chore: Rename module to drop host element (#24 )

feat(ci): Update GitHub Actions Runners (#23 )
chore: Update Boundary SDK tag
2023-06-02 08:55:14 -07:00 · 2023-06-02 11:02:40 -04:00 · 2023-06-01 08:36:25 -07:00 · 2023-05-31 08:27:16 -04:00 · 2023-05-30 21:04:44 -04:00 · 2023-05-30 20:53:47 -04:00
47 changed files with 6674 additions and 2563 deletions
@@ -0,0 +1,23 @@
+name: test
+
+on:
+  - workflow_dispatch
+  - push
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    env:
+      GO111MODULE: on
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+      - name: Set up Go
+        uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
+        with:
+          go-version-file: 'go.mod'
+          cache: true
+      - name: Run Tests
+        run: go test -v ./plugin/... ./internal/...
@@ -0,0 +1,5 @@
+# These owners will be the default owners for everything in
+# the repo, unless a later match takes precedence.
+
+@hashicorp/boundary
+
@@ -0,0 +1,21 @@
+# Contributing
+
+Create a new package when adding support to a new service in the aws plugin. The package name should be named after the service name found [here](https://github.com/hashicorp/boundary/tree/main/internal/proto/plugin/v1).
+
+## Service Packages
+
+- A service package should contain an `attributes.go` file, which contains all attributes associated to the service in addition to `CredentialAttributes`, which is defined in `internal/credential/attributes.go`.
+- A service package should contain an `state.go` file, which contains the logic and definition of the service's persisted state.
+- A service package should contain an `plugin.go` file, which contains the implemented method defined the the services proto definition found [here](https://github.com/hashicorp/boundary/tree/main/internal/proto/plugin/v1).
+
+## Credential Package
+
+This package contains all logic used for authorizing aws sessions. Any changes applied to this package will affect how all services handle aws sessions.
+
+## Plugin.go
+
+Found in `plugin/plugin.go`. This file contains the AwsPlugin struct definition, which contains the struct composition of all services that the plugin supports. Add your newly defined plugin service struct as a struct composition to the AwsPlugins struct.
+
+## Testing
+
+Please add end to end tests here in `testing/e2e_{service}_test.go`. Any aws terraform files should be stored in `testing/testdata/{service}/*.tf`
@@ -1,3 +1,5 @@
+Copyright (c) 2021 HashiCorp, Inc.
+
 Mozilla Public License Version 2.0
 ==================================

@@ -1,156 +1,62 @@
-# AWS Host Plugin for HashiCorp Boundary
+# AWS Plugin for HashiCorp Boundary

-This repo contains a Host-type plugin for [HashiCorp
-Boundary](https://www.boundaryproject.io/) allowing dynamically sourcing hosts
-from Amazon EC2.
-
-Host sets created with this plugin define filters which select and group like
-instances within AWS; these host sets can in turn be added to targets within
-Boundary as host sources.
-
-At creation or update of a host catalog of this type, configuration of the
-plugin is performed via the attribute/secret values passed to the create or
-update calls actions. These values are input as JSON objects; the expected types
-are indicated below with the valid fields.
-
-The plugin fetches hosts through the
-[DescribeInstances](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstances.html)
-call.
+This repo contains the aws plugin for [HashiCorp
+Boundary](https://www.boundaryproject.io/).

 ## Credential Rotation

 Although credentials are stored encrypted within Boundary, by default this
 plugin will attempt to rotate credentials when they are supplied through the
-`secrets` object on a create or update call to the host catalog resource. The
-given credentials will be used to create a new credential, and then the given
-credential will be revoked. In this way, after rotation, only Boundary knows the
-client secret in use by this plugin.
+`secrets` object. The given credentials will be used to create a new credential,
+and then the given credential will be revoked. In this way, after rotation,
+only Boundary knows the client secret in use by this plugin.

-## Getting Started
+Credential rotation can be turned off by setting the 
+`disable_credential_rotation` attribute to `true`.

-Refer to [Attributes and Secrets](#attributes-and-secrets) for more detail on
-configuration options for host catalogs and sets.
+## Dynamic Hosts

-To create a host catalog (using default scope created by `boundary dev`):
+This plugin supports dynamically sourcing hosts from Amazon EC2.

-```
-boundary host-catalogs create plugin \
- -scope-id p_1234567890 \
- -name "Example Plugin-Based Host Catalog" \
- -description "Description for plugin-based host catalog" \
- -plugin-name aws \
- -attr region=REGION \
- -secret access_key_id='KEY' \
- -secret secret_access_key='SECRET'
-```
+Host sets created with this plugin define filters which select and group like
+instances within AWS; these host sets can in turn be added to targets within
+Boundary as host sources.

-To create a host set, filtering the host set based on tag keys `foo` or `bar`
-(either tag can be present), ensuring that any targets set to this host set only
-connect to external addresses in the `54.0.0.0/8` class A subnet:
+At creation, update or deletion of a host catalog of this type, configuration of the
+plugin is performed via the attribute/secret values passed to the create, update, or
+delete calls actions. The values passed in to the plugin here are the attributes set
+on on a host catalog in boundary.

-```
-boundary host-sets create plugin \
- -host-catalog-id HOST_CATALOG_ID \
- -name "Example Plugin-Based Host Set" \
- -description "Description for plugin-based host set" \
- -attr filters=tag-key=foo,bar \
- -preferred-endpoint "cidr:54.0.0.0/8"
-```
+The plugin fetches hosts through the
+[DescribeInstances](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstances.html)
+call.

-As above, but instances must have both tags (both `foo` and `bar` *must* be
-present):
+[Getting Started](https://github.com/hashicorp/boundary-plugin-aws/plugin/service/host/README.md)

-```
-boundary host-sets create plugin \
- -host-catalog-id HOST_CATALOG_ID \
- -name "Example Plugin-Based Host Set" \
- -description "Description for plugin-based host set" \
- -attr filters=tag-key=foo \
- -attr filters=tag-key=bar \
- -preferred-endpoint "cidr:54.0.0.0/8"
-```
+## Storage Bucket

-As above, but matching on tag key named "development" with value "prod" or "dev"
-and launch date:
+This plugin supports storing and fetching objects from Amazon S3.

-```
-boundary host-sets create plugin \
- -host-catalog-id HOST_CATALOG_ID \
- -name "Example Plugin-Based Host Set" \
- -description "Description for plugin-based host set" \
- -attr filters=tag:development=prod,dev \
- -attr filters=launch-time=2022-01-04T* \
- -preferred-endpoint "cidr:54.0.0.0/8"
-```
+Files created with this plugin are stored as objects defined by the bucket
+name and bucket prefix values configured in the storage bucket resource;
+these storage bucket resources can in turn be associated to targets within
+Boundary.

-## Required IAM Privileges
+At creation, update or deletion of a storage bucket of this type, configuration of the
+plugin is performed via the attribute/secret values passed to the create, update, or 
+delete calls actions. The values passed in to the plugin here are the attributes set
+on on a storage bucket in boundary.

-The following IAM privileges, at the very least, are required to be attached to
-a configured IAM user for this provider:
+The plugin fetches files through the
+[GetObject](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html)
+call.

-* `ec2:DescribeInstances`, configured to `*` (`DescribeInstances` cannot be
-  scoped to a resource ARN). Example policy:
+The plugin stores files through the
+[PutObject](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html)
+call.

-```
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Action": [
-        "ec2:DescribeInstances"
-      ],
-      "Effect": "Allow",
-      "Resource": "*"
-    }
-  ]
-}
-```
+The plugin fetches metadata about the files through the
+[HeadObject](https://docs.aws.amazon.com/AmazonS3/latest/API/API_HeadObject.html)
+call.

-* `iam:GetUser`, `iam:CreateAccessKey`, and `iam:DeleteAccessKey`, configured to
-  the IAM user to allow credential rotation. Example policy:
-
-```
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Action": [
-        "iam:DeleteAccessKey",
-        "iam:GetUser",
-        "iam:CreateAccessKey"
-      ],
-      "Effect": "Allow",
-      "Resource": "arn:aws:iam::123456789012:user/JohnDoe"
-    }
-  ]
-}
-```
-
-## Attributes and Secrets
-
-### Host Catalog
-
-The following `attributes` are valid on an AWS host catalog resource:
-
- `disable_credential_rotation` (bool): If `true`, credential rotation will not
-  be performed. See the [Credential Rotation](#credential-rotation) section
-  above.
- `region` (string): The region to configure the host catalog for. All host sets
-  in this catalog will be configured for this region.
-
-The following `secrets` are valid on an AWS host catalog resource:
-
- `access_key_id` (string): The access key ID for the IAM user to use with this
-  host catalog.
- `secret_access_key` (string): The secret access key for the IAM user to use
-  with this host catalog.
-
-### Host Set
-
-The following attributes are valid on an AWS host Set resource:
-
- `filters` (array of strings): An array of string filters in the format
-  `key=val1,val2`. The key corresponds to a filter option, and the value(s) are
-  a comma-separated list. For a list of filter options, check out
-  [describe-instances in the AWS CLI
-  reference](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html).
+[Getting Started](https://github.com/hashicorp/boundary-plugin-aws/plugin/service/storage/README.md)
@@ -1,45 +1,64 @@
-module github.com/hashicorp/boundary-plugin-host-aws
+module github.com/hashicorp/boundary-plugin-aws

-go 1.18
+go 1.20

 require (
 	github.com/aws/aws-sdk-go v1.44.80
-	github.com/google/go-cmp v0.5.8
-	github.com/hashicorp/boundary/sdk v0.0.21
+	github.com/aws/aws-sdk-go-v2 v1.17.7
+	github.com/aws/aws-sdk-go-v2/config v1.18.19
+	github.com/aws/aws-sdk-go-v2/credentials v1.13.18
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.31.1
+	github.com/google/go-cmp v0.5.9
+	github.com/google/uuid v1.3.0
+	github.com/hashicorp/boundary/sdk v0.0.33
 	github.com/hashicorp/go-secure-stdlib/awsutil v0.1.6
 	github.com/hashicorp/terraform-json v0.14.0
 	github.com/mitchellh/mapstructure v1.5.0
-	github.com/stretchr/testify v1.8.0
-	google.golang.org/grpc v1.48.0
+	github.com/stretchr/testify v1.8.2
+	google.golang.org/grpc v1.53.0
 	google.golang.org/protobuf v1.28.1
 )

 require (
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.10 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.1 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.31 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.25 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.32 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.0.23 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.11 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.26 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.25 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.14.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.12.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.18.7 // indirect
+	github.com/aws/smithy-go v1.13.5 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/fatih/color v1.13.0 // indirect
+	github.com/fatih/color v1.14.1 // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
-	github.com/hashicorp/eventlogger v0.1.1-0.20211106154408-4ff8da3a890c // indirect
-	github.com/hashicorp/eventlogger/filters/encrypt v0.1.7 // indirect
+	github.com/hashicorp/eventlogger v0.1.2-0.20230428153751-cca445805f24 // indirect
+	github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20230428153751-cca445805f24 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-hclog v1.1.0 // indirect
-	github.com/hashicorp/go-kms-wrapping/v2 v2.0.4 // indirect
+	github.com/hashicorp/go-hclog v1.5.0 // indirect
+	github.com/hashicorp/go-kms-wrapping/v2 v2.0.9 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/hashicorp/go-uuid v1.0.2 // indirect
+	github.com/hashicorp/go-uuid v1.0.3 // indirect
 	github.com/hashicorp/go-version v1.5.0 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
-	github.com/mattn/go-colorable v0.1.11 // indirect
-	github.com/mattn/go-isatty v0.0.14 // indirect
+	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-isatty v0.0.17 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
-	github.com/mitchellh/pointerstructure v1.2.0 // indirect
+	github.com/mitchellh/pointerstructure v1.2.1 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/zclconf/go-cty v1.10.0 // indirect
-	golang.org/x/crypto v0.0.0-20220313003712-b769efc7c000 // indirect
-	golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd // indirect
-	golang.org/x/sys v0.0.0-20220204135822-1c1b9b1eba6a // indirect
-	golang.org/x/text v0.3.7 // indirect
-	google.golang.org/genproto v0.0.0-20220208230804-65c12eb4c068 // indirect
+	golang.org/x/crypto v0.8.0 // indirect
+	golang.org/x/net v0.9.0 // indirect
+	golang.org/x/sys v0.7.0 // indirect
+	golang.org/x/text v0.9.0 // indirect
+	google.golang.org/genproto v0.0.0-20230303212802-e74f57abe488 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
@@ -1,120 +1,118 @@
-cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/Masterminds/goutils v1.1.0 h1:zukEsf/1JZwCMgHiK3GZftabmxiCw4apj3a28RPBiVg=
-github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3QEww=
-github.com/Masterminds/sprig v2.22.0+incompatible h1:z4yfnGrZ7netVz+0EDJ0Wi+5VZCSYp4Z0m2dk6cEM60=
-github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
+github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
+github.com/Masterminds/semver/v3 v3.2.0 h1:3MEsd0SM6jqZojhjLWWeBY+Kcjy9i6MQAeY7YgDP83g=
+github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj9n6YA=
 github.com/apparentlymart/go-textseg v1.0.0/go.mod h1:z96Txxhf3xSFMPmb5X/1W05FF/Nj9VFpLOpjS5yuumk=
 github.com/apparentlymart/go-textseg/v13 v13.0.0/go.mod h1:ZK2fH7c4NqDTLtiYLvIkEghdlcqw7yxLeM89kiTRPUo=
 github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI=
 github.com/aws/aws-sdk-go v1.30.27/go.mod h1:5zCpMtNQVjRREroY7sYe8lOMRSxkhG6MZveU8YkpAk0=
 github.com/aws/aws-sdk-go v1.44.80 h1:jEXGecSgPdvM5KnyDsSgFhZSm7WwaTp4h544Im4SfhI=
 github.com/aws/aws-sdk-go v1.44.80/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
+github.com/aws/aws-sdk-go-v2 v1.17.7 h1:CLSjnhJSTSogvqUGhIC6LqFKATMRexcxLZ0i/Nzk9Eg=
+github.com/aws/aws-sdk-go-v2 v1.17.7/go.mod h1:uzbQtefpm44goOPmdKyAlXSNcwlRgF3ePWVW6EtJvvw=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.10 h1:dK82zF6kkPeCo8J1e+tGx4JdvDIQzj7ygIoLg8WMuGs=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.10/go.mod h1:VeTZetY5KRJLuD/7fkQXMU6Mw7H5m/KP2J5Iy9osMno=
+github.com/aws/aws-sdk-go-v2/config v1.18.19 h1:AqFK6zFNtq4i1EYu+eC7lcKHYnZagMn6SW171la0bGw=
+github.com/aws/aws-sdk-go-v2/config v1.18.19/go.mod h1:XvTmGMY8d52ougvakOv1RpiTLPz9dlG/OQHsKU/cMmY=
+github.com/aws/aws-sdk-go-v2/credentials v1.13.18 h1:EQMdtHwz0ILTW1hoP+EwuWhwCG1hD6l3+RWFQABET4c=
+github.com/aws/aws-sdk-go-v2/credentials v1.13.18/go.mod h1:vnwlwjIe+3XJPBYKu1et30ZPABG3VaXJYr8ryohpIyM=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.1 h1:gt57MN3liKiyGopcqgNzJb2+d9MJaKT/q1OksHNXVE4=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.1/go.mod h1:lfUx8puBRdM5lVVMQlwt2v+ofiG/X6Ms+dy0UkG/kXw=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.31 h1:sJLYcS+eZn5EeNINGHSCRAwUJMFVqklwkH36Vbyai7M=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.31/go.mod h1:QT0BqUvX1Bh2ABdTGnjqEjvjzrCfIniM9Sc8zn9Yndo=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.25 h1:1mnRASEKnkqsntcxHaysxwgVoUUp5dkiB+l3llKnqyg=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.25/go.mod h1:zBHOPwhBc3FlQjQJE/D3IfPWiWaQmT06Vq9aNukDo0k=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.3.32 h1:p5luUImdIqywn6JpQsW3tq5GNOxKmOnEpybzPx+d1lk=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.3.32/go.mod h1:XGhIBZDEgfqmFIugclZ6FU7v75nHhBDtzuB4xB/tEi4=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.0.23 h1:DWYZIsyqagnWL00f8M/SOr9fN063OEQWn9LLTbdYXsk=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.0.23/go.mod h1:uIiFgURZbACBEQJfqTZPb/jxO7R+9LeoHUFudtIdeQI=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.11 h1:y2+VQzC6Zh2ojtV2LoC0MNwHWc6qXv/j2vrQtlftkdA=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.11/go.mod h1:iV4q2hsqtNECrfmlXyord9u4zyuFEJX9eLgLpSPzWA8=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.26 h1:CeuSeq/8FnYpPtnuIeLQEEvDv9zUjneuYi8EghMBdwQ=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.26/go.mod h1:2UqAAwMUXKeRkAHIlDJqvMVgOWkUi/AUXPk/YIe+Dg4=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.25 h1:5LHn8JQ0qvjD9L9JhMtylnkcw7j05GDZqM9Oin6hpr0=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.25/go.mod h1:/95IA+0lMnzW6XzqYJRpjjsAbKEORVeO0anQqjd2CNU=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.14.0 h1:e2ooMhpYGhDnBfSvIyusvAwX7KexuZaHbQY2Dyei7VU=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.14.0/go.mod h1:bh2E0CXKZsQN+faiKVqC40vfNMAWheoULBCnEgO9K+8=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.31.1 h1:PJH4I+qYjPXclKRbVCW47iYUvtXEh1u6YmDhn5J8VQE=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.31.1/go.mod h1:ncltU6n4Nof5uJttDtcNQ537uNuwYqsZZQcpkd2/GUQ=
+github.com/aws/aws-sdk-go-v2/service/sso v1.12.6 h1:5V7DWLBd7wTELVz5bPpwzYy/sikk0gsgZfj40X+l5OI=
+github.com/aws/aws-sdk-go-v2/service/sso v1.12.6/go.mod h1:Y1VOmit/Fn6Tz1uFAeCO6Q7M2fmfXSCLeL5INVYsLuY=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.6 h1:B8cauxOH1W1v7rd8RdI/MWnoR4Ze0wIHWrb90qczxj4=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.6/go.mod h1:Lh/bc9XUf8CfOY6Jp5aIkQtN+j1mc+nExc+KXj9jx2s=
+github.com/aws/aws-sdk-go-v2/service/sts v1.18.7 h1:bWNgNdRko2x6gqa0blfATqAZKZokPIeM1vfmQt2pnvM=
+github.com/aws/aws-sdk-go-v2/service/sts v1.18.7/go.mod h1:JuTnSoeePXmMVe9G8NcjjwgOKEfZ4cOjMuT2IBT/2eI=
+github.com/aws/smithy-go v1.13.5 h1:hgz0X/DX0dGqTYpGALqXJoRKRj5oQ7150i5FdTePzO8=
+github.com/aws/smithy-go v1.13.5/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
 github.com/bgentry/speakeasy v0.1.0 h1:ByYyxL9InA1OWqxJqqp2A5pYHUrCiAL6K3J+LKSsQkY=
-github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
-github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20211001041855-01bcc9b48dfe/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
-github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
-github.com/envoyproxy/go-control-plane v0.10.2-0.20220325020618-49ff273808a1/go.mod h1:KJwIaB5Mv44NWtYuAOFCVOjcI94vtpEz2JU/D2v6IjE=
-github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
-github.com/fatih/color v1.13.0 h1:8LOYc1KYPPmyKMuN8QV2DNRWNbLo6LZ0iLs8+mlH53w=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
-github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/fatih/color v1.14.1 h1:qfhVLaG5s+nCROl1zJsZRxFeYrHLqWroPOQ8BWiNb4w=
+github.com/fatih/color v1.14.1/go.mod h1:2oHN61fhTpgcxD3TSWCgKDiH1+x4OiDVVGH8WlgGZGg=
 github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
 github.com/go-test/deep v1.0.4 h1:u2CU3YKy9I2pmu9pX0eq50wCgjfGIt539SqR7FbHiho=
 github.com/go-test/deep v1.0.4/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/protobuf v1.1.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
 github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
-github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
-github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
-github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
-github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
-github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
-github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
 github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/uuid v1.1.2 h1:EVhdT+1Kseyi1/pUmXKaFxYsDNy9RQYkMWRH68J/W7Y=
-github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/hashicorp/boundary/sdk v0.0.21 h1:amDhqGTQh8+AMBKe4rLeqJUxntkviurWV9ws2UUhFHI=
-github.com/hashicorp/boundary/sdk v0.0.21/go.mod h1:LQJL4dxljJc1rhsc8j0IC+P5vh8Ttr7onfqGGDFzd2w=
+github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
+github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/hashicorp/boundary/sdk v0.0.33 h1:kHaVZ3b9j1QvYlG+vhAgrbXh8/+Rq2qlUIs8fKMQH7k=
+github.com/hashicorp/boundary/sdk v0.0.33/go.mod h1:jn9j5mM8v2pOk8aLeJNIszdm7WBf4gRSP68iy8Iu5Q0=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/eventlogger v0.1.1-0.20211106154408-4ff8da3a890c h1:u1Zq+LfTXaagmJCHK3XH/fi7pk7oRY933VjGNG7/Ynw=
-github.com/hashicorp/eventlogger v0.1.1-0.20211106154408-4ff8da3a890c/go.mod h1:NaXU8p/pl5a2RX/N0/yncinT3Iw5CLkbF4JRxAVnk3c=
-github.com/hashicorp/eventlogger/filters/encrypt v0.1.7 h1:jzy2xrrF3IxDfogmPQRirRYY2chDhuYwlhE04/eV3f8=
-github.com/hashicorp/eventlogger/filters/encrypt v0.1.7/go.mod h1:ycg+hq87tTd9DvK5+izfoYD2bXKxhS4mM0vn9KePpK4=
+github.com/hashicorp/eventlogger v0.1.2-0.20230428153751-cca445805f24 h1:vtCJgcxwDMFrpUgVMfjtwXY1YqvHbj8pNA7GsXYEoLg=
+github.com/hashicorp/eventlogger v0.1.2-0.20230428153751-cca445805f24/go.mod h1://CHt6/j+Q2lc0NlUB5af4aS2M0c0aVBg9/JfcpAyhM=
+github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20230428153751-cca445805f24 h1:mopKPTxSaVr24uSysyRwywTDs85L5b05qqZvEkWa0qc=
+github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20230428153751-cca445805f24/go.mod h1:EQPLoX6CONA9BSYUovTQBHfPGE91g7wOxv03sO29FzY=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
 github.com/hashicorp/go-hclog v0.16.2/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
-github.com/hashicorp/go-hclog v1.1.0 h1:QsGcniKx5/LuX2eYoeL+Np3UKYPNaN7YKpTh29h8rbw=
-github.com/hashicorp/go-hclog v1.1.0/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
-github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.2 h1:it114Kjpk79JVh6AfxFMP5oi1gb+RPzcSLiG3zF/J0w=
-github.com/hashicorp/go-kms-wrapping/v2 v2.0.4 h1:7BSAm60AqJom/TRb73wmaCzwco9A+Qolr/wCi0PORmY=
-github.com/hashicorp/go-kms-wrapping/v2 v2.0.4/go.mod h1:sDQAfwJGv25uGPZA04x87ERglCG6avnRcBT9wYoMII8=
+github.com/hashicorp/go-hclog v1.5.0 h1:bI2ocEMgcVlz55Oj1xZNBsVi900c7II+fWDyV9o+13c=
+github.com/hashicorp/go-hclog v1.5.0/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
+github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.4 h1:8z+Zi0uLYXONkxwWb/D7O5t1IUucB6Ft3uvSOa950bM=
+github.com/hashicorp/go-kms-wrapping/v2 v2.0.9 h1:JpCvi97NMA+saNqO8ovQcGoRbBq6P5ZZlJqvOsW5ick=
+github.com/hashicorp/go-kms-wrapping/v2 v2.0.9/go.mod h1:NtMaPhqSlfQ72XWDD2g80o8HI8RKkowIB8/WZHMyPY4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-plugin v1.4.3 h1:DXmvivbWD5qdiBts9TpBC7BYL1Aia5sxbRgQB+v6UZM=
+github.com/hashicorp/go-plugin v1.4.9 h1:ESiK220/qE0aGxWdzKIvRH69iLiuN/PjoLTm69RoWtU=
 github.com/hashicorp/go-secure-stdlib/awsutil v0.1.6 h1:W9WN8p6moV1fjKLkeqEgkAMu5rauy9QeYDAmIaPuuiA=
 github.com/hashicorp/go-secure-stdlib/awsutil v0.1.6/go.mod h1:MpCPSPGLDILGb4JMm94/mMi3YysIqsXzGCzkEZjcjXg=
 github.com/hashicorp/go-secure-stdlib/base62 v0.1.1/go.mod h1:EdWO6czbmthiwZ3/PUsDV+UD1D5IRU4ActiaWGwt0Yw=
 github.com/hashicorp/go-secure-stdlib/base62 v0.1.2 h1:ET4pqyjiGmY09R5y+rSd70J2w45CtbWDNvGqWp/R3Ng=
-github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.5 h1:o1rvQfjcXq9XYaeU9xqrI0wGtxNdAm3cEtt6G6/tiHw=
-github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.4 h1:6ajbq64FhrIJZ6prrff3upVVDil4yfCrnSKwTH0HIPE=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.2 h1:Tz6v3Jb2DRnDCfifRSjYKG0m8dLdNq6bcDkB41en7nw=
-github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.2 h1:4I1pot2HFhZmXbZL6X2dS0EGR6flsxd+FpaL/BpTXF0=
+github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.9 h1:YZ01/aiARPneDUryzjiPGvr3pmjCSC+1WBZKI1P7I7k=
+github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.6 h1:rOmnqOSUBn5opme1Kh9OXO8qWd0KztO+f02vvCwCc/w=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7 h1:UpiO20jno/eV1eVZcxqWnUohyKRe1g8FPV/xH1s/2qs=
+github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.4 h1:IU2iGcvthrJ53rPbQU6B4+iVs/cLPO89ti5dd2XEj3k=
 github.com/hashicorp/go-secure-stdlib/reloadutil v0.1.1 h1:SMGUnbpAcat8rIKHkBPjfv81yC46a8eCNZ2hsR2l1EI=
-github.com/hashicorp/go-secure-stdlib/strutil v0.1.1 h1:nd0HIW15E6FG1MsnArYaHfuw9C2zgzM8LxkG5Ty/788=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U=
-github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.1 h1:Yc026VyMyIpq1UWRnakHRG01U8fJm+nEfEmjoAb00n8=
+github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts=
+github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.2 h1:phcbL8urUzF/kxA/Oj6awENaRwfWsjP59GW7u2qlDyY=
 github.com/hashicorp/go-sockaddr v1.0.2 h1:ztczhD1jLxIRjVejw8gFomI1BQZOe2WoVOu0SyteCQc=
-github.com/hashicorp/go-uuid v1.0.2 h1:cfejS+Tpcp13yd5nYHWDI6qVCny6wyX2Mt5SGur2IGE=
 github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
+github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-version v1.5.0 h1:O293SZ2Eg+AAYijkVK3jR786Am1bhDEh2GHT0tIVE5E=
 github.com/hashicorp/go-version v1.5.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
 github.com/hashicorp/terraform-json v0.14.0 h1:sh9iZ1Y8IFJLx+xQiKHGud6/TSUCM0N8e17dKDpqV7s=
 github.com/hashicorp/terraform-json v0.14.0/go.mod h1:5A9HIWPkk4e5aeeXIBbkcOvaZbIYnAIkEyqP2pNSckM=
-github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb h1:b5rjCoWHc7eqmAS4/qyk21ZsHyb6Mxv/jykxvNTkU4M=
-github.com/huandu/xstrings v1.3.2 h1:L18LIDzqlW6xN2rEkpdV8+oL/IXWJ1APd+vsdYy4Wdw=
-github.com/imdario/mergo v0.3.11 h1:3tnifQM4i+fbajXKBHXWEH+KvNHqojZ778UH75j3bGA=
+github.com/hashicorp/yamux v0.1.1 h1:yrQxtgseBDrq9Y652vSRDvsKCJKOUD+GzTS4Y0Y8pvE=
+github.com/huandu/xstrings v1.4.0 h1:D17IlohoQq4UcpqD7fDk80P7l+lwAmlFaBHgOipl2FU=
+github.com/imdario/mergo v0.3.13 h1:lFzP57bqS/wsqKssCGmtLAb8A0wKjLGrve2q3PPVcBk=
 github.com/jefferai/isbadcipher v0.0.0-20190226160619-51d2077c035f h1:E87tDTVS5W65euzixn7clSzK66puSt1H4I5SC0EmHH4=
 github.com/jmespath/go-jmespath v0.3.0/go.mod h1:9QtRXoHjLGCJ5IBSaohpXITPlowMeeYCZ7fLUTSywik=
 github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
@@ -133,48 +131,54 @@ github.com/kylelemons/godebug v0.0.0-20170820004349-d65d576e9348/go.mod h1:B69LE
 github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
 github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
-github.com/mattn/go-colorable v0.1.11 h1:nQ+aFkoE2TMGc0b68U2OKSexC+eq46+XwZzWXHRmPYs=
-github.com/mattn/go-colorable v0.1.11/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
+github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
+github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
+github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
-github.com/mattn/go-isatty v0.0.14 h1:yVuAays6BHfxijgZPzw+3Zlu5yQgKGP2/hcQbHb7S9Y=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
-github.com/mitchellh/cli v1.1.2 h1:PvH+lL2B7IQ101xQL63Of8yFS2y+aDlsFcsqNc+u/Kw=
+github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-isatty v0.0.17 h1:BTarxUcIeDqL27Mc+vyvdWYSL28zpIhv3RoTdsLMPng=
+github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mitchellh/cli v1.1.5 h1:OxRIeJXpAMztws/XHlN2vu6imG5Dpq+j61AzAX5fLng=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
-github.com/mitchellh/go-testing-interface v1.0.0 h1:fzU/JVNcaqHQEcVFAKeR41fkiLdIPrefOvVG1VZ96U0=
+github.com/mitchellh/go-testing-interface v1.14.1 h1:jrgshOhYAUVNMAJiKbEu7EqAwgJJ2JqpQmpLJOu07cU=
 github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/mitchellh/pointerstructure v1.2.0 h1:O+i9nHnXS3l/9Wu7r4NrEdwA2VFTicjUEN1uBnDo34A=
-github.com/mitchellh/pointerstructure v1.2.0/go.mod h1:BRAsLI5zgXmw97Lf6s25bs8ohIXc3tViBH44KcwB2g4=
+github.com/mitchellh/pointerstructure v1.2.1 h1:ZhBBeX8tSlRpu/FFhXH4RC4OJzFlqsQhoHZAz4x7TIw=
+github.com/mitchellh/pointerstructure v1.2.1/go.mod h1:BRAsLI5zgXmw97Lf6s25bs8ohIXc3tViBH44KcwB2g4=
 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
-github.com/oklog/run v1.0.0 h1:Ru7dDtJNOyC66gQ5dQmaCa0qIsAUFY3sFpK1Xk8igrw=
+github.com/oklog/run v1.1.0 h1:GEenZ1cK0+q0+wsJew9qUg/DyD8k3JzYsZAi5gYi2mA=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/posener/complete v1.2.3 h1:NP0eAhjcjImqslEwo/1hq7gpajME0fTLTezBKDqfXqo=
-github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
 github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
 github.com/rogpeppe/go-internal v1.6.2 h1:aIihoIOHCiLZHxyoNQ+ABL4NKhFTgKLBdMLyEAh98m0=
 github.com/rogpeppe/go-internal v1.6.2/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
 github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
 github.com/sebdah/goldie v1.0.0/go.mod h1:jXP4hmWywNEwZzhMuv2ccnqTSFpuq8iyQhtQdkkZBH4=
+github.com/shopspring/decimal v1.3.1 h1:2Usl1nmF/WZucqkFZhnfFYxxxu8LG21F6nPQBE5gKV8=
+github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
+github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8=
+github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/vmihailenco/msgpack v3.3.3+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
 github.com/vmihailenco/msgpack/v4 v4.3.12/go.mod h1:gborTTJjAo/GWTqqRjrLCn9pgNN+NXzzngzBKDPIqw4=
 github.com/vmihailenco/tagparser v0.1.1/go.mod h1:OeAg3pn3UbLjkWt+rN9oFYB6u/cQgqMEUPoW2WPyhdI=
@@ -183,119 +187,76 @@ github.com/zclconf/go-cty v1.2.0/go.mod h1:hOPWgoHbaTUnI5k4D2ld+GRpFJSCe6bCM7m1q
 github.com/zclconf/go-cty v1.10.0 h1:mp9ZXQeIcN8kAwuqorjH+Q+njbJKjLrvB2yIh4q7U+0=
 github.com/zclconf/go-cty v1.10.0/go.mod h1:vVKLxnk3puL4qRAv72AO+W99LUD4da90g3uUAzyuvAk=
 github.com/zclconf/go-cty-debug v0.0.0-20191215020915-b22d67c1ba0b/go.mod h1:ZRKQfBXbGkpdV6QMzT3rU1kSTAnfu1dO8dPKjYprgj8=
-go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
 go.uber.org/goleak v1.0.0 h1:qsup4IcBdlmsnGfqyLl4Ntn3C2XCCuKAE7DwHpScyUo=
 go.uber.org/goleak v1.0.0/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20220313003712-b769efc7c000 h1:SL+8VVnkqyshUSz5iNnXtrBQzvFF2SkROm6t5RczFAE=
-golang.org/x/crypto v0.0.0-20220313003712-b769efc7c000/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/crypto v0.8.0 h1:pd9TJtTueMTVQXzk8E2XESSMQDj/U7OUu0PqJqPXQjQ=
+golang.org/x/crypto v0.8.0/go.mod h1:mRqEX+O9/h5TFCrQhkgjo2yKi0yYA+9ecGkdQoHrywE=
 golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/lint v0.0.0-20210508222113-6edffad5e616 h1:VLliZ0d+/avPrXXH+OakdXhpJuEoBZuwh1m2j7U6Iug=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180811021610-c39426892332/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
-golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd h1:O7DYs+zxREGLKzKoMQrtrEacpb0ZVXA5rIwylE2Xchk=
 golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/net v0.9.0 h1:aWJ/m6xSmxWBx+V0XRHTlrYrPG56jKsLdTFmsSsCzOM=
+golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200602225109-6fdc65e7d980/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220204135822-1c1b9b1eba6a h1:ppl5mZgokTT8uPkmYOyEUmPTr3ypaKkg5eFOGrAmxxE=
-golang.org/x/sys v0.0.0-20220204135822-1c1b9b1eba6a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.7.0 h1:3jlCCIQZPdOYu1h8BkNvLz8Kgwtae2cagcG/VamtZRU=
+golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7 h1:olpwvP2KacW1ZWvsR7uQhoyTYvKAupfQrRGBFM352Gk=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20191108193012-7d206e10da11/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20210101214203-2dba1e4ea05c/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.1.5 h1:ouewzE6p+/VEB31YYnTbEJdi8pFqKp4P4n85vwo3DHA=
+golang.org/x/tools v0.6.0 h1:BOw41kyTf3PuCW1pVQf8+Cyg8pMlkYB1oo9iJ6D/lKM=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
-google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20220208230804-65c12eb4c068 h1:pwzFiZfBTH/GjBWz1BcDwMBaHBo8mZvpLa7eBKJpFAk=
-google.golang.org/genproto v0.0.0-20220208230804-65c12eb4c068/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
-google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
-google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
-google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.44.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
-google.golang.org/grpc v1.48.0 h1:rQOsyJ/8+ufEDJd/Gdsz7HG220Mh9HAhFHRGnIjda0w=
-google.golang.org/grpc v1.48.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
-google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
-google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
-google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
-google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
-google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
-google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
+google.golang.org/genproto v0.0.0-20230303212802-e74f57abe488 h1:QQF+HdiI4iocoxUjjpLgvTYDHKm99C/VtTBFnfiCJos=
+google.golang.org/genproto v0.0.0-20230303212802-e74f57abe488/go.mod h1:TvhZT5f700eVlTNwND1xoEZQeWTB2RY/65kplwl/bFA=
+google.golang.org/grpc v1.53.0 h1:LAv2ds7cmFV/XTS3XG1NneeENYrXGmorPxsBbptIjNc=
+google.golang.org/grpc v1.53.0/go.mod h1:OnIrk0ipVdj4N5d9IUoFUx72/VlD7+jUsHwZgwSMQpw=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=
 google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -304,12 +265,9 @@ gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogR
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 mvdan.cc/gofumpt v0.1.1/go.mod h1:yXG1r1WqZVKWbVRtBWKWX9+CxGYfA51nSomhM0woR48=
@@ -0,0 +1,96 @@
+package credential
+
+import (
+	"fmt"
+
+	"github.com/aws/aws-sdk-go/aws/endpoints"
+	"github.com/hashicorp/boundary-plugin-aws/internal/errors"
+	"github.com/hashicorp/boundary-plugin-aws/internal/values"
+	"github.com/hashicorp/go-secure-stdlib/awsutil"
+	"google.golang.org/protobuf/types/known/structpb"
+)
+
+// CredentialAttributes contains attributes used for AWS credentials
+type CredentialAttributes struct {
+	// Region is the region associated with the aws credentials
+	Region string
+
+	// DisableCredentialRotation disables the rotation of aws secrets associated with the plugin
+	DisableCredentialRotation bool
+}
+
+// GetCredentialsConfig parses values out of a protobuf struct input and returns a
+// CredentialsConfig used for configuring an AWS session. An error is returned if
+// any of the following fields are missing from the protobuf struct input or have
+// invalid value types: access_key_id, secret_access_key. An error is returned if
+// any unrecognized fields are found in the protobuf struct input.
+func GetCredentialsConfig(in *structpb.Struct, region string) (*awsutil.CredentialsConfig, error) {
+	unknownFields := values.StructFields(in)
+	badFields := make(map[string]string)
+
+	accessKey, err := values.GetStringValue(in, ConstAccessKeyId, true)
+	if err != nil {
+		badFields[fmt.Sprintf("secrets.%s", ConstAccessKeyId)] = err.Error()
+	}
+	delete(unknownFields, ConstAccessKeyId)
+
+	secretKey, err := values.GetStringValue(in, ConstSecretAccessKey, true)
+	if err != nil {
+		badFields[fmt.Sprintf("secrets.%s", ConstSecretAccessKey)] = err.Error()
+	}
+	delete(unknownFields, ConstSecretAccessKey)
+
+	if region == "" {
+		badFields[fmt.Sprintf("attributes.%s", ConstRegion)] = err.Error()
+	}
+
+	// the creds_last_rotated_time field will be found in the input struct for
+	// persisted secrets, this value is not needed for creating the CredentialsConfig
+	delete(unknownFields, ConstCredsLastRotatedTime)
+	for s := range unknownFields {
+		badFields[fmt.Sprintf("secrets.%s", s)] = "unrecognized field"
+	}
+
+	if len(badFields) > 0 {
+		return nil, errors.InvalidArgumentError("Error in the secrets provided", badFields)
+	}
+
+	return awsutil.NewCredentialsConfig(
+		awsutil.WithAccessKey(accessKey),
+		awsutil.WithSecretKey(secretKey),
+		awsutil.WithRegion(region),
+	)
+}
+
+// GetCredentialAttributes parses values out of a protobuf struct input and returns a
+// CredentialAttributes used for configuring an AWS session. An error is returned if
+// any of the following fields are missing from the protobuf struct input or have
+// invalid value types: region, disableCredentialRotation
+func GetCredentialAttributes(in *structpb.Struct) (*CredentialAttributes, error) {
+	badFields := make(map[string]string)
+
+	region, err := values.GetStringValue(in, ConstRegion, true)
+	if err != nil {
+		badFields[fmt.Sprintf("attributes.%s", ConstRegion)] = err.Error()
+	}
+
+	if region != "" {
+		if _, found := endpoints.PartitionForRegion(endpoints.DefaultPartitions(), region); !found {
+			badFields[fmt.Sprintf("attributes.%s", ConstRegion)] = fmt.Sprintf("not a valid region: %s", region)
+		}
+	}
+
+	disableCredentialRotation, err := values.GetBoolValue(in, ConstDisableCredentialRotation, false)
+	if err != nil {
+		badFields[fmt.Sprintf("attributes.%s", ConstDisableCredentialRotation)] = err.Error()
+	}
+
+	if len(badFields) > 0 {
+		return nil, errors.InvalidArgumentError("Error in the attributes provided", badFields)
+	}
+
+	return &CredentialAttributes{
+		Region:                    region,
+		DisableCredentialRotation: disableCredentialRotation,
+	}, nil
+}
@@ -0,0 +1,173 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package credential
+
+import (
+	"testing"
+
+	"github.com/hashicorp/go-secure-stdlib/awsutil"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/structpb"
+)
+
+func TestGetCredentialAttributes(t *testing.T) {
+	cases := []struct {
+		name                string
+		in                  map[string]any
+		expected            *CredentialAttributes
+		expectedErrContains string
+	}{
+		{
+			name:                "missing region",
+			in:                  map[string]any{},
+			expectedErrContains: "missing required value \"region\"",
+		},
+		{
+			name: "invalid aws region value",
+			in: map[string]any{
+				ConstRegion: "dne",
+			},
+			expectedErrContains: "not a valid region",
+		},
+		{
+			name: "bad value for disable_credential_rotation",
+			in: map[string]any{
+				ConstRegion:                    "us-west-2",
+				ConstDisableCredentialRotation: "sure",
+			},
+			expectedErrContains: "unexpected type for value \"disable_credential_rotation\": want bool, got string",
+		},
+		{
+			name: "default",
+			in: map[string]any{
+				ConstRegion: "us-west-2",
+			},
+			expected: &CredentialAttributes{
+				Region:                    "us-west-2",
+				DisableCredentialRotation: false,
+			},
+		},
+		{
+			name: "with disable_credential_rotation",
+			in: map[string]any{
+				ConstRegion:                    "us-west-2",
+				ConstDisableCredentialRotation: true,
+			},
+			expected: &CredentialAttributes{
+				Region:                    "us-west-2",
+				DisableCredentialRotation: true,
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			require := require.New(t)
+
+			input, err := structpb.NewStruct(tc.in)
+			require.NoError(err)
+
+			actual, err := GetCredentialAttributes(input)
+			if tc.expectedErrContains != "" {
+				require.Error(err)
+				require.Contains(err.Error(), tc.expectedErrContains)
+				require.Equal(status.Code(err), codes.InvalidArgument)
+				return
+			}
+
+			require.NoError(err)
+			require.EqualValues(tc.expected.Region, actual.Region)
+			require.EqualValues(tc.expected.DisableCredentialRotation, actual.DisableCredentialRotation)
+		})
+	}
+}
+
+func TestGetCredentialsConfig(t *testing.T) {
+	cases := []struct {
+		name                string
+		in                  map[string]any
+		region              string
+		expected            *awsutil.CredentialsConfig
+		expectedErrContains string
+	}{
+		{
+			name:                "missing access_key_id",
+			in:                  map[string]any{},
+			region:              "us-west-2",
+			expectedErrContains: "missing required value \"access_key_id\"",
+		},
+		{
+			name: "missing secret_access_key",
+			in: map[string]any{
+				ConstAccessKeyId: "foobar",
+			},
+			region:              "us-west-2",
+			expectedErrContains: "missing required value \"secret_access_key\"",
+		},
+		{
+			name: "unknown fields",
+			in: map[string]any{
+				ConstAccessKeyId:     "foobar",
+				ConstSecretAccessKey: "bazqux",
+				"foo":                true,
+				"bar":                true,
+			},
+			region:              "us-west-2",
+			expectedErrContains: "secrets.bar: unrecognized field, secrets.foo: unrecognized field",
+		},
+		{
+			name: "valid ignore creds_last_rotated_time",
+			in: map[string]any{
+				ConstAccessKeyId:          "foobar",
+				ConstSecretAccessKey:      "bazqux",
+				ConstCredsLastRotatedTime: "2006-01-02T15:04:05+07:00",
+			},
+			region: "us-west-2",
+			expected: &awsutil.CredentialsConfig{
+				AccessKey: "foobar",
+				SecretKey: "bazqux",
+				Region:    "us-west-2",
+			},
+		},
+		{
+			name: "good",
+			in: map[string]any{
+				ConstAccessKeyId:     "foobar",
+				ConstSecretAccessKey: "bazqux",
+			},
+			region: "us-west-2",
+			expected: &awsutil.CredentialsConfig{
+				AccessKey: "foobar",
+				SecretKey: "bazqux",
+				Region:    "us-west-2",
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			require := require.New(t)
+
+			input, err := structpb.NewStruct(tc.in)
+			require.NoError(err)
+
+			actual, err := GetCredentialsConfig(input, tc.region)
+			if tc.expectedErrContains != "" {
+				require.Error(err)
+				require.Contains(err.Error(), tc.expectedErrContains)
+				require.Equal(status.Code(err), codes.InvalidArgument)
+				return
+			}
+
+			require.NoError(err)
+			require.Equal(tc.expected.AccessKey, actual.AccessKey)
+			require.Equal(tc.expected.SecretKey, actual.SecretKey)
+			require.Equal(tc.expected.Region, actual.Region)
+		})
+	}
+}
@@ -0,0 +1,18 @@
+package credential
+
+const (
+	// ConstAccessKey is the key for the region in the aws credentials.
+	ConstRegion = "region"
+
+	// ConstAccessKey is the key for the access key id in the aws credentials.
+	ConstAccessKeyId = "access_key_id"
+
+	// ConstSecretAccessKey is the key for the secret access key in the aws credentials.
+	ConstSecretAccessKey = "secret_access_key"
+
+	// ConstDisableCredentialRotation is the key for the disable credential rotation in the aws credentials.
+	ConstDisableCredentialRotation = "disable_credential_rotation"
+
+	// ConstCredsLastRotatedTime is the key for the last rotated time in the aws credentials.
+	ConstCredsLastRotatedTime = "creds_last_rotated_time"
+)
@@ -1,47 +1,55 @@
-package plugin
+package credential

 import (
 	"errors"
 	"fmt"
-	"net"
-	"net/http"
 	"time"

-	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/ec2"
-	"github.com/aws/aws-sdk-go/service/ec2/ec2iface"
 	"github.com/aws/aws-sdk-go/service/iam"
-	pb "github.com/hashicorp/boundary/sdk/pbs/plugin"
+	"github.com/hashicorp/boundary-plugin-aws/internal/values"
 	"github.com/hashicorp/go-secure-stdlib/awsutil"
 	"google.golang.org/protobuf/types/known/structpb"
 )

-type ec2APIFunc func(*session.Session, ...*aws.Config) (ec2iface.EC2API, error)
+// rotationWaitTimeout controls the time we wait for credential rotation to
+// succeed. This is important to ensure that rotated credentials can be used
+// right away.
+const rotationWaitTimeout = time.Second * 30

-type awsCatalogPersistedStateOption func(s *awsCatalogPersistedState) error
+type AwsCredentialPersistedStateOption func(s *AwsCredentialPersistedState) error

-func withStateTestOpts(opts []awsutil.Option) awsCatalogPersistedStateOption {
-	return func(s *awsCatalogPersistedState) error {
+// AwsCredentialPersistedState is the persisted state for the AWS credential.
+type AwsCredentialPersistedState struct {
+	// AccessKeyId is the access key id for the AWS credential.
+	AccessKeyId string
+	// SecretAccessKey is the secret access key for the AWS credential.
+	SecretAccessKey string
+	// CredsLastRotatedTime is the last rotation of aws secrets for the AWS credential.
+	CredsLastRotatedTime time.Time
+
+	// testOpts are options that should be used for testing only
+	testOpts []awsutil.Option
+
+	// Region is not a part of persisted state but if set is passed to clients
+	// created with this state
+	region string
+}
+
+// WithStateTestOpts enables unit testing different edge cases
+// when using CredentialsConfig. This should never be used in
+// production code. This should only be used in unit tests.
+func WithStateTestOpts(opts []awsutil.Option) AwsCredentialPersistedStateOption {
+	return func(s *AwsCredentialPersistedState) error {
 		s.testOpts = opts
 		return nil
 	}
 }

-func withTestEC2APIFunc(f ec2APIFunc) awsCatalogPersistedStateOption {
-	return func(s *awsCatalogPersistedState) error {
-		if s.testEC2APIFunc != nil {
-			return errors.New("test API function already set")
-		}
-
-		s.testEC2APIFunc = f
-		return nil
-	}
-}
-
-func withAccessKeyId(x string) awsCatalogPersistedStateOption {
-	return func(s *awsCatalogPersistedState) error {
+// WithAccessKeyId sets the value for AccesskeyId in the storage persisted state.
+func WithAccessKeyId(x string) AwsCredentialPersistedStateOption {
+	return func(s *AwsCredentialPersistedState) error {
 		if s.AccessKeyId != "" {
 			return errors.New("access key id already set")
 		}
@@ -51,8 +59,9 @@ func withAccessKeyId(x string) awsCatalogPersistedStateOption {
 	}
 }

-func withSecretAccessKey(x string) awsCatalogPersistedStateOption {
-	return func(s *awsCatalogPersistedState) error {
+// WithSecretAccessKey sets the value for SecretAccessKey in the storage persisted state.
+func WithSecretAccessKey(x string) AwsCredentialPersistedStateOption {
+	return func(s *AwsCredentialPersistedState) error {
 		if s.SecretAccessKey != "" {
 			return errors.New("secret access key already set")
 		}
@@ -62,8 +71,9 @@ func withSecretAccessKey(x string) awsCatalogPersistedStateOption {
 	}
 }

-func withCredsLastRotatedTime(t time.Time) awsCatalogPersistedStateOption {
-	return func(s *awsCatalogPersistedState) error {
+// WithCredsLastRotatedTime sets the value for CredsLastRotatedTime in the storage persisted state.
+func WithCredsLastRotatedTime(t time.Time) AwsCredentialPersistedStateOption {
+	return func(s *AwsCredentialPersistedState) error {
 		if !s.CredsLastRotatedTime.IsZero() {
 			return errors.New("last rotation time already set")
 		}
@@ -73,8 +83,9 @@ func withCredsLastRotatedTime(t time.Time) awsCatalogPersistedStateOption {
 	}
 }

-func withRegion(with string) awsCatalogPersistedStateOption {
-	return func(s *awsCatalogPersistedState) error {
+// WithRegion sets the value for region in the storage persisted state.
+func WithRegion(with string) AwsCredentialPersistedStateOption {
+	return func(s *AwsCredentialPersistedState) error {
 		if s.region != "" {
 			return errors.New("region already set")
 		}
@@ -84,24 +95,11 @@ func withRegion(with string) awsCatalogPersistedStateOption {
 	}
 }

-type awsCatalogPersistedState struct {
-	AccessKeyId          string
-	SecretAccessKey      string
-	CredsLastRotatedTime time.Time
-
-	// testOpts are options that should be used for testing only
-	testOpts []awsutil.Option
-
-	// testEC2APIFunc provides a way to provide a factory for a mock EC2 client
-	testEC2APIFunc ec2APIFunc
-
-	// Region is not a part of persisted state but if set is passed to clients
-	// created with this state
-	region string
-}
-
-func newAwsCatalogPersistedState(opts ...awsCatalogPersistedStateOption) (*awsCatalogPersistedState, error) {
-	s := new(awsCatalogPersistedState)
+// NewAwsCredentialPersistedState returns a AwsCredentialPersistedState.
+// Supported options include: WithAccessKeyId, WithSecretAccessKey
+// WithCredsLastRotatedTime, & WithRegion.
+func NewAwsCredentialPersistedState(opts ...AwsCredentialPersistedStateOption) (*AwsCredentialPersistedState, error) {
+	s := new(AwsCredentialPersistedState)
 	for _, opt := range opts {
 		if err := opt(s); err != nil {
 			return nil, err
@@ -111,53 +109,10 @@ func newAwsCatalogPersistedState(opts ...awsCatalogPersistedStateOption) (*awsCa
 	return s, nil
 }

-func awsCatalogPersistedStateFromProto(in *pb.HostCatalogPersisted, opts ...awsCatalogPersistedStateOption) (*awsCatalogPersistedState, error) {
-	data := in.GetSecrets()
-	if data == nil {
-		return nil, errors.New("missing persisted secrets")
-	}
-
-	accessKeyId, err := getStringValue(data, constAccessKeyId, true)
-	if err != nil {
-		return nil, fmt.Errorf("persisted state integrity error: %w", err)
-	}
-
-	secretAccessKey, err := getStringValue(data, constSecretAccessKey, true)
-	if err != nil {
-		return nil, fmt.Errorf("persisted state integrity error: %w", err)
-	}
-
-	credsLastRotatedTime, err := getTimeValue(data, constCredsLastRotatedTime)
-	if err != nil {
-		return nil, fmt.Errorf("persisted state integrity error: %w", err)
-	}
-
-	s, err := newAwsCatalogPersistedState(opts...)
-	if err != nil {
-		return nil, err
-	}
-
-	s.AccessKeyId = accessKeyId
-	s.SecretAccessKey = secretAccessKey
-	s.CredsLastRotatedTime = credsLastRotatedTime
-
-	return s, nil
-}
-
-func (s *awsCatalogPersistedState) ToProto() (*pb.HostCatalogPersisted, error) {
-	data, err := structpb.NewStruct(map[string]interface{}{
-		constAccessKeyId:          s.AccessKeyId,
-		constSecretAccessKey:      s.SecretAccessKey,
-		constCredsLastRotatedTime: s.CredsLastRotatedTime.Format(time.RFC3339Nano),
-	})
-	if err != nil {
-		return nil, fmt.Errorf("error converting state to structpb.Struct: %w", err)
-	}
-
-	return &pb.HostCatalogPersisted{Secrets: data}, nil
-}
-
-func (s *awsCatalogPersistedState) ValidateCreds() error {
+// ValidateCreds takes the access key and secret key from the persisted state
+// and runs sts.GetCallerIdentity for the current credentials, which is done
+// to check that the credentials are valid.
+func (s *AwsCredentialPersistedState) ValidateCreds() error {
 	c, err := awsutil.NewCredentialsConfig(append([]awsutil.Option{
 		awsutil.WithAccessKey(s.AccessKeyId),
 		awsutil.WithSecretKey(s.SecretAccessKey),
@@ -174,7 +129,12 @@ func (s *awsCatalogPersistedState) ValidateCreds() error {
 	return nil
 }

-func (s *awsCatalogPersistedState) RotateCreds() error {
+// RotateCreds takes the access key and secret key from the persisted state and creates a new access/secret key,
+// then deletes the old access key. If deletion of the old access key is successful, the new access key/secret key are
+// written into the credentials config and the persisted state. On any error, the old credentials are not overwritten.
+// This ensures that any generated new secret key never leaves this function in case of an error, even though it will
+// still result in an extraneous access key existing.
+func (s *AwsCredentialPersistedState) RotateCreds() error {
 	c, err := awsutil.NewCredentialsConfig(append([]awsutil.Option{
 		awsutil.WithAccessKey(s.AccessKeyId),
 		awsutil.WithSecretKey(s.SecretAccessKey),
@@ -200,7 +160,7 @@ func (s *awsCatalogPersistedState) RotateCreds() error {
 // ReplaceCreds replaces the access key in the state with a new key.
 // If the existing key was rotated at any point in time, it is
 // deleted first, otherwise it's left alone.
-func (s *awsCatalogPersistedState) ReplaceCreds(accessKeyId, secretAccessKey string) error {
+func (s *AwsCredentialPersistedState) ReplaceCreds(accessKeyId, secretAccessKey string) error {
 	if accessKeyId == "" {
 		return errors.New("access key id cannot be empty")
 	}
@@ -232,7 +192,7 @@ func (s *awsCatalogPersistedState) ReplaceCreds(accessKeyId, secretAccessKey str
 // DeleteCreds deletes the credentials in the state. The access key
 // ID, secret access key, and rotation time fields are zeroed out in
 // the state just to ensure that they cannot be re-used after.
-func (s *awsCatalogPersistedState) DeleteCreds() error {
+func (s *AwsCredentialPersistedState) DeleteCreds() error {
 	c, err := awsutil.NewCredentialsConfig(append([]awsutil.Option{
 		awsutil.WithAccessKey(s.AccessKeyId),
 		awsutil.WithSecretKey(s.SecretAccessKey),
@@ -267,7 +227,7 @@ func (s *awsCatalogPersistedState) DeleteCreds() error {

 // GetSession returns a configured AWS session for the credentials in
 // the state.
-func (s *awsCatalogPersistedState) GetSession() (*session.Session, error) {
+func (s *AwsCredentialPersistedState) GetSession() (*session.Session, error) {
 	c, err := awsutil.NewCredentialsConfig(append([]awsutil.Option{
 		awsutil.WithAccessKey(s.AccessKeyId),
 		awsutil.WithSecretKey(s.SecretAccessKey),
@@ -280,45 +240,50 @@ func (s *awsCatalogPersistedState) GetSession() (*session.Session, error) {
 	return c.GetSession()
 }

-var customClient = &http.Client{
-	Transport: &http.Transport{
-		Proxy: http.ProxyFromEnvironment,
-		DialContext: (&net.Dialer{
-			Timeout:   30 * time.Second,
-			KeepAlive: 30 * time.Second,
-			DualStack: true,
-		}).DialContext,
-	},
+// ToMap returns a map of the credentials stored in the persisted state,
+// which includes the following keys: access_key_id, secret_access_key,
+// & creds_last_rotated_time
+func (s *AwsCredentialPersistedState) ToMap() map[string]any {
+	return map[string]any{
+		ConstAccessKeyId:          s.AccessKeyId,
+		ConstSecretAccessKey:      s.SecretAccessKey,
+		ConstCredsLastRotatedTime: s.CredsLastRotatedTime.Format(time.RFC3339Nano),
+	}
 }

-// EC2Client returns a configured EC2 client based on the session
-// information stored in the state.
-func (s *awsCatalogPersistedState) EC2Client(opt ...Option) (ec2iface.EC2API, error) {
-	opts, err := getOpts(opt...)
+// AwsCredentialPersistedStateFromProto parses values out of a protobuf struct input
+// and returns a AwsCredentialPersistedState used for configuring an AWS session.
+// An error is returned if any of the following fields are missing from the protobuf
+// struct input or have invalid value types: access_key_id, secret_access_key, &
+// creds_last_rotated_time.
+func AwsCredentialPersistedStateFromProto(in *structpb.Struct, opts ...AwsCredentialPersistedStateOption) (*AwsCredentialPersistedState, error) {
+	if in == nil {
+		return nil, errors.New("missing persisted secrets")
+	}
+
+	accessKeyId, err := values.GetStringValue(in, ConstAccessKeyId, true)
 	if err != nil {
-		return nil, fmt.Errorf("error parsing options when fetching EC2 client: %w", err)
+		return nil, fmt.Errorf("persisted state integrity error: %w", err)
 	}

-	region := opts.withRegion
-	if region == "" {
-		region = s.region
-	}
-
-	sess, err := s.GetSession()
+	secretAccessKey, err := values.GetStringValue(in, ConstSecretAccessKey, true)
 	if err != nil {
-		return nil, fmt.Errorf("error getting AWS session when fetching EC2 client: %w", err)
+		return nil, fmt.Errorf("persisted state integrity error: %w", err)
 	}

-	if s.testEC2APIFunc != nil {
-		return s.testEC2APIFunc(sess, aws.NewConfig().WithRegion(region))
+	credsLastRotatedTime, err := values.GetTimeValue(in, ConstCredsLastRotatedTime)
+	if err != nil {
+		return nil, fmt.Errorf("persisted state integrity error: %w", err)
 	}

-	cfg := aws.NewConfig()
-	if region != "" {
-		cfg = cfg.WithRegion(region)
+	s, err := NewAwsCredentialPersistedState(opts...)
+	if err != nil {
+		return nil, err
 	}

-	cfg.HTTPClient = customClient
+	s.AccessKeyId = accessKeyId
+	s.SecretAccessKey = secretAccessKey
+	s.CredsLastRotatedTime = credsLastRotatedTime

-	return ec2.New(sess, cfg), nil
+	return s, nil
 }
@@ -1,4 +1,4 @@
-package plugin
+package credential

 import (
 	"errors"
@@ -9,31 +9,24 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/aws/aws-sdk-go/service/iam"
-	pb "github.com/hashicorp/boundary/sdk/pbs/plugin"
 	"github.com/hashicorp/go-secure-stdlib/awsutil"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/types/known/structpb"
 )

-const (
-	testOptionErr            = "test option error"
-	testGetCallerIdentityErr = "test error for GetCallerIdentity"
-	testGetUserErr           = "test error for GetUser"
-	testDeleteAccessKeyErr   = "test error for DeleteAccessKey"
-)
-
-func TestNewAwsCatalogPersistedState(t *testing.T) {
+func TestNewAwsCredentialPersistedState(t *testing.T) {
 	staticTime := time.Now()

 	cases := []struct {
 		name        string
-		opts        []awsCatalogPersistedStateOption
-		expected    *awsCatalogPersistedState
+		opts        []AwsCredentialPersistedStateOption
+		expected    *AwsCredentialPersistedState
 		expectedErr string
 	}{
 		{
 			name: "error",
-			opts: []awsCatalogPersistedStateOption{
-				func(s *awsCatalogPersistedState) error {
+			opts: []AwsCredentialPersistedStateOption{
+				func(s *AwsCredentialPersistedState) error {
 					return errors.New(testOptionErr)
 				},
 			},
@@ -41,69 +34,69 @@ func TestNewAwsCatalogPersistedState(t *testing.T) {
 		},
 		{
 			name: "access key id",
-			opts: []awsCatalogPersistedStateOption{
-				withAccessKeyId("foobar"),
+			opts: []AwsCredentialPersistedStateOption{
+				WithAccessKeyId("foobar"),
 			},
-			expected: &awsCatalogPersistedState{
+			expected: &AwsCredentialPersistedState{
 				AccessKeyId: "foobar",
 			},
 		},
 		{
 			name: "secret access key",
-			opts: []awsCatalogPersistedStateOption{
-				withSecretAccessKey("bazqux"),
+			opts: []AwsCredentialPersistedStateOption{
+				WithSecretAccessKey("bazqux"),
 			},
-			expected: &awsCatalogPersistedState{
+			expected: &AwsCredentialPersistedState{
 				SecretAccessKey: "bazqux",
 			},
 		},
 		{
 			name: "rotation time",
-			opts: []awsCatalogPersistedStateOption{
-				withCredsLastRotatedTime(staticTime),
+			opts: []AwsCredentialPersistedStateOption{
+				WithCredsLastRotatedTime(staticTime),
 			},
-			expected: &awsCatalogPersistedState{
+			expected: &AwsCredentialPersistedState{
 				CredsLastRotatedTime: staticTime,
 			},
 		},
 		{
 			name: "region key",
-			opts: []awsCatalogPersistedStateOption{
-				withRegion("foobar"),
+			opts: []AwsCredentialPersistedStateOption{
+				WithRegion("foobar"),
 			},
-			expected: &awsCatalogPersistedState{
+			expected: &AwsCredentialPersistedState{
 				region: "foobar",
 			},
 		},
 		{
 			name: "double set access key id",
-			opts: []awsCatalogPersistedStateOption{
-				withAccessKeyId("foobar"),
-				withAccessKeyId("onetwo"),
+			opts: []AwsCredentialPersistedStateOption{
+				WithAccessKeyId("foobar"),
+				WithAccessKeyId("onetwo"),
 			},
 			expectedErr: "access key id already set",
 		},
 		{
 			name: "double set secret access key",
-			opts: []awsCatalogPersistedStateOption{
-				withSecretAccessKey("bazqux"),
-				withSecretAccessKey("threefour"),
+			opts: []AwsCredentialPersistedStateOption{
+				WithSecretAccessKey("bazqux"),
+				WithSecretAccessKey("threefour"),
 			},
 			expectedErr: "secret access key already set",
 		},
 		{
 			name: "double set rotation time",
-			opts: []awsCatalogPersistedStateOption{
-				withCredsLastRotatedTime(staticTime),
-				withCredsLastRotatedTime(time.Now()),
+			opts: []AwsCredentialPersistedStateOption{
+				WithCredsLastRotatedTime(staticTime),
+				WithCredsLastRotatedTime(time.Now()),
 			},
 			expectedErr: "last rotation time already set",
 		},
 		{
 			name: "double set region",
-			opts: []awsCatalogPersistedStateOption{
-				withRegion("foobar"),
-				withRegion("barfoo"),
+			opts: []AwsCredentialPersistedStateOption{
+				WithRegion("foobar"),
+				WithRegion("barfoo"),
 			},
 			expectedErr: "region already set",
 		},
@@ -113,7 +106,7 @@ func TestNewAwsCatalogPersistedState(t *testing.T) {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			require := require.New(t)
-			actual, err := newAwsCatalogPersistedState(tc.opts...)
+			actual, err := NewAwsCredentialPersistedState(tc.opts...)
 			if tc.expectedErr != "" {
 				require.EqualError(err, tc.expectedErr)
 				return
@@ -125,63 +118,49 @@ func TestNewAwsCatalogPersistedState(t *testing.T) {
 	}
 }

-func TestAwsCatalogPersistedStateFromProto(t *testing.T) {
+func TestAwsCredentialPersistedStateFromProto(t *testing.T) {
 	cases := []struct {
 		name        string
-		in          *pb.HostCatalogPersisted
-		opts        []awsCatalogPersistedStateOption
-		expected    *awsCatalogPersistedState
+		in          map[string]any
+		opts        []AwsCredentialPersistedStateOption
+		expected    *AwsCredentialPersistedState
 		expectedErr string
 	}{
 		{
-			name: "no secrets",
-			in: &pb.HostCatalogPersisted{
-				Secrets: nil,
-			},
+			name:        "no secrets",
+			in:          nil,
 			expectedErr: "missing persisted secrets",
 		},
 		{
-			name: "missing access key ID",
-			in: &pb.HostCatalogPersisted{
-				// Nil should be the same as empty map here
-				Secrets: mustStruct(nil),
-			},
+			name:        "missing access key ID",
+			in:          map[string]any{},
 			expectedErr: "persisted state integrity error: missing required value \"access_key_id\"",
 		},
 		{
 			name: "missing secret access key",
-			in: &pb.HostCatalogPersisted{
-				// Nil should be the same as empty map here
-				Secrets: mustStruct(map[string]interface{}{
-					constAccessKeyId: "foobar",
-				}),
+			in: map[string]any{
+				ConstAccessKeyId: "foobar",
 			},
 			expectedErr: "persisted state integrity error: missing required value \"secret_access_key\"",
 		},
 		{
 			name: "bad last rotated time",
-			in: &pb.HostCatalogPersisted{
-				// Nil should be the same as empty map here
-				Secrets: mustStruct(map[string]interface{}{
-					constAccessKeyId:          "foobar",
-					constSecretAccessKey:      "bazqux",
-					constCredsLastRotatedTime: "notatime",
-				}),
+			in: map[string]any{
+				ConstAccessKeyId:          "foobar",
+				ConstSecretAccessKey:      "bazqux",
+				ConstCredsLastRotatedTime: "notatime",
 			},
 			expectedErr: "persisted state integrity error: could not parse time in value \"creds_last_rotated_time\": parsing time \"notatime\" as \"2006-01-02T15:04:05.999999999Z07:00\": cannot parse \"notatime\" as \"2006\"",
 		},
 		{
 			name: "option error",
-			in: &pb.HostCatalogPersisted{
-				// Nil should be the same as empty map here
-				Secrets: mustStruct(map[string]interface{}{
-					constAccessKeyId:          "foobar",
-					constSecretAccessKey:      "bazqux",
-					constCredsLastRotatedTime: "2006-01-02T15:04:05+07:00",
-				}),
+			in: map[string]any{
+				ConstAccessKeyId:          "foobar",
+				ConstSecretAccessKey:      "bazqux",
+				ConstCredsLastRotatedTime: "2006-01-02T15:04:05+07:00",
 			},
-			opts: []awsCatalogPersistedStateOption{
-				func(s *awsCatalogPersistedState) error {
+			opts: []AwsCredentialPersistedStateOption{
+				func(s *AwsCredentialPersistedState) error {
 					return errors.New(testOptionErr)
 				},
 			},
@@ -189,15 +168,12 @@ func TestAwsCatalogPersistedStateFromProto(t *testing.T) {
 		},
 		{
 			name: "good with non-zero timestamp",
-			in: &pb.HostCatalogPersisted{
-				// Nil should be the same as empty map here
-				Secrets: mustStruct(map[string]interface{}{
-					constAccessKeyId:          "foobar",
-					constSecretAccessKey:      "bazqux",
-					constCredsLastRotatedTime: "2006-01-02T15:04:05+07:00",
-				}),
+			in: map[string]any{
+				ConstAccessKeyId:          "foobar",
+				ConstSecretAccessKey:      "bazqux",
+				ConstCredsLastRotatedTime: "2006-01-02T15:04:05+07:00",
 			},
-			expected: &awsCatalogPersistedState{
+			expected: &AwsCredentialPersistedState{
 				AccessKeyId:     "foobar",
 				SecretAccessKey: "bazqux",
 				CredsLastRotatedTime: func() time.Time {
@@ -205,22 +181,18 @@ func TestAwsCatalogPersistedStateFromProto(t *testing.T) {
 					if err != nil {
 						panic(err)
 					}
-
 					return t
 				}(),
 			},
 		},
 		{
 			name: "good with zero timestamp",
-			in: &pb.HostCatalogPersisted{
-				// Nil should be the same as empty map here
-				Secrets: mustStruct(map[string]interface{}{
-					constAccessKeyId:          "foobar",
-					constSecretAccessKey:      "bazqux",
-					constCredsLastRotatedTime: (time.Time{}).Format(time.RFC3339Nano),
-				}),
+			in: map[string]any{
+				ConstAccessKeyId:          "foobar",
+				ConstSecretAccessKey:      "bazqux",
+				ConstCredsLastRotatedTime: (time.Time{}).Format(time.RFC3339Nano),
 			},
-			expected: &awsCatalogPersistedState{
+			expected: &AwsCredentialPersistedState{
 				AccessKeyId:          "foobar",
 				SecretAccessKey:      "bazqux",
 				CredsLastRotatedTime: time.Time{},
@@ -228,23 +200,20 @@ func TestAwsCatalogPersistedStateFromProto(t *testing.T) {
 		},
 		{
 			name: "good (ignoring non-test options)",
-			in: &pb.HostCatalogPersisted{
-				// Nil should be the same as empty map here
-				Secrets: mustStruct(map[string]interface{}{
-					constAccessKeyId:          "foobar",
-					constSecretAccessKey:      "bazqux",
-					constCredsLastRotatedTime: (time.Time{}).Format(time.RFC3339Nano),
-				}),
+			in: map[string]any{
+				ConstAccessKeyId:          "foobar",
+				ConstSecretAccessKey:      "bazqux",
+				ConstCredsLastRotatedTime: (time.Time{}).Format(time.RFC3339Nano),
 			},
-			opts: []awsCatalogPersistedStateOption{
-				withAccessKeyId("ignored"),
-				withRegion("someregion"),
+			opts: []AwsCredentialPersistedStateOption{
+				WithAccessKeyId("ignored"),
+				WithRegion("us-west-2"),
 			},
-			expected: &awsCatalogPersistedState{
+			expected: &AwsCredentialPersistedState{
 				AccessKeyId:          "foobar",
 				SecretAccessKey:      "bazqux",
 				CredsLastRotatedTime: time.Time{},
-				region:               "someregion",
+				region:               "us-west-2",
 			},
 		},
 	}
@@ -253,76 +222,26 @@ func TestAwsCatalogPersistedStateFromProto(t *testing.T) {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			require := require.New(t)
-			actual, err := awsCatalogPersistedStateFromProto(tc.in, tc.opts...)
+
+			var (
+				input *structpb.Struct
+				err   error
+			)
+			if tc.in != nil {
+				input, err = structpb.NewStruct(tc.in)
+				require.NoError(err)
+			}
+
+			actual, err := AwsCredentialPersistedStateFromProto(input, tc.opts...)
 			if tc.expectedErr != "" {
 				require.EqualError(err, tc.expectedErr)
 				return
 			}

 			require.NoError(err)
-			require.Equal(tc.expected, actual)
-		})
-	}
-}
-
-func TestAwsCatalogPersistedStateToProto(t *testing.T) {
-	cases := []struct {
-		name        string
-		in          *awsCatalogPersistedState
-		expected    *pb.HostCatalogPersisted
-		expectedErr string // NOTE: Here for scaffolding but hard to test deep structpb err right now
-	}{
-		{
-			name: "good with non-zero timestamp",
-			in: &awsCatalogPersistedState{
-				AccessKeyId:     "foobar",
-				SecretAccessKey: "bazqux",
-				CredsLastRotatedTime: func() time.Time {
-					t, err := time.Parse(time.RFC3339, "2006-01-02T15:04:05+07:00")
-					if err != nil {
-						panic(err)
-					}
-
-					return t
-				}(),
-			},
-			expected: &pb.HostCatalogPersisted{
-				Secrets: mustStruct(map[string]interface{}{
-					constAccessKeyId:          "foobar",
-					constSecretAccessKey:      "bazqux",
-					constCredsLastRotatedTime: "2006-01-02T15:04:05+07:00",
-				}),
-			},
-		},
-		{
-			name: "good with zero timestamp",
-			in: &awsCatalogPersistedState{
-				AccessKeyId:          "foobar",
-				SecretAccessKey:      "bazqux",
-				CredsLastRotatedTime: time.Time{},
-			},
-			expected: &pb.HostCatalogPersisted{
-				Secrets: mustStruct(map[string]interface{}{
-					constAccessKeyId:          "foobar",
-					constSecretAccessKey:      "bazqux",
-					constCredsLastRotatedTime: (time.Time{}).Format(time.RFC3339Nano),
-				}),
-			},
-		},
-	}
-
-	for _, tc := range cases {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			require := require.New(t)
-			actual, err := tc.in.ToProto()
-			if tc.expectedErr != "" {
-				require.EqualError(err, tc.expectedErr)
-				return
-			}
-
-			require.NoError(err)
-			require.Equal(tc.expected, actual)
+			require.Equal(tc.expected.AccessKeyId, actual.AccessKeyId)
+			require.Equal(tc.expected.SecretAccessKey, actual.SecretAccessKey)
+			require.Equal(tc.expected.region, actual.region)
 		})
 	}
 }
@@ -330,26 +249,26 @@ func TestAwsCatalogPersistedStateToProto(t *testing.T) {
 func TestAwsCatalogPersistedStateValidateCreds(t *testing.T) {
 	cases := []struct {
 		name        string
-		in          *awsCatalogPersistedState
+		in          *AwsCredentialPersistedState
 		expectedErr string
 	}{
 		{
 			name: "could not load credentials",
-			in: &awsCatalogPersistedState{
+			in: &AwsCredentialPersistedState{
 				testOpts: []awsutil.Option{awsutil.MockOptionErr(errors.New(testOptionErr))},
 			},
 			expectedErr: fmt.Sprintf("error loading credentials: error reading options in NewCredentialsConfig: %s", testOptionErr),
 		},
 		{
 			name: "validation error",
-			in: &awsCatalogPersistedState{
+			in: &AwsCredentialPersistedState{
 				testOpts: []awsutil.Option{awsutil.WithSTSAPIFunc(awsutil.NewMockSTS(awsutil.WithGetCallerIdentityError(errors.New(testGetCallerIdentityErr))))},
 			},
 			expectedErr: fmt.Sprintf("error validating credentials: %s", testGetCallerIdentityErr),
 		},
 		{
 			name: "good",
-			in: &awsCatalogPersistedState{
+			in: &AwsCredentialPersistedState{
 				AccessKeyId:     "foobar",
 				SecretAccessKey: "bazqux",
 				testOpts:        []awsutil.Option{awsutil.WithSTSAPIFunc(awsutil.NewMockSTS())},
@@ -375,7 +294,7 @@ func TestAwsCatalogPersistedStateValidateCreds(t *testing.T) {
 func TestAwsCatalogPersistedStateRotateCreds(t *testing.T) {
 	cases := []struct {
 		name                       string
-		in                         *awsCatalogPersistedState
+		in                         *AwsCredentialPersistedState
 		expectedAccessKeyId        string
 		expectedSecretAccessKey    string
 		expectedNonZeroRotatedTime bool
@@ -383,14 +302,14 @@ func TestAwsCatalogPersistedStateRotateCreds(t *testing.T) {
 	}{
 		{
 			name: "could not load credentials",
-			in: &awsCatalogPersistedState{
+			in: &AwsCredentialPersistedState{
 				testOpts: []awsutil.Option{awsutil.MockOptionErr(errors.New(testOptionErr))},
 			},
 			expectedErr: fmt.Sprintf("error loading credentials: error reading options in NewCredentialsConfig: %s", testOptionErr),
 		},
 		{
 			name: "rotation error",
-			in: &awsCatalogPersistedState{
+			in: &AwsCredentialPersistedState{
 				AccessKeyId:     "foobar",
 				SecretAccessKey: "bazqux",
 				testOpts: []awsutil.Option{
@@ -405,7 +324,7 @@ func TestAwsCatalogPersistedStateRotateCreds(t *testing.T) {
 		},
 		{
 			name: "good",
-			in: &awsCatalogPersistedState{
+			in: &AwsCredentialPersistedState{
 				AccessKeyId:     "foobar",
 				SecretAccessKey: "bazqux",
 				testOpts: []awsutil.Option{
@@ -465,7 +384,7 @@ func TestAwsCatalogPersistedStateReplaceCreds(t *testing.T) {
 	state := new(testMockIAMState)
 	cases := []struct {
 		name                    string
-		in                      *awsCatalogPersistedState
+		in                      *AwsCredentialPersistedState
 		accessKeyId             string
 		secretAccessKey         string
 		expectedAccessKeyId     string
@@ -475,18 +394,18 @@ func TestAwsCatalogPersistedStateReplaceCreds(t *testing.T) {
 	}{
 		{
 			name:        "missing access key id",
-			in:          &awsCatalogPersistedState{},
+			in:          &AwsCredentialPersistedState{},
 			expectedErr: "access key id cannot be empty",
 		},
 		{
 			name:        "missing access key id",
-			in:          &awsCatalogPersistedState{},
+			in:          &AwsCredentialPersistedState{},
 			accessKeyId: "one",
 			expectedErr: "secret access key cannot be empty",
 		},
 		{
 			name: "identical access key id",
-			in: &awsCatalogPersistedState{
+			in: &AwsCredentialPersistedState{
 				AccessKeyId:     "foobar",
 				SecretAccessKey: "bazqux",
 			},
@@ -496,7 +415,7 @@ func TestAwsCatalogPersistedStateReplaceCreds(t *testing.T) {
 		},
 		{
 			name: "deletion error",
-			in: &awsCatalogPersistedState{
+			in: &AwsCredentialPersistedState{
 				AccessKeyId:          "foobar",
 				SecretAccessKey:      "bazqux",
 				CredsLastRotatedTime: time.Now(),
@@ -514,7 +433,7 @@ func TestAwsCatalogPersistedStateReplaceCreds(t *testing.T) {
 		},
 		{
 			name: "good with delete of old rotated",
-			in: &awsCatalogPersistedState{
+			in: &AwsCredentialPersistedState{
 				AccessKeyId:          "foobar",
 				SecretAccessKey:      "bazqux",
 				CredsLastRotatedTime: time.Now(),
@@ -532,7 +451,7 @@ func TestAwsCatalogPersistedStateReplaceCreds(t *testing.T) {
 		},
 		{
 			name: "good without delete of old rotated",
-			in: &awsCatalogPersistedState{
+			in: &AwsCredentialPersistedState{
 				AccessKeyId:     "foobar",
 				SecretAccessKey: "bazqux",
 				testOpts: []awsutil.Option{
@@ -572,19 +491,19 @@ func TestAwsCatalogPersistedStateReplaceCreds(t *testing.T) {
 func TestAwsCatalogPersistedStateDeleteCreds(t *testing.T) {
 	cases := []struct {
 		name        string
-		in          *awsCatalogPersistedState
+		in          *AwsCredentialPersistedState
 		expectedErr string
 	}{
 		{
 			name: "could not load credentials",
-			in: &awsCatalogPersistedState{
+			in: &AwsCredentialPersistedState{
 				testOpts: []awsutil.Option{awsutil.MockOptionErr(errors.New(testOptionErr))},
 			},
 			expectedErr: fmt.Sprintf("error loading credentials: error reading options in NewCredentialsConfig: %s", testOptionErr),
 		},
 		{
 			name: "deletion error",
-			in: &awsCatalogPersistedState{
+			in: &AwsCredentialPersistedState{
 				AccessKeyId:     "foobar",
 				SecretAccessKey: "bazqux",
 				testOpts: []awsutil.Option{
@@ -599,7 +518,7 @@ func TestAwsCatalogPersistedStateDeleteCreds(t *testing.T) {
 		},
 		{
 			name: "deletion error, but OK because key was just gone",
-			in: &awsCatalogPersistedState{
+			in: &AwsCredentialPersistedState{
 				AccessKeyId:     "foobar",
 				SecretAccessKey: "bazqux",
 				testOpts: []awsutil.Option{
@@ -615,7 +534,7 @@ func TestAwsCatalogPersistedStateDeleteCreds(t *testing.T) {
 		},
 		{
 			name: "good",
-			in: &awsCatalogPersistedState{
+			in: &AwsCredentialPersistedState{
 				AccessKeyId:     "foobar",
 				SecretAccessKey: "bazqux",
 				testOpts: []awsutil.Option{
@@ -647,37 +566,10 @@ func TestAwsCatalogPersistedStateDeleteCreds(t *testing.T) {

 func TestAwsCatalogPersistedStateGetSessionErr(t *testing.T) {
 	require := require.New(t)
-	state := &awsCatalogPersistedState{
+	state := &AwsCredentialPersistedState{
 		testOpts: []awsutil.Option{awsutil.MockOptionErr(errors.New(testOptionErr))},
 	}

 	_, err := state.GetSession()
 	require.EqualError(err, fmt.Sprintf("error reading options in NewCredentialsConfig: %s", testOptionErr))
 }
-
-func TestAwsCatalogPersistedStateEC2ClientErr(t *testing.T) {
-	require := require.New(t)
-	state, err := newAwsCatalogPersistedState(
-		withStateTestOpts([]awsutil.Option{awsutil.MockOptionErr(errors.New(testOptionErr))}),
-	)
-	require.NoError(err)
-
-	_, err = state.EC2Client(WithRegion("someregion"))
-	require.EqualError(err, fmt.Sprintf("error getting AWS session when fetching EC2 client: error reading options in NewCredentialsConfig: %s", testOptionErr))
-}
-
-func TestAwsCatalogPersistedStateEC2ClientGood(t *testing.T) {
-	require := require.New(t)
-	state, err := newAwsCatalogPersistedState(
-		withTestEC2APIFunc(newTestMockEC2(nil)),
-	)
-	require.NoError(err)
-
-	clientRaw, err := state.EC2Client(WithRegion("someregion"))
-	require.NoError(err)
-	require.NotNil(clientRaw)
-	client, ok := clientRaw.(*testMockEC2)
-	require.True(ok)
-	require.NotNil(client)
-	require.Equal("someregion", client.Region)
-}
@@ -0,0 +1,47 @@
+package credential
+
+import (
+	"github.com/aws/aws-sdk-go/aws/session"
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/service/iam/iamiface"
+	"github.com/hashicorp/go-secure-stdlib/awsutil"
+)
+
+const (
+	testOptionErr            = "test option error"
+	testGetCallerIdentityErr = "test error for GetCallerIdentity"
+	testGetUserErr           = "test error for GetUser"
+	testDeleteAccessKeyErr   = "test error for DeleteAccessKey"
+)
+
+type testMockIAMState struct {
+	DeleteAccessKeyCalled bool
+}
+
+func (s *testMockIAMState) Reset() {
+	s.DeleteAccessKeyCalled = false
+}
+
+type testMockIAM struct {
+	iamiface.IAMAPI
+
+	State *testMockIAMState
+}
+
+func (m *testMockIAM) DeleteAccessKey(input *iam.DeleteAccessKeyInput) (*iam.DeleteAccessKeyOutput, error) {
+	m.State.DeleteAccessKeyCalled = true
+	return m.IAMAPI.DeleteAccessKey(input)
+}
+
+func newTestMockIAM(state *testMockIAMState, opts ...awsutil.MockIAMOption) awsutil.IAMAPIFunc {
+	return func(sess *session.Session) (iamiface.IAMAPI, error) {
+		m := &testMockIAM{
+			State: state,
+		}
+		f := awsutil.NewMockIAM(opts...)
+		var err error
+
+		m.IAMAPI, err = f(sess)
+		return m, err
+	}
+}
@@ -0,0 +1,23 @@
+package errors
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+// InvalidArgumentError returns an grpc invalid argument status error.
+func InvalidArgumentError(msg string, f map[string]string) error {
+	var fieldMsgs []string
+	for field, val := range f {
+		fieldMsgs = append(fieldMsgs, fmt.Sprintf("%s: %s", field, val))
+	}
+	if len(fieldMsgs) > 0 {
+		sort.Strings(fieldMsgs)
+		msg = fmt.Sprintf("%s: [%s]", msg, strings.Join(fieldMsgs, ", "))
+	}
+	return status.Error(codes.InvalidArgument, msg)
+}
@@ -0,0 +1,93 @@
+package values
+
+import (
+	"fmt"
+	"time"
+
+	"google.golang.org/protobuf/types/known/structpb"
+)
+
+// GetStringValue returns a string value and no error if the given key
+// is found in the provided proto struct input. An error is returned
+// if the key is not found or the value type is not a string. An error is
+// returned if the parameter argument "required" is set to true
+// and the value from the proto struct input is empty.
+func GetStringValue(in *structpb.Struct, k string, required bool) (string, error) {
+	mv := in.GetFields()
+	v, ok := mv[k]
+	if !ok {
+		if required {
+			return "", fmt.Errorf("missing required value %q", k)
+		}
+
+		return "", nil
+	}
+
+	s, ok := v.AsInterface().(string)
+	if !ok {
+		return "", fmt.Errorf("unexpected type for value %q: want string, got %T", k, v.AsInterface())
+	}
+
+	if s == "" && required {
+		return "", fmt.Errorf("value %q cannot be empty", k)
+	}
+
+	return s, nil
+}
+
+// GetBoolValue returns a boolean value and no error if the given key
+// is found in the provided proto struct input. An error is returned
+// if the key is not found or the value type is not a bool.
+func GetBoolValue(in *structpb.Struct, k string, required bool) (bool, error) {
+	mv := in.GetFields()
+	v, ok := mv[k]
+	if !ok {
+		if required {
+			return false, fmt.Errorf("missing required value %q", k)
+		}
+
+		return false, nil
+	}
+
+	b, ok := v.AsInterface().(bool)
+	if !ok {
+		return false, fmt.Errorf("unexpected type for value %q: want bool, got %T", k, v.AsInterface())
+	}
+
+	return b, nil
+}
+
+// GetTimeValue returns a time.Time value and no error if the given key
+// is found in the provided proto struct input. An error is returned
+// if the key is not found or the value type is not a parsable. The
+// expected time layout is RFC3339Nano.
+func GetTimeValue(in *structpb.Struct, k string) (time.Time, error) {
+	mv := in.GetFields()
+	v, ok := mv[k]
+	if !ok {
+		return time.Time{}, nil
+	}
+
+	tRaw, ok := v.AsInterface().(string)
+	if !ok {
+		return time.Time{}, fmt.Errorf("unexpected type for value %q: want string, got %T", k, v.AsInterface())
+	}
+
+	t, err := time.Parse(time.RFC3339Nano, tRaw)
+	if err != nil {
+		return time.Time{}, fmt.Errorf("could not parse time in value %q: %w", k, err)
+	}
+
+	return t, nil
+}
+
+// StructFields returns a map[string]struct{} of the
+// proto struct input.
+func StructFields(s *structpb.Struct) map[string]struct{} {
+	m := make(map[string]struct{}, len(s.GetFields()))
+	for k := range s.GetFields() {
+		m[k] = struct{}{}
+	}
+
+	return m
+}
@@ -0,0 +1,207 @@
+package values
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/types/known/structpb"
+)
+
+func TestGetStringValue(t *testing.T) {
+	cases := []struct {
+		name        string
+		in          map[string]any
+		key         string
+		required    bool
+		expected    string
+		expectedErr string
+	}{
+		{
+			name:        "required missing",
+			in:          map[string]any{},
+			key:         "foo",
+			required:    true,
+			expectedErr: "missing required value \"foo\"",
+		},
+		{
+			name:     "optional missing",
+			in:       map[string]any{},
+			key:      "foo",
+			expected: "",
+		},
+		{
+			name: "non-string value",
+			in: map[string]any{
+				"foo": 1,
+			},
+			key:         "foo",
+			expectedErr: "unexpected type for value \"foo\": want string, got float64",
+		},
+		{
+			name: "required empty",
+			in: map[string]any{
+				"foo": "",
+			},
+			key:         "foo",
+			required:    true,
+			expectedErr: "value \"foo\" cannot be empty",
+		},
+		{
+			name: "good",
+			in: map[string]any{
+				"foo": "bar",
+			},
+			key:      "foo",
+			expected: "bar",
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			require := require.New(t)
+
+			input, err := structpb.NewStruct(tc.in)
+			require.NoError(err)
+
+			actual, err := GetStringValue(input, tc.key, tc.required)
+			if tc.expectedErr != "" {
+				require.EqualError(err, tc.expectedErr)
+				return
+			}
+
+			require.NoError(err)
+			require.Equal(tc.expected, actual)
+		})
+	}
+}
+
+func TestGetBoolValue(t *testing.T) {
+	cases := []struct {
+		name        string
+		in          map[string]any
+		key         string
+		required    bool
+		expected    bool
+		expectedErr string
+	}{
+		{
+			name:        "required missing",
+			in:          map[string]any{},
+			key:         "foo",
+			required:    true,
+			expectedErr: "missing required value \"foo\"",
+		},
+		{
+			name:     "optional missing",
+			in:       map[string]any{},
+			key:      "foo",
+			expected: false,
+		},
+		{
+			name: "non-bool value",
+			in: map[string]any{
+				"foo": "bar",
+			},
+			key:         "foo",
+			expectedErr: "unexpected type for value \"foo\": want bool, got string",
+		},
+		{
+			name: "good",
+			in: map[string]any{
+				"foo": true,
+			},
+			key:      "foo",
+			expected: true,
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			require := require.New(t)
+
+			input, err := structpb.NewStruct(tc.in)
+			require.NoError(err)
+
+			actual, err := GetBoolValue(input, tc.key, tc.required)
+			if tc.expectedErr != "" {
+				require.EqualError(err, tc.expectedErr)
+				return
+			}
+
+			require.NoError(err)
+			require.Equal(tc.expected, actual)
+		})
+	}
+}
+
+func TestGetTimeValue(t *testing.T) {
+	staticTime := time.Now()
+
+	cases := []struct {
+		name        string
+		in          map[string]any
+		key         string
+		expected    time.Time
+		expectedErr string
+	}{
+		{
+			name:     "missing",
+			in:       map[string]any{},
+			key:      "foo",
+			expected: time.Time{},
+		},
+		{
+			name: "non-time value",
+			in: map[string]any{
+				"foo": 1,
+			},
+			key:         "foo",
+			expectedErr: "unexpected type for value \"foo\": want string, got float64",
+		},
+		{
+			name: "bad parse",
+			in: map[string]any{
+				"foo": "bar",
+			},
+			key:         "foo",
+			expectedErr: "could not parse time in value \"foo\": parsing time \"bar\" as \"2006-01-02T15:04:05.999999999Z07:00\": cannot parse \"bar\" as \"2006\"",
+		},
+		{
+			name: "good",
+			in: map[string]any{
+				"foo": staticTime.Format(time.RFC3339Nano),
+			},
+			key: "foo",
+			expected: func() time.Time {
+				u, err := time.Parse(time.RFC3339Nano, staticTime.Format(time.RFC3339Nano))
+				if err != nil {
+					panic(err)
+				}
+
+				return u
+			}(),
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			require := require.New(t)
+
+			input, err := structpb.NewStruct(tc.in)
+			require.NoError(err)
+
+			actual, err := GetTimeValue(input, tc.key)
+			if tc.expectedErr != "" {
+				require.EqualError(err, tc.expectedErr)
+				return
+			}
+
+			require.NoError(err)
+			require.Equal(tc.expected, actual)
+		})
+	}
+}
@@ -1,217 +0,0 @@
-package plugin
-
-import (
-	"fmt"
-	"sort"
-	"strings"
-	"time"
-
-	"github.com/mitchellh/mapstructure"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-	"google.golang.org/protobuf/types/known/structpb"
-)
-
-func invalidArgumentError(msg string, f map[string]string) error {
-	var fieldMsgs []string
-	for field, val := range f {
-		fieldMsgs = append(fieldMsgs, fmt.Sprintf("%s: %s", field, val))
-	}
-	if len(fieldMsgs) > 0 {
-		sort.Strings(fieldMsgs)
-		msg = fmt.Sprintf("%s: [%s]", msg, strings.Join(fieldMsgs, ", "))
-	}
-	return status.Error(codes.InvalidArgument, msg)
-}
-
-// CatalogAttributes is a Go-native representation of the Attributes
-// map.
-type CatalogAttributes struct {
-	Region                    string
-	DisableCredentialRotation bool
-}
-
-func getCatalogAttributes(in *structpb.Struct) (*CatalogAttributes, error) {
-	unknownFields := structFields(in)
-	result := new(CatalogAttributes)
-	badFields := make(map[string]string)
-
-	var err error
-	result.Region, err = getStringValue(in, constRegion, true)
-	if err != nil {
-		badFields[fmt.Sprintf("attributes.%s", constRegion)] = err.Error()
-	}
-	delete(unknownFields, constRegion)
-
-	result.DisableCredentialRotation, err = getBoolValue(in, constDisableCredentialRotation, false)
-	if err != nil {
-		badFields[fmt.Sprintf("attributes.%s", constDisableCredentialRotation)] = err.Error()
-	}
-	delete(unknownFields, constDisableCredentialRotation)
-
-	for s := range unknownFields {
-		badFields[fmt.Sprintf("attributes.%s", s)] = "unrecognized field"
-	}
-
-	if len(badFields) > 0 {
-		return nil, invalidArgumentError("Invalid arguments in catalog attributes", badFields)
-	}
-
-	return result, nil
-}
-
-// CatalogSecrets is a Go-native representation of the Secrets map.
-type CatalogSecrets struct {
-	AccessKeyId     string
-	SecretAccessKey string
-}
-
-func getCatalogSecrets(in *structpb.Struct) (*CatalogSecrets, error) {
-	unknownFields := structFields(in)
-	result := new(CatalogSecrets)
-	badFields := make(map[string]string)
-
-	var err error
-	result.AccessKeyId, err = getStringValue(in, constAccessKeyId, true)
-	if err != nil {
-		badFields[fmt.Sprintf("secrets.%s", constAccessKeyId)] = err.Error()
-	}
-	delete(unknownFields, constAccessKeyId)
-
-	result.SecretAccessKey, err = getStringValue(in, constSecretAccessKey, true)
-	if err != nil {
-		badFields[fmt.Sprintf("secrets.%s", constSecretAccessKey)] = err.Error()
-	}
-	delete(unknownFields, constSecretAccessKey)
-
-	for s := range unknownFields {
-		badFields[fmt.Sprintf("secrets.%s", s)] = "unrecognized field"
-	}
-
-	if len(badFields) > 0 {
-		return nil, invalidArgumentError("Error in the secrets provided", badFields)
-	}
-
-	return result, nil
-}
-
-// SetAttributes is a Go-native representation of the Attributes map that can be
-// used for decoding the incoming map via mapstructure.
-type SetAttributes struct {
-	Filters []string
-}
-
-func getSetAttributes(in *structpb.Struct) (*SetAttributes, error) {
-	var setAttrs SetAttributes
-
-	// Quick validation to ensure that there's no non-filter attributes
-	// here for now. Make this more complex if we add more attributes
-	// to host sets.
-	unknownFields := structFields(in)
-	badFields := make(map[string]string)
-	delete(unknownFields, constDescribeInstancesFilters)
-	for a := range unknownFields {
-		badFields[fmt.Sprintf("attributes.%s", a)] = "unrecognized field"
-	}
-	if len(badFields) > 0 {
-		return nil, invalidArgumentError("Error in the attributes provided", badFields)
-	}
-
-	// Mapstructure complains if it expects a slice as output and sees a scalar
-	// value. Rather than use WeakDecode and risk unintended consequences, I'm
-	// manually making this change if necessary.
-	inMap := in.AsMap()
-	if filtersRaw, ok := inMap[constDescribeInstancesFilters]; ok {
-		switch filterVal := filtersRaw.(type) {
-		case string:
-			inMap[constDescribeInstancesFilters] = []string{filterVal}
-		}
-	}
-
-	if err := mapstructure.Decode(inMap, &setAttrs); err != nil {
-		return nil, status.Errorf(codes.InvalidArgument, "error decoding set attributes: %s", err)
-	}
-
-	return &setAttrs, nil
-}
-
-func getStringValue(in *structpb.Struct, k string, required bool) (string, error) {
-	mv := in.GetFields()
-	v, ok := mv[k]
-	if !ok {
-		if required {
-			return "", fmt.Errorf("missing required value %q", k)
-		}
-
-		return "", nil
-	}
-
-	s, ok := v.AsInterface().(string)
-	if !ok {
-		return "", fmt.Errorf("unexpected type for value %q: want string, got %T", k, v.AsInterface())
-	}
-
-	if s == "" && required {
-		return "", fmt.Errorf("value %q cannot be empty", k)
-	}
-
-	return s, nil
-}
-
-func getBoolValue(in *structpb.Struct, k string, required bool) (bool, error) {
-	mv := in.GetFields()
-	v, ok := mv[k]
-	if !ok {
-		if required {
-			return false, fmt.Errorf("missing required value %q", k)
-		}
-
-		return false, nil
-	}
-
-	b, ok := v.AsInterface().(bool)
-	if !ok {
-		return false, fmt.Errorf("unexpected type for value %q: want bool, got %T", k, v.AsInterface())
-	}
-
-	return b, nil
-}
-
-func getTimeValue(in *structpb.Struct, k string) (time.Time, error) {
-	mv := in.GetFields()
-	v, ok := mv[k]
-	if !ok {
-		return time.Time{}, nil
-	}
-
-	tRaw, ok := v.AsInterface().(string)
-	if !ok {
-		return time.Time{}, fmt.Errorf("unexpected type for value %q: want string, got %T", k, v.AsInterface())
-	}
-
-	t, err := time.Parse(time.RFC3339Nano, tRaw)
-	if err != nil {
-		return time.Time{}, fmt.Errorf("could not parse time in value %q: %w", k, err)
-	}
-
-	return t, nil
-}
-
-func structFields(s *structpb.Struct) map[string]struct{} {
-	m := make(map[string]struct{}, len(s.GetFields()))
-	for k := range s.GetFields() {
-		m[k] = struct{}{}
-	}
-
-	return m
-}
-
-func keysAsString(m map[string]struct{}) string {
-	s := make([]string, 0, len(m))
-	for k := range m {
-		s = append(s, k)
-	}
-
-	sort.Strings(s)
-	return strings.Join(s, ", ")
-}
@@ -1,453 +0,0 @@
-package plugin
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/google/go-cmp/cmp"
-	"github.com/hashicorp/boundary/sdk/pbs/plugin"
-	"github.com/stretchr/testify/require"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-	"google.golang.org/protobuf/testing/protocmp"
-	"google.golang.org/protobuf/types/known/structpb"
-)
-
-func TestGetCatalogAttributes(t *testing.T) {
-	cases := []struct {
-		name                string
-		in                  *structpb.Struct
-		expected            *CatalogAttributes
-		expectedErrContains string
-	}{
-		{
-			name:                "missing region",
-			in:                  mustStruct(map[string]interface{}{}),
-			expectedErrContains: "missing required value \"region\"",
-		},
-		{
-			name: "bad value for disable_credential_rotation",
-			in: mustStruct(map[string]interface{}{
-				constRegion:                    "us-west-2",
-				constDisableCredentialRotation: "sure",
-			}),
-			expectedErrContains: "unexpected type for value \"disable_credential_rotation\": want bool, got string",
-		},
-		{
-			name: "unknown fields",
-			in: mustStruct(map[string]interface{}{
-				constRegion: "us-west-2",
-				"foo":       true,
-				"bar":       true,
-			}),
-			expectedErrContains: "attributes.bar: unrecognized field, attributes.foo: unrecognized field",
-		},
-		{
-			name: "default",
-			in: mustStruct(map[string]interface{}{
-				constRegion: "us-west-2",
-			}),
-			expected: &CatalogAttributes{
-				Region:                    "us-west-2",
-				DisableCredentialRotation: false,
-			},
-		},
-		{
-			name: "with disable_credential_rotation",
-			in: mustStruct(map[string]interface{}{
-				constRegion:                    "us-west-2",
-				constDisableCredentialRotation: true,
-			}),
-			expected: &CatalogAttributes{
-				Region:                    "us-west-2",
-				DisableCredentialRotation: true,
-			},
-		},
-	}
-
-	for _, tc := range cases {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			require := require.New(t)
-			actual, err := getCatalogAttributes(tc.in)
-			if tc.expectedErrContains != "" {
-				require.Error(err)
-				require.Contains(err.Error(), tc.expectedErrContains)
-				require.Equal(status.Code(err), codes.InvalidArgument)
-				return
-			}
-
-			require.NoError(err)
-			require.Equal(tc.expected, actual)
-		})
-	}
-}
-
-func TestGetCatalogSecrets(t *testing.T) {
-	cases := []struct {
-		name                string
-		in                  *structpb.Struct
-		expected            *CatalogSecrets
-		expectedErrContains string
-	}{
-		{
-			name:                "missing access_key_id",
-			in:                  mustStruct(map[string]interface{}{}),
-			expectedErrContains: "missing required value \"access_key_id\"",
-		},
-		{
-			name: "missing secret_access_key",
-			in: mustStruct(map[string]interface{}{
-				constAccessKeyId: "foobar",
-			}),
-			expectedErrContains: "missing required value \"secret_access_key\"",
-		},
-		{
-			name: "unknown fields",
-			in: mustStruct(map[string]interface{}{
-				constAccessKeyId:     "foobar",
-				constSecretAccessKey: "bazqux",
-				"foo":                true,
-				"bar":                true,
-			}),
-			expectedErrContains: "secrets.bar: unrecognized field, secrets.foo: unrecognized field",
-		},
-		{
-			name: "good",
-			in: mustStruct(map[string]interface{}{
-				constAccessKeyId:     "foobar",
-				constSecretAccessKey: "bazqux",
-			}),
-			expected: &CatalogSecrets{
-				AccessKeyId:     "foobar",
-				SecretAccessKey: "bazqux",
-			},
-		},
-	}
-
-	for _, tc := range cases {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			require := require.New(t)
-			actual, err := getCatalogSecrets(tc.in)
-			if tc.expectedErrContains != "" {
-				require.Error(err)
-				require.Contains(err.Error(), tc.expectedErrContains)
-				require.Equal(status.Code(err), codes.InvalidArgument)
-				return
-			}
-
-			require.NoError(err)
-			require.Equal(tc.expected, actual)
-		})
-	}
-}
-
-func TestGetSetAttributes(t *testing.T) {
-	cases := []struct {
-		name                string
-		in                  *structpb.Struct
-		normalized          *structpb.Struct
-		expected            *SetAttributes
-		expectedErrContains string
-	}{
-		{
-			name:     "missing",
-			in:       mustStruct(map[string]interface{}{}),
-			expected: &SetAttributes{},
-		},
-		{
-			name: "non-string-slice value",
-			in: mustStruct(map[string]interface{}{
-				constDescribeInstancesFilters: "zip=foo,bar",
-			}),
-			expected: &SetAttributes{
-				Filters: []string{"zip=foo,bar"},
-			},
-		},
-		{
-			name: "bad filter element value",
-			in: mustStruct(map[string]interface{}{
-				constDescribeInstancesFilters: []interface{}{1},
-			}),
-			expectedErrContains: "expected type 'string', got unconvertible type 'float64'",
-		},
-		{
-			name: "unknown fields",
-			in: mustStruct(map[string]interface{}{
-				"foo": true,
-				"bar": true,
-			}),
-			expectedErrContains: "attributes.bar: unrecognized field, attributes.foo: unrecognized field",
-		},
-		{
-			name: "good",
-			in: mustStruct(map[string]interface{}{
-				constDescribeInstancesFilters: []interface{}{
-					"foo=bar",
-					"zip=zap",
-				},
-			}),
-			expected: &SetAttributes{
-				Filters: []string{"foo=bar", "zip=zap"},
-			},
-		},
-		{
-			name: "good with filter transform",
-			in: mustStruct(map[string]interface{}{
-				constDescribeInstancesFilters: "foo=bar",
-			}),
-			normalized: mustStruct(map[string]interface{}{
-				constDescribeInstancesFilters: []interface{}{"foo=bar"},
-			}),
-			expected: &SetAttributes{
-				Filters: []string{"foo=bar"},
-			},
-		},
-	}
-
-	for _, tc := range cases {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			require := require.New(t)
-			p := new(AwsPlugin)
-			normalizedOut, err := p.NormalizeSetData(context.Background(), &plugin.NormalizeSetDataRequest{Attributes: tc.in})
-			require.NoError(err)
-			if tc.normalized != nil {
-				require.Empty(cmp.Diff(tc.normalized, normalizedOut.Attributes, protocmp.Transform()))
-			}
-			tc.in = normalizedOut.Attributes
-			actual, err := getSetAttributes(tc.in)
-			if tc.expectedErrContains != "" {
-				require.Error(err)
-				require.Contains(err.Error(), tc.expectedErrContains)
-				require.Equal(status.Code(err), codes.InvalidArgument)
-				return
-			}
-
-			require.NoError(err)
-			require.Equal(tc.expected, actual)
-		})
-	}
-}
-
-func TestGetStringValue(t *testing.T) {
-	cases := []struct {
-		name        string
-		in          *structpb.Struct
-		key         string
-		required    bool
-		expected    string
-		expectedErr string
-	}{
-		{
-			name:        "required missing",
-			in:          mustStruct(map[string]interface{}{}),
-			key:         "foo",
-			required:    true,
-			expectedErr: "missing required value \"foo\"",
-		},
-		{
-			name:     "optional missing",
-			in:       mustStruct(map[string]interface{}{}),
-			key:      "foo",
-			expected: "",
-		},
-		{
-			name: "non-string value",
-			in: mustStruct(map[string]interface{}{
-				"foo": 1,
-			}),
-			key:         "foo",
-			expectedErr: "unexpected type for value \"foo\": want string, got float64",
-		},
-		{
-			name: "required empty",
-			in: mustStruct(map[string]interface{}{
-				"foo": "",
-			}),
-			key:         "foo",
-			required:    true,
-			expectedErr: "value \"foo\" cannot be empty",
-		},
-		{
-			name: "good",
-			in: mustStruct(map[string]interface{}{
-				"foo": "bar",
-			}),
-			key:      "foo",
-			expected: "bar",
-		},
-	}
-
-	for _, tc := range cases {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			require := require.New(t)
-			actual, err := getStringValue(tc.in, tc.key, tc.required)
-			if tc.expectedErr != "" {
-				require.EqualError(err, tc.expectedErr)
-				return
-			}
-
-			require.NoError(err)
-			require.Equal(tc.expected, actual)
-		})
-	}
-}
-
-func TestGetBoolValue(t *testing.T) {
-	cases := []struct {
-		name        string
-		in          *structpb.Struct
-		key         string
-		required    bool
-		expected    bool
-		expectedErr string
-	}{
-		{
-			name:        "required missing",
-			in:          mustStruct(map[string]interface{}{}),
-			key:         "foo",
-			required:    true,
-			expectedErr: "missing required value \"foo\"",
-		},
-		{
-			name:     "optional missing",
-			in:       mustStruct(map[string]interface{}{}),
-			key:      "foo",
-			expected: false,
-		},
-		{
-			name: "non-bool value",
-			in: mustStruct(map[string]interface{}{
-				"foo": "bar",
-			}),
-			key:         "foo",
-			expectedErr: "unexpected type for value \"foo\": want bool, got string",
-		},
-		{
-			name: "good",
-			in: mustStruct(map[string]interface{}{
-				"foo": true,
-			}),
-			key:      "foo",
-			expected: true,
-		},
-	}
-
-	for _, tc := range cases {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			require := require.New(t)
-			actual, err := getBoolValue(tc.in, tc.key, tc.required)
-			if tc.expectedErr != "" {
-				require.EqualError(err, tc.expectedErr)
-				return
-			}
-
-			require.NoError(err)
-			require.Equal(tc.expected, actual)
-		})
-	}
-}
-
-func TestGetTimeValue(t *testing.T) {
-	staticTime := time.Now()
-
-	cases := []struct {
-		name        string
-		in          *structpb.Struct
-		key         string
-		expected    time.Time
-		expectedErr string
-	}{
-		{
-			name:     "missing",
-			in:       mustStruct(map[string]interface{}{}),
-			key:      "foo",
-			expected: time.Time{},
-		},
-		{
-			name: "non-time value",
-			in: mustStruct(map[string]interface{}{
-				"foo": 1,
-			}),
-			key:         "foo",
-			expectedErr: "unexpected type for value \"foo\": want string, got float64",
-		},
-		{
-			name: "bad parse",
-			in: mustStruct(map[string]interface{}{
-				"foo": "bar",
-			}),
-			key:         "foo",
-			expectedErr: "could not parse time in value \"foo\": parsing time \"bar\" as \"2006-01-02T15:04:05.999999999Z07:00\": cannot parse \"bar\" as \"2006\"",
-		},
-		{
-			name: "good",
-			in: mustStruct(map[string]interface{}{
-				"foo": staticTime.Format(time.RFC3339Nano),
-			}),
-			key: "foo",
-			expected: func() time.Time {
-				u, err := time.Parse(time.RFC3339Nano, staticTime.Format(time.RFC3339Nano))
-				if err != nil {
-					panic(err)
-				}
-
-				return u
-			}(),
-		},
-	}
-
-	for _, tc := range cases {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			require := require.New(t)
-			actual, err := getTimeValue(tc.in, tc.key)
-			if tc.expectedErr != "" {
-				require.EqualError(err, tc.expectedErr)
-				return
-			}
-
-			require.NoError(err)
-			require.Equal(tc.expected, actual)
-		})
-	}
-}
-
-func TestValidateRegion(t *testing.T) {
-	cases := []struct {
-		name        string
-		in          string
-		expectedErr string
-	}{
-		{
-			name:        "invalid region",
-			in:          "foobar",
-			expectedErr: "not a valid region: foobar",
-		},
-		{
-			name:        "good",
-			in:          "us-west-2",
-			expectedErr: "",
-		},
-	}
-
-	for _, tc := range cases {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			require := require.New(t)
-			err := validateRegion(tc.in)
-			if tc.expectedErr != "" {
-				require.Contains(err.Error(), tc.expectedErr)
-				require.Equal(status.Code(err), codes.InvalidArgument)
-				return
-			}
-
-			require.NoError(err)
-		})
-	}
-}
@@ -1,10 +0,0 @@
-package plugin
-
-const (
-	constRegion                    = "region"
-	constAccessKeyId               = "access_key_id"
-	constSecretAccessKey           = "secret_access_key"
-	constDisableCredentialRotation = "disable_credential_rotation"
-	constCredsLastRotatedTime      = "creds_last_rotated_time"
-	constDescribeInstancesFilters  = "filters"
-)
@@ -1,35 +0,0 @@
-package plugin
-
-// getOpts iterates the inbound Options and returns a struct
-func getOpts(opt ...Option) (options, error) {
-	opts := getDefaultOptions()
-	for _, o := range opt {
-		if o == nil {
-			continue
-		}
-		if err := o(&opts); err != nil {
-			return options{}, err
-		}
-	}
-	return opts, nil
-}
-
-// Option - how Options are passed as arguments
-type Option func(*options) error
-
-// options = how options are represented
-type options struct {
-	withRegion string
-}
-
-func getDefaultOptions() options {
-	return options{}
-}
-
-// WithRegion contains the region to use
-func WithRegion(with string) Option {
-	return func(o *options) error {
-		o.withRegion = with
-		return nil
-	}
-}
@@ -1,678 +1,34 @@
 package plugin

 import (
-	"context"
-	"errors"
-	"fmt"
-	"strings"
-	"time"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/awserr"
-	"github.com/aws/aws-sdk-go/aws/endpoints"
-	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/hashicorp/boundary-plugin-aws/plugin/service/host"
+	"github.com/hashicorp/boundary-plugin-aws/plugin/service/storage"
 	pb "github.com/hashicorp/boundary/sdk/pbs/plugin"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-	"google.golang.org/protobuf/proto"
-	"google.golang.org/protobuf/types/known/structpb"
 )

-// rotationWaitTimeout controls the time we wait for credential rotation to
-// succeed. This is important to ensure that rotated credentials can be used
-// right away.
-const rotationWaitTimeout = time.Second * 30
-
-// AwsPlugin implements the HostPluginServiceServer interface for the
-// AWS plugin.
-type AwsPlugin struct {
-	pb.UnimplementedHostPluginServiceServer
-
-	// testStateOpts are passed in to the stored state to control test behavior
-	testStateOpts []awsCatalogPersistedStateOption
-}
-
-// Ensure that we are implementing HostPluginServiceServer
+// Ensure that AWSPlugin implementings the following services:
+//
+//	HostPluginServiceServer
+//	StoragePluginServiceServer
 var (
-	_ pb.HostPluginServiceServer = (*AwsPlugin)(nil)
+	_ pb.HostPluginServiceServer    = (*host.HostPlugin)(nil)
+	_ pb.StoragePluginServiceServer = (*storage.StoragePlugin)(nil)
 )

-func (p *AwsPlugin) OnCreateCatalog(ctx context.Context, req *pb.OnCreateCatalogRequest) (*pb.OnCreateCatalogResponse, error) {
-	catalog := req.GetCatalog()
-	if catalog == nil {
-		return nil, status.Error(codes.InvalidArgument, "catalog is nil")
-	}
+// AwsPlugin contains a collection of all aws plugin services.
+type AwsPlugin struct {
+	// HostPlugin implements the HostPluginServiceServer interface for
+	// supporting dynamically sourcing hosts from Amazon EC2
+	*host.HostPlugin

-	secrets := catalog.GetSecrets()
-	if secrets == nil {
-		return nil, status.Error(codes.InvalidArgument, "secrets are required")
-	}
-
-	attrs := catalog.GetAttributes()
-	if attrs == nil {
-		return nil, status.Error(codes.InvalidArgument, "attributes are required")
-	}
-
-	catalogAttributes, err := getCatalogAttributes(attrs)
-	if err != nil {
-		return nil, err
-	}
-	catalogSecrets, err := getCatalogSecrets(secrets)
-	if err != nil {
-		return nil, err
-	}
-
-	if err := validateRegion(catalogAttributes.Region); err != nil {
-		return nil, err
-	}
-
-	// Set up the creds in our persisted state.
-	state, err := newAwsCatalogPersistedState(append([]awsCatalogPersistedStateOption{
-		withAccessKeyId(catalogSecrets.AccessKeyId),
-		withSecretAccessKey(catalogSecrets.SecretAccessKey),
-		withRegion(catalogAttributes.Region),
-	}, p.testStateOpts...)...)
-	if err != nil {
-		return nil, status.Errorf(codes.InvalidArgument, "error setting up persisted state: %s", err)
-	}
-
-	// Try to rotate the credentials if we're not skipping them.
-	if !catalogAttributes.DisableCredentialRotation {
-		if err := state.RotateCreds(); err != nil {
-			return nil, status.Errorf(codes.InvalidArgument, "error during credential rotation: %s", err)
-		}
-	} else {
-		// Simply validate if we aren't rotating.
-		if err := state.ValidateCreds(); err != nil {
-			return nil, status.Errorf(codes.InvalidArgument, "error during credential validation: %s", err)
-		}
-	}
-
-	persistedProto, err := state.ToProto()
-	if err != nil {
-		return nil, status.Error(codes.InvalidArgument, err.Error())
-	}
-
-	return &pb.OnCreateCatalogResponse{
-		Persisted: persistedProto,
-	}, nil
+	// StoragePlugin implements the StoragePluginServiceServer interface for
+	// supporting storing and retrieving BSR files from Amazon S3
+	*storage.StoragePlugin
 }

-func (p *AwsPlugin) OnUpdateCatalog(ctx context.Context, req *pb.OnUpdateCatalogRequest) (*pb.OnUpdateCatalogResponse, error) {
-	// For host catalogs we only need to really validate what is
-	// currently in the new copy of the host catalog data, so skip
-	// fetching the new copy to keep things a little less messy.
-	catalog := req.GetNewCatalog()
-	if catalog == nil {
-		return nil, status.Error(codes.InvalidArgument, "new catalog is nil")
+func NewAwsPlugin() *AwsPlugin {
+	return &AwsPlugin{
+		HostPlugin:    &host.HostPlugin{},
+		StoragePlugin: &storage.StoragePlugin{},
 	}
-
-	var updateSecrets bool
-	secrets := catalog.GetSecrets()
-	if secrets != nil {
-		// We will be updating secrets this run, but what exactly that
-		// means will be determined later.
-		updateSecrets = true
-	}
-
-	attrs := catalog.GetAttributes()
-	if attrs == nil {
-		return nil, status.Error(codes.InvalidArgument, "new catalog missing attributes")
-	}
-
-	catalogAttributes, err := getCatalogAttributes(attrs)
-	if err != nil {
-		return nil, err
-	}
-
-	if err := validateRegion(catalogAttributes.Region); err != nil {
-		return nil, err
-	}
-
-	// Get the persisted data.
-	// NOTE: We might need to change this at a later time. I'm not too
-	// sure *exactly* what scenarios we might encounter that would
-	// ultimately mean that we would have to handle an empty or missing
-	// state in update, but what we are ultimately assuming here
-	// (implicitly through awsCatalogPersistedStateFromProto) is that
-	// the state will exist and be populated. Personally I think this
-	// is fine and important, but this may change in the future.
-	state, err := awsCatalogPersistedStateFromProto(req.GetPersisted(), append(p.testStateOpts, withRegion(catalogAttributes.Region))...)
-	if err != nil {
-		return nil, status.Errorf(codes.InvalidArgument, "error loading persisted state: %s", err)
-	}
-
-	if catalogAttributes.DisableCredentialRotation && !updateSecrets {
-		// This is a validate check to make sure that we aren't disabling
-		// rotation for credentials currently being managed by rotation.
-		// This is not allowed.
-		if !state.CredsLastRotatedTime.IsZero() {
-			return nil, status.Error(codes.FailedPrecondition, "cannot disable rotation for already-rotated credentials")
-		}
-	}
-
-	if updateSecrets {
-		catalogSecrets, err := getCatalogSecrets(secrets)
-		if err != nil {
-			return nil, err
-		}
-
-		// Replace the credentials. This checks the timestamp on the last
-		// rotation time as well and deletes the credentials if we are
-		// managing them (ie: if we've rotated them before).
-		if err := state.ReplaceCreds(catalogSecrets.AccessKeyId, catalogSecrets.SecretAccessKey); err != nil {
-			return nil, status.Errorf(codes.InvalidArgument, "error attempting to replace credentials: %s", err)
-		}
-	}
-
-	if !catalogAttributes.DisableCredentialRotation && state.CredsLastRotatedTime.IsZero() {
-		// If we're enabling rotation now but didn't before, or have
-		// freshly replaced credentials, we can rotate here.
-		if err := state.RotateCreds(); err != nil {
-			return nil, status.Errorf(codes.InvalidArgument, "error during credential rotation: %s", err)
-		}
-	}
-
-	// That's it!
-	persistedProto, err := state.ToProto()
-	if err != nil {
-		return nil, status.Error(codes.InvalidArgument, err.Error())
-	}
-
-	return &pb.OnUpdateCatalogResponse{
-		Persisted: persistedProto,
-	}, nil
-}
-
-func (p *AwsPlugin) OnDeleteCatalog(ctx context.Context, req *pb.OnDeleteCatalogRequest) (*pb.OnDeleteCatalogResponse, error) {
-	catalog := req.GetCatalog()
-	if catalog == nil {
-		return nil, status.Error(codes.InvalidArgument, "new catalog is nil")
-	}
-
-	attrs := catalog.GetAttributes()
-	if attrs == nil {
-		return nil, status.Error(codes.InvalidArgument, "new catalog missing attributes")
-	}
-
-	catalogAttributes, err := getCatalogAttributes(attrs)
-	if err != nil {
-		return nil, err
-	}
-
-	if err := validateRegion(catalogAttributes.Region); err != nil {
-		return nil, err
-	}
-	// Get the persisted data.
-	// NOTE: We return on error here, blocking the delete. This may or
-	// may not be an overzealous approach to maintaining database/state
-	// integrity. May need to be changed at later time if there are
-	// scenarios where we might be deleting things and any secret state
-	// may be corrupt/and or legitimately missing.
-	state, err := awsCatalogPersistedStateFromProto(req.GetPersisted(), append(p.testStateOpts, withRegion(catalogAttributes.Region))...)
-	if err != nil {
-		return nil, status.Errorf(codes.InvalidArgument, "error loading persisted state: %s", err)
-	}
-
-	if !state.CredsLastRotatedTime.IsZero() {
-		// Delete old/existing credentials. This is done with the same
-		// credentials to ensure that it has the proper permissions to do
-		// it.
-		if err := state.DeleteCreds(); err != nil {
-			return nil, status.Errorf(codes.Aborted, "error removing rotated credentials during catalog deletion: %s", err)
-		}
-	}
-
-	return &pb.OnDeleteCatalogResponse{}, nil
-}
-
-// NormalizeSetData currently ensures that "filters" is an array value, even
-// though it's accepted as a string value for CLI UX reasons
-func (p *AwsPlugin) NormalizeSetData(ctx context.Context, req *pb.NormalizeSetDataRequest) (*pb.NormalizeSetDataResponse, error) {
-	if req.Attributes == nil {
-		return new(pb.NormalizeSetDataResponse), nil
-	}
-
-	val := req.Attributes.Fields["filters"]
-	if val == nil {
-		return &pb.NormalizeSetDataResponse{Attributes: req.Attributes}, nil
-	}
-	stringVal, ok := val.Kind.(*structpb.Value_StringValue)
-	if !ok {
-		return &pb.NormalizeSetDataResponse{Attributes: req.Attributes}, nil
-	}
-
-	retAttrs := proto.Clone(req.Attributes).(*structpb.Struct)
-	retAttrs.Fields["filters"] = structpb.NewListValue(
-		&structpb.ListValue{
-			Values: []*structpb.Value{
-				structpb.NewStringValue(stringVal.StringValue),
-			},
-		})
-
-	return &pb.NormalizeSetDataResponse{Attributes: retAttrs}, nil
-}
-
-func (p *AwsPlugin) OnCreateSet(ctx context.Context, req *pb.OnCreateSetRequest) (*pb.OnCreateSetResponse, error) {
-	catalog := req.GetCatalog()
-	if catalog == nil {
-		return nil, status.Error(codes.InvalidArgument, "catalog is nil")
-	}
-
-	catalogAttrsRaw := catalog.GetAttributes()
-	if catalogAttrsRaw == nil {
-		return nil, status.Error(codes.InvalidArgument, "catalog missing attributes")
-	}
-
-	catalogAttributes, err := getCatalogAttributes(catalogAttrsRaw)
-	if err != nil {
-		return nil, err
-	}
-
-	if err := validateRegion(catalogAttributes.Region); err != nil {
-		return nil, err
-	}
-
-	state, err := awsCatalogPersistedStateFromProto(req.GetPersisted(), append(p.testStateOpts, withRegion(catalogAttributes.Region))...)
-	if err != nil {
-		return nil, status.Errorf(codes.InvalidArgument, "error loading persisted state: %s", err)
-	}
-
-	set := req.GetSet()
-	if set == nil {
-		return nil, status.Error(codes.InvalidArgument, "set is nil")
-	}
-
-	if set.GetAttributes() == nil {
-		return nil, status.Error(codes.InvalidArgument, "set missing attributes")
-	}
-	setAttrs, err := getSetAttributes(set.GetAttributes())
-	if err != nil {
-		return nil, err
-	}
-
-	ec2Client, err := state.EC2Client(WithRegion(catalogAttributes.Region))
-	if err != nil {
-		return nil, status.Errorf(codes.InvalidArgument, "error getting EC2 client: %s", err)
-	}
-
-	input, err := buildDescribeInstancesInput(setAttrs, true)
-	if err != nil {
-		return nil, status.Errorf(codes.InvalidArgument, "error building DescribeInstances parameters: %s", err)
-	}
-
-	_, err = ec2Client.DescribeInstances(input)
-	if err == nil {
-		return nil, status.Error(codes.FailedPrecondition, "query error: DescribeInstances DryRun should have returned error, but none was found")
-	}
-
-	if awsErr, ok := err.(awserr.Error); ok && awsErr.Code() == "DryRunOperation" {
-		// Success
-		return &pb.OnCreateSetResponse{}, nil
-	}
-
-	return nil, status.Errorf(codes.InvalidArgument, "error performing dry run of DescribeInstances: %s", err)
-}
-
-func (p *AwsPlugin) OnUpdateSet(ctx context.Context, req *pb.OnUpdateSetRequest) (*pb.OnUpdateSetResponse, error) {
-	catalog := req.GetCatalog()
-	if catalog == nil {
-		return nil, status.Error(codes.InvalidArgument, "catalog is nil")
-	}
-
-	catalogAttrsRaw := catalog.GetAttributes()
-	if catalogAttrsRaw == nil {
-		return nil, status.Error(codes.InvalidArgument, "catalog missing attributes")
-	}
-
-	catalogAttributes, err := getCatalogAttributes(catalogAttrsRaw)
-	if err != nil {
-		return nil, err
-	}
-
-	if err := validateRegion(catalogAttributes.Region); err != nil {
-		return nil, err
-	}
-
-	state, err := awsCatalogPersistedStateFromProto(req.GetPersisted(), append(p.testStateOpts, withRegion(catalogAttributes.Region))...)
-	if err != nil {
-		return nil, status.Errorf(codes.InvalidArgument, "error loading persisted state: %s", err)
-	}
-
-	// As with catalog, we don't need to really look at the old host
-	// set here, just need to work off of/validate the new set config
-	set := req.GetNewSet()
-	if set == nil {
-		return nil, status.Error(codes.InvalidArgument, "new set is nil")
-	}
-
-	if set.GetAttributes() == nil {
-		return nil, status.Error(codes.InvalidArgument, "new set missing attributes")
-	}
-	setAttrs, err := getSetAttributes(set.GetAttributes())
-	if err != nil {
-		return nil, err
-	}
-
-	ec2Client, err := state.EC2Client(WithRegion(catalogAttributes.Region))
-	if err != nil {
-		return nil, status.Errorf(codes.InvalidArgument, "error getting EC2 client: %s", err)
-	}
-
-	input, err := buildDescribeInstancesInput(setAttrs, true)
-	if err != nil {
-		return nil, status.Errorf(codes.InvalidArgument, "error building DescribeInstances parameters: %s", err)
-	}
-
-	_, err = ec2Client.DescribeInstances(input)
-	if err == nil {
-		return nil, status.Error(codes.FailedPrecondition, "query error: DescribeInstances DryRun should have returned error, but none was found")
-	}
-
-	if awsErr, ok := err.(awserr.Error); ok && awsErr.Code() == "DryRunOperation" {
-		// Success
-		return &pb.OnUpdateSetResponse{}, nil
-	}
-
-	return nil, status.Errorf(codes.InvalidArgument, "error performing dry run of DescribeInstances: %s", err)
-}
-
-func (p *AwsPlugin) OnDeleteSet(ctx context.Context, req *pb.OnDeleteSetRequest) (*pb.OnDeleteSetResponse, error) {
-	// No-op, AWS host set does not maintain anything that requires
-	// cleanup
-	return &pb.OnDeleteSetResponse{}, nil
-}
-
-func (p *AwsPlugin) ListHosts(ctx context.Context, req *pb.ListHostsRequest) (*pb.ListHostsResponse, error) {
-	catalog := req.GetCatalog()
-	if catalog == nil {
-		return nil, status.Error(codes.InvalidArgument, "catalog is nil")
-	}
-
-	catalogAttrsRaw := catalog.GetAttributes()
-	if catalogAttrsRaw == nil {
-		return nil, status.Error(codes.InvalidArgument, "catalog missing attributes")
-	}
-
-	catalogAttributes, err := getCatalogAttributes(catalogAttrsRaw)
-	if err != nil {
-		return nil, err
-	}
-
-	if err := validateRegion(catalogAttributes.Region); err != nil {
-		return nil, err
-	}
-
-	state, err := awsCatalogPersistedStateFromProto(req.GetPersisted(), append(p.testStateOpts, withRegion(catalogAttributes.Region))...)
-	if err != nil {
-		return nil, status.Errorf(codes.InvalidArgument, "error loading persisted state: %s", err)
-	}
-
-	sets := req.GetSets()
-	if sets == nil {
-		return nil, status.Error(codes.InvalidArgument, "sets is nil")
-	}
-
-	// Build all the queries in advance.
-	type hostSetQuery struct {
-		Id          string
-		Input       *ec2.DescribeInstancesInput
-		Output      *ec2.DescribeInstancesOutput
-		OutputHosts []*pb.ListHostsResponseHost
-	}
-
-	queries := make([]hostSetQuery, len(sets))
-	for i, set := range sets {
-		// Validate Id since we use it in output
-		if set.GetId() == "" {
-			return nil, status.Error(codes.InvalidArgument, "set missing id")
-		}
-
-		if set.GetAttributes() == nil {
-			return nil, status.Error(codes.InvalidArgument, "set missing attributes")
-		}
-		setAttrs, err := getSetAttributes(set.GetAttributes())
-		if err != nil {
-			return nil, err
-		}
-
-		input, err := buildDescribeInstancesInput(setAttrs, false)
-		if err != nil {
-			return nil, status.Errorf(codes.InvalidArgument, "error building DescribeInstances parameters for host set id %q: %s", set.GetId(), err)
-		}
-		queries[i] = hostSetQuery{
-			Id:    set.GetId(),
-			Input: input,
-		}
-	}
-
-	ec2Client, err := state.EC2Client()
-	if err != nil {
-		return nil, status.Errorf(codes.InvalidArgument, "error getting EC2 client: %s", err)
-	}
-
-	// Run all queries now and assemble output.
-	var maxLen int
-	for i, query := range queries {
-		output, err := ec2Client.DescribeInstances(query.Input)
-		if err != nil {
-			return nil, status.Errorf(codes.InvalidArgument, "error running DescribeInstances for host set id %q: %s", query.Id, err)
-		}
-
-		queries[i].Output = output
-
-		// Process the output here, we will normalize this into a single
-		// set of hosts afterwards (possibly removing duplicates).
-		for _, reservation := range output.Reservations {
-			for _, instance := range reservation.Instances {
-				host, err := awsInstanceToHost(instance)
-				if err != nil {
-					return nil, status.Errorf(codes.InvalidArgument, "error processing host results for host set id %q: %s", query.Id, err)
-				}
-
-				queries[i].OutputHosts = append(queries[i].OutputHosts, host)
-				maxLen++ // Increment maximum counter for allocation later
-			}
-		}
-	}
-
-	// Now de-duplicate the hosts for the output. Maintain two sets:
-	// * A slice of hosts that will be used in the output
-	// * A map of hosts indexed by their external ID
-	//
-	// The map will is used in de-duplication to determine whether or
-	// not we've seen the host before to simply add the query's set ID
-	// to the list of set IDs that the host was seen in.
-	hostResultSlice := make([]*pb.ListHostsResponseHost, 0, maxLen)
-	hostResultMap := make(map[string]*pb.ListHostsResponseHost)
-	for _, query := range queries {
-		for _, host := range query.OutputHosts {
-			if existingHost, ok := hostResultMap[host.ExternalId]; ok {
-				// Existing host, just add the set ID to the list of seen IDs
-				// and continue
-				existingHost.SetIds = append(existingHost.SetIds, query.Id)
-				continue
-			}
-
-			// This will be the first seen entry, so append the set ID to
-			// this host, and add it.
-			host.SetIds = append(host.SetIds, query.Id)
-			hostResultSlice = append(hostResultSlice, host)
-			hostResultMap[host.ExternalId] = host
-		}
-	}
-
-	// Done!
-	return &pb.ListHostsResponse{
-		Hosts: hostResultSlice,
-	}, nil
-}
-
-func validateRegion(region string) error {
-	_, found := endpoints.PartitionForRegion(endpoints.DefaultPartitions(), region)
-	if !found {
-		return status.Errorf(codes.InvalidArgument, "not a valid region: %s", region)
-	}
-
-	return nil
-}
-
-func buildFilters(attrs *SetAttributes) ([]*ec2.Filter, error) {
-	var filters []*ec2.Filter
-	var foundStateFilter bool
-	for _, filterAttr := range attrs.Filters {
-		// Each filter arrives in "k=v1,v2" format. First, split on equal sign.
-		splitFilter := strings.Split(filterAttr, "=")
-		switch {
-		case len(splitFilter) != 2:
-			return nil, fmt.Errorf("expected filter %q to contain a single equal sign", filterAttr)
-		case len(splitFilter[0]) == 0:
-			return nil, fmt.Errorf("filter %q contains an empty filter key", filterAttr)
-		case len(splitFilter[1]) == 0:
-			return nil, fmt.Errorf("filter %q contains an empty value", filterAttr)
-		}
-
-		filterKey, filterValue := splitFilter[0], splitFilter[1]
-		if filterKey == "instance-state-code" || filterKey == "instance-state-name" {
-			foundStateFilter = true
-		}
-
-		var filterValues []*string
-		for _, val := range strings.Split(filterValue, ",") {
-			filterValues = append(filterValues, aws.String(val))
-		}
-
-		filters = append(filters, &ec2.Filter{
-			Name:   aws.String(filterKey),
-			Values: filterValues,
-		})
-	}
-
-	if !foundStateFilter {
-		// if there is no explicit instance state filter, add the
-		// instance-state-name = ["running"] to the filter set. This
-		// ensures that we filter on running instances only at the API
-		// side, saving time when processing results.
-		filters = append(filters, &ec2.Filter{
-			Name:   aws.String("instance-state-name"),
-			Values: aws.StringSlice([]string{ec2.InstanceStateNameRunning}),
-		})
-	}
-
-	return filters, nil
-}
-
-func buildDescribeInstancesInput(attrs *SetAttributes, dryRun bool) (*ec2.DescribeInstancesInput, error) {
-	filters, err := buildFilters(attrs)
-	if err != nil {
-		return nil, fmt.Errorf("error building filters: %w", err)
-	}
-
-	return &ec2.DescribeInstancesInput{
-		DryRun:  aws.Bool(dryRun),
-		Filters: filters,
-	}, nil
-}
-
-// awsInstanceToHost processes data from an ec2.Instance and returns
-// a ListHostsResponseHost with the ID and network addresses
-// populated.
-func awsInstanceToHost(instance *ec2.Instance) (*pb.ListHostsResponseHost, error) {
-	// Integrity check: some fields should always be non-nil. Check
-	// those.
-	if instance == nil {
-		return nil, errors.New("response integrity error: missing instance entry")
-	}
-
-	if aws.StringValue(instance.InstanceId) == "" {
-		return nil, errors.New("response integrity error: missing instance id")
-	}
-
-	result := new(pb.ListHostsResponseHost)
-
-	// External ID is the instance ID.
-	result.ExternalId = aws.StringValue(instance.InstanceId)
-
-	// First IP address/dns name are always the private fields if they
-	// are populated
-	if aws.StringValue(instance.PrivateIpAddress) != "" {
-		result.IpAddresses = append(result.IpAddresses, aws.StringValue(instance.PrivateIpAddress))
-	}
-	if aws.StringValue(instance.PrivateDnsName) != "" {
-		result.DnsNames = append(result.DnsNames, aws.StringValue(instance.PrivateDnsName))
-	}
-
-	// Public IP address/dns names are next
-	if aws.StringValue(instance.PublicIpAddress) != "" {
-		result.IpAddresses = append(result.IpAddresses, aws.StringValue(instance.PublicIpAddress))
-	}
-	if aws.StringValue(instance.PublicDnsName) != "" {
-		result.DnsNames = append(result.DnsNames, aws.StringValue(instance.PublicDnsName))
-	}
-
-	// Now go through all of the interfaces and log the IP address of
-	// every interface.
-	for _, iface := range instance.NetworkInterfaces {
-		if iface == nil {
-			// Probably will never happen, but just in case
-			return nil, errors.New("response integrity error: interface entry is nil")
-		}
-
-		// Populate default IP addresses/DNS name similar to how we do
-		// for the entire instance.
-		if aws.StringValue(iface.PrivateIpAddress) != "" && !stringInSlice(result.IpAddresses, aws.StringValue(iface.PrivateIpAddress)) {
-			result.IpAddresses = append(result.IpAddresses, aws.StringValue(iface.PrivateIpAddress))
-		}
-		if aws.StringValue(iface.PrivateDnsName) != "" && !stringInSlice(result.DnsNames, aws.StringValue(iface.PrivateDnsName)) {
-			result.DnsNames = append(result.DnsNames, aws.StringValue(iface.PrivateDnsName))
-		}
-
-		// Iterate through the private IP addresses and log the
-		// information.
-		for _, addr := range iface.PrivateIpAddresses {
-			if addr == nil {
-				return nil, errors.New("response integrity error: interface address entry is nil")
-			}
-
-			// Add private address/dns name if they have not been added yet
-			if aws.StringValue(addr.PrivateIpAddress) != "" && !stringInSlice(result.IpAddresses, aws.StringValue(addr.PrivateIpAddress)) {
-				result.IpAddresses = append(result.IpAddresses, aws.StringValue(addr.PrivateIpAddress))
-			}
-			if aws.StringValue(addr.PrivateDnsName) != "" && !stringInSlice(result.DnsNames, aws.StringValue(addr.PrivateDnsName)) {
-				result.DnsNames = append(result.DnsNames, aws.StringValue(addr.PrivateDnsName))
-			}
-
-			// Add public address/dns name if they have not been added yet
-			if addr.Association != nil && aws.StringValue(addr.Association.PublicIp) != "" && !stringInSlice(result.IpAddresses, aws.StringValue(addr.Association.PublicIp)) {
-				result.IpAddresses = append(result.IpAddresses, aws.StringValue(addr.Association.PublicIp))
-			}
-			if addr.Association != nil && aws.StringValue(addr.Association.PublicDnsName) != "" && !stringInSlice(result.DnsNames, aws.StringValue(addr.Association.PublicDnsName)) {
-				result.DnsNames = append(result.DnsNames, aws.StringValue(addr.Association.PublicDnsName))
-			}
-		}
-
-		// Add the IPv6 addresses.
-		for _, addr := range iface.Ipv6Addresses {
-			if addr == nil {
-				continue
-			}
-
-			if addr.Ipv6Address != nil && aws.StringValue(addr.Ipv6Address) != "" {
-				result.IpAddresses = append(result.IpAddresses, aws.StringValue(addr.Ipv6Address))
-			}
-		}
-	}
-
-	// Done
-	return result, nil
-}
-
-func stringInSlice(s []string, x string) bool {
-	for _, y := range s {
-		if x == y {
-			return true
-		}
-	}
-
-	return false
 }
@@ -0,0 +1,128 @@
+## Getting Started
+
+Refer to [Attributes and Secrets](#attributes-and-secrets) for more detail on
+configuration options for host catalogs and sets.
+
+To create a host catalog (using default scope created by `boundary dev`):
+
+```
+boundary host-catalogs create plugin \
+ -scope-id p_1234567890 \
+ -name "Example Plugin-Based Host Catalog" \
+ -description "Description for plugin-based host catalog" \
+ -plugin-name aws \
+ -attr region=REGION \
+ -secret access_key_id='KEY' \
+ -secret secret_access_key='SECRET'
+```
+
+To create a host set, filtering the host set based on tag keys `foo` or `bar`
+(either tag can be present), ensuring that any targets set to this host set only
+connect to external addresses in the `54.0.0.0/8` class A subnet:
+
+```
+boundary host-sets create plugin \
+ -host-catalog-id HOST_CATALOG_ID \
+ -name "Example Plugin-Based Host Set" \
+ -description "Description for plugin-based host set" \
+ -attr filters=tag-key=foo,bar \
+ -preferred-endpoint "cidr:54.0.0.0/8"
+```
+
+As above, but instances must have both tags (both `foo` and `bar` *must* be
+present):
+
+```
+boundary host-sets create plugin \
+ -host-catalog-id HOST_CATALOG_ID \
+ -name "Example Plugin-Based Host Set" \
+ -description "Description for plugin-based host set" \
+ -attr filters=tag-key=foo \
+ -attr filters=tag-key=bar \
+ -preferred-endpoint "cidr:54.0.0.0/8"
+```
+
+As above, but matching on tag key named "development" with value "prod" or "dev"
+and launch date:
+
+```
+boundary host-sets create plugin \
+ -host-catalog-id HOST_CATALOG_ID \
+ -name "Example Plugin-Based Host Set" \
+ -description "Description for plugin-based host set" \
+ -attr filters=tag:development=prod,dev \
+ -attr filters=launch-time=2022-01-04T* \
+ -preferred-endpoint "cidr:54.0.0.0/8"
+```
+
+## Required IAM Privileges
+
+The following IAM privileges, at the very least, are required to be attached to
+a configured IAM user for this provider:
+
+* `ec2:DescribeInstances`, configured to `*` (`DescribeInstances` cannot be
+  scoped to a resource ARN). Example policy:
+
+```
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": [
+        "ec2:DescribeInstances"
+      ],
+      "Effect": "Allow",
+      "Resource": "*"
+    }
+  ]
+}
+```
+
+* `iam:GetUser`, `iam:CreateAccessKey`, and `iam:DeleteAccessKey`, configured to
+  the IAM user to allow credential rotation. Example policy:
+
+```
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": [
+        "iam:DeleteAccessKey",
+        "iam:GetUser",
+        "iam:CreateAccessKey"
+      ],
+      "Effect": "Allow",
+      "Resource": "arn:aws:iam::123456789012:user/JohnDoe"
+    }
+  ]
+}
+```
+
+## Attributes and Secrets
+
+### Host Catalog
+
+The following `attributes` are valid on an AWS host catalog resource:
+
+- `disable_credential_rotation` (bool): If `true`, credential rotation will not
+  be performed. See the [Credential Rotation](#credential-rotation) section
+  above.
+- `region` (string): The region to configure the host catalog for. All host sets
+  in this catalog will be configured for this region.
+
+The following `secrets` are valid on an AWS host catalog resource:
+
+- `access_key_id` (string): The access key ID for the IAM user to use with this
+  host catalog.
+- `secret_access_key` (string): The secret access key for the IAM user to use
+  with this host catalog.
+
+### Host Set
+
+The following attributes are valid on an AWS host Set resource:
+
+- `filters` (array of strings): An array of string filters in the format
+  `key=val1,val2`. The key corresponds to a filter option, and the value(s) are
+  a comma-separated list. For a list of filter options, check out
+  [describe-instances in the AWS CLI
+  reference](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html).
@@ -0,0 +1,90 @@
+package host
+
+import (
+	"fmt"
+
+	cred "github.com/hashicorp/boundary-plugin-aws/internal/credential"
+	"github.com/hashicorp/boundary-plugin-aws/internal/errors"
+	"github.com/hashicorp/boundary-plugin-aws/internal/values"
+	"github.com/mitchellh/mapstructure"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/structpb"
+)
+
+// CatalogAttributes is a Go-native representation of the Attributes
+// map.
+type CatalogAttributes struct {
+	*cred.CredentialAttributes
+}
+
+func getCatalogAttributes(in *structpb.Struct) (*CatalogAttributes, error) {
+	unknownFields := values.StructFields(in)
+	badFields := make(map[string]string)
+
+	var err error
+	credAttributes, err := cred.GetCredentialAttributes(in)
+	if err != nil {
+		return nil, err
+	}
+
+	for s := range unknownFields {
+		switch s {
+		// Ignore knownFields from CredentialAttributes
+		case cred.ConstRegion:
+			continue
+		case cred.ConstDisableCredentialRotation:
+			continue
+		default:
+			badFields[fmt.Sprintf("attributes.%s", s)] = "unrecognized field"
+		}
+	}
+
+	if len(badFields) > 0 {
+		return nil, errors.InvalidArgumentError("Invalid arguments in catalog attributes", badFields)
+	}
+
+	return &CatalogAttributes{
+		CredentialAttributes: credAttributes,
+	}, nil
+}
+
+// SetAttributes is a Go-native representation of the Attributes map that can be
+// used for decoding the incoming map via mapstructure.
+type SetAttributes struct {
+	Filters []string
+}
+
+func getSetAttributes(in *structpb.Struct) (*SetAttributes, error) {
+	var setAttrs SetAttributes
+
+	// Quick validation to ensure that there's no non-filter attributes
+	// here for now. Make this more complex if we add more attributes
+	// to host sets.
+	unknownFields := values.StructFields(in)
+	badFields := make(map[string]string)
+	delete(unknownFields, ConstDescribeInstancesFilters)
+	for a := range unknownFields {
+		badFields[fmt.Sprintf("attributes.%s", a)] = "unrecognized field"
+	}
+	if len(badFields) > 0 {
+		return nil, errors.InvalidArgumentError("Error in the attributes provided", badFields)
+	}
+
+	// Mapstructure complains if it expects a slice as output and sees a scalar
+	// value. Rather than use WeakDecode and risk unintended consequences, I'm
+	// manually making this change if necessary.
+	inMap := in.AsMap()
+	if filtersRaw, ok := inMap[ConstDescribeInstancesFilters]; ok {
+		switch filterVal := filtersRaw.(type) {
+		case string:
+			inMap[ConstDescribeInstancesFilters] = []string{filterVal}
+		}
+	}
+
+	if err := mapstructure.Decode(inMap, &setAttrs); err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error decoding set attributes: %s", err)
+	}
+
+	return &setAttrs, nil
+}
@@ -0,0 +1,188 @@
+package host
+
+import (
+	"context"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/boundary-plugin-aws/internal/credential"
+	"github.com/hashicorp/boundary/sdk/pbs/plugin"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/testing/protocmp"
+	"google.golang.org/protobuf/types/known/structpb"
+)
+
+func TestGetCatalogAttributes(t *testing.T) {
+	cases := []struct {
+		name                string
+		in                  map[string]any
+		expected            *CatalogAttributes
+		expectedErrContains string
+	}{
+		{
+			name:                "missing region",
+			in:                  map[string]any{},
+			expectedErrContains: "missing required value \"region\"",
+		},
+		{
+			name: "bad value for disable_credential_rotation",
+			in: map[string]any{
+				credential.ConstRegion:                    "us-west-2",
+				credential.ConstDisableCredentialRotation: "sure",
+			},
+			expectedErrContains: "unexpected type for value \"disable_credential_rotation\": want bool, got string",
+		},
+		{
+			name: "unknown fields",
+			in: map[string]any{
+				credential.ConstRegion: "us-west-2",
+				"foo":                  true,
+				"bar":                  true,
+			},
+			expectedErrContains: "attributes.bar: unrecognized field, attributes.foo: unrecognized field",
+		},
+		{
+			name: "default",
+			in: map[string]any{
+				credential.ConstRegion: "us-west-2",
+			},
+			expected: &CatalogAttributes{
+				CredentialAttributes: &credential.CredentialAttributes{
+					Region:                    "us-west-2",
+					DisableCredentialRotation: false,
+				},
+			},
+		},
+		{
+			name: "with disable_credential_rotation",
+			in: map[string]any{
+				credential.ConstRegion:                    "us-west-2",
+				credential.ConstDisableCredentialRotation: true,
+			},
+			expected: &CatalogAttributes{
+				CredentialAttributes: &credential.CredentialAttributes{
+					Region:                    "us-west-2",
+					DisableCredentialRotation: true,
+				},
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			require := require.New(t)
+
+			input, err := structpb.NewStruct(tc.in)
+			require.NoError(err)
+
+			actual, err := getCatalogAttributes(input)
+			if tc.expectedErrContains != "" {
+				require.Error(err)
+				require.Contains(err.Error(), tc.expectedErrContains)
+				require.Equal(status.Code(err), codes.InvalidArgument)
+				return
+			}
+
+			require.NoError(err)
+			require.Equal(tc.expected, actual)
+		})
+	}
+}
+
+func TestGetSetAttributes(t *testing.T) {
+	cases := []struct {
+		name                string
+		in                  map[string]any
+		normalized          map[string]any
+		expected            *SetAttributes
+		expectedErrContains string
+	}{
+		{
+			name:     "missing",
+			in:       map[string]any{},
+			expected: &SetAttributes{},
+		},
+		{
+			name: "non-string-slice value",
+			in: map[string]any{
+				ConstDescribeInstancesFilters: "zip=foo,bar",
+			},
+			expected: &SetAttributes{
+				Filters: []string{"zip=foo,bar"},
+			},
+		},
+		{
+			name: "bad filter element value",
+			in: map[string]any{
+				ConstDescribeInstancesFilters: []any{1},
+			},
+			expectedErrContains: "expected type 'string', got unconvertible type 'float64'",
+		},
+		{
+			name: "unknown fields",
+			in: map[string]any{
+				"foo": true,
+				"bar": true,
+			},
+			expectedErrContains: "attributes.bar: unrecognized field, attributes.foo: unrecognized field",
+		},
+		{
+			name: "good",
+			in: map[string]any{
+				ConstDescribeInstancesFilters: []any{
+					"foo=bar",
+					"zip=zap",
+				},
+			},
+			expected: &SetAttributes{
+				Filters: []string{"foo=bar", "zip=zap"},
+			},
+		},
+		{
+			name: "good with filter transform",
+			in: map[string]any{
+				ConstDescribeInstancesFilters: "foo=bar",
+			},
+			normalized: map[string]any{
+				ConstDescribeInstancesFilters: []any{"foo=bar"},
+			},
+			expected: &SetAttributes{
+				Filters: []string{"foo=bar"},
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			require := require.New(t)
+
+			input, err := structpb.NewStruct(tc.in)
+			require.NoError(err)
+
+			p := new(HostPlugin)
+			normalizedOut, err := p.NormalizeSetData(context.Background(), &plugin.NormalizeSetDataRequest{Attributes: input})
+			require.NoError(err)
+
+			if tc.normalized != nil {
+				normalized, err := structpb.NewStruct(tc.normalized)
+				require.NoError(err)
+				require.Empty(cmp.Diff(normalized, normalizedOut.Attributes, protocmp.Transform()))
+			}
+			input = normalizedOut.Attributes
+			actual, err := getSetAttributes(input)
+			if tc.expectedErrContains != "" {
+				require.Error(err)
+				require.Contains(err.Error(), tc.expectedErrContains)
+				require.Equal(status.Code(err), codes.InvalidArgument)
+				return
+			}
+
+			require.NoError(err)
+			require.Equal(tc.expected, actual)
+		})
+	}
+}
@@ -0,0 +1,10 @@
+package host
+
+const (
+	// ConstDescribeInstancesFilters is the key for the filter in the dynamic host set.
+	ConstDescribeInstancesFilters = "filters"
+
+	// ConstInstanceNameTagKey denotes the special AWS tag key that contains an EC2
+	// instance's name. This field is to be matched literally.
+	ConstInstanceNameTagKey = "Name"
+)
@@ -0,0 +1,725 @@
+package host
+
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/ec2"
+	pb "github.com/hashicorp/boundary/sdk/pbs/plugin"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/structpb"
+
+	"github.com/hashicorp/boundary-plugin-aws/internal/credential"
+	cred "github.com/hashicorp/boundary-plugin-aws/internal/credential"
+)
+
+// HostPlugin implements the HostPluginServiceServer interface for the
+// AWS host service plugin.
+type HostPlugin struct {
+	pb.UnimplementedHostPluginServiceServer
+
+	// testCredStateOpts are passed in to the stored state to control test behavior
+	testCredStateOpts []credential.AwsCredentialPersistedStateOption
+
+	// testCatalogStateOpts are passed in to the stored state to control test behavior
+	testCatalogStateOpts []awsCatalogPersistedStateOption
+}
+
+// Ensure that we are implementing HostPluginServiceServer
+var _ pb.HostPluginServiceServer = (*HostPlugin)(nil)
+
+// OnCreateCatalog is called when a dynamic host catalog is created.
+func (p *HostPlugin) OnCreateCatalog(ctx context.Context, req *pb.OnCreateCatalogRequest) (*pb.OnCreateCatalogResponse, error) {
+	catalog := req.GetCatalog()
+	if catalog == nil {
+		return nil, status.Error(codes.InvalidArgument, "catalog is nil")
+	}
+
+	secrets := catalog.GetSecrets()
+	if secrets == nil {
+		return nil, status.Error(codes.InvalidArgument, "secrets are required")
+	}
+
+	attrs := catalog.GetAttributes()
+	if attrs == nil {
+		return nil, status.Error(codes.InvalidArgument, "attributes are required")
+	}
+
+	catalogAttributes, err := getCatalogAttributes(attrs)
+	if err != nil {
+		return nil, err
+	}
+	credConfig, err := cred.GetCredentialsConfig(secrets, catalogAttributes.Region)
+	if err != nil {
+		return nil, err
+	}
+
+	// Set up the creds in our persisted state.
+	credState, err := credential.NewAwsCredentialPersistedState(
+		append([]credential.AwsCredentialPersistedStateOption{
+			credential.WithAccessKeyId(credConfig.AccessKey),
+			credential.WithSecretAccessKey(credConfig.SecretKey),
+			credential.WithRegion(credConfig.Region),
+		}, p.testCredStateOpts...)...,
+	)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error setting up persisted state: %s", err)
+	}
+
+	catalogState, err := newAwsCatalogPersistedState(
+		append([]awsCatalogPersistedStateOption{
+			withCredentials(credState),
+		}, p.testCatalogStateOpts...)...,
+	)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error setting up persisted state: %s", err)
+	}
+
+	// Try to rotate the credentials if we're not skipping them.
+	if !catalogAttributes.DisableCredentialRotation {
+		if err := credState.RotateCreds(); err != nil {
+			return nil, status.Errorf(codes.InvalidArgument, "error during credential rotation: %s", err)
+		}
+	} else {
+		// Simply validate if we aren't rotating.
+		if err := credState.ValidateCreds(); err != nil {
+			return nil, status.Errorf(codes.InvalidArgument, "error during credential validation: %s", err)
+		}
+	}
+
+	persistedProto, err := catalogState.toProto()
+	if err != nil {
+		return nil, status.Error(codes.InvalidArgument, err.Error())
+	}
+
+	return &pb.OnCreateCatalogResponse{
+		Persisted: persistedProto,
+	}, nil
+}
+
+// OnUpdateCatalog is called when a dynamic host catalog is updated.
+func (p *HostPlugin) OnUpdateCatalog(ctx context.Context, req *pb.OnUpdateCatalogRequest) (*pb.OnUpdateCatalogResponse, error) {
+	// For host catalogs we only need to really validate what is
+	// currently in the new copy of the host catalog data, so skip
+	// fetching the new copy to keep things a little less messy.
+	catalog := req.GetNewCatalog()
+	if catalog == nil {
+		return nil, status.Error(codes.InvalidArgument, "new catalog is nil")
+	}
+
+	var updateSecrets bool
+	secrets := catalog.GetSecrets()
+	if secrets != nil {
+		// We will be updating secrets this run, but what exactly that
+		// means will be determined later.
+		updateSecrets = true
+	}
+
+	attrs := catalog.GetAttributes()
+	if attrs == nil {
+		return nil, status.Error(codes.InvalidArgument, "new catalog missing attributes")
+	}
+
+	catalogAttributes, err := getCatalogAttributes(attrs)
+	if err != nil {
+		return nil, err
+	}
+
+	// Get the persisted data.
+	// NOTE: We might need to change this at a later time. I'm not too
+	// sure *exactly* what scenarios we might encounter that would
+	// ultimately mean that we would have to handle an empty or missing
+	// state in update, but what we are ultimately assuming here
+	// (implicitly through awsCatalogPersistedStateFromProto) is that
+	// the state will exist and be populated. Personally I think this
+	// is fine and important, but this may change in the future.
+	credState, err := credential.AwsCredentialPersistedStateFromProto(
+		req.GetPersisted().GetSecrets(),
+		append(p.testCredStateOpts, credential.WithRegion(catalogAttributes.Region))...)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error loading persisted state: %s", err)
+	}
+
+	catalogState, err := newAwsCatalogPersistedState(
+		append([]awsCatalogPersistedStateOption{
+			withCredentials(credState),
+		}, p.testCatalogStateOpts...)...,
+	)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error loading persisted state: %s", err)
+	}
+
+	if catalogAttributes.DisableCredentialRotation && !updateSecrets {
+		// This is a validate check to make sure that we aren't disabling
+		// rotation for credentials currently being managed by rotation.
+		// This is not allowed.
+		if !credState.CredsLastRotatedTime.IsZero() {
+			return nil, status.Error(codes.FailedPrecondition, "cannot disable rotation for already-rotated credentials")
+		}
+	}
+
+	if updateSecrets {
+		catalogSecrets, err := credential.GetCredentialsConfig(secrets, catalogAttributes.Region)
+		if err != nil {
+			return nil, err
+		}
+
+		// Replace the credentials. This checks the timestamp on the last
+		// rotation time as well and deletes the credentials if we are
+		// managing them (ie: if we've rotated them before).
+		if err := credState.ReplaceCreds(catalogSecrets.AccessKey, catalogSecrets.SecretKey); err != nil {
+			return nil, status.Errorf(codes.InvalidArgument, "error attempting to replace credentials: %s", err)
+		}
+	}
+
+	if !catalogAttributes.DisableCredentialRotation && credState.CredsLastRotatedTime.IsZero() {
+		// If we're enabling rotation now but didn't before, or have
+		// freshly replaced credentials, we can rotate here.
+		if err := credState.RotateCreds(); err != nil {
+			return nil, status.Errorf(codes.InvalidArgument, "error during credential rotation: %s", err)
+		}
+	}
+
+	// That's it!
+	persistedProto, err := catalogState.toProto()
+	if err != nil {
+		return nil, status.Error(codes.InvalidArgument, err.Error())
+	}
+
+	return &pb.OnUpdateCatalogResponse{
+		Persisted: persistedProto,
+	}, nil
+}
+
+// OnDeleteCatalog is called when a dynamic host catalog is deleted.
+func (p *HostPlugin) OnDeleteCatalog(ctx context.Context, req *pb.OnDeleteCatalogRequest) (*pb.OnDeleteCatalogResponse, error) {
+	catalog := req.GetCatalog()
+	if catalog == nil {
+		return nil, status.Error(codes.InvalidArgument, "new catalog is nil")
+	}
+
+	attrs := catalog.GetAttributes()
+	if attrs == nil {
+		return nil, status.Error(codes.InvalidArgument, "new catalog missing attributes")
+	}
+
+	catalogAttributes, err := getCatalogAttributes(attrs)
+	if err != nil {
+		return nil, err
+	}
+
+	// Get the persisted data.
+	// NOTE: We return on error here, blocking the delete. This may or
+	// may not be an overzealous approach to maintaining database/state
+	// integrity. May need to be changed at later time if there are
+	// scenarios where we might be deleting things and any secret state
+	// may be corrupt/and or legitimately missing.
+	credState, err := credential.AwsCredentialPersistedStateFromProto(
+		req.GetPersisted().GetSecrets(),
+		append(p.testCredStateOpts, credential.WithRegion(catalogAttributes.Region))...)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error loading persisted state: %s", err)
+	}
+
+	_, err = newAwsCatalogPersistedState(
+		append([]awsCatalogPersistedStateOption{
+			withCredentials(credState),
+		}, p.testCatalogStateOpts...)...,
+	)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error loading persisted state: %s", err)
+	}
+
+	if !credState.CredsLastRotatedTime.IsZero() {
+		// Delete old/existing credentials. This is done with the same
+		// credentials to ensure that it has the proper permissions to do
+		// it.
+		if err := credState.DeleteCreds(); err != nil {
+			return nil, status.Errorf(codes.Aborted, "error removing rotated credentials during catalog deletion: %s", err)
+		}
+	}
+
+	return &pb.OnDeleteCatalogResponse{}, nil
+}
+
+// NormalizeSetData currently ensures that "filters" is an array value, even
+// though it's accepted as a string value for CLI UX reasons
+func (p *HostPlugin) NormalizeSetData(ctx context.Context, req *pb.NormalizeSetDataRequest) (*pb.NormalizeSetDataResponse, error) {
+	if req.Attributes == nil {
+		return new(pb.NormalizeSetDataResponse), nil
+	}
+
+	val := req.Attributes.Fields["filters"]
+	if val == nil {
+		return &pb.NormalizeSetDataResponse{Attributes: req.Attributes}, nil
+	}
+	stringVal, ok := val.Kind.(*structpb.Value_StringValue)
+	if !ok {
+		return &pb.NormalizeSetDataResponse{Attributes: req.Attributes}, nil
+	}
+
+	retAttrs := proto.Clone(req.Attributes).(*structpb.Struct)
+	retAttrs.Fields["filters"] = structpb.NewListValue(
+		&structpb.ListValue{
+			Values: []*structpb.Value{
+				structpb.NewStringValue(stringVal.StringValue),
+			},
+		})
+
+	return &pb.NormalizeSetDataResponse{Attributes: retAttrs}, nil
+}
+
+// OnCreateSet is called when a dynamic host set is created.
+func (p *HostPlugin) OnCreateSet(ctx context.Context, req *pb.OnCreateSetRequest) (*pb.OnCreateSetResponse, error) {
+	catalog := req.GetCatalog()
+	if catalog == nil {
+		return nil, status.Error(codes.InvalidArgument, "catalog is nil")
+	}
+
+	catalogAttrsRaw := catalog.GetAttributes()
+	if catalogAttrsRaw == nil {
+		return nil, status.Error(codes.InvalidArgument, "catalog missing attributes")
+	}
+
+	catalogAttributes, err := getCatalogAttributes(catalogAttrsRaw)
+	if err != nil {
+		return nil, err
+	}
+
+	credState, err := credential.AwsCredentialPersistedStateFromProto(
+		req.GetPersisted().GetSecrets(),
+		append(p.testCredStateOpts, credential.WithRegion(catalogAttributes.Region))...)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error loading persisted state: %s", err)
+	}
+
+	catalogState, err := newAwsCatalogPersistedState(
+		append([]awsCatalogPersistedStateOption{
+			withCredentials(credState),
+		}, p.testCatalogStateOpts...)...,
+	)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error loading persisted state: %s", err)
+	}
+
+	set := req.GetSet()
+	if set == nil {
+		return nil, status.Error(codes.InvalidArgument, "set is nil")
+	}
+
+	if set.GetAttributes() == nil {
+		return nil, status.Error(codes.InvalidArgument, "set missing attributes")
+	}
+	setAttrs, err := getSetAttributes(set.GetAttributes())
+	if err != nil {
+		return nil, err
+	}
+
+	ec2Client, err := catalogState.EC2Client(catalogAttributes.Region)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error getting EC2 client: %s", err)
+	}
+
+	input, err := buildDescribeInstancesInput(setAttrs, true)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error building DescribeInstances parameters: %s", err)
+	}
+
+	_, err = ec2Client.DescribeInstances(input)
+	if err == nil {
+		return nil, status.Error(codes.FailedPrecondition, "query error: DescribeInstances DryRun should have returned error, but none was found")
+	}
+
+	if awsErr, ok := err.(awserr.Error); ok && awsErr.Code() == "DryRunOperation" {
+		// Success
+		return &pb.OnCreateSetResponse{}, nil
+	}
+
+	return nil, status.Errorf(codes.InvalidArgument, "error performing dry run of DescribeInstances: %s", err)
+}
+
+// OnUpdateSet is called when a dynamic host set is updated.
+func (p *HostPlugin) OnUpdateSet(ctx context.Context, req *pb.OnUpdateSetRequest) (*pb.OnUpdateSetResponse, error) {
+	catalog := req.GetCatalog()
+	if catalog == nil {
+		return nil, status.Error(codes.InvalidArgument, "catalog is nil")
+	}
+
+	catalogAttrsRaw := catalog.GetAttributes()
+	if catalogAttrsRaw == nil {
+		return nil, status.Error(codes.InvalidArgument, "catalog missing attributes")
+	}
+
+	catalogAttributes, err := getCatalogAttributes(catalogAttrsRaw)
+	if err != nil {
+		return nil, err
+	}
+
+	credState, err := credential.AwsCredentialPersistedStateFromProto(
+		req.GetPersisted().GetSecrets(),
+		append(p.testCredStateOpts, credential.WithRegion(catalogAttributes.Region))...)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error loading persisted state: %s", err)
+	}
+
+	catalogState, err := newAwsCatalogPersistedState(
+		append([]awsCatalogPersistedStateOption{
+			withCredentials(credState),
+		}, p.testCatalogStateOpts...)...,
+	)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error loading persisted state: %s", err)
+	}
+
+	// As with catalog, we don't need to really look at the old host
+	// set here, just need to work off of/validate the new set config
+	set := req.GetNewSet()
+	if set == nil {
+		return nil, status.Error(codes.InvalidArgument, "new set is nil")
+	}
+
+	if set.GetAttributes() == nil {
+		return nil, status.Error(codes.InvalidArgument, "new set missing attributes")
+	}
+	setAttrs, err := getSetAttributes(set.GetAttributes())
+	if err != nil {
+		return nil, err
+	}
+
+	ec2Client, err := catalogState.EC2Client(catalogAttributes.Region)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error getting EC2 client: %s", err)
+	}
+
+	input, err := buildDescribeInstancesInput(setAttrs, true)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error building DescribeInstances parameters: %s", err)
+	}
+
+	_, err = ec2Client.DescribeInstances(input)
+	if err == nil {
+		return nil, status.Error(codes.FailedPrecondition, "query error: DescribeInstances DryRun should have returned error, but none was found")
+	}
+
+	if awsErr, ok := err.(awserr.Error); ok && awsErr.Code() == "DryRunOperation" {
+		// Success
+		return &pb.OnUpdateSetResponse{}, nil
+	}
+
+	return nil, status.Errorf(codes.InvalidArgument, "error performing dry run of DescribeInstances: %s", err)
+}
+
+// OnDeleteSet is called when a dynamic host set is deleted.
+func (p *HostPlugin) OnDeleteSet(ctx context.Context, req *pb.OnDeleteSetRequest) (*pb.OnDeleteSetResponse, error) {
+	// No-op, AWS host set does not maintain anything that requires
+	// cleanup
+	return &pb.OnDeleteSetResponse{}, nil
+}
+
+// ListHosts returns the list of ec2 hosts and their descriptions.
+func (p *HostPlugin) ListHosts(ctx context.Context, req *pb.ListHostsRequest) (*pb.ListHostsResponse, error) {
+	catalog := req.GetCatalog()
+	if catalog == nil {
+		return nil, status.Error(codes.InvalidArgument, "catalog is nil")
+	}
+
+	catalogAttrsRaw := catalog.GetAttributes()
+	if catalogAttrsRaw == nil {
+		return nil, status.Error(codes.InvalidArgument, "catalog missing attributes")
+	}
+
+	catalogAttributes, err := getCatalogAttributes(catalogAttrsRaw)
+	if err != nil {
+		return nil, err
+	}
+
+	credState, err := credential.AwsCredentialPersistedStateFromProto(req.GetPersisted().GetSecrets(), p.testCredStateOpts...)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error loading persisted state: %s", err)
+	}
+
+	catalogState, err := newAwsCatalogPersistedState(
+		append([]awsCatalogPersistedStateOption{
+			withCredentials(credState),
+		}, p.testCatalogStateOpts...)...,
+	)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error loading persisted state: %s", err)
+	}
+
+	sets := req.GetSets()
+	if sets == nil {
+		return nil, status.Error(codes.InvalidArgument, "sets is nil")
+	}
+
+	// Build all the queries in advance.
+	type hostSetQuery struct {
+		Id          string
+		Input       *ec2.DescribeInstancesInput
+		Output      *ec2.DescribeInstancesOutput
+		OutputHosts []*pb.ListHostsResponseHost
+	}
+
+	queries := make([]hostSetQuery, len(sets))
+	for i, set := range sets {
+		// Validate Id since we use it in output
+		if set.GetId() == "" {
+			return nil, status.Error(codes.InvalidArgument, "set missing id")
+		}
+
+		if set.GetAttributes() == nil {
+			return nil, status.Error(codes.InvalidArgument, "set missing attributes")
+		}
+		setAttrs, err := getSetAttributes(set.GetAttributes())
+		if err != nil {
+			return nil, err
+		}
+
+		input, err := buildDescribeInstancesInput(setAttrs, false)
+		if err != nil {
+			return nil, status.Errorf(codes.InvalidArgument, "error building DescribeInstances parameters for host set id %q: %s", set.GetId(), err)
+		}
+		queries[i] = hostSetQuery{
+			Id:    set.GetId(),
+			Input: input,
+		}
+	}
+
+	ec2Client, err := catalogState.EC2Client(catalogAttributes.Region)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error getting EC2 client: %s", err)
+	}
+
+	// Run all queries now and assemble output.
+	var maxLen int
+	for i, query := range queries {
+		output, err := ec2Client.DescribeInstances(query.Input)
+		if err != nil {
+			return nil, status.Errorf(codes.InvalidArgument, "error running DescribeInstances for host set id %q: %s", query.Id, err)
+		}
+
+		queries[i].Output = output
+
+		// Process the output here, we will normalize this into a single
+		// set of hosts afterwards (possibly removing duplicates).
+		for _, reservation := range output.Reservations {
+			for _, instance := range reservation.Instances {
+				host, err := awsInstanceToHost(instance)
+				if err != nil {
+					return nil, status.Errorf(codes.InvalidArgument, "error processing host results for host set id %q: %s", query.Id, err)
+				}
+
+				queries[i].OutputHosts = append(queries[i].OutputHosts, host)
+				maxLen++ // Increment maximum counter for allocation later
+			}
+		}
+	}
+
+	// Now de-duplicate the hosts for the output. Maintain two sets:
+	// * A slice of hosts that will be used in the output
+	// * A map of hosts indexed by their external ID
+	//
+	// The map will is used in de-duplication to determine whether or
+	// not we've seen the host before to simply add the query's set ID
+	// to the list of set IDs that the host was seen in.
+	hostResultSlice := make([]*pb.ListHostsResponseHost, 0, maxLen)
+	hostResultMap := make(map[string]*pb.ListHostsResponseHost)
+	for _, query := range queries {
+		for _, host := range query.OutputHosts {
+			if existingHost, ok := hostResultMap[host.ExternalId]; ok {
+				// Existing host, just add the set ID to the list of seen IDs
+				// and continue
+				existingHost.SetIds = append(existingHost.SetIds, query.Id)
+				continue
+			}
+
+			// This will be the first seen entry, so append the set ID to
+			// this host, and add it.
+			host.SetIds = append(host.SetIds, query.Id)
+			hostResultSlice = append(hostResultSlice, host)
+			hostResultMap[host.ExternalId] = host
+		}
+	}
+
+	// Done!
+	return &pb.ListHostsResponse{
+		Hosts: hostResultSlice,
+	}, nil
+}
+
+func buildFilters(attrs *SetAttributes) ([]*ec2.Filter, error) {
+	var filters []*ec2.Filter
+	var foundStateFilter bool
+	for _, filterAttr := range attrs.Filters {
+		// Each filter arrives in "k=v1,v2" format. First, split on equal sign.
+		splitFilter := strings.Split(filterAttr, "=")
+		switch {
+		case len(splitFilter) != 2:
+			return nil, fmt.Errorf("expected filter %q to contain a single equal sign", filterAttr)
+		case len(splitFilter[0]) == 0:
+			return nil, fmt.Errorf("filter %q contains an empty filter key", filterAttr)
+		case len(splitFilter[1]) == 0:
+			return nil, fmt.Errorf("filter %q contains an empty value", filterAttr)
+		}
+
+		filterKey, filterValue := splitFilter[0], splitFilter[1]
+		if filterKey == "instance-state-code" || filterKey == "instance-state-name" {
+			foundStateFilter = true
+		}
+
+		var filterValues []*string
+		for _, val := range strings.Split(filterValue, ",") {
+			filterValues = append(filterValues, aws.String(val))
+		}
+
+		filters = append(filters, &ec2.Filter{
+			Name:   aws.String(filterKey),
+			Values: filterValues,
+		})
+	}
+
+	if !foundStateFilter {
+		// if there is no explicit instance state filter, add the
+		// instance-state-name = ["running"] to the filter set. This
+		// ensures that we filter on running instances only at the API
+		// side, saving time when processing results.
+		filters = append(filters, &ec2.Filter{
+			Name:   aws.String("instance-state-name"),
+			Values: aws.StringSlice([]string{ec2.InstanceStateNameRunning}),
+		})
+	}
+
+	return filters, nil
+}
+
+func buildDescribeInstancesInput(attrs *SetAttributes, dryRun bool) (*ec2.DescribeInstancesInput, error) {
+	filters, err := buildFilters(attrs)
+	if err != nil {
+		return nil, fmt.Errorf("error building filters: %w", err)
+	}
+
+	return &ec2.DescribeInstancesInput{
+		DryRun:  aws.Bool(dryRun),
+		Filters: filters,
+	}, nil
+}
+
+// awsInstanceToHost processes data from an ec2.Instance and returns
+// a ListHostsResponseHost with the ID and network addresses
+// populated.
+func awsInstanceToHost(instance *ec2.Instance) (*pb.ListHostsResponseHost, error) {
+	// Integrity check: some fields should always be non-nil. Check
+	// those.
+	if instance == nil {
+		return nil, errors.New("response integrity error: missing instance entry")
+	}
+
+	if aws.StringValue(instance.InstanceId) == "" {
+		return nil, errors.New("response integrity error: missing instance id")
+	}
+
+	result := new(pb.ListHostsResponseHost)
+
+	// External ID is the instance ID.
+	result.ExternalId = aws.StringValue(instance.InstanceId)
+
+	// External Name is the AWS "Name" tag, if it exists.
+	for _, t := range instance.Tags {
+		if aws.StringValue(t.Key) == ConstInstanceNameTagKey {
+			result.ExternalName = aws.StringValue(t.Value)
+			break
+		}
+	}
+
+	// First IP address/dns name are always the private fields if they
+	// are populated
+	if aws.StringValue(instance.PrivateIpAddress) != "" {
+		result.IpAddresses = append(result.IpAddresses, aws.StringValue(instance.PrivateIpAddress))
+	}
+	if aws.StringValue(instance.PrivateDnsName) != "" {
+		result.DnsNames = append(result.DnsNames, aws.StringValue(instance.PrivateDnsName))
+	}
+
+	// Public IP address/dns names are next
+	if aws.StringValue(instance.PublicIpAddress) != "" {
+		result.IpAddresses = append(result.IpAddresses, aws.StringValue(instance.PublicIpAddress))
+	}
+	if aws.StringValue(instance.PublicDnsName) != "" {
+		result.DnsNames = append(result.DnsNames, aws.StringValue(instance.PublicDnsName))
+	}
+
+	// Now go through all of the interfaces and log the IP address of
+	// every interface.
+	for _, iface := range instance.NetworkInterfaces {
+		if iface == nil {
+			// Probably will never happen, but just in case
+			return nil, errors.New("response integrity error: interface entry is nil")
+		}
+
+		// Populate default IP addresses/DNS name similar to how we do
+		// for the entire instance.
+		if aws.StringValue(iface.PrivateIpAddress) != "" && !stringInSlice(result.IpAddresses, aws.StringValue(iface.PrivateIpAddress)) {
+			result.IpAddresses = append(result.IpAddresses, aws.StringValue(iface.PrivateIpAddress))
+		}
+		if aws.StringValue(iface.PrivateDnsName) != "" && !stringInSlice(result.DnsNames, aws.StringValue(iface.PrivateDnsName)) {
+			result.DnsNames = append(result.DnsNames, aws.StringValue(iface.PrivateDnsName))
+		}
+
+		// Iterate through the private IP addresses and log the
+		// information.
+		for _, addr := range iface.PrivateIpAddresses {
+			if addr == nil {
+				return nil, errors.New("response integrity error: interface address entry is nil")
+			}
+
+			// Add private address/dns name if they have not been added yet
+			if aws.StringValue(addr.PrivateIpAddress) != "" && !stringInSlice(result.IpAddresses, aws.StringValue(addr.PrivateIpAddress)) {
+				result.IpAddresses = append(result.IpAddresses, aws.StringValue(addr.PrivateIpAddress))
+			}
+			if aws.StringValue(addr.PrivateDnsName) != "" && !stringInSlice(result.DnsNames, aws.StringValue(addr.PrivateDnsName)) {
+				result.DnsNames = append(result.DnsNames, aws.StringValue(addr.PrivateDnsName))
+			}
+
+			// Add public address/dns name if they have not been added yet
+			if addr.Association != nil && aws.StringValue(addr.Association.PublicIp) != "" && !stringInSlice(result.IpAddresses, aws.StringValue(addr.Association.PublicIp)) {
+				result.IpAddresses = append(result.IpAddresses, aws.StringValue(addr.Association.PublicIp))
+			}
+			if addr.Association != nil && aws.StringValue(addr.Association.PublicDnsName) != "" && !stringInSlice(result.DnsNames, aws.StringValue(addr.Association.PublicDnsName)) {
+				result.DnsNames = append(result.DnsNames, aws.StringValue(addr.Association.PublicDnsName))
+			}
+		}
+
+		// Add the IPv6 addresses.
+		for _, addr := range iface.Ipv6Addresses {
+			if addr == nil {
+				continue
+			}
+
+			if addr.Ipv6Address != nil && aws.StringValue(addr.Ipv6Address) != "" {
+				result.IpAddresses = append(result.IpAddresses, aws.StringValue(addr.Ipv6Address))
+			}
+		}
+	}
+
+	// Done
+	return result, nil
+}
+
+func stringInSlice(s []string, x string) bool {
+	for _, y := range s {
+		if x == y {
+			return true
+		}
+	}
+
+	return false
+}
@@ -0,0 +1,101 @@
+package host
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/session"
+	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/service/ec2/ec2iface"
+	"github.com/hashicorp/boundary-plugin-aws/internal/credential"
+	pb "github.com/hashicorp/boundary/sdk/pbs/plugin"
+	"google.golang.org/protobuf/types/known/structpb"
+)
+
+var customClient = &http.Client{
+	Transport: &http.Transport{
+		Proxy: http.ProxyFromEnvironment,
+		DialContext: (&net.Dialer{
+			Timeout:   30 * time.Second,
+			KeepAlive: 30 * time.Second,
+			DualStack: true,
+		}).DialContext,
+	},
+}
+
+type ec2APIFunc func(*session.Session, ...*aws.Config) (ec2iface.EC2API, error)
+
+type awsCatalogPersistedStateOption func(s *awsCatalogPersistedState) error
+
+type awsCatalogPersistedState struct {
+	*credential.AwsCredentialPersistedState
+
+	// testEC2APIFunc provides a way to provide a factory for a mock EC2 client
+	testEC2APIFunc ec2APIFunc
+}
+
+func withTestEC2APIFunc(f ec2APIFunc) awsCatalogPersistedStateOption {
+	return func(s *awsCatalogPersistedState) error {
+		if s.testEC2APIFunc != nil {
+			return errors.New("test API function already set")
+		}
+
+		s.testEC2APIFunc = f
+		return nil
+	}
+}
+
+func withCredentials(x *credential.AwsCredentialPersistedState) awsCatalogPersistedStateOption {
+	return func(s *awsCatalogPersistedState) error {
+		if s.AwsCredentialPersistedState != nil {
+			return errors.New("aws credentials already set")
+		}
+
+		s.AwsCredentialPersistedState = x
+		return nil
+	}
+}
+
+func newAwsCatalogPersistedState(opts ...awsCatalogPersistedStateOption) (*awsCatalogPersistedState, error) {
+	s := new(awsCatalogPersistedState)
+	for _, opt := range opts {
+		if err := opt(s); err != nil {
+			return nil, err
+		}
+	}
+	return s, nil
+}
+
+func (s *awsCatalogPersistedState) toProto() (*pb.HostCatalogPersisted, error) {
+	data, err := structpb.NewStruct(s.ToMap())
+	if err != nil {
+		return nil, fmt.Errorf("error converting state to structpb.Struct: %w", err)
+	}
+	return &pb.HostCatalogPersisted{Secrets: data}, nil
+}
+
+// EC2Client returns a configured EC2 client based on the session
+// information stored in the state.
+func (s *awsCatalogPersistedState) EC2Client(region string) (ec2iface.EC2API, error) {
+	sess, err := s.GetSession()
+	if err != nil {
+		return nil, fmt.Errorf("error getting AWS session when fetching EC2 client: %w", err)
+	}
+
+	if s.testEC2APIFunc != nil {
+		return s.testEC2APIFunc(sess, aws.NewConfig().WithRegion(region))
+	}
+
+	cfg := aws.NewConfig()
+	if region != "" {
+		cfg = cfg.WithRegion(region)
+	}
+
+	cfg.HTTPClient = customClient
+
+	return ec2.New(sess, cfg), nil
+}
@@ -0,0 +1,32 @@
+package host
+
+import (
+	"testing"
+
+	"github.com/hashicorp/boundary-plugin-aws/internal/credential"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAwsCatalogPersistedStateEC2Client(t *testing.T) {
+	require := require.New(t)
+	cred, err := credential.NewAwsCredentialPersistedState(
+		credential.WithRegion("us-west-2"),
+		credential.WithAccessKeyId("foobar"),
+		credential.WithSecretAccessKey("barfoo"),
+	)
+	require.NoError(err)
+
+	state, err := newAwsCatalogPersistedState(
+		withCredentials(cred),
+		withTestEC2APIFunc(newTestMockEC2(nil)),
+	)
+	require.NoError(err)
+
+	clientRaw, err := state.EC2Client("us-west-2")
+	require.NoError(err)
+	require.NotNil(clientRaw)
+	client, ok := clientRaw.(*testMockEC2)
+	require.True(ok)
+	require.NotNil(client)
+	require.Equal("us-west-2", client.Region)
+}
@@ -1,49 +1,19 @@
-package plugin
+package host

 import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/session"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/aws/aws-sdk-go/service/ec2/ec2iface"
-	"github.com/aws/aws-sdk-go/service/iam"
-	"github.com/aws/aws-sdk-go/service/iam/iamiface"
-	"github.com/hashicorp/go-secure-stdlib/awsutil"
-	"google.golang.org/protobuf/types/known/structpb"
 )

-const testDescribeInstancesError = "DescribeInstances error"
-
-type testMockIAMState struct {
-	DeleteAccessKeyCalled bool
-}
-
-func (s *testMockIAMState) Reset() {
-	s.DeleteAccessKeyCalled = false
-}
-
-type testMockIAM struct {
-	iamiface.IAMAPI
-
-	State *testMockIAMState
-}
-
-func newTestMockIAM(state *testMockIAMState, opts ...awsutil.MockIAMOption) awsutil.IAMAPIFunc {
-	return func(sess *session.Session) (iamiface.IAMAPI, error) {
-		m := &testMockIAM{
-			State: state,
-		}
-		f := awsutil.NewMockIAM(opts...)
-		var err error
-
-		m.IAMAPI, err = f(sess)
-		return m, err
-	}
-}
-
-func (m *testMockIAM) DeleteAccessKey(input *iam.DeleteAccessKeyInput) (*iam.DeleteAccessKeyOutput, error) {
-	m.State.DeleteAccessKeyCalled = true
-	return m.IAMAPI.DeleteAccessKey(input)
-}
+const (
+	testOptionErr              = "test option error"
+	testGetUserErr             = "test error for GetUser"
+	testGetCallerIdentityErr   = "test error for GetCallerIdentity"
+	testDeleteAccessKeyErr     = "test error for DeleteAccessKey"
+	testDescribeInstancesError = "DescribeInstances error"
+)

 type testMockEC2State struct {
 	DescribeInstancesCalled      bool
@@ -114,15 +84,6 @@ func (m *testMockEC2) DescribeInstances(input *ec2.DescribeInstancesInput) (*ec2
 	return m.DescribeInstancesOutput, nil
 }

-func mustStruct(in map[string]interface{}) *structpb.Struct {
-	out, err := structpb.NewStruct(in)
-	if err != nil {
-		panic(err)
-	}
-
-	return out
-}
-
 type ec2FilterSorter []*ec2.Filter

 func (s ec2FilterSorter) Len() int           { return len(s) }
@@ -0,0 +1,83 @@
+## Getting Started
+
+To create a storage bucket (using default scope created by `boundary dev`):
+
+```
+boundary storage-buckets create \
+ -scope-id p_1234567890 \
+ -name "Example Plugin-Based Storage Bucket" \
+ -description "Description for plugin-based storage bucket" \
+ -plugin-name aws \
+ -bucket-name="session_recording_storage" \
+ -bucket-prefix="foo/bar/zoo" \
+ -worker-filter ‘“aws-access” in “/tags/type”’ \
+ -attr region=REGION \
+ -attr endpoint_url=0.0.0.0 \
+ -secret access_key_id='KEY' \
+ -secret secret_access_key='SECRET'
+```
+
+### Required IAM Privileges
+
+The following IAM privileges, at the very least, are required to be attached to
+a configured IAM user for this provider:
+
+Example policy:
+
+```
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": [
+        "s3:PutObject",
+        "s3:GetObject",
+        "s3:GetObjectAttributes"
+      ],
+      "Effect": "Allow",
+      "Resource": "arn:aws:s3:::session_recording_storage/foo/bar/zoo/*"
+    }
+  ]
+}
+```
+
+* `iam:GetUser`, `iam:CreateAccessKey`, and `iam:DeleteAccessKey`, configured to
+  the IAM user to allow credential rotation. Example policy:
+
+```
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": [
+        "iam:DeleteAccessKey",
+        "iam:GetUser",
+        "iam:CreateAccessKey"
+      ],
+      "Effect": "Allow",
+      "Resource": "arn:aws:iam::123456789012:user/JohnDoe"
+    }
+  ]
+}
+```
+
+### Attributes
+
+The following `attributes` are valid on an AWS storage bucket resource:
+
+- `disable_credential_rotation` (bool): If `true`, credential rotation will not
+  be performed. See the [Credential Rotation](#credential-rotation) section
+  above.
+- `region` (string): The region to configure the storage bucket for.
+- `endpoint-url` (string): The endpoint to configure the storage.
+
+An example of how to utilize the [endpoint attribute](https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html)
+
+### Secrets
+
+The following `secrets` are valid on an AWS storage bucket resource:
+
+- `access_key_id` (string): The access key ID for the IAM user to use with this
+  storage bucket.
+- `secret_access_key` (string): The secret access key for the IAM user to use
+  with this storage bucket.
@@ -0,0 +1,57 @@
+package storage
+
+import (
+	"fmt"
+
+	cred "github.com/hashicorp/boundary-plugin-aws/internal/credential"
+	"github.com/hashicorp/boundary-plugin-aws/internal/errors"
+	"github.com/hashicorp/boundary-plugin-aws/internal/values"
+	"google.golang.org/protobuf/types/known/structpb"
+)
+
+// StorageAttributes is a Go-native representation of the Attributes
+// map.
+type StorageAttributes struct {
+	*cred.CredentialAttributes
+
+	// EndpointUrl is used for configuring how the aws client will resolve requests.
+	EndpointUrl string
+}
+
+func getStorageAttributes(in *structpb.Struct) (*StorageAttributes, error) {
+	unknownFields := values.StructFields(in)
+	badFields := make(map[string]string)
+
+	var err error
+	credAttributes, err := cred.GetCredentialAttributes(in)
+	if err != nil {
+		return nil, err
+	}
+
+	endpointUrl, err := values.GetStringValue(in, ConstAwsEndpointUrl, false)
+	if err != nil {
+		badFields[fmt.Sprintf("attributes.%s", ConstAwsEndpointUrl)] = err.Error()
+	}
+	delete(unknownFields, ConstAwsEndpointUrl)
+
+	for s := range unknownFields {
+		switch s {
+		// Ignore knownFields from CredentialAttributes
+		case cred.ConstRegion:
+			continue
+		case cred.ConstDisableCredentialRotation:
+			continue
+		default:
+			badFields[fmt.Sprintf("attributes.%s", s)] = "unrecognized field"
+		}
+	}
+
+	if len(badFields) > 0 {
+		return nil, errors.InvalidArgumentError("Invalid arguments in storage bucket attributes", badFields)
+	}
+
+	return &StorageAttributes{
+		CredentialAttributes: credAttributes,
+		EndpointUrl:          endpointUrl,
+	}, nil
+}
@@ -0,0 +1,80 @@
+package storage
+
+import (
+	"testing"
+
+	cred "github.com/hashicorp/boundary-plugin-aws/internal/credential"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/structpb"
+)
+
+func TestGetStorageAttributes(t *testing.T) {
+	cases := []struct {
+		name                string
+		in                  map[string]any
+		expected            *StorageAttributes
+		expectedErrContains string
+	}{
+		{
+			name:                "missing region",
+			in:                  map[string]any{},
+			expectedErrContains: "missing required value \"region\"",
+		},
+		{
+			name: "unknown fields",
+			in: map[string]any{
+				"region": "us-west-2",
+				"foo":    true,
+				"bar":    true,
+			},
+			expectedErrContains: "attributes.bar: unrecognized field, attributes.foo: unrecognized field",
+		},
+		{
+			name: "good w/ endpoint",
+			in: map[string]any{
+				cred.ConstRegion:    "us-west-2",
+				ConstAwsEndpointUrl: "0.0.0.0",
+			},
+			expected: &StorageAttributes{
+				CredentialAttributes: &cred.CredentialAttributes{
+					Region: "us-west-2",
+				},
+				EndpointUrl: "0.0.0.0",
+			},
+		},
+		{
+			name: "good w/o endpoint",
+			in: map[string]any{
+				cred.ConstRegion: "us-west-2",
+			},
+			expected: &StorageAttributes{
+				CredentialAttributes: &cred.CredentialAttributes{
+					Region: "us-west-2",
+				},
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			require := require.New(t)
+
+			input, err := structpb.NewStruct(tc.in)
+			require.NoError(err)
+
+			actual, err := getStorageAttributes(input)
+			if tc.expectedErrContains != "" {
+				require.Error(err)
+				require.Contains(err.Error(), tc.expectedErrContains)
+				require.Equal(status.Code(err), codes.InvalidArgument)
+				return
+			}
+
+			require.NoError(err)
+			require.Equal(tc.expected, actual)
+		})
+	}
+}
@@ -0,0 +1,9 @@
+package storage
+
+const (
+	// ConstAwsEndpointUrl is the key for the endpoint url in the aws s3 client.
+	ConstAwsEndpointUrl = "endpoint_url"
+
+	// defaultStreamChunkSize is the recommened chunk size for sending data through a stream
+	defaultStreamChunkSize = 65536 // 64 KiB
+)
@@ -0,0 +1,715 @@
+package storage
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"encoding/base64"
+	"io"
+	"os"
+	"path"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/aws/retry"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/google/uuid"
+	cred "github.com/hashicorp/boundary-plugin-aws/internal/credential"
+	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/storagebuckets"
+	pb "github.com/hashicorp/boundary/sdk/pbs/plugin"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/timestamppb"
+)
+
+// Ensure that we are implementing StoragePluginServiceServer
+var _ pb.StoragePluginServiceServer = (*StoragePlugin)(nil)
+
+// StoragePlugin implements the StoragePluginServiceServer interface for the
+// AWS storage service plugin.
+type StoragePlugin struct {
+	pb.UnimplementedStoragePluginServiceServer
+
+	// testCredStateOpts are passed in to the stored state to control test behavior
+	testCredStateOpts []cred.AwsCredentialPersistedStateOption
+
+	// testStorageStateOpts are passed in to the stored state to control test behavior
+	testStorageStateOpts []awsStoragePersistedStateOption
+}
+
+// OnCreateStorageBucket is called when a storage bucket is created.
+func (p *StoragePlugin) OnCreateStorageBucket(ctx context.Context, req *pb.OnCreateStorageBucketRequest) (*pb.OnCreateStorageBucketResponse, error) {
+	bucket := req.GetBucket()
+	if bucket == nil {
+		return nil, status.Error(codes.InvalidArgument, "bucket is required")
+	}
+	if bucket.BucketName == "" {
+		return nil, status.Error(codes.InvalidArgument, "bucketName is required")
+	}
+
+	secrets := bucket.GetSecrets()
+	if secrets == nil {
+		return nil, status.Error(codes.InvalidArgument, "secrets is required")
+	}
+
+	attrs := bucket.GetAttributes()
+	if attrs == nil {
+		return nil, status.Error(codes.InvalidArgument, "attributes is required")
+	}
+
+	storageAttributes, err := getStorageAttributes(attrs)
+	if err != nil {
+		return nil, err
+	}
+
+	credConfig, err := cred.GetCredentialsConfig(secrets, storageAttributes.Region)
+	if err != nil {
+		return nil, err
+	}
+
+	// Set up the creds in our persisted state.
+	credState, err := cred.NewAwsCredentialPersistedState(
+		append([]cred.AwsCredentialPersistedStateOption{
+			cred.WithAccessKeyId(credConfig.AccessKey),
+			cred.WithSecretAccessKey(credConfig.SecretKey),
+			cred.WithRegion(credConfig.Region),
+		}, p.testCredStateOpts...)...,
+	)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error setting up persisted state: %s", err)
+	}
+
+	// Try to rotate the credentials if we're not skipping them.
+	if !storageAttributes.DisableCredentialRotation {
+		if err := credState.RotateCreds(); err != nil {
+			return nil, status.Errorf(codes.InvalidArgument, "error during credential rotation: %s", err)
+		}
+	} else {
+		// Simply validate if we aren't rotating.
+		if err := credState.ValidateCreds(); err != nil {
+			return nil, status.Errorf(codes.InvalidArgument, "error during credential validation: %s", err)
+		}
+	}
+
+	storageState, err := newAwsStoragePersistedState(
+		append([]awsStoragePersistedStateOption{
+			withCredentials(credState),
+		}, p.testStorageStateOpts...)...,
+	)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error setting up persisted state: %s", err)
+	}
+
+	// perform dry run to ensure we can interact with the bucket as expected.
+	if err := dryRunValidation(ctx, storageState, storageAttributes, bucket); err != nil {
+		return nil, err
+	}
+
+	persistedProto, err := storageState.toProto()
+	if err != nil {
+		return nil, status.Error(codes.InvalidArgument, err.Error())
+	}
+
+	return &pb.OnCreateStorageBucketResponse{
+		Persisted: persistedProto,
+	}, nil
+}
+
+// OnUpdateStorageBucket is called when a storage bucket is updated.
+func (p *StoragePlugin) OnUpdateStorageBucket(ctx context.Context, req *pb.OnUpdateStorageBucketRequest) (*pb.OnUpdateStorageBucketResponse, error) {
+	// For storage buckets we only need to really validate what is
+	// currently in the new copy of the storage bucket data, so skip
+	// fetching the new copy to keep things a little less messy.
+	bucket := req.GetNewBucket()
+	if bucket == nil {
+		return nil, status.Error(codes.InvalidArgument, "new bucket is required")
+	}
+	if bucket.BucketName == "" {
+		return nil, status.Error(codes.InvalidArgument, "new bucketName is required")
+	}
+
+	var updateSecrets bool
+	secrets := bucket.GetSecrets()
+	if secrets != nil {
+		// We will be updating secrets this run, but what exactly that
+		// means will be determined later.
+		updateSecrets = true
+	}
+
+	attrs := bucket.GetAttributes()
+	if attrs == nil {
+		return nil, status.Error(codes.InvalidArgument, "new bucket attributes is required")
+	}
+
+	storageAttributes, err := getStorageAttributes(attrs)
+	if err != nil {
+		return nil, err
+	}
+
+	// Get the persisted data.
+	// NOTE: We might need to change this at a later time. I'm not too
+	// sure *exactly* what scenarios we might encounter that would
+	// ultimately mean that we would have to handle an empty or missing
+	// state in update, but what we are ultimately assuming here
+	// (implicitly through awsStoragePersistedStateFromProto) is that
+	// the state will exist and be populated. Personally I think this
+	// is fine and important, but this may change in the future.
+	credState, err := cred.AwsCredentialPersistedStateFromProto(
+		req.GetPersisted().GetData(),
+		append(p.testCredStateOpts, cred.WithRegion(storageAttributes.Region))...)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error loading persisted state: %s", err)
+	}
+
+	if storageAttributes.DisableCredentialRotation && !updateSecrets {
+		// This is a validate check to make sure that we aren't disabling
+		// rotation for credentials currently being managed by rotation.
+		// This is not allowed.
+		if !credState.CredsLastRotatedTime.IsZero() {
+			return nil, status.Error(codes.FailedPrecondition, "cannot disable rotation for already-rotated credentials")
+		}
+	}
+
+	if updateSecrets {
+		storageSecrets, err := cred.GetCredentialsConfig(secrets, storageAttributes.Region)
+		if err != nil {
+			return nil, err
+		}
+
+		// Replace the credentials. This checks the timestamp on the last
+		// rotation time as well and deletes the credentials if we are
+		// managing them (ie: if we've rotated them before).
+		if err := credState.ReplaceCreds(storageSecrets.AccessKey, storageSecrets.SecretKey); err != nil {
+			return nil, status.Errorf(codes.InvalidArgument, "error attempting to replace credentials: %s", err)
+		}
+	}
+
+	if !storageAttributes.DisableCredentialRotation && credState.CredsLastRotatedTime.IsZero() {
+		// If we're enabling rotation now but didn't before, or have
+		// freshly replaced credentials, we can rotate here.
+		if err := credState.RotateCreds(); err != nil {
+			return nil, status.Errorf(codes.InvalidArgument, "error during credential rotation: %s", err)
+		}
+	}
+
+	storageState, err := newAwsStoragePersistedState(
+		append([]awsStoragePersistedStateOption{
+			withCredentials(credState),
+		}, p.testStorageStateOpts...)...,
+	)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error loading persisted state: %s", err)
+	}
+
+	// perform dry run to ensure we can interact with the bucket as expected.
+	if err := dryRunValidation(ctx, storageState, storageAttributes, bucket); err != nil {
+		return nil, err
+	}
+
+	persistedProto, err := storageState.toProto()
+	if err != nil {
+		return nil, status.Error(codes.InvalidArgument, err.Error())
+	}
+
+	return &pb.OnUpdateStorageBucketResponse{
+		Persisted: persistedProto,
+	}, nil
+}
+
+// OnDeleteStorageBucket is called when a storage bucket is deleted.
+func (p *StoragePlugin) OnDeleteStorageBucket(ctx context.Context, req *pb.OnDeleteStorageBucketRequest) (*pb.OnDeleteStorageBucketResponse, error) {
+	bucket := req.GetBucket()
+	if bucket == nil {
+		return nil, status.Error(codes.InvalidArgument, "bucket is required")
+	}
+
+	attrs := bucket.GetAttributes()
+	if attrs == nil {
+		return nil, status.Error(codes.InvalidArgument, "attributes is required")
+	}
+
+	storageAttributes, err := getStorageAttributes(attrs)
+	if err != nil {
+		return nil, err
+	}
+
+	// Get the persisted data.
+	// NOTE: We return on error here, blocking the delete. This may or
+	// may not be an overzealous approach to maintaining database/state
+	// integrity. May need to be changed at later time if there are
+	// scenarios where we might be deleting things and any secret state
+	// may be corrupt/and or legitimately missing.
+	credState, err := cred.AwsCredentialPersistedStateFromProto(
+		req.GetPersisted().GetData(),
+		append(p.testCredStateOpts, cred.WithRegion(storageAttributes.Region))...)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error loading persisted state: %s", err)
+	}
+
+	_, err = newAwsStoragePersistedState(
+		append([]awsStoragePersistedStateOption{
+			withCredentials(credState),
+		}, p.testStorageStateOpts...)...,
+	)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error loading persisted state: %s", err)
+	}
+
+	if !credState.CredsLastRotatedTime.IsZero() {
+		// Delete old/existing credentials. This is done with the same
+		// credentials to ensure that it has the proper permissions to do
+		// it.
+		if err := credState.DeleteCreds(); err != nil {
+			return nil, status.Errorf(codes.Aborted, "error removing rotated credentials during storage bucket deletion: %s", err)
+		}
+	}
+
+	return &pb.OnDeleteStorageBucketResponse{}, nil
+}
+
+// HeadObject is called to get the metadata of an object.
+func (p *StoragePlugin) HeadObject(ctx context.Context, req *pb.HeadObjectRequest) (*pb.HeadObjectResponse, error) {
+	if req.GetKey() == "" {
+		return nil, status.Error(codes.InvalidArgument, "key is required")
+	}
+
+	bucket := req.GetBucket()
+	if bucket == nil {
+		return nil, status.Error(codes.InvalidArgument, "bucket is required")
+	}
+
+	if bucket.BucketName == "" {
+		return nil, status.Error(codes.InvalidArgument, "bucketName is required")
+	}
+
+	secrets := bucket.GetSecrets()
+	if secrets == nil {
+		return nil, status.Error(codes.InvalidArgument, "secrets is required")
+	}
+
+	attrs := bucket.GetAttributes()
+	if attrs == nil {
+		return nil, status.Error(codes.InvalidArgument, "attributes is required")
+	}
+
+	storageAttributes, err := getStorageAttributes(attrs)
+	if err != nil {
+		return nil, err
+	}
+
+	credConfig, err := cred.GetCredentialsConfig(secrets, storageAttributes.Region)
+	if err != nil {
+		return nil, err
+	}
+
+	// Set up the creds in our persisted state.
+	credState, err := cred.NewAwsCredentialPersistedState(
+		append([]cred.AwsCredentialPersistedStateOption{
+			cred.WithAccessKeyId(credConfig.AccessKey),
+			cred.WithSecretAccessKey(credConfig.SecretKey),
+			cred.WithRegion(credConfig.Region),
+		}, p.testCredStateOpts...)...,
+	)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error setting up persisted state: %s", err)
+	}
+
+	storageState, err := newAwsStoragePersistedState(
+		append([]awsStoragePersistedStateOption{
+			withCredentials(credState),
+		}, p.testStorageStateOpts...)...,
+	)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error setting up persisted state: %s", err)
+	}
+
+	opts := []s3Option{}
+	if storageAttributes.Region != "" {
+		opts = append(opts, WithRegion(storageAttributes.Region))
+	}
+	if storageAttributes.EndpointUrl != "" {
+		opts = append(opts, WithEndpoint(storageAttributes.EndpointUrl))
+	}
+	s3Client, err := storageState.S3Client(ctx, opts...)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error getting S3 client: %s", err)
+	}
+
+	objectKey := path.Join(bucket.GetBucketPrefix(), req.GetKey())
+	resp, err := s3Client.HeadObject(ctx, &s3.HeadObjectInput{
+		Bucket: aws.String(bucket.GetBucketName()),
+		Key:    aws.String(objectKey),
+	})
+	if err != nil {
+		return nil, parseAWSErrCode("error getting head object from s3", err)
+	}
+	return &pb.HeadObjectResponse{
+		ContentLength: resp.ContentLength,
+		LastModified:  timestamppb.New(*resp.LastModified),
+	}, nil
+}
+
+// ValidatePermissions is called to validate the secrets associated with the storage bucket.
+func (p *StoragePlugin) ValidatePermissions(ctx context.Context, req *pb.ValidatePermissionsRequest) (*pb.ValidatePermissionsResponse, error) {
+	bucket := req.GetBucket()
+	if bucket == nil {
+		return nil, status.Error(codes.InvalidArgument, "bucket is required")
+	}
+
+	if bucket.BucketName == "" {
+		return nil, status.Error(codes.InvalidArgument, "bucketName is required")
+	}
+
+	secrets := bucket.GetSecrets()
+	if secrets == nil {
+		return nil, status.Error(codes.InvalidArgument, "secrets is required")
+	}
+
+	attrs := bucket.GetAttributes()
+	if attrs == nil {
+		return nil, status.Error(codes.InvalidArgument, "attributes is required")
+	}
+
+	storageAttributes, err := getStorageAttributes(attrs)
+	if err != nil {
+		return nil, err
+	}
+
+	credConfig, err := cred.GetCredentialsConfig(secrets, storageAttributes.Region)
+	if err != nil {
+		return nil, err
+	}
+
+	// Set up the creds in our persisted state.
+	credState, err := cred.NewAwsCredentialPersistedState(
+		append([]cred.AwsCredentialPersistedStateOption{
+			cred.WithAccessKeyId(credConfig.AccessKey),
+			cred.WithSecretAccessKey(credConfig.SecretKey),
+			cred.WithRegion(credConfig.Region),
+		}, p.testCredStateOpts...)...,
+	)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error setting up persisted state: %s", err)
+	}
+
+	storageState, err := newAwsStoragePersistedState(
+		append([]awsStoragePersistedStateOption{
+			withCredentials(credState),
+		}, p.testStorageStateOpts...)...,
+	)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error setting up persisted state: %s", err)
+	}
+
+	// perform dry run to ensure we can interact with the bucket as expected.
+	if err := dryRunValidation(ctx, storageState, storageAttributes, bucket); err != nil {
+		return nil, err
+	}
+
+	return &pb.ValidatePermissionsResponse{}, nil
+}
+
+// GetObject is called when retrieving objects from an s3 bucket.
+// GetObject is a blocking call until the stream has been recieved in full.
+func (p *StoragePlugin) GetObject(req *pb.GetObjectRequest, stream pb.StoragePluginService_GetObjectServer) error {
+	if req.GetKey() == "" {
+		return status.Error(codes.InvalidArgument, "key is required")
+	}
+
+	bucket := req.GetBucket()
+	if bucket == nil {
+		return status.Error(codes.InvalidArgument, "bucket is required")
+	}
+
+	if bucket.GetBucketName() == "" {
+		return status.Error(codes.InvalidArgument, "bucketName is required")
+	}
+
+	secrets := bucket.GetSecrets()
+	if secrets == nil {
+		return status.Error(codes.InvalidArgument, "secrets is required")
+	}
+
+	attrs := bucket.GetAttributes()
+	if attrs == nil {
+		return status.Error(codes.InvalidArgument, "attributes is required")
+	}
+
+	storageAttributes, err := getStorageAttributes(attrs)
+	if err != nil {
+		return err
+	}
+
+	credConfig, err := cred.GetCredentialsConfig(secrets, storageAttributes.Region)
+	if err != nil {
+		return err
+	}
+
+	// Set up the creds in our persisted state.
+	credState, err := cred.NewAwsCredentialPersistedState(
+		append([]cred.AwsCredentialPersistedStateOption{
+			cred.WithAccessKeyId(credConfig.AccessKey),
+			cred.WithSecretAccessKey(credConfig.SecretKey),
+			cred.WithRegion(credConfig.Region),
+		}, p.testCredStateOpts...)...,
+	)
+	if err != nil {
+		return status.Errorf(codes.InvalidArgument, "error setting up persisted state: %s", err)
+	}
+
+	storageState, err := newAwsStoragePersistedState(
+		append([]awsStoragePersistedStateOption{
+			withCredentials(credState),
+		}, p.testStorageStateOpts...)...,
+	)
+	if err != nil {
+		return status.Errorf(codes.InvalidArgument, "error setting up persisted state: %s", err)
+	}
+
+	opts := []s3Option{}
+	if storageAttributes.Region != "" {
+		opts = append(opts, WithRegion(storageAttributes.Region))
+	}
+	if storageAttributes.EndpointUrl != "" {
+		opts = append(opts, WithEndpoint(storageAttributes.EndpointUrl))
+	}
+	s3Client, err := storageState.S3Client(stream.Context(), opts...)
+	if err != nil {
+		return status.Errorf(codes.InvalidArgument, "error getting S3 client: %s", err)
+	}
+
+	objectKey := path.Join(bucket.GetBucketPrefix(), req.GetKey())
+	resp, err := s3Client.GetObject(stream.Context(), &s3.GetObjectInput{
+		Bucket: aws.String(bucket.GetBucketName()),
+		Key:    aws.String(objectKey),
+	})
+	if err != nil {
+		return parseAWSErrCode("error getting object from s3", err)
+	}
+
+	defer resp.Body.Close()
+	reader := bufio.NewReader(resp.Body)
+	chunkSize := req.GetChunkSize()
+	if chunkSize == 0 {
+		chunkSize = defaultStreamChunkSize
+	}
+	for {
+		buffer := make([]byte, chunkSize)
+		n, err := reader.Read(buffer)
+		if err != nil && err != io.EOF {
+			return status.Errorf(codes.Internal, "error reading chunk from s3: %s", err)
+		}
+		if n > 0 {
+			if err := stream.Send(&pb.GetObjectResponse{
+				FileChunk: buffer[:n],
+			}); err != nil {
+				return status.Errorf(codes.Internal, "error sending chunk to client: %s", err)
+			}
+		}
+		if err == io.EOF {
+			break
+		}
+	}
+
+	return nil
+}
+
+// PutObject is called when putting objects into an s3 bucket.
+func (p *StoragePlugin) PutObject(ctx context.Context, req *pb.PutObjectRequest) (*pb.PutObjectResponse, error) {
+	if req == nil {
+		return nil, status.Errorf(codes.InvalidArgument, "request is required")
+	}
+	if req.GetKey() == "" {
+		return nil, status.Errorf(codes.InvalidArgument, "key is required")
+	}
+	bucket := req.GetBucket()
+	if bucket == nil {
+		return nil, status.Error(codes.InvalidArgument, "bucket is required")
+	}
+	if bucket.GetBucketName() == "" {
+		return nil, status.Error(codes.InvalidArgument, "bucketName is required")
+	}
+	secrets := bucket.GetSecrets()
+	if secrets == nil {
+		return nil, status.Error(codes.InvalidArgument, "secrets is required")
+	}
+	attrs := bucket.GetAttributes()
+	if attrs == nil {
+		return nil, status.Error(codes.InvalidArgument, "attributes is required")
+	}
+	if req.GetPath() == "" {
+		return nil, status.Errorf(codes.InvalidArgument, "path is required")
+	}
+	file, err := os.Open(req.GetPath())
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "failed to open file")
+	}
+	info, err := file.Stat()
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "failed to read file info")
+	}
+	if info.IsDir() {
+		return nil, status.Errorf(codes.InvalidArgument, "path is not a file")
+	}
+	if info.Size() == 0 {
+		return nil, status.Errorf(codes.InvalidArgument, "file is empty")
+	}
+
+	storageAttributes, err := getStorageAttributes(attrs)
+	if err != nil {
+		return nil, err
+	}
+
+	credConfig, err := cred.GetCredentialsConfig(secrets, storageAttributes.Region)
+	if err != nil {
+		return nil, err
+	}
+
+	// Set up the creds in our persisted state.
+	credState, err := cred.NewAwsCredentialPersistedState(
+		append([]cred.AwsCredentialPersistedStateOption{
+			cred.WithAccessKeyId(credConfig.AccessKey),
+			cred.WithSecretAccessKey(credConfig.SecretKey),
+			cred.WithRegion(credConfig.Region),
+		}, p.testCredStateOpts...)...,
+	)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error setting up persisted state: %s", err)
+	}
+
+	storageState, err := newAwsStoragePersistedState(
+		append([]awsStoragePersistedStateOption{
+			withCredentials(credState),
+		}, p.testStorageStateOpts...)...,
+	)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error setting up persisted state: %s", err)
+	}
+
+	opts := []s3Option{}
+	if storageAttributes.Region != "" {
+		opts = append(opts, WithRegion(storageAttributes.Region))
+	}
+	if storageAttributes.EndpointUrl != "" {
+		opts = append(opts, WithEndpoint(storageAttributes.EndpointUrl))
+	}
+	s3Client, err := storageState.S3Client(ctx, opts...)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error getting S3 client: %s", err)
+	}
+
+	hash := sha256.New()
+	if _, err := io.Copy(hash, file); err != nil {
+		return nil, status.Errorf(codes.Internal, "failed to calcualte hash")
+	}
+	checksum := base64.StdEncoding.EncodeToString(hash.Sum(nil))
+
+	_, err = file.Seek(0, io.SeekStart)
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "failed to rewind file pointer")
+	}
+
+	objectKey := path.Join(bucket.GetBucketPrefix(), req.GetKey())
+	resp, err := s3Client.PutObject(ctx, &s3.PutObjectInput{
+		Bucket:            aws.String(bucket.GetBucketName()),
+		Key:               aws.String(objectKey),
+		Body:              file,
+		ChecksumAlgorithm: types.ChecksumAlgorithmSha256,
+		ChecksumSHA256:    aws.String(checksum),
+	})
+	if err != nil {
+		return nil, parseAWSErrCode("error putting object into s3", err)
+	}
+	if resp.ChecksumSHA256 == nil {
+		return nil, status.Errorf(codes.Internal, "missing checksum response from aws")
+	}
+	if checksum != *resp.ChecksumSHA256 {
+		return nil, status.Errorf(codes.Internal, "mismatched checksum")
+	}
+	decodedChecksum, err := base64.StdEncoding.DecodeString(*resp.ChecksumSHA256)
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "failed to decode checksum value from aws")
+	}
+	return &pb.PutObjectResponse{
+		ChecksumSha_256: decodedChecksum,
+	}, nil
+}
+
+// dryRunValidation validates that the IAM role policy attached to the given secrets of the
+// storage bucket has the minimum required permissions needed for this plugin to function
+// as expected. This function will create an object in the s3 bucket to validate it has
+// PutObject permissions. This function will read the same file it had uploaded to validate
+// it has GetObject permissions. This function will read the metadata of the same file it
+// had uploaded to validate it has GetObjectAttributes permissions.
+func dryRunValidation(ctx context.Context, state *awsStoragePersistedState, attrs *StorageAttributes, bucket *storagebuckets.StorageBucket) error {
+	if state == nil {
+		return status.Error(codes.InvalidArgument, "persisted state is required")
+	}
+	if attrs == nil {
+		return status.Error(codes.InvalidArgument, "attributes is required")
+	}
+	if bucket == nil {
+		return status.Error(codes.InvalidArgument, "bucket is required")
+	}
+
+	opts := []s3Option{}
+	if attrs.Region != "" {
+		opts = append(opts, WithRegion(attrs.Region))
+	}
+	if attrs.EndpointUrl != "" {
+		opts = append(opts, WithEndpoint(attrs.EndpointUrl))
+	}
+
+	client, err := state.S3Client(ctx, opts...)
+	if err != nil {
+		return status.Errorf(codes.InvalidArgument, "error getting S3 client: %s", err)
+	}
+
+	objectKey := path.Join(bucket.GetBucketPrefix(), uuid.New().String())
+	if _, err := client.PutObject(ctx, &s3.PutObjectInput{
+		Bucket: aws.String(bucket.GetBucketName()),
+		Key:    aws.String(objectKey),
+		Body:   bytes.NewReader([]byte("hashicorp boundary aws plugin access test")),
+	}); err != nil {
+		return parseAWSErrCode("error failed to put object", err)
+	}
+
+	if _, err := client.GetObject(ctx, &s3.GetObjectInput{
+		Bucket: aws.String(bucket.GetBucketName()),
+		Key:    aws.String(objectKey),
+	}); err != nil {
+		return parseAWSErrCode("error failed to get object", err)
+	}
+
+	if _, err := client.HeadObject(ctx, &s3.HeadObjectInput{
+		Bucket: aws.String(bucket.GetBucketName()),
+		Key:    aws.String(objectKey),
+	}); err != nil {
+		return parseAWSErrCode("error failed to get head object", err)
+	}
+
+	// attempt to delete the test object created for the dry run validation,
+	// this step is allowed to fail because DeleteObject is not a required
+	// operation for the plugin.
+	client.DeleteObject(ctx, &s3.DeleteObjectInput{
+		Bucket: aws.String(bucket.GetBucketName()),
+		Key:    aws.String(objectKey),
+	})
+
+	return nil
+}
+
+// parseAWSErrCode detects if an aws error is a throttle error.
+// If the error is a throttle error, then an Unavailable status code
+// is returned. Otherwise the default status code is an Internal error.
+func parseAWSErrCode(msg string, err error) error {
+	errCode := codes.Internal
+	retryErr := retry.ThrottleErrorCode{
+		Codes: retry.DefaultThrottleErrorCodes,
+	}
+	if retryErr.IsErrorThrottle(err).Bool() {
+		errCode = codes.Unavailable
+	}
+	return status.Errorf(errCode, "%s: %s", msg, err)
+}
@@ -0,0 +1,189 @@
+package storage
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/credentials"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/hashicorp/boundary-plugin-aws/internal/credential"
+	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/storagebuckets"
+	"google.golang.org/protobuf/types/known/structpb"
+)
+
+type S3API interface {
+	DeleteObject(ctx context.Context, params *s3.DeleteObjectInput, optFns ...func(*s3.Options)) (*s3.DeleteObjectOutput, error)
+	GetObject(ctx context.Context, params *s3.GetObjectInput, optFns ...func(*s3.Options)) (*s3.GetObjectOutput, error)
+	HeadObject(ctx context.Context, params *s3.HeadObjectInput, optFns ...func(*s3.Options)) (*s3.HeadObjectOutput, error)
+	PutObject(ctx context.Context, params *s3.PutObjectInput, optFns ...func(*s3.Options)) (*s3.PutObjectOutput, error)
+}
+
+var customClient = &http.Client{
+	Transport: &http.Transport{
+		Proxy: http.ProxyFromEnvironment,
+		DialContext: (&net.Dialer{
+			Timeout:   30 * time.Second,
+			KeepAlive: 30 * time.Second,
+			DualStack: true,
+		}).DialContext,
+	},
+}
+
+type awsStoragePersistedState struct {
+	*credential.AwsCredentialPersistedState
+
+	// testS3APIFunc provides a way to provide a factory for a mock EC2 client
+	testS3APIFunc s3APIFunc
+}
+
+type s3APIFunc func(...aws.Config) (S3API, error)
+
+type awsStoragePersistedStateOption func(s *awsStoragePersistedState) error
+
+func withTestS3APIFunc(f s3APIFunc) awsStoragePersistedStateOption {
+	return func(s *awsStoragePersistedState) error {
+		if s.testS3APIFunc != nil {
+			return errors.New("test API function already set")
+		}
+
+		s.testS3APIFunc = f
+		return nil
+	}
+}
+
+func withCredentials(x *credential.AwsCredentialPersistedState) awsStoragePersistedStateOption {
+	return func(s *awsStoragePersistedState) error {
+		if s.AwsCredentialPersistedState != nil {
+			return errors.New("aws credentials already set")
+		}
+
+		s.AwsCredentialPersistedState = x
+		return nil
+	}
+}
+
+func newAwsStoragePersistedState(opts ...awsStoragePersistedStateOption) (*awsStoragePersistedState, error) {
+	s := new(awsStoragePersistedState)
+	for _, opt := range opts {
+		if err := opt(s); err != nil {
+			return nil, err
+		}
+	}
+	return s, nil
+}
+
+func (s *awsStoragePersistedState) toProto() (*storagebuckets.StorageBucketPersisted, error) {
+
+	data, err := structpb.NewStruct(s.ToMap())
+	if err != nil {
+		return nil, fmt.Errorf("error converting state to structpb.Struct: %w", err)
+	}
+	return &storagebuckets.StorageBucketPersisted{Data: data}, nil
+}
+
+// S3Client returns a configured S3 client based on the session
+// information stored in the state.
+func (s *awsStoragePersistedState) S3Client(ctx context.Context, opt ...s3Option) (S3API, error) {
+	opts, err := getOpts(opt...)
+	if err != nil {
+		return nil, fmt.Errorf("error parsing options when fetching S3 client: %w", err)
+	}
+
+	awsConfigOpts := []func(*config.LoadOptions) error{}
+	sess, err := s.GetSession()
+	if err != nil {
+		return nil, fmt.Errorf("error getting AWS session when fetching S3 client: %w", err)
+	}
+	creds, err := sess.Config.Credentials.Get()
+	if err != nil {
+		return nil, fmt.Errorf("error getting AWS session when fetching S3 client: %w", err)
+	}
+	customCredentials := config.WithCredentialsProvider(
+		credentials.NewStaticCredentialsProvider(creds.AccessKeyID, creds.SecretAccessKey, creds.SessionToken),
+	)
+	awsConfigOpts = append(awsConfigOpts, customCredentials)
+	if sess.Config.Region != nil {
+		awsConfigOpts = append(awsConfigOpts, config.WithRegion(*sess.Config.Region))
+	}
+	if opts.withRegion != "" {
+		awsConfigOpts = append(awsConfigOpts, config.WithRegion(opts.withRegion))
+	}
+	if opts.withEndpoint != "" {
+		customResolver := aws.EndpointResolverWithOptionsFunc(func(service, region string, options ...interface{}) (aws.Endpoint, error) {
+			if service == s3.ServiceID {
+				if opts.withRegion != "" {
+					region = opts.withRegion
+				}
+				return aws.Endpoint{
+					PartitionID:   "aws",
+					URL:           opts.withEndpoint,
+					SigningRegion: region,
+				}, nil
+			}
+			// returning EndpointNotFoundError will allow the service to fallback to it's default resolution
+			return aws.Endpoint{}, &aws.EndpointNotFoundError{}
+		})
+		awsConfigOpts = append(awsConfigOpts, config.WithEndpointResolverWithOptions(customResolver))
+	}
+	cfg, err := config.LoadDefaultConfig(ctx, awsConfigOpts...)
+	if err != nil {
+		return nil, fmt.Errorf("error loading aws configuration when fetching S3 client: %w", err)
+	}
+
+	if s.testS3APIFunc != nil {
+		return s.testS3APIFunc(cfg)
+	}
+
+	cfg.HTTPClient = customClient
+
+	return s3.NewFromConfig(cfg), nil
+}
+
+// getOpts iterates the inbound s3Options and returns a struct
+func getOpts(opt ...s3Option) (s3Options, error) {
+	opts := getDefaultS3Options()
+	for _, o := range opt {
+		if o == nil {
+			continue
+		}
+		if err := o(&opts); err != nil {
+			return s3Options{}, err
+		}
+	}
+	return opts, nil
+}
+
+// s3Option - how s3Options are passed as arguments
+type s3Option func(*s3Options) error
+
+// options = how options are represented
+type s3Options struct {
+	withRegion   string
+	withEndpoint string
+}
+
+func getDefaultS3Options() s3Options {
+	return s3Options{}
+}
+
+// WithRegion contains the region to use
+func WithRegion(with string) s3Option {
+	return func(o *s3Options) error {
+		o.withRegion = with
+		return nil
+	}
+}
+
+// WithEndpoint contains the endpoint to use
+func WithEndpoint(with string) s3Option {
+	return func(o *s3Options) error {
+		o.withEndpoint = with
+		return nil
+	}
+}
@@ -0,0 +1,40 @@
+package storage
+
+import (
+	"context"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/hashicorp/boundary-plugin-aws/internal/credential"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAwsStoragePersistedStateS3Client(t *testing.T) {
+	require := require.New(t)
+	cred, err := credential.NewAwsCredentialPersistedState(
+		credential.WithRegion("us-west-2"),
+		credential.WithAccessKeyId("foobar"),
+		credential.WithSecretAccessKey("barfoo"),
+	)
+	require.NoError(err)
+
+	state, err := newAwsStoragePersistedState(
+		withCredentials(cred),
+		withTestS3APIFunc(newTestMockS3(nil)),
+	)
+	require.NoError(err)
+
+	clientRaw, err := state.S3Client(context.Background(), WithRegion("us-west-2"), WithEndpoint("0.0.0.0"))
+	require.NoError(err)
+	require.NotNil(clientRaw)
+	client, ok := clientRaw.(*testMockS3)
+	require.True(ok)
+	require.NotNil(client)
+	require.Equal("us-west-2", client.Region)
+
+	endpoint, err := client.Endpoint.ResolveEndpoint(s3.ServiceID, client.Region)
+	require.NoError(err)
+	require.Equal("0.0.0.0", endpoint.URL)
+	require.Equal("us-west-2", endpoint.SigningRegion)
+	require.Equal("aws", endpoint.PartitionID)
+}
@@ -0,0 +1,300 @@
+package storage
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go/service/sts"
+	"github.com/hashicorp/boundary-plugin-aws/internal/credential"
+	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/storagebuckets"
+	pb "github.com/hashicorp/boundary/sdk/pbs/plugin"
+	"github.com/hashicorp/go-secure-stdlib/awsutil"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/protobuf/types/known/structpb"
+)
+
+const (
+	testOptionErr            = "test option error"
+	testGetUserErr           = "test error for GetUser"
+	testGetCallerIdentityErr = "test error for GetCallerIdentity"
+	testDeleteAccessKeyErr   = "test error for DeleteAccessKey"
+	testGetObjectErr         = "test error for GetObject"
+	testPutObjectErr         = "test error for PutObject"
+	testHeadObjectErr        = "test error for HeadObject"
+)
+
+// throttleErr is a mocked error used for testing the aws s3 client
+type throttleErr struct{}
+
+func (e *throttleErr) ErrorCode() string {
+	return "ThrottlingException"
+}
+
+func (e *throttleErr) Error() string {
+	return "ThrottlingException"
+}
+
+type testMockS3State struct {
+	GetObjectCalled      bool
+	GetObjectInputParams *s3.GetObjectInput
+
+	PutObjectCalled      bool
+	PutObjectInputParams *s3.PutObjectInput
+	PutObjectBody        []byte
+
+	HeadObjectCalled      bool
+	HeadObjectInputParams *s3.HeadObjectInput
+}
+
+func (s *testMockS3State) Reset() {
+	s.GetObjectCalled = false
+	s.GetObjectInputParams = nil
+	s.PutObjectCalled = false
+	s.PutObjectInputParams = nil
+	s.PutObjectBody = nil
+	s.HeadObjectCalled = false
+	s.HeadObjectInputParams = nil
+}
+
+type testMockS3 struct {
+	S3API
+
+	State    *testMockS3State
+	Region   string
+	Endpoint aws.EndpointResolverWithOptions
+
+	// mocked responses for getObject
+	GetObjectOutput *s3.GetObjectOutput
+	GetObjectErr    error
+
+	// mocked responses for putObject
+	PutObjectOutput *s3.PutObjectOutput
+	PutObjectErr    error
+
+	// mocked responses for headObject
+	HeadObjectOutput *s3.HeadObjectOutput
+	HeadObjectErr    error
+}
+
+type testMockS3Option func(m *testMockS3) error
+
+func testMockS3WithPutObjectOutput(o *s3.PutObjectOutput) testMockS3Option {
+	return func(m *testMockS3) error {
+		m.PutObjectOutput = o
+		return nil
+	}
+}
+
+func testMockS3WithPutObjectError(e error) testMockS3Option {
+	return func(m *testMockS3) error {
+		m.PutObjectErr = e
+		return nil
+	}
+}
+
+func testMockS3WithGetObjectOutput(o *s3.GetObjectOutput) testMockS3Option {
+	return func(m *testMockS3) error {
+		m.GetObjectOutput = o
+		return nil
+	}
+}
+
+func testMockS3WithGetObjectError(e error) testMockS3Option {
+	return func(m *testMockS3) error {
+		m.GetObjectErr = e
+		return nil
+	}
+}
+
+func testMockS3WithHeadObjectOutput(o *s3.HeadObjectOutput) testMockS3Option {
+	return func(m *testMockS3) error {
+		m.HeadObjectOutput = o
+		return nil
+	}
+}
+
+func testMockS3WithHeadObjectError(e error) testMockS3Option {
+	return func(m *testMockS3) error {
+		m.HeadObjectErr = e
+		return nil
+	}
+}
+
+func newTestMockS3(state *testMockS3State, opts ...testMockS3Option) s3APIFunc {
+	return func(cfgs ...aws.Config) (S3API, error) {
+		m := &testMockS3{
+			State: state,
+		}
+
+		for _, opt := range opts {
+			if err := opt(m); err != nil {
+				return nil, err
+			}
+		}
+
+		for _, cfg := range cfgs {
+			// Last region takes precedence
+			if cfg.Region != "" {
+				m.Region = cfg.Region
+			}
+			if cfg.EndpointResolverWithOptions != nil {
+				m.Endpoint = cfg.EndpointResolverWithOptions
+			}
+		}
+
+		return m, nil
+	}
+}
+
+func (m *testMockS3) GetObject(ctx context.Context, params *s3.GetObjectInput, optFns ...func(*s3.Options)) (*s3.GetObjectOutput, error) {
+	if m.State != nil {
+		m.State.GetObjectCalled = true
+		m.State.GetObjectInputParams = params
+	}
+
+	if m.GetObjectErr != nil {
+		return nil, m.GetObjectErr
+	}
+
+	return m.GetObjectOutput, nil
+}
+
+func (m *testMockS3) PutObject(ctx context.Context, params *s3.PutObjectInput, optFns ...func(*s3.Options)) (*s3.PutObjectOutput, error) {
+	if m.State != nil {
+		m.State.PutObjectCalled = true
+		m.State.PutObjectInputParams = params
+	}
+
+	if m.PutObjectErr != nil {
+		return nil, m.PutObjectErr
+	}
+
+	// Reads and Writes on the pipe are matched one to one except when multiple Reads are needed to consume a single Write.
+	// Therefore, we need to read the entire body to ensure that the pipe is not blocked.
+	if params.Body != nil {
+		data, err := io.ReadAll(params.Body)
+		if err != nil {
+			return nil, err
+		}
+		if m.State == nil || m.State.PutObjectBody == nil {
+			return m.PutObjectOutput, nil
+		}
+		if !bytes.Equal(data, m.State.PutObjectBody) {
+			return nil, fmt.Errorf("expected body %q, got %q", m.State.PutObjectBody, data)
+		}
+	}
+
+	return m.PutObjectOutput, nil
+}
+
+func (m *testMockS3) DeleteObject(ctx context.Context, params *s3.DeleteObjectInput, optFns ...func(*s3.Options)) (*s3.DeleteObjectOutput, error) {
+	return &s3.DeleteObjectOutput{}, nil
+}
+
+func (m *testMockS3) HeadObject(ctx context.Context, params *s3.HeadObjectInput, optFns ...func(*s3.Options)) (*s3.HeadObjectOutput, error) {
+	if m.State != nil {
+		m.State.HeadObjectCalled = true
+		m.State.HeadObjectInputParams = params
+	}
+
+	if m.HeadObjectErr != nil {
+		return nil, m.HeadObjectErr
+	}
+
+	return m.HeadObjectOutput, nil
+}
+
+type getObjectStreamMock struct {
+	grpc.ServerStream
+	ctx  context.Context
+	err  error
+	data *pb.GetObjectResponse
+}
+
+func (s *getObjectStreamMock) Context() context.Context {
+	return s.ctx
+}
+
+// Send streams a response message to the client.
+// This function should only be called on the server side.
+func (g *getObjectStreamMock) Send(req *pb.GetObjectResponse) error {
+	if req == nil {
+		return fmt.Errorf(`parameter arg "resp GetObjectResponse" cannot be nil.`)
+	}
+	g.data = req
+	return nil
+}
+
+// Recv streams a response message from the server.
+// This function should only be called on the client side.
+func (g *getObjectStreamMock) Recv() (*pb.GetObjectResponse, error) {
+	if g.data == nil {
+		if g.err != nil {
+			return nil, g.err
+		}
+		return nil, io.EOF
+	}
+	resp := &pb.GetObjectResponse{
+		FileChunk: append([]byte{}, g.data.FileChunk...),
+	}
+	g.data = nil
+	return resp, nil
+}
+
+func newGetObjectStreamMock() *getObjectStreamMock {
+	return &getObjectStreamMock{
+		ctx: context.Background(),
+	}
+}
+
+func createTime(t *testing.T, timestamp string) time.Time {
+	require := require.New(t)
+	testTime, err := time.Parse(time.RFC3339, timestamp)
+	require.NoError(err)
+	return testTime
+}
+
+func deepCopyPutObjectRequest(v *pb.PutObjectRequest) *pb.PutObjectRequest {
+	deepCopy := &pb.PutObjectRequest{
+		Key:  v.Key,
+		Path: v.Path,
+	}
+	if v.Bucket != nil {
+		deepCopy.Bucket = &storagebuckets.StorageBucket{
+			BucketName:   v.Bucket.BucketName,
+			BucketPrefix: v.Bucket.BucketPrefix,
+		}
+		if v.Bucket.Attributes != nil {
+			attrs, _ := structpb.NewStruct(v.Bucket.Attributes.AsMap())
+			deepCopy.Bucket.Attributes = attrs
+		}
+		if v.Bucket.Secrets != nil {
+			secrets, _ := structpb.NewStruct(v.Bucket.Secrets.AsMap())
+			deepCopy.Bucket.Secrets = secrets
+		}
+	}
+	return deepCopy
+}
+
+func validSTSMock() []credential.AwsCredentialPersistedStateOption {
+	return []credential.AwsCredentialPersistedStateOption{
+		credential.WithStateTestOpts([]awsutil.Option{
+			awsutil.WithSTSAPIFunc(
+				awsutil.NewMockSTS(
+					awsutil.WithGetCallerIdentityOutput(&sts.GetCallerIdentityOutput{
+						Account: aws.String("0123456789"),
+						Arn:     aws.String("arn:aws:iam::0123456789:user/test"),
+						UserId:  aws.String("test"),
+					}),
+				),
+			),
+		}),
+	}
+}
@@ -1,14 +0,0 @@
-terraform {
-  required_providers {
-    aws = {
-      source  = "hashicorp/aws"
-      version = "~> 3.0"
-    }
-  }
-}
-
-variable "project_path_tags" {
-  default = {
-    "project_path" = "hashicorp/boundary-plugin-host-aws/test/basic"
-  }
-}
@@ -1,4 +1,7 @@
-package plugin
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package testing

 import (
 	"context"
@@ -9,7 +12,9 @@ import (
 	"time"

 	"github.com/aws/aws-sdk-go/aws/awserr"
-	pluginTesting "github.com/hashicorp/boundary-plugin-host-aws/testing"
+	"github.com/hashicorp/boundary-plugin-aws/internal/credential"
+	"github.com/hashicorp/boundary-plugin-aws/internal/values"
+	"github.com/hashicorp/boundary-plugin-aws/plugin/service/host"
 	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/hostcatalogs"
 	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/hostsets"
 	pb "github.com/hashicorp/boundary/sdk/pbs/plugin"
@@ -38,7 +43,7 @@ func TestPlugin(t *testing.T) {
 	}

 	require := require.New(t)
-	tf, err := pluginTesting.NewTestTerraformer("testdata/basic")
+	tf, err := NewTestTerraformer("testdata/host")
 	require.NoError(err)
 	require.NotNil(tf)

@@ -85,7 +90,7 @@ func TestPlugin(t *testing.T) {
 	// will cause the state to go out of drift above in the sense that
 	// the access key ID/secret access key will no longer be valid. We
 	// will assert this through the returned state.
-	p := new(AwsPlugin)
+	p := new(host.HostPlugin)
 	ctx := context.Background()

 	// ********************
@@ -134,7 +139,7 @@ func TestPlugin(t *testing.T) {
 	// Process the collection of instances and index by expected tag names.
 	expectedTagInstancesMap := make(map[string][]string)
 	for instanceId, instanceTags := range ec2InstanceTags {
-		for tagKey := range instanceTags.(map[string]interface{}) {
+		for tagKey := range instanceTags.(map[string]any) {
 			for _, expectedTag := range expectedTags {
 				if tagKey == expectedTag {
 					expectedTagInstancesMap[tagKey] = append(expectedTagInstancesMap[tagKey], instanceId)
@@ -162,19 +167,19 @@ func TestPlugin(t *testing.T) {
 	}
 }

-func testPluginOnCreateCatalog(ctx context.Context, t *testing.T, p *AwsPlugin, region, accessKeyId, secretAccessKey string, rotate bool) (string, string) {
+func testPluginOnCreateCatalog(ctx context.Context, t *testing.T, p *host.HostPlugin, region, accessKeyId, secretAccessKey string, rotate bool) (string, string) {
 	t.Helper()
 	t.Logf("testing OnCreateCatalog (region=%s, rotate=%t)", region, rotate)
 	require := require.New(t)

-	reqAttrs, err := structpb.NewStruct(map[string]interface{}{
-		constRegion:                    region,
-		constDisableCredentialRotation: !rotate,
+	reqAttrs, err := structpb.NewStruct(map[string]any{
+		credential.ConstRegion:                    region,
+		credential.ConstDisableCredentialRotation: !rotate,
 	})
 	require.NoError(err)
-	reqSecrets, err := structpb.NewStruct(map[string]interface{}{
-		constAccessKeyId:     accessKeyId,
-		constSecretAccessKey: secretAccessKey,
+	reqSecrets, err := structpb.NewStruct(map[string]any{
+		credential.ConstAccessKeyId:     accessKeyId,
+		credential.ConstSecretAccessKey: secretAccessKey,
 	})
 	require.NoError(err)
 	request := &pb.OnCreateCatalogRequest{
@@ -192,7 +197,7 @@ func testPluginOnCreateCatalog(ctx context.Context, t *testing.T, p *AwsPlugin,
 	require.NotNil(persisted)
 	persistedSecrets := persisted.GetSecrets()
 	require.NotNil(persistedSecrets)
-	persistedAccessKeyId, err := getStringValue(persistedSecrets, constAccessKeyId, true)
+	persistedAccessKeyId, err := values.GetStringValue(persistedSecrets, credential.ConstAccessKeyId, true)
 	require.NoError(err)
 	require.NotZero(persistedAccessKeyId)
 	if rotate {
@@ -201,7 +206,7 @@ func testPluginOnCreateCatalog(ctx context.Context, t *testing.T, p *AwsPlugin,
 		require.Equal(accessKeyId, persistedAccessKeyId)
 	}

-	persistedSecretAccessKey, err := getStringValue(persistedSecrets, constSecretAccessKey, true)
+	persistedSecretAccessKey, err := values.GetStringValue(persistedSecrets, credential.ConstSecretAccessKey, true)
 	require.NoError(err)
 	require.NotZero(persistedSecretAccessKey)
 	if rotate {
@@ -210,7 +215,7 @@ func testPluginOnCreateCatalog(ctx context.Context, t *testing.T, p *AwsPlugin,
 		require.Equal(secretAccessKey, persistedSecretAccessKey)
 	}

-	persistedCredsLastRotatedTime, err := getTimeValue(persistedSecrets, constCredsLastRotatedTime)
+	persistedCredsLastRotatedTime, err := values.GetTimeValue(persistedSecrets, credential.ConstCredsLastRotatedTime)
 	require.NoError(err)
 	if rotate {
 		require.NotZero(persistedCredsLastRotatedTime)
@@ -223,7 +228,7 @@ func testPluginOnCreateCatalog(ctx context.Context, t *testing.T, p *AwsPlugin,
 }

 func testPluginOnUpdateCatalog(
-	ctx context.Context, t *testing.T, p *AwsPlugin,
+	ctx context.Context, t *testing.T, p *host.HostPlugin,
 	region, currentAccessKeyId, currentSecretAccessKey, newAccessKeyId, newSecretAccessKey string,
 	rotated, rotate bool,
 ) (string, string) {
@@ -236,28 +241,28 @@ func testPluginOnUpdateCatalog(
 	// timestamps.
 	currentCredsLastRotatedTime := time.Now()

-	reqCurrentAttrs, err := structpb.NewStruct(map[string]interface{}{
-		constRegion:                    region,
-		constDisableCredentialRotation: !rotated,
+	reqCurrentAttrs, err := structpb.NewStruct(map[string]any{
+		credential.ConstRegion:                    region,
+		credential.ConstDisableCredentialRotation: !rotated,
 	})
 	require.NoError(err)
-	reqNewAttrs, err := structpb.NewStruct(map[string]interface{}{
-		constRegion:                    region,
-		constDisableCredentialRotation: !rotate,
+	reqNewAttrs, err := structpb.NewStruct(map[string]any{
+		credential.ConstRegion:                    region,
+		credential.ConstDisableCredentialRotation: !rotate,
 	})
 	require.NoError(err)
 	var reqSecrets *structpb.Struct
 	if newAccessKeyId != "" && newSecretAccessKey != "" {
-		reqSecrets, err = structpb.NewStruct(map[string]interface{}{
-			constAccessKeyId:     newAccessKeyId,
-			constSecretAccessKey: newSecretAccessKey,
+		reqSecrets, err = structpb.NewStruct(map[string]any{
+			credential.ConstAccessKeyId:     newAccessKeyId,
+			credential.ConstSecretAccessKey: newSecretAccessKey,
 		})
 		require.NoError(err)
 	}
-	reqPersistedSecrets, err := structpb.NewStruct(map[string]interface{}{
-		constAccessKeyId:     currentAccessKeyId,
-		constSecretAccessKey: currentSecretAccessKey,
-		constCredsLastRotatedTime: func() string {
+	reqPersistedSecrets, err := structpb.NewStruct(map[string]any{
+		credential.ConstAccessKeyId:     currentAccessKeyId,
+		credential.ConstSecretAccessKey: currentSecretAccessKey,
+		credential.ConstCredsLastRotatedTime: func() string {
 			if rotated {
 				return currentCredsLastRotatedTime.Format(time.RFC3339Nano)
 			}
@@ -292,13 +297,13 @@ func testPluginOnUpdateCatalog(
 	require.NotNil(persistedSecrets)

 	// Complex checks based on the scenarios.
-	persistedAccessKeyId, err := getStringValue(persistedSecrets, constAccessKeyId, true)
+	persistedAccessKeyId, err := values.GetStringValue(persistedSecrets, credential.ConstAccessKeyId, true)
 	require.NoError(err)
 	require.NotZero(persistedAccessKeyId)
-	persistedSecretAccessKey, err := getStringValue(persistedSecrets, constSecretAccessKey, true)
+	persistedSecretAccessKey, err := values.GetStringValue(persistedSecrets, credential.ConstSecretAccessKey, true)
 	require.NoError(err)
 	require.NotZero(persistedSecretAccessKey)
-	persistedCredsLastRotatedTime, err := getTimeValue(persistedSecrets, constCredsLastRotatedTime)
+	persistedCredsLastRotatedTime, err := values.GetTimeValue(persistedSecrets, credential.ConstCredsLastRotatedTime)
 	require.NoError(err)

 	// Our test scenarios are complex due the multi-dimensional nature
@@ -400,25 +405,25 @@ func testPluginOnUpdateCatalog(
 	return persistedAccessKeyId, persistedSecretAccessKey
 }

-func testPluginOnDeleteCatalog(ctx context.Context, t *testing.T, p *AwsPlugin, region, accessKeyId, secretAccessKey string, rotated bool) {
+func testPluginOnDeleteCatalog(ctx context.Context, t *testing.T, p *host.HostPlugin, region, accessKeyId, secretAccessKey string, rotated bool) {
 	t.Helper()
 	t.Logf("testing OnDeleteCatalog (region=%s, rotated=%t)", region, rotated)
 	require := require.New(t)

-	reqAttrs, err := structpb.NewStruct(map[string]interface{}{
-		constRegion:                    region,
-		constDisableCredentialRotation: !rotated,
+	reqAttrs, err := structpb.NewStruct(map[string]any{
+		credential.ConstRegion:                    region,
+		credential.ConstDisableCredentialRotation: !rotated,
 	})
 	require.NoError(err)
-	reqSecrets, err := structpb.NewStruct(map[string]interface{}{
-		constAccessKeyId:     accessKeyId,
-		constSecretAccessKey: secretAccessKey,
+	reqSecrets, err := structpb.NewStruct(map[string]any{
+		credential.ConstAccessKeyId:     accessKeyId,
+		credential.ConstSecretAccessKey: secretAccessKey,
 	})
 	require.NoError(err)
-	reqPersistedSecrets, err := structpb.NewStruct(map[string]interface{}{
-		constAccessKeyId:     accessKeyId,
-		constSecretAccessKey: secretAccessKey,
-		constCredsLastRotatedTime: func() string {
+	reqPersistedSecrets, err := structpb.NewStruct(map[string]any{
+		credential.ConstAccessKeyId:     accessKeyId,
+		credential.ConstSecretAccessKey: secretAccessKey,
+		credential.ConstCredsLastRotatedTime: func() string {
 			if rotated {
 				return time.Now().Format(time.RFC3339Nano)
 			}
@@ -454,23 +459,23 @@ func testPluginOnDeleteCatalog(ctx context.Context, t *testing.T, p *AwsPlugin,
 	}
 }

-func testPluginOnCreateUpdateSet(ctx context.Context, t *testing.T, p *AwsPlugin, region, accessKeyId, secretAccessKey string, tags []string) {
+func testPluginOnCreateUpdateSet(ctx context.Context, t *testing.T, p *host.HostPlugin, region, accessKeyId, secretAccessKey string, tags []string) {
 	t.Helper()
 	t.Logf("testing OnCreateSet (region=%s, tags=%v)", region, tags)
 	require := require.New(t)
-	catalogAttrs, err := structpb.NewStruct(map[string]interface{}{
-		constRegion:                    region,
-		constDisableCredentialRotation: true, // Note that this does nothing in sets, but just noting for tests
+	catalogAttrs, err := structpb.NewStruct(map[string]any{
+		credential.ConstRegion:                    region,
+		credential.ConstDisableCredentialRotation: true, // Note that this does nothing in sets, but just noting for tests
 	})
 	require.NoError(err)
-	setAttrs, err := structpb.NewStruct(map[string]interface{}{
-		constDescribeInstancesFilters: []interface{}{fmt.Sprintf("tag-key=%s", strings.Join(tags, ","))},
+	setAttrs, err := structpb.NewStruct(map[string]any{
+		host.ConstDescribeInstancesFilters: []any{fmt.Sprintf("tag-key=%s", strings.Join(tags, ","))},
 	})
 	require.NoError(err)
-	reqPersistedSecrets, err := structpb.NewStruct(map[string]interface{}{
-		constAccessKeyId:          accessKeyId,
-		constSecretAccessKey:      secretAccessKey,
-		constCredsLastRotatedTime: (time.Time{}).Format(time.RFC3339Nano),
+	reqPersistedSecrets, err := structpb.NewStruct(map[string]any{
+		credential.ConstAccessKeyId:          accessKeyId,
+		credential.ConstSecretAccessKey:      secretAccessKey,
+		credential.ConstCredsLastRotatedTime: (time.Time{}).Format(time.RFC3339Nano),
 	})
 	require.NoError(err)
 	createRequest := &pb.OnCreateSetRequest{
@@ -520,19 +525,19 @@ func testPluginOnCreateUpdateSet(ctx context.Context, t *testing.T, p *AwsPlugin
 	require.NotNil(updateResponse)
 }

-func testPluginListHosts(ctx context.Context, t *testing.T, p *AwsPlugin, region, accessKeyId, secretAccessKey string, tags []string, expected map[string][]string) {
+func testPluginListHosts(ctx context.Context, t *testing.T, p *host.HostPlugin, region, accessKeyId, secretAccessKey string, tags []string, expected map[string][]string) {
 	t.Helper()
 	t.Logf("testing ListHosts (region=%s, tags=%v)", region, tags)
 	require := require.New(t)
-	catalogAttrs, err := structpb.NewStruct(map[string]interface{}{
-		constRegion:                    region,
-		constDisableCredentialRotation: true, // Note that this does nothing in sets, but just noting for tests
+	catalogAttrs, err := structpb.NewStruct(map[string]any{
+		credential.ConstRegion:                    region,
+		credential.ConstDisableCredentialRotation: true, // Note that this does nothing in sets, but just noting for tests
 	})
 	require.NoError(err)
 	sets := make([]*hostsets.HostSet, len(tags))
 	for i, tag := range tags {
-		setAttrs, err := structpb.NewStruct(map[string]interface{}{
-			constDescribeInstancesFilters: []interface{}{fmt.Sprintf("tag-key=%s", tag)},
+		setAttrs, err := structpb.NewStruct(map[string]any{
+			host.ConstDescribeInstancesFilters: []any{fmt.Sprintf("tag-key=%s", tag)},
 		})
 		require.NoError(err)
 		sets[i] = &hostsets.HostSet{
@@ -542,10 +547,10 @@ func testPluginListHosts(ctx context.Context, t *testing.T, p *AwsPlugin, region
 			},
 		}
 	}
-	reqPersistedSecrets, err := structpb.NewStruct(map[string]interface{}{
-		constAccessKeyId:          accessKeyId,
-		constSecretAccessKey:      secretAccessKey,
-		constCredsLastRotatedTime: (time.Time{}).Format(time.RFC3339Nano),
+	reqPersistedSecrets, err := structpb.NewStruct(map[string]any{
+		credential.ConstAccessKeyId:          accessKeyId,
+		credential.ConstSecretAccessKey:      secretAccessKey,
+		credential.ConstCredsLastRotatedTime: (time.Time{}).Format(time.RFC3339Nano),
 	})
 	require.NoError(err)
 	request := &pb.ListHostsRequest{
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "iam_user_prefix" {
  default = "boundary-plugin-host-aws-test-iam-user"
 }
@@ -16,8 +19,6 @@ resource "aws_iam_user" "user" {
  count         = var.iam_user_count
  name          = random_id.aws_iam_user_name[count.index].dec
  force_destroy = true
-
-  tags = var.project_path_tags
 }

 resource "aws_iam_access_key" "user_initial_key" {
@@ -42,8 +43,6 @@ resource "aws_iam_policy" "ec2_describeinstances" {
  ]
 }
 EOF
-
-  tags = var.project_path_tags
 }

 resource "aws_iam_user_policy_attachment" "user_ec2_describeinstances_attachment" {
@@ -72,8 +71,6 @@ resource "aws_iam_policy" "user_self_manage_policy" {
  ]
 }
 EOF
-
-  tags = var.project_path_tags
 }

 resource "aws_iam_user_policy_attachment" "user_self_manage_policy_attachment" {
@@ -98,4 +95,4 @@ output "iam_access_key_ids" {
 output "iam_secret_access_keys" {
  value     = aws_iam_access_key.user_initial_key.*.secret
  sensitive = true
-}
+}
@@ -0,0 +1,11 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 3.0"
+    }
+  }
+}
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 variable "instance_tags" {
  default = [
    {
@@ -40,16 +43,12 @@ data "aws_ami" "ubuntu" {

 resource "aws_vpc" "vpc" {
  cidr_block = "10.0.0.0/16"
-
-  tags = var.project_path_tags
 }

 resource "aws_subnet" "subnet" {
  vpc_id            = aws_vpc.vpc.id
  cidr_block        = aws_vpc.vpc.cidr_block
  availability_zone = data.aws_availability_zones.azs.names[0]
-
-  tags = var.project_path_tags
 }

 resource "aws_instance" "instances" {
@@ -58,7 +57,7 @@ resource "aws_instance" "instances" {
  instance_type = "t3.nano"
  subnet_id     = aws_subnet.subnet.id

-  tags = merge(var.instance_tags[count.index], var.project_path_tags)
+  tags = var.instance_tags[count.index]
 }

 output "instance_ids" {
@@ -75,4 +74,4 @@ output "instance_tags" {
  value = {
    for _, r in aws_instance.instances : r.id => r.tags
  }
-}
+}
@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 resource "random_id" "foo" {
  byte_length = 2
  prefix      = "test-foo"
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package testing

 import (
@@ -105,7 +108,7 @@ func (t *TestTerraformer) Destroy() error {
 //
 // Outputs for the root module are supported only. It's an error to
 // run this when no state exists.
-func (t *TestTerraformer) GetOutput(key string) (interface{}, error) {
+func (t *TestTerraformer) GetOutput(key string) (any, error) {
 	if key == "" {
 		return nil, errors.New("key must not be empty")
 	}
@@ -152,13 +155,13 @@ func (t *TestTerraformer) GetOutputString(key string) (string, error) {

 // GetOutputMap wraps GetOutput and returns the value as a map. It's an
 // error if the return value is actually not a map.
-func (t *TestTerraformer) GetOutputMap(key string) (map[string]interface{}, error) {
+func (t *TestTerraformer) GetOutputMap(key string) (map[string]any, error) {
 	value, err := t.GetOutput(key)
 	if err != nil {
 		return nil, err
 	}

-	m, ok := value.(map[string]interface{})
+	m, ok := value.(map[string]any)
 	if !ok {
 		return nil, fmt.Errorf("expected output value at key %q to be map, got %T", key, value)
 	}
@@ -168,13 +171,13 @@ func (t *TestTerraformer) GetOutputMap(key string) (map[string]interface{}, erro

 // GetOutputSlice wraps GetOutput and returns the value as a slice. It's an
 // error if the return value is actually not a slice.
-func (t *TestTerraformer) GetOutputSlice(key string) ([]interface{}, error) {
+func (t *TestTerraformer) GetOutputSlice(key string) ([]any, error) {
 	value, err := t.GetOutput(key)
 	if err != nil {
 		return nil, err
 	}

-	m, ok := value.([]interface{})
+	m, ok := value.([]any)
 	if !ok {
 		return nil, fmt.Errorf("expected output value at key %q to be slice, got %T", key, value)
 	}
@@ -1,3 +1,6 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 package testing

 import (
Author	SHA1	Message	Date
Louis Ruch	62e885a802	chore: Rename module to drop host element (#24 )	2023-06-02 08:55:14 -07:00
Stan Ryzhov	42629b729e	feat(ci): Update GitHub Actions Runners (#23 )	2023-06-02 11:02:40 -04:00
Louis Ruch	209711f688	chore: Update Boundary SDK tag	2023-06-01 08:36:25 -07:00
Louis Ruch	fbc51dd7d7	chore(deps): Update go.mod of Boundary SDK	2023-05-31 08:27:16 -04:00
Louis Ruch	80213b33b5	chore: Add CODEOWNERS	2023-05-30 21:04:44 -04:00
Louis Ruch	d5c9378340	feat(ci): Update CI to run valid go version	2023-05-30 20:53:47 -04:00
Damian Debkowski	010b9df595	feat(plugin): add support for storage service	2023-05-30 15:26:19 -04:00
Damian DebkowskiandMichael Li	46c53fb94a	refactor: organize plugin to support multiple services (#1 ) Co-authored-by: Michael Li <michael.li@hashicorp.com>	2023-04-30 23:30:08 -07:00
Jeff Mitchell	c441058b3e	Update README.md	2023-04-18 11:54:53 -04:00
Hugo	c235f0a72f	feat(plugin): Support extracting AWS instance name (#21 )	2023-04-17 11:00:12 +01:00
Johan Brandhorst-Satzkorn	adf0c99659	Merge pull request #20 from hashicorp/compliance/add-headers [COMPLIANCE] Add Copyright and License Headers	2023-01-03 16:17:19 -06:00
Johan Brandhorst-Satzkorn	5ba2c938c3	Merge pull request #19 from hashicorp/compliance/add-license [COMPLIANCE] Update MPL-2.0 LICENSE	2023-01-03 16:16:51 -06:00
hashicorp-copywrite[bot]	cef41e852e	[COMPLIANCE] Add Copyright and License Headers	2023-01-03 22:03:42 +00:00
CalebAlbers	dcde8f655d	Add or update MPL 2.0 license	2022-10-11 22:07:30 +00:00