chore: remove toolchain directive from go.mod (#482)

.github/dependabot.yml

@@ -9,36 +9,12 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      # Check for updates to GitHub Actions every Sunday
-      interval: "weekly"
-      day: "sunday"
-    groups:
-      # Group all GitHub Actions updates into a single PR
-      actions:
-        patterns:
-          - "*"
+      # Check for updates to GitHub Actions every weekday
+      interval: "daily"
 
+  # Maintain dependencies for Go modules
   - package-ecosystem: "gomod"
-    directories: 
-      - "/"
-      - "/plugins/kms/mains/alicloudkms"
-      - "/plugins/kms/mains/awskms"
-      - "/plugins/kms/mains/azurekeyvault"
-      - "/plugins/kms/mains/gcpckms"
-      - "/plugins/kms/mains/ocikms"
-      - "/plugins/kms/mains/transit"
+    directory: "/"
     schedule:
-      # Check for updates to Go modules every Sunday
-      interval: "weekly"
-      day: "sunday"
-    groups:
-      # Group all Go module updates into one PR for version updates
-      # and one for security updates.
-      go:
-        patterns:
-          - "*"
-        applies-to: "version-updates"
-      go-security:
-        patterns:
-          - "*"
-        applies-to: "security-updates"
+      # Check for updates to Go modules every weekday
+      interval: "daily"

.github/pull_request_template.md

@@ -1,11 +0,0 @@
-## PCI review checklist
-
-<!-- heimdall_github_prtemplate:grc-pci_dss-2024-01-05 -->
-
-- [ ] I have documented a clear reason for, and description of, the change I am making.
-
-- [ ] If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
-
-- [ ] If applicable, I've documented the impact of any changes to security controls.
-
-  Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.

.github/workflows/actionlint.yml

@@ -6,9 +6,9 @@ permissions:
 
 jobs:
   actionlint:
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
       - name: Check workflow files
         uses: docker://docker.mirror.hashicorp.services/rhysd/actionlint@sha256:02ccb6d91e4cb4a7b21eb99d5274d257e81ae667688d730e89d7ea0d6d35db91
         with:

.github/workflows/build.yaml

@@ -1,200 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: MPL-2.0
-#
-# This workflow builds the product for all supported platforms and uploads the resulting
-# binaries as Actions artifacts. The workflow also uploads a build metadata file
-# (metadata.json) -- and a Terraform Registry manifest file (terraform-registry-manifest.json).
-#
-# Reference: https://github.com/hashicorp/terraform-provider-crt-example/blob/main/.github/workflows/README.md
-#
-
-name: build
-
-# We default to running this workflow on every push to every branch.
-# This provides fast feedback when build issues occur, so they can be
-# fixed prior to being merged to the main branch.
-#
-# If you want to opt out of this, and only run the build on certain branches
-# please refer to the documentation on branch filtering here:
-#
-#   https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onpushbranchestagsbranches-ignoretags-ignore
-#
-on: [workflow_dispatch, push]
-
-env:
-  PKG_NAME: "terraform-provider-boundary"
-
-permissions:
-  contents: read
-
-jobs:
-  # Detects the Go version to use for builds.
-  get-go-version:
-    name: "Detect Go toolchain version"
-    runs-on: ubuntu-latest
-    outputs:
-      go-version: ${{ steps.get-go-version.outputs.go-version }}
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - name: Detect Go version
-        id: get-go-version
-        # We use .go-version as our source of truth for current Go version,
-        # because "goenv" can react to it automatically.
-        run: |
-          echo "Building with Go $(cat .go-version)"
-          echo "go-version=$(cat .go-version)" >> "$GITHUB_OUTPUT"
-      - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
-        with:
-          go-version: "${{ steps.get-go-version.outputs.go-version }}"
-          cache: false
-
-  # Parses the version/VERSION file. Reference: https://github.com/hashicorp/actions-set-product-version/blob/main/README.md
-  #
-  # > This action should be implemented in product repo `build.yml` files. The action is intended to grab the version
-  # > from the version file at the beginning of the build, then passes those versions (along with metadata, where
-  # > necessary) to any workflow jobs that need version information.
-  set-product-version:
-    name: "Parse version file"
-    runs-on: ubuntu-latest
-    outputs:
-      product-version: ${{ steps.set-product-version.outputs.product-version }}
-      product-base-version: ${{ steps.set-product-version.outputs.base-product-version }}
-      product-prerelease-version: ${{ steps.set-product-version.outputs.prerelease-product-version }}
-      product-minor-version: ${{ steps.set-product-version.outputs.minor-product-version }}
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - name: Set variables
-        id: set-product-version
-        uses: hashicorp/actions-set-product-version@v2
-        with:
-          checkout: false
-
-  # Creates metadata.json file containing build metadata for consumption by CRT workflows.
-  #
-  # Reference: https://github.com/hashicorp/actions-generate-metadata/blob/main/README.md
-  generate-metadata-file:
-    needs: set-product-version
-    runs-on: ubuntu-latest
-    outputs:
-      filepath: ${{ steps.generate-metadata-file.outputs.filepath }}
-    steps:
-      - name: "Checkout directory"
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - name: Generate metadata file
-        id: generate-metadata-file
-        uses: hashicorp/actions-generate-metadata@v1
-        with:
-          version: ${{ needs.set-product-version.outputs.product-version }}
-          product: ${{ env.PKG_NAME }}
-          repositoryOwner: "hashicorp"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: metadata.json
-          path: ${{ steps.generate-metadata-file.outputs.filepath }}
-
-  # Uploads an Actions artifact named terraform-registry-manifest.json.zip.
-  #
-  # The artifact contains a single file with a filename that Terraform Registry expects
-  # (example: terraform-provider-crt-example_2.3.6-alpha1_manifest.json). The file contents
-  # are identical to the terraform-registry-manifest.json file in the source repository.
-  upload-terraform-registry-manifest-artifact:
-    needs: set-product-version
-    runs-on: ubuntu-latest
-    steps:
-      - name: "Checkout directory"
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          path: ${{ env.PKG_NAME }}
-      - name: "Copy manifest from checkout directory to a file with the desired name"
-        id: terraform-registry-manifest
-        run: |
-          name="${{ env.PKG_NAME }}"
-          version="${{ needs.set-product-version.outputs.product-version }}"
-
-          source="${name}/terraform-registry-manifest.json"
-          destination="${name}_${version}_manifest.json"
-
-          cp "$source" "$destination"
-          echo "filename=$destination" >> "$GITHUB_OUTPUT"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: terraform-registry-manifest.json
-          path: ${{ steps.terraform-registry-manifest.outputs.filename }}
-          if-no-files-found: error
-
-  # Builds the product for supported platforms.
-  #
-  # With `reproducible: report`, this job also reports whether the build is reproducible,
-  # but does not enforce it.
-  #
-  # Reference: https://github.com/hashicorp/actions-go-build/blob/main/README.md
-  build:
-    needs:
-      - get-go-version
-      - set-product-version
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: true
-      matrix:
-        goos: [freebsd, windows, linux, darwin]
-        goarch: ["386", "amd64", "arm", "arm64"]
-        exclude:
-          - goos: freebsd
-            goarch: arm64
-          - goos: windows
-            goarch: arm64
-          - goos: windows
-            goarch: arm
-          - goos: darwin
-            goarch: 386
-          - goos: darwin
-            goarch: arm
-
-    name: Go ${{ needs.get-go-version.outputs.go-version }} ${{ matrix.goos }} ${{ matrix.goarch }} build
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: hashicorp/actions-go-build@v1
-        env:
-          CGO_ENABLED: 0
-          BASE_VERSION: ${{ needs.set-product-version.outputs.product-base-version }}
-          PRERELEASE_VERSION: ${{ needs.set-product-version.outputs.product-prerelease-version}}
-          METADATA_VERSION: ${{ env.METADATA }}
-        with:
-          bin_name: "${{ env.PKG_NAME }}_v${{ needs.set-product-version.outputs.product-version }}_x5"
-          product_name: ${{ env.PKG_NAME }}
-          product_version: ${{ needs.set-product-version.outputs.product-version }}
-          go_version: ${{ needs.get-go-version.outputs.go-version }}
-          os: ${{ matrix.goos }}
-          arch: ${{ matrix.goarch }}
-          reproducible: report
-          instructions: |
-            go mod download && ./scripts/plugins-all.sh
-            go build \
-              -o "$BIN_PATH" \
-              -trimpath \
-              -buildvcs=false \
-              -ldflags "-s -w -X 'main.version=${{ needs.set-product-version.outputs.product-version }}'"
-            cp LICENSE "$TARGET_DIR/LICENSE.txt"
-
-  whats-next:
-    needs:
-      - build
-      - generate-metadata-file
-      - upload-terraform-registry-manifest-artifact
-    runs-on: ubuntu-latest
-    name: "What's next?"
-    steps:
-      - name: "Write a helpful summary"
-        run: |
-          github_dot_com="${{ github.server_url }}"
-          owner_with_name="${{ github.repository }}"
-          ref="${{ github.ref }}"
-
-          {
-            echo "### What's next?"
-            echo "#### For a release branch (see \`.release/ci.hcl\`)"
-            echo "After this \`build\` workflow run completes succesfully, you can expect the CRT \`prepare\` workflow to begin momentarily."
-            echo "To find the \`prepare\` workflow run, [view the checks for this commit]($github_dot_com/$owner_with_name/commits/$ref)"
-          }  >> "$GITHUB_STEP_SUMMARY"
-

.github/workflows/jira.yml

@@ -0,0 +1,90 @@
+on:
+  issues:
+    types: [opened, closed, deleted, reopened]
+  pull_request_target:
+    types: [opened, closed, reopened]
+  issue_comment: # Also triggers when commenting on a PR from the conversation view
+    types: [created]
+  workflow_dispatch:
+
+name: Jira Sync
+
+permissions:
+  contents: read
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    name: Jira sync
+    steps:
+    - name: Check if community user
+      if: github.event.action == 'opened'
+      id: boundary-team-role
+      run: |
+        TEAM="boundary"
+        ROLE="$(hub api orgs/hashicorp/teams/${TEAM}/memberships/${{ github.actor }} | jq -r '.role | select(.!=null)')"
+        if [[ -n "${ROLE}" ]]; then
+          echo "Actor ${{ github.actor }} is a ${TEAM} team member, skipping ticket creation"
+        else
+          echo "Actor ${{ github.actor }} is not a ${TEAM} team member"
+        fi
+        echo "name=role::${ROLE}" >> "$GITHUB_OUTPUT"
+      env:
+        GITHUB_TOKEN: ${{ secrets.JIRA_SYNC_GITHUB_TOKEN }}
+
+    - name: Login
+      uses: atlassian/gajira-login@45fd029b9f1d6d8926c6f04175aa80c0e42c9026 # v3.0.1
+      env:
+        JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
+        JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
+        JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
+
+    - name: Set ticket type
+      if: github.event.action == 'opened' && !steps.boundary-team-role.outputs.role
+      id: set-ticket-type
+      run: |
+        if [[ "${{ github.event_name }}" == "pull_request_target" ]]; then
+          echo "name=type::PR" >> "$GITHUB_OUTPUT"
+        else
+          echo "name=type::ISS" >> "$GITHUB_OUTPUT"
+        fi
+
+    - name: Create ticket
+      if: github.event.action == 'opened' && !steps.boundary-team-role.outputs.role
+      uses: tomhjp/gh-action-jira-create@3ed1789cad3521292e591a7cfa703215ec1348bf # v0.2.1
+      with:
+        project: ICU
+        issuetype: "GH Issue"
+        summary: "${{ github.event.repository.name }} [${{ steps.set-ticket-type.outputs.type }} #${{ github.event.issue.number || github.event.pull_request.number }}]: ${{ github.event.issue.title || github.event.pull_request.title }}"
+        description: "${{ github.event.issue.body || github.event.pull_request.body }}\n\n_Created from GitHub Action for ${{ github.event.issue.html_url || github.event.pull_request.html_url }} from ${{ github.actor }}_"
+        # customfield_10089 is Issue Link custom field
+        extraFields: '{"customfield_10089": "${{ github.event.issue.html_url || github.event.pull_request.html_url }}"}'
+
+    - name: Search
+      if: github.event.action != 'opened'
+      id: search
+      uses: tomhjp/gh-action-jira-search@04700b457f317c3e341ce90da5a3ff4ce058f2fa # v0.2.2
+      with:
+        # cf[10089] is Issue Link custom field
+        jql: 'issuetype = "GH Issue" and cf[10089]="${{ github.event.issue.html_url || github.event.pull_request.html_url }}"'
+
+    - name: Sync comment
+      if: github.event.action == 'created' && steps.search.outputs.issue
+      uses: tomhjp/gh-action-jira-comment@6eb6b9ead70221916b6badd118c24535ed220bd9 # v0.2.0
+      with:
+        issue: ${{ steps.search.outputs.issue }}
+        comment: "${{ github.actor }} ${{ github.event.review.state || 'commented' }}:\n\n${{ github.event.comment.body || github.event.review.body }}\n\n${{ github.event.comment.html_url || github.event.review.html_url }}"
+
+    - name: Close ticket
+      if: (github.event.action == 'closed' || github.event.action == 'deleted') && steps.search.outputs.issue
+      uses: atlassian/gajira-transition@38fc9cd61b03d6a53dd35fcccda172fe04b36de3 # v3
+      with:
+        issue: ${{ steps.search.outputs.issue }}
+        transition: Done
+
+    - name: Reopen ticket
+      if: github.event.action == 'reopened' && steps.search.outputs.issue
+      uses: atlassian/gajira-transition@38fc9cd61b03d6a53dd35fcccda172fe04b36de3 # v3
+      with:
+        issue: ${{ steps.search.outputs.issue }}
+        transition: "To Do"

.github/workflows/make-gen-delta.yml

@@ -1,43 +0,0 @@
-name: "make-gen-delta"
-on:
-  - workflow_dispatch
-  - push
-  - pull_request
-  - workflow_call
-
-permissions:
-  contents: read
-
-jobs:
-  make-gen-delta:
-    name: "Check for uncommitted changes from make gen"
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          fetch-depth: '0'
-      - name: Determine Go version
-        id: get-go-version
-        # We use .go-version as our source of truth for current Go
-        # version, because "goenv" can react to it automatically.
-        run: |
-          echo "Building with Go $(cat .go-version)"
-          echo "go-version=$(cat .go-version)" >> "$GITHUB_OUTPUT"
-      - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
-        with:
-          go-version: "${{ steps.get-go-version.outputs.go-version }}"
-      - name: Running go mod tidy
-        run: |
-          go mod tidy
-      - name: Install Dependencies
-        run: |
-          make tools
-      - name: Running make gen
-        run: |
-          make gen
-      - name: Check for changes
-        run: |
-          git diff --exit-code
-          git status --porcelain
-          test -z "$(git status --porcelain)"

.github/workflows/release.yml

@@ -0,0 +1,51 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v[0-9]+.[0-9]+.[0-9]+*'
+
+permissions:
+  contents: write
+
+jobs:
+  go-version:
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.go-version.outputs.version }}
+    steps:
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+      - id: go-version
+        run: echo "name=version::$(cat ./.go-version)" >> "$GITHUB_OUTPUT"
+  release-notes:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+        with:
+          fetch-depth: 0
+      - name: Generate Release Notes
+        run: sed -n -e "1{/# /d;}" -e "2{/^$/d;}" -e "/# $(git describe --abbrev=0 --exclude="$(git describe --abbrev=0 --match='v*.*.*' --tags)" --match='v*.*.*' --tags | tr -d v)/q;p" CHANGELOG.md > release-notes.txt
+      - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        with:
+          name: release-notes
+          path: release-notes.txt
+          retention-days: 1
+  terraform-provider-release:
+    name: 'Terraform Provider Release'
+    needs: [go-version, release-notes]
+    uses: hashicorp/ghaction-terraform-provider-release/.github/workflows/hashicorp.yml@v2
+    secrets:
+      hc-releases-github-token: '${{ secrets.HASHI_RELEASES_GITHUB_TOKEN }}'
+      hc-releases-host-staging: '${{ secrets.HC_RELEASES_HOST_STAGING }}'
+      hc-releases-host-prod: '${{ secrets.HC_RELEASES_HOST_PROD }}'
+      hc-releases-key-prod: '${{ secrets.HC_RELEASES_KEY_PROD }}'
+      hc-releases-key-staging: '${{ secrets.HC_RELEASES_KEY_STAGING }}'
+      hc-releases-terraform-registry-sync-token: '${{ secrets.TF_PROVIDER_RELEASE_TERRAFORM_REGISTRY_SYNC_TOKEN }}'
+      setup-signore-github-token: '${{ secrets.HASHI_SIGNORE_GITHUB_TOKEN }}'
+      signore-client-id: '${{ secrets.SIGNORE_CLIENT_ID }}'
+      signore-client-secret: '${{ secrets.SIGNORE_CLIENT_SECRET }}'
+    with:
+      release-notes: true
+      setup-go-version: '${{ needs.go-version.outputs.version }}'
+      # Product Version (e.g. v1.2.3 or github.ref_name)
+      product-version: '${{ github.ref_name }}'

.github/workflows/test.yml

@@ -11,9 +11,9 @@ permissions:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
       - name: Determine go version
         id: get-go-version
         # We use .go-version as our source of truth for current Go
@@ -22,17 +22,16 @@ jobs:
           echo "Building with Go $(cat .go-version)"
           echo "go-version=$(cat .go-version)" >> "$GITHUB_OUTPUT"
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version: "${{ steps.get-go-version.outputs.go-version }}"
-          cache: false
       - name: Determine Go cache paths
         id: go-cache-paths
         run: |
           echo "go-build=$(go env GOCACHE)" >> "$GITHUB_OUTPUT"
           echo "go-mod=$(go env GOMODCACHE)" >> "$GITHUB_OUTPUT"
       - name: Set up Go modules cache
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         with:
           path: |
             ${{ steps.go-cache-paths.outputs.go-build }}

.go-version

@@ -1 +1 @@
-1.26.4
+1.21.1

.goreleaser.yml

@@ -0,0 +1,78 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+archives:
+  - files:
+      # Ensure only built binary is archived
+      - 'none*'
+    format: zip
+    name_template: '{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}'
+before:
+  hooks:
+    - 'go mod download'
+    - './scripts/plugins-all.sh'
+builds:
+  - # Binary naming only required for Terraform CLI 0.12
+    binary: '{{ .ProjectName }}_v{{ .Version }}_x5'
+    env:
+      - CGO_ENABLED=0
+    flags:
+      - -trimpath
+    goos:
+      - darwin
+      - freebsd
+      - linux
+      - windows
+    goarch:
+      - '386'
+      - amd64
+      - arm
+      - arm64
+    ignore:
+      - goarch: arm
+        goos: windows
+      - goarch: arm64
+        goos: freebsd
+      - goarch: arm64
+        goos: windows
+    ldflags:
+      - -s -w -X main.Version={{.Version}}
+    mod_timestamp: '{{ .CommitTimestamp }}'
+checksum:
+  algorithm: sha256
+  extra_files:
+    - glob: 'terraform-registry-manifest.json'
+      name_template: '{{ .ProjectName }}_{{ .Version }}_manifest.json'
+  name_template: '{{ .ProjectName }}_{{ .Version }}_SHA256SUMS'
+publishers:
+  - checksum: true
+    # Terraform CLI 0.10 - 0.11 perform discovery via HTTP headers on releases.hashicorp.com
+    # For providers which have existed since those CLI versions, exclude
+    # discovery by setting the protocol version headers to 5.
+    cmd: hc-releases upload -product {{ .ProjectName }} -version {{ .Version }} -file={{ .ArtifactPath }}={{ .ArtifactName }} -header=x-terraform-protocol-version=5 -header=x-terraform-protocol-versions=5.0
+    env:
+      - HC_RELEASES_HOST={{ .Env.HC_RELEASES_HOST }}
+      - HC_RELEASES_KEY={{ .Env.HC_RELEASES_KEY }}
+    extra_files:
+      - glob: 'terraform-registry-manifest.json'
+        name_template: '{{ .ProjectName }}_{{ .Version }}_manifest.json'
+    name: upload
+    signature: true
+release:
+  extra_files:
+    - glob: 'terraform-registry-manifest.json'
+      name_template: '{{ .ProjectName }}_{{ .Version }}_manifest.json'
+  ids:
+    - none
+signs:
+  - args: ["sign", "--dearmor", "--file", "${artifact}", "--out", "${signature}"]
+    artifacts: checksum
+    cmd: signore
+    signature: ${artifact}.sig
+  - args: ["sign", "--dearmor", "--file", "${artifact}", "--out", "${signature}"]
+    artifacts: checksum
+    cmd: signore
+    id: key-id
+    signature: ${artifact}.72D7468F.sig
+snapshot:
+  name_template: "{{ .Tag }}-next"

.release/ci.hcl

@@ -1,96 +0,0 @@
-# Copyright IBM Corp. 2020, 2026
-# SPDX-License-Identifier: MPL-2.0
-# 
-# Reference: https://github.com/hashicorp/crt-core-helloworld/blob/main/.release/ci.hcl (private repository)
-# 
-# One way to validate this file, with a local build of the orchestrator (an internal repo):
-# 
-# $ GITHUB_TOKEN="not-used" orchestrator parse config -use-v2 -local-config=.release/ci.hcl
-
-schema = "2"
-
-project "terraform-provider-boundary" {
-  // team is currently unused and has no meaning
-  // but is required to be non-empty by CRT orchestator
-  team = "_UNUSED_"
-
-  slack {
-    notification_channel = "C01BWLSMJ03" // #proj-boundary-release-engineering
-  }
-
-  github {
-    organization     = "hashicorp"
-    repository       = "terraform-provider-boundary"
-    release_branches = ["main", "release/**"]
-  }
-}
-
-event "merge" {
-}
-
-event "build" {
-  action "build" {
-    depends = ["merge"]
-
-    organization = "hashicorp"
-    repository   = "terraform-provider-boundary"
-    workflow     = "build"
-  }
-}
-
-event "prepare" {
-  # `prepare` is the Common Release Tooling (CRT) artifact processing workflow.
-  # It prepares artifacts for potential promotion to staging and production.
-  # For example, it scans and signs artifacts.
-
-  depends = ["build"]
-
-  action "prepare" {
-    organization = "hashicorp"
-    repository   = "crt-workflows-common"
-    workflow     = "prepare"
-    depends      = ["build"]
-  }
-
-  notification {
-    on = "fail"
-  }
-}
-
-event "trigger-staging" {
-}
-
-event "promote-staging" {
-  action "promote-staging" {
-    organization = "hashicorp"
-    repository   = "crt-workflows-common"
-    workflow     = "promote-staging"
-    depends      = null
-    config       = "release-metadata.hcl"
-  }
-
-  depends = ["trigger-staging"]
-
-  notification {
-    on = "always"
-  }
-}
-
-event "trigger-production" {
-}
-
-event "promote-production" {
-  action "promote-production" {
-    organization = "hashicorp"
-    repository   = "crt-workflows-common"
-    workflow     = "promote-production"
-    depends      = null
-    config       = ""
-  }
-
-  depends = ["trigger-production"]
-
-  notification {
-    on = "always"
-  }
-}

.release/release-metadata.hcl

@@ -1,7 +1,5 @@
-# Copyright IBM Corp. 2020, 2026
+# Copyright (c) HashiCorp, Inc.
 # SPDX-License-Identifier: MPL-2.0
 
 url_source_repository      = "https://github.com/hashicorp/terraform-provider-boundary"
-url_project_website        = "https://registry.terraform.io/providers/hashicorp/boundary"
 url_license                = "https://github.com/hashicorp/terraform-provider-boundary/blob/main/LICENSE"
-url_release_notes          = "https://github.com/hashicorp/terraform-provider-boundary/blob/main/CHANGELOG.md"

.release/security-scan.hcl

@@ -1,28 +0,0 @@
-# Copyright IBM Corp. 2020, 2026
-# SPDX-License-Identifier: MPL-2.0
-#
-# Reference: https://github.com/hashicorp/security-scanner/blob/main/CONFIG.md#binary (private repository)
-
-binary {
-  secrets {
-    all = true
-  }
-  go_modules   = true
-  osv          = true
-  oss_index    = false
-  nvd          = false
-
-    triage {
-    suppress {
-      vulnerabilities = [
-        // golang.org/x/crypto/openpgp is deprecated/unmaintained with no fixed
-        // version. The provider does not use this package (confirmed via
-        // `go mod why golang.org/x/crypto/openpgp`); it imports the maintained
-        // fork github.com/ProtonMail/go-crypto/openpgp instead. x/crypto is
-        // only pulled in for the unaffected golang.org/x/crypto/cryptobyte
-        // package. Not reachable in the built binary.
-        "GO-2026-5932",
-      ]
-    }
-  }
-}

.release/terraform-provider-boundary-artifacts.hcl

@@ -1,20 +0,0 @@
-# Copyright IBM Corp. 2020, 2026
-# SPDX-License-Identifier: MPL-2.0
-
-schema = 1
-artifacts {
-  # This should match the `matrix` in .github/workflows/build.yml
-  zip = [
-    "terraform-provider-boundary_${version}_darwin_amd64.zip",
-    "terraform-provider-boundary_${version}_darwin_arm64.zip",
-    "terraform-provider-boundary_${version}_freebsd_386.zip",
-    "terraform-provider-boundary_${version}_freebsd_amd64.zip",
-    "terraform-provider-boundary_${version}_freebsd_arm.zip",
-    "terraform-provider-boundary_${version}_linux_386.zip",
-    "terraform-provider-boundary_${version}_linux_amd64.zip",
-    "terraform-provider-boundary_${version}_linux_arm.zip",
-    "terraform-provider-boundary_${version}_linux_arm64.zip",
-    "terraform-provider-boundary_${version}_windows_386.zip",
-    "terraform-provider-boundary_${version}_windows_amd64.zip",
-  ]
-}

.vscode/launch.json

@@ -1,22 +0,0 @@
-{
-    // Use IntelliSense to learn about possible attributes.
-    // Hover to view descriptions of existing attributes.
-    // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
-    "version": "0.2.0",
-    "configurations": [
-        {
-            "name": "Launch a test function",
-            "type": "go",
-            "request": "launch",
-            "mode": "auto",
-            "program": "${fileDirname}",
-            "args": [
-                "-test.v",
-                "-test.run",
-                "^${selectedText}$"
-            ],
-            "showLog": true,
-            "envFile": "${workspaceFolder}/.vscode/private.env"
-        }
-    ]
-}

.vscode/private.env

@@ -1,3 +0,0 @@
-TF_ACC=1
-TF_LOG=INFO
-GOFLAGS='-mod=readonly'

CHANGELOG.md

@@ -2,129 +2,6 @@
 
 Canonical reference for changes, improvements, and bugfixes for the Boundary Terraform provider.
 
-## Next
-## 1.6.1 (Jul 24th, 2026)
-
-### New and Improved
-
-* Adds support to enable set/remove alias suffix and aliases at project scope
-  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/824))
-
-## 1.6.0 (Jul 8th, 2026)
-
-### New and Improved
-
-* Adds support to enable Session Recording for RDP Targets
-  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/818))
-
-
-## 1.5.1 (Feb 2nd, 2026)
-
-### New and Improved
-
-* Adds support for Vault LDAP Credential Store.
-  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/778))
-
-## 1.5.0 (December 19th, 2025)
-
-### New and Improved
-
-* Adds support for Password credentials.
-  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/758))
-
-## 1.4.0 (September 25th, 2025)
-
-### New and Improved
-
-* Adds support for new RDP target type and Username, Password, and Domain credentials.
-  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/735))
-
-## 1.3.1 (July 11th, 2025)
-
-### Bug Fix
-
-* Fixes a problem where the KMS plugins were not being bundled in the provider's
-  binary ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/717))
-
-## 1.3.0 (July 9th, 2025)
-
-### Known Issues
-
-* `Error configuring kms: plugin is nil`: This error message may occur when you
-  attempt to use KMS plugin functionality. The [KMS plugins](plugins/kms/mains)
-  were not bundled in this Terraform provider release and thus any functionality
-  related to this will not work.
-
-### New and Improved
-
-* Updates various dependencies across the provider
-  ([Example PR](https://github.com/hashicorp/terraform-provider-boundary/pull/708))
-
-## 1.2.0 (October 21, 2024)
-
-### New and Improved
-
-* Introduces support for specifying a worker filter in dynamic host catalogs
-  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/626))
-
-### Deprecations/Changes
-
-* With Boundary 0.15, a deprecation notice was put under the `grant_scope_id`
-  field, and a new `grant_scope_ids` field was introduced to replace it. With
-  Boundary v0.17.1 and Boundary API v0.0.52, `grant_scope_id` support was
-  entirely removed. `grant_scope_id` support has now been removed from this TF
-  provider.
-
-## 1.1.15 (May 1, 2024)
-
-### New and Improved
-
-* Add support for a target alias as a resource
-  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/571))
-
-## 1.1.14 (February 14, 2024)
-
-### New and Improved
-
-* Support the multi-value `grant_scope_ids` field in the role provider
-  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/562))
-
-* Support Boundary [Storage Policies](https://developer.hashicorp.com/boundary/docs/configuration/session-recording/configure-storage-policy)
-  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/558))
-
-## 1.1.13 (February 1, 2024)
-
-### New and Improved
-
-* Allow dynamic credentials when configuring storage buckets
-  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/549))
-
-## 1.1.12 (January 8, 2024)
-
-### New and Improved
-
-* Add support to configure valid_principals with Vault SSH Certificate Credential Library
-  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/512))
-
-## 1.1.11 (December 13, 2023)
-
-### New and Improved
-
-* Add support for OIDC prompts. Using prompts, the Relying Party (RP) can customize the authentication and authorization flow to suit their specific needs and improve the user experience. [OIDC Authentication request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest) server.
-  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/519))
-* Add boundary_auth_method data source
-  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/505))
-* Add boundary_group data source
-  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/503))
-* Add boundary_account data source
-  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/493))
-* Add boundary_user data source
-  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/468))
-
-### Bug Fix
-* Fix boundary_worker overwriting worker generated auth token during
-  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/461)) 
-
 ## 1.1.10 (October 11, 2023)
 
 ### New and Improved
@@ -408,4 +285,4 @@ Update provider to handle new domain errors ([PR](https://github.com/hashicorp/t
 
 ## 0.1.0 (October 14, 2020)
 
-Initial release!
+Initial release!

CODEOWNERS

@@ -1,4 +1,4 @@
 # These owners will be the default owners for everything in
 # the repo, unless a later match takes precedence.
 
-* @hashicorp/boundary
+@hashicorp/boundary

Dockerfile

@@ -1,4 +1,4 @@
-# Copyright IBM Corp. 2020, 2026
+# Copyright (c) HashiCorp, Inc.
 # SPDX-License-Identifier: MPL-2.0
 
 FROM golang:1.20

Makefile

@@ -18,12 +18,14 @@ DOCKER_ARGS ?= -d
 PG_OPTS ?=
 TEST_DB_PORT ?= 5432
 BOUNDARY_VERSION = $(shell go mod edit -json | jq -r '.["Require"][] | select(.Path=="github.com/hashicorp/boundary") | .["Version"]')
-GOPATH ?= $(abspath ~/go)
+GOPATH ?= ~/go
 GOMODCACHE ?= $(GOPATH)/pkg/mod
 
 tools:
 	go generate -tags tools tools/tools.go
-	go install github.com/hashicorp/copywrite@v0.15.0
+
+fmtcheck:
+	echo "Placeholder"
 
 test:
 	echo "Placeholder"
@@ -79,14 +81,3 @@ test-database-down:
 	docker rm -v boundary-sql-tests || true
 
 .PHONY: testacc tools docs test-database-up test-database-down
-
-.PHONY: copywrite
-copywrite:
-	copywrite headers
-
-.PHONY: fmt
-fmt:
-	gofumpt -w $$(find . -name '*.go')
-
-.PHONY: gen
-gen: docs copywrite fmt

README.md

@@ -1,15 +1,18 @@
 ![](boundary.png)
 
-# Terraform Provider Boundary
+Terraform Provider Boundary
+==================
 
 Available in the [Terraform Registry](https://registry.terraform.io/providers/hashicorp/boundary/latest).
 
-## Requirements
+Requirements
+------------
 
--	[Terraform](https://www.terraform.io/downloads.html) >= 0.13.x
--	[Go](https://golang.org/doc/install) >= 1.21
+-	[Terraform](https://www.terraform.io/downloads.html) >= 0.12.x
+-	[Go](https://golang.org/doc/install) >= 1.20
 
-## Building The Provider
+Building The Provider
+---------------------
 
 1. Clone the repository
 1. Enter the repository directory
@@ -19,30 +22,32 @@ You'll need to ensure that your Terraform file contains the information necessar
 
 ```hcl
 terraform {
-  required_providers {
-    boundary = {
-      source = "localhost/providers/boundary"
-      version = "0.0.1"
-    }
-  }
+        required_providers {
+                boundary = {
+                        source = "localhost/providers/boundary"
+                        version = "0.0.1"
+                }
+        }
 }
 ```
 
-## Adding Dependencies
+Adding Dependencies
+---------------------
 
 This provider uses [Go modules](https://github.com/golang/go/wiki/Modules).
 Please see the Go documentation for the most up to date information about using Go modules.
 
 To add a new dependency `github.com/author/dependency` to your Terraform provider:
 
-```shell
+```
 go get github.com/author/dependency
 go mod tidy
 ```
 
 Then commit the changes to `go.mod` and `go.sum`.
 
-## Developing the Provider
+Developing the Provider
+---------------------------
 
 If you wish to work on the provider, you'll first need [Go](http://www.golang.org) installed on your machine (see [Requirements](#requirements) above).
 
@@ -67,40 +72,25 @@ $ make testacc
 For more details on the docker image and troubleshooting see the
 [boundary testing doc](https://github.com/hashicorp/boundary/blob/main/CONTRIBUTING.md#testing).
 
-## Debugging the provider
-
-If you're using vscode, this provider has delve debugging baked into the [.vscode](https://github.com/hashicorp/terraform-provider-boundary/tree/main/.vscode) directory. To debug you can find instructions [here.](https://dev.to/drewmullen/vscode-terraform-provider-development-setup-debugging-6bn#usage)
-
-## Generating Docs
-
-This provider uses the [terraform-plugin-docs](https://github.com/hashicorp/terraform-plugin-docs/) tool to generate documentation. Each resource and data source requires a set of examples [examples](https://github.com/hashicorp/terraform-provider-boundary/tree/main/examples) then you execute a binary to generate the docs which are placed in [./docs](https://github.com/hashicorp/terraform-provider-boundary/tree/main/docs). Optionally, you can specify your own [templates](https://github.com/hashicorp/terraform-provider-boundary/tree/main/templates) for a resource or data source if you want to add custom information (example: [data "boundary_scope"](https://github.com/hashicorp/terraform-provider-boundary/blob/main/templates/data-sources/scope.md.tmpl#L11))
-
-### New Resources & Data Sources (documentation templates)
-
-If you're adding a new resource or a data source, you must include a documentation template for your new R/DS in [./templates](https://github.com/hashicorp/terraform-provider-boundary/tree/main/templates) directory. This provider uses the [terraform-plugin-docs](https://github.com/hashicorp/terraform-plugin-docs/) tool to generate documentation. For full details see the link.
-
-### Documentation Examples for Resources & Data Sources
-
-Examples are required for all resources and data sources. This provider uses the [terraform-plugin-docs](https://github.com/hashicorp/terraform-plugin-docs/) tool to generate documentation. To add examples, add a new file to the [./examples](https://github.com/hashicorp/terraform-provider-boundary/tree/main/examples) directory or update the existing files. Next make sure the corresponding template in [./templates](https://github.com/hashicorp/terraform-provider-boundary/tree/main/templates) directory references this example.
-
-### Generating
+Generating Docs
+----------------------
 
 From the root of the repo run:
 
-```shell
+```
 go run github.com/hashicorp/terraform-plugin-docs/cmd/tfplugindocs
 ```
 
-## Using the provider
-
+Using the provider
+----------------------
 Please see our detailed docs for individual resource usage. Below is a complex example using the Boundary provider to configure all resource types available:
 
 ```hcl
 provider "boundary" {
-  addr                   = "http://127.0.0.1:9200"
-  auth_method_id         = "ampw_1234567890"      # changeme
-  auth_method_login_name = "myuser"               # changeme
-  auth_method_password   = "passpass"             # changeme
+  addr                            = "http://127.0.0.1:9200"
+  auth_method_id                  = "ampw_1234567890"      # changeme
+  password_auth_method_login_name = "myuser"               # changeme
+  password_auth_method_password   = "passpass"             # changeme
 }
 
 variable "users" {
@@ -150,7 +140,7 @@ resource "boundary_user" "users" {
   scope_id    = boundary_scope.corp.id
 }
 
-// organization level group for readonly users
+// organization level group for readonly users 
 resource "boundary_group" "readonly" {
   name        = "readonly"
   description = "Organization group for readonly users"
@@ -163,7 +153,7 @@ resource "boundary_role" "organization_readonly" {
   name        = "readonly"
   description = "Read-only role"
   principal_ids = [boundary_group.readonly_users.id]
-  grant_strings = ["ids=*;type=*;actions=read"]
+  grant_strings = ["id=*;type=*;actions=read"]
   scope_id    = boundary_scope.corp.id
 }
 
@@ -174,7 +164,7 @@ resource "boundary_role" "organization_admin" {
   principal_ids = concat(
     [for user in boundary_user.user: user.id]
   )
-  grant_strings   = ["ids=*;type=*;actions=create,read,update,delete"]
+  grant_strings   = ["id=*;type=*;actions=create,read,update,delete"]
   scope_id = boundary_scope.corp.id
 }
 

docs/data-sources/account.md

@@ -1,47 +0,0 @@
----
-# generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "boundary_account Data Source - terraform-provider-boundary"
-subcategory: ""
-description: |-
-  The boundary_account data source allows you to find a Boundary account.
----
-
-# boundary_account (Data Source)
-
-The boundary_account data source allows you to find a Boundary account.
-
-## Example Usage
-
-```terraform
-# Retrieve the ID of a Boundary account
-data "boundary_account" "admin" {
-  name           = "admin"
-  auth_method_id = "ampw_1234567890"
-}
-```
-
-<!-- schema generated by tfplugindocs -->
-## Schema
-
-### Required
-
-- `auth_method_id` (String) The auth method ID that will be queried for the account.
-- `name` (String) The name of the account to retrieve.
-
-### Read-Only
-
-- `description` (String) The description of the retrieved account.
-- `id` (String) The ID of the retrieved account.
-- `scope` (List of Object) (see [below for nested schema](#nestedatt--scope))
-- `type` (String) The type of the account
-
-<a id="nestedatt--scope"></a>
-### Nested Schema for `scope`
-
-Read-Only:
-
-- `description` (String)
-- `id` (String)
-- `name` (String)
-- `parent_scope_id` (String)
-- `type` (String)

docs/data-sources/auth_method.md

@@ -1,60 +0,0 @@
----
-# generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "boundary_auth_method Data Source - terraform-provider-boundary"
-subcategory: ""
-description: |-
-  The boundary_auth_method data source allows you to find a Boundary auth method.
----
-
-# boundary_auth_method (Data Source)
-
-The boundary_auth_method data source allows you to find a Boundary auth method.
-
-## Example Usage
-
-```terraform
-# Retrieve an auth method from the global scope
-data "boundary_auth_method" "auth_method" {
-  name = "password_auth_method"
-}
-
-# Auth method from a org scope
-data "boundary_scope" "org" {
-  name     = "my-org"
-  scope_id = "global"
-}
-
-data "boundary_auth_method" "auth_method" {
-  name     = "password_auth_method"
-  scope_id = data.boundary_scope.org.id
-}
-```
-
-<!-- schema generated by tfplugindocs -->
-## Schema
-
-### Required
-
-- `name` (String) The name of the auth method to retrieve.
-
-### Optional
-
-- `scope_id` (String) The scope ID in which the resource is created. Defaults `global` if unset.
-
-### Read-Only
-
-- `description` (String) The description of the retrieved auth method.
-- `id` (String) The ID of the retrieved auth method.
-- `scope` (List of Object) (see [below for nested schema](#nestedatt--scope))
-- `type` (String) The type of the auth method
-
-<a id="nestedatt--scope"></a>
-### Nested Schema for `scope`
-
-Read-Only:
-
-- `description` (String)
-- `id` (String)
-- `name` (String)
-- `parent_scope_id` (String)
-- `type` (String)

docs/data-sources/group.md

@@ -1,60 +0,0 @@
----
-# generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "boundary_group Data Source - terraform-provider-boundary"
-subcategory: ""
-description: |-
-  The boundary_group data source allows you to find a Boundary group.
----
-
-# boundary_group (Data Source)
-
-The boundary_group data source allows you to find a Boundary group.
-
-## Example Usage
-
-```terraform
-# Retrieve a user from the global scope
-data "boundary_group" "global_group" {
-  name = "admin"
-}
-
-# User from an org scope
-data "boundary_scope" "org" {
-  name     = "org"
-  scope_id = "global"
-}
-
-data "boundary_group" "org_group" {
-  name     = "username"
-  scope_id = data.boundary_scope.org.id
-}
-```
-
-<!-- schema generated by tfplugindocs -->
-## Schema
-
-### Required
-
-- `name` (String) The name of the group to retrieve.
-
-### Optional
-
-- `scope_id` (String) The scope ID in which the resource is created. Defaults `global` if unset.
-
-### Read-Only
-
-- `description` (String) The description of the retrieved group.
-- `id` (String) The ID of the retrieved group.
-- `member_ids` (Set of String) Resource IDs for group members, these are most likely boundary users.
-- `scope` (List of Object) (see [below for nested schema](#nestedatt--scope))
-
-<a id="nestedatt--scope"></a>
-### Nested Schema for `scope`
-
-Read-Only:
-
-- `description` (String)
-- `id` (String)
-- `name` (String)
-- `parent_scope_id` (String)
-- `type` (String)

docs/data-sources/role.md

@@ -1,62 +0,0 @@
----
-# generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "boundary_role Data Source - terraform-provider-boundary"
-subcategory: ""
-description: |-
-  The boundary_role data source allows you to find a Boundary role.
----
-
-# boundary_role (Data Source)
-
-The boundary_role data source allows you to find a Boundary role.
-
-## Example Usage
-
-```terraform
-# Role from the global scope
-data "boundary_role" "global_role" {
-  name = "global_role_one"
-}
-
-# Role from an org scope
-data "boundary_scope" "org" {
-  name     = "org_one"
-  scope_id = "global"
-}
-
-data "boundary_role" "org_role" {
-  name     = "org_role_one"
-  scope_id = data.boundary_scope.org.id
-}
-```
-
-<!-- schema generated by tfplugindocs -->
-## Schema
-
-### Required
-
-- `name` (String) The name of the role to retrieve.
-
-### Optional
-
-- `scope_id` (String) The scope ID in which the resource is created. Defaults `global` if unset.
-
-### Read-Only
-
-- `description` (String) The description of the retrieved role.
-- `grant_scope_ids` (Set of String) The list of scope IDs for the role's grants.
-- `grant_strings` (Set of String) The list of stringified grants for the role.
-- `id` (String) The ID of the retrieved role.
-- `principal_ids` (Set of String) The list of principal (user or group) IDs added as principals on the role.
-- `scope` (List of Object) (see [below for nested schema](#nestedatt--scope))
-
-<a id="nestedatt--scope"></a>
-### Nested Schema for `scope`
-
-Read-Only:
-
-- `description` (String)
-- `id` (String)
-- `name` (String)
-- `parent_scope_id` (String)
-- `type` (String)

docs/data-sources/scope.md

@@ -1,4 +1,5 @@
 ---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
 page_title: "boundary_scope Data Source - terraform-provider-boundary"
 subcategory: ""
 description: |-
@@ -12,19 +13,21 @@ Please note that the Global scope will always have an id of "global", and does n
 
 ## Example Usage
 
+Basic usage:
+
 ```terraform
-# Retrieve the ID of a Boundary project
 data "boundary_scope" "org" {
   name     = "SecOps"
-  scope_id = "global"
+  parent_scope_id = "global"
 }
 
 data "boundary_scope" "project" {
   name     = "2111"
-  scope_id = data.boundary_scope.id
+  parent_scope_id = data.boundary_scope.id
 }
 ```
 
+
 <!-- schema generated by tfplugindocs -->
 ## Schema
 

docs/data-sources/user.md

@@ -1,63 +0,0 @@
----
-# generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "boundary_user Data Source - terraform-provider-boundary"
-subcategory: ""
-description: |-
-  The user data source allows you to find a Boundary user.
----
-
-# boundary_user (Data Source)
-
-The user data source allows you to find a Boundary user.
-
-## Example Usage
-
-```terraform
-# Retrieve a user from the global scope
-data "boundary_user" "global_scope_admin" {
-  name = "admin"
-}
-
-# User from a org scope
-data "boundary_user" "org_user" {
-  name     = "username"
-  scope_id = data.boundary_scope.org.id
-}
-
-data "boundary_scope" "org" {
-  name     = "my-org"
-  scope_id = data.boundary_scope.org.id
-}
-```
-
-<!-- schema generated by tfplugindocs -->
-## Schema
-
-### Required
-
-- `name` (String) The username to search for.
-
-### Optional
-
-- `scope_id` (String) The scope ID in which the resource is created. Defaults `global` if unset.
-
-### Read-Only
-
-- `account_ids` (Set of String) Account ID's to associate with this user resource.
-- `authorized_actions` (List of String) A list of actions that the worker is entitled to perform.
-- `description` (String) The user description.
-- `id` (String) The ID of the user.
-- `login_name` (String) Login name for user.
-- `primary_account_id` (String) Primary account ID.
-- `scope` (List of Object) (see [below for nested schema](#nestedatt--scope))
-
-<a id="nestedatt--scope"></a>
-### Nested Schema for `scope`
-
-Read-Only:
-
-- `description` (String)
-- `id` (String)
-- `name` (String)
-- `parent_scope_id` (String)
-- `type` (String)

docs/index.md

@@ -15,23 +15,23 @@ Do not keep your authentication password in HCL for production environments, use
 
 ```terraform
 provider "boundary" {
-  addr                   = "http://127.0.0.1:9200"
-  auth_method_id         = "ampw_1234567890" # changeme
-  auth_method_login_name = "myuser"          # changeme
-  auth_method_password   = "passpass"        # changeme
+  addr                            = "http://127.0.0.1:9200"
+  auth_method_id                  = "ampw_1234567890" # changeme
+  password_auth_method_login_name = "myuser"          # changeme
+  password_auth_method_password   = "passpass"        # changeme
 }
 
 provider "boundary" {
-  addr                   = "http://127.0.0.1:9200"
-  auth_method_login_name = "myuser"
-  auth_method_password   = "passpass"
+  addr                            = "http://127.0.0.1:9200"
+  password_auth_method_login_name = "myuser"
+  password_auth_method_password   = "passpass"
 }
 
 provider "boundary" {
-  addr                   = "http://127.0.0.1:9200"
-  auth_method_login_name = "myuser"
-  auth_method_password   = "passpass"
-  scope_id               = "s_1234567890"
+  addr                            = "http://127.0.0.1:9200"
+  password_auth_method_login_name = "myuser"
+  password_auth_method_password   = "passpass"
+  scope_id                        = "s_1234567890"
 }
 ```
 

docs/resources/account_ldap.md

@@ -10,44 +10,7 @@ description: |-
 
 The account resource allows you to configure a Boundary account.
 
-## Example Usage
 
-```terraform
-resource "boundary_scope" "org" {
-  name                     = "organization_one"
-  description              = "My first scope!"
-  scope_id                 = "global"
-  auto_create_admin_role   = true
-  auto_create_default_role = true
-}
-
-resource "boundary_auth_method_ldap" "forumsys_ldap" {
-  name          = "forumsys public LDAP"
-  scope_id      = "global"                               # add the new auth method to the global scope
-  urls          = ["ldap://ldap.forumsys.com"]           # the addr of the LDAP server
-  user_dn       = "dc=example,dc=com"                    # the basedn for users
-  user_attr     = "uid"                                  # the user attribute
-  group_dn      = "dc=example,dc=com"                    # the basedn for groups
-  bind_dn       = "cn=read-only-admin,dc=example,dc=com" # the dn to use when binding
-  bind_password = "password"                             # passwd to use when binding
-  state         = "active-public"                        # make sure the new auth-method is available to everyone
-  enable_groups = true                                   # this turns-on the discovery of a user's groups
-  discover_dn   = true                                   # this turns-on the discovery of an authenticating user's dn
-}
-
-resource "boundary_account_ldap" "einstein" {
-  auth_method_id = boundary_auth_method_ldap.forumsys_ldap.id
-  login_name     = "einstein"
-  name           = "einstein"
-}
-
-resource "boundary_user" "einstein" {
-  name        = "einstein"
-  description = "User resource for einstein"
-  scope_id    = "global"
-  account_ids = [boundary_account_ldap.einstein.id]
-}
-```
 
 <!-- schema generated by tfplugindocs -->
 ## Schema
@@ -66,13 +29,3 @@ resource "boundary_user" "einstein" {
 ### Read-Only
 
 - `id` (String) The ID of the account.
-
-## Import
-
-Import is supported using the following syntax:
-
-The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
-
-```shell
-terraform import boundary_account_ldap.foo <my-id>
-```

docs/resources/account_password.md

@@ -56,8 +56,6 @@ resource "boundary_account_password" "jeff" {
 
 Import is supported using the following syntax:
 
-The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
-
 ```shell
 terraform import boundary_account_password.foo <my-id>
 ```

docs/resources/alias_target.md

@@ -1,132 +0,0 @@
----
-# generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "boundary_alias_target Resource - terraform-provider-boundary"
-subcategory: ""
-description: |-
-  The target alias resource allows you to configure a Boundary target alias at project and global scopes.
----
-
-# boundary_alias_target (Resource)
-
-The target alias resource allows you to configure a Boundary target alias at project and global scopes.
-
-## Example Usage
-
-```terraform
-resource "boundary_scope" "org" {
-  name                     = "organization_one"
-  description              = "global scope"
-  scope_id                 = "global"
-  auto_create_admin_role   = true
-  auto_create_default_role = true
-}
-
-resource "boundary_scope" "project" {
-  name                   = "project_one"
-  description            = "My first scope!"
-  scope_id               = boundary_scope.org.id
-  auto_create_admin_role = true
-}
-
-resource "boundary_scope_alias_suffix" "org" {
-  scope_id     = boundary_scope.org.id
-  alias_suffix = "org"
-}
-
-resource "boundary_scope_alias_suffix" "project" {
-  scope_id     = boundary_scope.project.id
-  alias_suffix = "projectone"
-}
-
-resource "boundary_host_catalog_static" "foo" {
-  name        = "test"
-  description = "test catalog"
-  scope_id    = boundary_scope.project.id
-}
-
-resource "boundary_host_static" "foo" {
-  name            = "foo"
-  host_catalog_id = boundary_host_catalog_static.foo.id
-  address         = "10.0.0.1"
-}
-
-resource "boundary_host_static" "bar" {
-  name            = "bar"
-  host_catalog_id = boundary_host_catalog_static.foo.id
-  address         = "127.0.0.1"
-}
-
-resource "boundary_host_set_static" "foo" {
-  name            = "foo"
-  host_catalog_id = boundary_host_catalog_static.foo.id
-
-  host_ids = [
-    boundary_host_static.foo.id,
-    boundary_host_static.bar.id,
-  ]
-}
-
-resource "boundary_target" "foo" {
-  name         = "foo"
-  description  = "Foo target"
-  type         = "tcp"
-  default_port = "22"
-  scope_id     = boundary_scope.project.id
-  host_source_ids = [
-    boundary_host_set_static.foo.id,
-  ]
-}
-
-resource "boundary_alias_target" "example_alias_target" {
-  name                      = "example_alias_target"
-  description               = "Example alias to target foo using host boundary_host_static.bar"
-  scope_id                  = "global"
-  value                     = "example.bar.foo.boundary"
-  destination_id            = boundary_target.foo.id
-  authorize_session_host_id = boundary_host_static.bar.id
-}
-
-resource "boundary_alias_target" "example_alias_target_project" {
-  name                      = "example_alias_target_project"
-  description               = "Example project-scoped alias to target foo"
-  scope_id                  = boundary_scope.project.id
-  value                     = "prodops.projectone.org"
-  destination_id            = boundary_target.foo.id
-  authorize_session_host_id = boundary_host_static.bar.id
-  depends_on = [
-    boundary_scope_alias_suffix.org,
-    boundary_scope_alias_suffix.project,
-  ]
-}
-```
-
-<!-- schema generated by tfplugindocs -->
-## Schema
-
-### Required
-
-- `scope_id` (String) The scope ID. Org scopes are not supported for aliases.
-- `value` (String) The value of the alias.
-
-### Optional
-
-- `authorize_session_host_id` (String) The host id to pass to Boundary when performing an authorize session action.
-- `description` (String) The alias description.
-- `destination_id` (String) The destination of the alias.
-- `name` (String) The alias name. Defaults to the resource name.
-- `type` (String) The type of alias; hardcoded.
-
-### Read-Only
-
-- `id` (String) The ID of the account.
-
-## Import
-
-Import is supported using the following syntax:
-
-The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
-
-```shell
-terraform import boundary_alias_target.example_alias_target <my-id>
-terraform import boundary_alias_target.example_alias_target_project <my-id>
-```

docs/resources/auth_method.md

@@ -25,12 +25,6 @@ resource "boundary_auth_method" "password" {
   scope_id = boundary_scope.org.id
   type     = "password"
 }
-
-resource "boundary_auth_method" "password_is_primary" {
-  scope_id = boundary_scope.org.id
-  type     = "password"
-  is_primary_for_scope = true
-}
 ```
 
 <!-- schema generated by tfplugindocs -->
@@ -44,7 +38,6 @@ resource "boundary_auth_method" "password_is_primary" {
 ### Optional
 
 - `description` (String) The auth method description.
-- `is_primary_for_scope` (Boolean) When true, makes this auth method the primary auth method for the scope in which it resides.
 - `min_login_name_length` (Number, Deprecated) The minimum login name length.
 - `min_password_length` (Number, Deprecated) The minimum password length.
 - `name` (String) The auth method name. Defaults to the resource name.
@@ -57,8 +50,6 @@ resource "boundary_auth_method" "password_is_primary" {
 
 Import is supported using the following syntax:
 
-The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
-
 ```shell
 terraform import boundary_auth_method.foo <my-id>
 ```

docs/resources/auth_method_ldap.md

@@ -3,38 +3,14 @@
 page_title: "boundary_auth_method_ldap Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The LDAP auth method resource allows you to configure a Boundary auth_method_ldap.
+  The LDAP auth method resource allows you to configure a Boundary authmethodldap.
 ---
 
 # boundary_auth_method_ldap (Resource)
 
 The LDAP auth method resource allows you to configure a Boundary auth_method_ldap.
 
-## Example Usage
 
-```terraform
-resource "boundary_scope" "org" {
-  name                     = "organization_one"
-  description              = "My first scope!"
-  scope_id                 = "global"
-  auto_create_admin_role   = true
-  auto_create_default_role = true
-}
-
-resource "boundary_auth_method_ldap" "forumsys_ldap" {
-  name          = "forumsys public LDAP"
-  scope_id      = "global"                               # add the new auth method to the global scope
-  urls          = ["ldap://ldap.forumsys.com"]           # the addr of the LDAP server
-  user_dn       = "dc=example,dc=com"                    # the basedn for users
-  user_attr     = "uid"                                  # the user attribute
-  group_dn      = "dc=example,dc=com"                    # the basedn for groups
-  bind_dn       = "cn=read-only-admin,dc=example,dc=com" # the dn to use when binding
-  bind_password = "password"                             # passwd to use when binding
-  state         = "active-public"                        # make sure the new auth-method is available to everyone
-  enable_groups = true                                   # this turns-on the discovery of a user's groups
-  discover_dn   = true                                   # this turns-on the discovery of an authenticating user's dn
-}
-```
 
 <!-- schema generated by tfplugindocs -->
 ## Schema
@@ -78,13 +54,3 @@ resource "boundary_auth_method_ldap" "forumsys_ldap" {
 ### Read-Only
 
 - `id` (String) The ID of the auth method.
-
-## Import
-
-Import is supported using the following syntax:
-
-The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
-
-```shell
-terraform import boundary_auth_method_ldap.foo <my-id>
-```

docs/resources/auth_method_oidc.md

@@ -3,59 +3,14 @@
 page_title: "boundary_auth_method_oidc Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The OIDC auth method resource allows you to configure a Boundary auth_method_oidc.
+  The OIDC auth method resource allows you to configure a Boundary authmethodoidc.
 ---
 
 # boundary_auth_method_oidc (Resource)
 
 The OIDC auth method resource allows you to configure a Boundary auth_method_oidc.
 
-## Example Usage
 
-```terraform
-resource "boundary_scope" "org" {
-  name                     = "organization_one"
-  description              = "My first scope!"
-  scope_id                 = "global"
-  auto_create_admin_role   = true
-  auto_create_default_role = true
-}
-
-resource "boundary_auth_method_oidc" "vault" {
-  api_url_prefix     = "https://XO-XO-XO-XO-XOXOXO.boundary.hashicorp.cloud:9200"
-  client_id          = "eieio"
-  client_secret      = "hvo_secret_XO"
-  description        = "My Boundary OIDC Auth Method for Vault"
-  issuer             = "https://XO-XO-XO-XO-XOXOXO.vault.hashicorp.cloud:8200/v1/identity/oidc/provider/my-provider"
-  scope_id           = "global"
-  signing_algorithms = ["RS256"]
-  type               = "oidc"
-}
-
-resource "boundary_auth_method_oidc" "oidc_with_one_prompt" {
-  api_url_prefix     = "https://XO-XO-XO-XO-XOXOXO.boundary.hashicorp.cloud:9200"
-  client_id          = "eieio"
-  client_secret      = "hvo_secret_XO"
-  description        = "My Boundary OIDC Auth Method With Prompt"
-  issuer             = "https://sts.windows.net/TENANT_ID/"
-  scope_id           = "global"
-  signing_algorithms = ["RS256"]
-  prompts            = ["select_account"]
-  type               = "oidc"
-}
-
-resource "boundary_auth_method_oidc" "oidc_with_multiple_prompts" {
-  api_url_prefix     = "https://XO-XO-XO-XO-XOXOXO.boundary.hashicorp.cloud:9200"
-  client_id          = "eieio"
-  client_secret      = "hvo_secret_XO"
-  description        = "My Boundary OIDC Auth Method With Multiple Prompts"
-  issuer             = "https://sts.windows.net/TENANT_ID/"
-  scope_id           = "global"
-  signing_algorithms = ["RS256"]
-  prompts            = ["consent", "select_account"]
-  type               = "oidc"
-}
-```
 
 <!-- schema generated by tfplugindocs -->
 ## Schema
@@ -81,7 +36,6 @@ resource "boundary_auth_method_oidc" "oidc_with_multiple_prompts" {
 - `issuer` (String) The issuer corresponding to the provider, which must match the issuer field in generated tokens.
 - `max_age` (Number) The max age to provide to the provider, indicating how much time is allowed to have passed since the last authentication before the user is challenged again. A value of 0 sets an immediate requirement for all users to reauthenticate, and an unset maxAge results in a Terraform value of -1 and the default TTL of the chosen OIDC will be used.
 - `name` (String) The auth method name. Defaults to the resource name.
-- `prompts` (List of String) The prompts passed to the identity provider to determine whether to prompt the end-user for reauthentication, account selection or consent. Please note the values passed are case-sensitive. The valid values are: `none`, `login`, `consent` and `select_account`.
 - `signing_algorithms` (List of String) Allowed signing algorithms for the provider's issued tokens.
 - `state` (String) Can be one of 'inactive', 'active-private', or 'active-public'. Currently automatically set to active-public.
 - `type` (String) The type of auth method; hardcoded.
@@ -89,13 +43,3 @@ resource "boundary_auth_method_oidc" "oidc_with_multiple_prompts" {
 ### Read-Only
 
 - `id` (String) The ID of the auth method.
-
-## Import
-
-Import is supported using the following syntax:
-
-The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
-
-```shell
-terraform import boundary_auth_method_oidc.foo <my-id>
-```

docs/resources/auth_method_password.md

@@ -3,33 +3,14 @@
 page_title: "boundary_auth_method_password Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The auth method resource allows you to configure a Boundary auth_method_password.
+  The auth method resource allows you to configure a Boundary authmethodpassword.
 ---
 
 # boundary_auth_method_password (Resource)
 
 The auth method resource allows you to configure a Boundary auth_method_password.
 
-## Example Usage
 
-```terraform
-resource "boundary_scope" "org" {
-  name                     = "organization_one"
-  description              = "My first scope!"
-  scope_id                 = "global"
-  auto_create_admin_role   = true
-  auto_create_default_role = true
-}
-
-resource "boundary_auth_method_password" "password" {
-  scope_id = boundary_scope.org.id
-}
-
-resource "boundary_auth_method_password" "password_is_primary" {
-  scope_id = boundary_scope.org.id
-  is_primary_for_scope = true
-}
-```
 
 <!-- schema generated by tfplugindocs -->
 ## Schema
@@ -41,7 +22,6 @@ resource "boundary_auth_method_password" "password_is_primary" {
 ### Optional
 
 - `description` (String) The auth method description.
-- `is_primary_for_scope` (Boolean) When true, makes this auth method the primary auth method for the scope in which it resides.
 - `min_login_name_length` (Number) The minimum login name length.
 - `min_password_length` (Number) The minimum password length.
 - `name` (String) The auth method name. Defaults to the resource name.
@@ -50,13 +30,3 @@ resource "boundary_auth_method_password" "password_is_primary" {
 ### Read-Only
 
 - `id` (String) The ID of the account.
-
-## Import
-
-Import is supported using the following syntax:
-
-The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
-
-```shell
-terraform import boundary_auth_method_password.foo <my-id>
-```

docs/resources/credential_json.md

@@ -64,8 +64,6 @@ resource "boundary_credential_json" "example" {
 
 Import is supported using the following syntax:
 
-The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
-
 ```shell
 terraform import boundary_credential_json.example_json <my-id>
 ```

docs/resources/credential_library_vault.md

@@ -110,8 +110,6 @@ resource "boundary_credential_library_vault" "quz" {
 
 Import is supported using the following syntax:
 
-The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
-
 ```shell
 terraform import boundary_credential_library_vault.foo <my-id>
 ```

docs/resources/credential_library_vault_ldap.md

@@ -1,79 +0,0 @@
----
-# generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "boundary_credential_library_vault_ldap Resource - terraform-provider-boundary"
-subcategory: ""
-description: |-
-  The credential library for Vault LDAP resource allows you to configure a Boundary credential library for Vault LDAP.
----
-
-# boundary_credential_library_vault_ldap (Resource)
-
-The credential library for Vault LDAP resource allows you to configure a Boundary credential library for Vault LDAP.
-
-## Example Usage
-
-```terraform
-resource "boundary_scope" "org" {
-  name                     = "organization_one"
-  description              = "My first scope!"
-  scope_id                 = "global"
-  auto_create_admin_role   = true
-  auto_create_default_role = true
-}
-
-resource "boundary_scope" "project" {
-  name                   = "project_one"
-  description            = "My first scope!"
-  scope_id               = boundary_scope.org.id
-  auto_create_admin_role = true
-}
-
-resource "boundary_credential_store_vault" "foo" {
-  name        = "foo"
-  description = "My first Vault credential store!"
-  address     = "http://127.0.0.1:8200"      # change to Vault address
-  token       = "s.0ufRo6XEGU2jOqnIr7OlFYP5" # change to valid Vault token
-  scope_id    = boundary_scope.project.id
-}
-
-resource "boundary_credential_library_vault_ldap" "foo-static" {
-  name                = "foo"
-  description         = "My first static Vault LDAP credential library!"
-  credential_store_id = boundary_credential_store_vault.foo.id
-  path                = "ldap/static-cred/foo" # change to Vault backend path
-}
-
-resource "boundary_credential_library_vault_ldap" "bar-dynamic" {
-  name                = "bar"
-  description         = "My first dynamic Vault LDAP credential library!"
-  credential_store_id = boundary_credential_store_vault.foo.id
-  path                = "ldap/creds/bar" # change to Vault backend path
-}
-```
-
-<!-- schema generated by tfplugindocs -->
-## Schema
-
-### Required
-
-- `credential_store_id` (String) The ID of the credential store that this library belongs to.
-- `path` (String) The path in Vault to request credentials from.
-
-### Optional
-
-- `description` (String) The Vault LDAP credential library description.
-- `name` (String) The Vault LDAP credential library name. Defaults to the resource name.
-
-### Read-Only
-
-- `id` (String) The ID of the Vault LDAP credential library.
-
-## Import
-
-Import is supported using the following syntax:
-
-The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
-
-```shell
-terraform import boundary_credential_library_vault_ldap.foo <my-id>
-```

docs/resources/credential_library_vault_ssh_certificate.md

@@ -89,7 +89,6 @@ resource "boundary_credential_library_vault_ssh_certificate" "baz" {
 
 ### Optional
 
-- `additional_valid_principals` (List of String) Principals to be signed as "valid_principles" in addition to username.
 - `critical_options` (Map of String) Specifies a map of the critical options that the certificate should be signed for.
 - `description` (String) The Vault credential library description.
 - `extensions` (Map of String) Specifies a map of the extensions that the certificate should be signed for.
@@ -107,8 +106,6 @@ resource "boundary_credential_library_vault_ssh_certificate" "baz" {
 
 Import is supported using the following syntax:
 
-The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
-
 ```shell
 terraform import boundary_credential_library_vault_ssh_certificate.foo <my-id>
 ```

docs/resources/credential_password.md

@@ -1,71 +0,0 @@
----
-# generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "boundary_credential_password Resource - terraform-provider-boundary"
-subcategory: ""
-description: |-
-  The password credential resource allows you to configure a credential using a password.
----
-
-# boundary_credential_password (Resource)
-
-The password credential resource allows you to configure a credential using a password.
-
-## Example Usage
-
-```terraform
-resource "boundary_scope" "org" {
-  name                     = "organization_one"
-  description              = "global scope"
-  scope_id                 = "global"
-  auto_create_admin_role   = true
-  auto_create_default_role = true
-}
-
-resource "boundary_scope" "project" {
-  name                   = "project_one"
-  description            = "My first scope!"
-  scope_id               = boundary_scope.org.id
-  auto_create_admin_role = true
-}
-
-resource "boundary_credential_store_static" "example" {
-  name        = "example_static_credential_store"
-  description = "My first static credential store!"
-  scope_id    = boundary_scope.project.id
-}
-
-resource "boundary_credential_password" "example" {
-  name                = "example_password"
-  description         = "My first password credential!"
-  credential_store_id = boundary_credential_store_static.example.id
-  password            = "my-password"
-}
-```
-
-<!-- schema generated by tfplugindocs -->
-## Schema
-
-### Required
-
-- `credential_store_id` (String) The credential store in which to save this password credential.
-- `password` (String, Sensitive) The password of this password credential.
-
-### Optional
-
-- `description` (String) The description of this password credential.
-- `name` (String) The name of this password credential. Defaults to the resource name.
-
-### Read-Only
-
-- `id` (String) The ID of this password credential.
-- `password_hmac` (String) The password hmac.
-
-## Import
-
-Import is supported using the following syntax:
-
-The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
-
-```shell
-terraform import boundary_credential_password.example <my-id>
-```

docs/resources/credential_ssh_private_key.md

@@ -69,8 +69,6 @@ resource "boundary_credential_ssh_private_key" "example" {
 
 Import is supported using the following syntax:
 
-The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
-
 ```shell
 terraform import boundary_credential_ssh_private_key.example_ssh_private_key <my-id>
 ```

docs/resources/credential_store_static.md

@@ -55,8 +55,6 @@ resource "boundary_credential_store_static" "example" {
 
 Import is supported using the following syntax:
 
-The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
-
 ```shell
 terraform import boundary_credential_store_static.example_static_credential_store <my-id>
 ```

docs/resources/credential_store_vault.md

@@ -68,8 +68,6 @@ resource "boundary_credential_store_vault" "example" {
 
 Import is supported using the following syntax:
 
-The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
-
 ```shell
 terraform import boundary_credential_store_vault.foo <my-id>
 ```

docs/resources/credential_username_password.md

@@ -66,8 +66,6 @@ resource "boundary_credential_username_password" "example" {
 
 Import is supported using the following syntax:
 
-The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
-
 ```shell
 terraform import boundary_credential_username_password.example_username_password <my-id>
 ```

docs/resources/credential_username_password_domain.md

@@ -1,75 +0,0 @@
----
-# generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "boundary_credential_username_password_domain Resource - terraform-provider-boundary"
-subcategory: ""
-description: |-
-  The username-password-domain credential resource allows you to configure a credential using a username, password and domain.
----
-
-# boundary_credential_username_password_domain (Resource)
-
-The username-password-domain credential resource allows you to configure a credential using a username, password and domain.
-
-## Example Usage
-
-```terraform
-resource "boundary_scope" "org" {
-  name                     = "organization_one"
-  description              = "global scope"
-  scope_id                 = "global"
-  auto_create_admin_role   = true
-  auto_create_default_role = true
-}
-
-resource "boundary_scope" "project" {
-  name                   = "project_one"
-  description            = "My first scope!"
-  scope_id               = boundary_scope.org.id
-  auto_create_admin_role = true
-}
-
-resource "boundary_credential_store_static" "example" {
-  name        = "example_static_credential_store"
-  description = "My first static credential store!"
-  scope_id    = boundary_scope.project.id
-}
-
-resource "boundary_credential_username_password_domain" "example" {
-  name                = "example_username_password_domain"
-  description         = "My first username password domain credential!"
-  credential_store_id = boundary_credential_store_static.example.id
-  username            = "my-username"
-  password            = "my-password"
-  domain              = "my-domain"
-}
-```
-
-<!-- schema generated by tfplugindocs -->
-## Schema
-
-### Required
-
-- `credential_store_id` (String) The credential store in which to save this username-password-domain credential.
-- `password` (String, Sensitive) The password of this username-password-domain credential.
-
-### Optional
-
-- `description` (String) The description of this username-password-domain credential.
-- `domain` (String) The domain of this username-password-domain credential. This field is required unless provided as part of the username field instead (see username field description).
-- `name` (String) The name of this username-password-domain credential. Defaults to the resource name.
-- `username` (String) This field is required even though it is marked as optional. The username of this username-password-domain credential. Can also contain a domain if provided as username@domain or domain\username
-
-### Read-Only
-
-- `id` (String) The ID of this username-password-domain credential.
-- `password_hmac` (String) The password hmac.
-
-## Import
-
-Import is supported using the following syntax:
-
-The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
-
-```shell
-terraform import boundary_credential_username_password_domain.example_username_password_domain <my-id>
-```

docs/resources/host.md

@@ -66,8 +66,6 @@ resource "boundary_host" "example" {
 
 Import is supported using the following syntax:
 
-The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
-
 ```shell
 terraform import boundary_host.foo <my-id>
 ```

docs/resources/host_catalog.md

@@ -57,8 +57,6 @@ resource "boundary_host_catalog" "example" {
 
 Import is supported using the following syntax:
 
-The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
-
 ```shell
 terraform import boundary_host_catalog.foo <my-id>
 ```

docs/resources/host_catalog_plugin.md

@@ -94,7 +94,6 @@ resource "boundary_host_catalog_plugin" "azure_example" {
 - `plugin_name` (String) The name of the plugin that should back the resource. This or plugin_id must be defined.
 - `secrets_hmac` (String) The HMAC'd secrets value returned from the server.
 - `secrets_json` (String, Sensitive) The secrets for the host catalog. Either values encoded with the "jsonencode" function, pre-escaped JSON string, or a file:// or env:// path. Set to a string "null" to clear any existing values. NOTE: Unlike "attributes_json", removing this block will NOT clear secrets from the host catalog; this allows injecting secrets for one call, then removing them for storage.
-- `worker_filter` (String) HCP Only. A filter used to control which PKI workers can handle dynamic host catalog requests.
 
 ### Read-Only
 
@@ -104,8 +103,6 @@ resource "boundary_host_catalog_plugin" "azure_example" {
 
 Import is supported using the following syntax:
 
-The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
-
 ```shell
 terraform import boundary_host_catalog_plugin.foo <my-id>
 ```

docs/resources/host_catalog_static.md

@@ -55,8 +55,6 @@ resource "boundary_host_catalog_static" "example" {
 
 Import is supported using the following syntax:
 
-The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
-
 ```shell
 terraform import boundary_host_catalog_static.foo <my-id>
 ```

docs/resources/host_set.md

@@ -39,6 +39,7 @@ resource "boundary_host" "first" {
   description     = "My first host!"
   address         = "10.0.0.1"
   host_catalog_id = boundary_host_catalog.static.id
+  scope_id        = boundary_scope.project.id
 }
 
 resource "boundary_host" "second" {
@@ -47,6 +48,7 @@ resource "boundary_host" "second" {
   description     = "My second host!"
   address         = "10.0.0.2"
   host_catalog_id = boundary_host_catalog.static.id
+  scope_id        = boundary_scope.project.id
 }
 
 resource "boundary_host_set" "web" {
@@ -81,8 +83,6 @@ resource "boundary_host_set" "web" {
 
 Import is supported using the following syntax:
 
-The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
-
 ```shell
 terraform import boundary_host_set.foo <my-id>
 ```

docs/resources/host_set_plugin.md

@@ -3,7 +3,7 @@
 page_title: "boundary_host_set_plugin Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The host_set_plugin resource allows you to configure a Boundary host set. Host sets are always part of a host catalog, so a host catalog resource should be used inline or you should have the host catalog ID in hand to successfully configure a host set.
+  The hostsetplugin resource allows you to configure a Boundary host set. Host sets are always part of a host catalog, so a host catalog resource should be used inline or you should have the host catalog ID in hand to successfully configure a host set.
 ---
 
 # boundary_host_set_plugin (Resource)
@@ -140,8 +140,6 @@ resource "boundary_host_set_plugin" "foodev" {
 
 Import is supported using the following syntax:
 
-The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
-
 ```shell
 terraform import boundary_host_set_plugin.foo <my-id>
 ```

docs/resources/host_set_static.md

@@ -3,7 +3,7 @@
 page_title: "boundary_host_set_static Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The host_set_static resource allows you to configure a Boundary host set. Host sets are always part of a host catalog, so a host catalog resource should be used inline or you should have the host catalog ID in hand to successfully configure a host set.
+  The hostsetstatic resource allows you to configure a Boundary host set. Host sets are always part of a host catalog, so a host catalog resource should be used inline or you should have the host catalog ID in hand to successfully configure a host set.
 ---
 
 # boundary_host_set_static (Resource)
@@ -77,8 +77,6 @@ resource "boundary_host_set_static" "web" {
 
 Import is supported using the following syntax:
 
-The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
-
 ```shell
 terraform import boundary_host_set_static.foo <my-id>
 ```

docs/resources/host_static.md

@@ -64,8 +64,6 @@ resource "boundary_host_static" "example" {
 
 Import is supported using the following syntax:
 
-The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
-
 ```shell
 terraform import boundary_host_static.foo <my-id>
 ```

docs/resources/managed_group_ldap.md

@@ -10,38 +10,7 @@ description: |-
 
 The managed group resource allows you to configure a Boundary group.
 
-## Example Usage
 
-```terraform
-resource "boundary_scope" "org" {
-  name                     = "organization_one"
-  description              = "My first scope!"
-  scope_id                 = "global"
-  auto_create_admin_role   = true
-  auto_create_default_role = true
-}
-
-resource "boundary_auth_method_ldap" "forumsys_ldap" {
-  name          = "forumsys public LDAP"
-  scope_id      = "global"                               # add the new auth method to the global scope
-  urls          = ["ldap://ldap.forumsys.com"]           # the addr of the LDAP server
-  user_dn       = "dc=example,dc=com"                    # the basedn for users
-  user_attr     = "uid"                                  # the user attribute
-  group_dn      = "dc=example,dc=com"                    # the basedn for groups
-  bind_dn       = "cn=read-only-admin,dc=example,dc=com" # the dn to use when binding
-  bind_password = "password"                             # passwd to use when binding
-  state         = "active-public"                        # make sure the new auth-method is available to everyone
-  enable_groups = true                                   # this turns-on the discovery of a user's groups
-  discover_dn   = true                                   # this turns-on the discovery of an authenticating user's dn
-}
-
-resource "boundary_managed_group_ldap" "forumsys_scientists" {
-  name           = "scientists"
-  description    = "forumsys scientists managed group"
-  auth_method_id = boundary_auth_method_ldap.forumsys_ldap.id
-  group_names    = ["Scientists"]
-}
-```
 
 <!-- schema generated by tfplugindocs -->
 ## Schema
@@ -59,13 +28,3 @@ resource "boundary_managed_group_ldap" "forumsys_scientists" {
 ### Read-Only
 
 - `id` (String) The ID of the group.
-
-## Import
-
-Import is supported using the following syntax:
-
-The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
-
-```shell
-terraform import boundary_managed_group_ldap.foo <my-id>
-```

docs/resources/policy_storage.md

@@ -1,33 +0,0 @@
----
-# generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "boundary_policy_storage Resource - terraform-provider-boundary"
-subcategory: ""
-description: |-
-  The storage policy resource allows you to configure a Boundary storage policy. Storage policies allow an admin to configure how long session recordings must be stored and when to delete them. Storage policies must be applied to the global scope or an org scope in order to take effect.
----
-
-# boundary_policy_storage (Resource)
-
-The storage policy resource allows you to configure a Boundary storage policy. Storage policies allow an admin to configure how long session recordings must be stored and when to delete them. Storage policies must be applied to the global scope or an org scope in order to take effect.
-
-
-
-<!-- schema generated by tfplugindocs -->
-## Schema
-
-### Required
-
-- `scope_id` (String) The scope for this policy.
-
-### Optional
-
-- `delete_after_days` (Number) The number of days after which a session recording will be automatically deleted. Defaults to 0: never automatically delete. However, delete_after_days and retain_for_days cannot both be 0.
-- `delete_after_overridable` (Boolean) Whether or not the associated delete_after_days value can be overridden by org scopes. Note: if the associated delete_after_days value is 0, overridable is ignored
-- `description` (String) The policy description.
-- `name` (String) The policy name. Defaults to the resource name.
-- `retain_for_days` (Number) The number of days a session recording is required to be stored. Defaults to 0: allow deletions at any time. However, retain_for_days and delete_after_days cannot both be 0.
-- `retain_for_overridable` (Boolean) Whether or not the associated retain_for_days value can be overridden by org scopes. Note: if the associated retain_for_days value is 0, overridable is ignored.
-
-### Read-Only
-
-- `id` (String) The ID of the policy.

docs/resources/role.md

@@ -79,7 +79,7 @@ resource "boundary_role" "readonly" {
   name          = "readonly"
   description   = "A readonly role"
   principal_ids = [boundary_user.readonly.id]
-  grant_strings = ["ids=*;type=*;actions=read"]
+  grant_strings = ["id=*;type=*;actions=read"]
   scope_id      = boundary_scope.org.id
 }
 ```
@@ -112,7 +112,7 @@ resource "boundary_role" "readonly" {
   name          = "readonly"
   description   = "A readonly role"
   principal_ids = [boundary_user.readonly.id]
-  grant_strings = ["ids=*;type=*;actions=read"]
+  grant_strings = ["id=*;type=*;actions=read"]
   scope_id      = boundary_scope.project.id
 }
 ```
@@ -127,7 +127,7 @@ resource "boundary_role" "readonly" {
 ### Optional
 
 - `description` (String) The role description.
-- `grant_scope_ids` (Set of String) A list of scopes for which the grants in this role should apply, which can include the special values "this", "children", or "descendants"
+- `grant_scope_id` (String)
 - `grant_strings` (Set of String) A list of stringified grants for the role.
 - `name` (String) The role name. Defaults to the resource name.
 - `principal_ids` (Set of String) A list of principal (user or group) IDs to add as principals on the role.

docs/resources/scope.md

@@ -53,10 +53,10 @@ resource "boundary_scope" "org" {
 }
 
 resource "boundary_role" "org_admin" {
-  scope_id        = boundary_scope.global.id
-  grant_scope_ids = [boundary_scope.org.id]
-  grant_strings   = ["ids=*;type=*;actions=*"]
-  principal_ids   = ["u_auth"]
+  scope_id       = boundary_scope.global.id
+  grant_scope_id = boundary_scope.org.id
+  grant_strings  = ["id=*;type=*;actions=*"]
+  principal_ids  = ["u_auth"]
 }
 ```
 

docs/resources/scope_alias_suffix.md

@@ -1,67 +0,0 @@
----
-# generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "boundary_scope_alias_suffix Resource - terraform-provider-boundary"
-subcategory: ""
-description: |-
-  The scope alias suffix resource allows you to set an alias suffix for an org or project scope. Global scopes are not valid for alias suffix operations.
----
-
-# boundary_scope_alias_suffix (Resource)
-
-The scope alias suffix resource allows you to set an alias suffix for an org or project scope. Global scopes are not valid for alias suffix operations.
-
-## Example Usage
-
-```terraform
-resource "boundary_scope" "global" {
-  global_scope = true
-  scope_id     = "global"
-}
-
-resource "boundary_scope" "org" {
-  name                     = "organization_one"
-  description              = "My first scope!"
-  scope_id                 = boundary_scope.global.id
-  auto_create_admin_role   = true
-  auto_create_default_role = true
-}
-
-resource "boundary_scope" "project" {
-  name                   = "project_one"
-  description            = "My first project"
-  scope_id               = boundary_scope.org.id
-  auto_create_admin_role = true
-}
-
-resource "boundary_scope_alias_suffix" "org_suffix" {
-  scope_id     = boundary_scope.org.id
-  alias_suffix = "org"
-}
-
-resource "boundary_scope_alias_suffix" "project_suffix" {
-  scope_id     = boundary_scope.project.id
-  alias_suffix = "projectone"
-}
-```
-
-<!-- schema generated by tfplugindocs -->
-## Schema
-
-### Required
-
-- `alias_suffix` (String) The alias suffix value for this scope.
-- `scope_id` (String) The scope ID. Alias suffixes are supported for org and project scopes.
-
-### Read-Only
-
-- `id` (String) The ID of this resource.
-
-## Import
-
-Import is supported using the following syntax:
-
-The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
-
-```shell
-terraform import boundary_scope_alias_suffix.org_suffix <scope-id>
-```

docs/resources/scope_policy_attachment.md

@@ -1,25 +0,0 @@
----
-# generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "boundary_scope_policy_attachment Resource - terraform-provider-boundary"
-subcategory: ""
-description: |-
-  
----
-
-# boundary_scope_policy_attachment (Resource)
-
-
-
-
-
-<!-- schema generated by tfplugindocs -->
-## Schema
-
-### Required
-
-- `policy_id` (String)
-- `scope_id` (String)
-
-### Read-Only
-
-- `id` (String) The ID of this resource.

docs/resources/storage_bucket.md

@@ -21,8 +21,8 @@ resource "boundary_scope" "org" {
   auto_create_default_role = true
 }
 
-resource "boundary_storage_bucket" "aws_static_credentials_example" {
-  name            = "My aws storage bucket with static credentials"
+resource "boundary_storage_bucket" "aws_example" {
+  name            = "My aws storage bucket"
   description     = "My first storage bucket!"
   scope_id        = boundary_scope.org.id
   plugin_name     = "aws"
@@ -37,23 +37,6 @@ resource "boundary_storage_bucket" "aws_static_credentials_example" {
   })
   worker_filter = "\"pki\" in \"/tags/type\""
 }
-
-resource "boundary_storage_bucket" "aws_dynamic_credentials_example" {
-  name        = "My aws storage bucket with dynamic credentials"
-  description = "My first storage bucket!"
-  scope_id    = boundary_scope.org.id
-  plugin_name = "aws"
-  bucket_name = "mybucket"
-
-  # the role_arn value should be the same arn used as the instance profile that is attached to the ec2 instance
-  # https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html
-  attributes_json = jsonencode({
-    "region"                      = "us-east-1"
-    "role_arn"                    = "arn:aws:iam::123456789012:role/S3Access"
-    "disable_credential_rotation" = "true"
-  })
-  worker_filter = "\"pki\" in \"/tags/type\""
-}
 ```
 
 <!-- schema generated by tfplugindocs -->
@@ -63,6 +46,7 @@ resource "boundary_storage_bucket" "aws_dynamic_credentials_example" {
 
 - `bucket_name` (String) The name of the bucket within the external object store service.
 - `scope_id` (String) The scope for this storage bucket.
+- `secrets_json` (String, Sensitive) The secrets for the storage bucket. Either values encoded with the "jsonencode" function, pre-escaped JSON string, or a file:// or env:// path. Set to a string "null" to clear any existing values. NOTE: Unlike "attributes_json", removing this block will NOT clear secrets from the storage bucket; this allows injecting secrets for one call, then removing them for storage.
 - `worker_filter` (String) Filters to the worker(s) that can handle requests for this storage bucket. The filter must match an existing worker in order to create a storage bucket.
 
 ### Optional
@@ -73,7 +57,6 @@ resource "boundary_storage_bucket" "aws_dynamic_credentials_example" {
 - `name` (String) The storage bucket name. Defaults to the resource name.
 - `plugin_id` (String) The ID of the plugin that should back the resource. This or plugin_name must be defined.
 - `plugin_name` (String) The name of the plugin that should back the resource. This or plugin_id must be defined.
-- `secrets_json` (String, Sensitive) The secrets for the storage bucket. Either values encoded with the "jsonencode" function, pre-escaped JSON string, or a file:// or env:// path. Set to a string "null" to clear any existing values. NOTE: Unlike "attributes_json", removing this block will NOT clear secrets from the storage bucket; this allows injecting secrets for one call, then removing them for storage.
 
 ### Read-Only
 
@@ -87,8 +70,6 @@ resource "boundary_storage_bucket" "aws_dynamic_credentials_example" {
 
 Import is supported using the following syntax:
 
-The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
-
 ```shell
 terraform import boundary_storage_bucket.foo <my-id>
 ```

docs/resources/target.md

@@ -50,30 +50,37 @@ resource "boundary_credential_library_vault" "foo" {
   credential_type     = "username_password"
 }
 
-resource "boundary_host_catalog_static" "foo" {
+resource "boundary_host_catalog" "foo" {
   name        = "test"
   description = "test catalog"
   scope_id    = boundary_scope.project.id
+  type        = "static"
 }
 
-resource "boundary_host_static" "foo" {
+resource "boundary_host" "foo" {
+  type            = "static"
   name            = "foo"
-  host_catalog_id = boundary_host_catalog_static.foo.id
+  host_catalog_id = boundary_host_catalog.foo.id
+  scope_id        = boundary_scope.project.id
   address         = "10.0.0.1"
 }
 
-resource "boundary_host_static" "bar" {
+resource "boundary_host" "bar" {
+  type            = "static"
   name            = "bar"
-  host_catalog_id = boundary_host_catalog_static.foo.id
+  host_catalog_id = boundary_host_catalog.foo.id
+  scope_id        = boundary_scope.project.id
   address         = "10.0.0.1"
 }
 
-resource "boundary_host_set_static" "foo" {
+resource "boundary_host_set" "foo" {
+  type            = "static"
   name            = "foo"
-  host_catalog_id = boundary_host_catalog_static.foo.id
+  host_catalog_id = boundary_host_catalog.foo.id
+
   host_ids = [
-    boundary_host_static.foo.id,
-    boundary_host_static.bar.id,
+    boundary_host.foo.id,
+    boundary_host.bar.id,
   ]
 }
 
@@ -88,7 +95,7 @@ resource "boundary_storage_bucket" "aws_example" {
     "access_key_id"     = "aws_access_key_id_value",
     "secret_access_key" = "aws_secret_access_key_value"
   })
-  egress_worker_filter = "\"egress\" in \"/tags/type\""
+  worker_filter = "\"pki\" in \"/tags/type\""
 }
 
 resource "boundary_target" "foo" {
@@ -98,7 +105,7 @@ resource "boundary_target" "foo" {
   default_port = "22"
   scope_id     = boundary_scope.project.id
   host_source_ids = [
-    boundary_host_set_static.foo.id
+    boundary_host_set.foo.id
   ]
   brokered_credential_source_ids = [
     boundary_credential_library_vault.foo.id
@@ -107,12 +114,12 @@ resource "boundary_target" "foo" {
 
 resource "boundary_target" "ssh_foo" {
   name         = "ssh_foo"
-  description  = "SSH target"
+  description  = "Ssh target"
   type         = "ssh"
   default_port = "22"
   scope_id     = boundary_scope.project.id
   host_source_ids = [
-    boundary_host_set_static.foo.id
+    boundary_host_set.foo.id
   ]
   injected_application_credential_source_ids = [
     boundary_credential_library_vault.foo.id
@@ -121,12 +128,12 @@ resource "boundary_target" "ssh_foo" {
 
 resource "boundary_target" "ssh_session_recording_foo" {
   name         = "ssh_foo"
-  description  = "SSH target"
+  description  = "Ssh target"
   type         = "ssh"
   default_port = "22"
   scope_id     = boundary_scope.project.id
   host_source_ids = [
-    boundary_host_set_static.foo.id
+    boundary_host_set.foo.id
   ]
   injected_application_credential_source_ids = [
     boundary_credential_library_vault.foo.id
@@ -135,21 +142,6 @@ resource "boundary_target" "ssh_session_recording_foo" {
   storage_bucket_id        = boundary_storage_bucket.aws_example
 }
 
-resource "boundary_target" "rdp_foo" {
-  name         = "rdp_foo"
-  description  = "RDP target"
-  type         = "rdp"
-  default_port = "3389"
-  scope_id     = boundary_scope.project.id
-  host_source_ids = [
-    boundary_host_set_static.foo.id
-  ]
-  injected_application_credential_source_ids = [
-    boundary_credential_library_vault.foo.id
-  ]
-  egress_worker_filter = "\"egress\" in \"/tags/type\""
-}
-
 resource "boundary_target" "address_foo" {
   name         = "address_foo"
   description  = "Foo target with an address"
@@ -176,14 +168,14 @@ resource "boundary_target" "address_foo" {
 - `default_port` (Number) The default port for this target.
 - `description` (String) The target description.
 - `egress_worker_filter` (String) Boolean expression to filter the workers used to access this target
-- `enable_session_recording` (Boolean) HCP/Ent Only. Enable sessions recording for this target. Only applicable for SSH and RDP targets.
+- `enable_session_recording` (Boolean) HCP/Ent Only. Enable sessions recording for this target. Only applicable for SSH targets.
 - `host_source_ids` (Set of String) A list of host source ID's. Cannot be used alongside address.
 - `ingress_worker_filter` (String) HCP Only. Boolean expression to filter the workers a user will connect to when initiating a session against this target
 - `injected_application_credential_source_ids` (Set of String) A list of injected application credential source ID's.
 - `name` (String) The target name. Defaults to the resource name.
 - `session_connection_limit` (Number)
 - `session_max_seconds` (Number)
-- `storage_bucket_id` (String) HCP/Ent Only. Storage bucket for this target. Only applicable for SSH and RDP targets.
+- `storage_bucket_id` (String) HCP/Ent Only. Storage bucket for this target. Only applicable for SSH targets.
 - `worker_filter` (String, Deprecated) Boolean expression to filter the workers for this target
 
 ### Read-Only
@@ -194,8 +186,6 @@ resource "boundary_target" "address_foo" {
 
 Import is supported using the following syntax:
 
-The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
-
 ```shell
 terraform import boundary_target.foo <my-id>
 ```

docs/resources/user.md

@@ -62,8 +62,6 @@ resource "boundary_user" "jeff" {
 
 Import is supported using the following syntax:
 
-The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
-
 ```shell
 terraform import boundary_user.foo <my-id>
 ```

docs/resources/worker.md

@@ -1,4 +1,5 @@
 ---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
 page_title: "boundary_worker Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
@@ -11,22 +12,16 @@ The resource allows you to create a self-managed worker object.
 
 ## Example Usage
 
-### Controller-led worker
-
 ```terraform
 resource "boundary_worker" "controller_led" {
   scope_id    = "global"
-  name        = "controller-led-worker-1"
+  name        = "worker 1"
   description = "self managed worker with controller led auth"
 }
-```
 
-### Worker-led worker
-
-```terraform
 resource "boundary_worker" "worker_led" {
   scope_id                    = "global"
-  name                        = "worker-led-worker-1"
+  name                        = "worker 2"
   description                 = "self managed worker with worker led auth"
   worker_generated_auth_token = var.worker_generated_auth_token
 }

examples/data-sources/boundary_account/data-source.tf

@@ -1,5 +0,0 @@
-# Retrieve the ID of a Boundary account
-data "boundary_account" "admin" {
-  name           = "admin"
-  auth_method_id = "ampw_1234567890"
-}

examples/data-sources/boundary_auth_method/data-source.tf

@@ -1,15 +0,0 @@
-# Retrieve an auth method from the global scope
-data "boundary_auth_method" "auth_method" {
-  name = "password_auth_method"
-}
-
-# Auth method from a org scope
-data "boundary_scope" "org" {
-  name     = "my-org"
-  scope_id = "global"
-}
-
-data "boundary_auth_method" "auth_method" {
-  name     = "password_auth_method"
-  scope_id = data.boundary_scope.org.id
-}

examples/data-sources/boundary_group/data-source.tf

@@ -1,15 +0,0 @@
-# Retrieve a user from the global scope
-data "boundary_group" "global_group" {
-  name = "admin"
-}
-
-# User from an org scope
-data "boundary_scope" "org" {
-  name     = "org"
-  scope_id = "global"
-}
-
-data "boundary_group" "org_group" {
-  name     = "username"
-  scope_id = data.boundary_scope.org.id
-}

examples/data-sources/boundary_role/data-source.tf

@@ -1,15 +0,0 @@
-# Role from the global scope
-data "boundary_role" "global_role" {
-  name = "global_role_one"
-}
-
-# Role from an org scope
-data "boundary_scope" "org" {
-  name     = "org_one"
-  scope_id = "global"
-}
-
-data "boundary_role" "org_role" {
-  name     = "org_role_one"
-  scope_id = data.boundary_scope.org.id
-}

examples/data-sources/boundary_user/data-source.tf

@@ -1,15 +0,0 @@
-# Retrieve a user from the global scope
-data "boundary_user" "global_scope_admin" {
-  name = "admin"
-}
-
-# User from a org scope
-data "boundary_user" "org_user" {
-  name     = "username"
-  scope_id = data.boundary_scope.org.id
-}
-
-data "boundary_scope" "org" {
-  name     = "my-org"
-  scope_id = data.boundary_scope.org.id
-}

examples/data-sources/scope/data-source.tf

@@ -1,10 +1,10 @@
 # Retrieve the ID of a Boundary project
 data "boundary_scope" "org" {
   name     = "SecOps"
-  scope_id = "global"
+  parent_scope_id = "global"
 }
 
 data "boundary_scope" "project" {
   name     = "2111"
-  scope_id = data.boundary_scope.id
-}
+  parent_scope_id = data.boundary_scope.id
+}

examples/provider/provider.tf

@@ -1,19 +1,19 @@
 provider "boundary" {
-  addr                   = "http://127.0.0.1:9200"
-  auth_method_id         = "ampw_1234567890" # changeme
-  auth_method_login_name = "myuser"          # changeme
-  auth_method_password   = "passpass"        # changeme
+  addr                            = "http://127.0.0.1:9200"
+  auth_method_id                  = "ampw_1234567890" # changeme
+  password_auth_method_login_name = "myuser"          # changeme
+  password_auth_method_password   = "passpass"        # changeme
 }
 
 provider "boundary" {
-  addr                   = "http://127.0.0.1:9200"
-  auth_method_login_name = "myuser"
-  auth_method_password   = "passpass"
+  addr                            = "http://127.0.0.1:9200"
+  password_auth_method_login_name = "myuser"
+  password_auth_method_password   = "passpass"
 }
 
 provider "boundary" {
-  addr                   = "http://127.0.0.1:9200"
-  auth_method_login_name = "myuser"
-  auth_method_password   = "passpass"
-  scope_id               = "s_1234567890"
+  addr                            = "http://127.0.0.1:9200"
+  password_auth_method_login_name = "myuser"
+  password_auth_method_password   = "passpass"
+  scope_id                        = "s_1234567890"
 }

examples/resources/boundary_account_ldap/import.sh

@@ -1 +0,0 @@
-terraform import boundary_account_ldap.foo <my-id>

examples/resources/boundary_account_ldap/resource.tf

@@ -1,34 +0,0 @@
-resource "boundary_scope" "org" {
-  name                     = "organization_one"
-  description              = "My first scope!"
-  scope_id                 = "global"
-  auto_create_admin_role   = true
-  auto_create_default_role = true
-}
-
-resource "boundary_auth_method_ldap" "forumsys_ldap" {
-  name          = "forumsys public LDAP"
-  scope_id      = "global"                               # add the new auth method to the global scope
-  urls          = ["ldap://ldap.forumsys.com"]           # the addr of the LDAP server
-  user_dn       = "dc=example,dc=com"                    # the basedn for users
-  user_attr     = "uid"                                  # the user attribute
-  group_dn      = "dc=example,dc=com"                    # the basedn for groups
-  bind_dn       = "cn=read-only-admin,dc=example,dc=com" # the dn to use when binding
-  bind_password = "password"                             # passwd to use when binding
-  state         = "active-public"                        # make sure the new auth-method is available to everyone
-  enable_groups = true                                   # this turns-on the discovery of a user's groups
-  discover_dn   = true                                   # this turns-on the discovery of an authenticating user's dn
-}
-
-resource "boundary_account_ldap" "einstein" {
-  auth_method_id = boundary_auth_method_ldap.forumsys_ldap.id
-  login_name     = "einstein"
-  name           = "einstein"
-}
-
-resource "boundary_user" "einstein" {
-  name        = "einstein"
-  description = "User resource for einstein"
-  scope_id    = "global"
-  account_ids = [boundary_account_ldap.einstein.id]
-}

examples/resources/boundary_alias_target/import.sh

@@ -1,2 +0,0 @@
-terraform import boundary_alias_target.example_alias_target <my-id>
-terraform import boundary_alias_target.example_alias_target_project <my-id>

examples/resources/boundary_alias_target/resource.tf

@@ -1,85 +0,0 @@
-resource "boundary_scope" "org" {
-  name                     = "organization_one"
-  description              = "global scope"
-  scope_id                 = "global"
-  auto_create_admin_role   = true
-  auto_create_default_role = true
-}
-
-resource "boundary_scope" "project" {
-  name                   = "project_one"
-  description            = "My first scope!"
-  scope_id               = boundary_scope.org.id
-  auto_create_admin_role = true
-}
-
-resource "boundary_scope_alias_suffix" "org" {
-  scope_id     = boundary_scope.org.id
-  alias_suffix = "org"
-}
-
-resource "boundary_scope_alias_suffix" "project" {
-  scope_id     = boundary_scope.project.id
-  alias_suffix = "projectone"
-}
-
-resource "boundary_host_catalog_static" "foo" {
-  name        = "test"
-  description = "test catalog"
-  scope_id    = boundary_scope.project.id
-}
-
-resource "boundary_host_static" "foo" {
-  name            = "foo"
-  host_catalog_id = boundary_host_catalog_static.foo.id
-  address         = "10.0.0.1"
-}
-
-resource "boundary_host_static" "bar" {
-  name            = "bar"
-  host_catalog_id = boundary_host_catalog_static.foo.id
-  address         = "127.0.0.1"
-}
-
-resource "boundary_host_set_static" "foo" {
-  name            = "foo"
-  host_catalog_id = boundary_host_catalog_static.foo.id
-
-  host_ids = [
-    boundary_host_static.foo.id,
-    boundary_host_static.bar.id,
-  ]
-}
-
-resource "boundary_target" "foo" {
-  name         = "foo"
-  description  = "Foo target"
-  type         = "tcp"
-  default_port = "22"
-  scope_id     = boundary_scope.project.id
-  host_source_ids = [
-    boundary_host_set_static.foo.id,
-  ]
-}
-
-resource "boundary_alias_target" "example_alias_target" {
-  name                      = "example_alias_target"
-  description               = "Example alias to target foo using host boundary_host_static.bar"
-  scope_id                  = "global"
-  value                     = "example.bar.foo.boundary"
-  destination_id            = boundary_target.foo.id
-  authorize_session_host_id = boundary_host_static.bar.id
-}
-
-resource "boundary_alias_target" "example_alias_target_project" {
-  name                      = "example_alias_target_project"
-  description               = "Example project-scoped alias to target foo"
-  scope_id                  = boundary_scope.project.id
-  value                     = "prodops.projectone.org"
-  destination_id            = boundary_target.foo.id
-  authorize_session_host_id = boundary_host_static.bar.id
-  depends_on = [
-    boundary_scope_alias_suffix.org,
-    boundary_scope_alias_suffix.project,
-  ]
-}

examples/resources/boundary_auth_method/resource.tf

@@ -10,9 +10,3 @@ resource "boundary_auth_method" "password" {
   scope_id = boundary_scope.org.id
   type     = "password"
 }
-
-resource "boundary_auth_method" "password_is_primary" {
-  scope_id = boundary_scope.org.id
-  type     = "password"
-  is_primary_for_scope = true
-}

examples/resources/boundary_auth_method_ldap/import.sh

@@ -1 +0,0 @@
-terraform import boundary_auth_method_ldap.foo <my-id>

examples/resources/boundary_auth_method_ldap/resource.tf

@@ -1,21 +0,0 @@
-resource "boundary_scope" "org" {
-  name                     = "organization_one"
-  description              = "My first scope!"
-  scope_id                 = "global"
-  auto_create_admin_role   = true
-  auto_create_default_role = true
-}
-
-resource "boundary_auth_method_ldap" "forumsys_ldap" {
-  name          = "forumsys public LDAP"
-  scope_id      = "global"                               # add the new auth method to the global scope
-  urls          = ["ldap://ldap.forumsys.com"]           # the addr of the LDAP server
-  user_dn       = "dc=example,dc=com"                    # the basedn for users
-  user_attr     = "uid"                                  # the user attribute
-  group_dn      = "dc=example,dc=com"                    # the basedn for groups
-  bind_dn       = "cn=read-only-admin,dc=example,dc=com" # the dn to use when binding
-  bind_password = "password"                             # passwd to use when binding
-  state         = "active-public"                        # make sure the new auth-method is available to everyone
-  enable_groups = true                                   # this turns-on the discovery of a user's groups
-  discover_dn   = true                                   # this turns-on the discovery of an authenticating user's dn
-}

examples/resources/boundary_auth_method_oidc/import.sh

@@ -1 +0,0 @@
-terraform import boundary_auth_method_oidc.foo <my-id>

examples/resources/boundary_auth_method_oidc/resource.tf

@@ -1,42 +0,0 @@
-resource "boundary_scope" "org" {
-  name                     = "organization_one"
-  description              = "My first scope!"
-  scope_id                 = "global"
-  auto_create_admin_role   = true
-  auto_create_default_role = true
-}
-
-resource "boundary_auth_method_oidc" "vault" {
-  api_url_prefix     = "https://XO-XO-XO-XO-XOXOXO.boundary.hashicorp.cloud:9200"
-  client_id          = "eieio"
-  client_secret      = "hvo_secret_XO"
-  description        = "My Boundary OIDC Auth Method for Vault"
-  issuer             = "https://XO-XO-XO-XO-XOXOXO.vault.hashicorp.cloud:8200/v1/identity/oidc/provider/my-provider"
-  scope_id           = "global"
-  signing_algorithms = ["RS256"]
-  type               = "oidc"
-}
-
-resource "boundary_auth_method_oidc" "oidc_with_one_prompt" {
-  api_url_prefix     = "https://XO-XO-XO-XO-XOXOXO.boundary.hashicorp.cloud:9200"
-  client_id          = "eieio"
-  client_secret      = "hvo_secret_XO"
-  description        = "My Boundary OIDC Auth Method With Prompt"
-  issuer             = "https://sts.windows.net/TENANT_ID/"
-  scope_id           = "global"
-  signing_algorithms = ["RS256"]
-  prompts            = ["select_account"]
-  type               = "oidc"
-}
-
-resource "boundary_auth_method_oidc" "oidc_with_multiple_prompts" {
-  api_url_prefix     = "https://XO-XO-XO-XO-XOXOXO.boundary.hashicorp.cloud:9200"
-  client_id          = "eieio"
-  client_secret      = "hvo_secret_XO"
-  description        = "My Boundary OIDC Auth Method With Multiple Prompts"
-  issuer             = "https://sts.windows.net/TENANT_ID/"
-  scope_id           = "global"
-  signing_algorithms = ["RS256"]
-  prompts            = ["consent", "select_account"]
-  type               = "oidc"
-}

examples/resources/boundary_auth_method_password/import.sh

@@ -1 +0,0 @@
-terraform import boundary_auth_method_password.foo <my-id>

examples/resources/boundary_auth_method_password/resource.tf

@@ -1,16 +0,0 @@
-resource "boundary_scope" "org" {
-  name                     = "organization_one"
-  description              = "My first scope!"
-  scope_id                 = "global"
-  auto_create_admin_role   = true
-  auto_create_default_role = true
-}
-
-resource "boundary_auth_method_password" "password" {
-  scope_id = boundary_scope.org.id
-}
-
-resource "boundary_auth_method_password" "password_is_primary" {
-  scope_id = boundary_scope.org.id
-  is_primary_for_scope = true
-}

examples/resources/boundary_credential_library_vault_ldap/import.sh

@@ -1 +0,0 @@
-terraform import boundary_credential_library_vault_ldap.foo <my-id>

examples/resources/boundary_credential_library_vault_ldap/resource.tf

@@ -1,36 +0,0 @@
-resource "boundary_scope" "org" {
-  name                     = "organization_one"
-  description              = "My first scope!"
-  scope_id                 = "global"
-  auto_create_admin_role   = true
-  auto_create_default_role = true
-}
-
-resource "boundary_scope" "project" {
-  name                   = "project_one"
-  description            = "My first scope!"
-  scope_id               = boundary_scope.org.id
-  auto_create_admin_role = true
-}
-
-resource "boundary_credential_store_vault" "foo" {
-  name        = "foo"
-  description = "My first Vault credential store!"
-  address     = "http://127.0.0.1:8200"      # change to Vault address
-  token       = "s.0ufRo6XEGU2jOqnIr7OlFYP5" # change to valid Vault token
-  scope_id    = boundary_scope.project.id
-}
-
-resource "boundary_credential_library_vault_ldap" "foo-static" {
-  name                = "foo"
-  description         = "My first static Vault LDAP credential library!"
-  credential_store_id = boundary_credential_store_vault.foo.id
-  path                = "ldap/static-cred/foo" # change to Vault backend path
-}
-
-resource "boundary_credential_library_vault_ldap" "bar-dynamic" {
-  name                = "bar"
-  description         = "My first dynamic Vault LDAP credential library!"
-  credential_store_id = boundary_credential_store_vault.foo.id
-  path                = "ldap/creds/bar" # change to Vault backend path
-}

examples/resources/boundary_credential_password/import.sh

@@ -1 +0,0 @@
-terraform import boundary_credential_password.example <my-id>

examples/resources/boundary_credential_password/resource.tf

@@ -1,27 +0,0 @@
-resource "boundary_scope" "org" {
-  name                     = "organization_one"
-  description              = "global scope"
-  scope_id                 = "global"
-  auto_create_admin_role   = true
-  auto_create_default_role = true
-}
-
-resource "boundary_scope" "project" {
-  name                   = "project_one"
-  description            = "My first scope!"
-  scope_id               = boundary_scope.org.id
-  auto_create_admin_role = true
-}
-
-resource "boundary_credential_store_static" "example" {
-  name        = "example_static_credential_store"
-  description = "My first static credential store!"
-  scope_id    = boundary_scope.project.id
-}
-
-resource "boundary_credential_password" "example" {
-  name                = "example_password"
-  description         = "My first password credential!"
-  credential_store_id = boundary_credential_store_static.example.id
-  password            = "my-password"
-}

examples/resources/boundary_credential_username_password_domain/import.sh

@@ -1 +0,0 @@
-terraform import boundary_credential_username_password_domain.example_username_password_domain <my-id>

examples/resources/boundary_credential_username_password_domain/resource.tf

@@ -1,29 +0,0 @@
-resource "boundary_scope" "org" {
-  name                     = "organization_one"
-  description              = "global scope"
-  scope_id                 = "global"
-  auto_create_admin_role   = true
-  auto_create_default_role = true
-}
-
-resource "boundary_scope" "project" {
-  name                   = "project_one"
-  description            = "My first scope!"
-  scope_id               = boundary_scope.org.id
-  auto_create_admin_role = true
-}
-
-resource "boundary_credential_store_static" "example" {
-  name        = "example_static_credential_store"
-  description = "My first static credential store!"
-  scope_id    = boundary_scope.project.id
-}
-
-resource "boundary_credential_username_password_domain" "example" {
-  name                = "example_username_password_domain"
-  description         = "My first username password domain credential!"
-  credential_store_id = boundary_credential_store_static.example.id
-  username            = "my-username"
-  password            = "my-password"
-  domain              = "my-domain"
-}

examples/resources/boundary_host_set/resource.tf

@@ -24,6 +24,7 @@ resource "boundary_host" "first" {
   description     = "My first host!"
   address         = "10.0.0.1"
   host_catalog_id = boundary_host_catalog.static.id
+  scope_id        = boundary_scope.project.id
 }
 
 resource "boundary_host" "second" {
@@ -32,6 +33,7 @@ resource "boundary_host" "second" {
   description     = "My second host!"
   address         = "10.0.0.2"
   host_catalog_id = boundary_host_catalog.static.id
+  scope_id        = boundary_scope.project.id
 }
 
 resource "boundary_host_set" "web" {

examples/resources/boundary_managed_group_ldap/import.sh

@@ -1 +0,0 @@
-terraform import boundary_managed_group_ldap.foo <my-id>

examples/resources/boundary_managed_group_ldap/resource.tf

@@ -1,28 +0,0 @@
-resource "boundary_scope" "org" {
-  name                     = "organization_one"
-  description              = "My first scope!"
-  scope_id                 = "global"
-  auto_create_admin_role   = true
-  auto_create_default_role = true
-}
-
-resource "boundary_auth_method_ldap" "forumsys_ldap" {
-  name          = "forumsys public LDAP"
-  scope_id      = "global"                               # add the new auth method to the global scope
-  urls          = ["ldap://ldap.forumsys.com"]           # the addr of the LDAP server
-  user_dn       = "dc=example,dc=com"                    # the basedn for users
-  user_attr     = "uid"                                  # the user attribute
-  group_dn      = "dc=example,dc=com"                    # the basedn for groups
-  bind_dn       = "cn=read-only-admin,dc=example,dc=com" # the dn to use when binding
-  bind_password = "password"                             # passwd to use when binding
-  state         = "active-public"                        # make sure the new auth-method is available to everyone
-  enable_groups = true                                   # this turns-on the discovery of a user's groups
-  discover_dn   = true                                   # this turns-on the discovery of an authenticating user's dn
-}
-
-resource "boundary_managed_group_ldap" "forumsys_scientists" {
-  name           = "scientists"
-  description    = "forumsys scientists managed group"
-  auth_method_id = boundary_auth_method_ldap.forumsys_ldap.id
-  group_names    = ["Scientists"]
-}

examples/resources/boundary_policy/resource.tf

@@ -1,27 +0,0 @@
-resource "boundary_scope" "global" {
-  global_scope = true
-  scope_id     = "global"
-}
-
-resource "boundary_scope" "org" {
-  name                     = "organization_one"
-  description              = "My first scope!"
-  scope_id                 = boundary_scope.global.id
-  auto_create_admin_role   = true
-  auto_create_default_role = true
-}
-
-resource "boundary_policy_storage" "foo" {
-  name                     = "foo"
-  description              = "Foo policy"
-  scope_id                 = boundary_scope.org.id
-  retain_for_days          = 10
-  retain_for_overridable   = false
-  delete_after_days        = 10
-  delete_after_overridable = true
-}
-
-resource "boundary_scope_policy_attachment" "foo_attachment" {
-  scope_id  = boundary_scope.org.id
-  policy_id = boundary_policy_storage.foo.id
-}

examples/resources/boundary_role/project-specific/resource.tf

@@ -23,6 +23,6 @@ resource "boundary_role" "readonly" {
   name          = "readonly"
   description   = "A readonly role"
   principal_ids = [boundary_user.readonly.id]
-  grant_strings = ["ids=*;type=*;actions=read"]
+  grant_strings = ["id=*;type=*;actions=read"]
   scope_id      = boundary_scope.project.id
 }

examples/resources/boundary_role/user-grants/resource.tf

@@ -16,6 +16,6 @@ resource "boundary_role" "readonly" {
   name          = "readonly"
   description   = "A readonly role"
   principal_ids = [boundary_user.readonly.id]
-  grant_strings = ["ids=*;type=*;actions=read"]
+  grant_strings = ["id=*;type=*;actions=read"]
   scope_id      = boundary_scope.org.id
 }

examples/resources/boundary_scope/role.tf

@@ -5,8 +5,8 @@ resource "boundary_scope" "org" {
 }
 
 resource "boundary_role" "org_admin" {
-  scope_id        = boundary_scope.global.id
-  grant_scope_ids = [boundary_scope.org.id]
-  grant_strings   = ["ids=*;type=*;actions=*"]
-  principal_ids   = ["u_auth"]
+  scope_id       = boundary_scope.global.id
+  grant_scope_id = boundary_scope.org.id
+  grant_strings  = ["id=*;type=*;actions=*"]
+  principal_ids  = ["u_auth"]
 }

examples/resources/boundary_scope_alias_suffix/import.sh

@@ -1 +0,0 @@
-terraform import boundary_scope_alias_suffix.org_suffix <scope-id>

examples/resources/boundary_scope_alias_suffix/resource.tf

@@ -1,29 +0,0 @@
-resource "boundary_scope" "global" {
-  global_scope = true
-  scope_id     = "global"
-}
-
-resource "boundary_scope" "org" {
-  name                     = "organization_one"
-  description              = "My first scope!"
-  scope_id                 = boundary_scope.global.id
-  auto_create_admin_role   = true
-  auto_create_default_role = true
-}
-
-resource "boundary_scope" "project" {
-  name                   = "project_one"
-  description            = "My first project"
-  scope_id               = boundary_scope.org.id
-  auto_create_admin_role = true
-}
-
-resource "boundary_scope_alias_suffix" "org_suffix" {
-  scope_id     = boundary_scope.org.id
-  alias_suffix = "org"
-}
-
-resource "boundary_scope_alias_suffix" "project_suffix" {
-  scope_id     = boundary_scope.project.id
-  alias_suffix = "projectone"
-}

examples/resources/boundary_storage_bucket/resource.tf

@@ -6,8 +6,8 @@ resource "boundary_scope" "org" {
   auto_create_default_role = true
 }
 
-resource "boundary_storage_bucket" "aws_static_credentials_example" {
-  name            = "My aws storage bucket with static credentials"
+resource "boundary_storage_bucket" "aws_example" {
+  name            = "My aws storage bucket"
   description     = "My first storage bucket!"
   scope_id        = boundary_scope.org.id
   plugin_name     = "aws"
@@ -22,20 +22,3 @@ resource "boundary_storage_bucket" "aws_static_credentials_example" {
   })
   worker_filter = "\"pki\" in \"/tags/type\""
 }
-
-resource "boundary_storage_bucket" "aws_dynamic_credentials_example" {
-  name        = "My aws storage bucket with dynamic credentials"
-  description = "My first storage bucket!"
-  scope_id    = boundary_scope.org.id
-  plugin_name = "aws"
-  bucket_name = "mybucket"
-
-  # the role_arn value should be the same arn used as the instance profile that is attached to the ec2 instance
-  # https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html
-  attributes_json = jsonencode({
-    "region"                      = "us-east-1"
-    "role_arn"                    = "arn:aws:iam::123456789012:role/S3Access"
-    "disable_credential_rotation" = "true"
-  })
-  worker_filter = "\"pki\" in \"/tags/type\""
-}

examples/resources/boundary_target/resource.tf

@@ -35,30 +35,37 @@ resource "boundary_credential_library_vault" "foo" {
   credential_type     = "username_password"
 }
 
-resource "boundary_host_catalog_static" "foo" {
+resource "boundary_host_catalog" "foo" {
   name        = "test"
   description = "test catalog"
   scope_id    = boundary_scope.project.id
+  type        = "static"
 }
 
-resource "boundary_host_static" "foo" {
+resource "boundary_host" "foo" {
+  type            = "static"
   name            = "foo"
-  host_catalog_id = boundary_host_catalog_static.foo.id
+  host_catalog_id = boundary_host_catalog.foo.id
+  scope_id        = boundary_scope.project.id
   address         = "10.0.0.1"
 }
 
-resource "boundary_host_static" "bar" {
+resource "boundary_host" "bar" {
+  type            = "static"
   name            = "bar"
-  host_catalog_id = boundary_host_catalog_static.foo.id
+  host_catalog_id = boundary_host_catalog.foo.id
+  scope_id        = boundary_scope.project.id
   address         = "10.0.0.1"
 }
 
-resource "boundary_host_set_static" "foo" {
+resource "boundary_host_set" "foo" {
+  type            = "static"
   name            = "foo"
-  host_catalog_id = boundary_host_catalog_static.foo.id
+  host_catalog_id = boundary_host_catalog.foo.id
+
   host_ids = [
-    boundary_host_static.foo.id,
-    boundary_host_static.bar.id,
+    boundary_host.foo.id,
+    boundary_host.bar.id,
   ]
 }
 
@@ -73,7 +80,7 @@ resource "boundary_storage_bucket" "aws_example" {
     "access_key_id"     = "aws_access_key_id_value",
     "secret_access_key" = "aws_secret_access_key_value"
   })
-  egress_worker_filter = "\"egress\" in \"/tags/type\""
+  worker_filter = "\"pki\" in \"/tags/type\""
 }
 
 resource "boundary_target" "foo" {
@@ -83,7 +90,7 @@ resource "boundary_target" "foo" {
   default_port = "22"
   scope_id     = boundary_scope.project.id
   host_source_ids = [
-    boundary_host_set_static.foo.id
+    boundary_host_set.foo.id
   ]
   brokered_credential_source_ids = [
     boundary_credential_library_vault.foo.id
@@ -92,12 +99,12 @@ resource "boundary_target" "foo" {
 
 resource "boundary_target" "ssh_foo" {
   name         = "ssh_foo"
-  description  = "SSH target"
+  description  = "Ssh target"
   type         = "ssh"
   default_port = "22"
   scope_id     = boundary_scope.project.id
   host_source_ids = [
-    boundary_host_set_static.foo.id
+    boundary_host_set.foo.id
   ]
   injected_application_credential_source_ids = [
     boundary_credential_library_vault.foo.id
@@ -106,12 +113,12 @@ resource "boundary_target" "ssh_foo" {
 
 resource "boundary_target" "ssh_session_recording_foo" {
   name         = "ssh_foo"
-  description  = "SSH target"
+  description  = "Ssh target"
   type         = "ssh"
   default_port = "22"
   scope_id     = boundary_scope.project.id
   host_source_ids = [
-    boundary_host_set_static.foo.id
+    boundary_host_set.foo.id
   ]
   injected_application_credential_source_ids = [
     boundary_credential_library_vault.foo.id
@@ -120,21 +127,6 @@ resource "boundary_target" "ssh_session_recording_foo" {
   storage_bucket_id        = boundary_storage_bucket.aws_example
 }
 
-resource "boundary_target" "rdp_foo" {
-  name         = "rdp_foo"
-  description  = "RDP target"
-  type         = "rdp"
-  default_port = "3389"
-  scope_id     = boundary_scope.project.id
-  host_source_ids = [
-    boundary_host_set_static.foo.id
-  ]
-  injected_application_credential_source_ids = [
-    boundary_credential_library_vault.foo.id
-  ]
-  egress_worker_filter = "\"egress\" in \"/tags/type\""
-}
-
 resource "boundary_target" "address_foo" {
   name         = "address_foo"
   description  = "Foo target with an address"

examples/resources/boundary_worker/controller_led.tf

@@ -1,5 +0,0 @@
-resource "boundary_worker" "controller_led" {
-  scope_id    = "global"
-  name        = "controller-led-worker-1"
-  description = "self managed worker with controller led auth"
-}

examples/resources/boundary_worker/main.tf

@@ -0,0 +1,13 @@
+resource "boundary_worker" "controller_led" {
+  scope_id                    = "global"
+  name                        = "worker 1"
+  description                 = "self managed worker with controller-led auth"
+  worker_generated_auth_token = var.worker_generated_auth_token
+}
+
+resource "boundary_worker" "worker_led" {
+  scope_id                    = "global"
+  name                        = "worker 2"
+  description                 = "self managed worker with worker-led auth"
+  worker_generated_auth_token = var.worker_generated_auth_token
+}