultCredStoreResc, credentialStoreVaultClientCertificateKey, ""),
 					resource.TestCheckResourceAttr(vaultCredStoreResc, credentialStoreVaultClientCertificateKeyKey, ""),
 
-					testAccCheckCredentialStoreResourceExists(provider, vaultCredStoreResc),
+					testAccCheckCredentialStoreVaultResourceExists(provider, vaultCredStoreResc),
 				),
 			},
 			importStep(vaultCredStoreResc, credentialStoreVaultTokenKey, credentialStoreVaultClientCertificateKeyKey),
@@ -138,7 +138,7 @@ func TestAccCredentialStoreVault(t *testing.T) {
 					resource.TestCheckResourceAttr(vaultCredStoreResc, credentialStoreVaultClientCertificateKey, string(vcUpdate.ClientCert)),
 					resource.TestCheckResourceAttr(vaultCredStoreResc, credentialStoreVaultClientCertificateKeyKey, string(vcUpdate.ClientKey)),
 
-					testAccCheckCredentialStoreResourceExists(provider, vaultCredStoreResc),
+					testAccCheckCredentialStoreVaultResourceExists(provider, vaultCredStoreResc),
 				),
 			},
 			importStep(vaultCredStoreResc, credentialStoreVaultTokenKey, credentialStoreVaultClientCertificateKeyKey),
@@ -194,7 +194,7 @@ func externalUpdate(t *testing.T, testProvider *schema.Provider) {
 	}
 }
 
-func testAccCheckCredentialStoreResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
+func testAccCheckCredentialStoreVaultResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[name]
 		if !ok {
@@ -217,14 +217,7 @@ func testAccCheckCredentialStoreResourceExists(testProvider *schema.Provider, na
 	}
 }
 
-type credentialDestroyStoreType string
-
-const (
-	staticStoreCredentialStoreType credentialDestroyStoreType = "boundary_credential_store_static"
-	vaultStoreCredentialStoreType  credentialDestroyStoreType = "boundary_credential_store_vault"
-)
-
-func testAccCheckCredentialStoreResourceDestroy(t *testing.T, testProvider *schema.Provider, typ credentialDestroyStoreType) resource.TestCheckFunc {
+func testAccCheckCredentialStoreVaultResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if testProvider.Meta() == nil {
 			t.Fatal("got nil provider metadata")
@@ -233,13 +226,13 @@ func testAccCheckCredentialStoreResourceDestroy(t *testing.T, testProvider *sche
 
 		for _, rs := range s.RootModule().Resources {
 			switch rs.Type {
-			case string(typ):
+			case "boundary_credential_store_vault":
 				id := rs.Primary.ID
 
 				c := credentialstores.NewClient(md.client)
 				_, err := c.Read(context.Background(), id)
 				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
-					return fmt.Errorf("didn't get a 404 when reading destroyed static credential store %q: %v", id, err)
+					return fmt.Errorf("didn't get a 404 when reading destroyed Vault credential store %q: %v", id, err)
 				}
 			default:
 				continue

internal/provider/resource_credential_username_password_test.go

@@ -6,8 +6,10 @@ package provider
 import (
 	"context"
 	"fmt"
+	"net/http"
 	"testing"
 
+	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/credentials"
 	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
@@ -67,7 +69,7 @@ func TestAccCredentialUsernamePassword(t *testing.T) {
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckCredentialResourceDestroy(t, provider, usernamePasswordCredentialType),
+		CheckDestroy:      testAccCheckCredentialUsernamePasswordResourceDestroy(t, provider),
 		Steps: []resource.TestStep{
 			{
 				// create
@@ -78,8 +80,8 @@ func TestAccCredentialUsernamePassword(t *testing.T) {
 					resource.TestCheckResourceAttr(usernamePasswordCredResc, credentialUsernamePasswordUsernameKey, usernamePasswordCredUsername),
 					resource.TestCheckResourceAttr(usernamePasswordCredResc, credentialUsernamePasswordPasswordKey, usernamePasswordCredPassword),
 
-					testAccCheckCredentialStoreUsernamePasswordHmac(),
-					testAccCheckCredentialResourceExists(provider, usernamePasswordCredResc),
+					testAccCheckCredentialStoreUsernamePasswordHmac(provider),
+					testAccCheckCredentialUsernamePasswordResourceExists(provider, usernamePasswordCredResc),
 				),
 			},
 			importStep(usernamePasswordCredResc, credentialUsernamePasswordPasswordKey),
@@ -92,8 +94,8 @@ func TestAccCredentialUsernamePassword(t *testing.T) {
 					resource.TestCheckResourceAttr(usernamePasswordCredResc, credentialUsernamePasswordUsernameKey, usernamePasswordCredUsername+usernamePasswordCredUpdate),
 					resource.TestCheckResourceAttr(usernamePasswordCredResc, credentialUsernamePasswordPasswordKey, usernamePasswordCredPassword+usernamePasswordCredUpdate),
 
-					testAccCheckCredentialStoreUsernamePasswordHmac(),
-					testAccCheckCredentialResourceExists(provider, usernamePasswordCredResc),
+					testAccCheckCredentialStoreUsernamePasswordHmac(provider),
+					testAccCheckCredentialUsernamePasswordResourceExists(provider, usernamePasswordCredResc),
 				),
 			},
 			importStep(usernamePasswordCredResc, credentialUsernamePasswordPasswordKey),
@@ -135,7 +137,55 @@ func usernamePasswordCredExternalUpdate(t *testing.T, testProvider *schema.Provi
 	}
 }
 
-func testAccCheckCredentialStoreUsernamePasswordHmac() resource.TestCheckFunc {
+func testAccCheckCredentialUsernamePasswordResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("not found: %s", name)
+		}
+
+		id := rs.Primary.ID
+		if id == "" {
+			return fmt.Errorf("no ID is set")
+		}
+		storeId = id
+
+		md := testProvider.Meta().(*metaData)
+		c := credentials.NewClient(md.client)
+		if _, err := c.Read(context.Background(), id); err != nil {
+			return fmt.Errorf("got an error reading %q: %w", id, err)
+		}
+
+		return nil
+	}
+}
+
+func testAccCheckCredentialUsernamePasswordResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if testProvider.Meta() == nil {
+			t.Fatal("got nil provider metadata")
+		}
+		md := testProvider.Meta().(*metaData)
+
+		for _, rs := range s.RootModule().Resources {
+			switch rs.Type {
+			case "boundary_credential_username_password":
+				id := rs.Primary.ID
+
+				c := credentials.NewClient(md.client)
+				_, err := c.Read(context.Background(), id)
+				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
+					return fmt.Errorf("didn't get a 404 when reading destroyed username password credential %q: %v", id, err)
+				}
+			default:
+				continue
+			}
+		}
+		return nil
+	}
+}
+
+func testAccCheckCredentialStoreUsernamePasswordHmac(testProvider *schema.Provider) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[usernamePasswordCredResc]
 		if !ok {

internal/provider/resource_host_catalog_plugin_test.go

@@ -8,8 +8,10 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"net/http"
 	"testing"
 
+	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/hostcatalogs"
 	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
@@ -154,7 +156,7 @@ func TestAccPluginHostCatalog(t *testing.T) {
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckHostCatalogResourceDestroy(t, provider, baseHostCatalogType),
+		CheckDestroy:      testAccCheckPluginHostCatalogResourceDestroy(t, provider),
 		Steps: []resource.TestStep{
 			{
 				// test create
@@ -366,3 +368,27 @@ func testAccCheckPluginHostCatalogResourceExists(testProvider *schema.Provider,
 		return nil
 	}
 }
+
+func testAccCheckPluginHostCatalogResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		md := testProvider.Meta().(*metaData)
+
+		for _, rs := range s.RootModule().Resources {
+			switch rs.Type {
+			case "boundary_host_catalog":
+
+				id := rs.Primary.ID
+				hcClient := hostcatalogs.NewClient(md.client)
+
+				_, err := hcClient.Read(context.Background(), id)
+				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
+					return fmt.Errorf("didn't get a 404 when reading destroyed host catalog %q: %v", id, err)
+				}
+
+			default:
+				continue
+			}
+		}
+		return nil
+	}
+}

internal/provider/resource_host_catalog_static_test.go

@@ -70,7 +70,7 @@ func testAccHostCatalog(t *testing.T, static bool) {
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckHostCatalogResourceDestroy(t, provider, staticHostCatalogType),
+		CheckDestroy:      testAccCheckHostCatalogResourceDestroy(t, provider),
 		Steps: []resource.TestStep{
 			{
 				// test create
@@ -119,23 +119,13 @@ func testAccCheckHostCatalogResourceExists(testProvider *schema.Provider, name s
 	}
 }
 
-type hostCatalogType string
-
-const (
-	baseHostCatalogType   hostCatalogType = "boundary_host_catalog"
-	staticHostCatalogType hostCatalogType = "boundary_host_catalog_static"
-)
-
-func testAccCheckHostCatalogResourceDestroy(t *testing.T, testProvider *schema.Provider, typ hostCatalogType) resource.TestCheckFunc {
+func testAccCheckHostCatalogResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		if testProvider.Meta() == nil {
-			t.Fatal("got nil provider metadata")
-		}
 		md := testProvider.Meta().(*metaData)
 
 		for _, rs := range s.RootModule().Resources {
 			switch rs.Type {
-			case string(typ):
+			case "boundary_host_catalog", "boundary_host_catalog_static":
 
 				id := rs.Primary.ID
 				hcClient := hostcatalogs.NewClient(md.client)

internal/provider/resource_host_set_plugin_test.go

@@ -8,8 +8,10 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"net/http"
 	"testing"
 
+	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/hostsets"
 	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
@@ -87,7 +89,7 @@ func TestAccHostSetPlugin(t *testing.T) {
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckHostSetResourceDestroy(t, provider, baseHostSetType),
+		CheckDestroy:      testAccCheckHostSetPluginResourceDestroy(t, provider),
 		Steps: []resource.TestStep{
 			{
 				// test project hostset create
@@ -254,6 +256,34 @@ func testAccCheckHostSetPluginResourceExists(testProvider *schema.Provider, name
 	}
 }
 
+func testAccCheckHostSetPluginResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		if testProvider.Meta() == nil {
+			t.Fatal("got nil provider metadata")
+		}
+		md := testProvider.Meta().(*metaData)
+
+		for _, rs := range s.RootModule().Resources {
+			switch rs.Type {
+			case "boundary_host_set":
+
+				id := rs.Primary.ID
+
+				hostsetsClient := hostsets.NewClient(md.client)
+
+				_, err := hostsetsClient.Read(context.Background(), id)
+				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
+					return fmt.Errorf("didn't get a 404 when reading destroyed host set %q: %v", id, apiErr)
+				}
+
+			default:
+				continue
+			}
+		}
+		return nil
+	}
+}
+
 func testAccCheckHostSetPluginPreferredEndpoints(t *testing.T, testProvider *schema.Provider, name string, wantPreferredEndpoints []string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[name]

internal/provider/resource_host_set_static_test.go

@@ -86,7 +86,7 @@ func testAccHostSetStatic(t *testing.T, static bool) {
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckHostSetResourceDestroy(t, provider, baseHostSetType),
+		CheckDestroy:      testAccCheckHostSetStaticResourceDestroy(t, provider),
 		Steps: []resource.TestStep{
 			{
 				// test project hostset create
@@ -195,11 +195,7 @@ func testAccCheckHostSetStaticHostIDsSet(testProvider *schema.Provider, name str
 	}
 }
 
-type hostSetType string
-
-const baseHostSetType hostSetType = "boundary_host_set"
-
-func testAccCheckHostSetResourceDestroy(t *testing.T, testProvider *schema.Provider, typ hostSetType) resource.TestCheckFunc {
+func testAccCheckHostSetStaticResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if testProvider.Meta() == nil {
 			t.Fatal("got nil provider metadata")
@@ -208,7 +204,7 @@ func testAccCheckHostSetResourceDestroy(t *testing.T, testProvider *schema.Provi
 
 		for _, rs := range s.RootModule().Resources {
 			switch rs.Type {
-			case string(typ):
+			case "boundary_host_set":
 
 				id := rs.Primary.ID
 

internal/provider/resource_managed_group_ldap.go

@@ -1,221 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
-package provider
-
-import (
-	"context"
-	"net/http"
-
-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/managedgroups"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-)
-
-const managedGroupLdapGroupNamesKey = "group_names"
-
-func resourceManagedGroupLdap() *schema.Resource {
-	return &schema.Resource{
-		Description: "The managed group resource allows you to configure a Boundary group.",
-
-		CreateContext: resourceManagedGroupLdapCreate,
-		ReadContext:   resourceManagedGroupLdapRead,
-		UpdateContext: resourceManagedGroupLdapUpdate,
-		DeleteContext: resourceManagedGroupDelete,
-		Importer: &schema.ResourceImporter{
-			StateContext: schema.ImportStatePassthroughContext,
-		},
-
-		Schema: map[string]*schema.Schema{
-			IDKey: {
-				Description: "The ID of the group.",
-				Type:        schema.TypeString,
-				Computed:    true,
-			},
-			NameKey: {
-				Description: "The managed group name. Defaults to the resource name.",
-				Type:        schema.TypeString,
-				Optional:    true,
-			},
-			DescriptionKey: {
-				Description: "The managed group description.",
-				Type:        schema.TypeString,
-				Optional:    true,
-			},
-			AuthMethodIdKey: {
-				Description: "The resource ID for the auth method.",
-				Type:        schema.TypeString,
-				Required:    true,
-				ForceNew:    true,
-			},
-			managedGroupLdapGroupNamesKey: {
-				Description: "The list of groups that make up the managed group.",
-				Type:        schema.TypeList,
-				Elem: &schema.Schema{
-					Type: schema.TypeString,
-				},
-				Required: true,
-			},
-		},
-	}
-}
-
-func setFromManagedGroupLdapResponseMap(d *schema.ResourceData, raw map[string]any) error {
-	if err := d.Set(NameKey, raw[NameKey]); err != nil {
-		return err
-	}
-	if err := d.Set(DescriptionKey, raw[DescriptionKey]); err != nil {
-		return err
-	}
-	if err := d.Set(AuthMethodIdKey, raw[AuthMethodIdKey]); err != nil {
-		return err
-	}
-
-	if attrsVal, ok := raw["attributes"]; ok {
-		attrs := attrsVal.(map[string]interface{})
-		if err := d.Set(managedGroupLdapGroupNamesKey, attrs[managedGroupLdapGroupNamesKey].([]interface{})); err != nil {
-			return err
-		}
-	}
-
-	d.SetId(raw[IDKey].(string))
-
-	return nil
-}
-
-func resourceManagedGroupLdapCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	md := meta.(*metaData)
-	grpClient := managedgroups.NewClient(md.client)
-
-	var authMethodId string
-	authMethodVal, ok := d.GetOk(AuthMethodIdKey)
-	if !ok {
-		return diag.Errorf("no auth method ID provided")
-	}
-	authMethodId = authMethodVal.(string)
-
-	var opts []managedgroups.Option
-	nameVal, ok := d.GetOk(NameKey)
-	if ok {
-		nameStr := nameVal.(string)
-		opts = append(opts, managedgroups.WithName(nameStr))
-	}
-
-	descVal, ok := d.GetOk(DescriptionKey)
-	if ok {
-		descStr := descVal.(string)
-		opts = append(opts, managedgroups.WithDescription(descStr))
-	}
-
-	if v, ok := d.GetOk(managedGroupLdapGroupNamesKey); ok {
-		names := make([]string, 0, len(v.([]any)))
-		for _, n := range v.([]any) {
-			names = append(names, n.(string))
-		}
-		opts = append(opts, managedgroups.WithLdapManagedGroupGroupNames(names))
-	}
-
-	grp, err := grpClient.Create(ctx, authMethodId, opts...)
-	if err != nil {
-		return diag.Errorf("error creating ldap managed group: %v", err)
-	}
-	if grp == nil {
-		return diag.Errorf("managed group nil after create")
-	}
-	raw := grp.GetResponse().Map
-
-	if err := setFromManagedGroupLdapResponseMap(d, raw); err != nil {
-		return diag.FromErr(err)
-	}
-
-	return nil
-}
-
-func resourceManagedGroupLdapRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	md := meta.(*metaData)
-	grpClient := managedgroups.NewClient(md.client)
-
-	grp, err := grpClient.Read(ctx, d.Id())
-	if err != nil {
-		if apiErr := api.AsServerError(err); apiErr.Response().StatusCode() == http.StatusNotFound {
-			d.SetId("")
-			return nil
-		}
-		return diag.Errorf("error reading managed group: %v", err)
-	}
-	if grp == nil {
-		return diag.Errorf("managed group nil after read")
-	}
-
-	if err := setFromManagedGroupLdapResponseMap(d, grp.GetResponse().Map); err != nil {
-		return diag.FromErr(err)
-	}
-
-	return nil
-}
-
-func resourceManagedGroupLdapUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	md := meta.(*metaData)
-	grpClient := managedgroups.NewClient(md.client)
-
-	var opts []managedgroups.Option
-	var name *string
-	if d.HasChange(NameKey) {
-		opts = append(opts, managedgroups.DefaultName())
-		nameVal, ok := d.GetOk(NameKey)
-		if ok {
-			nameStr := nameVal.(string)
-			name = &nameStr
-			opts = append(opts, managedgroups.WithName(nameStr))
-		}
-	}
-
-	var desc *string
-	if d.HasChange(DescriptionKey) {
-		opts = append(opts, managedgroups.DefaultDescription())
-		descVal, ok := d.GetOk(DescriptionKey)
-		if ok {
-			descStr := descVal.(string)
-			desc = &descStr
-			opts = append(opts, managedgroups.WithDescription(descStr))
-		}
-	}
-
-	var names []string
-	if d.HasChange(managedGroupLdapGroupNamesKey) {
-		if v, ok := d.GetOk(managedGroupLdapGroupNamesKey); ok {
-			names = make([]string, 0, len(v.([]any)))
-			for _, n := range v.([]any) {
-				names = append(names, n.(string))
-			}
-			opts = append(opts, managedgroups.WithLdapManagedGroupGroupNames(names))
-		}
-	}
-
-	if len(opts) > 0 {
-		opts = append(opts, managedgroups.WithAutomaticVersioning(true))
-		_, err := grpClient.Update(ctx, d.Id(), 0, opts...)
-		if err != nil {
-			return diag.Errorf("error updating managed group: %v", err)
-		}
-	}
-
-	if d.HasChange(NameKey) {
-		if err := d.Set(NameKey, name); err != nil {
-			return diag.FromErr(err)
-		}
-	}
-	if d.HasChange(DescriptionKey) {
-		if err := d.Set(DescriptionKey, desc); err != nil {
-			return diag.FromErr(err)
-		}
-	}
-	if d.HasChange(managedGroupLdapGroupNamesKey) {
-		if err := d.Set(managedGroupLdapGroupNamesKey, names); err != nil {
-			return diag.FromErr(err)
-		}
-	}
-
-	return nil
-}

internal/provider/resource_managed_group_ldap_test.go

@@ -1,111 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
-package provider
-
-import (
-	"context"
-	"fmt"
-	"strings"
-	"testing"
-
-	"github.com/hashicorp/boundary/api/managedgroups"
-	"github.com/hashicorp/boundary/testing/controller"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
-)
-
-var (
-	fooManagedGroupLdap = fmt.Sprintf(`
-resource "boundary_managed_group_ldap" "foo" {
-	name           = "%s"
-	description    = "%s"
-	auth_method_id = boundary_auth_method_ldap.test-ldap.id
-	group_names    = ["admin", "users"]
-}`, managedGroupName, managedGroupDescription)
-
-	fooManagedGroupLdapUpdate = fmt.Sprintf(`
-resource "boundary_managed_group_ldap" "foo" {
-	name           = "%s"
-	description    = "%s"
-	auth_method_id = boundary_auth_method_ldap.test-ldap.id
-	group_names    = ["admin-updated", "users-updated"]
-}`, managedGroupName+managedGroupUpdate, managedGroupDescription+managedGroupUpdate)
-)
-
-func TestAccManagedGroupLdap(t *testing.T) {
-	wrapper := testWrapper(context.Background(), t, tcRecoveryKey)
-	tc := controller.NewTestController(t, append(tcConfig, controller.WithRecoveryKms(wrapper))...)
-
-	createConfig := fmt.Sprintf(testAuthMethodLdap, testAuthMethodLdapDesc, testAuthMethodLdapCert)
-
-	defer tc.Shutdown()
-	url := tc.ApiAddrs()[0]
-
-	var provider *schema.Provider
-	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckManagedGroupResourceDestroy(t, provider, ldapManagedGroupType),
-		Steps: []resource.TestStep{
-			{
-				// test create
-				Config: testConfig(url, fooOrg, createConfig, fooManagedGroupLdap),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckManagedGroupResourceExists(provider, "boundary_managed_group_ldap.foo"),
-					resource.TestCheckResourceAttr("boundary_managed_group_ldap.foo", DescriptionKey, managedGroupDescription),
-					resource.TestCheckResourceAttr("boundary_managed_group_ldap.foo", NameKey, managedGroupName),
-					testAccCheckManagedGrpAttrAryValueSet(provider, "boundary_managed_group_ldap.foo", managedGroupLdapGroupNamesKey, []string{"admin", "users"}),
-				),
-			},
-			importStep("boundary_managed_group_ldap.foo"),
-			{
-				// test update
-				Config: testConfig(url, fooOrg, createConfig, fooManagedGroupLdapUpdate),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckManagedGroupResourceExists(provider, "boundary_managed_group_ldap.foo"),
-					resource.TestCheckResourceAttr("boundary_managed_group_ldap.foo", DescriptionKey, managedGroupDescription+managedGroupUpdate),
-					resource.TestCheckResourceAttr("boundary_managed_group_ldap.foo", NameKey, managedGroupName+managedGroupUpdate),
-					testAccCheckManagedGrpAttrAryValueSet(provider, "boundary_managed_group_ldap.foo", managedGroupLdapGroupNamesKey, []string{"admin-updated", "users-updated"}),
-				),
-			},
-			importStep("boundary_managed_group_ldap.foo"),
-		},
-	})
-}
-
-func testAccCheckManagedGrpAttrAryValueSet(testProvider *schema.Provider, name string, key string, strAry []string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[name]
-		if !ok {
-			return fmt.Errorf("auth method resource not found: %s", name)
-		}
-
-		id := rs.Primary.ID
-		if id == "" {
-			return fmt.Errorf("auth method resource ID is not set")
-		}
-
-		md := testProvider.Meta().(*metaData)
-		grpClient := managedgroups.NewClient(md.client)
-
-		amr, err := grpClient.Read(context.Background(), id)
-		if err != nil {
-			return fmt.Errorf("Got an error when reading auth method %q: %v", id, err)
-		}
-
-		for _, got := range amr.Item.Attributes[key].([]interface{}) {
-			ok := false
-			for _, expected := range strAry {
-				if strings.TrimSpace(got.(string)) == strings.TrimSpace(expected) {
-					ok = true
-				}
-			}
-			if !ok {
-				return fmt.Errorf("value not found in boundary\n %s: %s\n", key, got.(string))
-			}
-		}
-
-		return nil
-	}
-}

internal/provider/resource_managed_group_test.go

@@ -57,7 +57,7 @@ func TestAccManagedGroup(t *testing.T) {
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckManagedGroupResourceDestroy(t, provider, baseManagedGroupType),
+		CheckDestroy:      testAccCheckManagedGroupResourceDestroy(t, provider),
 		Steps: []resource.TestStep{
 			{
 				// test create
@@ -108,14 +108,7 @@ func testAccCheckManagedGroupResourceExists(testProvider *schema.Provider, name
 	}
 }
 
-type managedGroupType string
-
-const (
-	baseManagedGroupType managedGroupType = "boundary_managed_group"
-	ldapManagedGroupType managedGroupType = "boundary_managed_group_ldap"
-)
-
-func testAccCheckManagedGroupResourceDestroy(t *testing.T, testProvider *schema.Provider, typ managedGroupType) resource.TestCheckFunc {
+func testAccCheckManagedGroupResourceDestroy(t *testing.T, testProvider *schema.Provider) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		if testProvider.Meta() == nil {
 			t.Fatal("got nil provider metadata")
@@ -125,7 +118,7 @@ func testAccCheckManagedGroupResourceDestroy(t *testing.T, testProvider *schema.
 
 		for _, rs := range s.RootModule().Resources {
 			switch rs.Type {
-			case string(typ):
+			case "boundary_managed_group":
 				grpClient := managedgroups.NewClient(md.client)
 				id := rs.Primary.ID
 

internal/provider/resource_storage_bucket.go

@@ -1,552 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
-package provider
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"math/rand"
-	"net/http"
-	"strconv"
-
-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/storagebuckets"
-	"github.com/hashicorp/go-secure-stdlib/parseutil"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-)
-
-const (
-	storageBucketNameKey   = "bucket_name"
-	storageBucketPrefixKey = "bucket_prefix"
-)
-
-func resourceStorageBucket() *schema.Resource {
-	return &schema.Resource{
-		Description: `The storage bucket resource allows you to configure a Boundary storage bucket. ` +
-			`A storage bucket can only belong to the Global scope or an Org scope. ` +
-			`At this time, the only supported storage for storage buckets is AWS S3. ` +
-			`This feature requires Boundary Enterprise or Boundary HCP.`,
-		CreateContext: resourceStorageBucketCreate,
-		ReadContext:   resourceStorageBucketRead,
-		UpdateContext: resourceStorageBucketUpdate,
-		DeleteContext: resourceStorageBucketDelete,
-		Importer: &schema.ResourceImporter{
-			StateContext: schema.ImportStatePassthroughContext,
-		},
-
-		Schema: map[string]*schema.Schema{
-			IDKey: {
-				Description: "The ID of the storage bucket.",
-				Type:        schema.TypeString,
-				Computed:    true,
-			},
-			NameKey: {
-				Description: "The storage bucket name. Defaults to the resource name.",
-				Type:        schema.TypeString,
-				Optional:    true,
-			},
-			DescriptionKey: {
-				Description: "The storage bucket description.",
-				Type:        schema.TypeString,
-				Optional:    true,
-			},
-			PluginIdKey: {
-				Description:   "The ID of the plugin that should back the resource. This or " + PluginNameKey + " must be defined.",
-				Type:          schema.TypeString,
-				ConflictsWith: []string{PluginNameKey},
-				ExactlyOneOf:  []string{PluginIdKey, PluginNameKey},
-				Optional:      true,
-				ForceNew:      true,
-				Computed:      true, // If name is provided this will be computed
-			},
-			PluginNameKey: {
-				Description:   "The name of the plugin that should back the resource. This or " + PluginIdKey + " must be defined.",
-				Type:          schema.TypeString,
-				ConflictsWith: []string{PluginIdKey},
-				ExactlyOneOf:  []string{PluginIdKey, PluginNameKey},
-				Optional:      true,
-				ForceNew:      true,
-			},
-			ScopeIdKey: {
-				Description: "The scope for this storage bucket.",
-				Type:        schema.TypeString,
-				ForceNew:    true,
-				Required:    true,
-			},
-			SecretsJsonKey: {
-				Description: `The secrets for the storage bucket. Either values encoded with the "jsonencode" function, pre-escaped JSON string, ` +
-					`or a file:// or env:// path. Set to a string "null" to clear any existing values. NOTE: Unlike "attributes_json", removing ` +
-					`this block will NOT clear secrets from the storage bucket; this allows injecting secrets for one call, then removing them for storage.`,
-				Type:      schema.TypeString,
-				Required:  true,
-				Sensitive: true,
-			},
-			SecretsHmacKey: {
-				Description: "The HMAC'd secrets value returned from the server.",
-				Type:        schema.TypeString,
-				Computed:    true,
-			},
-			storageBucketNameKey: {
-				Description: "The name of the bucket within the external object store service.",
-				Type:        schema.TypeString,
-				Required:    true,
-			},
-			storageBucketPrefixKey: {
-				Description: "The prefix used to organize the data held within the external object store.",
-				Type:        schema.TypeString,
-				Optional:    true,
-			},
-			internalSecretsConfigHmacKey: {
-				Description: "Internal only. HMAC of (serverSecretsHmac + config secrets). Used for proper secrets handling.",
-				Type:        schema.TypeString,
-				Computed:    true,
-			},
-			internalHmacUsedForSecretsConfigHmacKey: {
-				Description: "Internal only. The Boundary-provided HMAC used to calculate the current value of the HMAC'd config. Used for drift detection.",
-				Type:        schema.TypeString,
-				Computed:    true,
-			},
-			AttributesJsonKey: {
-				Description: `The attributes for the storage bucket. The "region" attribute field is required when creating an AWS storage bucket. ` +
-					`Values are either encoded with the "jsonencode" function, pre-escaped JSON string, ` +
-					`or a file:// or env:// path. Set to a string "null" or remove the block to clear all attributes in the storage bucket.`,
-				Type:     schema.TypeString,
-				Optional: true,
-				// If set to null in config and nothing comes from API, consider
-				// it the same. Same if config changes from empty to null.
-				DiffSuppressFunc: func(k, old, new string, d *schema.ResourceData) bool {
-					sanitizedNew, err := sanitizeJson(new)
-					if err != nil {
-						return false
-					}
-					new = string(sanitizedNew)
-					switch {
-					case old == new:
-						return true
-					case old == "null" && new == "":
-						return true
-					case old == "" && new == "null":
-						return true
-					default:
-						return false
-					}
-				},
-			},
-			WorkerFilterKey: {
-				Description: `Filters to the worker(s) that can handle requests for this storage bucket. The filter must match an existing ` +
-					`worker in order to create a storage bucket.`,
-				Type:     schema.TypeString,
-				Required: true,
-			},
-			internalForceUpdateKey: {
-				Description: "Internal only. Used to force update so that we can always check the value of secrets.",
-				Type:        schema.TypeString,
-				Computed:    true,
-			},
-		},
-
-		// We want to always force an update (which itself may not actually do
-		// anything) so that we can properly check secrets state.
-		CustomizeDiff: func(_ context.Context, d *schema.ResourceDiff, _ interface{}) error {
-			return d.SetNewComputed(internalForceUpdateKey)
-		},
-	}
-}
-
-func setFromStorageBucketResponseMap(d *schema.ResourceData, raw map[string]interface{}) error {
-	if err := d.Set(NameKey, raw[NameKey]); err != nil {
-		return err
-	}
-	if err := d.Set(DescriptionKey, raw[DescriptionKey]); err != nil {
-		return err
-	}
-	if err := d.Set(ScopeIdKey, raw[ScopeIdKey]); err != nil {
-		return err
-	}
-
-	// Plugin stuff
-	{
-		if err := d.Set(PluginIdKey, raw[PluginIdKey]); err != nil {
-			return err
-		}
-		pluginRaw, ok := raw["plugin"]
-		if !ok {
-			return fmt.Errorf("plugin field not found in response")
-		}
-		pluginInfo, ok := pluginRaw.(map[string]interface{})
-		if !ok {
-			return fmt.Errorf("plugin field in response has wrong type")
-		}
-		pluginNameRaw, ok := pluginInfo["name"]
-		if !ok {
-			return fmt.Errorf("plugin name field not found in response")
-		}
-		pluginName, ok := pluginNameRaw.(string)
-		if !ok {
-			return fmt.Errorf("plugin name field in response has wrong type")
-		}
-		if err := d.Set(PluginNameKey, pluginName); err != nil {
-			return err
-		}
-	}
-
-	// Attributes stuff
-	{
-		attrRaw, ok := raw["attributes"]
-		switch ok {
-		case true:
-			encodedAttributes, err := json.Marshal(attrRaw)
-			if err != nil {
-				return err
-			}
-			if err := d.Set(AttributesJsonKey, string(encodedAttributes)); err != nil {
-				return err
-			}
-		default:
-			d.Set(AttributesJsonKey, nil)
-		}
-	}
-
-	// Secrets stuff
-	{
-		// We do not save secrets into the state file, and they're not returned in
-		// the response
-		secretsHmacRaw, ok := raw[SecretsHmacKey]
-		switch ok {
-		case true:
-			if err := d.Set(SecretsHmacKey, secretsHmacRaw); err != nil {
-				return err
-			}
-		default:
-			d.Set(SecretsHmacKey, nil)
-		}
-	}
-
-	d.SetId(raw[IDKey].(string))
-
-	if err := d.Set(internalForceUpdateKey, strconv.FormatInt(rand.Int63(), 10)); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func resourceStorageBucketCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	md := meta.(*metaData)
-	sbClient := storagebuckets.NewClient(md.client)
-	opts := []storagebuckets.Option{}
-
-	var scopeId string
-	if scopeIdVal, ok := d.GetOk(ScopeIdKey); ok {
-		scopeId = scopeIdVal.(string)
-	} else {
-		return diag.Errorf("no scope ID provided")
-	}
-
-	if pluginIdVal, ok := d.GetOk(PluginIdKey); ok {
-		opts = append(opts, storagebuckets.WithPluginId(pluginIdVal.(string)))
-	}
-
-	if pluginNameVal, ok := d.GetOk(PluginNameKey); ok {
-		opts = append(opts, storagebuckets.WithPluginName(pluginNameVal.(string)))
-	}
-
-	if nameVal, ok := d.GetOk(NameKey); ok {
-		opts = append(opts, storagebuckets.WithName(nameVal.(string)))
-	}
-
-	if descVal, ok := d.GetOk(DescriptionKey); ok {
-		opts = append(opts, storagebuckets.WithDescription(descVal.(string)))
-	}
-
-	if storageBucketNameVal, ok := d.GetOk(storageBucketNameKey); ok {
-		opts = append(opts, storagebuckets.WithBucketName(storageBucketNameVal.(string)))
-	}
-
-	if storageBucketPrefixVal, ok := d.GetOk(storageBucketPrefixKey); ok {
-		opts = append(opts, storagebuckets.WithBucketPrefix(storageBucketPrefixVal.(string)))
-	}
-
-	if workerFilterVal, ok := d.GetOk(WorkerFilterKey); ok {
-		opts = append(opts, storagebuckets.WithWorkerFilter(workerFilterVal.(string)))
-	}
-
-	attrsVal, ok := d.GetOk(AttributesJsonKey)
-	if ok {
-		attrsStr, err := parseutil.ParsePath(attrsVal.(string))
-		if err != nil && !errors.Is(err, parseutil.ErrNotAUrl) {
-			return diag.Errorf("error parsing path with attributes: %v", err)
-		}
-		switch attrsStr {
-		case "null":
-			opts = append(opts, storagebuckets.DefaultAttributes())
-		default:
-			// What comes in is json-encoded but we want to set a
-			// map[string]interface{} so we unmarshal it and set that
-			var m map[string]interface{}
-			if err := json.Unmarshal([]byte(attrsStr), &m); err != nil {
-				return diag.Errorf("error unmarshaling attributes: %v", err)
-			}
-			opts = append(opts, storagebuckets.WithAttributes(m))
-		}
-	}
-
-	secretsVal, ok := d.GetOk(SecretsJsonKey)
-	var secretsJson string
-	if ok {
-		var err error
-		secretsJson, err = parseutil.ParsePath(secretsVal.(string))
-		if err != nil && !errors.Is(err, parseutil.ErrNotAUrl) {
-			return diag.Errorf("error parsing path with secrets: %v", err)
-		}
-		switch secretsJson {
-		case "null":
-			opts = append(opts, storagebuckets.DefaultSecrets())
-		default:
-			// What comes in is json-encoded but we want to set a
-			// map[string]interface{} so we unmarshal it and set that
-			var m map[string]interface{}
-			if err := json.Unmarshal([]byte(secretsJson), &m); err != nil {
-				return diag.Errorf("error unmarshaling secrets: %v", err)
-			}
-			opts = append(opts, storagebuckets.WithSecrets(m))
-		}
-	}
-
-	sbr, err := sbClient.Create(ctx, scopeId, opts...)
-	if err != nil {
-		return diag.Errorf("error creating storage bucket: %v", err)
-	}
-	if sbr == nil {
-		return diag.Errorf("nil storage bucket after create")
-	}
-
-	if err := setFromStorageBucketResponseMap(d, sbr.GetResponse().Map); err != nil {
-		return diag.FromErr(err)
-	}
-
-	if serverHmac := d.Get(SecretsHmacKey).(string); serverHmac != "" {
-		configHmac, err := calculateCurrentConfigHmac(serverHmac, secretsJson)
-		if err != nil {
-			return diag.FromErr(err)
-		}
-		if err := d.Set(internalSecretsConfigHmacKey, configHmac); err != nil {
-			return diag.FromErr(err)
-		}
-		if err := d.Set(internalHmacUsedForSecretsConfigHmacKey, serverHmac); err != nil {
-			return diag.FromErr(err)
-		}
-	}
-
-	return nil
-}
-
-func resourceStorageBucketRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	md := meta.(*metaData)
-	sbClient := storagebuckets.NewClient(md.client)
-
-	sbrr, err := sbClient.Read(ctx, d.Id())
-	if err != nil {
-		if apiErr := api.AsServerError(err); apiErr != nil && apiErr.Response().StatusCode() == http.StatusNotFound {
-			d.SetId("")
-			return nil
-		}
-		return diag.Errorf("error reading storage bucket: %v", err)
-	}
-	if sbrr == nil {
-		return diag.Errorf("storage bucket nil after read")
-	}
-
-	if err := setFromStorageBucketResponseMap(d, sbrr.GetResponse().Map); err != nil {
-		return diag.FromErr(err)
-	}
-
-	return nil
-}
-
-func resourceStorageBucketUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	md := meta.(*metaData)
-	sbClient := storagebuckets.NewClient(md.client)
-
-	opts := []storagebuckets.Option{}
-
-	// We need to refresh the current server hmac value to figure out what to do
-	// next around secrets handling
-	var clearStateSecrets, sendSecretsToBoundary bool
-	var secretsJson string
-	var currentDiagnostics diag.Diagnostics
-	{
-		sbrr, err := sbClient.Read(ctx, d.Id())
-		if err != nil {
-			if apiErr := api.AsServerError(err); apiErr != nil && apiErr.Response().StatusCode() == http.StatusNotFound {
-				d.SetId("")
-				return nil
-			}
-			return diag.Errorf("error reading storage bucket in update: %v", err)
-		}
-		if sbrr == nil {
-			return diag.Errorf("storage bucket nil after read in update")
-		}
-		var serverSecretsHmac string
-		if secretsHmacRaw, ok := sbrr.GetResponse().Map[SecretsHmacKey]; ok {
-			serverSecretsHmac = secretsHmacRaw.(string)
-		}
-		// Get current secrets_json value
-		secretsJson, err = parseutil.ParsePath(d.Get(SecretsJsonKey).(string))
-		if err != nil && !errors.Is(err, parseutil.ErrNotAUrl) {
-			return diag.Errorf("error parsing path with secrets: %v", err)
-		}
-		// Now that we have the value from the server, see if anything needs to be
-		// done
-		var diagWarning *diag.Diagnostic
-		clearStateSecrets, sendSecretsToBoundary, diagWarning, err = calculateConfigHmacPlan(serverSecretsHmac, secretsJson, d)
-		if err != nil {
-			return diag.FromErr(err)
-		}
-		if diagWarning != nil {
-			currentDiagnostics = append(currentDiagnostics, *diagWarning)
-		}
-	}
-
-	if d.HasChange(NameKey) {
-		opts = append(opts, storagebuckets.DefaultName())
-		nameVal, ok := d.GetOk(NameKey)
-		if ok {
-			nameStr := nameVal.(string)
-			opts = append(opts, storagebuckets.WithName(nameStr))
-		}
-	}
-
-	if d.HasChange(DescriptionKey) {
-		opts = append(opts, storagebuckets.DefaultDescription())
-		descVal, ok := d.GetOk(DescriptionKey)
-		if ok {
-			descStr := descVal.(string)
-			opts = append(opts, storagebuckets.WithDescription(descStr))
-		}
-	}
-
-	if d.HasChange(storageBucketNameKey) {
-		opts = append(opts, storagebuckets.DefaultBucketName())
-		storageBucketNameVal, ok := d.GetOk(storageBucketNameKey)
-		if ok {
-			storageBucketNameStr := storageBucketNameVal.(string)
-			opts = append(opts, storagebuckets.WithBucketName(storageBucketNameStr))
-		}
-	}
-
-	if d.HasChange(storageBucketPrefixKey) {
-		opts = append(opts, storagebuckets.DefaultBucketPrefix())
-		storageBucketPrefixVal, ok := d.GetOk(storageBucketPrefixKey)
-		if ok {
-			storageBucketPrefixStr := storageBucketPrefixVal.(string)
-			opts = append(opts, storagebuckets.WithBucketPrefix(storageBucketPrefixStr))
-		}
-	}
-
-	if d.HasChange(WorkerFilterKey) {
-		opts = append(opts, storagebuckets.DefaultWorkerFilter())
-		workerFilterVal, ok := d.GetOk(WorkerFilterKey)
-		if ok {
-			workerFilterStr := workerFilterVal.(string)
-			opts = append(opts, storagebuckets.WithWorkerFilter(workerFilterStr))
-		}
-	}
-
-	if d.HasChange(AttributesJsonKey) {
-		attrsVal, ok := d.GetOk(AttributesJsonKey)
-		if ok {
-			attrsStr, err := parseutil.ParsePath(attrsVal.(string))
-			if err != nil && !errors.Is(err, parseutil.ErrNotAUrl) {
-				return append(currentDiagnostics, diag.Errorf("error parsing path with attributes: %v", err)...)
-			}
-			switch attrsStr {
-			case "null", "":
-				opts = append(opts, storagebuckets.DefaultAttributes())
-			default:
-				// What comes in is json-encoded but we want to set a
-				// map[string]interface{} so we unmarshal it and set that
-				var m map[string]interface{}
-				if err := json.Unmarshal([]byte(attrsStr), &m); err != nil {
-					return append(currentDiagnostics, diag.Errorf("error unmarshaling attributes: %v", err)...)
-				}
-				opts = append(opts, storagebuckets.WithAttributes(m))
-			}
-		} else {
-			opts = append(opts, storagebuckets.DefaultAttributes())
-		}
-	}
-
-	if sendSecretsToBoundary {
-		switch secretsJson {
-		case "null":
-			opts = append(opts, storagebuckets.DefaultSecrets())
-		default:
-			// What comes in is json-encoded but we want to set a
-			// map[string]interface{} so we unmarshal it and set that
-			var m map[string]interface{}
-			if err := json.Unmarshal([]byte(secretsJson), &m); err != nil {
-				return append(currentDiagnostics, diag.Errorf("error unmarshaling secrets: %v", err)...)
-			}
-			opts = append(opts, storagebuckets.WithSecrets(m))
-		}
-	}
-
-	if len(opts) > 0 {
-		opts = append(opts, storagebuckets.WithAutomaticVersioning(true))
-		sbur, err := sbClient.Update(ctx, d.Id(), 0, opts...)
-		if err != nil {
-			return append(currentDiagnostics, diag.Errorf("error updating storage bucket: %v", err)...)
-		}
-		if sbur == nil {
-			return append(currentDiagnostics, diag.Errorf("storage bucket nil after update")...)
-		}
-
-		if err := setFromStorageBucketResponseMap(d, sbur.GetResponse().Map); err != nil {
-			return append(currentDiagnostics, diag.FromErr(err)...)
-		}
-	}
-
-	// Save any updated secrets information if needed
-	switch {
-	case clearStateSecrets:
-		if err := d.Set(internalSecretsConfigHmacKey, nil); err != nil {
-			return append(currentDiagnostics, diag.FromErr(err)...)
-		}
-		if err := d.Set(internalHmacUsedForSecretsConfigHmacKey, nil); err != nil {
-			return append(currentDiagnostics, diag.FromErr(err)...)
-		}
-
-	case sendSecretsToBoundary:
-		if serverHmac := d.Get(SecretsHmacKey).(string); serverHmac != "" {
-			configHmac, err := calculateCurrentConfigHmac(serverHmac, secretsJson)
-			if err != nil {
-				return append(currentDiagnostics, diag.FromErr(err)...)
-			}
-			if err := d.Set(internalSecretsConfigHmacKey, configHmac); err != nil {
-				return append(currentDiagnostics, diag.FromErr(err)...)
-			}
-			if err := d.Set(internalHmacUsedForSecretsConfigHmacKey, serverHmac); err != nil {
-				return append(currentDiagnostics, diag.FromErr(err)...)
-			}
-		}
-	}
-
-	return nil
-}
-
-func resourceStorageBucketDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	md := meta.(*metaData)
-	sbClient := storagebuckets.NewClient(md.client)
-
-	_, err := sbClient.Delete(ctx, d.Id())
-	if err != nil {
-		return diag.Errorf("error deleting storage bucket: %v", err)
-	}
-
-	return nil
-}

internal/provider/resource_storage_bucket_test.go

@@ -1,369 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
-package provider
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"net/http"
-	"testing"
-
-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/storagebuckets"
-	"github.com/hashicorp/boundary/testing/controller"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
-)
-
-const (
-	testStorageBucketDescription        = "bar"
-	testStorageBucketDescriptionUpdate  = "bar foo"
-	testStorageBucketDescriptionUpdate2 = "bar foo foo"
-)
-
-var projStorageBucketBase = `
-resource "boundary_storage_bucket" "foo" {
-	name        	= "foo"
-	scope_id    	= boundary_scope.proj1.id
-	plugin_name 	= "loopback"
-	bucket_name   	= "testbucket123"
-    worker_filter 	= "\"pki\" in \"/tags/type\""
-%s
-	depends_on  	= [boundary_role.proj1_admin]
-}`
-
-var (
-	currentStorageBucketSecretsHmacValue string
-	currentStorageBucketAttributesValue  string
-)
-
-func TestAccStorageBucket(t *testing.T) {
-	t.Skip("Skipping test until Boundary Terraform Provider can unit tests for Boundary Enterprise only features")
-
-	tc := controller.NewTestController(t, tcConfig...)
-	defer tc.Shutdown()
-	url := tc.ApiAddrs()[0]
-
-	resName := "boundary_storage_bucket.foo"
-	workerFilter := "\"pki\" in \"/tags/type\""
-	initialValuesStr := fmt.Sprintf(`
-	description = "%s"
-	attributes_json = jsonencode({
-		foo = "bar"
-		zip = "zap"
-	})
-	workerFilter = "%s"
-	secrets_json = jsonencode({
-		hush = "puppies"
-	})
-	`,
-		testStorageBucketDescription,
-		workerFilter,
-	)
-
-	// Changed description and secrets
-	valuesStrUpdate1 := fmt.Sprintf(`
-	description = "%s"
-	attributes_json = jsonencode({
-		foo = "bar"
-		zip = "zoop"
-	})
-	workerFilter = "%s"
-	secrets_json = jsonencode({
-		flush = "fluppies"
-	})
-	`,
-		testStorageBucketDescriptionUpdate,
-		workerFilter,
-	)
-
-	// Changed description, no secrets update
-	valuesStrUpdate2 := fmt.Sprintf(`
-	description = "%s"
-	attributes_json = jsonencode({
-		foo = "bar"
-		zip = "zoop"
-	})
-	workerFilter = "%s"
-	secrets_json = jsonencode({
-		flush = "fluppies"
-	})
-	`,
-		testStorageBucketDescriptionUpdate2,
-		workerFilter,
-	)
-
-	// Same description, now explicitly unset secrets and blankify attrs
-	valuesStrUpdate3 := fmt.Sprintf(`
-		description = "%s"
-		secrets_json = jsonencode({
-			flush = "fluppies"
-		})
-		`,
-		testStorageBucketDescriptionUpdate2,
-	)
-
-	// Set values again
-	valuesStrUpdate4 := fmt.Sprintf(`
-		description = "%s"
-		attributes_json = jsonencode({
-			foo = "bar"
-			zip = "zoop"
-		})
-		secrets_json = jsonencode({
-			flush = "fluppies"
-		})
-		`,
-		testStorageBucketDescriptionUpdate2,
-	)
-
-	// Explicitly set both secrets and attributes to null
-	valuesStrUpdate5 := fmt.Sprintf(`
-		description = "%s"
-		attributes_json = "null"
-		secrets_json = "null"
-		`,
-		testStorageBucketDescriptionUpdate2,
-	)
-
-	initialHcl := fmt.Sprintf(projStorageBucketBase, initialValuesStr)
-	update1Hcl := fmt.Sprintf(projStorageBucketBase, valuesStrUpdate1)
-	update2Hcl := fmt.Sprintf(projStorageBucketBase, valuesStrUpdate2)
-	update3Hcl := fmt.Sprintf(projStorageBucketBase, valuesStrUpdate3)
-	update4Hcl := fmt.Sprintf(projStorageBucketBase, valuesStrUpdate4)
-	update5Hcl := fmt.Sprintf(projStorageBucketBase, valuesStrUpdate5)
-
-	var provider *schema.Provider
-	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories(&provider),
-		CheckDestroy:      testAccCheckStorageBucketResourceDestroy(t, provider, "boundary_storage_bucket"),
-		Steps: []resource.TestStep{
-			{
-				// test create
-				Config: testConfig(url, fooOrg, firstProjectFoo, initialHcl),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckScopeResourceExists(provider, "boundary_scope.org1"),
-					testAccCheckScopeResourceExists(provider, "boundary_scope.proj1"),
-					testAccCheckStorageBucketResourceExists(provider, resName, expectedAttributesStatePreviouslyEmptyNowSet),
-					resource.TestCheckResourceAttr(resName, DescriptionKey, testStorageBucketDescription),
-				),
-				ExpectNonEmptyPlan: true,
-			},
-			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
-			{
-				// test update
-				Config: testConfig(url, fooOrg, firstProjectFoo, update1Hcl),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckStorageBucketResourceExists(provider, resName, expectedAttributesStatePreviouslySetButChanged),
-					resource.TestCheckResourceAttr(resName, DescriptionKey, testStorageBucketDescriptionUpdate),
-				),
-				ExpectNonEmptyPlan: true,
-			},
-			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
-			{
-				// test update
-				Config: testConfig(url, fooOrg, firstProjectFoo, update2Hcl),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckStorageBucketResourceExists(provider, resName, expectedAttributesStatePreviouslySetNoChange),
-					resource.TestCheckResourceAttr(resName, DescriptionKey, testStorageBucketDescriptionUpdate2),
-				),
-				ExpectNonEmptyPlan: true,
-			},
-			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
-			{
-				// this runs the same HCL; mostly used in some manual checking
-				// to ensure update is still called even when nothing has
-				// changed (as we need for secrets)
-				Config: testConfig(url, fooOrg, firstProjectFoo, update2Hcl),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckStorageBucketResourceExists(provider, resName, expectedAttributesStatePreviouslySetNoChange),
-					resource.TestCheckResourceAttr(resName, DescriptionKey, testStorageBucketDescriptionUpdate2),
-				),
-				ExpectNonEmptyPlan: true,
-			},
-			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
-			{
-				// test update
-				Config: testConfig(url, fooOrg, firstProjectFoo, update3Hcl),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckStorageBucketResourceExists(provider, resName, expectedAttributesStatePreviouslySetNoChange),
-					resource.TestCheckResourceAttr(resName, DescriptionKey, testStorageBucketDescriptionUpdate2),
-				),
-				ExpectNonEmptyPlan: true,
-			},
-			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
-			{
-				// test update
-				Config: testConfig(url, fooOrg, firstProjectFoo, update4Hcl),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckStorageBucketResourceExists(provider, resName, expectedAttributesStatePreviouslySetNowEmpty),
-					resource.TestCheckResourceAttr(resName, DescriptionKey, testStorageBucketDescriptionUpdate2),
-				),
-				ExpectNonEmptyPlan: true,
-			},
-			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
-			{
-				// test update
-				Config: testConfig(url, fooOrg, firstProjectFoo, update5Hcl),
-				Check: resource.ComposeTestCheckFunc(
-					testAccCheckStorageBucketResourceExists(provider, resName, expectedAttributesStatePreviouslyEmptyNowSet),
-					resource.TestCheckResourceAttr(resName, DescriptionKey, testStorageBucketDescriptionUpdate2),
-				),
-				ExpectNonEmptyPlan: true,
-			},
-			importStep(resName, SecretsJsonKey, internalHmacUsedForSecretsConfigHmacKey, internalForceUpdateKey, internalSecretsConfigHmacKey),
-		},
-	})
-}
-
-func testAccCheckStorageBucketResourceExists(testProvider *schema.Provider, name string, expAttrState expectedAttributesState) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		rs, ok := s.RootModule().Resources[name]
-		if !ok {
-			return fmt.Errorf("Not found: %s", name)
-		}
-
-		id := rs.Primary.ID
-		if id == "" {
-			return fmt.Errorf("No ID is set")
-		}
-
-		md := testProvider.Meta().(*metaData)
-		sbClient := storagebuckets.NewClient(md.client)
-
-		val, err := sbClient.Read(context.Background(), id)
-		if err != nil {
-			return fmt.Errorf("Got an error when reading storage bucket %q: %v", id, err)
-		}
-		if val == nil {
-			return errors.New("empty val returned")
-		}
-		secretsHmac := val.GetResponse().Map[SecretsHmacKey]
-		attrs := val.GetResponse().Map["attributes"]
-		switch expAttrState {
-		case expectedAttributesStatePreviouslyEmptyNowSet:
-			if currentStorageBucketSecretsHmacValue != "" {
-				return errors.New("expected no previous secrets hmac value")
-			}
-			val := secretsHmac.(string)
-			if val == "" {
-				return errors.New("expected non-empty new secrets hmac value")
-			}
-			currentStorageBucketSecretsHmacValue = val
-			if currentStorageBucketAttributesValue != "" {
-				return fmt.Errorf("expected no previous attributes value, got %s", currentStorageBucketAttributesValue)
-			}
-			if attrs == nil {
-				return errors.New("expected non-empty new attributes value")
-			}
-			attrsVal, err := json.Marshal(attrs)
-			if err != nil {
-				return fmt.Errorf("error marshaling attrs: %w", err)
-			}
-			currentStorageBucketAttributesValue = string(attrsVal)
-
-		case expectedAttributesStatePreviouslySetButChanged:
-			if currentStorageBucketSecretsHmacValue == "" {
-				return errors.New("expected previous secrets hmac value")
-			}
-			val := secretsHmac.(string)
-			if val == "" {
-				return errors.New("expected non-empty new secrets hmac value")
-			}
-			if val == currentStorageBucketSecretsHmacValue {
-				return errors.New("expected changed secrets hmac value")
-			}
-			currentStorageBucketSecretsHmacValue = val
-			if currentStorageBucketAttributesValue == "" {
-				return errors.New("expected previous attributes value")
-			}
-			if attrs == nil {
-				return errors.New("expected non-empty new attributes value")
-			}
-			attrsVal, err := json.Marshal(attrs)
-			if err != nil {
-				return fmt.Errorf("error marshaling attrs: %w", err)
-			}
-			if string(attrsVal) == currentStorageBucketAttributesValue {
-				return errors.New("expected changed attrs value")
-			}
-			currentStorageBucketAttributesValue = string(attrsVal)
-
-		case expectedAttributesStatePreviouslySetNoChange:
-			if currentStorageBucketSecretsHmacValue == "" {
-				return errors.New("expected previous secrets hmac value")
-			}
-			val := secretsHmac.(string)
-			if val == "" {
-				return errors.New("expected non-empty new secrets hmac value")
-			}
-			if val != currentStorageBucketSecretsHmacValue {
-				return errors.New("expected same secrets hmac value")
-			}
-			if currentStorageBucketAttributesValue == "" {
-				return errors.New("expected previous attributes value")
-			}
-			if attrs == nil {
-				return errors.New("expected non-empty new attributes value")
-			}
-			attrsVal, err := json.Marshal(attrs)
-			if err != nil {
-				return fmt.Errorf("error marshaling attrs: %w", err)
-			}
-			if string(attrsVal) == "" {
-				return errors.New("expected non-empty new attributes value")
-			}
-			if string(attrsVal) != currentStorageBucketAttributesValue {
-				return errors.New("expected same attributes value")
-			}
-
-		case expectedAttributesStatePreviouslySetNowEmpty:
-			if currentStorageBucketSecretsHmacValue == "" {
-				return errors.New("expected previous secrets hmac value")
-			}
-			if secretsHmac != nil {
-				return fmt.Errorf("expected empty new secrets hmac value, got %s", secretsHmac.(string))
-			}
-			currentStorageBucketSecretsHmacValue = ""
-			if currentStorageBucketAttributesValue == "" {
-				return errors.New("expected previous attributes value")
-			}
-			if attrs != nil {
-				return fmt.Errorf("expected empty new attributes value, got %s", attrs)
-			}
-			currentStorageBucketAttributesValue = ""
-		}
-		return nil
-	}
-}
-
-func testAccCheckStorageBucketResourceDestroy(t *testing.T, testProvider *schema.Provider, typ string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		if testProvider.Meta() == nil {
-			t.Fatal("got nil provider metadata")
-		}
-		md := testProvider.Meta().(*metaData)
-
-		for _, rs := range s.RootModule().Resources {
-			switch rs.Type {
-			case string(typ):
-
-				id := rs.Primary.ID
-				sbClient := storagebuckets.NewClient(md.client)
-
-				_, err := sbClient.Read(context.Background(), id)
-				if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
-					return fmt.Errorf("didn't get a 404 when reading destroyed storage bucket %q: %v", id, err)
-				}
-
-			default:
-				continue
-			}
-		}
-		return nil
-	}
-}

internal/provider/resource_target.go

@@ -6,7 +6,6 @@ package provider
 import (
 	"context"
 	"encoding/json"
-	"math"
 	"net/http"
 
 	"github.com/hashicorp/boundary/api"
@@ -20,11 +19,8 @@ const (
 	targetBrokeredCredentialSourceIdsKey    = "brokered_credential_source_ids"
 	targetInjectedAppCredentialSourceIdsKey = "injected_application_credential_source_ids"
 	targetDefaultPortKey                    = "default_port"
-	targetDefaultClientPortKey              = "default_client_port"
-	targetEnableSessionRecordingKey         = "enable_session_recording"
 	targetSessionMaxSecondsKey              = "session_max_seconds"
 	targetSessionConnectionLimitKey         = "session_connection_limit"
-	targetStorageBucketIdKey                = "storage_bucket_id"
 	targetWorkerFilterKey                   = "worker_filter"
 	targetWorkerEgressFilterKey             = "egress_worker_filter"
 	targetWorkerIngressFilterKey            = "ingress_worker_filter"
@@ -79,11 +75,6 @@ func resourceTarget() *schema.Resource {
 				Type:        schema.TypeInt,
 				Optional:    true,
 			},
-			targetDefaultClientPortKey: {
-				Description: "The default client port for this target.",
-				Type:        schema.TypeInt,
-				Optional:    true,
-			},
 			targetHostSourceIdsKey: {
 				Description:   "A list of host source ID's. Cannot be used alongside address.",
 				Type:          schema.TypeSet,
@@ -135,16 +126,6 @@ func resourceTarget() *schema.Resource {
 				Optional:      true,
 				ConflictsWith: []string{targetHostSourceIdsKey},
 			},
-			targetEnableSessionRecordingKey: {
-				Description: "HCP/Ent Only. Enable sessions recording for this target. Only applicable for SSH targets.",
-				Type:        schema.TypeBool,
-				Optional:    true,
-			},
-			targetStorageBucketIdKey: {
-				Description: "HCP/Ent Only. Storage bucket for this target. Only applicable for SSH targets.",
-				Type:        schema.TypeString,
-				Optional:    true,
-			},
 		},
 	}
 }
@@ -190,38 +171,16 @@ func setFromTargetResponseMap(d *schema.ResourceData, raw map[string]interface{}
 		return err
 	}
 
-	typeStr := raw["type"].(string)
-
-	switch typeStr {
+	switch raw["type"].(string) {
 	case targetTypeTcp, targetTypeSsh:
 		if attrsVal, ok := raw["attributes"]; ok {
 			attrs := attrsVal.(map[string]interface{})
-			if defPort, ok := attrs[targetDefaultPortKey].(json.Number); ok {
+			if defPort, ok := attrs["default_port"].(json.Number); ok {
 				defPortInt, _ := defPort.Int64()
 				if err := d.Set(targetDefaultPortKey, int(defPortInt)); err != nil {
 					return err
 				}
 			}
-			if defCliPort, ok := attrs[targetDefaultClientPortKey].(json.Number); ok {
-				defCliPortInt, _ := defCliPort.Int64()
-				if err := d.Set(targetDefaultClientPortKey, int(defCliPortInt)); err != nil {
-					return err
-				}
-			}
-
-			// SSH only features
-			if typeStr == targetTypeSsh {
-				if sessionRecordingVal, ok := attrs[targetEnableSessionRecordingKey].(bool); ok {
-					if err := d.Set(targetEnableSessionRecordingKey, sessionRecordingVal); err != nil {
-						return err
-					}
-				}
-				if targetStorageBucketIdVal, ok := attrs[targetStorageBucketIdKey]; ok {
-					if err := d.Set(targetStorageBucketIdKey, targetStorageBucketIdVal); err != nil {
-						return err
-					}
-				}
-			}
 		}
 	}
 
@@ -267,7 +226,7 @@ func resourceTargetCreate(ctx context.Context, d *schema.ResourceData, meta inte
 	defaultPortVal, ok := d.GetOk(targetDefaultPortKey)
 	if ok {
 		defaultPortInt := defaultPortVal.(int)
-		if defaultPortInt <= 0 || defaultPortInt > math.MaxUint16 {
+		if defaultPortInt < 0 || defaultPortInt > 65535 {
 			return diag.Errorf(`"default_port" must be a valid tcp port`)
 		}
 		switch typeStr {
@@ -278,32 +237,6 @@ func resourceTargetCreate(ctx context.Context, d *schema.ResourceData, meta inte
 		}
 	}
 
-	defaultClientPortVal, ok := d.GetOk(targetDefaultClientPortKey)
-	if ok {
-		defaultClientPortInt := defaultClientPortVal.(int)
-		if defaultClientPortInt <= 0 || defaultClientPortInt > math.MaxUint16 {
-			return diag.Errorf(`"default_client_port" must be a valid tcp port`)
-		}
-		switch typeStr {
-		case targetTypeTcp:
-			opts = append(opts, targets.WithTcpTargetDefaultClientPort(uint32(defaultClientPortInt)))
-		case targetTypeSsh:
-			opts = append(opts, targets.WithSshTargetDefaultClientPort(uint32(defaultClientPortInt)))
-		}
-	}
-
-	enableSessionRecordingVal, ok := d.GetOk(targetEnableSessionRecordingKey)
-	if ok {
-		enableSessionRecordingBool := enableSessionRecordingVal.(bool)
-		opts = append(opts, targets.WithSshTargetEnableSessionRecording(enableSessionRecordingBool))
-	}
-
-	storageBucketIdVal, ok := d.GetOk(targetStorageBucketIdKey)
-	if ok {
-		storageBucketIdStr := storageBucketIdVal.(string)
-		opts = append(opts, targets.WithSshTargetStorageBucketId(storageBucketIdStr))
-	}
-
 	sessionMaxSecondsVal, ok := d.GetOk(targetSessionMaxSecondsKey)
 	if ok {
 		sessionMaxSecondsInt := sessionMaxSecondsVal.(int)
@@ -483,34 +416,6 @@ func resourceTargetUpdate(ctx context.Context, d *schema.ResourceData, meta inte
 		}
 	}
 
-	var enableSessionRecording *bool
-	if d.HasChange(targetEnableSessionRecordingKey) {
-		switch typeStr {
-		case targetTypeSsh:
-			opts = append(opts, targets.WithSshTargetEnableSessionRecording(false))
-			enableSessionRecordingVal, ok := d.GetOk(targetEnableSessionRecordingKey)
-			if ok {
-				enableSessionRecordingBool := enableSessionRecordingVal.(bool)
-				enableSessionRecording = &enableSessionRecordingBool
-				opts = append(opts, targets.WithSshTargetEnableSessionRecording(enableSessionRecordingBool))
-			}
-		}
-	}
-
-	var storageBucket *string
-	if d.HasChange(targetStorageBucketIdKey) {
-		switch typeStr {
-		case targetTypeSsh:
-			opts = append(opts, targets.DefaultSshTargetStorageBucketId())
-			storageBucketVal, ok := d.GetOk(targetStorageBucketIdKey)
-			if ok {
-				storageBucketStr := storageBucketVal.(string)
-				storageBucket = &storageBucketStr
-				opts = append(opts, targets.WithSshTargetStorageBucketId(storageBucketStr))
-			}
-		}
-	}
-
 	var defaultPort *int
 	if d.HasChange(targetDefaultPortKey) {
 		switch typeStr {
@@ -519,7 +424,7 @@ func resourceTargetUpdate(ctx context.Context, d *schema.ResourceData, meta inte
 			defaultPortVal, ok := d.GetOk(targetDefaultPortKey)
 			if ok {
 				defaultPortInt := defaultPortVal.(int)
-				if defaultPortInt <= 0 || defaultPortInt > math.MaxUint16 {
+				if defaultPortInt < 0 || defaultPortInt > 65535 {
 					return diag.Errorf(`"default_port" must be a valid tcp port`)
 				}
 				defaultPort = &defaultPortInt
@@ -531,7 +436,7 @@ func resourceTargetUpdate(ctx context.Context, d *schema.ResourceData, meta inte
 			defaultPortVal, ok := d.GetOk(targetDefaultPortKey)
 			if ok {
 				defaultPortInt := defaultPortVal.(int)
-				if defaultPortInt <= 0 || defaultPortInt > math.MaxUint16 {
+				if defaultPortInt < 0 || defaultPortInt > 65535 {
 					return diag.Errorf(`"default_port" must be a valid tcp port`)
 				}
 				defaultPort = &defaultPortInt
@@ -540,35 +445,6 @@ func resourceTargetUpdate(ctx context.Context, d *schema.ResourceData, meta inte
 		}
 	}
 
-	var defaultClientPort *int
-	if d.HasChange(targetDefaultClientPortKey) {
-		switch typeStr {
-		case targetTypeTcp:
-			opts = append(opts, targets.DefaultTcpTargetDefaultClientPort())
-			defaultClientPortVal, ok := d.GetOk(targetDefaultClientPortKey)
-			if ok {
-				defaultClientPortInt := defaultClientPortVal.(int)
-				if defaultClientPortInt <= 0 || defaultClientPortInt > math.MaxUint16 {
-					return diag.Errorf(`"default_client_port" must be a valid tcp port`)
-				}
-				defaultClientPort = &defaultClientPortInt
-				opts = append(opts, targets.WithTcpTargetDefaultClientPort(uint32(defaultClientPortInt)))
-			}
-
-		case targetTypeSsh:
-			opts = append(opts, targets.DefaultSshTargetDefaultClientPort())
-			defaultClientPortVal, ok := d.GetOk(targetDefaultClientPortKey)
-			if ok {
-				defaultClientPortInt := defaultClientPortVal.(int)
-				if defaultClientPortInt <= 0 || defaultClientPortInt > math.MaxUint16 {
-					return diag.Errorf(`"default_client_port" must be a valid tcp port`)
-				}
-				defaultClientPort = &defaultClientPortInt
-				opts = append(opts, targets.WithSshTargetDefaultClientPort(uint32(defaultClientPortInt)))
-			}
-		}
-	}
-
 	var sessionMaxSeconds *int
 	if d.HasChange(targetSessionMaxSecondsKey) {
 		opts = append(opts, targets.DefaultSessionMaxSeconds())
@@ -664,11 +540,6 @@ func resourceTargetUpdate(ctx context.Context, d *schema.ResourceData, meta inte
 			return diag.FromErr(err)
 		}
 	}
-	if d.HasChange(targetDefaultClientPortKey) {
-		if err := d.Set(targetDefaultClientPortKey, defaultClientPort); err != nil {
-			return diag.FromErr(err)
-		}
-	}
 	if d.HasChange(targetSessionMaxSecondsKey) {
 		if err := d.Set(targetSessionMaxSecondsKey, sessionMaxSeconds); err != nil {
 			return diag.FromErr(err)
@@ -699,16 +570,6 @@ func resourceTargetUpdate(ctx context.Context, d *schema.ResourceData, meta inte
 			return diag.FromErr(err)
 		}
 	}
-	if d.HasChange(targetEnableSessionRecordingKey) {
-		if err := d.Set(targetEnableSessionRecordingKey, enableSessionRecording); err != nil {
-			return diag.FromErr(err)
-		}
-	}
-	if d.HasChange(targetStorageBucketIdKey) {
-		if err := d.Set(targetStorageBucketIdKey, storageBucket); err != nil {
-			return diag.FromErr(err)
-		}
-	}
 
 	// The above call may not actually happen, so we use d.Id() and automatic
 	// versioning here

internal/provider/resource_target_test.go

@@ -97,7 +97,6 @@ resource "boundary_target" "foo" {
 		boundary_credential_library_vault.foo.id
 	]
 	default_port = 22
-	default_client_port = 1022
 	depends_on  = [boundary_role.proj1_admin]
 	session_max_seconds = 6000
 	session_connection_limit = 6
@@ -117,7 +116,6 @@ resource "boundary_target" "foo" {
 		boundary_credential_library_vault.bar.id
 	]
 	default_port = 80
-	default_client_port = 8022
 	depends_on  = [boundary_role.proj1_admin]
 	session_max_seconds = 7000
 	session_connection_limit = 7
@@ -131,7 +129,6 @@ resource "boundary_target" "foo" {
 	type         = "tcp"
 	scope_id     = boundary_scope.proj1.id
 	default_port = 80
-	default_client_port = 8022
 	depends_on  = [boundary_role.proj1_admin]
 	session_max_seconds = 7000
 	session_connection_limit = 7
@@ -145,7 +142,6 @@ resource "boundary_target" "foo" {
 	type                                       = "tcp"
 	scope_id                                   = boundary_scope.proj1.id
 	default_port                               = 80
-	default_client_port                        = 8022
 	depends_on                                 = [boundary_role.proj1_admin]
 	session_max_seconds                        = 7000
 	session_connection_limit                   = 7
@@ -156,66 +152,61 @@ resource "boundary_target" "foo" {
 
 	fooTargetWithIPAddress = fmt.Sprintf(`
 resource "boundary_target" "foo" {
-	name                = "test"
-	description         = "%s"
-	type                = "tcp"
-	scope_id            = boundary_scope.proj1.id
-	address             = "127.0.0.1"
-	default_port        = 22
-	default_client_port = 1022
-	depends_on          = [boundary_role.proj1_admin]
+	name         = "test"
+	description  = "%s"
+	type         = "tcp"
+	scope_id     = boundary_scope.proj1.id
+	address      = "127.0.0.1"
+	default_port = 22
+	depends_on  = [boundary_role.proj1_admin]
 }`, fooTargetDescription)
 
 	fooTargetWithDNSAddress = fmt.Sprintf(`
 resource "boundary_target" "foo" {
-	name                = "test"
-	description         = "%s"
-	type                = "tcp"
-	scope_id            = boundary_scope.proj1.id
-	address             = "localhost"
-	default_port        = 22
-	default_client_port = 1022
-	depends_on          = [boundary_role.proj1_admin]
+	name         = "test"
+	description  = "%s"
+	type         = "tcp"
+	scope_id     = boundary_scope.proj1.id
+	address      = "localhost"
+	default_port = 22
+	depends_on  = [boundary_role.proj1_admin]
 }`, fooTargetDescription)
 
 	fooTargetUnsetAddress = fmt.Sprintf(`
 resource "boundary_target" "foo" {
-	name                = "test"
-	description         = "%s"
-	type                = "tcp"
-	scope_id            = boundary_scope.proj1.id
-	default_port        = 22
-	default_client_port = 1022
-	depends_on          = [boundary_role.proj1_admin]
+	name         = "test"
+	description  = "%s"
+	type         = "tcp"
+	scope_id     = boundary_scope.proj1.id
+	default_port = 22
+	depends_on  = [boundary_role.proj1_admin]
 }`, fooTargetDescription)
 
 	fooTargetSetHostSource = fmt.Sprintf(`
 resource "boundary_target" "foo" {
-	name                = "test"
-	description         = "%s"
-	type                = "tcp"
-	scope_id            = boundary_scope.proj1.id
-	default_port        = 22
-	default_client_port = 1022
-	host_source_ids     = [
+	name         = "test"
+	description  = "%s"
+	type         = "tcp"
+	scope_id     = boundary_scope.proj1.id
+	default_port = 22
+	host_source_ids = [
 		boundary_host_set.foo.id
 	]
-	depends_on          = [boundary_role.proj1_admin]
+	depends_on  = [boundary_role.proj1_admin]
 }`, fooTargetDescription)
 
 	fooTargetWithAddressAndHostSource = fmt.Sprintf(`
 resource "boundary_target" "foo" {
-	name                = "test"
-	description         = "%s"
-	type                = "tcp"
-	scope_id            = boundary_scope.proj1.id
-	address             = "localhost"
-	host_source_ids     = [
+	name         = "test"
+	description  = "%s"
+	type         = "tcp"
+	scope_id     = boundary_scope.proj1.id
+	address      = "localhost"
+	host_source_ids = [
 		boundary_host_set.foo.id
 	]
-	default_port        = 22
-	default_client_port = 1022
-	depends_on          = [boundary_role.proj1_admin]
+	default_port = 22
+	depends_on  = [boundary_role.proj1_admin]
 }`, fooTargetDescription)
 )
 
@@ -249,7 +240,6 @@ func TestAccTarget(t *testing.T) {
 					resource.TestCheckResourceAttr("boundary_target.foo", DescriptionKey, fooTargetDescription),
 					resource.TestCheckResourceAttr("boundary_target.foo", NameKey, "test"),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetDefaultPortKey, "22"),
-					resource.TestCheckResourceAttr("boundary_target.foo", targetDefaultClientPortKey, "1022"),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetSessionMaxSecondsKey, "6000"),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetSessionConnectionLimitKey, "6"),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetWorkerEgressFilterKey, `type == "foo"`),
@@ -265,7 +255,6 @@ func TestAccTarget(t *testing.T) {
 					testAccCheckTargetResourceExists(provider, "boundary_target.foo"),
 					resource.TestCheckResourceAttr("boundary_target.foo", DescriptionKey, fooTargetDescriptionUpdate),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetDefaultPortKey, "80"),
-					resource.TestCheckResourceAttr("boundary_target.foo", targetDefaultClientPortKey, "8022"),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetSessionMaxSecondsKey, "7000"),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetSessionConnectionLimitKey, "7"),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetWorkerEgressFilterKey, `type == "bar"`),
@@ -281,7 +270,6 @@ func TestAccTarget(t *testing.T) {
 					testAccCheckTargetResourceExists(provider, "boundary_target.foo"),
 					resource.TestCheckResourceAttr("boundary_target.foo", DescriptionKey, fooTargetDescriptionUpdate),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetDefaultPortKey, "80"),
-					resource.TestCheckResourceAttr("boundary_target.foo", targetDefaultClientPortKey, "8022"),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetSessionMaxSecondsKey, "7000"),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetSessionConnectionLimitKey, "7"),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetWorkerEgressFilterKey, `type == "bar"`),
@@ -297,7 +285,6 @@ func TestAccTarget(t *testing.T) {
 					testAccCheckTargetResourceExists(provider, "boundary_target.foo"),
 					resource.TestCheckResourceAttr("boundary_target.foo", DescriptionKey, ""),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetDefaultPortKey, "80"),
-					resource.TestCheckResourceAttr("boundary_target.foo", targetDefaultClientPortKey, "8022"),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetSessionMaxSecondsKey, "7000"),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetSessionConnectionLimitKey, "7"),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetHostSourceIdsKey+".%", "0"),
@@ -313,7 +300,6 @@ func TestAccTarget(t *testing.T) {
 					testAccCheckTargetResourceExists(provider, "boundary_target.foo"),
 					resource.TestCheckResourceAttr("boundary_target.foo", DescriptionKey, fooTargetDescriptionUpdate),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetDefaultPortKey, "80"),
-					resource.TestCheckResourceAttr("boundary_target.foo", targetDefaultClientPortKey, "8022"),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetSessionMaxSecondsKey, "7000"),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetSessionConnectionLimitKey, "7"),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetWorkerEgressFilterKey, `type == "bar"`),
@@ -349,7 +335,6 @@ func TestAccTargetWithAddress(t *testing.T) {
 					resource.TestCheckResourceAttr("boundary_target.foo", TypeKey, "tcp"),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetAddressKey, "127.0.0.1"),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetDefaultPortKey, "22"),
-					resource.TestCheckResourceAttr("boundary_target.foo", targetDefaultClientPortKey, "1022"),
 				),
 			},
 			importStep("boundary_target.foo"),
@@ -363,7 +348,6 @@ func TestAccTargetWithAddress(t *testing.T) {
 					resource.TestCheckResourceAttr("boundary_target.foo", TypeKey, "tcp"),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetAddressKey, "localhost"),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetDefaultPortKey, "22"),
-					resource.TestCheckResourceAttr("boundary_target.foo", targetDefaultClientPortKey, "1022"),
 				),
 			},
 			importStep("boundary_target.foo"),
@@ -376,7 +360,6 @@ func TestAccTargetWithAddress(t *testing.T) {
 					resource.TestCheckResourceAttr("boundary_target.foo", DescriptionKey, fooTargetDescription),
 					resource.TestCheckResourceAttr("boundary_target.foo", TypeKey, "tcp"),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetDefaultPortKey, "22"),
-					resource.TestCheckResourceAttr("boundary_target.foo", targetDefaultClientPortKey, "1022"),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetAddressKey, ""),
 				),
 			},
@@ -390,7 +373,6 @@ func TestAccTargetWithAddress(t *testing.T) {
 					resource.TestCheckResourceAttr("boundary_target.foo", DescriptionKey, fooTargetDescription),
 					resource.TestCheckResourceAttr("boundary_target.foo", TypeKey, "tcp"),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetDefaultPortKey, "22"),
-					resource.TestCheckResourceAttr("boundary_target.foo", targetDefaultClientPortKey, "1022"),
 					testAccCheckTargetResourceHostSource(provider, "boundary_target.foo", []string{"boundary_host_set.foo"}),
 				),
 			},
@@ -420,7 +402,6 @@ func TestAccTargetWithAddress_MoveToHostSourceDirectly(t *testing.T) {
 					resource.TestCheckResourceAttr("boundary_target.foo", TypeKey, "tcp"),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetAddressKey, "127.0.0.1"),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetDefaultPortKey, "22"),
-					resource.TestCheckResourceAttr("boundary_target.foo", targetDefaultClientPortKey, "1022"),
 				),
 			},
 			importStep("boundary_target.foo"),
@@ -433,7 +414,6 @@ func TestAccTargetWithAddress_MoveToHostSourceDirectly(t *testing.T) {
 					resource.TestCheckResourceAttr("boundary_target.foo", DescriptionKey, fooTargetDescription),
 					resource.TestCheckResourceAttr("boundary_target.foo", TypeKey, "tcp"),
 					resource.TestCheckResourceAttr("boundary_target.foo", targetDefaultPortKey, "22"),
-					resource.TestCheckResourceAttr("boundary_target.foo", targetDefaultClientPortKey, "1022"),
 					testAccCheckTargetResourceHostSource(provider, "boundary_target.foo", []string{"boundary_host_set.foo"}),
 				),
 			},