chore: add comment for ToMap method

On Storage Bucket update, when we determine if the credentials are to be
updated to new ones, we call `credState.ReplaceCreds`.

This call, if the old credentials were managed by us (rotated at create
time), will delete the old credentials and set the new ones onto
credState.

We called this function without validating if the incoming credentials
are valid. This could get the bucket in a state where where, while we'd
return an update error if the incoming credentials weren't working with
S3 (err in the dry run process that happens at the end of the update),
we'd also silently delete the old credentials the bucket used, rendering
the bucket completely broken.

.github/workflows/test.yml

@@ -13,9 +13,9 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
       - name: Set up Go
-        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+        uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
         with:
           go-version-file: 'go.mod'
           cache: true

README.md

@@ -17,7 +17,7 @@ and then the given credential will be revoked. In this way, after rotation,
 only Boundary knows the client secret in use by this plugin. More information
 about AWS static credentials can be found [here](https://docs.aws.amazon.com/sdkref/latest/guide/feature-static-credentials.html).
 
-Credential rotation can be turned off by setting the
+Credential rotation can be turned off by setting the 
 `disable_credential_rotation` attribute to `true`.
 
 ### Assume Role Credentials
@@ -48,7 +48,7 @@ The plugin fetches hosts through the
 [DescribeInstances](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstances.html)
 call.
 
-[Getting Started](plugin/service/host/README.md)
+[Getting Started](https://github.com/hashicorp/boundary-plugin-aws/plugin/service/host/README.md)
 
 ## Storage Bucket
 
@@ -60,7 +60,7 @@ these storage bucket resources can in turn be associated to targets within
 Boundary.
 
 At creation, update or deletion of a storage bucket of this type, configuration of the
-plugin is performed via the attribute/secret values passed to the create, update, or
+plugin is performed via the attribute/secret values passed to the create, update, or 
 delete calls actions. The values passed in to the plugin here are the attributes set
 on on a storage bucket in boundary.
 
@@ -76,4 +76,4 @@ The plugin fetches metadata about the files through the
 [HeadObject](https://docs.aws.amazon.com/AmazonS3/latest/API/API_HeadObject.html)
 call.
 
-[Getting Started](plugin/service/storage/README.md)
+[Getting Started](https://github.com/hashicorp/boundary-plugin-aws/plugin/service/storage/README.md)

go.mod

@@ -1,24 +1,24 @@
 module github.com/hashicorp/boundary-plugin-aws
 
-go 1.21
+go 1.20
 
 require (
+	github.com/aws/aws-sdk-go v1.44.80
 	github.com/aws/aws-sdk-go-v2 v1.20.1
 	github.com/aws/aws-sdk-go-v2/service/ec2 v1.99.0
 	github.com/aws/aws-sdk-go-v2/service/iam v1.22.2
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.38.2
 	github.com/aws/aws-sdk-go-v2/service/sts v1.21.2
 	github.com/aws/smithy-go v1.14.1
-	github.com/google/go-cmp v0.6.0
-	github.com/google/uuid v1.4.0
-	github.com/hashicorp/boundary/sdk v0.0.43-0.20240717182311-a20aae98794a
-	github.com/hashicorp/go-multierror v1.1.1
+	github.com/google/go-cmp v0.5.9
+	github.com/google/uuid v1.3.0
+	github.com/hashicorp/boundary/sdk v0.0.33
 	github.com/hashicorp/go-secure-stdlib/awsutil/v2 v2.0.0
 	github.com/hashicorp/terraform-json v0.14.0
 	github.com/mitchellh/mapstructure v1.5.0
 	github.com/stretchr/testify v1.8.4
-	google.golang.org/grpc v1.61.0
-	google.golang.org/protobuf v1.33.0
+	google.golang.org/grpc v1.53.0
+	google.golang.org/protobuf v1.28.1
 )
 
 require (
@@ -37,30 +37,29 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/sso v1.13.2 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.15.2 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/fatih/color v1.15.0 // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/fatih/color v1.14.1 // indirect
+	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
-	github.com/hashicorp/eventlogger v0.2.6-0.20231025104552-802587e608f0 // indirect
-	github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20231025104552-802587e608f0 // indirect
+	github.com/hashicorp/eventlogger v0.1.2-0.20230428153751-cca445805f24 // indirect
+	github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20230428153751-cca445805f24 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-hclog v1.5.0 // indirect
-	github.com/hashicorp/go-kms-wrapping/v2 v2.0.14 // indirect
+	github.com/hashicorp/go-kms-wrapping/v2 v2.0.9 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
 	github.com/hashicorp/go-version v1.5.0 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-isatty v0.0.19 // indirect
+	github.com/mattn/go-isatty v0.0.17 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/pointerstructure v1.2.1 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/zclconf/go-cty v1.10.0 // indirect
-	golang.org/x/crypto v0.18.0 // indirect
-	golang.org/x/net v0.20.0 // indirect
-	golang.org/x/sys v0.16.0 // indirect
-	golang.org/x/text v0.14.0 // indirect
-	google.golang.org/genproto v0.0.0-20240116215550-a9fa1716bcac // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20240125205218-1f4bbc51befe // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240125205218-1f4bbc51befe // indirect
+	golang.org/x/crypto v0.8.0 // indirect
+	golang.org/x/net v0.9.0 // indirect
+	golang.org/x/sys v0.7.0 // indirect
+	golang.org/x/text v0.9.0 // indirect
+	google.golang.org/genproto v0.0.0-20230303212802-e74f57abe488 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -1,13 +1,11 @@
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
-github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
 github.com/Masterminds/semver/v3 v3.2.0 h1:3MEsd0SM6jqZojhjLWWeBY+Kcjy9i6MQAeY7YgDP83g=
-github.com/Masterminds/semver/v3 v3.2.0/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
 github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj9n6YA=
-github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBaRMhvYXJNkGuM=
 github.com/apparentlymart/go-textseg v1.0.0/go.mod h1:z96Txxhf3xSFMPmb5X/1W05FF/Nj9VFpLOpjS5yuumk=
 github.com/apparentlymart/go-textseg/v13 v13.0.0/go.mod h1:ZK2fH7c4NqDTLtiYLvIkEghdlcqw7yxLeM89kiTRPUo=
 github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI=
-github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
+github.com/aws/aws-sdk-go v1.44.80 h1:jEXGecSgPdvM5KnyDsSgFhZSm7WwaTp4h544Im4SfhI=
+github.com/aws/aws-sdk-go v1.44.80/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
 github.com/aws/aws-sdk-go-v2 v1.18.0/go.mod h1:uzbQtefpm44goOPmdKyAlXSNcwlRgF3ePWVW6EtJvvw=
 github.com/aws/aws-sdk-go-v2 v1.20.1 h1:rZBf5DWr7YGrnlTK4kgDQGn1ltqOg5orCYb/UhOFZkg=
 github.com/aws/aws-sdk-go-v2 v1.20.1/go.mod h1:NU06lETsFm8fUC6ZjhgDpVBcGZTFQ6XM+LZWZxMI4ac=
@@ -54,90 +52,73 @@ github.com/aws/smithy-go v1.13.5/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J
 github.com/aws/smithy-go v1.14.1 h1:EFKMUmH/iHMqLiwoEDx2rRjRQpI1YCn5jTysoaDujFs=
 github.com/aws/smithy-go v1.14.1/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
 github.com/bgentry/speakeasy v0.1.0 h1:ByYyxL9InA1OWqxJqqp2A5pYHUrCiAL6K3J+LKSsQkY=
-github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
-github.com/fatih/color v1.15.0 h1:kOqh6YHBtK8aywxGerMG2Eq3H6Qgoqeo13Bk2Mv/nBs=
-github.com/fatih/color v1.15.0/go.mod h1:0h5ZqXfHYED7Bhv2ZJamyIOUej9KtShiJESRwBDUSsw=
+github.com/fatih/color v1.14.1 h1:qfhVLaG5s+nCROl1zJsZRxFeYrHLqWroPOQ8BWiNb4w=
+github.com/fatih/color v1.14.1/go.mod h1:2oHN61fhTpgcxD3TSWCgKDiH1+x4OiDVVGH8WlgGZGg=
 github.com/go-test/deep v1.0.4 h1:u2CU3YKy9I2pmu9pX0eq50wCgjfGIt539SqR7FbHiho=
 github.com/go-test/deep v1.0.4/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
 github.com/golang/protobuf v1.1.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
+github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/uuid v1.4.0 h1:MtMxsa51/r9yyhkyLsVeVt0B+BGQZzpQiTQ4eHZ8bc4=
-github.com/google/uuid v1.4.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/hashicorp/boundary/sdk v0.0.43-0.20240717182311-a20aae98794a h1:SwVze6sYE5o+J9qdcgj29auY1k6O8oSo9DC2+2Gb9rw=
-github.com/hashicorp/boundary/sdk v0.0.43-0.20240717182311-a20aae98794a/go.mod h1:9iOT7kDM6mYcSkKxNuZlv8rP7U5BG1kXoevjLLL8lNQ=
+github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
+github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/hashicorp/boundary/sdk v0.0.33 h1:kHaVZ3b9j1QvYlG+vhAgrbXh8/+Rq2qlUIs8fKMQH7k=
+github.com/hashicorp/boundary/sdk v0.0.33/go.mod h1:jn9j5mM8v2pOk8aLeJNIszdm7WBf4gRSP68iy8Iu5Q0=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/eventlogger v0.2.6-0.20231025104552-802587e608f0 h1:f9oX8/3zxiQrfrWnBeyjDm4S02GAU02OBtCRoZOUwlo=
-github.com/hashicorp/eventlogger v0.2.6-0.20231025104552-802587e608f0/go.mod h1://CHt6/j+Q2lc0NlUB5af4aS2M0c0aVBg9/JfcpAyhM=
-github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20231025104552-802587e608f0 h1:iAb287bq0TaWTnhDYuN/zVqdD2EwanQg9ncVelC60Xc=
-github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20231025104552-802587e608f0/go.mod h1:tMywUTIvdB/FXhwm6HMTt61C8/eODY6gitCHhXtyojg=
+github.com/hashicorp/eventlogger v0.1.2-0.20230428153751-cca445805f24 h1:vtCJgcxwDMFrpUgVMfjtwXY1YqvHbj8pNA7GsXYEoLg=
+github.com/hashicorp/eventlogger v0.1.2-0.20230428153751-cca445805f24/go.mod h1://CHt6/j+Q2lc0NlUB5af4aS2M0c0aVBg9/JfcpAyhM=
+github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20230428153751-cca445805f24 h1:mopKPTxSaVr24uSysyRwywTDs85L5b05qqZvEkWa0qc=
+github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20230428153751-cca445805f24/go.mod h1:EQPLoX6CONA9BSYUovTQBHfPGE91g7wOxv03sO29FzY=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
 github.com/hashicorp/go-hclog v1.5.0 h1:bI2ocEMgcVlz55Oj1xZNBsVi900c7II+fWDyV9o+13c=
 github.com/hashicorp/go-hclog v1.5.0/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
-github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.5 h1:jrnDfQm2hCQ0/hEselgqzV4fK16gpZoY0OWGZpVPNHM=
-github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.5/go.mod h1:psh1qKep5ukvuNobFY/hCybuudlkkACpmazOsCgX5Rg=
-github.com/hashicorp/go-kms-wrapping/v2 v2.0.14 h1:1ZuhfnZgRnLK8S0KovJkoTCRIQId5pv3sDR7pG5VQBw=
-github.com/hashicorp/go-kms-wrapping/v2 v2.0.14/go.mod h1:0dWtzl2ilqKpavgM3id/kFK9L3tjo6fS4OhbVPSYpnQ=
+github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.4 h1:8z+Zi0uLYXONkxwWb/D7O5t1IUucB6Ft3uvSOa950bM=
+github.com/hashicorp/go-kms-wrapping/v2 v2.0.9 h1:JpCvi97NMA+saNqO8ovQcGoRbBq6P5ZZlJqvOsW5ick=
+github.com/hashicorp/go-kms-wrapping/v2 v2.0.9/go.mod h1:NtMaPhqSlfQ72XWDD2g80o8HI8RKkowIB8/WZHMyPY4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-plugin v1.5.2 h1:aWv8eimFqWlsEiMrYZdPYl+FdHaBJSN4AWwGWfT1G2Y=
-github.com/hashicorp/go-plugin v1.5.2/go.mod h1:w1sAEES3g3PuV/RzUrgow20W2uErMly84hhD3um1WL4=
+github.com/hashicorp/go-plugin v1.4.9 h1:ESiK220/qE0aGxWdzKIvRH69iLiuN/PjoLTm69RoWtU=
 github.com/hashicorp/go-secure-stdlib/awsutil/v2 v2.0.0 h1:ca5TSI4AgaOncPpyzLDtCGjVEtKukONpeM95vFxXCOQ=
 github.com/hashicorp/go-secure-stdlib/awsutil/v2 v2.0.0/go.mod h1:7CUvZtfTp2U0CYQCLzMtS2ngckjAZePSfwrE2aeDP1M=
 github.com/hashicorp/go-secure-stdlib/base62 v0.1.1/go.mod h1:EdWO6czbmthiwZ3/PUsDV+UD1D5IRU4ActiaWGwt0Yw=
 github.com/hashicorp/go-secure-stdlib/base62 v0.1.2 h1:ET4pqyjiGmY09R5y+rSd70J2w45CtbWDNvGqWp/R3Ng=
-github.com/hashicorp/go-secure-stdlib/base62 v0.1.2/go.mod h1:EdWO6czbmthiwZ3/PUsDV+UD1D5IRU4ActiaWGwt0Yw=
-github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.11 h1:uPW2Wn0YlmI9RGSkZpcIplnVRwJ7BCiGpk1vnF2TMw4=
-github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.11/go.mod h1:uis9dCmOzXuOaRyXq+1Foh31kcvXKoWogjNnhfjHfW8=
-github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.9 h1:0S0ctJ7Ra8O7ap+/3fZUnzJ3VzJyirWS/WnNCuOYtZY=
-github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.9/go.mod h1:TNNdgtjLgVDbrgFcyCKrlAicIl3dZF94swJltyGUX2M=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8 h1:iBt4Ew4XEGLfh6/bPk4rSYmuZJGizr6/x/AEizP0CQc=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8/go.mod h1:aiJI+PIApBRQG7FZTEBx5GiiX+HbOHilUdNxUZi4eV0=
-github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.6 h1:ZYv2XA+tEfFXIToR2jmBgVqQU9gERt0APbWqmUoNGnY=
-github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.6/go.mod h1:ggFN8dlaLWS2R1gymBbCrvXM/bkZP7hEAa4seqDwhyg=
+github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.9 h1:YZ01/aiARPneDUryzjiPGvr3pmjCSC+1WBZKI1P7I7k=
+github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.6 h1:rOmnqOSUBn5opme1Kh9OXO8qWd0KztO+f02vvCwCc/w=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7 h1:UpiO20jno/eV1eVZcxqWnUohyKRe1g8FPV/xH1s/2qs=
+github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.4 h1:IU2iGcvthrJ53rPbQU6B4+iVs/cLPO89ti5dd2XEj3k=
 github.com/hashicorp/go-secure-stdlib/reloadutil v0.1.1 h1:SMGUnbpAcat8rIKHkBPjfv81yC46a8eCNZ2hsR2l1EI=
-github.com/hashicorp/go-secure-stdlib/reloadutil v0.1.1/go.mod h1:Ch/bf00Qnx77MZd49JRgHYqHQjtEmTgGU2faufpVZb0=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts=
-github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4=
-github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.3 h1:xbrxd0U9XQW8qL1BAz2XrAjAF/P2vcqUTAues9c24B8=
-github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.3/go.mod h1:LWq2Sy8UoKKuK4lFuCNWSjJj57MhNNf2zzBWMtkAIX4=
-github.com/hashicorp/go-sockaddr v1.0.5 h1:dvk7TIXCZpmfOlM+9mlcrWmWjw/wlKT+VDq2wMvfPJU=
-github.com/hashicorp/go-sockaddr v1.0.5/go.mod h1:uoUUmtwU7n9Dv3O4SNLeFvg0SxQ3lyjsj6+CCykpaxI=
+github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.2 h1:phcbL8urUzF/kxA/Oj6awENaRwfWsjP59GW7u2qlDyY=
+github.com/hashicorp/go-sockaddr v1.0.2 h1:ztczhD1jLxIRjVejw8gFomI1BQZOe2WoVOu0SyteCQc=
 github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-version v1.5.0 h1:O293SZ2Eg+AAYijkVK3jR786Am1bhDEh2GHT0tIVE5E=
 github.com/hashicorp/go-version v1.5.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
-github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/hashicorp/terraform-json v0.14.0 h1:sh9iZ1Y8IFJLx+xQiKHGud6/TSUCM0N8e17dKDpqV7s=
 github.com/hashicorp/terraform-json v0.14.0/go.mod h1:5A9HIWPkk4e5aeeXIBbkcOvaZbIYnAIkEyqP2pNSckM=
 github.com/hashicorp/yamux v0.1.1 h1:yrQxtgseBDrq9Y652vSRDvsKCJKOUD+GzTS4Y0Y8pvE=
-github.com/hashicorp/yamux v0.1.1/go.mod h1:CtWFDAQgb7dxtzFs4tWbplKIe2jSi3+5vKbgIO0SLnQ=
 github.com/huandu/xstrings v1.4.0 h1:D17IlohoQq4UcpqD7fDk80P7l+lwAmlFaBHgOipl2FU=
-github.com/huandu/xstrings v1.4.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/imdario/mergo v0.3.13 h1:lFzP57bqS/wsqKssCGmtLAb8A0wKjLGrve2q3PPVcBk=
-github.com/imdario/mergo v0.3.13/go.mod h1:4lJ1jqUDcsbIECGy0RUJAXNIhg+6ocWgb1ALK2O4oXg=
 github.com/jefferai/isbadcipher v0.0.0-20190226160619-51d2077c035f h1:E87tDTVS5W65euzixn7clSzK66puSt1H4I5SC0EmHH4=
-github.com/jefferai/isbadcipher v0.0.0-20190226160619-51d2077c035f/go.mod h1:3J2qVK16Lq8V+wfiL2lPeDZ7UWMxk5LemerHa1p6N00=
 github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
 github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
@@ -145,7 +126,6 @@ github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfC
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
-github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -158,14 +138,12 @@ github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovk
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-isatty v0.0.19 h1:JITubQf0MOLdlGRuRq+jtsDlekdYPia9ZFsB8h/APPA=
-github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.17 h1:BTarxUcIeDqL27Mc+vyvdWYSL28zpIhv3RoTdsLMPng=
+github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mitchellh/cli v1.1.5 h1:OxRIeJXpAMztws/XHlN2vu6imG5Dpq+j61AzAX5fLng=
-github.com/mitchellh/cli v1.1.5/go.mod h1:v8+iFts2sPIKUV1ltktPXMCC8fumSKFItNcD2cLtRR4=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
 github.com/mitchellh/go-testing-interface v1.14.1 h1:jrgshOhYAUVNMAJiKbEu7EqAwgJJ2JqpQmpLJOu07cU=
-github.com/mitchellh/go-testing-interface v1.14.1/go.mod h1:gfgS7OtZj6MA4U1UrDRp04twqAjfvlZyCfX3sDjEym8=
 github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
@@ -174,21 +152,17 @@ github.com/mitchellh/pointerstructure v1.2.1/go.mod h1:BRAsLI5zgXmw97Lf6s25bs8oh
 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/oklog/run v1.1.0 h1:GEenZ1cK0+q0+wsJew9qUg/DyD8k3JzYsZAi5gYi2mA=
-github.com/oklog/run v1.1.0/go.mod h1:sVPdnTZT1zYwAJeCMu2Th4T21pA3FPOQRfWjQlk7DVU=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/posener/complete v1.2.3 h1:NP0eAhjcjImqslEwo/1hq7gpajME0fTLTezBKDqfXqo=
-github.com/posener/complete v1.2.3/go.mod h1:WZIdtGGp+qx0sLrYKtIRAruyNpv6hFCicSgv7Sy7s/s=
+github.com/rogpeppe/go-internal v1.6.2 h1:aIihoIOHCiLZHxyoNQ+ABL4NKhFTgKLBdMLyEAh98m0=
 github.com/rogpeppe/go-internal v1.6.2/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
-github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
-github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
 github.com/sebdah/goldie v1.0.0/go.mod h1:jXP4hmWywNEwZzhMuv2ccnqTSFpuq8iyQhtQdkkZBH4=
 github.com/shopspring/decimal v1.3.1 h1:2Usl1nmF/WZucqkFZhnfFYxxxu8LG21F6nPQBE5gKV8=
-github.com/shopspring/decimal v1.3.1/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
 github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w=
-github.com/spf13/cast v1.5.0/go.mod h1:SpXXQ5YoyJw6s3/6cMTQuxvgRl3PCJiyaX9p6b155UU=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
@@ -204,16 +178,16 @@ github.com/zclconf/go-cty v1.2.0/go.mod h1:hOPWgoHbaTUnI5k4D2ld+GRpFJSCe6bCM7m1q
 github.com/zclconf/go-cty v1.10.0 h1:mp9ZXQeIcN8kAwuqorjH+Q+njbJKjLrvB2yIh4q7U+0=
 github.com/zclconf/go-cty v1.10.0/go.mod h1:vVKLxnk3puL4qRAv72AO+W99LUD4da90g3uUAzyuvAk=
 github.com/zclconf/go-cty-debug v0.0.0-20191215020915-b22d67c1ba0b/go.mod h1:ZRKQfBXbGkpdV6QMzT3rU1kSTAnfu1dO8dPKjYprgj8=
+go.uber.org/goleak v1.0.0 h1:qsup4IcBdlmsnGfqyLl4Ntn3C2XCCuKAE7DwHpScyUo=
 go.uber.org/goleak v1.0.0/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
-go.uber.org/goleak v1.1.12 h1:gZAh5/EyT/HQwlpkCy6wTpqfH9H8Lz8zbm3dZh+OyzA=
-go.uber.org/goleak v1.1.12/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.18.0 h1:PGVlW0xEltQnzFZ55hkuX5+KLyrMYhHld1YHO4AKcdc=
-golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
+golang.org/x/crypto v0.8.0 h1:pd9TJtTueMTVQXzk8E2XESSMQDj/U7OUu0PqJqPXQjQ=
+golang.org/x/crypto v0.8.0/go.mod h1:mRqEX+O9/h5TFCrQhkgjo2yKi0yYA+9ecGkdQoHrywE=
 golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
+golang.org/x/lint v0.0.0-20210508222113-6edffad5e616 h1:VLliZ0d+/avPrXXH+OakdXhpJuEoBZuwh1m2j7U6Iug=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
@@ -224,8 +198,9 @@ golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.20.0 h1:aCL9BSgETF1k+blQaYUBx9hJ9LOGP3gAVemcZlf1Kpo=
-golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
+golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
+golang.org/x/net v0.9.0 h1:aWJ/m6xSmxWBx+V0XRHTlrYrPG56jKsLdTFmsSsCzOM=
+golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -234,43 +209,43 @@ golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.16.0 h1:xWw16ngr6ZMtmxDyKyIgsE93KNKz5HKmMa3b8ALHidU=
-golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.7.0 h1:3jlCCIQZPdOYu1h8BkNvLz8Kgwtae2cagcG/VamtZRU=
+golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20191108193012-7d206e10da11/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20210101214203-2dba1e4ea05c/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.6.0 h1:BOw41kyTf3PuCW1pVQf8+Cyg8pMlkYB1oo9iJ6D/lKM=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/genproto v0.0.0-20240116215550-a9fa1716bcac h1:ZL/Teoy/ZGnzyrqK/Optxxp2pmVh+fmJ97slxSRyzUg=
-google.golang.org/genproto v0.0.0-20240116215550-a9fa1716bcac/go.mod h1:+Rvu7ElI+aLzyDQhpHMFMMltsD6m7nqpuWDd2CwJw3k=
-google.golang.org/genproto/googleapis/api v0.0.0-20240125205218-1f4bbc51befe h1:0poefMBYvYbs7g5UkjS6HcxBPaTRAmznle9jnxYoAI8=
-google.golang.org/genproto/googleapis/api v0.0.0-20240125205218-1f4bbc51befe/go.mod h1:4jWUdICTdgc3Ibxmr8nAJiiLHwQBY0UI0XZcEMaFKaA=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240125205218-1f4bbc51befe h1:bQnxqljG/wqi4NTXu2+DJ3n7APcEA882QZ1JvhQAq9o=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240125205218-1f4bbc51befe/go.mod h1:PAREbraiVEVGVdTZsVWjSbbTtSyGbAgIIvni8a8CD5s=
-google.golang.org/grpc v1.61.0 h1:TOvOcuXn30kRao+gfcvsebNEa5iZIiLkisYEkf7R7o0=
-google.golang.org/grpc v1.61.0/go.mod h1:VUbo7IFqmF1QtCAstipjG0GIoq49KvMe9+h1jFLBNJs=
+google.golang.org/genproto v0.0.0-20230303212802-e74f57abe488 h1:QQF+HdiI4iocoxUjjpLgvTYDHKm99C/VtTBFnfiCJos=
+google.golang.org/genproto v0.0.0-20230303212802-e74f57abe488/go.mod h1:TvhZT5f700eVlTNwND1xoEZQeWTB2RY/65kplwl/bFA=
+google.golang.org/grpc v1.53.0 h1:LAv2ds7cmFV/XTS3XG1NneeENYrXGmorPxsBbptIjNc=
+google.golang.org/grpc v1.53.0/go.mod h1:OnIrk0ipVdj4N5d9IUoFUx72/VlD7+jUsHwZgwSMQpw=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
-google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=
+google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=

internal/credential/attributes.go

@@ -6,6 +6,7 @@ package credential
 import (
 	"fmt"
 
+	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/hashicorp/boundary-plugin-aws/internal/errors"
 	"github.com/hashicorp/boundary-plugin-aws/internal/values"
 	"github.com/hashicorp/go-secure-stdlib/awsutil/v2"
@@ -34,9 +35,8 @@ type CredentialAttributes struct {
 }
 
 // GetCredentialsConfig parses values out of a protobuf struct secrets and returns a
-// CredentialsConfig used for configuring an AWS session. An status error is returned
-// with an InvalidArgument code if any unrecognized fields are found in the protobuf
-// struct input.
+// CredentialsConfig used for configuring an AWS session. An error is returned if
+// any unrecognized fields are found in the protobuf struct input.
 func GetCredentialsConfig(secrets *structpb.Struct, attrs *CredentialAttributes, required bool) (*awsutil.CredentialsConfig, error) {
 	// initialize secrets if it is nil
 	// secrets can be nil because static credentials are optional
@@ -117,18 +117,13 @@ func GetCredentialsConfig(secrets *structpb.Struct, attrs *CredentialAttributes,
 		opts = append(opts, awsutil.WithRoleTags(attrs.RoleTags))
 	}
 
-	cfg, err := awsutil.NewCredentialsConfig(opts...)
-	if err != nil {
-		return nil, errors.BadRequestStatus(err.Error())
-	}
-
-	return cfg, nil
+	return awsutil.NewCredentialsConfig(opts...)
 }
 
 // GetCredentialAttributes parses values out of a protobuf struct input and returns a
-// CredentialAttributes used for configuring an AWS session. An status error is returned
-// with an InvalidArgument code if any of the following fields are missing from the protobuf
-// struct input or have invalid value types: region, disableCredentialRotation
+// CredentialAttributes used for configuring an AWS session. An error is returned if
+// any of the following fields are missing from the protobuf struct input or have
+// invalid value types: region, disableCredentialRotation
 func GetCredentialAttributes(in *structpb.Struct) (*CredentialAttributes, error) {
 	badFields := make(map[string]string)
 
@@ -137,6 +132,12 @@ func GetCredentialAttributes(in *structpb.Struct) (*CredentialAttributes, error)
 		badFields[fmt.Sprintf("attributes.%s", ConstRegion)] = err.Error()
 	}
 
+	if region != "" {
+		if _, found := endpoints.PartitionForRegion(endpoints.DefaultPartitions(), region); !found {
+			badFields[fmt.Sprintf("attributes.%s", ConstRegion)] = fmt.Sprintf("not a valid region: %s", region)
+		}
+	}
+
 	disableCredentialRotation, err := values.GetBoolValue(in, ConstDisableCredentialRotation, false)
 	if err != nil {
 		badFields[fmt.Sprintf("attributes.%s", ConstDisableCredentialRotation)] = err.Error()

internal/credential/attributes_test.go

@@ -25,6 +25,13 @@ func TestGetCredentialAttributes(t *testing.T) {
 			in:                  map[string]any{},
 			expectedErrContains: "missing required value \"region\"",
 		},
+		{
+			name: "invalid aws region value",
+			in: map[string]any{
+				ConstRegion: "dne",
+			},
+			expectedErrContains: "not a valid region",
+		},
 		{
 			name: "bad value for disable_credential_rotation",
 			in: map[string]any{

internal/credential/state.go

@@ -5,14 +5,13 @@ package credential
 
 import (
 	"context"
-	stderr "errors"
+	"errors"
 	"fmt"
 	"strings"
 	"time"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	iamTypes "github.com/aws/aws-sdk-go-v2/service/iam/types"
-	"github.com/hashicorp/boundary-plugin-aws/internal/errors"
 	"github.com/hashicorp/boundary-plugin-aws/internal/values"
 	"github.com/hashicorp/go-secure-stdlib/awsutil/v2"
 	"google.golang.org/protobuf/types/known/structpb"
@@ -72,7 +71,7 @@ func WithStateTestOpts(opts []awsutil.Option) AwsCredentialPersistedStateOption
 func WithCredentialsConfig(x *awsutil.CredentialsConfig) AwsCredentialPersistedStateOption {
 	return func(s *AwsCredentialPersistedState) error {
 		if s.CredentialsConfig != nil {
-			return stderr.New("credentials config already set")
+			return errors.New("credentials config already set")
 		}
 
 		s.CredentialsConfig = x
@@ -84,7 +83,7 @@ func WithCredentialsConfig(x *awsutil.CredentialsConfig) AwsCredentialPersistedS
 func WithCredsLastRotatedTime(t time.Time) AwsCredentialPersistedStateOption {
 	return func(s *AwsCredentialPersistedState) error {
 		if !s.CredsLastRotatedTime.IsZero() {
-			return stderr.New("last rotation time already set")
+			return errors.New("last rotation time already set")
 		}
 
 		s.CredsLastRotatedTime = t
@@ -107,15 +106,13 @@ func NewAwsCredentialPersistedState(opts ...AwsCredentialPersistedStateOption) (
 
 // ValidateCreds takes the credentials configuration from the persisted state
 // and runs sts.GetCallerIdentity for the current credentials, which is done
-// to check that the credentials are valid. This method returns a status error
-// with PluginError details.
+// to check that the credentials are valid.
 func (s *AwsCredentialPersistedState) ValidateCreds(ctx context.Context) error {
 	if s.CredentialsConfig == nil {
-		return errors.BadRequestStatus("missing credentials config")
+		return errors.New("missing credentials config")
 	}
 	if _, err := s.CredentialsConfig.GetCallerIdentity(ctx, s.testOpts...); err != nil {
-		st, _ := errors.ParseAWSError(err, "validating credentials")
-		return st.Err()
+		return fmt.Errorf("error validating credentials: %w", err)
 	}
 	return nil
 }
@@ -124,19 +121,18 @@ func (s *AwsCredentialPersistedState) ValidateCreds(ctx context.Context) error {
 // then deletes the old access key. If deletion of the old access key is successful, the new access key/secret key are
 // written into the credentials config and the persisted state. On any error, the old credentials are not overwritten.
 // This ensures that any generated new secret key never leaves this function in case of an error, even though it will
-// still result in an extraneous access key existing. This method returns a status error with PluginError details.
+// still result in an extraneous access key existing.
 func (s *AwsCredentialPersistedState) RotateCreds(ctx context.Context) error {
 	if s.CredentialsConfig == nil {
-		return errors.BadRequestStatus("missing credentials config")
+		return errors.New("missing credentials config")
 	}
 	if GetCredentialType(s.CredentialsConfig) != StaticAWS {
-		return errors.BadRequestStatus("invalid credential type")
+		return errors.New("invalid credential type")
 	}
 	if err := s.CredentialsConfig.RotateKeys(ctx, append([]awsutil.Option{
 		awsutil.WithValidityCheckTimeout(rotationWaitTimeout),
 	}, s.testOpts...)...); err != nil {
-		st, _ := errors.ParseAWSError(err, "error rotating credentials")
-		return st.Err()
+		return fmt.Errorf("error rotating credentials: %w", err)
 	}
 	s.CredsLastRotatedTime = time.Now()
 	return nil
@@ -144,14 +140,13 @@ func (s *AwsCredentialPersistedState) RotateCreds(ctx context.Context) error {
 
 // ReplaceCreds replaces the access key in the state with a new key.
 // If the existing key was rotated at any point in time, it is
-// deleted first, otherwise it's left alone. This method returns a
-// status error with PluginError details.
+// deleted first, otherwise it's left alone.
 func (s *AwsCredentialPersistedState) ReplaceCreds(ctx context.Context, credentialsConfig *awsutil.CredentialsConfig) error {
 	if credentialsConfig == nil {
-		return errors.BadRequestStatus("missing new credentials config")
+		return errors.New("missing new credentials config")
 	}
 	if s.CredentialsConfig == nil {
-		return errors.BadRequestStatus("missing credentials config")
+		return errors.New("missing credentials config")
 	}
 
 	// Delete old/existing credentials. This action is only possible for static credential types.
@@ -171,29 +166,27 @@ func (s *AwsCredentialPersistedState) ReplaceCreds(ctx context.Context, credenti
 
 // DeleteCreds deletes the credentials in the state. The access key
 // ID, secret access key, and rotation time fields are zeroed out in
-// the state just to ensure that they cannot be re-used after. This
-// method returns a status error with PluginError details.
+// the state just to ensure that they cannot be re-used after.
 func (s *AwsCredentialPersistedState) DeleteCreds(ctx context.Context) error {
 	if s.CredentialsConfig == nil {
-		return errors.BadRequestStatus("missing credentials config")
+		return errors.New("missing credentials config")
 	}
 	if GetCredentialType(s.CredentialsConfig) != StaticAWS {
-		return errors.BadRequestStatus("invalid credential type")
+		return errors.New("invalid credential type")
 	}
 
 	if err := s.CredentialsConfig.DeleteAccessKey(ctx, s.CredentialsConfig.AccessKey, s.testOpts...); err != nil {
 		// Determine if the deletion error was due to a missing
 		// resource. If it was, just pass it.
 		var awsErr *iamTypes.NoSuchEntityException
-		if stderr.As(err, &awsErr) && awsErr.ErrorCode() == "NoSuchEntity" {
+		if errors.As(err, &awsErr) && awsErr.ErrorCode() == "NoSuchEntity" {
 			s.CredentialsConfig = nil
 			s.CredsLastRotatedTime = time.Time{}
 			return nil
 		}
 
 		// Otherwise treat it as an actual error.
-		st, _ := errors.ParseAWSError(err, "failed to delete access key")
-		return st.Err()
+		return err
 	}
 
 	s.CredentialsConfig = nil
@@ -203,13 +196,7 @@ func (s *AwsCredentialPersistedState) DeleteCreds(ctx context.Context) error {
 
 // GenerateCredentialChain returns a AWS configuration for the credentials in the state.
 func (s *AwsCredentialPersistedState) GenerateCredentialChain(ctx context.Context) (*aws.Config, error) {
-	// Default `WithSharedCredentials` is `true` - This disables the ability to
-	// read credentials from environment variables because we set the default
-	// profile options, so we need to set it to false (see
-	// awsutil@v2.(*CredentialsConfig).generateAwsConfigOptions) for extra
-	// details.
-	opts := append(s.testOpts, awsutil.WithSharedCredentials(false))
-	return s.CredentialsConfig.GenerateCredentialChain(ctx, opts...)
+	return s.CredentialsConfig.GenerateCredentialChain(ctx, s.testOpts...)
 }
 
 // ToMap returns a map of the credentials stored in the persisted state.

internal/credential/state_test.go

@@ -14,10 +14,7 @@ import (
 	"github.com/aws/aws-sdk-go-v2/service/iam"
 	iamTypes "github.com/aws/aws-sdk-go-v2/service/iam/types"
 	"github.com/hashicorp/go-secure-stdlib/awsutil/v2"
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/types/known/structpb"
 )
 
@@ -343,16 +340,14 @@ func TestAwsCredentialPersistedStateFromProto(t *testing.T) {
 
 func TestAwsCatalogPersistedState_ValidateCreds(t *testing.T) {
 	cases := []struct {
-		name               string
-		in                 *AwsCredentialPersistedState
-		expectedStatusCode codes.Code
-		expectedErr        string
+		name        string
+		in          *AwsCredentialPersistedState
+		expectedErr string
 	}{
 		{
-			name:               "missing credentials config",
-			in:                 &AwsCredentialPersistedState{},
-			expectedStatusCode: codes.InvalidArgument,
-			expectedErr:        "missing credentials config",
+			name:        "missing credentials config",
+			in:          &AwsCredentialPersistedState{},
+			expectedErr: "missing credentials config",
 		},
 		{
 			name: "validation error",
@@ -370,8 +365,7 @@ func TestAwsCatalogPersistedState_ValidateCreds(t *testing.T) {
 					),
 				},
 			},
-			expectedStatusCode: codes.Unknown,
-			expectedErr:        "aws service unknown: unknown error: validating credentials",
+			expectedErr: fmt.Sprintf("error validating credentials: %s", testGetCallerIdentityErr),
 		},
 		{
 			name: "good",
@@ -389,12 +383,10 @@ func TestAwsCatalogPersistedState_ValidateCreds(t *testing.T) {
 	for _, tc := range cases {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
-			require, assert := require.New(t), assert.New(t)
+			require := require.New(t)
 			err := tc.in.ValidateCreds(context.Background())
 			if tc.expectedErr != "" {
-				require.Error(err)
-				assert.ErrorContains(err, tc.expectedErr)
-				assert.Equal(tc.expectedStatusCode, status.Code(err))
+				require.EqualError(err, tc.expectedErr)
 				return
 			}
 
@@ -410,13 +402,11 @@ func TestAwsCatalogPersistedState_RotateCreds(t *testing.T) {
 		exepected                  *awsutil.CredentialsConfig
 		expectedNonZeroRotatedTime bool
 		expectedErr                string
-		expectedStatusCode         codes.Code
 	}{
 		{
-			name:               "missing credentials config",
-			in:                 &AwsCredentialPersistedState{},
-			expectedErr:        "missing credentials config",
-			expectedStatusCode: codes.InvalidArgument,
+			name:        "missing credentials config",
+			in:          &AwsCredentialPersistedState{},
+			expectedErr: "missing credentials config",
 		},
 		{
 			name: "cannot delete dynamic credential type",
@@ -427,8 +417,7 @@ func TestAwsCatalogPersistedState_RotateCreds(t *testing.T) {
 				},
 				CredsLastRotatedTime: time.Now(),
 			},
-			expectedErr:        "invalid credential type",
-			expectedStatusCode: codes.InvalidArgument,
+			expectedErr: "invalid credential type",
 		},
 		{
 			name: "cannot delete unknown credential type",
@@ -439,8 +428,7 @@ func TestAwsCatalogPersistedState_RotateCreds(t *testing.T) {
 				},
 				CredsLastRotatedTime: time.Now(),
 			},
-			expectedErr:        "invalid credential type",
-			expectedStatusCode: codes.InvalidArgument,
+			expectedErr: "invalid credential type",
 		},
 		{
 			name: "rotation error",
@@ -458,8 +446,7 @@ func TestAwsCatalogPersistedState_RotateCreds(t *testing.T) {
 					),
 				},
 			},
-			expectedErr:        "aws service unknown: unknown error: error rotating credentials",
-			expectedStatusCode: codes.Unknown,
+			expectedErr: fmt.Sprintf("error rotating credentials: error calling CreateAccessKey: error calling iam.GetUser: %s", testGetUserErr),
 		},
 		{
 			name: "good",
@@ -509,12 +496,10 @@ func TestAwsCatalogPersistedState_RotateCreds(t *testing.T) {
 	for _, tc := range cases {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
-			require, assert := require.New(t), assert.New(t)
+			require := require.New(t)
 			err := tc.in.RotateCreds(context.Background())
 			if tc.expectedErr != "" {
-				require.Error(err)
-				assert.ErrorContains(err, tc.expectedErr)
-				assert.Equal(tc.expectedStatusCode, status.Code(err))
+				require.EqualError(err, tc.expectedErr)
 				return
 			}
 
@@ -536,20 +521,17 @@ func TestAwsCatalogPersistedState_ReplaceCreds(t *testing.T) {
 		expected             *awsutil.CredentialsConfig
 		expectedDeleteCalled bool
 		expectedErr          string
-		expectedStatusCode   codes.Code
 	}{
 		{
-			name:               "missing new credentials config",
-			in:                 &AwsCredentialPersistedState{},
-			expectedErr:        "missing new credentials config",
-			expectedStatusCode: codes.InvalidArgument,
+			name:        "missing new credentials config",
+			in:          &AwsCredentialPersistedState{},
+			expectedErr: "missing new credentials config",
 		},
 		{
-			name:               "missing credentials config",
-			in:                 &AwsCredentialPersistedState{},
-			credentialConfig:   &awsutil.CredentialsConfig{},
-			expectedErr:        "missing credentials config",
-			expectedStatusCode: codes.InvalidArgument,
+			name:             "missing credentials config",
+			in:               &AwsCredentialPersistedState{},
+			credentialConfig: &awsutil.CredentialsConfig{},
+			expectedErr:      "missing credentials config",
 		},
 		{
 			name: "deletion error",
@@ -567,9 +549,8 @@ func TestAwsCatalogPersistedState_ReplaceCreds(t *testing.T) {
 					),
 				},
 			},
-			credentialConfig:   &awsutil.CredentialsConfig{},
-			expectedErr:        "aws service unknown: unknown error: failed to delete access key",
-			expectedStatusCode: codes.Unknown,
+			credentialConfig: &awsutil.CredentialsConfig{},
+			expectedErr:      fmt.Sprintf("error deleting old access key: %s", testDeleteAccessKeyErr),
 		},
 		{
 			name: "good with delete of old rotated",
@@ -623,12 +604,11 @@ func TestAwsCatalogPersistedState_ReplaceCreds(t *testing.T) {
 	for _, tc := range cases {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
-			require, assert := require.New(t), assert.New(t)
+			require := require.New(t)
 			state.Reset()
 			err := tc.in.ReplaceCreds(context.Background(), tc.credentialConfig)
 			if tc.expectedErr != "" {
-				require.Error(err)
-				assert.ErrorContains(err, tc.expectedErr)
+				require.EqualError(err, tc.expectedErr)
 				return
 			}
 
@@ -643,16 +623,14 @@ func TestAwsCatalogPersistedState_ReplaceCreds(t *testing.T) {
 
 func TestAwsCatalogPersistedState_DeleteCreds(t *testing.T) {
 	cases := []struct {
-		name               string
-		in                 *AwsCredentialPersistedState
-		expectedErr        string
-		expectedStatusCode codes.Code
+		name        string
+		in          *AwsCredentialPersistedState
+		expectedErr string
 	}{
 		{
-			name:               "missing credentials config",
-			in:                 &AwsCredentialPersistedState{},
-			expectedErr:        "missing credentials config",
-			expectedStatusCode: codes.InvalidArgument,
+			name:        "missing credentials config",
+			in:          &AwsCredentialPersistedState{},
+			expectedErr: "missing credentials config",
 		},
 		{
 			name: "cannot delete dynamic credential type",
@@ -663,8 +641,7 @@ func TestAwsCatalogPersistedState_DeleteCreds(t *testing.T) {
 				},
 				CredsLastRotatedTime: time.Now(),
 			},
-			expectedErr:        "invalid credential type",
-			expectedStatusCode: codes.InvalidArgument,
+			expectedErr: "invalid credential type",
 		},
 		{
 			name: "cannot delete unknown credential type",
@@ -675,8 +652,7 @@ func TestAwsCatalogPersistedState_DeleteCreds(t *testing.T) {
 				},
 				CredsLastRotatedTime: time.Now(),
 			},
-			expectedErr:        "invalid credential type",
-			expectedStatusCode: codes.InvalidArgument,
+			expectedErr: "invalid credential type",
 		},
 		{
 			name: "deletion error",
@@ -693,8 +669,7 @@ func TestAwsCatalogPersistedState_DeleteCreds(t *testing.T) {
 					),
 				},
 			},
-			expectedErr:        "aws service unknown: unknown error: failed to delete access key",
-			expectedStatusCode: codes.Unknown,
+			expectedErr: fmt.Sprintf("error deleting old access key: %s", testDeleteAccessKeyErr),
 		},
 		{
 			name: "deletion error, but OK because key was just gone",
@@ -733,11 +708,10 @@ func TestAwsCatalogPersistedState_DeleteCreds(t *testing.T) {
 	for _, tc := range cases {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
-			require, assert := require.New(t), assert.New(t)
+			require := require.New(t)
 			err := tc.in.DeleteCreds(context.Background())
 			if tc.expectedErr != "" {
-				require.Error(err)
-				assert.ErrorContains(err, tc.expectedErr)
+				require.EqualError(err, tc.expectedErr)
 				return
 			}
 

internal/errors/error.go

@@ -4,63 +4,12 @@
 package errors
 
 import (
-	"bytes"
-	"errors"
 	"fmt"
-	"net/http"
 	"sort"
 	"strings"
 
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
-
-	"github.com/aws/aws-sdk-go-v2/aws/retry"
-	awshttp "github.com/aws/aws-sdk-go-v2/aws/transport/http"
-	"github.com/aws/smithy-go"
-	pb "github.com/hashicorp/boundary/sdk/pbs/plugin"
-	"google.golang.org/protobuf/types/known/timestamppb"
-)
-
-const (
-	// awsErrorAccessDenied is returned when the credentials do not have
-	// the required permissions to do a specific action on a resource.
-	// This error will persist until the IAM Role Policy is updated by
-	// the owner. This error cannot be resolved by retrying the request.
-	awsErrorAccessDenied = "AccessDenied"
-
-	// awsErrorInvalidAccessKeyId is returned when the credential does
-	// not exist. This error will persist until the credentials attached
-	// to the storage bucket is updated. This error can occur when the
-	// given credentials are deleted, deactivated, or rotated. This
-	// error cannot be resolved by retrying the request.
-	awsErrorInvalidAccessKeyId = "InvalidAccessKeyId"
-
-	// awsErrorExpiredToken is returned when the provided credential is
-	// expired. This error can only be returned by a dynamic credential
-	// type. This error can resolve itself by retrying the request.
-	awsErrorExpiredToken = "ExpiredToken"
-
-	// NoSuchBucket is returned when the specified S3 storage bucket does
-	// not exist
-	awsErrorNoSuchBucket = "NoSuchBucket"
-
-	// BadDigest is returned when an S3 PUT OBJECT request's calculated
-	// checksum does not match the checksum which was sent by the client
-	awsErrorBadDigest = "BadDigest"
-
-	// NoSuchKey is returned when attempting to interact with an S3 object
-	// whose key does not exist
-	awsErrorNoSuchKey = "NoSuchKey"
-
-	// The InvalidObjectState error is returned when trying to
-	// access an object that was moved into cold storage.
-	awsErrorInvalidObjectState = "InvalidObjectState"
-
-	// RequestTimeout is returned when an http request takes longer than allowed
-	awsErrorRequestTimeout = "RequestTimeout"
-
-	// RequestTimeoutException is returned when an http request takes longer than allowed
-	awsErrorRequestTimeoutException = "RequestTimeoutException"
 )
 
 // InvalidArgumentError returns an grpc invalid argument status error.
@@ -73,146 +22,5 @@ func InvalidArgumentError(msg string, f map[string]string) error {
 		sort.Strings(fieldMsgs)
 		msg = fmt.Sprintf("%s: [%s]", msg, strings.Join(fieldMsgs, ", "))
 	}
-	return BadRequestStatus(msg)
-}
-
-// ParseAWSError converts an aws service error into a RPC status. This method
-// will handle parsing the following aws error codes: throttling, connections,
-// and credentials. This method will fallback to parsing the http status code
-// when it cannot match an aws error code. This method does not handle specific
-// service type errors such as S3 or EC2.
-func ParseAWSError(err error, msg string) (st *status.Status, permission *pb.Permission) {
-	if err == nil {
-		return nil, nil
-	}
-
-	// find the service name of the aws api
-	serviceName := "unknown"
-	var oe *smithy.OperationError
-	if errors.As(err, &oe) {
-		serviceName = oe.Service()
-	}
-
-	// The unknown plugin error code will be used
-	// when the aws service returns an error that
-	// has failed to be parsed. By default, this
-	// error code is retryable.
-
-	defer func() {
-		if st == nil {
-			statusMsg := fmt.Sprintf("aws service %s: unknown error: %s", serviceName, msg)
-			st = status.New(codes.Unknown, statusMsg)
-		}
-		if permission == nil {
-			permission = &pb.Permission{State: pb.StateType_STATE_TYPE_UNKNOWN, CheckedAt: timestamppb.Now()}
-		}
-	}()
-
-	// evaluate against aws throttling error codes
-	throttleErr := retry.ThrottleErrorCode{
-		Codes: retry.DefaultThrottleErrorCodes,
-	}
-	if throttleErr.IsErrorThrottle(err).Bool() {
-		statusMsg := fmt.Sprintf("aws service %s: throttling error: %s", serviceName, msg)
-		return status.New(codes.Unavailable, statusMsg), nil
-	}
-
-	// parse some specific aws error codes that we have special cred states for
-	var apiErr smithy.APIError
-	if errors.As(err, &apiErr) {
-		switch apiErr.ErrorCode() {
-		case awsErrorAccessDenied:
-			fallthrough
-		case awsErrorInvalidAccessKeyId:
-			fallthrough
-		case awsErrorExpiredToken:
-			statusMsg := fmt.Sprintf("aws service %s: invalid credentials error: %s", serviceName, msg)
-			return status.New(codes.PermissionDenied, statusMsg), &pb.Permission{
-				State:        pb.StateType_STATE_TYPE_ERROR,
-				ErrorDetails: apiErr.ErrorMessage(),
-				CheckedAt:    timestamppb.Now(),
-			}
-		case awsErrorNoSuchBucket:
-			statusMsg := fmt.Sprintf("aws %s error: %s", serviceName, msg)
-			return status.New(codes.NotFound, statusMsg), &pb.Permission{
-				State:        pb.StateType_STATE_TYPE_ERROR,
-				ErrorDetails: apiErr.ErrorMessage(),
-				CheckedAt:    timestamppb.Now(),
-			}
-		case awsErrorBadDigest:
-			statusMsg := fmt.Sprintf("aws %s error: %s", serviceName, msg)
-			return status.New(codes.Aborted, statusMsg), nil
-		case awsErrorNoSuchKey:
-			fallthrough
-		case awsErrorInvalidObjectState:
-			statusMsg := fmt.Sprintf("aws %s error: %s", serviceName, msg)
-			return status.New(codes.NotFound, statusMsg), nil
-		case awsErrorRequestTimeout:
-			fallthrough
-		case awsErrorRequestTimeoutException:
-			statusMsg := fmt.Sprintf("aws %s error: %s", serviceName, msg)
-			return status.New(codes.DeadlineExceeded, statusMsg), nil
-		}
-	}
-
-	// default to evaluating the http status code
-	if httpErr, ok := err.(*awshttp.ResponseError); ok {
-		buf := new(bytes.Buffer)
-		_, err = buf.ReadFrom(httpErr.Response.Body)
-		if err != nil {
-			return status.New(codes.Internal, err.Error()), nil
-		}
-		defer httpErr.Response.Body.Close()
-		switch httpErr.HTTPStatusCode() {
-		case http.StatusBadRequest:
-			statusMsg := fmt.Sprintf("aws service %s: bad request error: %s", serviceName, msg)
-			return status.New(codes.InvalidArgument, statusMsg), nil
-		case http.StatusUnauthorized:
-			statusMsg := fmt.Sprintf("aws service %s: invalid credentials error: %s", serviceName, msg)
-			return status.New(codes.PermissionDenied, statusMsg), &pb.Permission{
-				State:        pb.StateType_STATE_TYPE_ERROR,
-				ErrorDetails: buf.String(),
-				CheckedAt:    timestamppb.Now(),
-			}
-		case http.StatusForbidden:
-			statusMsg := fmt.Sprintf("aws service %s: invalid credentials error: %s", serviceName, msg)
-			return status.New(codes.PermissionDenied, statusMsg), &pb.Permission{
-				State:        pb.StateType_STATE_TYPE_ERROR,
-				ErrorDetails: buf.String(),
-				CheckedAt:    timestamppb.Now(),
-			}
-		case http.StatusNotFound:
-			statusMsg := fmt.Sprintf("aws service %s: resource not found error: %s", serviceName, msg)
-			return status.New(codes.NotFound, statusMsg), nil
-		case http.StatusTooManyRequests:
-			statusMsg := fmt.Sprintf("aws service %s: throttling error: %s", serviceName, msg)
-			return status.New(codes.Unavailable, statusMsg), nil
-		case http.StatusInternalServerError:
-			fallthrough
-		case http.StatusBadGateway:
-			fallthrough
-		case http.StatusServiceUnavailable:
-			statusMsg := fmt.Sprintf("aws service %s: connectivity error: %s", serviceName, msg)
-			return status.New(codes.Unavailable, statusMsg), nil
-		case http.StatusRequestTimeout:
-			fallthrough
-		case http.StatusGatewayTimeout:
-			statusMsg := fmt.Sprintf("aws service %s: timeout error: %s", serviceName, msg)
-			return status.New(codes.DeadlineExceeded, statusMsg), nil
-		}
-	}
-
-	return st, nil
-}
-
-// BadRequestStatus returns a status error with an invalid
-// argument code
-func BadRequestStatus(format string, args ...any) error {
-	return status.New(codes.InvalidArgument, fmt.Sprintf(format, args...)).Err()
-}
-
-// UnknownStatus returns a status error with an internal
-// error code
-func UnknownStatus(format string, args ...any) error {
-	return status.New(codes.Internal, fmt.Sprintf(format, args...)).Err()
+	return status.Error(codes.InvalidArgument, msg)
 }

internal/errors/error_test.go

@@ -1,346 +0,0 @@
-package errors
-
-import (
-	"fmt"
-	"testing"
-
-	"net/http"
-
-	pb "github.com/hashicorp/boundary/sdk/pbs/plugin"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-	"google.golang.org/protobuf/types/known/timestamppb"
-)
-
-func Test_ParseAWSError(t *testing.T) {
-	t.Parallel()
-
-	cases := []struct {
-		name               string
-		err                error
-		expectedStatusCode codes.Code
-		expectedStatusMsg  string
-		expectedPermission *pb.Permission
-	}{
-		{
-			name:               "nil-error",
-			expectedStatusCode: codes.OK,
-		},
-		{
-			name:               "default-to-unknwon",
-			err:                fmt.Errorf("what can this error be?"),
-			expectedStatusCode: codes.Unknown,
-			expectedStatusMsg:  "aws service unknown: unknown error: test",
-			expectedPermission: &pb.Permission{
-				State: pb.StateType_STATE_TYPE_UNKNOWN,
-			},
-		},
-		{
-			name:               "http-status-code-bad-request",
-			err:                TestAwsHttpResponseError(http.StatusBadRequest, "bad request"),
-			expectedStatusCode: codes.InvalidArgument,
-			expectedStatusMsg:  "aws service unknown: bad request error: test",
-			expectedPermission: &pb.Permission{
-				State: pb.StateType_STATE_TYPE_UNKNOWN,
-			},
-		},
-		{
-			name:               "http-status-code-unauthorized",
-			err:                TestAwsHttpResponseError(http.StatusUnauthorized, "unauthorized request"),
-			expectedStatusCode: codes.PermissionDenied,
-			expectedStatusMsg:  "aws service unknown: invalid credentials error: test",
-			expectedPermission: &pb.Permission{
-				State:        pb.StateType_STATE_TYPE_ERROR,
-				ErrorDetails: "unauthorized request",
-				CheckedAt:    timestamppb.Now(),
-			},
-		},
-		{
-			name:               "http-status-code-forbidden",
-			err:                TestAwsHttpResponseError(http.StatusForbidden, "forbidden request"),
-			expectedStatusCode: codes.PermissionDenied,
-			expectedStatusMsg:  "aws service unknown: invalid credentials error: test",
-			expectedPermission: &pb.Permission{
-				State:        pb.StateType_STATE_TYPE_ERROR,
-				ErrorDetails: "forbidden request",
-				CheckedAt:    timestamppb.Now(),
-			},
-		},
-		{
-			name:               "http-status-code-not-found",
-			err:                TestAwsHttpResponseError(http.StatusNotFound, "not found request"),
-			expectedStatusCode: codes.NotFound,
-			expectedStatusMsg:  "aws service unknown: resource not found error: test",
-			expectedPermission: &pb.Permission{
-				State: pb.StateType_STATE_TYPE_UNKNOWN,
-			},
-		},
-		{
-			name:               "http-status-code-too-many-requests",
-			err:                TestAwsHttpResponseError(http.StatusTooManyRequests, "too many requests"),
-			expectedStatusCode: codes.Unavailable,
-			expectedStatusMsg:  "aws service unknown: throttling error: test",
-			expectedPermission: &pb.Permission{
-				State: pb.StateType_STATE_TYPE_UNKNOWN,
-			},
-		},
-		{
-			name:               "http-status-code-request-timeout",
-			err:                TestAwsHttpResponseError(http.StatusRequestTimeout, "request timeout"),
-			expectedStatusCode: codes.DeadlineExceeded,
-			expectedStatusMsg:  "aws service unknown: timeout error: test",
-			expectedPermission: &pb.Permission{
-				State: pb.StateType_STATE_TYPE_UNKNOWN,
-			},
-		},
-		{
-			name:               "http-status-code-internal-server-error",
-			err:                TestAwsHttpResponseError(http.StatusInternalServerError, "internal server error"),
-			expectedStatusCode: codes.Unavailable,
-			expectedStatusMsg:  "aws service unknown: connectivity error: test",
-			expectedPermission: &pb.Permission{
-				State: pb.StateType_STATE_TYPE_UNKNOWN,
-			},
-		},
-		{
-			name:               "http-status-code-bad-gateway",
-			err:                TestAwsHttpResponseError(http.StatusBadGateway, "bad gateway"),
-			expectedStatusCode: codes.Unavailable,
-			expectedStatusMsg:  "aws service unknown: connectivity error: test",
-			expectedPermission: &pb.Permission{
-				State: pb.StateType_STATE_TYPE_UNKNOWN,
-			},
-		},
-		{
-			name:               "http-status-code-service-unavailable",
-			err:                TestAwsHttpResponseError(http.StatusServiceUnavailable, "service unavailable"),
-			expectedStatusCode: codes.Unavailable,
-			expectedStatusMsg:  "aws service unknown: connectivity error: test",
-			expectedPermission: &pb.Permission{
-				State: pb.StateType_STATE_TYPE_UNKNOWN,
-			},
-		},
-		{
-			name:               "http-status-code-gateway-timeout",
-			err:                TestAwsHttpResponseError(http.StatusGatewayTimeout, "gateway timeout"),
-			expectedStatusCode: codes.DeadlineExceeded,
-			expectedStatusMsg:  "aws service unknown: timeout error: test",
-			expectedPermission: &pb.Permission{
-				State: pb.StateType_STATE_TYPE_UNKNOWN,
-			},
-		},
-		{
-			name:               "aws-throttling",
-			err:                TestAwsError("Throttling", "throttling error"),
-			expectedStatusCode: codes.Unavailable,
-			expectedStatusMsg:  "aws service unknown: throttling error: test",
-			expectedPermission: &pb.Permission{
-				State: pb.StateType_STATE_TYPE_UNKNOWN,
-			},
-		},
-		{
-			name:               "aws-throttling-exception",
-			err:                TestAwsError("ThrottlingException", "throttling exception"),
-			expectedStatusCode: codes.Unavailable,
-			expectedStatusMsg:  "aws service unknown: throttling error: test",
-			expectedPermission: &pb.Permission{
-				State: pb.StateType_STATE_TYPE_UNKNOWN,
-			},
-		},
-		{
-			name:               "aws-throttled-exception",
-			err:                TestAwsError("ThrottledException", "throttled exception"),
-			expectedStatusCode: codes.Unavailable,
-			expectedStatusMsg:  "aws service unknown: throttling error: test",
-			expectedPermission: &pb.Permission{
-				State: pb.StateType_STATE_TYPE_UNKNOWN,
-			},
-		},
-		{
-			name:               "aws-request-throttled-exception",
-			err:                TestAwsError("RequestThrottledException", "request throttled exception"),
-			expectedStatusCode: codes.Unavailable,
-			expectedStatusMsg:  "aws service unknown: throttling error: test",
-			expectedPermission: &pb.Permission{
-				State: pb.StateType_STATE_TYPE_UNKNOWN,
-			},
-		},
-		{
-			name:               "aws-request-too-many-requests-exception",
-			err:                TestAwsError("TooManyRequestsException", "too many requests exception"),
-			expectedStatusCode: codes.Unavailable,
-			expectedStatusMsg:  "aws service unknown: throttling error: test",
-			expectedPermission: &pb.Permission{
-				State: pb.StateType_STATE_TYPE_UNKNOWN,
-			},
-		},
-		{
-			name:               "aws-request-provisioned-throughput-exceeded-exception",
-			err:                TestAwsError("ProvisionedThroughputExceededException", "provisioned throughput exceeded exception"),
-			expectedStatusCode: codes.Unavailable,
-			expectedStatusMsg:  "aws service unknown: throttling error: test",
-			expectedPermission: &pb.Permission{
-				State: pb.StateType_STATE_TYPE_UNKNOWN,
-			},
-		},
-		{
-			name:               "aws-request-transaction-in-progress-exception",
-			err:                TestAwsError("TransactionInProgressException", "transaction in progress exception"),
-			expectedStatusCode: codes.Unavailable,
-			expectedStatusMsg:  "aws service unknown: throttling error: test",
-			expectedPermission: &pb.Permission{
-				State: pb.StateType_STATE_TYPE_UNKNOWN,
-			},
-		},
-		{
-			name:               "aws-request-limit-exceeded",
-			err:                TestAwsError("RequestLimitExceeded", "request limit exceeded"),
-			expectedStatusCode: codes.Unavailable,
-			expectedStatusMsg:  "aws service unknown: throttling error: test",
-			expectedPermission: &pb.Permission{
-				State: pb.StateType_STATE_TYPE_UNKNOWN,
-			},
-		},
-		{
-			name:               "aws-request-bandwidth-limit-exceeded",
-			err:                TestAwsError("BandwidthLimitExceeded", "bandwidth limit exceeded"),
-			expectedStatusCode: codes.Unavailable,
-			expectedStatusMsg:  "aws service unknown: throttling error: test",
-			expectedPermission: &pb.Permission{
-				State: pb.StateType_STATE_TYPE_UNKNOWN,
-			},
-		},
-		{
-			name:               "aws-request-limit-exceeded-exception",
-			err:                TestAwsError("LimitExceededException", "limit exceeded exception"),
-			expectedStatusCode: codes.Unavailable,
-			expectedStatusMsg:  "aws service unknown: throttling error: test",
-			expectedPermission: &pb.Permission{
-				State: pb.StateType_STATE_TYPE_UNKNOWN,
-			},
-		},
-		{
-			name:               "aws-request-throttled",
-			err:                TestAwsError("RequestThrottled", "request throttled"),
-			expectedStatusCode: codes.Unavailable,
-			expectedStatusMsg:  "aws service unknown: throttling error: test",
-			expectedPermission: &pb.Permission{
-				State: pb.StateType_STATE_TYPE_UNKNOWN,
-			},
-		},
-		{
-			name:               "aws-request-slow-down",
-			err:                TestAwsError("SlowDown", "slow down"),
-			expectedStatusCode: codes.Unavailable,
-			expectedStatusMsg:  "aws service unknown: throttling error: test",
-			expectedPermission: &pb.Permission{
-				State: pb.StateType_STATE_TYPE_UNKNOWN,
-			},
-		},
-		{
-			name:               "aws-request-prior-request-not-complete",
-			err:                TestAwsError("PriorRequestNotComplete", "prior request not complete"),
-			expectedStatusCode: codes.Unavailable,
-			expectedStatusMsg:  "aws service unknown: throttling error: test",
-			expectedPermission: &pb.Permission{
-				State: pb.StateType_STATE_TYPE_UNKNOWN,
-			},
-		},
-		{
-			name:               "aws-request-ec2-throttled-exception",
-			err:                TestAwsError("EC2ThrottledException", "ec2 throttled exception"),
-			expectedStatusCode: codes.Unavailable,
-			expectedStatusMsg:  "aws service unknown: throttling error: test",
-			expectedPermission: &pb.Permission{
-				State: pb.StateType_STATE_TYPE_UNKNOWN,
-			},
-		},
-		{
-			name:               "aws-request-timeout",
-			err:                TestAwsError("RequestTimeout", "request timeout"),
-			expectedStatusCode: codes.DeadlineExceeded,
-			expectedStatusMsg:  "aws unknown error: test",
-			expectedPermission: &pb.Permission{
-				State: pb.StateType_STATE_TYPE_UNKNOWN,
-			},
-		},
-		{
-			name:               "aws-request-timeout-exception",
-			err:                TestAwsError("RequestTimeoutException", "request timeout exception"),
-			expectedStatusCode: codes.DeadlineExceeded,
-			expectedStatusMsg:  "aws unknown error: test",
-			expectedPermission: &pb.Permission{
-				State: pb.StateType_STATE_TYPE_UNKNOWN,
-			},
-		},
-		{
-			name:               "aws-request-access-denied",
-			err:                TestAwsError(awsErrorAccessDenied, "not authorized to perform action"),
-			expectedStatusCode: codes.PermissionDenied,
-			expectedStatusMsg:  "aws service unknown: invalid credentials error: test",
-			expectedPermission: &pb.Permission{
-				State:        pb.StateType_STATE_TYPE_ERROR,
-				ErrorDetails: "not authorized to perform action",
-				CheckedAt:    timestamppb.Now(),
-			},
-		},
-		{
-			name:               "aws-request-invalid-access-key-id",
-			err:                TestAwsError(awsErrorInvalidAccessKeyId, "The AWS Access Key Id you provided does not exist in our records."),
-			expectedStatusCode: codes.PermissionDenied,
-			expectedStatusMsg:  "aws service unknown: invalid credentials error: test",
-			expectedPermission: &pb.Permission{
-				State:        pb.StateType_STATE_TYPE_ERROR,
-				ErrorDetails: "The AWS Access Key Id you provided does not exist in our records.",
-				CheckedAt:    timestamppb.Now(),
-			},
-		},
-		{
-			name:               "aws-request-expired-token",
-			err:                TestAwsError(awsErrorExpiredToken, "The security token included in the request is expired."),
-			expectedStatusCode: codes.PermissionDenied,
-			expectedStatusMsg:  "aws service unknown: invalid credentials error: test",
-			expectedPermission: &pb.Permission{
-				State:        pb.StateType_STATE_TYPE_ERROR,
-				ErrorDetails: "The security token included in the request is expired.",
-				CheckedAt:    timestamppb.Now(),
-			},
-		},
-	}
-	for _, tt := range cases {
-		t.Run(tt.name, func(t *testing.T) {
-			require, assert := require.New(t), assert.New(t)
-
-			actualStatus, permission := ParseAWSError(tt.err, "test")
-			if tt.expectedStatusCode == codes.OK {
-				require.Nil(actualStatus)
-				return
-			}
-
-			require.Equal(tt.expectedStatusCode, actualStatus.Code())
-			require.Equal(tt.expectedStatusMsg, actualStatus.Message())
-			require.Len(actualStatus.Details(), 0)
-			CheckSimilarPermission(assert, tt.expectedPermission, permission, true)
-		})
-	}
-}
-
-func Test_BadRequestStatus(t *testing.T) {
-	require, assert := require.New(t), assert.New(t)
-	err := BadRequestStatus("test: %s", "hello world")
-	assert.ErrorContains(err, "test: hello world")
-	assert.Equal(status.Code(err), codes.InvalidArgument)
-	_, ok := status.FromError(err)
-	require.True(ok)
-}
-
-func Test_UnknownStatus(t *testing.T) {
-	require, assert := require.New(t), assert.New(t)
-	err := UnknownStatus("test: %s", "hello world")
-	assert.ErrorContains(err, "test: hello world")
-	assert.Equal(status.Code(err), codes.Internal)
-	_, ok := status.FromError(err)
-	require.True(ok)
-}

internal/errors/testing.go

@@ -1,57 +0,0 @@
-package errors
-
-import (
-	"io"
-	"net/http"
-	"strings"
-
-	awshttp "github.com/aws/aws-sdk-go-v2/aws/transport/http"
-	"github.com/aws/smithy-go"
-	smithyhttp "github.com/aws/smithy-go/transport/http"
-	pb "github.com/hashicorp/boundary/sdk/pbs/plugin"
-	"github.com/stretchr/testify/assert"
-	"google.golang.org/protobuf/types/known/timestamppb"
-)
-
-// TestAwsHttpResponseError returns an aws http response error
-func TestAwsHttpResponseError(code int, msg string) error {
-	return &awshttp.ResponseError{
-		ResponseError: &smithyhttp.ResponseError{
-			Response: &smithyhttp.Response{
-				Response: &http.Response{
-					StatusCode: code,
-					Body:       io.NopCloser(strings.NewReader(msg)),
-				},
-			},
-		},
-	}
-}
-
-// TestAwsError returns an generic api error
-func TestAwsError(code, msg string) error {
-	return &smithy.GenericAPIError{
-		Code:    code,
-		Message: msg,
-		Fault:   smithy.FaultServer,
-	}
-}
-
-func CheckSimilarPermission(assert *assert.Assertions, expected, actual *pb.Permission, substituteNilWithDefaultOk bool) {
-	if expected == nil && substituteNilWithDefaultOk {
-		expected = &pb.Permission{
-			State:     pb.StateType_STATE_TYPE_OK,
-			CheckedAt: timestamppb.Now(),
-		}
-	}
-
-	if expected != nil {
-		assert.NotNil(actual)
-		if actual != nil {
-			assert.Equal(expected.State, actual.State, "StateType mismatch")
-			assert.Equal(expected.ErrorDetails, actual.ErrorDetails)
-			assert.NotNil(actual.CheckedAt)
-		}
-	} else {
-		assert.Equal(expected, actual)
-	}
-}

plugin/service/host/plugin_test.go

@@ -79,6 +79,27 @@ func TestPluginOnCreateCatalogErr(t *testing.T) {
 			expectedErrContains: "missing required value \"access_key_id\"",
 			expectedErrCode:     codes.InvalidArgument,
 		},
+		{
+			name: "invalid region",
+			req: &pb.OnCreateCatalogRequest{
+				Catalog: &hostcatalogs.HostCatalog{
+					Secrets: &structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							credential.ConstAccessKeyId:     structpb.NewStringValue("AKIA_foobar"),
+							credential.ConstSecretAccessKey: structpb.NewStringValue("bazqux"),
+						}},
+					Attrs: &hostcatalogs.HostCatalog_Attributes{
+						Attributes: &structpb.Struct{
+							Fields: map[string]*structpb.Value{
+								credential.ConstRegion: structpb.NewStringValue("foobar"),
+							},
+						},
+					},
+				},
+			},
+			expectedErrContains: "not a valid region: foobar",
+			expectedErrCode:     codes.InvalidArgument,
+		},
 		{
 			name: "persisted state setup error",
 			req: &pb.OnCreateCatalogRequest{
@@ -132,7 +153,7 @@ func TestPluginOnCreateCatalogErr(t *testing.T) {
 					),
 				}),
 			},
-			expectedErrContains: "aws service unknown: unknown error: error rotating credentials",
+			expectedErrContains: fmt.Sprintf("error during credential rotation: error rotating credentials: error calling CreateAccessKey: error calling iam.GetUser: %s", testGetUserErr),
 			expectedErrCode:     codes.InvalidArgument,
 		},
 		{
@@ -163,7 +184,7 @@ func TestPluginOnCreateCatalogErr(t *testing.T) {
 					),
 				}),
 			},
-			expectedErrContains: "aws service unknown: unknown error: validating credentials",
+			expectedErrContains: fmt.Sprintf("error during credential validation: error validating credentials: %s", testGetCallerIdentityErr),
 			expectedErrCode:     codes.InvalidArgument,
 		},
 	}
@@ -177,7 +198,6 @@ func TestPluginOnCreateCatalogErr(t *testing.T) {
 				testCatalogStateOpts: tc.catalogOpts,
 			}
 			_, err := p.OnCreateCatalog(context.Background(), tc.req)
-			require.Error(err)
 			require.Contains(err.Error(), tc.expectedErrContains)
 			require.Equal(status.Code(err).String(), tc.expectedErrCode.String())
 		})
@@ -222,6 +242,22 @@ func TestPluginOnUpdateCatalogErr(t *testing.T) {
 			expectedErrContains: "missing required value \"region\"",
 			expectedErrCode:     codes.InvalidArgument,
 		},
+		{
+			name: "invalid region",
+			req: &pb.OnUpdateCatalogRequest{
+				NewCatalog: &hostcatalogs.HostCatalog{
+					Attrs: &hostcatalogs.HostCatalog_Attributes{
+						Attributes: &structpb.Struct{
+							Fields: map[string]*structpb.Value{
+								credential.ConstRegion: structpb.NewStringValue("foobar"),
+							},
+						},
+					},
+				},
+			},
+			expectedErrContains: "not a valid region: foobar",
+			expectedErrCode:     codes.InvalidArgument,
+		},
 		{
 			name: "persisted state setup error",
 			req: &pb.OnUpdateCatalogRequest{
@@ -342,7 +378,7 @@ func TestPluginOnUpdateCatalogErr(t *testing.T) {
 					),
 				}),
 			},
-			expectedErrContains: "aws service unknown: unknown error: failed to delete access key",
+			expectedErrContains: fmt.Sprintf("error attempting to replace credentials: error deleting old access key: %s", testDeleteAccessKeyErr),
 			expectedErrCode:     codes.InvalidArgument,
 		},
 		{
@@ -375,7 +411,7 @@ func TestPluginOnUpdateCatalogErr(t *testing.T) {
 					),
 				}),
 			},
-			expectedErrContains: "aws service unknown: unknown error: error rotating credentials",
+			expectedErrContains: fmt.Sprintf("error during credential rotation: error rotating credentials: error calling CreateAccessKey: error calling iam.GetUser: %s", testGetUserErr),
 			expectedErrCode:     codes.InvalidArgument,
 		},
 	}
@@ -389,7 +425,6 @@ func TestPluginOnUpdateCatalogErr(t *testing.T) {
 				testCatalogStateOpts: tc.catalogOpts,
 			}
 			_, err := p.OnUpdateCatalog(context.Background(), tc.req)
-			require.Error(err)
 			require.Contains(err.Error(), tc.expectedErrContains)
 			require.Equal(status.Code(err).String(), tc.expectedErrCode.String())
 		})
@@ -466,7 +501,7 @@ func TestPluginOnDeleteCatalogErr(t *testing.T) {
 					),
 				}),
 			},
-			expectedErrContains: "aws service unknown: unknown error: failed to delete access key",
+			expectedErrContains: fmt.Sprintf("error removing rotated credentials during catalog deletion: error deleting old access key: %s", testDeleteAccessKeyErr),
 			expectedErrCode:     codes.Aborted,
 		},
 	}
@@ -480,7 +515,6 @@ func TestPluginOnDeleteCatalogErr(t *testing.T) {
 				testCatalogStateOpts: tc.catalogOpts,
 			}
 			_, err := p.OnDeleteCatalog(context.Background(), tc.req)
-			require.Error(err)
 			require.Contains(err.Error(), tc.expectedErrContains)
 			require.Equal(status.Code(err).String(), tc.expectedErrCode.String())
 		})
@@ -525,6 +559,22 @@ func TestPluginOnCreateSetErr(t *testing.T) {
 			expectedErrContains: "missing required value \"region\"",
 			expectedErrCode:     codes.InvalidArgument,
 		},
+		{
+			name: "invalid region",
+			req: &pb.OnCreateSetRequest{
+				Catalog: &hostcatalogs.HostCatalog{
+					Attrs: &hostcatalogs.HostCatalog_Attributes{
+						Attributes: &structpb.Struct{
+							Fields: map[string]*structpb.Value{
+								credential.ConstRegion: structpb.NewStringValue("foobar"),
+							},
+						},
+					},
+				},
+			},
+			expectedErrContains: "not a valid region: foobar",
+			expectedErrCode:     codes.InvalidArgument,
+		},
 		{
 			name: "persisted state setup error",
 			req: &pb.OnCreateSetRequest{
@@ -833,7 +883,6 @@ func TestPluginOnCreateSetErr(t *testing.T) {
 				testCatalogStateOpts: tc.catalogOpts,
 			}
 			_, err := p.OnCreateSet(context.Background(), tc.req)
-			require.Error(err)
 			require.Contains(err.Error(), tc.expectedErrContains)
 			require.Equal(status.Code(err).String(), tc.expectedErrCode.String())
 		})
@@ -878,6 +927,23 @@ func TestPluginOnUpdateSetErr(t *testing.T) {
 			expectedErrContains: "missing required value \"region\"",
 			expectedErrCode:     codes.InvalidArgument,
 		},
+		{
+			name: "invalid region",
+			req: &pb.OnUpdateSetRequest{
+				Catalog: &hostcatalogs.HostCatalog{
+					Secrets: new(structpb.Struct),
+					Attrs: &hostcatalogs.HostCatalog_Attributes{
+						Attributes: &structpb.Struct{
+							Fields: map[string]*structpb.Value{
+								credential.ConstRegion: structpb.NewStringValue("foobar"),
+							},
+						},
+					},
+				},
+			},
+			expectedErrContains: "not a valid region: foobar",
+			expectedErrCode:     codes.InvalidArgument,
+		},
 		{
 			name: "persisted state setup error",
 			req: &pb.OnUpdateSetRequest{
@@ -1141,7 +1207,6 @@ func TestPluginOnUpdateSetErr(t *testing.T) {
 				testCatalogStateOpts: tc.catalogOpts,
 			}
 			_, err := p.OnUpdateSet(context.Background(), tc.req)
-			require.Error(err)
 			require.Contains(err.Error(), tc.expectedErrContains)
 			require.Equal(status.Code(err).String(), tc.expectedErrCode.String())
 		})
@@ -1186,6 +1251,23 @@ func TestPluginListHostsErr(t *testing.T) {
 			expectedErrContains: "attributes.region: missing required value \"region\"",
 			expectedErrCode:     codes.InvalidArgument,
 		},
+		{
+			name: "invalid region",
+			req: &pb.ListHostsRequest{
+				Catalog: &hostcatalogs.HostCatalog{
+					Secrets: new(structpb.Struct),
+					Attrs: &hostcatalogs.HostCatalog_Attributes{
+						Attributes: &structpb.Struct{
+							Fields: map[string]*structpb.Value{
+								credential.ConstRegion: structpb.NewStringValue("foobar"),
+							},
+						},
+					},
+				},
+			},
+			expectedErrContains: "not a valid region: ",
+			expectedErrCode:     codes.InvalidArgument,
+		},
 		{
 			name: "persisted state setup error",
 			req: &pb.ListHostsRequest{
@@ -1504,7 +1586,6 @@ func TestPluginListHostsErr(t *testing.T) {
 				testCatalogStateOpts: tc.catalogOpts,
 			}
 			_, err := p.ListHosts(context.Background(), tc.req)
-			require.Error(err)
 			require.Contains(err.Error(), tc.expectedErrContains)
 			require.Equal(status.Code(err).String(), tc.expectedErrCode.String())
 		})

plugin/service/storage/README.md

@@ -68,7 +68,7 @@ The following `attributes` are valid on an AWS storage bucket resource:
 - `disable_credential_rotation` (bool): If `true`, credential rotation will not
   be performed.
 - `region` (string): The region to configure the storage bucket for.
-- `endpoint_url` (string): The endpoint to configure the storage.
+- `endpoint-url` (string): The endpoint to configure the storage.
 - `role_arn` (string): The role arn configured for the assume role provider.
 - `role_external_id` (string):  The external id configured for the assume role provider.
 - `role_session_name` (string): The session name configured for the assume role provider.

plugin/service/storage/attributes_test.go

@@ -7,8 +7,6 @@ import (
 	"testing"
 
 	cred "github.com/hashicorp/boundary-plugin-aws/internal/credential"
-	pb "github.com/hashicorp/boundary/sdk/pbs/plugin"
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
@@ -21,7 +19,6 @@ func TestGetStorageAttributes(t *testing.T) {
 		in                  *structpb.Struct
 		expected            *StorageAttributes
 		expectedErrContains string
-		expectedDetails     *pb.StorageBucketCredentialState
 	}{
 		{
 			name: "missing region",
@@ -103,17 +100,13 @@ func TestGetStorageAttributes(t *testing.T) {
 	for _, tc := range cases {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
-			require, assert := require.New(t), assert.New(t)
+			require := require.New(t)
 
 			actual, err := getStorageAttributes(tc.in)
 			if tc.expectedErrContains != "" {
 				require.Error(err)
 				require.Contains(err.Error(), tc.expectedErrContains)
-				require.Equal(codes.InvalidArgument, status.Code(err))
-
-				st, ok := status.FromError(err)
-				require.True(ok)
-				assert.Len(st.Details(), 0)
+				require.Equal(status.Code(err), codes.InvalidArgument)
 				return
 			}
 

plugin/service/storage/error.go

@@ -1,68 +0,0 @@
-package storage
-
-import (
-	"github.com/hashicorp/boundary-plugin-aws/internal/errors"
-	pb "github.com/hashicorp/boundary/sdk/pbs/plugin"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-)
-
-const (
-	s3StatusErrMsg = "aws s3 error: %s"
-
-	// s3ErrorBadDigest is returned when there is a checksum
-	// mismatch between the request and the s3 service. This
-	// error code is returned for the PutObject request.
-	s3ErrorBadDigest = "BadDigest"
-)
-
-func setStatePermission(req any, permission *pb.Permission) *pb.StorageBucketCredentialState {
-	state := &pb.StorageBucketCredentialState{
-		State: &pb.Permissions{},
-	}
-	switch req.(type) {
-	case pb.HeadObjectRequest:
-		state.State.Read = permission
-	case *pb.HeadObjectRequest:
-		state.State.Read = permission
-	case pb.GetObjectRequest:
-		state.State.Read = permission
-	case *pb.GetObjectRequest:
-		state.State.Read = permission
-	case pb.PutObjectRequest:
-		state.State.Write = permission
-	case *pb.PutObjectRequest:
-		state.State.Write = permission
-	case pb.DeleteObjectsRequest:
-		state.State.Delete = permission
-	case *pb.DeleteObjectsRequest:
-		state.State.Delete = permission
-	}
-	return state
-}
-
-// parseS3Error will convert an S3 api error into a RPC status. If the
-// error does not match against an s3 error type, it will fallback to
-// evaluating against generic aws service errors. This includes throttling,
-// credentials, and connectivity error types.
-//
-// https://docs.aws.amazon.com/AmazonS3/latest/API/ErrorResponses.html
-func parseS3Error(err error, msg string, req any) *status.Status {
-	if err == nil {
-		return nil
-	}
-
-	st, p := errors.ParseAWSError(err, msg)
-	if p != nil {
-		state := setStatePermission(req, p)
-		if st, err = st.WithDetails(state); err != nil {
-			st = status.New(codes.Internal, err.Error())
-		}
-	}
-
-	return st
-}
-
-func checksumMistmatchStatus() error {
-	return status.New(codes.Aborted, "mismatched checksum").Err()
-}

plugin/service/storage/error_test.go

@@ -1,180 +0,0 @@
-package storage
-
-import (
-	"testing"
-
-	"github.com/hashicorp/boundary-plugin-aws/internal/errors"
-	pb "github.com/hashicorp/boundary/sdk/pbs/plugin"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/protobuf/types/known/timestamppb"
-)
-
-func Test_ParseS3Error(t *testing.T) {
-	t.Parallel()
-
-	cases := []struct {
-		name               string
-		req                any
-		err                error
-		expectedStatusCode codes.Code
-		expectedStatusMsg  string
-		expectedDetails    *pb.StorageBucketCredentialState
-	}{
-		{
-			name:               "nil-error",
-			expectedStatusCode: codes.OK,
-		},
-		{
-			name:               "no-such-bucket",
-			req:                &pb.GetObjectRequest{},
-			err:                TestAwsS3Error("NoSuchBucket", "GetObject", "no such bucket"),
-			expectedStatusCode: codes.NotFound,
-			expectedStatusMsg:  "aws s3 error: test",
-			expectedDetails: &pb.StorageBucketCredentialState{
-				State: &pb.Permissions{
-					Read: &pb.Permission{
-						State:        pb.StateType_STATE_TYPE_ERROR,
-						ErrorDetails: "no such bucket",
-						CheckedAt:    timestamppb.Now(),
-					},
-				},
-			},
-		},
-		{
-			name:               "no-such-key",
-			req:                &pb.GetObjectRequest{},
-			err:                TestAwsS3Error("NoSuchKey", "GetObject", "no such key"),
-			expectedStatusCode: codes.NotFound,
-			expectedStatusMsg:  "aws s3 error: test",
-			expectedDetails: &pb.StorageBucketCredentialState{
-				State: &pb.Permissions{
-					Read: &pb.Permission{
-						State:     pb.StateType_STATE_TYPE_UNKNOWN,
-						CheckedAt: timestamppb.Now(),
-					},
-				},
-			},
-		},
-		{
-			name:               "not-found",
-			req:                &pb.GetObjectRequest{},
-			err:                errors.TestAwsHttpResponseError(404, "not found"),
-			expectedStatusCode: codes.NotFound,
-			// cannot embed services within mock http errors, therefore unknown service
-			expectedStatusMsg: "aws service unknown: resource not found error: test",
-			expectedDetails: &pb.StorageBucketCredentialState{
-				State: &pb.Permissions{
-					Read: &pb.Permission{
-						State:     pb.StateType_STATE_TYPE_UNKNOWN,
-						CheckedAt: timestamppb.Now(),
-					},
-				},
-			},
-		},
-		{
-			name:               "invalid-object-state",
-			req:                &pb.GetObjectRequest{},
-			err:                TestAwsS3Error("InvalidObjectState", "GetObject", "invalid object state"),
-			expectedStatusCode: codes.NotFound,
-			expectedStatusMsg:  "aws s3 error: test",
-			expectedDetails: &pb.StorageBucketCredentialState{
-				State: &pb.Permissions{
-					Read: &pb.Permission{
-						State:     pb.StateType_STATE_TYPE_UNKNOWN,
-						CheckedAt: timestamppb.Now(),
-					},
-				},
-			},
-		},
-		{
-			name:               "bad-digest",
-			req:                &pb.PutObjectRequest{},
-			err:                TestAwsS3Error(s3ErrorBadDigest, "PutObject", "checksum mismatch"),
-			expectedStatusCode: codes.Aborted,
-			expectedStatusMsg:  "aws s3 error: test",
-			expectedDetails: &pb.StorageBucketCredentialState{
-				State: &pb.Permissions{
-					Write: &pb.Permission{
-						State:     pb.StateType_STATE_TYPE_UNKNOWN,
-						CheckedAt: timestamppb.Now(),
-					},
-				},
-			},
-		},
-		{
-			name:               "fallback-throttle-error",
-			req:                &pb.GetObjectRequest{},
-			err:                TestAwsS3Error("Throttling", "action", "throttling exception"),
-			expectedStatusCode: codes.Unavailable,
-			expectedStatusMsg:  "aws service s3: throttling error: test",
-			expectedDetails: &pb.StorageBucketCredentialState{
-				State: &pb.Permissions{
-					Read: &pb.Permission{
-						State:     pb.StateType_STATE_TYPE_UNKNOWN,
-						CheckedAt: timestamppb.Now(),
-					},
-				},
-			},
-		},
-		{
-			name:               "fallback-connectivity-error",
-			req:                &pb.GetObjectRequest{},
-			err:                TestAwsS3Error("RequestTimeout", "action", "request timeout"),
-			expectedStatusCode: codes.DeadlineExceeded,
-			expectedStatusMsg:  "aws s3 error: test",
-			expectedDetails: &pb.StorageBucketCredentialState{
-				State: &pb.Permissions{
-					Read: &pb.Permission{
-						State:     pb.StateType_STATE_TYPE_UNKNOWN,
-						CheckedAt: timestamppb.Now(),
-					},
-				},
-			},
-		},
-		{
-			name:               "fallback-credentials-error",
-			req:                &pb.GetObjectRequest{},
-			err:                TestAwsS3Error("AccessDenied", "action", "access denied"),
-			expectedStatusCode: codes.PermissionDenied,
-			expectedStatusMsg:  "aws service s3: invalid credentials error: test",
-			expectedDetails: &pb.StorageBucketCredentialState{
-				State: &pb.Permissions{
-					Read: &pb.Permission{
-						State:        pb.StateType_STATE_TYPE_ERROR,
-						ErrorDetails: "access denied",
-						CheckedAt:    timestamppb.Now(),
-					},
-				},
-			},
-		},
-	}
-	for _, tt := range cases {
-		t.Run(tt.name, func(t *testing.T) {
-			require, assert := require.New(t), assert.New(t)
-
-			actualStatus := parseS3Error(tt.err, "test", tt.req)
-			if tt.expectedStatusCode == codes.OK {
-				require.Nil(actualStatus)
-				return
-			}
-
-			require.Equal(tt.expectedStatusCode, actualStatus.Code())
-			require.Equal(tt.expectedStatusMsg, actualStatus.Message())
-			require.Len(actualStatus.Details(), 1)
-
-			foundDetail := false
-			for _, detail := range actualStatus.Details() {
-				switch errDetail := detail.(type) {
-				case *pb.StorageBucketCredentialState:
-					foundDetail = true
-					errors.CheckSimilarPermission(assert, tt.expectedDetails.State.Read, errDetail.State.Read, false)
-					errors.CheckSimilarPermission(assert, tt.expectedDetails.State.Write, errDetail.State.Write, false)
-					errors.CheckSimilarPermission(assert, tt.expectedDetails.State.Delete, errDetail.State.Delete, false)
-				}
-			}
-			require.True(foundDetail, "did not find error details with status")
-		})
-	}
-}

plugin/service/storage/plugin.go

@@ -9,21 +9,18 @@ import (
 	"context"
 	"crypto/sha256"
 	"encoding/base64"
-	"fmt"
 	"io"
 	"os"
 	"path"
-	"strings"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/aws/retry"
 	"github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	"github.com/google/uuid"
 	cred "github.com/hashicorp/boundary-plugin-aws/internal/credential"
-	"github.com/hashicorp/boundary-plugin-aws/internal/errors"
 	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/storagebuckets"
 	pb "github.com/hashicorp/boundary/sdk/pbs/plugin"
-	"github.com/hashicorp/go-multierror"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/types/known/timestamppb"
@@ -48,15 +45,15 @@ type StoragePlugin struct {
 func (p *StoragePlugin) OnCreateStorageBucket(ctx context.Context, req *pb.OnCreateStorageBucketRequest) (*pb.OnCreateStorageBucketResponse, error) {
 	bucket := req.GetBucket()
 	if bucket == nil {
-		return nil, errors.BadRequestStatus("bucket is required")
+		return nil, status.Error(codes.InvalidArgument, "bucket is required")
 	}
 	if bucket.BucketName == "" {
-		return nil, errors.BadRequestStatus("bucketName is required")
+		return nil, status.Error(codes.InvalidArgument, "bucketName is required")
 	}
 
 	attrs := bucket.GetAttributes()
 	if attrs == nil {
-		return nil, errors.BadRequestStatus("attributes is required")
+		return nil, status.Error(codes.InvalidArgument, "attributes is required")
 	}
 
 	storageAttributes, err := getStorageAttributes(attrs)
@@ -76,13 +73,13 @@ func (p *StoragePlugin) OnCreateStorageBucket(ctx context.Context, req *pb.OnCre
 		}, p.testCredStateOpts...)...,
 	)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error setting up persisted state: %s", err)
+		return nil, status.Errorf(codes.InvalidArgument, "error setting up persisted state: %s", err)
 	}
 
 	// Try to rotate AWS static credentials
 	if cred.GetCredentialType(credConfig) == cred.StaticAWS && !storageAttributes.DisableCredentialRotation {
 		if err := credState.RotateCreds(ctx); err != nil {
-			return nil, err
+			return nil, status.Errorf(codes.InvalidArgument, "error during credential rotation: %s", err)
 		}
 	}
 
@@ -92,17 +89,17 @@ func (p *StoragePlugin) OnCreateStorageBucket(ctx context.Context, req *pb.OnCre
 		}, p.testStorageStateOpts...)...,
 	)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error setting up persisted state: %s", err)
+		return nil, status.Errorf(codes.InvalidArgument, "error setting up persisted state: %s", err)
 	}
 
 	// perform dry run to ensure we can interact with the bucket as expected.
-	if st := dryRunValidation(ctx, storageState, storageAttributes, bucket); st != nil {
-		return nil, st.Err()
+	if err := dryRunValidation(ctx, storageState, storageAttributes, bucket); err != nil {
+		return nil, err
 	}
 
 	persistedProto, err := storageState.toProto()
 	if err != nil {
-		return nil, errors.BadRequestStatus(err.Error())
+		return nil, status.Error(codes.InvalidArgument, err.Error())
 	}
 
 	return &pb.OnCreateStorageBucketResponse{
@@ -117,19 +114,19 @@ func (p *StoragePlugin) OnUpdateStorageBucket(ctx context.Context, req *pb.OnUpd
 	// fetching the new copy to keep things a little less messy.
 	newBucket := req.GetNewBucket()
 	if newBucket == nil {
-		return nil, errors.BadRequestStatus("new bucket is required")
+		return nil, status.Error(codes.InvalidArgument, "new bucket is required")
 	}
 	if newBucket.BucketName == "" {
-		return nil, errors.BadRequestStatus("new bucketName is required")
+		return nil, status.Error(codes.InvalidArgument, "new bucketName is required")
 	}
 	currentBucket := req.GetCurrentBucket()
 	if currentBucket == nil {
-		return nil, errors.BadRequestStatus("current bucket is required")
+		return nil, status.Error(codes.InvalidArgument, "current bucket is required")
 	}
 
 	oldAttrs := currentBucket.GetAttributes()
 	if oldAttrs == nil {
-		return nil, errors.BadRequestStatus("current bucket attributes is required")
+		return nil, status.Error(codes.InvalidArgument, "current bucket attributes is required")
 	}
 	oldStorageAttributes, err := getStorageAttributes(oldAttrs)
 	if err != nil {
@@ -137,7 +134,7 @@ func (p *StoragePlugin) OnUpdateStorageBucket(ctx context.Context, req *pb.OnUpd
 	}
 	newAttrs := newBucket.GetAttributes()
 	if newAttrs == nil {
-		return nil, errors.BadRequestStatus("new bucket attributes is required")
+		return nil, status.Error(codes.InvalidArgument, "new bucket attributes is required")
 	}
 	newStorageAttributes, err := getStorageAttributes(newAttrs)
 	if err != nil {
@@ -149,7 +146,7 @@ func (p *StoragePlugin) OnUpdateStorageBucket(ctx context.Context, req *pb.OnUpd
 		oldStorageAttributes.CredentialAttributes,
 		p.testCredStateOpts...)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error loading persisted state: %s", err)
+		return nil, status.Errorf(codes.InvalidArgument, "error loading persisted state: %s", err)
 	}
 
 	// Verify the incoming credentials are valid and return any errors to the
@@ -172,7 +169,7 @@ func (p *StoragePlugin) OnUpdateStorageBucket(ctx context.Context, req *pb.OnUpd
 			}, p.testCredStateOpts...)...,
 		)
 		if err != nil {
-			return nil, errors.BadRequestStatus("error setting up new credential persisted state: %s", err)
+			return nil, status.Errorf(codes.InvalidArgument, "error setting up new credential persisted state: %s", err)
 		}
 		newStorageState, err := newAwsStoragePersistedState(
 			append([]awsStoragePersistedStateOption{
@@ -180,10 +177,10 @@ func (p *StoragePlugin) OnUpdateStorageBucket(ctx context.Context, req *pb.OnUpd
 			}, p.testStorageStateOpts...)...,
 		)
 		if err != nil {
-			return nil, errors.BadRequestStatus("error loading persisted state: %s", err)
+			return nil, status.Errorf(codes.InvalidArgument, "error loading persisted state: %s", err)
 		}
-		if st := dryRunValidation(ctx, newStorageState, newStorageAttributes, newBucket); st != nil {
-			return nil, st.Err()
+		if err := dryRunValidation(ctx, newStorageState, newStorageAttributes, newBucket); err != nil {
+			return nil, status.Errorf(codes.InvalidArgument, "failed to validate incoming credentials: %s", err)
 		}
 
 		// Replace the existing credential state.
@@ -191,7 +188,7 @@ func (p *StoragePlugin) OnUpdateStorageBucket(ctx context.Context, req *pb.OnUpd
 		// and deletes the credentials if we are managing them
 		// (ie: if we've rotated them before).
 		if err := credState.ReplaceCreds(ctx, updatedCredentials); err != nil {
-			return nil, err
+			return nil, status.Errorf(codes.InvalidArgument, "error attempting to replace credentials: %s", err)
 		}
 	}
 
@@ -201,7 +198,7 @@ func (p *StoragePlugin) OnUpdateStorageBucket(ctx context.Context, req *pb.OnUpd
 		// This is not allowed.
 		if newStorageAttributes.DisableCredentialRotation && newBucket.GetSecrets() == nil {
 			if !credState.CredsLastRotatedTime.IsZero() {
-				return nil, errors.BadRequestStatus("cannot disable rotation for already-rotated credentials")
+				return nil, status.Error(codes.FailedPrecondition, "cannot disable rotation for already-rotated credentials")
 			}
 		}
 
@@ -209,7 +206,7 @@ func (p *StoragePlugin) OnUpdateStorageBucket(ctx context.Context, req *pb.OnUpd
 		// freshly replaced credentials, we can rotate here.
 		if !newStorageAttributes.DisableCredentialRotation && credState.CredsLastRotatedTime.IsZero() {
 			if err := credState.RotateCreds(ctx); err != nil {
-				return nil, err
+				return nil, status.Errorf(codes.InvalidArgument, "error during credential rotation: %s", err)
 			}
 		}
 	}
@@ -220,17 +217,17 @@ func (p *StoragePlugin) OnUpdateStorageBucket(ctx context.Context, req *pb.OnUpd
 		}, p.testStorageStateOpts...)...,
 	)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error loading persisted state: %s", err)
+		return nil, status.Errorf(codes.InvalidArgument, "error loading persisted state: %s", err)
 	}
 
 	// perform dry run to ensure we can interact with the bucket as expected.
-	if st := dryRunValidation(ctx, storageState, newStorageAttributes, newBucket); st != nil {
-		return nil, st.Err()
+	if err := dryRunValidation(ctx, storageState, newStorageAttributes, newBucket); err != nil {
+		return nil, err
 	}
 
 	persistedProto, err := storageState.toProto()
 	if err != nil {
-		return nil, errors.BadRequestStatus(err.Error())
+		return nil, status.Error(codes.InvalidArgument, err.Error())
 	}
 
 	return &pb.OnUpdateStorageBucketResponse{
@@ -242,12 +239,12 @@ func (p *StoragePlugin) OnUpdateStorageBucket(ctx context.Context, req *pb.OnUpd
 func (p *StoragePlugin) OnDeleteStorageBucket(ctx context.Context, req *pb.OnDeleteStorageBucketRequest) (*pb.OnDeleteStorageBucketResponse, error) {
 	bucket := req.GetBucket()
 	if bucket == nil {
-		return nil, errors.BadRequestStatus("bucket is required")
+		return nil, status.Error(codes.InvalidArgument, "bucket is required")
 	}
 
 	attrs := bucket.GetAttributes()
 	if attrs == nil {
-		return nil, errors.BadRequestStatus("attributes is required")
+		return nil, status.Error(codes.InvalidArgument, "attributes is required")
 	}
 
 	storageAttributes, err := getStorageAttributes(attrs)
@@ -266,7 +263,7 @@ func (p *StoragePlugin) OnDeleteStorageBucket(ctx context.Context, req *pb.OnDel
 		storageAttributes.CredentialAttributes,
 		p.testCredStateOpts...)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error loading persisted state: %s", err)
+		return nil, status.Errorf(codes.InvalidArgument, "error loading persisted state: %s", err)
 	}
 
 	_, err = newAwsStoragePersistedState(
@@ -275,7 +272,7 @@ func (p *StoragePlugin) OnDeleteStorageBucket(ctx context.Context, req *pb.OnDel
 		}, p.testStorageStateOpts...)...,
 	)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error loading persisted state: %s", err)
+		return nil, status.Errorf(codes.InvalidArgument, "error loading persisted state: %s", err)
 	}
 
 	// try to delete static credentials
@@ -285,7 +282,7 @@ func (p *StoragePlugin) OnDeleteStorageBucket(ctx context.Context, req *pb.OnDel
 			// credentials to ensure that it has the proper permissions to do
 			// it.
 			if err := credState.DeleteCreds(ctx); err != nil {
-				return nil, err
+				return nil, status.Errorf(codes.Aborted, "error removing rotated credentials during storage bucket deletion: %s", err)
 			}
 		}
 	}
@@ -296,21 +293,21 @@ func (p *StoragePlugin) OnDeleteStorageBucket(ctx context.Context, req *pb.OnDel
 // HeadObject is called to get the metadata of an object.
 func (p *StoragePlugin) HeadObject(ctx context.Context, req *pb.HeadObjectRequest) (*pb.HeadObjectResponse, error) {
 	if req.GetKey() == "" {
-		return nil, errors.BadRequestStatus("key is required")
+		return nil, status.Error(codes.InvalidArgument, "key is required")
 	}
 
 	bucket := req.GetBucket()
 	if bucket == nil {
-		return nil, errors.BadRequestStatus("bucket is required")
+		return nil, status.Error(codes.InvalidArgument, "bucket is required")
 	}
 
 	if bucket.BucketName == "" {
-		return nil, errors.BadRequestStatus("bucketName is required")
+		return nil, status.Error(codes.InvalidArgument, "bucketName is required")
 	}
 
 	attrs := bucket.GetAttributes()
 	if attrs == nil {
-		return nil, errors.BadRequestStatus("attributes is required")
+		return nil, status.Error(codes.InvalidArgument, "attributes is required")
 	}
 
 	storageAttributes, err := getStorageAttributes(attrs)
@@ -330,7 +327,7 @@ func (p *StoragePlugin) HeadObject(ctx context.Context, req *pb.HeadObjectReques
 		}, p.testCredStateOpts...)...,
 	)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error setting up persisted state: %s", err)
+		return nil, status.Errorf(codes.InvalidArgument, "error setting up persisted state: %s", err)
 	}
 
 	storageState, err := newAwsStoragePersistedState(
@@ -339,7 +336,7 @@ func (p *StoragePlugin) HeadObject(ctx context.Context, req *pb.HeadObjectReques
 		}, p.testStorageStateOpts...)...,
 	)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error setting up persisted state: %s", err)
+		return nil, status.Errorf(codes.InvalidArgument, "error setting up persisted state: %s", err)
 	}
 
 	opts := []s3Option{}
@@ -348,7 +345,7 @@ func (p *StoragePlugin) HeadObject(ctx context.Context, req *pb.HeadObjectReques
 	}
 	s3Client, err := storageState.S3Client(ctx, opts...)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error getting S3 client: %s", err)
+		return nil, status.Errorf(codes.InvalidArgument, "error getting S3 client: %s", err)
 	}
 
 	objectKey := path.Join(bucket.GetBucketPrefix(), req.GetKey())
@@ -357,7 +354,7 @@ func (p *StoragePlugin) HeadObject(ctx context.Context, req *pb.HeadObjectReques
 		Key:    aws.String(objectKey),
 	})
 	if err != nil {
-		return nil, parseS3Error(err, "failed to head object", req).Err()
+		return nil, parseAWSErrCode("error getting head object from s3", err)
 	}
 	return &pb.HeadObjectResponse{
 		ContentLength: resp.ContentLength,
@@ -369,16 +366,16 @@ func (p *StoragePlugin) HeadObject(ctx context.Context, req *pb.HeadObjectReques
 func (p *StoragePlugin) ValidatePermissions(ctx context.Context, req *pb.ValidatePermissionsRequest) (*pb.ValidatePermissionsResponse, error) {
 	bucket := req.GetBucket()
 	if bucket == nil {
-		return nil, errors.BadRequestStatus("bucket is required")
+		return nil, status.Error(codes.InvalidArgument, "bucket is required")
 	}
 
 	if bucket.BucketName == "" {
-		return nil, errors.BadRequestStatus("bucketName is required")
+		return nil, status.Error(codes.InvalidArgument, "bucketName is required")
 	}
 
 	attrs := bucket.GetAttributes()
 	if attrs == nil {
-		return nil, errors.BadRequestStatus("attributes is required")
+		return nil, status.Error(codes.InvalidArgument, "attributes is required")
 	}
 
 	storageAttributes, err := getStorageAttributes(attrs)
@@ -398,7 +395,7 @@ func (p *StoragePlugin) ValidatePermissions(ctx context.Context, req *pb.Validat
 		}, p.testCredStateOpts...)...,
 	)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error setting up persisted state: %s", err)
+		return nil, status.Errorf(codes.InvalidArgument, "error setting up persisted state: %s", err)
 	}
 
 	storageState, err := newAwsStoragePersistedState(
@@ -407,12 +404,12 @@ func (p *StoragePlugin) ValidatePermissions(ctx context.Context, req *pb.Validat
 		}, p.testStorageStateOpts...)...,
 	)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error setting up persisted state: %s", err)
+		return nil, status.Errorf(codes.InvalidArgument, "error setting up persisted state: %s", err)
 	}
 
 	// perform dry run to ensure we can interact with the bucket as expected.
-	if st := dryRunValidation(ctx, storageState, storageAttributes, bucket); st != nil {
-		return nil, st.Err()
+	if err := dryRunValidation(ctx, storageState, storageAttributes, bucket); err != nil {
+		return nil, err
 	}
 
 	return &pb.ValidatePermissionsResponse{}, nil
@@ -422,21 +419,21 @@ func (p *StoragePlugin) ValidatePermissions(ctx context.Context, req *pb.Validat
 // GetObject is a blocking call until the stream has been recieved in full.
 func (p *StoragePlugin) GetObject(req *pb.GetObjectRequest, stream pb.StoragePluginService_GetObjectServer) error {
 	if req.GetKey() == "" {
-		return errors.BadRequestStatus("key is required")
+		return status.Error(codes.InvalidArgument, "key is required")
 	}
 
 	bucket := req.GetBucket()
 	if bucket == nil {
-		return errors.BadRequestStatus("bucket is required")
+		return status.Error(codes.InvalidArgument, "bucket is required")
 	}
 
 	if bucket.GetBucketName() == "" {
-		return errors.BadRequestStatus("bucketName is required")
+		return status.Error(codes.InvalidArgument, "bucketName is required")
 	}
 
 	attrs := bucket.GetAttributes()
 	if attrs == nil {
-		return errors.BadRequestStatus("attributes is required")
+		return status.Error(codes.InvalidArgument, "attributes is required")
 	}
 
 	storageAttributes, err := getStorageAttributes(attrs)
@@ -456,7 +453,7 @@ func (p *StoragePlugin) GetObject(req *pb.GetObjectRequest, stream pb.StoragePlu
 		}, p.testCredStateOpts...)...,
 	)
 	if err != nil {
-		return errors.BadRequestStatus("error setting up persisted state: %s", err)
+		return status.Errorf(codes.InvalidArgument, "error setting up persisted state: %s", err)
 	}
 
 	storageState, err := newAwsStoragePersistedState(
@@ -465,7 +462,7 @@ func (p *StoragePlugin) GetObject(req *pb.GetObjectRequest, stream pb.StoragePlu
 		}, p.testStorageStateOpts...)...,
 	)
 	if err != nil {
-		return errors.BadRequestStatus("error setting up persisted state: %s", err)
+		return status.Errorf(codes.InvalidArgument, "error setting up persisted state: %s", err)
 	}
 
 	opts := []s3Option{}
@@ -474,7 +471,7 @@ func (p *StoragePlugin) GetObject(req *pb.GetObjectRequest, stream pb.StoragePlu
 	}
 	s3Client, err := storageState.S3Client(stream.Context(), opts...)
 	if err != nil {
-		return errors.BadRequestStatus("error getting S3 client: %s", err)
+		return status.Errorf(codes.InvalidArgument, "error getting S3 client: %s", err)
 	}
 
 	objectKey := path.Join(bucket.GetBucketPrefix(), req.GetKey())
@@ -483,7 +480,7 @@ func (p *StoragePlugin) GetObject(req *pb.GetObjectRequest, stream pb.StoragePlu
 		Key:    aws.String(objectKey),
 	})
 	if err != nil {
-		return parseS3Error(err, "failed to get object", req).Err()
+		return parseAWSErrCode("error getting object from s3", err)
 	}
 
 	defer resp.Body.Close()
@@ -496,13 +493,13 @@ func (p *StoragePlugin) GetObject(req *pb.GetObjectRequest, stream pb.StoragePlu
 		buffer := make([]byte, chunkSize)
 		n, err := reader.Read(buffer)
 		if err != nil && err != io.EOF {
-			return errors.UnknownStatus("error reading chunk from s3: %s", err)
+			return status.Errorf(codes.Internal, "error reading chunk from s3: %s", err)
 		}
 		if n > 0 {
 			if err := stream.Send(&pb.GetObjectResponse{
 				FileChunk: buffer[:n],
 			}); err != nil {
-				return errors.UnknownStatus("error sending chunk to client: %s", err)
+				return status.Errorf(codes.Internal, "error sending chunk to client: %s", err)
 			}
 		}
 		if err == io.EOF {
@@ -516,38 +513,38 @@ func (p *StoragePlugin) GetObject(req *pb.GetObjectRequest, stream pb.StoragePlu
 // PutObject is called when putting objects into an s3 bucket.
 func (p *StoragePlugin) PutObject(ctx context.Context, req *pb.PutObjectRequest) (*pb.PutObjectResponse, error) {
 	if req == nil {
-		return nil, errors.BadRequestStatus("request is required")
+		return nil, status.Errorf(codes.InvalidArgument, "request is required")
 	}
 	if req.GetKey() == "" {
-		return nil, errors.BadRequestStatus("key is required")
+		return nil, status.Errorf(codes.InvalidArgument, "key is required")
 	}
 	bucket := req.GetBucket()
 	if bucket == nil {
-		return nil, errors.BadRequestStatus("bucket is required")
+		return nil, status.Error(codes.InvalidArgument, "bucket is required")
 	}
 	if bucket.GetBucketName() == "" {
-		return nil, errors.BadRequestStatus("bucketName is required")
+		return nil, status.Error(codes.InvalidArgument, "bucketName is required")
 	}
 	attrs := bucket.GetAttributes()
 	if attrs == nil {
-		return nil, errors.BadRequestStatus("attributes is required")
+		return nil, status.Error(codes.InvalidArgument, "attributes is required")
 	}
 	if req.GetPath() == "" {
-		return nil, errors.BadRequestStatus("path is required")
+		return nil, status.Errorf(codes.InvalidArgument, "path is required")
 	}
 	file, err := os.Open(req.GetPath())
 	if err != nil {
-		return nil, errors.BadRequestStatus("failed to open file")
+		return nil, status.Errorf(codes.Internal, "failed to open file")
 	}
 	info, err := file.Stat()
 	if err != nil {
-		return nil, errors.BadRequestStatus("failed to read file info")
+		return nil, status.Errorf(codes.Internal, "failed to read file info")
 	}
 	if info.IsDir() {
-		return nil, errors.BadRequestStatus("path is not a file")
+		return nil, status.Errorf(codes.InvalidArgument, "path is not a file")
 	}
 	if info.Size() == 0 {
-		return nil, errors.BadRequestStatus("file is empty")
+		return nil, status.Errorf(codes.InvalidArgument, "file is empty")
 	}
 
 	storageAttributes, err := getStorageAttributes(attrs)
@@ -567,7 +564,7 @@ func (p *StoragePlugin) PutObject(ctx context.Context, req *pb.PutObjectRequest)
 		}, p.testCredStateOpts...)...,
 	)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error setting up persisted state: %s", err)
+		return nil, status.Errorf(codes.InvalidArgument, "error setting up persisted state: %s", err)
 	}
 
 	storageState, err := newAwsStoragePersistedState(
@@ -576,7 +573,7 @@ func (p *StoragePlugin) PutObject(ctx context.Context, req *pb.PutObjectRequest)
 		}, p.testStorageStateOpts...)...,
 	)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error setting up persisted state: %s", err)
+		return nil, status.Errorf(codes.InvalidArgument, "error setting up persisted state: %s", err)
 	}
 
 	opts := []s3Option{}
@@ -585,18 +582,18 @@ func (p *StoragePlugin) PutObject(ctx context.Context, req *pb.PutObjectRequest)
 	}
 	s3Client, err := storageState.S3Client(ctx, opts...)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error getting S3 client: %s", err)
+		return nil, status.Errorf(codes.InvalidArgument, "error getting S3 client: %s", err)
 	}
 
 	hash := sha256.New()
 	if _, err := io.Copy(hash, file); err != nil {
-		return nil, errors.UnknownStatus("failed to calcualte hash")
+		return nil, status.Errorf(codes.Internal, "failed to calcualte hash")
 	}
 	checksum := base64.StdEncoding.EncodeToString(hash.Sum(nil))
 
 	_, err = file.Seek(0, io.SeekStart)
 	if err != nil {
-		return nil, errors.UnknownStatus("failed to rewind file pointer")
+		return nil, status.Errorf(codes.Internal, "failed to rewind file pointer")
 	}
 
 	objectKey := path.Join(bucket.GetBucketPrefix(), req.GetKey())
@@ -608,161 +605,38 @@ func (p *StoragePlugin) PutObject(ctx context.Context, req *pb.PutObjectRequest)
 		ChecksumSHA256:    aws.String(checksum),
 	})
 	if err != nil {
-		return nil, parseS3Error(err, "failed to put object", req).Err()
+		return nil, parseAWSErrCode("error putting object into s3", err)
 	}
 	if resp.ChecksumSHA256 == nil {
-		return nil, errors.UnknownStatus("missing checksum response from aws")
+		return nil, status.Errorf(codes.Internal, "missing checksum response from aws")
 	}
 	if checksum != *resp.ChecksumSHA256 {
-		return nil, checksumMistmatchStatus()
+		return nil, status.Errorf(codes.Internal, "mismatched checksum")
 	}
 	decodedChecksum, err := base64.StdEncoding.DecodeString(*resp.ChecksumSHA256)
 	if err != nil {
-		return nil, errors.UnknownStatus("failed to decode checksum value from aws")
+		return nil, status.Errorf(codes.Internal, "failed to decode checksum value from aws")
 	}
 	return &pb.PutObjectResponse{
 		ChecksumSha_256: decodedChecksum,
 	}, nil
 }
 
-// DeleteObjects is used to delete one or many objects from an s3 bucket.
-func (p *StoragePlugin) DeleteObjects(ctx context.Context, req *pb.DeleteObjectsRequest) (*pb.DeleteObjectsResponse, error) {
-	if req.GetKeyPrefix() == "" {
-		return nil, errors.BadRequestStatus("key prefix is required")
-	}
-
-	bucket := req.GetBucket()
-	if bucket == nil {
-		return nil, errors.BadRequestStatus("bucket is required")
-	}
-
-	if bucket.GetBucketName() == "" {
-		return nil, errors.BadRequestStatus("bucketName is required")
-	}
-
-	attrs := bucket.GetAttributes()
-	if attrs == nil {
-		return nil, errors.BadRequestStatus("attributes is required")
-	}
-
-	storageAttributes, err := getStorageAttributes(attrs)
-	if err != nil {
-		return nil, err
-	}
-
-	credConfig, err := cred.GetCredentialsConfig(bucket.GetSecrets(), storageAttributes.CredentialAttributes, false)
-	if err != nil {
-		return nil, err
-	}
-
-	// Set up the creds in our persisted state.
-	credState, err := cred.NewAwsCredentialPersistedState(
-		append([]cred.AwsCredentialPersistedStateOption{
-			cred.WithCredentialsConfig(credConfig),
-		}, p.testCredStateOpts...)...,
-	)
-	if err != nil {
-		return nil, errors.BadRequestStatus("error setting up persisted state: %s", err)
-	}
-
-	storageState, err := newAwsStoragePersistedState(
-		append([]awsStoragePersistedStateOption{
-			withCredentials(credState),
-		}, p.testStorageStateOpts...)...,
-	)
-	if err != nil {
-		return nil, errors.BadRequestStatus("error setting up persisted state: %s", err)
-	}
-
-	opts := []s3Option{}
-	if storageAttributes.EndpointUrl != "" {
-		opts = append(opts, WithEndpoint(storageAttributes.EndpointUrl))
-	}
-	client, err := storageState.S3Client(ctx, opts...)
-	if err != nil {
-		return nil, errors.BadRequestStatus("error getting S3 client: %s", err)
-	}
-
-	prefix := path.Join(bucket.GetBucketPrefix(), req.GetKeyPrefix())
-	if strings.HasSuffix(req.GetKeyPrefix(), "/") {
-		// path.Join ends by "cleaning" the path, including removing a trailing slash, if
-		// it exists. given that a slash is used to denote a folder, it is required here.
-		prefix += "/"
-	}
-
-	if !req.Recursive {
-		_, err := client.DeleteObject(ctx, &s3.DeleteObjectInput{
-			Bucket: aws.String(bucket.GetBucketName()),
-			Key:    aws.String(prefix),
-		})
-		if err != nil {
-			return nil, parseS3Error(err, "failed to delete object", req).Err()
-		}
-		return &pb.DeleteObjectsResponse{
-			ObjectsDeleted: uint32(1),
-		}, nil
-	}
-
-	const maxkeys = 1000
-
-	objects := []types.ObjectIdentifier{}
-	var conToken *string
-	truncated := true
-	for truncated {
-		res, err := client.ListObjectsV2(ctx, &s3.ListObjectsV2Input{
-			Bucket:            aws.String(bucket.GetBucketName()),
-			Prefix:            aws.String(prefix),
-			MaxKeys:           maxkeys,
-			ContinuationToken: conToken,
-		})
-		if err != nil {
-			return nil, parseS3Error(err, "failed to list objects", req).Err()
-		}
-		truncated = res.IsTruncated
-		conToken = res.NextContinuationToken
-		for _, o := range res.Contents {
-			objects = append(objects, types.ObjectIdentifier{
-				Key: o.Key,
-			})
-		}
-	}
-
-	deleted := 0
-
-	for i := 0; i < len(objects); i += maxkeys {
-		toDelete := objects[i:min(len(objects), i+maxkeys)] // min is required to avoid an out of bounds panic
-		res, err := client.DeleteObjects(ctx, &s3.DeleteObjectsInput{
-			Bucket: aws.String(bucket.GetBucketName()),
-			Delete: &types.Delete{
-				Objects: toDelete,
-			},
-		})
-		if err != nil {
-			return nil, parseS3Error(err, "failed to delete objects", req).Err()
-		}
-		deleted += len(res.Deleted)
-	}
-
-	return &pb.DeleteObjectsResponse{
-		ObjectsDeleted: uint32(deleted),
-	}, nil
-}
-
 // dryRunValidation validates that the IAM role policy attached to the given secrets of the
 // storage bucket has the minimum required permissions needed for this plugin to function
 // as expected. This function will create an object in the s3 bucket to validate it has
 // PutObject permissions. This function will read the same file it had uploaded to validate
 // it has GetObject permissions. This function will read the metadata of the same file it
 // had uploaded to validate it has GetObjectAttributes permissions.
-func dryRunValidation(ctx context.Context, state *awsStoragePersistedState, attrs *StorageAttributes, bucket *storagebuckets.StorageBucket) *status.Status {
+func dryRunValidation(ctx context.Context, state *awsStoragePersistedState, attrs *StorageAttributes, bucket *storagebuckets.StorageBucket) error {
 	if state == nil {
-		return status.New(codes.InvalidArgument, "persisted state is required")
+		return status.Error(codes.InvalidArgument, "persisted state is required")
 	}
 	if attrs == nil {
-		return status.New(codes.InvalidArgument, "attributes is required")
+		return status.Error(codes.InvalidArgument, "attributes is required")
 	}
 	if bucket == nil {
-		return status.New(codes.InvalidArgument, "bucket is required")
+		return status.Error(codes.InvalidArgument, "bucket is required")
 	}
 
 	opts := []s3Option{}
@@ -772,77 +646,53 @@ func dryRunValidation(ctx context.Context, state *awsStoragePersistedState, attr
 
 	client, err := state.S3Client(ctx, opts...)
 	if err != nil {
-		return status.New(codes.InvalidArgument, fmt.Sprintf("error getting S3 client: %s", err))
+		return status.Errorf(codes.InvalidArgument, "error getting S3 client: %s", err)
 	}
 
-	var errs *multierror.Error
-	permissions := &pb.Permissions{}
-	// we track the codes returned by ParseAWSError and pick the most severe one by using the max func
-
 	objectKey := path.Join(bucket.GetBucketPrefix(), uuid.New().String())
 	if _, err := client.PutObject(ctx, &s3.PutObjectInput{
 		Bucket: aws.String(bucket.GetBucketName()),
 		Key:    aws.String(objectKey),
 		Body:   bytes.NewReader([]byte("hashicorp boundary aws plugin access test")),
 	}); err != nil {
-		var st *status.Status
-		st, permissions.Write = errors.ParseAWSError(err, "failed to put object")
-		errs = multierror.Append(errs, st.Err())
-	} else {
-		permissions.Write = &pb.Permission{State: pb.StateType_STATE_TYPE_OK, CheckedAt: timestamppb.Now()}
+		return parseAWSErrCode("error failed to put object", err)
 	}
 
 	if _, err := client.GetObject(ctx, &s3.GetObjectInput{
 		Bucket: aws.String(bucket.GetBucketName()),
 		Key:    aws.String(objectKey),
 	}); err != nil {
-		var st *status.Status
-		st, permissions.Read = errors.ParseAWSError(err, "failed to get object")
-		errs = multierror.Append(errs, st.Err())
-	} else {
-		permissions.Read = &pb.Permission{State: pb.StateType_STATE_TYPE_OK, CheckedAt: timestamppb.Now()}
+		return parseAWSErrCode("error failed to get object", err)
 	}
 
 	if _, err := client.HeadObject(ctx, &s3.HeadObjectInput{
 		Bucket: aws.String(bucket.GetBucketName()),
 		Key:    aws.String(objectKey),
 	}); err != nil {
-		var st *status.Status
-		st, permissions.Read = errors.ParseAWSError(err, "failed to head object")
-		errs = multierror.Append(errs, st.Err())
+		return parseAWSErrCode("error failed to get head object", err)
 	}
 
-	if res, err := client.ListObjectsV2(ctx, &s3.ListObjectsV2Input{
-		Bucket: aws.String(bucket.GetBucketName()),
-		Prefix: aws.String(objectKey),
-	}); err != nil {
-		var st *status.Status
-		st, permissions.Read = errors.ParseAWSError(err, "failed to list object")
-		errs = multierror.Append(errs, st.Err())
-	} else if res == nil || len(res.Contents) != 1 || *res.Contents[0].Key != objectKey {
-		permissions.Read = &pb.Permission{State: pb.StateType_STATE_TYPE_UNKNOWN, CheckedAt: timestamppb.Now()}
-		errs = multierror.Append(errs, status.New(codes.Aborted, fmt.Sprintf("list response did not contain the expected key: %+v", res)).Err())
-	}
-
-	if _, err := client.DeleteObject(ctx, &s3.DeleteObjectInput{
+	// attempt to delete the test object created for the dry run validation,
+	// this step is allowed to fail because DeleteObject is not a required
+	// operation for the plugin.
+	client.DeleteObject(ctx, &s3.DeleteObjectInput{
 		Bucket: aws.String(bucket.GetBucketName()),
 		Key:    aws.String(objectKey),
-	}); err != nil {
-		var st *status.Status
-		st, permissions.Delete = errors.ParseAWSError(err, "failed to delete object")
-		errs = multierror.Append(errs, st.Err())
-	} else {
-		permissions.Delete = &pb.Permission{State: pb.StateType_STATE_TYPE_OK, CheckedAt: timestamppb.Now()}
-	}
-
-	if errs != nil {
-		st := status.New(codes.FailedPrecondition, fmt.Sprintf("failed to validate provided aws credentials: %v", errs.Unwrap()))
-		state := &pb.StorageBucketCredentialState{State: permissions}
-		if st, err = st.WithDetails(state); err != nil {
-			st = status.New(codes.Internal, err.Error())
-		}
-		return st
-	}
+	})
 
 	return nil
 }
+
+// parseAWSErrCode detects if an aws error is a throttle error.
+// If the error is a throttle error, then an Unavailable status code
+// is returned. Otherwise the default status code is an Internal error.
+func parseAWSErrCode(msg string, err error) error {
+	errCode := codes.Internal
+	retryErr := retry.ThrottleErrorCode{
+		Codes: retry.DefaultThrottleErrorCodes,
+	}
+	if retryErr.IsErrorThrottle(err).Bool() {
+		errCode = codes.Unavailable
+	}
+	return status.Errorf(errCode, "%s: %s", msg, err)
+}

plugin/service/storage/state.go

@@ -25,8 +25,6 @@ type S3API interface {
 	GetObject(ctx context.Context, params *s3.GetObjectInput, optFns ...func(*s3.Options)) (*s3.GetObjectOutput, error)
 	HeadObject(ctx context.Context, params *s3.HeadObjectInput, optFns ...func(*s3.Options)) (*s3.HeadObjectOutput, error)
 	PutObject(ctx context.Context, params *s3.PutObjectInput, optFns ...func(*s3.Options)) (*s3.PutObjectOutput, error)
-	DeleteObjects(ctx context.Context, params *s3.DeleteObjectsInput, optFns ...func(*s3.Options)) (*s3.DeleteObjectsOutput, error)
-	ListObjectsV2(ctx context.Context, params *s3.ListObjectsV2Input, optFns ...func(*s3.Options)) (*s3.ListObjectsV2Output, error)
 }
 
 var customClient = &http.Client{
@@ -84,6 +82,7 @@ func newAwsStoragePersistedState(opts ...awsStoragePersistedStateOption) (*awsSt
 }
 
 func (s *awsStoragePersistedState) toProto() (*storagebuckets.StorageBucketPersisted, error) {
+
 	data, err := structpb.NewStruct(s.ToMap())
 	if err != nil {
 		return nil, fmt.Errorf("error converting state to structpb.Struct: %w", err)

plugin/service/storage/testing.go

@@ -14,7 +14,6 @@ import (
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
-	"github.com/aws/smithy-go"
 	"github.com/hashicorp/boundary-plugin-aws/internal/credential"
 	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/storagebuckets"
 	pb "github.com/hashicorp/boundary/sdk/pbs/plugin"
@@ -29,8 +28,22 @@ const (
 	testGetUserErr           = "test error for GetUser"
 	testGetCallerIdentityErr = "test error for GetCallerIdentity"
 	testDeleteAccessKeyErr   = "test error for DeleteAccessKey"
+	testGetObjectErr         = "test error for GetObject"
+	testPutObjectErr         = "test error for PutObject"
+	testHeadObjectErr        = "test error for HeadObject"
 )
 
+// throttleErr is a mocked error used for testing the aws s3 client
+type throttleErr struct{}
+
+func (e *throttleErr) ErrorCode() string {
+	return "ThrottlingException"
+}
+
+func (e *throttleErr) Error() string {
+	return "ThrottlingException"
+}
+
 type testMockS3State struct {
 	GetObjectCalled      bool
 	GetObjectInputParams *s3.GetObjectInput
@@ -41,14 +54,6 @@ type testMockS3State struct {
 
 	HeadObjectCalled      bool
 	HeadObjectInputParams *s3.HeadObjectInput
-
-	ListObjectsV2Called      bool
-	ListObjectsV2InputParams *s3.ListObjectsV2Input
-
-	DeleteObjectCalled       bool
-	DeleteObjectInputParams  *s3.DeleteObjectInput
-	DeleteObjectsCalled      bool
-	DeleteObjectsInputParams *s3.DeleteObjectsInput
 }
 
 func (s *testMockS3State) Reset() {
@@ -59,12 +64,6 @@ func (s *testMockS3State) Reset() {
 	s.PutObjectBody = nil
 	s.HeadObjectCalled = false
 	s.HeadObjectInputParams = nil
-	s.ListObjectsV2Called = false
-	s.ListObjectsV2InputParams = nil
-	s.DeleteObjectCalled = false
-	s.DeleteObjectInputParams = nil
-	s.DeleteObjectsCalled = false
-	s.DeleteObjectsInputParams = nil
 }
 
 type testMockS3 struct {
@@ -84,18 +83,6 @@ type testMockS3 struct {
 	// mocked responses for headObject
 	HeadObjectOutput *s3.HeadObjectOutput
 	HeadObjectErr    error
-
-	// mocked responses for ListObjectsV2 (needed for delete)
-	ListObjectsV2Output *s3.ListObjectsV2Output
-	ListObjectsV2Err    error
-	// sometimes we need to create a wildcard output
-	ListObjectsV2OutputFunc func(*s3.ListObjectsV2Input) *s3.ListObjectsV2Output
-
-	// mocked responses for DeleteObject(s)
-	DeleteObjectOutput  *s3.DeleteObjectOutput
-	DeleteObjectErr     error
-	DeleteObjectsOutput *s3.DeleteObjectsOutput
-	DeleteObjectsErr    error
 }
 
 type testMockS3Option func(m *testMockS3) error
@@ -142,55 +129,6 @@ func testMockS3WithHeadObjectError(e error) testMockS3Option {
 	}
 }
 
-func testMockS3WithListObjectsV2Output(o *s3.ListObjectsV2Output) testMockS3Option {
-	return func(m *testMockS3) error {
-		m.ListObjectsV2Output = o
-		return nil
-	}
-}
-
-func testMockS3WithListObjectsV2Error(e error) testMockS3Option {
-	return func(m *testMockS3) error {
-		m.ListObjectsV2Err = e
-		return nil
-	}
-}
-
-func testMockS3WithListObjectsV2OutputFunc(o func(*s3.ListObjectsV2Input) *s3.ListObjectsV2Output) testMockS3Option {
-	return func(m *testMockS3) error {
-		m.ListObjectsV2OutputFunc = o
-		return nil
-	}
-}
-
-func testMockS3WithDeleteObjectOutput(o *s3.DeleteObjectOutput) testMockS3Option {
-	return func(m *testMockS3) error {
-		m.DeleteObjectOutput = o
-		return nil
-	}
-}
-
-func testMockS3WithDeleteObjectError(e error) testMockS3Option {
-	return func(m *testMockS3) error {
-		m.DeleteObjectErr = e
-		return nil
-	}
-}
-
-func testMockS3WithDeleteObjectsOutput(o *s3.DeleteObjectsOutput) testMockS3Option {
-	return func(m *testMockS3) error {
-		m.DeleteObjectsOutput = o
-		return nil
-	}
-}
-
-func testMockS3WithDeleteObjectsError(e error) testMockS3Option {
-	return func(m *testMockS3) error {
-		m.DeleteObjectsErr = e
-		return nil
-	}
-}
-
 func newTestMockS3(state *testMockS3State, opts ...testMockS3Option) s3APIFunc {
 	return func(cfgs ...aws.Config) (S3API, error) {
 		m := &testMockS3{
@@ -255,47 +193,8 @@ func (m *testMockS3) PutObject(ctx context.Context, params *s3.PutObjectInput, o
 	return m.PutObjectOutput, nil
 }
 
-func (m *testMockS3) ListObjectsV2(ctx context.Context, params *s3.ListObjectsV2Input, optFns ...func(*s3.Options)) (*s3.ListObjectsV2Output, error) {
-	if m.State != nil {
-		m.State.ListObjectsV2Called = true
-		m.State.ListObjectsV2InputParams = params
-	}
-
-	if m.ListObjectsV2Err != nil {
-		return nil, m.ListObjectsV2Err
-	}
-
-	if m.ListObjectsV2OutputFunc != nil {
-		return m.ListObjectsV2OutputFunc(params), nil
-	}
-
-	return m.ListObjectsV2Output, nil
-}
-
 func (m *testMockS3) DeleteObject(ctx context.Context, params *s3.DeleteObjectInput, optFns ...func(*s3.Options)) (*s3.DeleteObjectOutput, error) {
-	if m.State != nil {
-		m.State.DeleteObjectCalled = true
-		m.State.DeleteObjectInputParams = params
-	}
-
-	if m.DeleteObjectErr != nil {
-		return nil, m.DeleteObjectErr
-	}
-
-	return m.DeleteObjectOutput, nil
-}
-
-func (m *testMockS3) DeleteObjects(ctx context.Context, params *s3.DeleteObjectsInput, optFns ...func(*s3.Options)) (*s3.DeleteObjectsOutput, error) {
-	if m.State != nil {
-		m.State.DeleteObjectsCalled = true
-		m.State.DeleteObjectsInputParams = params
-	}
-
-	if m.DeleteObjectsErr != nil {
-		return nil, m.DeleteObjectsErr
-	}
-
-	return m.DeleteObjectsOutput, nil
+	return &s3.DeleteObjectOutput{}, nil
 }
 
 func (m *testMockS3) HeadObject(ctx context.Context, params *s3.HeadObjectInput, optFns ...func(*s3.Options)) (*s3.HeadObjectOutput, error) {
@@ -398,16 +297,3 @@ func validSTSMock() []credential.AwsCredentialPersistedStateOption {
 		}),
 	}
 }
-
-// TestAwsS3Error returns an s3 api error
-func TestAwsS3Error(code, op, msg string) error {
-	return &smithy.OperationError{
-		ServiceID:     "s3",
-		OperationName: op,
-		Err: &smithy.GenericAPIError{
-			Code:    code,
-			Message: msg,
-			Fault:   smithy.FaultServer,
-		},
-	}
-}