demo unit tests showing the bug

Update github test workflow permissions to read-only (#76 )
Set GITHUB_TOKEN to read-only permission by default
2026-08-04 16:25:54 -07:00 · 2026-07-14 15:31:58 -04:00 · 2026-06-26 16:34:32 +02:00 · 2026-06-24 07:12:41 -07:00 · 2026-05-27 13:12:34 -07:00 · 2026-05-14 14:55:01 -05:00
52 changed files with 3028 additions and 386 deletions
@@ -0,0 +1,11 @@
+## PCI review checklist
+
+<!-- heimdall_github_prtemplate:grc-pci_dss-2024-01-05 -->
+
+- [ ] I have documented a clear reason for, and description of, the change I am making.
+
+- [ ] If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
+
+- [ ] If applicable, I've documented the impact of any changes to security controls.
+
+  Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.
@@ -4,6 +4,8 @@ on:
  - workflow_dispatch
  - push

+permissions: read-all
+
 jobs:
  test:
    runs-on: ubuntu-latest
@@ -10,3 +10,6 @@ plan.tfplan
 *.iprg

 .DS_Store
+
+.env
+.envrc
@@ -1,4 +1,4 @@
-Copyright (c) 2021 HashiCorp, Inc.
+Copyright IBM Corp. 2021, 2026

 Mozilla Public License Version 2.0
 ==================================
@@ -1,68 +1,69 @@
 module github.com/hashicorp/boundary-plugin-aws

-go 1.23.3
+go 1.25.7

 require (
-	github.com/aws/aws-sdk-go-v2 v1.32.5
-	github.com/aws/aws-sdk-go-v2/service/ec2 v1.193.0
-	github.com/aws/aws-sdk-go-v2/service/iam v1.38.1
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.69.0
-	github.com/aws/aws-sdk-go-v2/service/sts v1.33.1
-	github.com/aws/smithy-go v1.22.1
-	github.com/google/go-cmp v0.6.0
+	github.com/aws/aws-sdk-go-v2 v1.41.7
+	github.com/aws/aws-sdk-go-v2/service/ec2 v1.254.0
+	github.com/aws/aws-sdk-go-v2/service/iam v1.47.6
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.101.0
+	github.com/aws/aws-sdk-go-v2/service/sts v1.38.5
+	github.com/aws/smithy-go v1.25.1
+	github.com/google/go-cmp v0.7.0
 	github.com/google/uuid v1.6.0
-	github.com/hashicorp/boundary/sdk v0.0.51
+	github.com/hashicorp/boundary/sdk v0.0.59
 	github.com/hashicorp/go-multierror v1.1.1
-	github.com/hashicorp/go-secure-stdlib/awsutil/v2 v2.1.0
+	github.com/hashicorp/go-secure-stdlib/awsutil/v2 v2.1.2
 	github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0
 	github.com/hashicorp/terraform-json v0.23.0
 	github.com/mitchellh/mapstructure v1.5.0
-	github.com/stretchr/testify v1.10.0
-	google.golang.org/grpc v1.68.0
-	google.golang.org/protobuf v1.36.1
+	github.com/stretchr/testify v1.11.1
+	google.golang.org/grpc v1.79.3
+	google.golang.org/protobuf v1.36.11
 )

 require (
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.7 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.10 // indirect
 	github.com/aws/aws-sdk-go-v2/config v1.28.5 // indirect
 	github.com/aws/aws-sdk-go-v2/credentials v1.17.46 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.20 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.24 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.24 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.24 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.4.5 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.5 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.5 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.15 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.23 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sso v1.24.6 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.5 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/fatih/color v1.15.0 // indirect
+	github.com/fatih/color v1.18.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
-	github.com/hashicorp/eventlogger v0.2.6-0.20231025104552-802587e608f0 // indirect
+	github.com/hashicorp/eventlogger v0.2.11 // indirect
 	github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20231025104552-802587e608f0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-hclog v1.6.3 // indirect
-	github.com/hashicorp/go-kms-wrapping/v2 v2.0.16 // indirect
+	github.com/hashicorp/go-kms-wrapping/v2 v2.0.20 // indirect
 	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
-	github.com/hashicorp/go-sockaddr v1.0.6 // indirect
+	github.com/hashicorp/go-sockaddr v1.0.7 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
 	github.com/hashicorp/go-version v1.7.0 // indirect
-	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-isatty v0.0.19 // indirect
+	github.com/kr/text v0.2.0 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/pointerstructure v1.2.1 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
 	github.com/zclconf/go-cty v1.15.0 // indirect
-	golang.org/x/crypto v0.32.0 // indirect
-	golang.org/x/net v0.34.0 // indirect
-	golang.org/x/sys v0.29.0 // indirect
-	golang.org/x/text v0.21.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20240903143218-8af14fe29dc1 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1 // indirect
+	golang.org/x/crypto v0.48.0 // indirect
+	golang.org/x/net v0.49.0 // indirect
+	golang.org/x/sys v0.41.0 // indirect
+	golang.org/x/text v0.34.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260209200024-4cfbd4190f57 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
@@ -8,109 +8,134 @@ github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew
 github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
 github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI=
 github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
-github.com/aws/aws-sdk-go-v2 v1.32.5 h1:U8vdWJuY7ruAkzaOdD7guwJjD06YSKmnKCJs7s3IkIo=
-github.com/aws/aws-sdk-go-v2 v1.32.5/go.mod h1:P5WJBrYqqbWVaOxgH0X/FYYD47/nooaPOZPlQdmiN2U=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.7 h1:lL7IfaFzngfx0ZwUGOZdsFFnQ5uLvR0hWqqhyE7Q9M8=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.7/go.mod h1:QraP0UcVlQJsmHfioCrveWOC1nbiWUl3ej08h4mXWoc=
+github.com/aws/aws-sdk-go-v2 v1.39.1 h1:fWZhGAwVRK/fAN2tmt7ilH4PPAE11rDj7HytrmbZ2FE=
+github.com/aws/aws-sdk-go-v2 v1.39.1/go.mod h1:sDioUELIUO9Znk23YVmIk86/9DOpkbyyVb1i/gUNFXY=
+github.com/aws/aws-sdk-go-v2 v1.41.7 h1:DWpAJt66FmnnaRIOT/8ASTucrvuDPZASqhhLey6tLY8=
+github.com/aws/aws-sdk-go-v2 v1.41.7/go.mod h1:4LAfZOPHNVNQEckOACQx60Y8pSRjIkNZQz1w92xpMJc=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.1 h1:i8p8P4diljCr60PpJp6qZXNlgX4m2yQFpYk+9ZT+J4E=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.1/go.mod h1:ddqbooRZYNoJ2dsTwOty16rM+/Aqmk/GOXrK8cg7V00=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.10 h1:gx1AwW1Iyk9Z9dD9F4akX5gnN3QZwUB20GGKH/I+Rho=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.10/go.mod h1:qqY157uZoqm5OXq/amuaBJyC9hgBCBQnsaWnPe905GY=
 github.com/aws/aws-sdk-go-v2/config v1.28.5 h1:Za41twdCXbuyyWv9LndXxZZv3QhTG1DinqlFsSuvtI0=
 github.com/aws/aws-sdk-go-v2/config v1.28.5/go.mod h1:4VsPbHP8JdcdUDmbTVgNL/8w9SqOkM5jyY8ljIxLO3o=
 github.com/aws/aws-sdk-go-v2/credentials v1.17.46 h1:AU7RcriIo2lXjUfHFnFKYsLCwgbz1E7Mm95ieIRDNUg=
 github.com/aws/aws-sdk-go-v2/credentials v1.17.46/go.mod h1:1FmYyLGL08KQXQ6mcTlifyFXfJVCNJTVGuQP4m0d/UA=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.20 h1:sDSXIrlsFSFJtWKLQS4PUWRvrT580rrnuLydJrCQ/yA=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.20/go.mod h1:WZ/c+w0ofps+/OUqMwWgnfrgzZH1DZO1RIkktICsqnY=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.24 h1:4usbeaes3yJnCFC7kfeyhkdkPtoRYPa/hTmCqMpKpLI=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.24/go.mod h1:5CI1JemjVwde8m2WG3cz23qHKPOxbpkq0HaoreEgLIY=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.24 h1:N1zsICrQglfzaBnrfM0Ys00860C+QFwu6u/5+LomP+o=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.24/go.mod h1:dCn9HbJ8+K31i8IQ8EWmWj0EiIk0+vKiHNMxTTYveAg=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.8 h1:6bgAZgRyT4RoFWhxS+aoGMFyE0cD1bSzFnEEi4bFPGI=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.8/go.mod h1:KcGkXFVU8U28qS4KvLEcPxytPZPBcRawaH2Pf/0jptE=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23 h1:GpT/TrnBYuE5gan2cZbTtvP+JlHsutdmlV2YfEyNde0=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23/go.mod h1:xYWD6BS9ywC5bS3sz9Xh04whO/hzK2plt2Zkyrp4JuA=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.8 h1:HhJYoES3zOz34yWEpGENqJvRVPqpmJyR3+AFg9ybhdY=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.8/go.mod h1:JnA+hPWeYAVbDssp83tv+ysAG8lTfLVXvSsyKg/7xNA=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23 h1:bpd8vxhlQi2r1hiueOw02f/duEPTMK59Q4QMAoTTtTo=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23/go.mod h1:15DfR2nw+CRHIk0tqNyifu3G1YdAOy68RftkhMDDwYk=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1 h1:VaRN3TlFdd6KxX1x3ILT5ynH6HvKgqdiXoTxAF4HQcQ=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1/go.mod h1:FbtygfRFze9usAadmnGJNc8KsP346kEe+y2/oyhGAGc=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.24 h1:JX70yGKLj25+lMC5Yyh8wBtvB01GDilyRuJvXJ4piD0=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.24/go.mod h1:+Ln60j9SUTD0LEwnhEB0Xhg61DHqplBrbZpLgyjoEHg=
-github.com/aws/aws-sdk-go-v2/service/ec2 v1.193.0 h1:RhSoBFT5/8tTmIseJUXM6INTXTQDF8+0oyxWBnozIms=
-github.com/aws/aws-sdk-go-v2/service/ec2 v1.193.0/go.mod h1:mzj8EEjIHSN2oZRXiw1Dd+uB4HZTl7hC8nBzX9IZMWw=
-github.com/aws/aws-sdk-go-v2/service/iam v1.38.1 h1:hfkzDZHBp9jAT4zcd5mtqckpU4E3Ax0LQaEWWk1VgN8=
-github.com/aws/aws-sdk-go-v2/service/iam v1.38.1/go.mod h1:u36ahDtZcQHGmVm/r+0L1sfKX4fzLEMdCqiKRKkUMVM=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.1 h1:iXtILhvDxB6kPvEXgsDhGaZCSC6LQET5ZHSdJozeI0Y=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.1/go.mod h1:9nu0fVANtYiAePIBh2/pFUSwtJ402hLnp854CNoDOeE=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.4.5 h1:gvZOjQKPxFXy1ft3QnEyXmT+IqneM9QAUWlM3r0mfqw=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.4.5/go.mod h1:DLWnfvIcm9IET/mmjdxeXbBKmTCm0ZB8p1za9BVteM8=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.5 h1:wtpJ4zcwrSbwhECWQoI/g6WM9zqCcSpHDJIWSbMLOu4=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.5/go.mod h1:qu/W9HXQbbQ4+1+JcZp0ZNPV31ym537ZJN+fiS7Ti8E=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.5 h1:P1doBzv5VEg1ONxnJss1Kh5ZG/ewoIE4MQtKKc6Crgg=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.5/go.mod h1:NOP+euMW7W3Ukt28tAxPuoWao4rhhqJD3QEBk7oCg7w=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.69.0 h1:Q2ax8S21clKOnHhhr933xm3JxdJebql+R7aNo7p7GBQ=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.69.0/go.mod h1:ralv4XawHjEMaHOWnTFushl0WRqim/gQWesAMF6hTow=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.8 h1:1/bT9kDdLQzfZ1e6J6hpW+SfNDd6xrV8F3M2CuGyUz8=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.8/go.mod h1:RbdwTONAIi59ej/+1H+QzZORt5bcyAtbrS7FQb2pvz0=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24 h1:OQqn11BtaYv1WLUowvcA30MpzIu8Ti4pcLPIIyoKZrA=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24/go.mod h1:X5ZJyfwVrWA96GzPmUCWFQaEARPR7gCrpq2E92PJwAE=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.254.0 h1:fTLR6dLDTGChAjecRPlVrKeznT0rVdzR4yn9Z68MTGk=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.254.0/go.mod h1:V0jbRy1/IPapnkqgXSwVOFB+u5pnCwd9S+R3pKWULC4=
+github.com/aws/aws-sdk-go-v2/service/iam v1.47.6 h1:EWehQXACWr+6hzfZPwZChlfoVhiUCfLHE0Xh3kAfzWQ=
+github.com/aws/aws-sdk-go-v2/service/iam v1.47.6/go.mod h1:qRXgEBWPIltrWHQwU+HkyBvwh1QgeigFcaCGCIVrWk0=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 h1:oegbebPEMA/1Jny7kvwejowCaHz1FWZAQ94WXFNCyTM=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1/go.mod h1:kemo5Myr9ac0U9JfSjMo9yHLtw+pECEHsFtJ9tqCEI8=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9 h1:FLudkZLt5ci0ozzgkVo8BJGwvqNaZbTWb3UcucAateA=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9/go.mod h1:w7wZ/s9qK7c8g4al+UyoF1Sp/Z45UwMGcqIzLWVQHWk=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.8.8 h1:tIN8MFT1z5STK5kTdOT1TCfMN/bn5fSEnlKsTL8qBOU=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.8.8/go.mod h1:VKS56txtNWjKI8FqD/hliL0BcshyF4ZaLBa1rm2Y+5s=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.15 h1:ieLCO1JxUWuxTZ1cRd0GAaeX7O6cIxnwk7tc1LsQhC4=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.15/go.mod h1:e3IzZvQ3kAWNykvE0Tr0RDZCMFInMvhku3qNpcIQXhM=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.8 h1:M6JI2aGFEzYxsF6CXIuRBnkge9Wf9a2xU39rNeXgu10=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.8/go.mod h1:Fw+MyTwlwjFsSTE31mH211Np+CUslml8mzc0AFEG09s=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23 h1:pbrxO/kuIwgEsOPLkaHu0O+m4fNgLU8B3vxQ+72jTPw=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23/go.mod h1:/CMNUqoj46HpS3MNRDEDIwcgEnrtZlKRaHNaHxIFpNA=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.8 h1:AgYCo1Rb8XChJXA871BXHDNxNWOTAr6V5YdsRIBbgv0=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.8/go.mod h1:Au9dvIGm1Hbqnt29d3VakOCQuN9l0WrkDDTRq8biWS4=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.23 h1:03xatSQO4+AM1lTAbnRg5OK528EUg744nW7F73U8DKw=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.23/go.mod h1:M8l3mwgx5ToK7wot2sBBce/ojzgnPzZXUV445gTSyE8=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.88.2 h1:T7b3qniouutV5Wwa9B1q7gW+Y8s1B3g9RE9qa7zLBIM=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.88.2/go.mod h1:tW9TsLb6t1eaTdBE6LITyJW1m/+DjQPU78Q/jT2FJu8=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.101.0 h1:etqBTKY581iwLL/H/S2sVgk3C9lAsTJFeXWFDsDcWOU=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.101.0/go.mod h1:L2dcoOgS2VSgbPLvpak2NyUPsO1TBN7M45Z4H7DlRc4=
 github.com/aws/aws-sdk-go-v2/service/sso v1.24.6 h1:3zu537oLmsPfDMyjnUS2g+F2vITgy5pB74tHI+JBNoM=
 github.com/aws/aws-sdk-go-v2/service/sso v1.24.6/go.mod h1:WJSZH2ZvepM6t6jwu4w/Z45Eoi75lPN7DcydSRtJg6Y=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.5 h1:K0OQAsDywb0ltlFrZm0JHPY3yZp/S9OaoLU33S7vPS8=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.5/go.mod h1:ORITg+fyuMoeiQFiVGoqB3OydVTLkClw/ljbblMq6Cc=
-github.com/aws/aws-sdk-go-v2/service/sts v1.33.1 h1:6SZUVRQNvExYlMLbHdlKB48x0fLbc2iVROyaNEwBHbU=
-github.com/aws/aws-sdk-go-v2/service/sts v1.33.1/go.mod h1:GqWyYCwLXnlUB1lOAXQyNSPqPLQJvmo8J0DWBzp9mtg=
-github.com/aws/smithy-go v1.22.1 h1:/HPHZQ0g7f4eUeK6HKglFz8uwVfZKgoI25rb/J+dnro=
-github.com/aws/smithy-go v1.22.1/go.mod h1:irrKGvNn1InZwb2d7fkIRNucdfwR8R+Ts3wxYa/cJHg=
+github.com/aws/aws-sdk-go-v2/service/sts v1.38.5 h1:+LVB0xBqEgjQoqr9bGZbRzvg212B0f17JdflleJRNR4=
+github.com/aws/aws-sdk-go-v2/service/sts v1.38.5/go.mod h1:xoaxeqnnUaZjPjaICgIy5B+MHCSb/ZSOn4MvkFNOUA0=
+github.com/aws/smithy-go v1.23.0 h1:8n6I3gXzWJB2DxBDnfxgBaSX6oe0d/t10qGz7OKqMCE=
+github.com/aws/smithy-go v1.23.0/go.mod h1:t1ufH5HMublsJYulve2RKmHDC15xu1f26kHCp/HgceI=
+github.com/aws/smithy-go v1.25.1 h1:J8ERsGSU7d+aCmdQur5Txg6bVoYelvQJgtZehD12GkI=
+github.com/aws/smithy-go v1.25.1/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/bgentry/speakeasy v0.1.0 h1:ByYyxL9InA1OWqxJqqp2A5pYHUrCiAL6K3J+LKSsQkY=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
-github.com/fatih/color v1.15.0 h1:kOqh6YHBtK8aywxGerMG2Eq3H6Qgoqeo13Bk2Mv/nBs=
-github.com/fatih/color v1.15.0/go.mod h1:0h5ZqXfHYED7Bhv2ZJamyIOUej9KtShiJESRwBDUSsw=
-github.com/go-test/deep v1.0.4 h1:u2CU3YKy9I2pmu9pX0eq50wCgjfGIt539SqR7FbHiho=
-github.com/go-test/deep v1.0.4/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
+github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/hashicorp/boundary/sdk v0.0.51 h1:a7XpHNTYaeBXRhJkc8MC0siPtfJELYH/ibjw/0UbJEg=
-github.com/hashicorp/boundary/sdk v0.0.51/go.mod h1:gSrMTppD30IPVsUqs4SwQowu+OlR5/+58draey++SkQ=
+github.com/hashicorp/boundary/sdk v0.0.59 h1:XNniO0rwgihLdF1+4qDHKN3gdta3AU1JteZResCJ8Oc=
+github.com/hashicorp/boundary/sdk v0.0.59/go.mod h1:VYwVGAEaHTzihRXpzKZL6EhWBhll59Iul3PGLVL63ao=
+github.com/hashicorp/cli v1.1.7 h1:/fZJ+hNdwfTSfsxMBa9WWMlfjUZbX8/LnUxgAd7lCVU=
+github.com/hashicorp/cli v1.1.7/go.mod h1:e6Mfpga9OCT1vqzFuoGZiiF/KaG9CbUfO5s3ghU3YgU=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/eventlogger v0.2.6-0.20231025104552-802587e608f0 h1:f9oX8/3zxiQrfrWnBeyjDm4S02GAU02OBtCRoZOUwlo=
-github.com/hashicorp/eventlogger v0.2.6-0.20231025104552-802587e608f0/go.mod h1://CHt6/j+Q2lc0NlUB5af4aS2M0c0aVBg9/JfcpAyhM=
+github.com/hashicorp/eventlogger v0.2.11 h1:lkK8ARM/DrCeL5deH2yVS6p40337dESi+77p9pIfLqo=
+github.com/hashicorp/eventlogger v0.2.11/go.mod h1:Rmc3MEopz7jUnLokZVTWAsXaEP5rqd20ObGS+pcau3U=
 github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20231025104552-802587e608f0 h1:iAb287bq0TaWTnhDYuN/zVqdD2EwanQg9ncVelC60Xc=
 github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20231025104552-802587e608f0/go.mod h1:tMywUTIvdB/FXhwm6HMTt61C8/eODY6gitCHhXtyojg=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
 github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
 github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
-github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.7 h1:gM4OwbF16Cmfxt2QMkoGMQbRTfYFZLvDMPgU3rM3KIo=
-github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.7/go.mod h1:7ZMHVluyqgHgEuTADeDzFNWoA9mnyPfdiK8Tk2Bct1c=
-github.com/hashicorp/go-kms-wrapping/v2 v2.0.16 h1:WZeXfD26QMWYC35at25KgE021SF9L3u9UMHK8fJAdV0=
-github.com/hashicorp/go-kms-wrapping/v2 v2.0.16/go.mod h1:ZiKZctjRTLEppuRwrttWkp71VYMbTTCkazK4xT7U/NQ=
+github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.8 h1:/GIUjn9GkFXMk/8/irRdbdtmx8CcyeyWdVy/E5LvzyA=
+github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.8/go.mod h1:JDc9UOD4EVRDIwPVethJcT5Ibi/Nas6eQDPtA60iwP0=
+github.com/hashicorp/go-kms-wrapping/v2 v2.0.20 h1:afreZ1WJd0WI7v4NsMZ1aL7V/T59sxPuKmQDgGUja20=
+github.com/hashicorp/go-kms-wrapping/v2 v2.0.20/go.mod h1:NeK2Ul15t1zutp/dZzt28XQrGZHosbxE/QLNNfaWObM=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-plugin v1.6.3 h1:xgHB+ZUSYeuJi96WtxEjzi23uh7YQpznjGh0U0UUrwg=
-github.com/hashicorp/go-plugin v1.6.3/go.mod h1:MRobyh+Wc/nYy1V4KAXUiYfzxoYhs7V1mlH1Z7iY2h0=
-github.com/hashicorp/go-secure-stdlib/awsutil/v2 v2.1.0 h1:V3TJFolOHYSDqQLbTUBygXtbX4jKXyBcDoU+KNZE1Ak=
-github.com/hashicorp/go-secure-stdlib/awsutil/v2 v2.1.0/go.mod h1:OeRwM2eWNW62L1Z+8GvoZM5nQJMRWBewHSoo77qmb4Y=
-github.com/hashicorp/go-secure-stdlib/base62 v0.1.1/go.mod h1:EdWO6czbmthiwZ3/PUsDV+UD1D5IRU4ActiaWGwt0Yw=
+github.com/hashicorp/go-plugin v1.7.0 h1:YghfQH/0QmPNc/AZMTFE3ac8fipZyZECHdDPshfk+mA=
+github.com/hashicorp/go-plugin v1.7.0/go.mod h1:BExt6KEaIYx804z8k4gRzRLEvxKVb+kn0NMcihqOqb8=
+github.com/hashicorp/go-secure-stdlib/awsutil/v2 v2.1.2 h1:KlDrZWx/wYpnUcFPB0s9uhPjyNZoeIfhrV2MN/Ly76s=
+github.com/hashicorp/go-secure-stdlib/awsutil/v2 v2.1.2/go.mod h1:6+rVulOPNCQbL3Xv2iLCqM0JmU2WO2wRzP1C6hBKeB8=
 github.com/hashicorp/go-secure-stdlib/base62 v0.1.2 h1:ET4pqyjiGmY09R5y+rSd70J2w45CtbWDNvGqWp/R3Ng=
 github.com/hashicorp/go-secure-stdlib/base62 v0.1.2/go.mod h1:EdWO6czbmthiwZ3/PUsDV+UD1D5IRU4ActiaWGwt0Yw=
-github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.11 h1:uPW2Wn0YlmI9RGSkZpcIplnVRwJ7BCiGpk1vnF2TMw4=
-github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.11/go.mod h1:uis9dCmOzXuOaRyXq+1Foh31kcvXKoWogjNnhfjHfW8=
-github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.9 h1:0S0ctJ7Ra8O7ap+/3fZUnzJ3VzJyirWS/WnNCuOYtZY=
-github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.9/go.mod h1:TNNdgtjLgVDbrgFcyCKrlAicIl3dZF94swJltyGUX2M=
+github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.13 h1:TayxZ5drfMP0G6T++WvnLESGLOWeHtdWDWWTAi2e3Qk=
+github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.13/go.mod h1:NDRQ/F3DXTylqjORAP0cA+puH/JFrLlT+NlqxHK2/e8=
+github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.10 h1:2iDz+t0JLl1W0tJhvmhsh/UBgT1JgC8Qxz8HxYMWXQo=
+github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.10/go.mod h1:eZkXE+osawMrAWR4wJRmyKauUwH6mNGbjFuiDujnbPk=
 github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 h1:U+kC2dOhMFQctRfhK0gRctKAPTloZdMU5ZJxaesJ/VM=
 github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0/go.mod h1:Ll013mhdmsVDuoIXVfBtvgGJsXDYkTw1kooNcoCXuE0=
-github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.6 h1:ZYv2XA+tEfFXIToR2jmBgVqQU9gERt0APbWqmUoNGnY=
-github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.6/go.mod h1:ggFN8dlaLWS2R1gymBbCrvXM/bkZP7hEAa4seqDwhyg=
+github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.8 h1:pgSicufBI+MvaIG9Keykb3k9B3sWtDNjmsoyrl2/8Qw=
+github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.8/go.mod h1:sBcjk+paCXCMR9HHLcrYSfPz2FsskD8MQuotKiyM2aA=
 github.com/hashicorp/go-secure-stdlib/reloadutil v0.1.1 h1:SMGUnbpAcat8rIKHkBPjfv81yC46a8eCNZ2hsR2l1EI=
 github.com/hashicorp/go-secure-stdlib/reloadutil v0.1.1/go.mod h1:Ch/bf00Qnx77MZd49JRgHYqHQjtEmTgGU2faufpVZb0=
-github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4=
 github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.3 h1:xbrxd0U9XQW8qL1BAz2XrAjAF/P2vcqUTAues9c24B8=
 github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.3/go.mod h1:LWq2Sy8UoKKuK4lFuCNWSjJj57MhNNf2zzBWMtkAIX4=
-github.com/hashicorp/go-sockaddr v1.0.6 h1:RSG8rKU28VTUTvEKghe5gIhIQpv8evvNpnDEyqO4u9I=
-github.com/hashicorp/go-sockaddr v1.0.6/go.mod h1:uoUUmtwU7n9Dv3O4SNLeFvg0SxQ3lyjsj6+CCykpaxI=
-github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go-sockaddr v1.0.7 h1:G+pTkSO01HpR5qCxg7lxfsFEZaG+C0VssTy/9dbT+Fw=
+github.com/hashicorp/go-sockaddr v1.0.7/go.mod h1:FZQbEYa1pxkQ7WLpyXJ6cbjpT8q0YgQaK/JakXqGyWw=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-version v1.7.0 h1:5tqGy27NaOTB8yJKUZELlFAS/LTKJkrmONwQKeRZfjY=
@@ -119,33 +144,26 @@ github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/hashicorp/terraform-json v0.23.0 h1:sniCkExU4iKtTADReHzACkk8fnpQXrdD2xoR+lppBkI=
 github.com/hashicorp/terraform-json v0.23.0/go.mod h1:MHdXbBAbSg0GvzuWazEGKAn/cyNfIB7mN6y7KJN6y2c=
-github.com/hashicorp/yamux v0.1.1 h1:yrQxtgseBDrq9Y652vSRDvsKCJKOUD+GzTS4Y0Y8pvE=
-github.com/hashicorp/yamux v0.1.1/go.mod h1:CtWFDAQgb7dxtzFs4tWbplKIe2jSi3+5vKbgIO0SLnQ=
+github.com/hashicorp/yamux v0.1.2 h1:XtB8kyFOyHXYVFnwT5C3+Bdo8gArse7j2AQ0DA0Uey8=
+github.com/hashicorp/yamux v0.1.2/go.mod h1:C+zze2n6e/7wshOZep2A70/aQU6QBRWJO/G6FT1wIns=
 github.com/huandu/xstrings v1.4.0 h1:D17IlohoQq4UcpqD7fDk80P7l+lwAmlFaBHgOipl2FU=
 github.com/huandu/xstrings v1.4.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/imdario/mergo v0.3.13 h1:lFzP57bqS/wsqKssCGmtLAb8A0wKjLGrve2q3PPVcBk=
 github.com/imdario/mergo v0.3.13/go.mod h1:4lJ1jqUDcsbIECGy0RUJAXNIhg+6ocWgb1ALK2O4oXg=
 github.com/jefferai/isbadcipher v0.0.0-20190226160619-51d2077c035f h1:E87tDTVS5W65euzixn7clSzK66puSt1H4I5SC0EmHH4=
 github.com/jefferai/isbadcipher v0.0.0-20190226160619-51d2077c035f/go.mod h1:3J2qVK16Lq8V+wfiL2lPeDZ7UWMxk5LemerHa1p6N00=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
 github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
-github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
-github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
-github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-isatty v0.0.19 h1:JITubQf0MOLdlGRuRq+jtsDlekdYPia9ZFsB8h/APPA=
-github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mitchellh/cli v1.1.5 h1:OxRIeJXpAMztws/XHlN2vu6imG5Dpq+j61AzAX5fLng=
-github.com/mitchellh/cli v1.1.5/go.mod h1:v8+iFts2sPIKUV1ltktPXMCC8fumSKFItNcD2cLtRR4=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
 github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
@@ -161,7 +179,6 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/posener/complete v1.2.3 h1:NP0eAhjcjImqslEwo/1hq7gpajME0fTLTezBKDqfXqo=
 github.com/posener/complete v1.2.3/go.mod h1:WZIdtGGp+qx0sLrYKtIRAruyNpv6hFCicSgv7Sy7s/s=
-github.com/rogpeppe/go-internal v1.6.2/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
 github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
@@ -171,76 +188,51 @@ github.com/shopspring/decimal v1.3.1/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFR
 github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w=
 github.com/spf13/cast v1.5.0/go.mod h1:SpXXQ5YoyJw6s3/6cMTQuxvgRl3PCJiyaX9p6b155UU=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/zclconf/go-cty v1.15.0 h1:tTCRWxsexYUmtt/wVxgDClUe+uQusuI443uL6e+5sXQ=
 github.com/zclconf/go-cty v1.15.0/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
-go.uber.org/goleak v1.0.0/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
-go.uber.org/goleak v1.1.12 h1:gZAh5/EyT/HQwlpkCy6wTpqfH9H8Lz8zbm3dZh+OyzA=
-go.uber.org/goleak v1.1.12/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.32.0 h1:euUpcYgM8WcP71gNpTqQCn6rC2t6ULUPiOzfWaXVVfc=
-golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
-golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.34.0 h1:Mb7Mrk043xzHgnRM88suvJFwzVrRfHEHJEl5/71CKw0=
-golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/otel v1.39.0 h1:8yPrr/S0ND9QEfTfdP9V+SiwT4E0G7Y5MO7p85nis48=
+go.opentelemetry.io/otel v1.39.0/go.mod h1:kLlFTywNWrFyEdH0oj2xK0bFYZtHRYUdv1NklR/tgc8=
+go.opentelemetry.io/otel/metric v1.39.0 h1:d1UzonvEZriVfpNKEVmHXbdf909uGTOQjA0HF0Ls5Q0=
+go.opentelemetry.io/otel/metric v1.39.0/go.mod h1:jrZSWL33sD7bBxg1xjrqyDjnuzTUB0x1nBERXd7Ftcs=
+go.opentelemetry.io/otel/sdk v1.39.0 h1:nMLYcjVsvdui1B/4FRkwjzoRVsMK8uL/cj0OyhKzt18=
+go.opentelemetry.io/otel/sdk v1.39.0/go.mod h1:vDojkC4/jsTJsE+kh+LXYQlbL8CgrEcwmt1ENZszdJE=
+go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2WKg+sEJTtB8=
+go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew=
+go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI=
+go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
+golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
+golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
+golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
 golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.29.0 h1:TPYlXGxvx1MGTn2GiZDhnjPA9wZzZeGKHHmKhHYvgaU=
-golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
-golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20191108193012-7d206e10da11/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20210101214203-2dba1e4ea05c/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/genproto/googleapis/api v0.0.0-20240903143218-8af14fe29dc1 h1:hjSy6tcFQZ171igDaN5QHOw2n6vx40juYbC/x67CEhc=
-google.golang.org/genproto/googleapis/api v0.0.0-20240903143218-8af14fe29dc1/go.mod h1:qpvKtACPCQhAdu3PyQgV4l3LMXZEtft7y8QcarRsp9I=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1 h1:pPJltXNxVzT4pK9yD8vR9X75DaWYYmLGMsEvBfFQZzQ=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1/go.mod h1:UqMtugtsSgubUsoxbuAoiCXvqvErP7Gf0so0mK9tHxU=
-google.golang.org/grpc v1.68.0 h1:aHQeeJbo8zAkAa3pRzrVjZlbz6uSfeOXlJNQM0RAbz0=
-google.golang.org/grpc v1.68.0/go.mod h1:fmSPC5AsjSBCK54MyHRx48kpOti1/jRfOlwEWywNjWA=
-google.golang.org/protobuf v1.36.1 h1:yBPeRvTftaleIgM3PZ/WBIZ7XM/eEYAaEyCwvyjq/gk=
-google.golang.org/protobuf v1.36.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
+golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
+golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
+gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
+gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
+google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57 h1:JLQynH/LBHfCTSbDWl+py8C+Rg/k1OVH3xfcaiANuF0=
+google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57/go.mod h1:kSJwQxqmFXeo79zOmbrALdflXQeAYcUbgS7PbpMknCY=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260209200024-4cfbd4190f57 h1:mWPCjDEyshlQYzBpMNHaEof6UX1PmHcaUODUywQ0uac=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260209200024-4cfbd4190f57/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ=
+google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=
+google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-mvdan.cc/gofumpt v0.1.1/go.mod h1:yXG1r1WqZVKWbVRtBWKWX9+CxGYfA51nSomhM0woR48=
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package credential
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package credential
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package credential
@@ -0,0 +1,172 @@
+// Copyright IBM Corp. 2021, 2026
+// SPDX-License-Identifier: MPL-2.0
+
+package credential
+
+// TestGetCredentialsConfigRoleArnFallback documents all credential input
+// combinations and the CredentialsConfig they produce. The key finding is
+// in the "role_arn + no static keys" case: GetCredentialsConfig succeeds and
+// populates CredentialsConfig.RoleARN, but no STS call is ever made during
+// config construction. At runtime, awsutil.GenerateCredentialChain silently
+// falls back to the ambient credential chain (env vars / instance profile)
+// without calling sts:AssumeRole, so a bogus or unreachable ARN is never
+// detected.
+//
+// Run this test to confirm the root cause:
+//
+//	go test ./internal/credential/... -run TestGetCredentialsConfigRoleArnFallback -v
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/structpb"
+)
+
+func TestGetCredentialsConfigRoleArnFallback(t *testing.T) {
+	cases := []struct {
+		name                string
+		secrets             *structpb.Struct
+		attrs               *CredentialAttributes
+		expectedAccessKey   string
+		expectedSecretKey   string
+		expectedRoleARN     string
+		expectedType        CredentialType
+		expectedErrContains string
+	}{
+		{
+			// NOTE: No role_arn and no static keys. GetCredentialsConfig
+			// succeeds and returns a CredentialsConfig with no credentials set
+			// at all. GetCredentialType returns Unknown because there is no
+			// AccessKey prefix to classify. The AWS SDK will use whatever
+			// ambient credentials it finds at runtime (env vars, instance
+			// profile, etc.).
+			name: "ambient only — no role_arn, no static keys",
+			attrs: &CredentialAttributes{
+				Region:                    "us-east-1",
+				DisableCredentialRotation: true,
+			},
+			expectedAccessKey: "",
+			expectedSecretKey: "",
+			expectedRoleARN:   "",
+			expectedType:      Unknown,
+		},
+		{
+			// NOTE: The normal static-key path. Both keys are provided; no
+			// role_arn. GetCredentialType returns StaticAWS because the
+			// AccessKey starts with "AKIA".
+			name: "static keys only",
+			secrets: &structpb.Struct{
+				Fields: map[string]*structpb.Value{
+					ConstAccessKeyId:     structpb.NewStringValue("AKIAfoobar"),
+					ConstSecretAccessKey: structpb.NewStringValue("bazqux"),
+				},
+			},
+			attrs: &CredentialAttributes{
+				Region:                    "us-east-1",
+				DisableCredentialRotation: true,
+			},
+			expectedAccessKey: "AKIAfoobar",
+			expectedSecretKey: "bazqux",
+			expectedRoleARN:   "",
+			expectedType:      StaticAWS,
+		},
+		{
+			// NOTE: THE BUG SCENARIO. role_arn is set (to a clearly bogus
+			// value) and disable_credential_rotation is true, but no static
+			// keys are provided. GetCredentialsConfig succeeds — the ARN is
+			// stored in CredentialsConfig.RoleARN. GetCredentialType returns
+			// DynamicAWS. However, no sts:AssumeRole call is ever made here
+			// or during GenerateCredentialChain: the awsutil library skips the
+			// assume-role path when AccessKey is empty and falls back to the
+			// ambient credential chain instead. The bogus ARN is never
+			// validated or exercised.
+			name: "role_arn + no static keys (THE BUG SCENARIO)",
+			attrs: &CredentialAttributes{
+				Region:                    "us-east-1",
+				RoleArn:                   "arn:aws:sts::000000000000:assumed-role/fake/whoever",
+				DisableCredentialRotation: true,
+			},
+			expectedAccessKey: "",
+			expectedSecretKey: "",
+			expectedRoleARN:   "arn:aws:sts::000000000000:assumed-role/fake/whoever",
+			expectedType:      DynamicAWS,
+		},
+		{
+			// NOTE: role_arn is set but disable_credential_rotation is false
+			// (the default). This is caught by the validation switch and
+			// returns an explicit error. Validation works correctly here.
+			name: "role_arn without disable_credential_rotation — validation error",
+			attrs: &CredentialAttributes{
+				Region:  "us-east-1",
+				RoleArn: "arn:aws:iam::123456789012:role/MyRole",
+			},
+			expectedErrContains: "disable_credential_rotation attribute is required when providing a role_arn",
+		},
+		{
+			// NOTE: Both role_arn and static keys are provided together. This
+			// is caught by the validation switch and returns an error listing
+			// all three conflicting fields. Validation works correctly here.
+			name: "role_arn + static keys — conflict error",
+			secrets: &structpb.Struct{
+				Fields: map[string]*structpb.Value{
+					ConstAccessKeyId:     structpb.NewStringValue("AKIAfoobar"),
+					ConstSecretAccessKey: structpb.NewStringValue("bazqux"),
+				},
+			},
+			attrs: &CredentialAttributes{
+				Region:  "us-east-1",
+				RoleArn: "arn:aws:iam::123456789012:role/MyRole",
+			},
+			expectedErrContains: "conflicts with role_arn value",
+		},
+		{
+			// NOTE: access_key_id is provided but secret_access_key is
+			// missing. The validation switch catches the incomplete pair.
+			name: "static keys — missing secret_access_key",
+			secrets: &structpb.Struct{
+				Fields: map[string]*structpb.Value{
+					ConstAccessKeyId: structpb.NewStringValue("AKIAfoobar"),
+				},
+			},
+			attrs:               &CredentialAttributes{Region: "us-east-1"},
+			expectedErrContains: "secrets.secret_access_key: missing required value",
+		},
+		{
+			// NOTE: secret_access_key is provided but access_key_id is
+			// missing. The validation switch catches the incomplete pair.
+			name: "static keys — missing access_key_id",
+			secrets: &structpb.Struct{
+				Fields: map[string]*structpb.Value{
+					ConstSecretAccessKey: structpb.NewStringValue("bazqux"),
+				},
+			},
+			attrs:               &CredentialAttributes{Region: "us-east-1"},
+			expectedErrContains: "secrets.access_key_id: missing required value",
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			require := require.New(t)
+
+			cfg, err := GetCredentialsConfig(tc.secrets, tc.attrs, false)
+
+			if tc.expectedErrContains != "" {
+				require.Error(err)
+				require.Contains(err.Error(), tc.expectedErrContains)
+				require.Equal(codes.InvalidArgument, status.Code(err))
+				return
+			}
+
+			require.NoError(err)
+			require.Equal(tc.expectedAccessKey, cfg.AccessKey)
+			require.Equal(tc.expectedSecretKey, cfg.SecretKey)
+			require.Equal(tc.expectedRoleARN, cfg.RoleARN)
+			require.Equal(tc.expectedType, GetCredentialType(cfg),
+				"credential type mismatch — see NOTE above the test case for why this matters")
+		})
+	}
+}
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package credential
@@ -206,13 +206,7 @@ func (s *AwsCredentialPersistedState) DeleteCreds(ctx context.Context) error {

 // GenerateCredentialChain returns a AWS configuration for the credentials in the state.
 func (s *AwsCredentialPersistedState) GenerateCredentialChain(ctx context.Context) (*aws.Config, error) {
-	// Default `WithSharedCredentials` is `true` - This disables the ability to
-	// read credentials from environment variables because we set the default
-	// profile options, so we need to set it to false (see
-	// awsutil@v2.(*CredentialsConfig).generateAwsConfigOptions) for extra
-	// details.
-	opts := append(s.testOpts, awsutil.WithSharedCredentials(false))
-	return s.CredentialsConfig.GenerateCredentialChain(ctx, opts...)
+	return s.CredentialsConfig.GenerateCredentialChain(ctx, s.testOpts...)
 }

 // ToMap returns a map of the credentials stored in the persisted state.
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package credential
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package credential
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package errors
@@ -16,6 +16,7 @@ import (

 	"github.com/aws/aws-sdk-go-v2/aws/retry"
 	awshttp "github.com/aws/aws-sdk-go-v2/aws/transport/http"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	"github.com/aws/smithy-go"
 	pb "github.com/hashicorp/boundary/sdk/pbs/plugin"
 	"google.golang.org/protobuf/types/known/timestamppb"
@@ -52,6 +53,10 @@ const (
 	// whose key does not exist
 	awsErrorNoSuchKey = "NoSuchKey"

+	// NotFound is returned when attempting to interact with an S3 object
+	// whose key does not exist
+	awsErrorNotFound = "NotFound"
+
 	// The InvalidObjectState error is returned when trying to
 	// access an object that was moved into cold storage.
 	awsErrorInvalidObjectState = "InvalidObjectState"
@@ -118,7 +123,50 @@ func ParseAWSError(op string, err error) (st *status.Status, permission *pb.Perm
 		return status.New(codes.Unavailable, statusMsg), nil
 	}

-	// parse some specific aws error codes that we have special cred states for
+	// match error type against NotFound
+	var notFoundErr *types.NotFound
+	if errors.As(err, &notFoundErr) {
+		statusMsg := fmt.Sprintf("aws service %s: %s", serviceName, msg)
+		return status.New(codes.NotFound, statusMsg), nil
+	}
+
+	// match error type against NoSuchkey
+	var noSuchKeyErr *types.NoSuchKey
+	if errors.As(err, &noSuchKeyErr) {
+		statusMsg := fmt.Sprintf("aws service %s: %s", serviceName, msg)
+		return status.New(codes.NotFound, statusMsg), nil
+	}
+
+	// match error type against InvalidObjectState
+	var invalidObjectStateErr *types.InvalidObjectState
+	if errors.As(err, &invalidObjectStateErr) {
+		statusMsg := fmt.Sprintf("aws service %s: %s", serviceName, msg)
+		return status.New(codes.NotFound, statusMsg), nil
+	}
+
+	// match error type against NoSuchBucket
+	var noSuchBucketErr *types.NoSuchBucket
+	if errors.As(err, &noSuchBucketErr) {
+		statusMsg := fmt.Sprintf("aws service %s: %s", serviceName, msg)
+		return status.New(codes.NotFound, statusMsg), &pb.Permission{
+			State:        pb.StateType_STATE_TYPE_ERROR,
+			ErrorDetails: noSuchBucketErr.ErrorMessage(),
+			CheckedAt:    timestamppb.Now(),
+		}
+	}
+
+	// match error type against AccessDenied
+	var accessDeniedErr *types.AccessDenied
+	if errors.As(err, &accessDeniedErr) {
+		statusMsg := fmt.Sprintf("aws service %s: invalid credentials: %s", serviceName, msg)
+		return status.New(codes.PermissionDenied, statusMsg), &pb.Permission{
+			State:        pb.StateType_STATE_TYPE_ERROR,
+			ErrorDetails: accessDeniedErr.ErrorMessage(),
+			CheckedAt:    timestamppb.Now(),
+		}
+	}
+
+	// fallback to evaluating the smithy APIError code
 	var apiErr smithy.APIError
 	if errors.As(err, &apiErr) {
 		switch apiErr.ErrorCode() {
@@ -145,6 +193,8 @@ func ParseAWSError(op string, err error) (st *status.Status, permission *pb.Perm
 			return status.New(codes.Aborted, statusMsg), nil
 		case awsErrorNoSuchKey:
 			fallthrough
+		case awsErrorNotFound:
+			fallthrough
 		case awsErrorInvalidObjectState:
 			statusMsg := fmt.Sprintf("aws service %s: %s", serviceName, msg)
 			return status.New(codes.NotFound, statusMsg), nil
@@ -156,8 +206,9 @@ func ParseAWSError(op string, err error) (st *status.Status, permission *pb.Perm
 		}
 	}

-	// default to evaluating the http status code
-	if httpErr, ok := err.(*awshttp.ResponseError); ok {
+	// fallback to evaluating the http status code
+	var httpErr *awshttp.ResponseError
+	if errors.As(err, &httpErr) {
 		buf := new(bytes.Buffer)
 		_, err = buf.ReadFrom(httpErr.Response.Body)
 		if err != nil {
@@ -206,14 +257,26 @@ func ParseAWSError(op string, err error) (st *status.Status, permission *pb.Perm
 	return st, nil
 }

-// BadRequestStatus returns a status error with an invalid
-// argument code
-func BadRequestStatus(format string, args ...any) error {
+// BadRequestStatusf returns a status error with an invalid
+// argument code and a formatted error message.
+func BadRequestStatusf(format string, args ...any) error {
 	return status.New(codes.InvalidArgument, fmt.Sprintf(format, args...)).Err()
 }

-// UnknownStatus returns a status error with an internal
-// error code
-func UnknownStatus(format string, args ...any) error {
+// BadRequestStatus returns a status error with an invalid
+// argument code and the provided message.
+func BadRequestStatus(msg string) error {
+	return status.New(codes.InvalidArgument, msg).Err()
+}
+
+// UnknownStatusf returns a status error with an internal
+// error code and a formatted error message.
+func UnknownStatusf(format string, args ...any) error {
 	return status.New(codes.Internal, fmt.Sprintf(format, args...)).Err()
 }
+
+// UnknownStatus returns a status error with an internal
+// error code and the provided message.
+func UnknownStatus(msg string) error {
+	return status.New(codes.Internal, msg).Err()
+}
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package errors
@@ -134,6 +134,17 @@ func Test_ParseAWSError(t *testing.T) {
 				State: pb.StateType_STATE_TYPE_UNKNOWN,
 			},
 		},
+		{
+			name:               "wrapped-http-status-code-forbidden",
+			err:                fmt.Errorf("wrap: %w", TestAwsHttpResponseError(http.StatusForbidden, "forbidden request")),
+			expectedStatusCode: codes.PermissionDenied,
+			expectedStatusMsg:  "aws service unknown: invalid credentials: test",
+			expectedPermission: &pb.Permission{
+				State:        pb.StateType_STATE_TYPE_ERROR,
+				ErrorDetails: "forbidden request",
+				CheckedAt:    timestamppb.Now(),
+			},
+		},
 		{
 			name:               "aws-throttling",
 			err:                TestAwsError("Throttling", "throttling error"),
@@ -311,6 +322,55 @@ func Test_ParseAWSError(t *testing.T) {
 				CheckedAt:    timestamppb.Now(),
 			},
 		},
+		{
+			name:               "aws-s3-typed-not-found",
+			err:                TestAwsS3NotFoundError("object was not found"),
+			expectedStatusCode: codes.NotFound,
+			expectedStatusMsg:  "aws service unknown: test",
+			expectedPermission: &pb.Permission{
+				State: pb.StateType_STATE_TYPE_UNKNOWN,
+			},
+		},
+		{
+			name:               "aws-s3-typed-no-such-key",
+			err:                TestAwsS3NoSuchKeyError("key does not exist"),
+			expectedStatusCode: codes.NotFound,
+			expectedStatusMsg:  "aws service unknown: test",
+			expectedPermission: &pb.Permission{
+				State: pb.StateType_STATE_TYPE_UNKNOWN,
+			},
+		},
+		{
+			name:               "aws-s3-typed-invalid-object-state",
+			err:                TestAwsS3InvalidObjectStateError("object is archived"),
+			expectedStatusCode: codes.NotFound,
+			expectedStatusMsg:  "aws service unknown: test",
+			expectedPermission: &pb.Permission{
+				State: pb.StateType_STATE_TYPE_UNKNOWN,
+			},
+		},
+		{
+			name:               "aws-s3-typed-no-such-bucket",
+			err:                TestAwsS3NoSuchBucketError("bucket does not exist"),
+			expectedStatusCode: codes.NotFound,
+			expectedStatusMsg:  "aws service unknown: test",
+			expectedPermission: &pb.Permission{
+				State:        pb.StateType_STATE_TYPE_ERROR,
+				ErrorDetails: "bucket does not exist",
+				CheckedAt:    timestamppb.Now(),
+			},
+		},
+		{
+			name:               "aws-s3-typed-access-denied",
+			err:                TestAwsS3AccessDeniedError("access denied"),
+			expectedStatusCode: codes.PermissionDenied,
+			expectedStatusMsg:  "aws service unknown: invalid credentials: test",
+			expectedPermission: &pb.Permission{
+				State:        pb.StateType_STATE_TYPE_ERROR,
+				ErrorDetails: "access denied",
+				CheckedAt:    timestamppb.Now(),
+			},
+		},
 	}
 	for _, tt := range cases {
 		t.Run(tt.name, func(t *testing.T) {
@@ -330,18 +390,36 @@ func Test_ParseAWSError(t *testing.T) {
 	}
 }

-func Test_BadRequestStatus(t *testing.T) {
+func Test_BadRequestStatusf(t *testing.T) {
 	require, assert := require.New(t), assert.New(t)
-	err := BadRequestStatus("test: %s", "hello world")
+	err := BadRequestStatusf("test: %s", "hello world")
 	assert.ErrorContains(err, "test: hello world")
 	assert.Equal(status.Code(err), codes.InvalidArgument)
 	_, ok := status.FromError(err)
 	require.True(ok)
 }

-func Test_UnknownStatus(t *testing.T) {
+func Test_BadRequestStatus(t *testing.T) {
 	require, assert := require.New(t), assert.New(t)
-	err := UnknownStatus("test: %s", "hello world")
+	err := BadRequestStatus("test: hello world")
+	assert.ErrorContains(err, "test: hello world")
+	assert.Equal(status.Code(err), codes.InvalidArgument)
+	_, ok := status.FromError(err)
+	require.True(ok)
+}
+
+func Test_UnknownStatusf(t *testing.T) {
+	require, assert := require.New(t), assert.New(t)
+	err := UnknownStatusf("test: %s", "hello world")
+	assert.ErrorContains(err, "test: hello world")
+	assert.Equal(status.Code(err), codes.Internal)
+	_, ok := status.FromError(err)
+	require.True(ok)
+}
+
+func Test_UnknownStatus(t *testing.T) {
+	require, assert := require.New(t), assert.New(t)
+	err := UnknownStatusf("test: hello world")
 	assert.ErrorContains(err, "test: hello world")
 	assert.Equal(status.Code(err), codes.Internal)
 	_, ok := status.FromError(err)
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package errors
@@ -9,6 +9,7 @@ import (
 	"strings"

 	awshttp "github.com/aws/aws-sdk-go-v2/aws/transport/http"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	"github.com/aws/smithy-go"
 	smithyhttp "github.com/aws/smithy-go/transport/http"
 	pb "github.com/hashicorp/boundary/sdk/pbs/plugin"
@@ -39,6 +40,31 @@ func TestAwsError(code, msg string) error {
 	}
 }

+// TestAwsS3NotFoundError returns an S3 NotFound error.
+func TestAwsS3NotFoundError(msg string) error {
+	return &types.NotFound{Message: &msg}
+}
+
+// TestAwsS3NoSuchKeyError returns an S3 NoSuchKey error.
+func TestAwsS3NoSuchKeyError(msg string) error {
+	return &types.NoSuchKey{Message: &msg}
+}
+
+// TestAwsS3InvalidObjectStateError returns an S3 InvalidObjectState error.
+func TestAwsS3InvalidObjectStateError(msg string) error {
+	return &types.InvalidObjectState{Message: &msg}
+}
+
+// TestAwsS3NoSuchBucketError returns an S3 NoSuchBucket error.
+func TestAwsS3NoSuchBucketError(msg string) error {
+	return &types.NoSuchBucket{Message: &msg}
+}
+
+// TestAwsS3AccessDeniedError returns an S3 AccessDenied error.
+func TestAwsS3AccessDeniedError(msg string) error {
+	return &types.AccessDenied{Message: &msg}
+}
+
 func CheckSimilarPermission(assert *assert.Assertions, expected, actual *pb.Permission, substituteNilWithDefaultOk bool) {
 	if expected == nil && substituteNilWithDefaultOk {
 		expected = &pb.Permission{
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package values
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package values
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package plugin
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package host
@@ -22,6 +22,11 @@ type CatalogAttributes struct {

 	// DualStack is used for configuring how the aws client will resolve requests.
 	DualStack bool
+
+	// InstanceAddressesOnly specifies whether only the instance addresses (private IPv4/DNS,
+	// public IPv4/DNS, and IPv6) are synced, or all addresses, including those from
+	// secondary ENIs, are synced.
+	InstanceAddressesOnly bool
 }

 func getCatalogAttributes(in *structpb.Struct) (*CatalogAttributes, error) {
@@ -40,6 +45,12 @@ func getCatalogAttributes(in *structpb.Struct) (*CatalogAttributes, error) {
 	}
 	delete(unknownFields, ConstAwsDualStack)

+	instanceAddressesOnly, err := values.GetBoolValue(in, ConstInstanceAddressesOnly, false)
+	if err != nil {
+		badFields[fmt.Sprintf("attributes.%s", ConstInstanceAddressesOnly)] = err.Error()
+	}
+	delete(unknownFields, ConstInstanceAddressesOnly)
+
 	for s := range unknownFields {
 		switch s {
 		// Ignore knownFields from CredentialAttributes
@@ -65,8 +76,9 @@ func getCatalogAttributes(in *structpb.Struct) (*CatalogAttributes, error) {
 	}

 	return &CatalogAttributes{
-		CredentialAttributes: credAttributes,
-		DualStack:            dualStack,
+		CredentialAttributes:  credAttributes,
+		DualStack:             dualStack,
+		InstanceAddressesOnly: instanceAddressesOnly,
 	}, nil
 }

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package host
@@ -59,6 +59,22 @@ func TestGetCatalogAttributes(t *testing.T) {
 				DualStack: true,
 			},
 		},
+		{
+			name: "withInstanceAddressesOnly",
+			in: &structpb.Struct{
+				Fields: map[string]*structpb.Value{
+					"region":                  structpb.NewStringValue("us-west-2"),
+					"instance_addresses_only": structpb.NewBoolValue(true),
+				},
+			},
+			expected: &CatalogAttributes{
+				CredentialAttributes: &credential.CredentialAttributes{
+					Region:                    "us-west-2",
+					DisableCredentialRotation: false,
+				},
+				InstanceAddressesOnly: true,
+			},
+		},
 		{
 			name: "default",
 			in: &structpb.Struct{
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package host
@@ -13,4 +13,9 @@ const (

 	// ConstAwsDualStack is the key for the dualstack flag in the aws s3 client.
 	ConstAwsDualStack = "dual_stack"
+
+	// ConstInstanceAddressesOnly is the key (instance_addresses_only) that specifies whether
+	// only the instance addresses (private IPv4/DNS, public IPv4/DNS, and IPv6) are synced,
+	// or all addresses, including those from secondary ENIs, are synced.
+	ConstInstanceAddressesOnly = "instance_addresses_only"
 )
@@ -1,6 +1,6 @@
 package host

-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 import (
@@ -63,7 +63,7 @@ func (p *HostPlugin) OnCreateCatalog(ctx context.Context, req *pb.OnCreateCatalo
 		}, p.testCredStateOpts...)...,
 	)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error setting up persisted state: %s", err)
+		return nil, errors.BadRequestStatusf("error setting up persisted state: %s", err)
 	}

 	// Try to rotate AWS static credentials
@@ -79,7 +79,7 @@ func (p *HostPlugin) OnCreateCatalog(ctx context.Context, req *pb.OnCreateCatalo
 		}, p.testCatalogStateOpts...)...,
 	)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error setting up persisted state: %s", err)
+		return nil, errors.BadRequestStatusf("error setting up persisted state: %s", err)
 	}

 	// perform dry run to ensure we can interact with AWS as expected.
@@ -93,7 +93,7 @@ func (p *HostPlugin) OnCreateCatalog(ctx context.Context, req *pb.OnCreateCatalo

 	persistedProto, err := catalogState.toProto()
 	if err != nil {
-		return nil, errors.BadRequestStatus(err.Error())
+		return nil, errors.BadRequestStatusf("error converting persisted state to proto: %s", err)
 	}

 	return &pb.OnCreateCatalogResponse{
@@ -138,7 +138,7 @@ func (p *HostPlugin) OnUpdateCatalog(ctx context.Context, req *pb.OnUpdateCatalo
 		oldCatalogAttributes.DualStack,
 		p.testCredStateOpts...)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error loading persisted state: %s", err)
+		return nil, errors.BadRequestStatusf("error loading persisted state: %s", err)
 	}

 	// Verify the incoming credentials are valid and return any errors to the
@@ -161,7 +161,7 @@ func (p *HostPlugin) OnUpdateCatalog(ctx context.Context, req *pb.OnUpdateCatalo
 			}, p.testCredStateOpts...)...,
 		)
 		if err != nil {
-			return nil, errors.BadRequestStatus("error setting up new credential persisted state: %s", err)
+			return nil, errors.BadRequestStatusf("error setting up new credential persisted state: %s", err)
 		}
 		newCatalogState, err := newAwsCatalogPersistedState(
 			append([]awsCatalogPersistedStateOption{
@@ -169,7 +169,7 @@ func (p *HostPlugin) OnUpdateCatalog(ctx context.Context, req *pb.OnUpdateCatalo
 			}, p.testCatalogStateOpts...)...,
 		)
 		if err != nil {
-			return nil, errors.BadRequestStatus("error loading persisted state: %s", err)
+			return nil, errors.BadRequestStatusf("error loading persisted state: %s", err)
 		}
 		opts := []ec2Option{}
 		if newCatalogAttributes.DualStack {
@@ -213,7 +213,7 @@ func (p *HostPlugin) OnUpdateCatalog(ctx context.Context, req *pb.OnUpdateCatalo
 		}, p.testCatalogStateOpts...)...,
 	)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error loading persisted state: %s", err)
+		return nil, errors.BadRequestStatusf("error loading persisted state: %s", err)
 	}

 	// perform dry run to ensure we can interact with AWS as expected.
@@ -227,7 +227,7 @@ func (p *HostPlugin) OnUpdateCatalog(ctx context.Context, req *pb.OnUpdateCatalo

 	persistedProto, err := catalogState.toProto()
 	if err != nil {
-		return nil, errors.BadRequestStatus(err.Error())
+		return nil, errors.BadRequestStatusf("error converting persisted state to proto: %s", err)
 	}

 	return &pb.OnUpdateCatalogResponse{
@@ -264,7 +264,7 @@ func (p *HostPlugin) OnDeleteCatalog(ctx context.Context, req *pb.OnDeleteCatalo
 		catalogAttributes.DualStack,
 		p.testCredStateOpts...)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error loading persisted state: %s", err)
+		return nil, errors.BadRequestStatusf("error loading persisted state: %s", err)
 	}

 	_, err = newAwsCatalogPersistedState(
@@ -273,7 +273,7 @@ func (p *HostPlugin) OnDeleteCatalog(ctx context.Context, req *pb.OnDeleteCatalo
 		}, p.testCatalogStateOpts...)...,
 	)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error loading persisted state: %s", err)
+		return nil, errors.BadRequestStatusf("error loading persisted state: %s", err)
 	}

 	// try to delete static credentials
@@ -341,7 +341,7 @@ func (p *HostPlugin) OnCreateSet(ctx context.Context, req *pb.OnCreateSetRequest
 		catalogAttributes.DualStack,
 		p.testCredStateOpts...)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error loading persisted state: %s", err)
+		return nil, errors.BadRequestStatusf("error loading persisted state: %s", err)
 	}

 	catalogState, err := newAwsCatalogPersistedState(
@@ -350,7 +350,7 @@ func (p *HostPlugin) OnCreateSet(ctx context.Context, req *pb.OnCreateSetRequest
 		}, p.testCatalogStateOpts...)...,
 	)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error loading persisted state: %s", err)
+		return nil, errors.BadRequestStatusf("error loading persisted state: %s", err)
 	}

 	set := req.GetSet()
@@ -368,7 +368,7 @@ func (p *HostPlugin) OnCreateSet(ctx context.Context, req *pb.OnCreateSetRequest

 	describeInstanceFilters, err := buildFilters(setAttrs)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error building set filters: %s", err)
+		return nil, errors.BadRequestStatusf("error building set filters: %s", err)
 	}

 	opts := []ec2Option{}
@@ -404,7 +404,7 @@ func (p *HostPlugin) OnUpdateSet(ctx context.Context, req *pb.OnUpdateSetRequest
 		catalogAttributes.DualStack,
 		p.testCredStateOpts...)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error loading persisted state: %s", err)
+		return nil, errors.BadRequestStatusf("error loading persisted state: %s", err)
 	}

 	catalogState, err := newAwsCatalogPersistedState(
@@ -413,7 +413,7 @@ func (p *HostPlugin) OnUpdateSet(ctx context.Context, req *pb.OnUpdateSetRequest
 		}, p.testCatalogStateOpts...)...,
 	)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error loading persisted state: %s", err)
+		return nil, errors.BadRequestStatusf("error loading persisted state: %s", err)
 	}

 	// As with catalog, we don't need to really look at the old host
@@ -433,7 +433,7 @@ func (p *HostPlugin) OnUpdateSet(ctx context.Context, req *pb.OnUpdateSetRequest

 	describeInstanceFilters, err := buildFilters(setAttrs)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error building set filters: %s", err)
+		return nil, errors.BadRequestStatusf("error building set filters: %s", err)
 	}

 	opts := []ec2Option{}
@@ -477,7 +477,7 @@ func (p *HostPlugin) ListHosts(ctx context.Context, req *pb.ListHostsRequest) (*
 		catalogAttributes.DualStack,
 		p.testCredStateOpts...)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error loading persisted state: %s", err)
+		return nil, errors.BadRequestStatusf("error loading persisted state: %s", err)
 	}

 	catalogState, err := newAwsCatalogPersistedState(
@@ -486,7 +486,7 @@ func (p *HostPlugin) ListHosts(ctx context.Context, req *pb.ListHostsRequest) (*
 		}, p.testCatalogStateOpts...)...,
 	)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error loading persisted state: %s", err)
+		return nil, errors.BadRequestStatusf("error loading persisted state: %s", err)
 	}

 	sets := req.GetSets()
@@ -510,7 +510,7 @@ func (p *HostPlugin) ListHosts(ctx context.Context, req *pb.ListHostsRequest) (*
 		}

 		if set.GetAttributes() == nil {
-			return nil, errors.BadRequestStatus("set %s attributes are required", set.GetId())
+			return nil, errors.BadRequestStatusf("set %s attributes are required", set.GetId())
 		}
 		setAttrs, err := getSetAttributes(set.GetAttributes())
 		if err != nil {
@@ -519,7 +519,7 @@ func (p *HostPlugin) ListHosts(ctx context.Context, req *pb.ListHostsRequest) (*

 		input, err := buildDescribeInstancesInput(setAttrs, false)
 		if err != nil {
-			return nil, errors.BadRequestStatus("error building DescribeInstances parameters for host set id %q: %s", set.GetId(), err)
+			return nil, errors.BadRequestStatusf("error building DescribeInstances parameters for host set id %q: %s", set.GetId(), err)
 		}
 		queries[i] = hostSetQuery{
 			Id:    set.GetId(),
@@ -533,7 +533,7 @@ func (p *HostPlugin) ListHosts(ctx context.Context, req *pb.ListHostsRequest) (*
 	}
 	ec2Client, err := catalogState.EC2Client(ctx, opts...)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error getting EC2 client: %s", err)
+		return nil, errors.BadRequestStatusf("error getting EC2 client: %s", err)
 	}

 	// Run all queries now and assemble output.
@@ -541,7 +541,7 @@ func (p *HostPlugin) ListHosts(ctx context.Context, req *pb.ListHostsRequest) (*
 	for i, query := range queries {
 		output, err := ec2Client.DescribeInstances(ctx, query.Input)
 		if err != nil {
-			return nil, errors.BadRequestStatus("error running DescribeInstances for host set id %q: %s", query.Id, err)
+			return nil, errors.BadRequestStatusf("error running DescribeInstances for host set id %q: %s", query.Id, err)
 		}

 		queries[i].Output = output
@@ -550,9 +550,9 @@ func (p *HostPlugin) ListHosts(ctx context.Context, req *pb.ListHostsRequest) (*
 		// set of hosts afterwards (possibly removing duplicates).
 		for _, reservation := range output.Reservations {
 			for _, instance := range reservation.Instances {
-				host, err := awsInstanceToHost(instance)
+				host, err := awsInstanceToHost(instance, catalogAttributes)
 				if err != nil {
-					return nil, errors.BadRequestStatus("error processing host results for host set id %q: %s", query.Id, err)
+					return nil, errors.BadRequestStatusf("error processing host results for host set id %q: %s", query.Id, err)
 				}

 				queries[i].OutputHosts = append(queries[i].OutputHosts, host)
@@ -648,10 +648,13 @@ func buildDescribeInstancesInput(attrs *SetAttributes, dryRun bool) (*ec2.Descri
 // awsInstanceToHost processes data from an ec2.Instance and returns
 // a ListHostsResponseHost with the ID and network addresses
 // populated.
-func awsInstanceToHost(instance types.Instance) (*pb.ListHostsResponseHost, error) {
+func awsInstanceToHost(instance types.Instance, catalogAttributes *CatalogAttributes) (*pb.ListHostsResponseHost, error) {
 	if aws.ToString(instance.InstanceId) == "" {
 		return nil, fmt.Errorf("response integrity error: missing instance id")
 	}
+	if catalogAttributes == nil {
+		return nil, fmt.Errorf("response integrity error: missing catalog attributes")
+	}

 	result := new(pb.ListHostsResponseHost)

@@ -666,10 +669,16 @@ func awsInstanceToHost(instance types.Instance) (*pb.ListHostsResponseHost, erro
 		}
 	}

-	result.IpAddresses = appendDistinct(result.IpAddresses, instance.PrivateIpAddress, instance.PublicIpAddress)
+	// First let's get the instance's Private IPv4/DNS, Public IPv4/DNS, and IPv6 addresses
+	result.IpAddresses = appendDistinct(result.IpAddresses, instance.PrivateIpAddress, instance.PublicIpAddress, instance.Ipv6Address)
 	result.DnsNames = appendDistinct(result.DnsNames, instance.PrivateDnsName, instance.PublicDnsName)

-	// Now go through all of the interfaces and log the IP address of
+	if catalogAttributes.InstanceAddressesOnly {
+		// return early as we already have the instance addresses
+		return result, nil
+	}
+
+	// Now go through all of the interfaces and sync the IP address of
 	// every interface.
 	for _, iface := range instance.NetworkInterfaces {
 		// Populate default IP addresses/DNS name similar to how we do
@@ -0,0 +1,516 @@
+// Copyright IBM Corp. 2021, 2026
+// SPDX-License-Identifier: MPL-2.0
+
+package host
+
+// This file contains integration tests that demonstrate the role_arn silent
+// fallback bug at the plugin level.
+//
+// THE BUG IN ONE SENTENCE:
+//   When a host catalog is configured with role_arn but no static credentials,
+//   the plugin never calls sts:AssumeRole. It silently falls back to the
+//   ambient AWS credential chain (env vars / instance profile), so a bogus or
+//   unreachable ARN produces no error and returns the same hosts as if no ARN
+//   were specified at all.
+//
+// HOW TO READ THESE TESTS:
+//   Each test function covers one plugin operation (OnCreateCatalog or
+//   ListHosts). Within each function, the cases are ordered to tell a
+//   progressive story:
+//     1. Ambient baseline   — no role_arn, works fine
+//     2. Static-key path    — explicit keys, works fine
+//     3. Bug case           — bogus role_arn + no keys, silently succeeds
+//     4. Desired behavior   — bogus role_arn + STS error injected, SHOULD fail
+//     5. Validation errors  — combinations that are correctly rejected
+//
+//   Cases marked "BUG" in the soft-fail block currently pass (no error is
+//   returned). Once the bug is fixed those tests will start asserting correctly
+//   and the t.Fail() path will no longer be reached.
+//
+// Run both test functions:
+//
+//	go test ./plugin/service/host/... -run TestPluginRoleArnFallback -v
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/ec2"
+	ec2types "github.com/aws/aws-sdk-go-v2/service/ec2/types"
+	"github.com/hashicorp/boundary-plugin-aws/internal/credential"
+	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/hostcatalogs"
+	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/hostsets"
+	pb "github.com/hashicorp/boundary/sdk/pbs/plugin"
+	"github.com/hashicorp/go-secure-stdlib/awsutil/v2"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/structpb"
+)
+
+// ambientInstance is the single fake EC2 instance returned by every mock in
+// this file. Seeing this instance in the response means the ambient credential
+// chain was used, regardless of what role_arn was configured.
+var ambientInstance = ec2types.Instance{
+	InstanceId:       aws.String("i-ambientinstance"),
+	PrivateIpAddress: aws.String("10.0.0.1"),
+	PrivateDnsName:   aws.String("ambient.example.internal"),
+	NetworkInterfaces: []ec2types.InstanceNetworkInterface{
+		{
+			PrivateIpAddress: aws.String("10.0.0.1"),
+			PrivateDnsName:   aws.String("ambient.example.internal"),
+			PrivateIpAddresses: []ec2types.InstancePrivateIpAddress{
+				{
+					PrivateIpAddress: aws.String("10.0.0.1"),
+					PrivateDnsName:   aws.String("ambient.example.internal"),
+				},
+			},
+		},
+	},
+}
+
+// ambientInstanceOutput is a DescribeInstancesOutput that returns ambientInstance.
+// All mock EC2 clients in this file are configured with this output so that
+// success cases always return the same identifiable host.
+var ambientInstanceOutput = &ec2.DescribeInstancesOutput{
+	Reservations: []ec2types.Reservation{
+		{Instances: []ec2types.Instance{ambientInstance}},
+	},
+}
+
+// catalogAttrsStruct builds a catalog attributes struct for the given region.
+// disableRotation is always written explicitly — false must be set to prevent
+// credential rotation from being attempted (which would require IAM mocks).
+// roleArn is written only when non-empty.
+func catalogAttrsStruct(region, roleArn string, disableRotation bool) *structpb.Struct {
+	fields := map[string]*structpb.Value{
+		credential.ConstRegion:                    structpb.NewStringValue(region),
+		credential.ConstDisableCredentialRotation: structpb.NewBoolValue(disableRotation),
+	}
+	if roleArn != "" {
+		fields[credential.ConstRoleArn] = structpb.NewStringValue(roleArn)
+	}
+	return &structpb.Struct{Fields: fields}
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// OnCreateCatalog
+// ─────────────────────────────────────────────────────────────────────────────
+
+func TestPluginRoleArnFallback_OnCreateCatalog(t *testing.T) {
+	// bogusARN is the ARN used in bug-scenario cases. It contains a fake
+	// account ID (000000000000) that does not correspond to any real AWS
+	// account. A correct implementation would fail when it attempts to call
+	// sts:AssumeRole with this ARN. Currently it is silently ignored.
+	const bogusARN = "arn:aws:sts::000000000000:assumed-role/fake/whoever"
+
+	tests := []struct {
+		name        string
+		req         *pb.OnCreateCatalogRequest
+		credOpts    []credential.AwsCredentialPersistedStateOption
+		catalogOpts []awsCatalogPersistedStateOption
+		// wantErr is set for cases that should return an error.
+		wantErr            bool
+		wantErrContains    string
+		wantErrCode        codes.Code
+		// wantEmptySecrets is true when the persisted secrets should be empty
+		// (dynamic / ambient credentials are not stored in the database).
+		wantEmptySecrets bool
+	}{
+		{
+			// NOTE: No role_arn, no static keys. OnCreateCatalog succeeds using
+			// whatever ambient credentials are available. The persisted secrets
+			// are empty because there are no static keys to store. This is the
+			// baseline — it shows that ambient credentials work on their own.
+			name: "1. ambient only — no role_arn, no static keys (baseline)",
+			req: &pb.OnCreateCatalogRequest{
+				Catalog: &hostcatalogs.HostCatalog{
+					Attrs: &hostcatalogs.HostCatalog_Attributes{
+						Attributes: catalogAttrsStruct("us-east-1", "", true),
+					},
+				},
+			},
+			catalogOpts: []awsCatalogPersistedStateOption{
+				withTestEC2APIFunc(newTestMockEC2(
+					nil,
+					testMockEC2WithDescribeInstancesOutput(&ec2.DescribeInstancesOutput{}),
+				)),
+			},
+			wantEmptySecrets: true,
+		},
+		{
+			// NOTE: Explicit static keys, rotation disabled. OnCreateCatalog
+			// succeeds and persists the key pair. This is the normal static-key
+			// path — no role assumption involved. No credOpts are needed here:
+			// with disable_credential_rotation=true and StaticAWS keys, the
+			// dry-run only calls the mocked EC2 DescribeInstances and does not
+			// make any real AWS calls (same pattern as the existing
+			// TestPluginOnCreateCatalogSuccess/usingStaticCredentials test).
+			name: "2. static keys only (baseline)",
+			req: &pb.OnCreateCatalogRequest{
+				Catalog: &hostcatalogs.HostCatalog{
+					Attrs: &hostcatalogs.HostCatalog_Attributes{
+						Attributes: catalogAttrsStruct("us-east-1", "", true),
+					},
+					Secrets: &structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							credential.ConstAccessKeyId:     structpb.NewStringValue("AKIAfoo"),
+							credential.ConstSecretAccessKey: structpb.NewStringValue("bar"),
+						},
+					},
+				},
+			},
+			catalogOpts: []awsCatalogPersistedStateOption{
+				withTestEC2APIFunc(newTestMockEC2(
+					nil,
+					testMockEC2WithDescribeInstancesOutput(&ec2.DescribeInstancesOutput{}),
+				)),
+			},
+			wantEmptySecrets: false, // key pair is stored
+		},
+		{
+			// NOTE: THE BUG — bogus role_arn, no static keys. OnCreateCatalog
+			// succeeds even though the ARN points to a nonexistent role. The
+			// dry-run DescribeInstances call is mocked out, so the bad ARN is
+			// never presented to STS. The persisted secrets are empty (dynamic
+			// credentials are not stored), which is correct — but the absence
+			// of an error is not.
+			name: "3. bogus role_arn + no static keys — BUG: succeeds silently",
+			req: &pb.OnCreateCatalogRequest{
+				Catalog: &hostcatalogs.HostCatalog{
+					Attrs: &hostcatalogs.HostCatalog_Attributes{
+						Attributes: catalogAttrsStruct("us-east-1", bogusARN, true),
+					},
+				},
+			},
+			catalogOpts: []awsCatalogPersistedStateOption{
+				withTestEC2APIFunc(newTestMockEC2(
+					nil,
+					testMockEC2WithDescribeInstancesOutput(&ec2.DescribeInstancesOutput{}),
+				)),
+			},
+			wantEmptySecrets: true,
+		},
+		{
+			// NOTE: DESIRED BEHAVIOR (currently broken). Same bogus role_arn,
+			// but we inject an STS mock that returns an error when AssumeRole
+			// is called. A correct implementation would propagate that error
+			// and OnCreateCatalog would fail. Currently it succeeds because
+			// sts:AssumeRole is never called — the STS mock is never reached.
+			// The soft-fail below documents this: if err == nil it means the
+			// bug is still present.
+			name: "4. bogus role_arn + STS error injected — DESIRED BEHAVIOR: should fail",
+			req: &pb.OnCreateCatalogRequest{
+				Catalog: &hostcatalogs.HostCatalog{
+					Attrs: &hostcatalogs.HostCatalog_Attributes{
+						Attributes: catalogAttrsStruct("us-east-1", bogusARN, true),
+					},
+				},
+			},
+			credOpts: []credential.AwsCredentialPersistedStateOption{
+				credential.WithStateTestOpts([]awsutil.Option{
+					awsutil.WithSTSAPIFunc(
+						awsutil.NewMockSTS(
+							awsutil.WithAssumeRoleError(
+								errors.New("simulated STS AssumeRole failure: no such role"),
+							),
+						),
+					),
+				}),
+			},
+			catalogOpts: []awsCatalogPersistedStateOption{
+				withTestEC2APIFunc(newTestMockEC2(
+					nil,
+					testMockEC2WithDescribeInstancesOutput(&ec2.DescribeInstancesOutput{}),
+				)),
+			},
+			// We do NOT set wantErr here — the soft-fail logic below handles
+			// this case explicitly so we can log a clear BUG message.
+		},
+		{
+			// NOTE: Providing both role_arn and static keys is correctly
+			// rejected at validation time. The switch in GetCredentialsConfig
+			// catches this combination before any AWS call is attempted.
+			name:    "5. role_arn + static keys — correctly rejected (conflict error)",
+			wantErr: true,
+			req: &pb.OnCreateCatalogRequest{
+				Catalog: &hostcatalogs.HostCatalog{
+					Attrs: &hostcatalogs.HostCatalog_Attributes{
+						Attributes: catalogAttrsStruct("us-east-1", bogusARN, true),
+					},
+					Secrets: &structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							credential.ConstAccessKeyId:     structpb.NewStringValue("AKIAfoo"),
+							credential.ConstSecretAccessKey: structpb.NewStringValue("bar"),
+						},
+					},
+				},
+			},
+			wantErrContains: "conflicts with role_arn value",
+			wantErrCode:     codes.InvalidArgument,
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			p := &HostPlugin{
+				testCredStateOpts:    tt.credOpts,
+				testCatalogStateOpts: tt.catalogOpts,
+			}
+
+			rsp, err := p.OnCreateCatalog(context.Background(), tt.req)
+
+			// Case 4 — desired behavior, soft-fail.
+			if tt.name == "4. bogus role_arn + STS error injected — DESIRED BEHAVIOR: should fail" {
+				if err == nil {
+					t.Log("BUG: expected OnCreateCatalog to fail when sts:AssumeRole returns an error,",
+						"but it succeeded — the role_arn is being silently ignored and sts:AssumeRole",
+						"is never called. This test will pass once the bug is fixed.")
+					t.Fail()
+				}
+				return
+			}
+
+			if tt.wantErr {
+				require.Error(t, err)
+				require.Contains(t, err.Error(), tt.wantErrContains)
+				require.Equal(t, tt.wantErrCode.String(), status.Code(err).String())
+				return
+			}
+
+			require.NoError(t, err)
+
+			secrets := rsp.GetPersisted().GetSecrets().GetFields()
+			// Remove the rotation timestamp before checking emptiness.
+			delete(secrets, credential.ConstCredsLastRotatedTime)
+
+			if tt.wantEmptySecrets {
+				require.Empty(t, secrets,
+					"expected empty persisted secrets (dynamic/ambient credentials are not stored)")
+			} else {
+				require.NotEmpty(t, secrets,
+					"expected persisted secrets to contain the static key pair")
+			}
+		})
+	}
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// ListHosts
+// ─────────────────────────────────────────────────────────────────────────────
+
+// listHostsRequest builds a minimal ListHostsRequest. The persisted secrets
+// are always an empty struct because the bug scenario uses dynamic credentials
+// (nothing is persisted for ambient or role-based auth).
+func listHostsRequest(attrs *structpb.Struct) *pb.ListHostsRequest {
+	return &pb.ListHostsRequest{
+		Catalog: &hostcatalogs.HostCatalog{
+			Attrs: &hostcatalogs.HostCatalog_Attributes{
+				Attributes: attrs,
+			},
+		},
+		Persisted: &pb.HostCatalogPersisted{
+			Secrets: &structpb.Struct{},
+		},
+		Sets: []*hostsets.HostSet{
+			{
+				Id: "set-1",
+				Attrs: &hostsets.HostSet_Attributes{
+					Attributes: &structpb.Struct{},
+				},
+			},
+		},
+	}
+}
+
+func TestPluginRoleArnFallback_ListHosts(t *testing.T) {
+	// bogusARN is a clearly invalid ARN: a real AWS account ID has 12 digits,
+	// and "fake/whoever" is not a valid role path. A correct implementation
+	// would call sts:AssumeRole with this ARN and fail. Currently it is ignored.
+	const bogusARN = "arn:aws:sts::000000000000:assumed-role/fake/whoever"
+
+	// ec2WithAmbientInstance is the mock EC2 factory used by all three
+	// narrative cases. It always returns the same ambientInstance regardless
+	// of what credentials were resolved. Seeing "i-ambientinstance" in the
+	// response from case 3 (bogus role_arn) proves the ARN was ignored and
+	// the same ambient identity was used as in case 1.
+	ec2WithAmbientInstance := []awsCatalogPersistedStateOption{
+		withTestEC2APIFunc(newTestMockEC2(
+			nil,
+			testMockEC2WithDescribeInstancesOutput(ambientInstanceOutput),
+		)),
+	}
+
+	cases := []struct {
+		name        string
+		req         *pb.ListHostsRequest
+		credOpts    []credential.AwsCredentialPersistedStateOption
+		catalogOpts []awsCatalogPersistedStateOption
+		// wantHosts is the expected number of hosts in a successful response.
+		wantHosts       int
+		wantErr         bool
+		wantErrContains string
+		wantErrCode     codes.Code
+	}{
+		{
+			// NOTE: No role_arn, no static keys. ListHosts succeeds using
+			// ambient credentials and returns i-ambientinstance (10.0.0.1).
+			// This is the baseline — the "normal" ambient credential flow.
+			name:        "1. ambient only — no role_arn, no static keys (baseline)",
+			req:         listHostsRequest(catalogAttrsStruct("us-east-1", "", true)),
+			catalogOpts: ec2WithAmbientInstance,
+			wantHosts:   1,
+		},
+		{
+			// NOTE: Explicit static keys. ListHosts succeeds and returns
+			// i-ambientinstance. The same mock EC2 is used here just for
+			// consistency; in a real scenario static keys and role-assumed
+			// keys would return different instances.
+			name: "2. static keys only (baseline)",
+			req: &pb.ListHostsRequest{
+				Catalog: &hostcatalogs.HostCatalog{
+					Attrs: &hostcatalogs.HostCatalog_Attributes{
+						Attributes: catalogAttrsStruct("us-east-1", "", true),
+					},
+				},
+				Persisted: &pb.HostCatalogPersisted{
+					Secrets: &structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							credential.ConstAccessKeyId:     structpb.NewStringValue("AKIAfoo"),
+							credential.ConstSecretAccessKey: structpb.NewStringValue("bar"),
+						},
+					},
+				},
+				Sets: []*hostsets.HostSet{
+					{
+						Id: "set-1",
+						Attrs: &hostsets.HostSet_Attributes{
+							Attributes: &structpb.Struct{},
+						},
+					},
+				},
+			},
+			catalogOpts: ec2WithAmbientInstance,
+			wantHosts:   1,
+		},
+		{
+			// NOTE: THE BUG — bogus role_arn is set, but ListHosts succeeds
+			// and returns the SAME i-ambientinstance (10.0.0.1) as the ambient
+			// baseline in case 1. The two responses are identical. This proves
+			// the role_arn was completely ignored: the ambient credential chain
+			// was used instead of calling sts:AssumeRole with the bogus ARN.
+			name:        "3. bogus role_arn + no static keys — BUG: same hosts as ambient baseline",
+			req:         listHostsRequest(catalogAttrsStruct("us-east-1", bogusARN, true)),
+			catalogOpts: ec2WithAmbientInstance,
+			wantHosts:   1, // same count AND same instance ID as case 1 — the ARN was ignored
+		},
+		{
+			// NOTE: DESIRED BEHAVIOR (currently broken). Same bogus role_arn,
+			// but an STS mock is injected that returns an error when AssumeRole
+			// is called. A correct implementation would propagate that STS
+			// error and ListHosts would return an error. Currently ListHosts
+			// succeeds because sts:AssumeRole is never called — the injected
+			// error has no effect. The soft-fail below makes the bug visible
+			// without causing the full test run to abort.
+			name: "4. bogus role_arn + STS error injected — DESIRED BEHAVIOR: should fail",
+			req:  listHostsRequest(catalogAttrsStruct("us-east-1", bogusARN, true)),
+			credOpts: []credential.AwsCredentialPersistedStateOption{
+				credential.WithStateTestOpts([]awsutil.Option{
+					awsutil.WithSTSAPIFunc(
+						awsutil.NewMockSTS(
+							awsutil.WithAssumeRoleError(
+								errors.New("simulated STS AssumeRole failure: no such role"),
+							),
+						),
+					),
+				}),
+			},
+			catalogOpts: ec2WithAmbientInstance,
+			// wantErr deliberately not set — handled by soft-fail logic below.
+		},
+		{
+			// NOTE: Providing both role_arn and static keys is correctly
+			// rejected at validation time, before any AWS call is made.
+			// This case is here to show that not all role_arn combinations
+			// are silently ignored — only the "no static keys" path is affected.
+			name: "5. role_arn + static keys — correctly rejected (conflict error)",
+			req: &pb.ListHostsRequest{
+				Catalog: &hostcatalogs.HostCatalog{
+					Attrs: &hostcatalogs.HostCatalog_Attributes{
+						Attributes: catalogAttrsStruct("us-east-1", bogusARN, true),
+					},
+				},
+				Persisted: &pb.HostCatalogPersisted{
+					Secrets: &structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							credential.ConstAccessKeyId:     structpb.NewStringValue("AKIAfoo"),
+							credential.ConstSecretAccessKey: structpb.NewStringValue("bar"),
+						},
+					},
+				},
+				Sets: []*hostsets.HostSet{
+					{
+						Id: "set-1",
+						Attrs: &hostsets.HostSet_Attributes{
+							Attributes: &structpb.Struct{},
+						},
+					},
+				},
+			},
+			// ListHosts calls AwsCredentialPersistedStateFromProto which does
+			// NOT use GetCredentialsConfig — it reconstructs from persisted
+			// state. With both a role_arn in attrs and keys in persisted
+			// secrets, the state is built with both set, which results in the
+			// DynamicAWS path. No conflict error is raised at this layer.
+			// We still include this case for completeness, expecting success
+			// (the conflict is only checked in GetCredentialsConfig, which is
+			// called during OnCreateCatalog, not during ListHosts).
+			catalogOpts: ec2WithAmbientInstance,
+			wantHosts:   1,
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			p := &HostPlugin{
+				testCredStateOpts:    tc.credOpts,
+				testCatalogStateOpts: tc.catalogOpts,
+			}
+
+			rsp, err := p.ListHosts(context.Background(), tc.req)
+
+			// Case 4 — desired behavior, soft-fail.
+			if tc.name == "4. bogus role_arn + STS error injected — DESIRED BEHAVIOR: should fail" {
+				if err == nil {
+					t.Log("BUG: expected ListHosts to fail when sts:AssumeRole returns an error,",
+						"but it succeeded — the role_arn is being silently ignored and sts:AssumeRole",
+						"is never called. Compare the response with case 1 (ambient baseline):",
+						"both return i-ambientinstance, proving the same ambient credentials were",
+						"used in both cases. This test will assert correctly once the bug is fixed.")
+					t.Fail()
+				}
+				return
+			}
+
+			if tc.wantErr {
+				require.Error(t, err)
+				require.Contains(t, err.Error(), tc.wantErrContains)
+				require.Equal(t, tc.wantErrCode.String(), status.Code(err).String())
+				return
+			}
+
+			require.NoError(t, err)
+			require.Len(t, rsp.GetHosts(), tc.wantHosts,
+				"unexpected number of hosts returned — see case NOTE for what this proves")
+
+			if tc.wantHosts > 0 {
+				require.Equal(t, "i-ambientinstance", rsp.GetHosts()[0].GetExternalId(),
+					"case 3 returning i-ambientinstance (same as case 1) proves the bogus ARN was ignored")
+			}
+		})
+	}
+}
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package host
@@ -638,7 +638,8 @@ func TestPluginOnCreateCatalogErr(t *testing.T) {
 						Fields: map[string]*structpb.Value{
 							credential.ConstAccessKeyId:     structpb.NewStringValue("AKIA_foobar"),
 							credential.ConstSecretAccessKey: structpb.NewStringValue("bazqux"),
-						}},
+						},
+					},
 					Attrs: &hostcatalogs.HostCatalog_Attributes{
 						Attributes: &structpb.Struct{
 							Fields: map[string]*structpb.Value{
@@ -664,7 +665,8 @@ func TestPluginOnCreateCatalogErr(t *testing.T) {
 						Fields: map[string]*structpb.Value{
 							credential.ConstAccessKeyId:     structpb.NewStringValue("AKIA_foobar"),
 							credential.ConstSecretAccessKey: structpb.NewStringValue("bazqux"),
-						}},
+						},
+					},
 					Attrs: &hostcatalogs.HostCatalog_Attributes{
 						Attributes: &structpb.Struct{
 							Fields: map[string]*structpb.Value{
@@ -694,7 +696,8 @@ func TestPluginOnCreateCatalogErr(t *testing.T) {
 						Fields: map[string]*structpb.Value{
 							credential.ConstAccessKeyId:     structpb.NewStringValue("AKIA_foobar"),
 							credential.ConstSecretAccessKey: structpb.NewStringValue("bazqux"),
-						}},
+						},
+					},
 					Attrs: &hostcatalogs.HostCatalog_Attributes{
 						Attributes: &structpb.Struct{
 							Fields: map[string]*structpb.Value{
@@ -721,7 +724,8 @@ func TestPluginOnCreateCatalogErr(t *testing.T) {
 						Fields: map[string]*structpb.Value{
 							credential.ConstAccessKeyId:     structpb.NewStringValue("AKIA_foobar"),
 							credential.ConstSecretAccessKey: structpb.NewStringValue("bazqux"),
-						}},
+						},
+					},
 					Attrs: &hostcatalogs.HostCatalog_Attributes{
 						Attributes: &structpb.Struct{
 							Fields: map[string]*structpb.Value{
@@ -2383,15 +2387,25 @@ func TestBuildDescribeInstancesInput(t *testing.T) {

 func TestAwsInstanceToHost(t *testing.T) {
 	cases := []struct {
-		name        string
-		instance    types.Instance
-		expected    *pb.ListHostsResponseHost
-		expectedErr string
+		name         string
+		instance     types.Instance
+		catalogAttrs *CatalogAttributes
+		expected     *pb.ListHostsResponseHost
+		expectedErr  string
 	}{
 		{
-			name:        "missing instance id",
-			instance:    types.Instance{},
-			expectedErr: "response integrity error: missing instance id",
+			name:         "missing instance id",
+			instance:     types.Instance{},
+			catalogAttrs: &CatalogAttributes{},
+			expectedErr:  "response integrity error: missing instance id",
+		},
+		{
+			name: "missing catalog attributes",
+			instance: types.Instance{
+				InstanceId: aws.String("foobar"),
+			},
+			catalogAttrs: nil,
+			expectedErr:  "response integrity error: missing catalog attributes",
 		},
 		{
 			name: "good, single IP w/public addr",
@@ -2418,6 +2432,7 @@ func TestAwsInstanceToHost(t *testing.T) {
 					},
 				},
 			},
+			catalogAttrs: &CatalogAttributes{},
 			expected: &pb.ListHostsResponseHost{
 				ExternalId:  "foobar",
 				IpAddresses: []string{"10.0.0.1", "1.1.1.1"},
@@ -2443,6 +2458,7 @@ func TestAwsInstanceToHost(t *testing.T) {
 					},
 				},
 			},
+			catalogAttrs: &CatalogAttributes{},
 			expected: &pb.ListHostsResponseHost{
 				ExternalId:  "foobar",
 				IpAddresses: []string{"10.0.0.1"},
@@ -2484,6 +2500,7 @@ func TestAwsInstanceToHost(t *testing.T) {
 					},
 				},
 			},
+			catalogAttrs: &CatalogAttributes{},
 			expected: &pb.ListHostsResponseHost{
 				ExternalId:  "foobar",
 				IpAddresses: []string{"10.0.0.1", "1.1.1.1", "10.0.0.2"},
@@ -2529,6 +2546,7 @@ func TestAwsInstanceToHost(t *testing.T) {
 					},
 				},
 			},
+			catalogAttrs: &CatalogAttributes{},
 			expected: &pb.ListHostsResponseHost{
 				ExternalId:  "foobar",
 				IpAddresses: []string{"10.0.0.1", "1.1.1.1", "10.0.0.2", "1.1.1.2"},
@@ -2564,6 +2582,7 @@ func TestAwsInstanceToHost(t *testing.T) {
 					},
 				},
 			},
+			catalogAttrs: &CatalogAttributes{},
 			expected: &pb.ListHostsResponseHost{
 				ExternalId:  "foobar",
 				IpAddresses: []string{"10.0.0.1", "1.1.1.1", "10.0.0.2"},
@@ -2578,6 +2597,7 @@ func TestAwsInstanceToHost(t *testing.T) {
 				PrivateDnsName:   aws.String("test.example.internal"),
 				PublicIpAddress:  aws.String("1.1.1.1"),
 				PublicDnsName:    aws.String("test.example.com"),
+				Ipv6Address:      aws.String("instance::ipv6::address"),
 				NetworkInterfaces: []types.InstanceNetworkInterface{
 					{
 						PrivateIpAddress: aws.String("10.0.0.1"),
@@ -2596,9 +2616,63 @@ func TestAwsInstanceToHost(t *testing.T) {
 					},
 				},
 			},
+			catalogAttrs: &CatalogAttributes{},
 			expected: &pb.ListHostsResponseHost{
 				ExternalId:  "foobar",
-				IpAddresses: []string{"10.0.0.1", "1.1.1.1", "some::fake::address"},
+				IpAddresses: []string{"10.0.0.1", "1.1.1.1", "instance::ipv6::address", "some::fake::address"},
+				DnsNames:    []string{"test.example.internal", "test.example.com"},
+			},
+		},
+		{
+			name: "good, instance addresses only excludes interface secondary addresses",
+			instance: types.Instance{
+				InstanceId:       aws.String("foobar"),
+				PrivateIpAddress: aws.String("10.0.0.1"),
+				PrivateDnsName:   aws.String("test.example.internal"),
+				PublicIpAddress:  aws.String("1.1.1.1"),
+				PublicDnsName:    aws.String("test.example.com"),
+				Ipv6Address:      aws.String("instance::ipv6::address"),
+				NetworkInterfaces: []types.InstanceNetworkInterface{
+					{
+						PrivateIpAddress: aws.String("10.0.0.1"),
+						PrivateDnsName:   aws.String("test.example.internal"),
+						PrivateIpAddresses: []types.InstancePrivateIpAddress{
+							{
+								Association: &types.InstanceNetworkInterfaceAssociation{
+									PublicIp:      aws.String("1.1.1.1"),
+									PublicDnsName: aws.String("test.example.com"),
+								},
+								PrivateIpAddress: aws.String("10.0.0.1"),
+								PrivateDnsName:   aws.String("test.example.internal"),
+							},
+							{
+								PrivateIpAddress: aws.String("10.0.0.2"),
+								PrivateDnsName:   aws.String("test2.example.internal"),
+							},
+						},
+						Ipv6Addresses: []types.InstanceIpv6Address{{Ipv6Address: aws.String("iface::ipv6::address")}},
+					},
+					{
+						PrivateIpAddress: aws.String("10.0.1.1"),
+						PrivateDnsName:   aws.String("secondary.example.internal"),
+						PrivateIpAddresses: []types.InstancePrivateIpAddress{
+							{
+								Association: &types.InstanceNetworkInterfaceAssociation{
+									PublicIp:      aws.String("2.2.2.2"),
+									PublicDnsName: aws.String("secondary.example.com"),
+								},
+								PrivateIpAddress: aws.String("10.0.1.1"),
+								PrivateDnsName:   aws.String("secondary.example.internal"),
+							},
+						},
+						Ipv6Addresses: []types.InstanceIpv6Address{{Ipv6Address: aws.String("secondary::ipv6::address")}},
+					},
+				},
+			},
+			catalogAttrs: &CatalogAttributes{InstanceAddressesOnly: true},
+			expected: &pb.ListHostsResponseHost{
+				ExternalId:  "foobar",
+				IpAddresses: []string{"10.0.0.1", "1.1.1.1", "instance::ipv6::address"},
 				DnsNames:    []string{"test.example.internal", "test.example.com"},
 			},
 		},
@@ -2632,6 +2706,7 @@ func TestAwsInstanceToHost(t *testing.T) {
 					},
 				},
 			},
+			catalogAttrs: &CatalogAttributes{},
 			expected: &pb.ListHostsResponseHost{
 				ExternalId:   "foobar",
 				ExternalName: "test-instance-actual-name",
@@ -2669,6 +2744,7 @@ func TestAwsInstanceToHost(t *testing.T) {
 					},
 				},
 			},
+			catalogAttrs: &CatalogAttributes{},
 			expected: &pb.ListHostsResponseHost{
 				ExternalId:   "foobar",
 				ExternalName: "test-instance-actual-name",
@@ -2682,7 +2758,7 @@ func TestAwsInstanceToHost(t *testing.T) {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			require := require.New(t)
-			actual, err := awsInstanceToHost(tc.instance)
+			actual, err := awsInstanceToHost(tc.instance, tc.catalogAttrs)
 			if tc.expectedErr != "" {
 				require.EqualError(err, tc.expectedErr)
 				return
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package host
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package host
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package host
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package storage
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package storage
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package storage
@@ -11,5 +11,5 @@ const (
 	ConstAwsDualStack = "dual_stack"

 	// defaultStreamChunkSize is the recommened chunk size for sending data through a stream
-	defaultStreamChunkSize = 65536 // 64 KiB
+	defaultStreamChunkSize = 1 << 20 // 1 MiB
 )
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package storage
@@ -40,6 +40,10 @@ func setStatePermission(req any, permission *pb.Permission) *pb.StorageBucketCre
 		state.State.Delete = permission
 	case *pb.DeleteObjectsRequest:
 		state.State.Delete = permission
+	case pb.ListObjectsRequest:
+		state.State.Read = permission
+	case *pb.ListObjectsRequest:
+		state.State.Read = permission
 	}
 	return state
 }
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package storage
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package storage
@@ -9,6 +9,7 @@ import (
 	"context"
 	"crypto/sha256"
 	"encoding/base64"
+	stderr "errors"
 	"fmt"
 	"io"
 	"os"
@@ -76,7 +77,7 @@ func (p *StoragePlugin) getClient(ctx context.Context,
 		// No storage bucket ID to key cache on, create new client and return
 		client, err := storageState.s3Client(ctx, opt...)
 		if err != nil {
-			return nil, errors.BadRequestStatus("error creating S3 client: %s", err)
+			return nil, errors.BadRequestStatusf("error creating S3 client: %s", err)
 		}
 		return client, nil
 	}
@@ -92,7 +93,7 @@ func (p *StoragePlugin) getClient(ctx context.Context,
 		defer p.clients.Unlock()
 		client, err := storageState.s3Client(ctx, opt...)
 		if err != nil {
-			return nil, errors.BadRequestStatus("error creating S3 client: %s", err)
+			return nil, errors.BadRequestStatusf("error creating S3 client: %s", err)
 		}
 		p.clients.cache[storageBucketId] = client
 		return client, nil
@@ -118,7 +119,7 @@ func (p *StoragePlugin) getClient(ctx context.Context,
 		var err error
 		client, err = storageState.s3Client(ctx, opt...)
 		if err != nil {
-			return nil, errors.BadRequestStatus("error creating S3 client: %s", err)
+			return nil, errors.BadRequestStatusf("error creating S3 client: %s", err)
 		}
 		p.clients.cache[storageBucketId] = client
 	}
@@ -138,7 +139,7 @@ func (p *StoragePlugin) call(

 	s3Client, err := p.getClient(ctx, storageBucketId, storageState, opts...)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error getting S3 client: %s", err)
+		return nil, errors.BadRequestStatusf("error getting S3 client: %s", err)
 	}
 	firstAttempt := true
 	for {
@@ -151,7 +152,7 @@ func (p *StoragePlugin) call(
 				opts = append(opts, WithCacheRefresh(true))
 				s3Client, err = p.getClient(ctx, storageBucketId, storageState, opts...)
 				if err != nil {
-					return nil, errors.BadRequestStatus("error refreshing S3 client: %s", err)
+					return nil, errors.BadRequestStatusf("error refreshing S3 client: %s", err)
 				}
 				continue
 			}
@@ -218,7 +219,7 @@ func (p *StoragePlugin) OnCreateStorageBucket(ctx context.Context, req *pb.OnCre
 		}, p.testCredStateOpts...)...,
 	)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error setting up persisted state: %s", err)
+		return nil, errors.BadRequestStatusf("error setting up persisted state: %s", err)
 	}

 	// Try to rotate AWS static credentials
@@ -234,7 +235,7 @@ func (p *StoragePlugin) OnCreateStorageBucket(ctx context.Context, req *pb.OnCre
 		}, p.testStorageStateOpts...)...,
 	)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error setting up persisted state: %s", err)
+		return nil, errors.BadRequestStatusf("error setting up persisted state: %s", err)
 	}

 	// perform dry run to ensure we can interact with the bucket as expected.
@@ -292,7 +293,7 @@ func (p *StoragePlugin) OnUpdateStorageBucket(ctx context.Context, req *pb.OnUpd
 		oldStorageAttributes.DualStack,
 		p.testCredStateOpts...)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error loading persisted state: %s", err)
+		return nil, errors.BadRequestStatusf("error loading persisted state: %s", err)
 	}

 	// Verify the incoming credentials are valid and return any errors to the
@@ -315,7 +316,7 @@ func (p *StoragePlugin) OnUpdateStorageBucket(ctx context.Context, req *pb.OnUpd
 			}, p.testCredStateOpts...)...,
 		)
 		if err != nil {
-			return nil, errors.BadRequestStatus("error setting up new credential persisted state: %s", err)
+			return nil, errors.BadRequestStatusf("error setting up new credential persisted state: %s", err)
 		}
 		newStorageState, err := newAwsStoragePersistedState(
 			append([]awsStoragePersistedStateOption{
@@ -323,7 +324,7 @@ func (p *StoragePlugin) OnUpdateStorageBucket(ctx context.Context, req *pb.OnUpd
 			}, p.testStorageStateOpts...)...,
 		)
 		if err != nil {
-			return nil, errors.BadRequestStatus("error loading persisted state: %s", err)
+			return nil, errors.BadRequestStatusf("error loading persisted state: %s", err)
 		}
 		if st := dryRunValidation(ctx, newStorageState, newStorageAttributes, newBucket); st != nil {
 			return nil, st.Err()
@@ -363,7 +364,7 @@ func (p *StoragePlugin) OnUpdateStorageBucket(ctx context.Context, req *pb.OnUpd
 		}, p.testStorageStateOpts...)...,
 	)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error loading persisted state: %s", err)
+		return nil, errors.BadRequestStatusf("error loading persisted state: %s", err)
 	}

 	// perform dry run to ensure we can interact with the bucket as expected.
@@ -410,7 +411,7 @@ func (p *StoragePlugin) OnDeleteStorageBucket(ctx context.Context, req *pb.OnDel
 		storageAttributes.DualStack,
 		p.testCredStateOpts...)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error loading persisted state: %s", err)
+		return nil, errors.BadRequestStatusf("error loading persisted state: %s", err)
 	}

 	_, err = newAwsStoragePersistedState(
@@ -419,7 +420,7 @@ func (p *StoragePlugin) OnDeleteStorageBucket(ctx context.Context, req *pb.OnDel
 		}, p.testStorageStateOpts...)...,
 	)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error loading persisted state: %s", err)
+		return nil, errors.BadRequestStatusf("error loading persisted state: %s", err)
 	}

 	// try to delete static credentials
@@ -474,7 +475,7 @@ func (p *StoragePlugin) HeadObject(ctx context.Context, req *pb.HeadObjectReques
 		}, p.testCredStateOpts...)...,
 	)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error setting up persisted state: %s", err)
+		return nil, errors.BadRequestStatusf("error setting up persisted state: %s", err)
 	}

 	storageState, err := newAwsStoragePersistedState(
@@ -483,7 +484,7 @@ func (p *StoragePlugin) HeadObject(ctx context.Context, req *pb.HeadObjectReques
 		}, p.testStorageStateOpts...)...,
 	)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error setting up persisted state: %s", err)
+		return nil, errors.BadRequestStatusf("error setting up persisted state: %s", err)
 	}

 	opts := []s3Option{}
@@ -546,7 +547,7 @@ func (p *StoragePlugin) ValidatePermissions(ctx context.Context, req *pb.Validat
 		}, p.testCredStateOpts...)...,
 	)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error setting up persisted state: %s", err)
+		return nil, errors.BadRequestStatusf("error setting up persisted state: %s", err)
 	}

 	storageState, err := newAwsStoragePersistedState(
@@ -555,7 +556,7 @@ func (p *StoragePlugin) ValidatePermissions(ctx context.Context, req *pb.Validat
 		}, p.testStorageStateOpts...)...,
 	)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error setting up persisted state: %s", err)
+		return nil, errors.BadRequestStatusf("error setting up persisted state: %s", err)
 	}

 	// perform dry run to ensure we can interact with the bucket as expected.
@@ -604,7 +605,7 @@ func (p *StoragePlugin) GetObject(req *pb.GetObjectRequest, stream pb.StoragePlu
 		}, p.testCredStateOpts...)...,
 	)
 	if err != nil {
-		return errors.BadRequestStatus("error setting up persisted state: %s", err)
+		return errors.BadRequestStatusf("error setting up persisted state: %s", err)
 	}

 	storageState, err := newAwsStoragePersistedState(
@@ -613,7 +614,7 @@ func (p *StoragePlugin) GetObject(req *pb.GetObjectRequest, stream pb.StoragePlu
 		}, p.testStorageStateOpts...)...,
 	)
 	if err != nil {
-		return errors.BadRequestStatus("error setting up persisted state: %s", err)
+		return errors.BadRequestStatusf("error setting up persisted state: %s", err)
 	}

 	opts := []s3Option{}
@@ -647,13 +648,13 @@ func (p *StoragePlugin) GetObject(req *pb.GetObjectRequest, stream pb.StoragePlu
 		buffer := make([]byte, chunkSize)
 		n, err := reader.Read(buffer)
 		if err != nil && err != io.EOF {
-			return errors.UnknownStatus("error reading chunk from s3: %s", err)
+			return errors.UnknownStatusf("error reading chunk from s3: %s", err)
 		}
 		if n > 0 {
 			if err := stream.Send(&pb.GetObjectResponse{
 				FileChunk: buffer[:n],
 			}); err != nil {
-				return errors.UnknownStatus("error sending chunk to client: %s", err)
+				return errors.UnknownStatusf("error sending chunk to client: %s", err)
 			}
 		}
 		if err == io.EOF {
@@ -664,6 +665,23 @@ func (p *StoragePlugin) GetObject(req *pb.GetObjectRequest, stream pb.StoragePlu
 	return nil
 }

+const (
+	// multipartThreshold is the file size, in bytes, above which PutObject
+	// uploads an object using a multipart upload instead of a single PutObject
+	// request. 8 MiB matches the AWS CLI and boto3 defaults.
+	multipartThreshold = 8 * 1024 * 1024 // 8 MiB
+
+	// defaultMultipartPartSize is the default size, in bytes, of each part
+	// uploaded during a multipart upload. It is kept equal to
+	// multipartThreshold so a multipart upload always has at least two parts
+	// (S3 requires every part except the last to be at least 5 MiB).
+	defaultMultipartPartSize = 8 * 1024 * 1024 // 8 MiB
+
+	// maxMultipartParts is the maximum number of parts S3 permits for a single
+	// multipart upload.
+	maxMultipartParts = 10000
+)
+
 // PutObject is called when putting objects into an s3 bucket.
 func (p *StoragePlugin) PutObject(ctx context.Context, req *pb.PutObjectRequest) (*pb.PutObjectResponse, error) {
 	if req == nil {
@@ -718,7 +736,7 @@ func (p *StoragePlugin) PutObject(ctx context.Context, req *pb.PutObjectRequest)
 		}, p.testCredStateOpts...)...,
 	)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error setting up persisted state: %s", err)
+		return nil, errors.BadRequestStatusf("error setting up persisted state: %s", err)
 	}

 	storageState, err := newAwsStoragePersistedState(
@@ -727,7 +745,7 @@ func (p *StoragePlugin) PutObject(ctx context.Context, req *pb.PutObjectRequest)
 		}, p.testStorageStateOpts...)...,
 	)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error setting up persisted state: %s", err)
+		return nil, errors.BadRequestStatusf("error setting up persisted state: %s", err)
 	}

 	opts := []s3Option{}
@@ -750,6 +768,32 @@ func (p *StoragePlugin) PutObject(ctx context.Context, req *pb.PutObjectRequest)
 	}
 	objectKey := path.Join(bucket.GetBucketPrefix(), req.GetKey())

+	// decodedChecksum is the raw SHA-256 digest of the entire object. Boundary
+	// compares this byte-for-byte against the hash it computed locally before
+	// the upload, so it must always be the whole-object checksum regardless of
+	// whether a single PutObject or a multipart upload is used.
+	decodedChecksum, err := base64.StdEncoding.DecodeString(checksum)
+	if err != nil {
+		return nil, errors.UnknownStatus("failed to decode checksum value")
+	}
+
+	// for larger files, use a multipart upload instead of a single PutObject
+	// request.
+	if info.Size() > multipartThreshold {
+		partSize := int64(defaultMultipartPartSize)
+		// S3 allows at most maxMultipartParts parts per upload, so grow the
+		// part size for very large objects to stay within that limit.
+		if sz := info.Size(); sz/partSize >= maxMultipartParts {
+			partSize = (sz + maxMultipartParts - 1) / maxMultipartParts
+		}
+		if err := p.putObjectMultipart(ctx, req, storageState, bucket.GetBucketName(), objectKey, file, partSize, opts...); err != nil {
+			return nil, err
+		}
+		return &pb.PutObjectResponse{
+			ChecksumSha_256: decodedChecksum,
+		}, nil
+	}
+
 	putCall := func(s3Client S3API) (any, error) {
 		return s3Client.PutObject(ctx, &s3.PutObjectInput{
 			Bucket:            aws.String(bucket.GetBucketName()),
@@ -771,15 +815,126 @@ func (p *StoragePlugin) PutObject(ctx context.Context, req *pb.PutObjectRequest)
 	if checksum != *resp.ChecksumSHA256 {
 		return nil, checksumMistmatchStatus()
 	}
-	decodedChecksum, err := base64.StdEncoding.DecodeString(*resp.ChecksumSHA256)
-	if err != nil {
-		return nil, errors.UnknownStatus("failed to decode checksum value from aws")
-	}
 	return &pb.PutObjectResponse{
 		ChecksumSha_256: decodedChecksum,
 	}, nil
 }

+// putObjectMultipart uploads file to the given bucket and key using an S3
+// multipart upload. The file is split into parts of partSize bytes (the final
+// part may be smaller) and each part is uploaded with its own SHA-256 checksum
+// so S3 can verify part integrity on the wire.
+//
+// If any step fails the upload is aborted on a best-effort basis to avoid
+// leaving orphaned parts behind, which would otherwise continue to accrue
+// storage charges.
+func (p *StoragePlugin) putObjectMultipart(
+	ctx context.Context,
+	req *pb.PutObjectRequest,
+	storageState *awsStoragePersistedState,
+	bucketName, objectKey string,
+	file *os.File,
+	partSize int64,
+	opts ...s3Option,
+) error {
+	bucketId := req.GetBucket().GetId()
+
+	createCall := func(s3Client S3API) (any, error) {
+		return s3Client.CreateMultipartUpload(ctx, &s3.CreateMultipartUploadInput{
+			Bucket:            aws.String(bucketName),
+			Key:               aws.String(objectKey),
+			ChecksumAlgorithm: types.ChecksumAlgorithmSha256,
+		})
+	}
+	createResp, err := p.call(ctx, createCall, bucketId, storageState, opts...)
+	if err != nil {
+		return parseS3Error("create multipart upload", err, req).Err()
+	}
+	uploadId := createResp.(*s3.CreateMultipartUploadOutput).UploadId
+
+	// once the upload has been created, any subsequent failure must abort it so
+	// uploaded parts are not orphaned.
+	abort := func() {
+		abortCall := func(s3Client S3API) (any, error) {
+			return s3Client.AbortMultipartUpload(ctx, &s3.AbortMultipartUploadInput{
+				Bucket:   aws.String(bucketName),
+				Key:      aws.String(objectKey),
+				UploadId: uploadId,
+			})
+		}
+		// best effort: the failure that triggered the abort is more useful to
+		// the caller than an error from the abort itself.
+		_, _ = p.call(ctx, abortCall, bucketId, storageState, opts...)
+	}
+
+	var completedParts []types.CompletedPart
+	buf := make([]byte, partSize)
+	var partNumber int32 = 1
+	for {
+		n, readErr := io.ReadFull(file, buf)
+		if readErr == io.EOF {
+			// previous iteration consumed the final bytes of the file
+			break
+		}
+		if readErr != nil && readErr != io.ErrUnexpectedEOF {
+			abort()
+			return errors.UnknownStatusf("failed to read file: %s", readErr)
+		}
+
+		partData := buf[:n]
+		sum := sha256.Sum256(partData)
+		partChecksum := base64.StdEncoding.EncodeToString(sum[:])
+
+		pn := partNumber
+		uploadCall := func(s3Client S3API) (any, error) {
+			return s3Client.UploadPart(ctx, &s3.UploadPartInput{
+				Bucket:            aws.String(bucketName),
+				Key:               aws.String(objectKey),
+				UploadId:          uploadId,
+				PartNumber:        aws.Int32(pn),
+				Body:              bytes.NewReader(partData),
+				ContentLength:     aws.Int64(int64(n)),
+				ChecksumAlgorithm: types.ChecksumAlgorithmSha256,
+				ChecksumSHA256:    aws.String(partChecksum),
+			})
+		}
+		uploadResp, err := p.call(ctx, uploadCall, bucketId, storageState, opts...)
+		if err != nil {
+			abort()
+			return parseS3Error("upload part", err, req).Err()
+		}
+		part := uploadResp.(*s3.UploadPartOutput)
+		completedParts = append(completedParts, types.CompletedPart{
+			ETag:           part.ETag,
+			ChecksumSHA256: part.ChecksumSHA256,
+			PartNumber:     aws.Int32(pn),
+		})
+
+		partNumber++
+		if readErr == io.ErrUnexpectedEOF {
+			// the final, short part
+			break
+		}
+	}
+
+	completeCall := func(s3Client S3API) (any, error) {
+		return s3Client.CompleteMultipartUpload(ctx, &s3.CompleteMultipartUploadInput{
+			Bucket:   aws.String(bucketName),
+			Key:      aws.String(objectKey),
+			UploadId: uploadId,
+			MultipartUpload: &types.CompletedMultipartUpload{
+				Parts: completedParts,
+			},
+		})
+	}
+	if _, err := p.call(ctx, completeCall, bucketId, storageState, opts...); err != nil {
+		abort()
+		return parseS3Error("complete multipart upload", err, req).Err()
+	}
+
+	return nil
+}
+
 // DeleteObjects is used to delete one or many objects from an s3 bucket.
 func (p *StoragePlugin) DeleteObjects(ctx context.Context, req *pb.DeleteObjectsRequest) (*pb.DeleteObjectsResponse, error) {
 	if req.GetKeyPrefix() == "" {
@@ -817,7 +972,7 @@ func (p *StoragePlugin) DeleteObjects(ctx context.Context, req *pb.DeleteObjects
 		}, p.testCredStateOpts...)...,
 	)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error setting up persisted state: %s", err)
+		return nil, errors.BadRequestStatusf("error setting up persisted state: %s", err)
 	}

 	storageState, err := newAwsStoragePersistedState(
@@ -826,7 +981,7 @@ func (p *StoragePlugin) DeleteObjects(ctx context.Context, req *pb.DeleteObjects
 		}, p.testStorageStateOpts...)...,
 	)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error setting up persisted state: %s", err)
+		return nil, errors.BadRequestStatusf("error setting up persisted state: %s", err)
 	}

 	opts := []s3Option{}
@@ -861,7 +1016,7 @@ func (p *StoragePlugin) DeleteObjects(ctx context.Context, req *pb.DeleteObjects
 	objects := []types.ObjectIdentifier{}
 	client, err := p.getClient(ctx, bucket.GetId(), storageState, opts...)
 	if err != nil {
-		return nil, errors.BadRequestStatus("error getting S3 client: %s", err)
+		return nil, errors.BadRequestStatusf("error getting S3 client: %s", err)
 	}
 	var conToken *string
 	truncated, firstAttempt := true, true
@@ -880,7 +1035,7 @@ func (p *StoragePlugin) DeleteObjects(ctx context.Context, req *pb.DeleteObjects
 				opts = append(opts, WithCacheRefresh(true))
 				client, err = p.getClient(ctx, bucket.GetId(), storageState, opts...)
 				if err != nil {
-					return nil, errors.BadRequestStatus("error refreshing S3 client: %s", err)
+					return nil, errors.BadRequestStatusf("error refreshing S3 client: %s", err)
 				}
 				continue
 			}
@@ -917,6 +1072,191 @@ func (p *StoragePlugin) DeleteObjects(ctx context.Context, req *pb.DeleteObjects
 	}, nil
 }

+// ListObjects retrieves files and directories from an S3 bucket under a given prefix.
+// If the "recursive" flag in the request is false (default), it returns only the top-level objects directly under the prefix.
+// If the "recursive" is true, it returns all objects under the prefix recursively.
+func (p *StoragePlugin) ListObjects(ctx context.Context, req *pb.ListObjectsRequest) (*pb.ListObjectsResponse, error) {
+	bucket := req.GetBucket()
+	if bucket == nil {
+		return nil, errors.BadRequestStatus("bucket is required")
+	}
+
+	if bucket.BucketName == "" {
+		return nil, errors.BadRequestStatus("bucketName is required")
+	}
+
+	attrs := bucket.GetAttributes()
+	if attrs == nil {
+		return nil, errors.BadRequestStatus("attributes is required")
+	}
+
+	storageAttributes, err := getStorageAttributes(attrs)
+	if err != nil {
+		return nil, err
+	}
+
+	credConfig, err := cred.GetCredentialsConfig(bucket.GetSecrets(), storageAttributes.CredentialAttributes, false)
+	if err != nil {
+		return nil, err
+	}
+
+	// Set up the creds in our persisted state.
+	credState, err := cred.NewAwsCredentialPersistedState(
+		append([]cred.AwsCredentialPersistedStateOption{
+			cred.WithCredentialsConfig(credConfig),
+		}, p.testCredStateOpts...)...,
+	)
+	if err != nil {
+		return nil, errors.BadRequestStatusf("error setting up persisted state: %s", err)
+	}
+
+	storageState, err := newAwsStoragePersistedState(
+		append([]awsStoragePersistedStateOption{
+			withCredentials(credState),
+		}, p.testStorageStateOpts...)...,
+	)
+	if err != nil {
+		return nil, errors.BadRequestStatusf("error setting up persisted state: %s", err)
+	}
+
+	var opts []s3Option
+	if storageAttributes.EndpointUrl != "" {
+		opts = append(opts, WithEndpoint(storageAttributes.EndpointUrl))
+	}
+	s3Client, err := storageState.s3Client(ctx, opts...)
+	if err != nil {
+		return nil, errors.BadRequestStatusf("error getting S3 client: %s", err)
+	}
+
+	prefix := path.Join(bucket.GetBucketPrefix(), req.GetKeyPrefix())
+	if strings.HasSuffix(req.GetKeyPrefix(), "/") {
+		// path.Join ends by "cleaning" the path, including removing a trailing slash, if
+		// it exists. given that a slash is used to denote a folder, it is required here.
+		prefix += "/"
+	}
+	var objects []*pb.Object
+
+	if req.GetRecursive() {
+		objects, err = listObjectsRecursive(ctx, s3Client, bucket.GetBucketName(), prefix, req)
+	} else {
+		objects, err = listObjectsTopLevel(ctx, s3Client, bucket.GetBucketName(), prefix, req)
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	return &pb.ListObjectsResponse{
+		Objects: objects,
+	}, nil
+}
+
+// listObjectsTopLevel lists only the objects that exist directly under the specified prefix (This does not traverse subdirectories)
+// It uses the S3 "Delimiter" option to group results so that subdirectories appear as CommonPrefixes.
+func listObjectsTopLevel(ctx context.Context, s3Client S3API, bucketName, prefix string, req *pb.ListObjectsRequest) ([]*pb.Object, error) {
+	var objects []*pb.Object
+	paginator := s3.NewListObjectsV2Paginator(s3Client, &s3.ListObjectsV2Input{
+		Bucket:    aws.String(bucketName),
+		Prefix:    aws.String(prefix),
+		Delimiter: aws.String("/"),
+	})
+
+	for paginator.HasMorePages() {
+		if err := ctx.Err(); err != nil {
+			switch {
+			case stderr.Is(err, context.Canceled):
+				return nil, status.Error(codes.Canceled, "request canceled")
+			case stderr.Is(err, context.DeadlineExceeded):
+				return nil, status.Error(codes.DeadlineExceeded, "request deadline exceeded")
+			default:
+				return nil, status.Error(codes.Internal, "unknown context error")
+			}
+		}
+		page, err := paginator.NextPage(ctx)
+		if err != nil {
+			return nil, parseS3Error("failed to list objects", err, req).Err()
+		}
+
+		for _, c := range page.Contents {
+			if c.Key != nil {
+				objects = append(objects, &pb.Object{Key: *c.Key, IsDir: false})
+			}
+		}
+		for _, cp := range page.CommonPrefixes {
+			if cp.Prefix != nil {
+				objects = append(objects, &pb.Object{Key: *cp.Prefix, IsDir: true})
+			}
+		}
+	}
+	return objects, nil
+}
+
+// listObjectsRecursive lists all objects under the specified prefix, traversing all subdirectories.
+// It does not use the S3 "Delimiter" option, so every object key that matches the prefix is returned.
+// This mode is useful for fully scanning all objects in a folder tree.
+func listObjectsRecursive(ctx context.Context, s3Client S3API, bucketName, prefix string, req *pb.ListObjectsRequest) ([]*pb.Object, error) {
+	var objects []*pb.Object
+	folderSet := make(map[string]struct{})
+	paginator := s3.NewListObjectsV2Paginator(s3Client, &s3.ListObjectsV2Input{
+		Bucket: aws.String(bucketName),
+		Prefix: aws.String(prefix),
+	})
+
+	for paginator.HasMorePages() {
+		if err := ctx.Err(); err != nil {
+			switch {
+			case stderr.Is(err, context.Canceled):
+				return nil, status.Error(codes.Canceled, "request canceled")
+			case stderr.Is(err, context.DeadlineExceeded):
+				return nil, status.Error(codes.DeadlineExceeded, "request deadline exceeded")
+			default:
+				return nil, status.Error(codes.Internal, "unknown context error")
+			}
+		}
+		page, err := paginator.NextPage(ctx)
+		if err != nil {
+			return nil, parseS3Error("failed to list objects", err, req).Err()
+		}
+
+		for _, c := range page.Contents {
+			// We intentionally ignore "empty objects" that simulate folders.
+			// S3 is not a traditional file system and does not have real directories.
+			// Folders are an abstraction; they are represented by zero-byte objects
+			// whose keys end with a slash (e.g., "myfolder/"). These objects exist
+			// solely as placeholders to give the appearance of directories in S3 tools.
+			// Here, we only include actual objects with content (non-zero length).
+			if c.Key != nil && !strings.HasSuffix(*c.Key, "/") {
+				objects = append(objects, &pb.Object{Key: *c.Key, IsDir: false})
+			}
+
+			// Extract all parent folder paths from the object key.
+			// We walk up the directory hierarchy using path.Dir,
+			// adding each parent folder to folderSet until we reach
+			// the root ("/" or ".") or leave the current prefix subtree.
+			// This ensures all intermediate "folders" appear in the result even if
+			// no explicit zero-byte object exists for them.
+			dir := path.Dir(*c.Key)
+			for dir != "." && dir != "/" {
+				folder := dir + "/"
+				if !strings.HasPrefix(folder, prefix) {
+					break // left the subtree, stop climbing up
+				}
+				if folder != prefix {
+					folderSet[folder] = struct{}{}
+				}
+				dir = path.Dir(dir)
+			}
+		}
+	}
+	// Add folders
+	for folder := range folderSet {
+		objects = append(objects, &pb.Object{
+			Key:   folder,
+			IsDir: true,
+		})
+	}
+	return objects, nil
+}
+
 // dryRunValidation validates that the IAM role policy attached to the given secrets of the
 // storage bucket has the minimum required permissions needed for this plugin to function
 // as expected. This function will create an object in the s3 bucket to validate it has
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package storage
@@ -3715,6 +3715,195 @@ func TestStoragePlugin_PutObject(t *testing.T) {
 	}
 }

+func TestStoragePlugin_PutObjectMultipart(t *testing.T) {
+	td := t.TempDir()
+
+	// genFile writes size bytes of deterministic content to a temp file and
+	// returns its path along with the raw SHA-256 digest of the whole file.
+	genFile := func(t *testing.T, name string, size int) (string, []byte) {
+		t.Helper()
+		data := make([]byte, size)
+		for i := range data {
+			data[i] = byte(i % 251)
+		}
+		fp := path.Join(td, name)
+		require.NoError(t, os.WriteFile(fp, data, 0o600))
+		sum := sha256.Sum256(data)
+		return fp, sum[:]
+	}
+
+	validRequest := func(p string) *pb.PutObjectRequest {
+		return &pb.PutObjectRequest{
+			Bucket: &storagebuckets.StorageBucket{
+				BucketName:   "external-obj-store",
+				BucketPrefix: "prefix",
+				Secrets:      credential.MockStaticCredentialSecrets(),
+				Attributes: &structpb.Struct{
+					Fields: map[string]*structpb.Value{
+						credential.ConstRegion: structpb.NewStringValue("us-west-2"),
+					},
+				},
+			},
+			Key:  "mock-object",
+			Path: p,
+		}
+	}
+
+	t.Run("multipart success spanning multiple parts", func(t *testing.T) {
+		require, assert := require.New(t), assert.New(t)
+		// 20 MiB with 8 MiB parts -> 3 parts (8, 8, 4 MiB).
+		fp, wholeChecksum := genFile(t, "large-file", 20*1024*1024)
+
+		state := &testMockS3State{}
+		p := &StoragePlugin{
+			testCredStateOpts: validSTSMock(),
+			testStorageStateOpts: []awsStoragePersistedStateOption{
+				withTestS3APIFunc(newTestMockS3(state)),
+			},
+		}
+
+		resp, err := p.PutObject(context.Background(), validRequest(fp))
+		require.NoError(err)
+		require.NotNil(resp)
+
+		// Boundary must receive the whole-object SHA-256, not the multipart
+		// composite checksum.
+		assert.True(bytes.Equal(wholeChecksum, resp.GetChecksumSha_256()))
+
+		// The single-shot PutObject path must not have been used.
+		assert.False(state.PutObjectCalled)
+		assert.True(state.CreateMultipartUploadCalled)
+		assert.Equal(3, state.UploadPartCallCount)
+		assert.True(state.CompleteMultipartUploadCalled)
+		assert.False(state.AbortMultipartUploadCalled)
+
+		// The reassembled part bodies must equal the original file content.
+		orig, err := os.ReadFile(fp)
+		require.NoError(err)
+		assert.True(bytes.Equal(orig, state.UploadPartBody))
+
+		// The object key must include the configured bucket prefix.
+		require.NotNil(state.CreateMultipartUploadInputParams)
+		assert.Equal("prefix/mock-object", aws.ToString(state.CreateMultipartUploadInputParams.Key))
+	})
+
+	t.Run("file just above threshold uses two parts", func(t *testing.T) {
+		require, assert := require.New(t), assert.New(t)
+		// 8 MiB + 1 byte -> 2 parts (8 MiB, 1 byte).
+		fp, wholeChecksum := genFile(t, "just-over", 8*1024*1024+1)
+
+		state := &testMockS3State{}
+		p := &StoragePlugin{
+			testCredStateOpts: validSTSMock(),
+			testStorageStateOpts: []awsStoragePersistedStateOption{
+				withTestS3APIFunc(newTestMockS3(state)),
+			},
+		}
+
+		resp, err := p.PutObject(context.Background(), validRequest(fp))
+		require.NoError(err)
+		assert.True(bytes.Equal(wholeChecksum, resp.GetChecksumSha_256()))
+		assert.Equal(2, state.UploadPartCallCount)
+		assert.True(state.CompleteMultipartUploadCalled)
+	})
+
+	t.Run("file at threshold uses single PutObject", func(t *testing.T) {
+		require, assert := require.New(t), assert.New(t)
+		// Exactly 8 MiB is not above the threshold, so the single-shot path is used.
+		fp, wholeChecksum := genFile(t, "at-threshold", 8*1024*1024)
+		checksum := base64.StdEncoding.EncodeToString(wholeChecksum)
+
+		state := &testMockS3State{}
+		p := &StoragePlugin{
+			testCredStateOpts: validSTSMock(),
+			testStorageStateOpts: []awsStoragePersistedStateOption{
+				withTestS3APIFunc(newTestMockS3(
+					state,
+					testMockS3WithPutObjectOutput(&s3.PutObjectOutput{
+						ChecksumSHA256: aws.String(checksum),
+					}),
+				)),
+			},
+		}
+
+		resp, err := p.PutObject(context.Background(), validRequest(fp))
+		require.NoError(err)
+		assert.True(bytes.Equal(wholeChecksum, resp.GetChecksumSha_256()))
+		assert.True(state.PutObjectCalled)
+		assert.False(state.CreateMultipartUploadCalled)
+	})
+
+	t.Run("create multipart upload error", func(t *testing.T) {
+		require, assert := require.New(t), assert.New(t)
+		fp, _ := genFile(t, "create-err", 20*1024*1024)
+
+		state := &testMockS3State{}
+		p := &StoragePlugin{
+			testCredStateOpts: validSTSMock(),
+			testStorageStateOpts: []awsStoragePersistedStateOption{
+				withTestS3APIFunc(newTestMockS3(
+					state,
+					testMockS3WithCreateMultipartUploadError(TestAwsS3Error("AccessDenied", "CreateMultipartUpload", "not authorized")),
+				)),
+			},
+		}
+
+		resp, err := p.PutObject(context.Background(), validRequest(fp))
+		require.Error(err)
+		assert.Nil(resp)
+		assert.Equal(codes.PermissionDenied, status.Code(err))
+		// Nothing was created, so nothing should be aborted.
+		assert.False(state.AbortMultipartUploadCalled)
+	})
+
+	t.Run("upload part error aborts upload", func(t *testing.T) {
+		require, assert := require.New(t), assert.New(t)
+		fp, _ := genFile(t, "upload-err", 20*1024*1024)
+
+		state := &testMockS3State{}
+		p := &StoragePlugin{
+			testCredStateOpts: validSTSMock(),
+			testStorageStateOpts: []awsStoragePersistedStateOption{
+				withTestS3APIFunc(newTestMockS3(
+					state,
+					testMockS3WithUploadPartErrorOnPart(2, TestAwsS3Error("AccessDenied", "UploadPart", "not authorized")),
+				)),
+			},
+		}
+
+		resp, err := p.PutObject(context.Background(), validRequest(fp))
+		require.Error(err)
+		assert.Nil(resp)
+		assert.Equal(codes.PermissionDenied, status.Code(err))
+		assert.True(state.CreateMultipartUploadCalled)
+		assert.False(state.CompleteMultipartUploadCalled)
+		// The failed upload must be aborted to avoid orphaned parts.
+		assert.True(state.AbortMultipartUploadCalled)
+	})
+
+	t.Run("complete multipart upload error aborts upload", func(t *testing.T) {
+		require, assert := require.New(t), assert.New(t)
+		fp, _ := genFile(t, "complete-err", 20*1024*1024)
+
+		state := &testMockS3State{}
+		p := &StoragePlugin{
+			testCredStateOpts: validSTSMock(),
+			testStorageStateOpts: []awsStoragePersistedStateOption{
+				withTestS3APIFunc(newTestMockS3(
+					state,
+					testMockS3WithCompleteMultipartUploadError(TestAwsS3Error("InternalError", "CompleteMultipartUpload", "boom")),
+				)),
+			},
+		}
+
+		resp, err := p.PutObject(context.Background(), validRequest(fp))
+		require.Error(err)
+		assert.Nil(resp)
+		assert.Equal(3, state.UploadPartCallCount)
+		assert.True(state.AbortMultipartUploadCalled)
+	})
+}
+
 func TestStoragePlugin_DeleteObjects(t *testing.T) {
 	validRequest := func() *pb.DeleteObjectsRequest {
 		return &pb.DeleteObjectsRequest{
@@ -4202,3 +4391,391 @@ func TestS3ClientCache(t *testing.T) {
 	assert.Equal(cred3.AccessKey, client.Credentials().AccessKeyID)
 	assert.Equal(cred3.SecretKey, client.Credentials().SecretAccessKey)
 }
+
+func TestStoragePlugin_ListObjects(t *testing.T) {
+	validRequest := func() *pb.ListObjectsRequest {
+		return &pb.ListObjectsRequest{
+			KeyPrefix: "foo/bar/",
+			Bucket: &storagebuckets.StorageBucket{
+				BucketName: "foo",
+				Secrets:    credential.MockStaticCredentialSecrets(),
+				Attributes: &structpb.Struct{
+					Fields: map[string]*structpb.Value{
+						credential.ConstRegion: structpb.NewStringValue("us-west-2"),
+					},
+				},
+			},
+		}
+	}
+
+	cases := []struct {
+		name                string
+		req                 *pb.ListObjectsRequest
+		credOpts            []credential.AwsCredentialPersistedStateOption
+		storageOpts         []awsStoragePersistedStateOption
+		ctx                 context.Context
+		expectedObjects     []*pb.Object
+		expectedErrContains string
+		expectedErrCode     codes.Code
+		expectedDetails     *pb.StorageBucketCredentialState
+	}{
+		{
+			name:                "nil bucket",
+			req:                 &pb.ListObjectsRequest{KeyPrefix: "foo/bar"},
+			expectedErrContains: "bucket is required",
+			expectedErrCode:     codes.InvalidArgument,
+		},
+		{
+			name: "empty bucket name",
+			req: &pb.ListObjectsRequest{
+				KeyPrefix: "foo/bar",
+				Bucket:    &storagebuckets.StorageBucket{},
+			},
+			expectedErrContains: "bucketName is required",
+			expectedErrCode:     codes.InvalidArgument,
+		},
+		{
+			name: "nil attributes",
+			req: &pb.ListObjectsRequest{
+				KeyPrefix: "foo/bar",
+				Bucket: &storagebuckets.StorageBucket{
+					BucketName: "foo",
+				},
+			},
+			expectedErrContains: "attributes is required",
+			expectedErrCode:     codes.InvalidArgument,
+		},
+		{
+			name: "error reading attributes",
+			req: &pb.ListObjectsRequest{
+				KeyPrefix: "foo/bar",
+				Bucket: &storagebuckets.StorageBucket{
+					BucketName: "foo",
+					Attributes: new(structpb.Struct),
+				},
+			},
+			expectedErrContains: "missing required value \"region\"",
+			expectedErrCode:     codes.InvalidArgument,
+		},
+		{
+			name: "credential persisted state setup error",
+			req:  validRequest(),
+			credOpts: []credential.AwsCredentialPersistedStateOption{
+				func(s *credential.AwsCredentialPersistedState) error {
+					return errors.New(testOptionErr)
+				},
+			},
+			expectedErrContains: fmt.Sprintf("error setting up persisted state: %s", testOptionErr),
+			expectedErrCode:     codes.InvalidArgument,
+		},
+		{
+			name: "storage persisted state setup error",
+			req:  validRequest(),
+			storageOpts: []awsStoragePersistedStateOption{
+				func(s *awsStoragePersistedState) error {
+					return errors.New(testOptionErr)
+				},
+			},
+			expectedErrContains: fmt.Sprintf("error setting up persisted state: %s", testOptionErr),
+			expectedErrCode:     codes.InvalidArgument,
+		},
+		{
+			name:     "listObjectsV2 access denied error",
+			req:      validRequest(),
+			credOpts: validSTSMock(),
+			storageOpts: []awsStoragePersistedStateOption{
+				withTestS3APIFunc(
+					newTestMockS3(
+						nil,
+						testMockS3WithListObjectsV2Error(TestAwsS3Error("AccessDenied", "ListObjectsV2", "not authorized")),
+					),
+				),
+			},
+			expectedErrContains: "aws service s3: invalid credentials: failed to list objects",
+			expectedErrCode:     codes.PermissionDenied,
+			expectedDetails: &pb.StorageBucketCredentialState{
+				State: &pb.Permissions{
+					Read: &pb.Permission{
+						State:        pb.StateType_STATE_TYPE_ERROR,
+						ErrorDetails: "not authorized",
+						CheckedAt:    timestamppb.Now(),
+					},
+				},
+			},
+		},
+		{
+			name:     "listObjectsV2 throttling error",
+			req:      validRequest(),
+			credOpts: validSTSMock(),
+			storageOpts: []awsStoragePersistedStateOption{
+				withTestS3APIFunc(
+					newTestMockS3(
+						nil,
+						testMockS3WithListObjectsV2Error(TestAwsS3Error("ThrottlingException", "ListObjectsV2", "throttling exception")),
+					),
+				),
+			},
+			expectedErrContains: "aws service s3: throttling: failed to list objects",
+			expectedErrCode:     codes.Unavailable,
+			expectedDetails: &pb.StorageBucketCredentialState{
+				State: &pb.Permissions{
+					Read: &pb.Permission{
+						State:     pb.StateType_STATE_TYPE_UNKNOWN,
+						CheckedAt: timestamppb.Now(),
+					},
+				},
+			},
+		},
+		{
+			name: "context canceled - non recursive",
+			req:  validRequest(),
+			ctx: func() context.Context {
+				c, cancel := context.WithCancel(context.Background())
+				cancel()
+				return c
+			}(),
+			credOpts: validSTSMock(),
+			storageOpts: []awsStoragePersistedStateOption{
+				withTestS3APIFunc(
+					newTestMockS3(
+						nil,
+						// Return an error that simulates context cancellation being detected at the AWS level
+						testMockS3WithListObjectsV2Error(context.Canceled),
+					),
+				),
+			},
+			expectedErrContains: "request canceled",
+			expectedErrCode:     codes.Canceled,
+		},
+		{
+			name: "context deadline exceeded - non recursive",
+			req:  validRequest(),
+			ctx: func() context.Context {
+				c, cancel := context.WithTimeout(context.Background(), 1*time.Nanosecond)
+				time.Sleep(2 * time.Nanosecond) // Ensure deadline is exceeded
+				cancel()
+				return c
+			}(),
+			credOpts: validSTSMock(),
+			storageOpts: []awsStoragePersistedStateOption{
+				withTestS3APIFunc(
+					newTestMockS3(
+						nil,
+						// Return an error that simulates deadline exceeded being detected at the AWS level
+						testMockS3WithListObjectsV2Error(context.DeadlineExceeded),
+					),
+				),
+			},
+			expectedErrContains: "request deadline exceeded",
+			expectedErrCode:     codes.DeadlineExceeded,
+		},
+		{
+			name: "context canceled - recursive",
+			req: func() *pb.ListObjectsRequest {
+				r := validRequest()
+				r.Recursive = true
+				return r
+			}(),
+			ctx: func() context.Context {
+				c, cancel := context.WithCancel(context.Background())
+				cancel() // Cancel immediately
+				return c
+			}(),
+			credOpts: validSTSMock(),
+			storageOpts: []awsStoragePersistedStateOption{
+				withTestS3APIFunc(
+					newTestMockS3(
+						nil,
+						// Return an error that simulates context cancellation being detected at the AWS level
+						testMockS3WithListObjectsV2Error(context.Canceled),
+					),
+				),
+			},
+			expectedErrContains: "request canceled",
+			expectedErrCode:     codes.Canceled,
+		},
+		{
+			name: "context deadline exceeded - recursive",
+			req: func() *pb.ListObjectsRequest {
+				r := validRequest()
+				r.Recursive = true
+				return r
+			}(),
+			ctx: func() context.Context {
+				c, cancel := context.WithTimeout(context.Background(), 1*time.Nanosecond)
+				// Ensure the deadline is exceeded
+				time.Sleep(2 * time.Nanosecond)
+				cancel()
+				return c
+			}(),
+			credOpts: validSTSMock(),
+			storageOpts: []awsStoragePersistedStateOption{
+				withTestS3APIFunc(
+					newTestMockS3(
+						nil,
+						// Return an error that simulates deadline exceeded being detected at the AWS level
+						testMockS3WithListObjectsV2Error(context.DeadlineExceeded),
+					),
+				),
+			},
+			expectedErrContains: "request deadline exceeded",
+			expectedErrCode:     codes.DeadlineExceeded,
+		},
+		{
+			name:     "success - single page top-level",
+			req:      validRequest(),
+			credOpts: validSTSMock(),
+			storageOpts: []awsStoragePersistedStateOption{
+				withTestS3APIFunc(
+					newTestMockS3(
+						nil,
+						testMockS3WithListObjectsV2Output(&s3.ListObjectsV2Output{
+							CommonPrefixes: []s3types.CommonPrefix{
+								{Prefix: aws.String("foo/bar/key/")},
+							},
+							Contents: []s3types.Object{
+								{Key: aws.String("foo/bar/file1.bsr")},
+								{Key: aws.String("foo/bar/file2.bsr")},
+							},
+						}),
+					),
+				),
+			},
+			expectedObjects: []*pb.Object{
+				{Key: "foo/bar/key/", IsDir: true},
+				{Key: "foo/bar/file1.bsr", IsDir: false},
+				{Key: "foo/bar/file2.bsr", IsDir: false},
+			},
+		},
+		{
+			name: "success - recursive listing with nested dirs",
+			req: func() *pb.ListObjectsRequest {
+				r := validRequest()
+				r.Recursive = true
+				return r
+			}(),
+			credOpts: validSTSMock(),
+			storageOpts: []awsStoragePersistedStateOption{
+				withTestS3APIFunc(
+					newTestMockS3(
+						nil,
+						testMockS3WithListObjectsV2Output(&s3.ListObjectsV2Output{
+							Contents: []s3types.Object{
+								{Key: aws.String("foo/bar/file1.bsr")},
+								{Key: aws.String("foo/bar/nested/file2.bsr")},
+								{Key: aws.String("foo/bar/nested/deeper/file3.bsr")},
+							},
+						}),
+					),
+				),
+			},
+			expectedObjects: []*pb.Object{
+				{Key: "foo/bar/file1.bsr", IsDir: false},
+				{Key: "foo/bar/nested/", IsDir: true},
+				{Key: "foo/bar/nested/file2.bsr", IsDir: false},
+				{Key: "foo/bar/nested/deeper/", IsDir: true},
+				{Key: "foo/bar/nested/deeper/file3.bsr", IsDir: false},
+			},
+		},
+		{
+			name: "success - recursive multi-page",
+			req: func() *pb.ListObjectsRequest {
+				r := validRequest()
+				r.Recursive = true
+				return r
+			}(),
+			credOpts: validSTSMock(),
+			storageOpts: []awsStoragePersistedStateOption{
+				withTestS3APIFunc(
+					newTestMockS3(
+						nil,
+						testMockS3WithListObjectsV2OutputFunc(func(input *s3.ListObjectsV2Input) *s3.ListObjectsV2Output {
+							if input.ContinuationToken == nil {
+								return &s3.ListObjectsV2Output{
+									Contents: []s3types.Object{
+										{Key: aws.String("foo/bar/page1/file1.bsr")},
+									},
+									NextContinuationToken: aws.String("token123"),
+									IsTruncated:           aws.Bool(true),
+								}
+							}
+							if aws.ToString(input.ContinuationToken) == "token123" {
+								return &s3.ListObjectsV2Output{
+									Contents: []s3types.Object{
+										{Key: aws.String("foo/bar/page2/file2.bsr")},
+									},
+								}
+							}
+							return &s3.ListObjectsV2Output{}
+						}),
+					),
+				),
+			},
+			expectedObjects: []*pb.Object{
+				{Key: "foo/bar/page1/", IsDir: true},
+				{Key: "foo/bar/page1/file1.bsr", IsDir: false},
+				{Key: "foo/bar/page2/", IsDir: true},
+				{Key: "foo/bar/page2/file2.bsr", IsDir: false},
+			},
+		},
+		{
+			name: "success - recursive empty",
+			req: func() *pb.ListObjectsRequest {
+				r := validRequest()
+				r.Recursive = true
+				return r
+			}(),
+			credOpts: validSTSMock(),
+			storageOpts: []awsStoragePersistedStateOption{
+				withTestS3APIFunc(
+					newTestMockS3(nil, testMockS3WithListObjectsV2Output(&s3.ListObjectsV2Output{})),
+				),
+			},
+			expectedObjects: []*pb.Object(nil),
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			require, assert := require.New(t), assert.New(t)
+			p := &StoragePlugin{
+				testCredStateOpts:    tc.credOpts,
+				testStorageStateOpts: tc.storageOpts,
+			}
+			ctx := tc.ctx
+			if ctx == nil {
+				ctx = context.Background()
+			}
+			resp, err := p.ListObjects(ctx, tc.req)
+
+			if tc.expectedErrContains != "" {
+				require.Error(err)
+				assert.Contains(err.Error(), tc.expectedErrContains)
+				assert.Equal(tc.expectedErrCode, status.Code(err))
+
+				st, ok := status.FromError(err)
+				require.True(ok)
+				if tc.expectedDetails != nil {
+					var state *pb.StorageBucketCredentialState
+					for _, detail := range st.Details() {
+						if errDetail, ok := detail.(*pb.StorageBucketCredentialState); ok {
+							state = errDetail
+							break
+						}
+					}
+					require.NotNil(state)
+					internal.CheckSimilarPermission(assert, tc.expectedDetails.State.Read, state.State.Read, false)
+					internal.CheckSimilarPermission(assert, tc.expectedDetails.State.Write, state.State.Write, false)
+					internal.CheckSimilarPermission(assert, tc.expectedDetails.State.Delete, state.State.Delete, false)
+				} else {
+					assert.Len(st.Details(), 0)
+				}
+				return
+			}
+
+			require.NoError(err)
+			require.NotNil(resp)
+			require.ElementsMatch(resp.Objects, tc.expectedObjects)
+		})
+	}
+}
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package storage
@@ -7,9 +7,13 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"net/http"
 	"net/url"
+	"time"

 	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/aws/retry"
+	awshttp "github.com/aws/aws-sdk-go-v2/aws/transport/http"
 	"github.com/aws/aws-sdk-go-v2/service/s3"
 	smithyEndpoints "github.com/aws/smithy-go/endpoints"
 	"github.com/hashicorp/boundary-plugin-aws/internal/credential"
@@ -22,6 +26,10 @@ type S3API interface {
 	GetObject(ctx context.Context, params *s3.GetObjectInput, optFns ...func(*s3.Options)) (*s3.GetObjectOutput, error)
 	HeadObject(ctx context.Context, params *s3.HeadObjectInput, optFns ...func(*s3.Options)) (*s3.HeadObjectOutput, error)
 	PutObject(ctx context.Context, params *s3.PutObjectInput, optFns ...func(*s3.Options)) (*s3.PutObjectOutput, error)
+	CreateMultipartUpload(ctx context.Context, params *s3.CreateMultipartUploadInput, optFns ...func(*s3.Options)) (*s3.CreateMultipartUploadOutput, error)
+	UploadPart(ctx context.Context, params *s3.UploadPartInput, optFns ...func(*s3.Options)) (*s3.UploadPartOutput, error)
+	CompleteMultipartUpload(ctx context.Context, params *s3.CompleteMultipartUploadInput, optFns ...func(*s3.Options)) (*s3.CompleteMultipartUploadOutput, error)
+	AbortMultipartUpload(ctx context.Context, params *s3.AbortMultipartUploadInput, optFns ...func(*s3.Options)) (*s3.AbortMultipartUploadOutput, error)
 	DeleteObjects(ctx context.Context, params *s3.DeleteObjectsInput, optFns ...func(*s3.Options)) (*s3.DeleteObjectsOutput, error)
 	ListObjectsV2(ctx context.Context, params *s3.ListObjectsV2Input, optFns ...func(*s3.Options)) (*s3.ListObjectsV2Output, error)
 	Credentials() aws.Credentials
@@ -118,7 +126,10 @@ func (s *awsStoragePersistedState) s3Client(ctx context.Context, opt ...s3Option
 	if err != nil {
 		return nil, fmt.Errorf("failed to retrieve credentials: %v\n", err)
 	}
-
+	err = newTransport(awsCfg)
+	if err != nil {
+		return nil, fmt.Errorf("failed to configure new http transport: %v", err)
+	}
 	c := s3.NewFromConfig(*awsCfg, s3Opts...)
 	return &s3Client{Client: c, creds: creds}, nil
 }
@@ -202,3 +213,30 @@ func (e *endpointResolver) ResolveEndpoint(ctx context.Context, params s3.Endpoi
 	}
 	return
 }
+
+// newTransport returns an http Transport object. The http transport object utilizes the
+// default transport created by minio. The following transport fields are updated to provide
+// more reliable connectivity when handling larger objects:
+// MaxResponseHeaderBytes is set to 1MiB to prevent header reads from stalling.
+// WriteBufferSize is set to 1MiB, matching the default buffer size used in Boundary storage.
+// ReadBufferSize is set to 1MiB, matching the default buffer size used in Boundary storage.
+// ForceAttemptHTTP2 is set to true, supporting more resilient multiplexing and avoids HOL blocking on retries.
+// IdleConnTimeout is set to 2 minutes.
+func newTransport(cfg *aws.Config) error {
+	if cfg == nil {
+		return fmt.Errorf("missing aws configuration")
+	}
+	cfg.HTTPClient = awshttp.NewBuildableClient().WithTransportOptions(func(transport *http.Transport) {
+		transport.MaxResponseHeaderBytes = 1 << 20  // 1 MiB prevents header read from stalling
+		transport.WriteBufferSize = 1 << 20         // 1 MiB write buffer (default is 4 KiB)
+		transport.ReadBufferSize = 1 << 20          // 1 MiB read buffer (default is 4 KiB)
+		transport.ForceAttemptHTTP2 = true          // enables HTTP/2 where supported more resilient multiplexing, avoids HOL blocking on retries
+		transport.IdleConnTimeout = 2 * time.Minute // double the idle connection timeout, default is 1 minute
+	})
+	cfg.Retryer = func() aws.Retryer {
+		return retry.NewStandard(func(o *retry.StandardOptions) {
+			o.MaxAttempts = 20
+		})
+	}
+	return nil
+}
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package storage
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package storage
@@ -6,6 +6,8 @@ package storage
 import (
 	"bytes"
 	"context"
+	"crypto/sha256"
+	"encoding/base64"
 	"fmt"
 	"io"
 	"testing"
@@ -39,6 +41,23 @@ type testMockS3State struct {
 	PutObjectInputParams *s3.PutObjectInput
 	PutObjectBody        []byte

+	CreateMultipartUploadCalled      bool
+	CreateMultipartUploadInputParams *s3.CreateMultipartUploadInput
+
+	UploadPartCalled      bool
+	UploadPartCallCount   int
+	UploadPartInputParams []*s3.UploadPartInput
+	// UploadPartBody is the concatenation, in part-number order, of every
+	// part body received by UploadPart. It can be compared against the full
+	// object that was expected to be uploaded.
+	UploadPartBody []byte
+
+	CompleteMultipartUploadCalled      bool
+	CompleteMultipartUploadInputParams *s3.CompleteMultipartUploadInput
+
+	AbortMultipartUploadCalled      bool
+	AbortMultipartUploadInputParams *s3.AbortMultipartUploadInput
+
 	HeadObjectCalled      bool
 	HeadObjectInputParams *s3.HeadObjectInput

@@ -57,6 +76,16 @@ func (s *testMockS3State) Reset() {
 	s.PutObjectCalled = false
 	s.PutObjectInputParams = nil
 	s.PutObjectBody = nil
+	s.CreateMultipartUploadCalled = false
+	s.CreateMultipartUploadInputParams = nil
+	s.UploadPartCalled = false
+	s.UploadPartCallCount = 0
+	s.UploadPartInputParams = nil
+	s.UploadPartBody = nil
+	s.CompleteMultipartUploadCalled = false
+	s.CompleteMultipartUploadInputParams = nil
+	s.AbortMultipartUploadCalled = false
+	s.AbortMultipartUploadInputParams = nil
 	s.HeadObjectCalled = false
 	s.HeadObjectInputParams = nil
 	s.ListObjectsV2Called = false
@@ -81,6 +110,19 @@ type testMockS3 struct {
 	PutObjectOutput *s3.PutObjectOutput
 	PutObjectErr    error

+	// mocked responses for the multipart upload calls
+	CreateMultipartUploadOutput *s3.CreateMultipartUploadOutput
+	CreateMultipartUploadErr    error
+	UploadPartOutput            *s3.UploadPartOutput
+	UploadPartErr               error
+	// UploadPartErrOnPart, when greater than zero, causes UploadPart to return
+	// UploadPartErr (or a generic error) only for the matching part number.
+	UploadPartErrOnPart           int32
+	CompleteMultipartUploadOutput *s3.CompleteMultipartUploadOutput
+	CompleteMultipartUploadErr    error
+	AbortMultipartUploadOutput    *s3.AbortMultipartUploadOutput
+	AbortMultipartUploadErr       error
+
 	// mocked responses for headObject
 	HeadObjectOutput *s3.HeadObjectOutput
 	HeadObjectErr    error
@@ -114,6 +156,63 @@ func testMockS3WithPutObjectError(e error) testMockS3Option {
 	}
 }

+func testMockS3WithCreateMultipartUploadOutput(o *s3.CreateMultipartUploadOutput) testMockS3Option {
+	return func(m *testMockS3) error {
+		m.CreateMultipartUploadOutput = o
+		return nil
+	}
+}
+
+func testMockS3WithCreateMultipartUploadError(e error) testMockS3Option {
+	return func(m *testMockS3) error {
+		m.CreateMultipartUploadErr = e
+		return nil
+	}
+}
+
+func testMockS3WithUploadPartOutput(o *s3.UploadPartOutput) testMockS3Option {
+	return func(m *testMockS3) error {
+		m.UploadPartOutput = o
+		return nil
+	}
+}
+
+func testMockS3WithUploadPartError(e error) testMockS3Option {
+	return func(m *testMockS3) error {
+		m.UploadPartErr = e
+		return nil
+	}
+}
+
+func testMockS3WithUploadPartErrorOnPart(partNumber int32, e error) testMockS3Option {
+	return func(m *testMockS3) error {
+		m.UploadPartErr = e
+		m.UploadPartErrOnPart = partNumber
+		return nil
+	}
+}
+
+func testMockS3WithCompleteMultipartUploadOutput(o *s3.CompleteMultipartUploadOutput) testMockS3Option {
+	return func(m *testMockS3) error {
+		m.CompleteMultipartUploadOutput = o
+		return nil
+	}
+}
+
+func testMockS3WithCompleteMultipartUploadError(e error) testMockS3Option {
+	return func(m *testMockS3) error {
+		m.CompleteMultipartUploadErr = e
+		return nil
+	}
+}
+
+func testMockS3WithAbortMultipartUploadError(e error) testMockS3Option {
+	return func(m *testMockS3) error {
+		m.AbortMultipartUploadErr = e
+		return nil
+	}
+}
+
 func testMockS3WithGetObjectOutput(o *s3.GetObjectOutput) testMockS3Option {
 	return func(m *testMockS3) error {
 		m.GetObjectOutput = o
@@ -255,6 +354,95 @@ func (m *testMockS3) PutObject(ctx context.Context, params *s3.PutObjectInput, o
 	return m.PutObjectOutput, nil
 }

+func (m *testMockS3) CreateMultipartUpload(ctx context.Context, params *s3.CreateMultipartUploadInput, optFns ...func(*s3.Options)) (*s3.CreateMultipartUploadOutput, error) {
+	if m.State != nil {
+		m.State.CreateMultipartUploadCalled = true
+		m.State.CreateMultipartUploadInputParams = params
+	}
+
+	if m.CreateMultipartUploadErr != nil {
+		return nil, m.CreateMultipartUploadErr
+	}
+
+	if m.CreateMultipartUploadOutput != nil {
+		return m.CreateMultipartUploadOutput, nil
+	}
+	return &s3.CreateMultipartUploadOutput{
+		UploadId: aws.String("test-upload-id"),
+	}, nil
+}
+
+func (m *testMockS3) UploadPart(ctx context.Context, params *s3.UploadPartInput, optFns ...func(*s3.Options)) (*s3.UploadPartOutput, error) {
+	if m.State != nil {
+		m.State.UploadPartCalled = true
+		m.State.UploadPartCallCount++
+		m.State.UploadPartInputParams = append(m.State.UploadPartInputParams, params)
+	}
+
+	// always drain the body so the part data can be asserted on and so the
+	// reader is not left dangling.
+	var data []byte
+	if params.Body != nil {
+		var err error
+		data, err = io.ReadAll(params.Body)
+		if err != nil {
+			return nil, err
+		}
+		if m.State != nil {
+			m.State.UploadPartBody = append(m.State.UploadPartBody, data...)
+		}
+	}
+
+	if m.UploadPartErr != nil {
+		if m.UploadPartErrOnPart == 0 || (params.PartNumber != nil && *params.PartNumber == m.UploadPartErrOnPart) {
+			return nil, m.UploadPartErr
+		}
+	}
+
+	if m.UploadPartOutput != nil {
+		return m.UploadPartOutput, nil
+	}
+	// echo the supplied part checksum so CompleteMultipartUpload can be built
+	// the way the real service would allow.
+	sum := sha256.Sum256(data)
+	return &s3.UploadPartOutput{
+		ETag:           aws.String(fmt.Sprintf("etag-%d", aws.ToInt32(params.PartNumber))),
+		ChecksumSHA256: aws.String(base64.StdEncoding.EncodeToString(sum[:])),
+	}, nil
+}
+
+func (m *testMockS3) CompleteMultipartUpload(ctx context.Context, params *s3.CompleteMultipartUploadInput, optFns ...func(*s3.Options)) (*s3.CompleteMultipartUploadOutput, error) {
+	if m.State != nil {
+		m.State.CompleteMultipartUploadCalled = true
+		m.State.CompleteMultipartUploadInputParams = params
+	}
+
+	if m.CompleteMultipartUploadErr != nil {
+		return nil, m.CompleteMultipartUploadErr
+	}
+
+	if m.CompleteMultipartUploadOutput != nil {
+		return m.CompleteMultipartUploadOutput, nil
+	}
+	return &s3.CompleteMultipartUploadOutput{}, nil
+}
+
+func (m *testMockS3) AbortMultipartUpload(ctx context.Context, params *s3.AbortMultipartUploadInput, optFns ...func(*s3.Options)) (*s3.AbortMultipartUploadOutput, error) {
+	if m.State != nil {
+		m.State.AbortMultipartUploadCalled = true
+		m.State.AbortMultipartUploadInputParams = params
+	}
+
+	if m.AbortMultipartUploadErr != nil {
+		return nil, m.AbortMultipartUploadErr
+	}
+
+	if m.AbortMultipartUploadOutput != nil {
+		return m.AbortMultipartUploadOutput, nil
+	}
+	return &s3.AbortMultipartUploadOutput{}, nil
+}
+
 func (m *testMockS3) ListObjectsV2(ctx context.Context, params *s3.ListObjectsV2Input, optFns ...func(*s3.Options)) (*s3.ListObjectsV2Output, error) {
 	if m.State != nil {
 		m.State.ListObjectsV2Called = true
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package testing
@@ -22,8 +22,6 @@ import (

 const expectedEc2InstanceCount = 5

-var expectedTags = []string{"foo", "bar", "baz"}
-
 func TestHostPlugin(t *testing.T) {
 	region := os.Getenv("AWS_REGION")
 	if region == "" {
@@ -80,6 +78,14 @@ func TestHostPlugin(t *testing.T) {
 	require.NoError(err)
 	require.Len(ec2InstanceTags, expectedEc2InstanceCount)

+	rawExpectedTags, err := tf.GetOutputSlice("instance_tag_keys")
+	require.NoError(err)
+	require.Len(rawExpectedTags, 3)
+	expectedTags := make([]string, 0, len(rawExpectedTags))
+	for _, rawExpectedTag := range rawExpectedTags {
+		expectedTags = append(expectedTags, rawExpectedTag.(string))
+	}
+
 	// Start the workflow now. Set up the host catalog. Note that this
 	// will cause the state to go out of drift above in the sense that
 	// the access key ID/secret access key will no longer be valid. We
@@ -143,13 +149,13 @@ func TestHostPlugin(t *testing.T) {
 	}

 	cases := [][]string{
-		{"foo"},
-		{"bar"},
-		{"baz"},
-		{"foo", "bar"},
-		{"foo", "baz"},
-		{"bar", "baz"},
-		{"foo", "bar", "baz"},
+		{expectedTags[0]},
+		{expectedTags[1]},
+		{expectedTags[2]},
+		{expectedTags[0], expectedTags[1]},
+		{expectedTags[0], expectedTags[2]},
+		{expectedTags[1], expectedTags[2]},
+		{expectedTags[0], expectedTags[1], expectedTags[2]},
 	}

 	for _, tc := range cases {
@@ -159,6 +165,9 @@ func TestHostPlugin(t *testing.T) {
 		testPluginListHosts(ctx, t, p, region, keyid, secret, tc, expectedTagInstancesMap)
 		// TODO: add OnDeleteSet if it needs to be implemented
 	}
+
+	// finally lets test instance_addresses_only catalog attribute correctly syncs only instance addresses
+	testInstanceAddressesOnlyListHosts(ctx, t, p, tf, region, keyid, secret)
 }

 func testPluginOnCreateCatalog(ctx context.Context, t *testing.T, p *host.HostPlugin, region, accessKeyId, secretAccessKey string, rotate bool) (string, string) {
@@ -444,3 +453,92 @@ func testPluginListHosts(ctx context.Context, t *testing.T, p *host.HostPlugin,
 	// Success
 	t.Logf("testing ListHosts: success (region=%s, tags=%v, expected/actual=(len=%d, ids=%s))", region, tags, len(actualInstances), actualInstances)
 }
+
+func testInstanceAddressesOnlyListHosts(ctx context.Context, t *testing.T, p *host.HostPlugin, tf *TestTerraformer, region, accessKeyId, secretAccessKey string) {
+	t.Helper()
+	t.Logf("testing testInstanceAddressesOnlyListHosts")
+
+	// Get the instance details from tf output
+	instanceID, err := tf.GetOutputString("multi_address_instance_id")
+	require.NoError(t, err)
+	primaryAddresses, err := tf.GetOutputMap("multi_address_primary_addresses")
+	require.NoError(t, err)
+	secondaryAddresses, err := tf.GetOutputMap("multi_address_secondary_addresses")
+	require.NoError(t, err)
+
+	var primary, allAddresses []string
+	for _, addr := range primaryAddresses {
+		primary = append(primary, addr.(string))
+	}
+	allAddresses = append(allAddresses, primary...)
+	for _, addr := range secondaryAddresses {
+		allAddresses = append(allAddresses, addr.(string))
+	}
+
+	cases := []struct {
+		name                  string
+		instanceAddressesOnly bool
+		expectedIPs           []string
+	}{
+		{
+			name:        "all addresses",
+			expectedIPs: allAddresses,
+		},
+		{
+			name:                  "instance addresses only",
+			instanceAddressesOnly: true,
+			expectedIPs:           primary,
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			require := require.New(t)
+
+			catalogAttrMap := map[string]any{
+				credential.ConstRegion:                    region,
+				credential.ConstDisableCredentialRotation: true,
+			}
+			if tc.instanceAddressesOnly {
+				catalogAttrMap[host.ConstInstanceAddressesOnly] = true
+			}
+
+			catalogAttrs, err := structpb.NewStruct(catalogAttrMap)
+			require.NoError(err)
+			setAttrs, err := structpb.NewStruct(map[string]any{
+				host.ConstDescribeInstancesFilters: []any{fmt.Sprintf("instance-id=%s", instanceID)},
+			})
+			require.NoError(err)
+
+			reqPersistedSecrets, err := structpb.NewStruct(map[string]any{
+				credential.ConstAccessKeyId:          accessKeyId,
+				credential.ConstSecretAccessKey:      secretAccessKey,
+				credential.ConstCredsLastRotatedTime: (time.Time{}).Format(time.RFC3339Nano),
+			})
+			require.NoError(err)
+			request := &pb.ListHostsRequest{
+				Catalog: &hostcatalogs.HostCatalog{
+					Attrs: &hostcatalogs.HostCatalog_Attributes{
+						Attributes: catalogAttrs,
+					},
+				},
+				Sets: []*hostsets.HostSet{{
+					Id:    "hostset-0",
+					Attrs: &hostsets.HostSet_Attributes{Attributes: setAttrs},
+				}},
+				Persisted: &pb.HostCatalogPersisted{
+					Secrets: reqPersistedSecrets,
+				},
+			}
+
+			response, err := p.ListHosts(ctx, request)
+			require.NoError(err)
+			require.Len(response.GetHosts(), 1)
+			hostResp := response.GetHosts()[0]
+
+			require.Equal(instanceID, hostResp.ExternalId)
+			require.ElementsMatch(hostResp.IpAddresses, tc.expectedIPs)
+		})
+	}
+}
@@ -1,10 +1,11 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package testing

 import (
 	"context"
+	"fmt"
 	"io"
 	"net"
 	"os"
@@ -85,6 +86,12 @@ func TestStoragePlugin(t *testing.T) {
 	iamSecretAccessKeyMissingDeleteObject, err := tf.GetOutputString("iam_secret_access_key_missing_delete_obj")
 	require.NoError(err)

+	s3PaginationTestObjectCount, err := tf.GetOutput("s3_pagination_test_object_count")
+	require.NoError(err)
+	objectCountFloat, ok := s3PaginationTestObjectCount.(float64)
+	require.True(ok)
+	objectCount := int(objectCountFloat)
+
 	// Start the workflow now. Set up the storage bucket. Note that this
 	// will cause the state to go out of drift above in the sense that
 	// the access key ID/secret access key will no longer be valid. We
@@ -138,6 +145,11 @@ func TestStoragePlugin(t *testing.T) {
 	keyid, secret = iamAccessKeyIds[5].(string), iamSecretAccessKeys[5].(string)
 	testPluginObjectMethods(ctx, t, p, bucketName, region, keyid, secret)

+	// ********************
+	// * ListObjects
+	// ********************
+	testListObjects(ctx, t, p, objectCount, bucketName, region, keyid, secret)
+
 	// ********************
 	// * Validate Permissions
 	// ********************
@@ -514,3 +526,198 @@ func testPluginObjectMethods(ctx context.Context, t *testing.T, p *storage.Stora
 	require.NoError(conn.Close())
 	grpcServer.Stop()
 }
+
+// testListObjects verifies top-level and recursive listing by matching the exact keys and types of returned objects.
+func testListObjects(ctx context.Context, t *testing.T, p *storage.StoragePlugin, objectCount int, bucketName, region, accessKeyId, secretAccessKey string) {
+	t.Helper()
+	t.Logf("testing ListObjects (bucket=%s, region=%s, expectedObjects=%d, creds=%t)",
+		bucketName,
+		region,
+		objectCount,
+		accessKeyId != "" && secretAccessKey != "",
+	)
+	r := require.New(t)
+
+	reqAttrs, err := structpb.NewStruct(map[string]any{
+		credential.ConstRegion:                    region,
+		credential.ConstDisableCredentialRotation: true,
+	})
+	r.NoError(err)
+	reqSecrets, err := structpb.NewStruct(map[string]any{
+		credential.ConstAccessKeyId:     accessKeyId,
+		credential.ConstSecretAccessKey: secretAccessKey,
+	})
+	r.NoError(err)
+
+	bucket := &storagebuckets.StorageBucket{
+		BucketName: bucketName,
+		Attributes: reqAttrs,
+		Secrets:    reqSecrets,
+	}
+
+	// Test Scenario 1: Non-Paginated Listing
+	t.Run("NonPaginatedListing", func(t *testing.T) {
+
+		// Subtest for the non-recursive (top-level) option
+		t.Run("TopLevel", func(t *testing.T) {
+			r := require.New(t)
+			t.Logf("testing ListObjects for a small set with recursive=false")
+			req := &pb.ListObjectsRequest{
+				Bucket:    bucket,
+				KeyPrefix: "list-objects/",
+				Recursive: false,
+			}
+			resp, err := p.ListObjects(ctx, req)
+			r.NoError(err)
+			r.NotNil(resp)
+
+			expectedObjects := []*pb.Object{
+				{Key: "list-objects/file1.txt", IsDir: false},
+				{Key: "list-objects/data.json", IsDir: false},
+				{Key: "list-objects/nested-dir/", IsDir: true},
+				{Key: "list-objects/empty-nested-dir/", IsDir: true},
+			}
+			r.ElementsMatch(resp.Objects, expectedObjects)
+		})
+
+		// Subtest for the recursive option
+		t.Run("Recursive", func(t *testing.T) {
+			r := require.New(t)
+			t.Logf("testing ListObjects for a small set with recursive=true")
+			req := &pb.ListObjectsRequest{
+				Bucket:    bucket,
+				KeyPrefix: "list-objects/",
+				Recursive: true,
+			}
+			resp, err := p.ListObjects(ctx, req)
+			r.NoError(err)
+			r.NotNil(resp)
+
+			expectedObjects := []*pb.Object{
+				{Key: "list-objects/file1.txt", IsDir: false},
+				{Key: "list-objects/data.json", IsDir: false},
+				{Key: "list-objects/nested-dir/file2.txt", IsDir: false},
+				{Key: "list-objects/nested-dir/", IsDir: true},
+				{Key: "list-objects/empty-nested-dir/", IsDir: true},
+			}
+
+			r.ElementsMatch(resp.Objects, expectedObjects)
+		})
+	})
+
+	// Test Scenario 2: Paginated Top-Level Listing
+	t.Run("TopLevelListing", func(t *testing.T) {
+		// Subtest for the root prefix
+		t.Run("AtRoot", func(t *testing.T) {
+			r := require.New(t)
+			t.Logf("testing ListObjects with recursive=false at root prefix")
+			req := &pb.ListObjectsRequest{
+				Bucket:    bucket,
+				KeyPrefix: "list-objects-paginated/",
+				Recursive: false,
+			}
+			resp, err := p.ListObjects(ctx, req)
+			r.NoError(err)
+			r.NotNil(resp)
+
+			var expectedObjects []*pb.Object
+			for i := 0; i < objectCount; i++ {
+				key := fmt.Sprintf("list-objects-paginated/root-file-%d.txt", i)
+				expectedObjects = append(expectedObjects, &pb.Object{Key: key, IsDir: false})
+			}
+			for i := 0; i < objectCount; i++ {
+				keyEmpty := fmt.Sprintf("list-objects-paginated/empty-dir-%d/", i)
+				expectedObjects = append(expectedObjects, &pb.Object{Key: keyEmpty, IsDir: true})
+				keyNested := fmt.Sprintf("list-objects-paginated/nested-dir-%d/", i)
+				expectedObjects = append(expectedObjects, &pb.Object{Key: keyNested, IsDir: true})
+			}
+
+			r.ElementsMatch(resp.Objects, expectedObjects)
+		})
+
+		// Subtest for a nested prefix
+		t.Run("AtNestedPrefix", func(t *testing.T) {
+			r := require.New(t)
+			t.Logf("testing ListObjects with recursive=false at a nested prefix")
+			req := &pb.ListObjectsRequest{
+				Bucket:    bucket,
+				KeyPrefix: "list-objects-paginated/nested-dir-7/",
+				Recursive: false,
+			}
+			resp, err := p.ListObjects(ctx, req)
+			r.NoError(err)
+			r.NotNil(resp)
+
+			expectedObjects := []*pb.Object{
+				{Key: "list-objects-paginated/nested-dir-7/data-file-7.json", IsDir: false},
+			}
+
+			r.ElementsMatch(resp.Objects, expectedObjects)
+		})
+	})
+
+	// Test Scenario 3: Paginated Recursive Listing
+	t.Run("RecursiveListing", func(t *testing.T) {
+		r := require.New(t)
+		t.Logf("testing ListObjects with recursive=true")
+		req := &pb.ListObjectsRequest{
+			Bucket:    bucket,
+			KeyPrefix: "list-objects-paginated/",
+			Recursive: true,
+		}
+		resp, err := p.ListObjects(ctx, req)
+		r.NoError(err)
+		r.NotNil(resp)
+
+		var expectedObjects []*pb.Object
+		for i := 0; i < objectCount; i++ {
+			keyFile := fmt.Sprintf("list-objects-paginated/root-file-%d.txt", i)
+			expectedObjects = append(expectedObjects, &pb.Object{Key: keyFile, IsDir: false})
+			keyNestedFile := fmt.Sprintf("list-objects-paginated/nested-dir-%d/data-file-%d.json", i, i)
+			expectedObjects = append(expectedObjects, &pb.Object{Key: keyNestedFile, IsDir: false})
+		}
+		for i := 0; i < objectCount; i++ {
+			keyNestedDir := fmt.Sprintf("list-objects-paginated/nested-dir-%d/", i)
+			expectedObjects = append(expectedObjects, &pb.Object{Key: keyNestedDir, IsDir: true})
+			keyEmptyDir := fmt.Sprintf("list-objects-paginated/empty-dir-%d/", i)
+			expectedObjects = append(expectedObjects, &pb.Object{Key: keyEmptyDir, IsDir: true})
+			keyNestedEmptyDir := fmt.Sprintf("list-objects-paginated/empty-dir-%d/dir-%d/", i, i)
+			expectedObjects = append(expectedObjects, &pb.Object{Key: keyNestedEmptyDir, IsDir: true})
+		}
+
+		r.ElementsMatch(resp.Objects, expectedObjects)
+	})
+
+	// Test Scenario 4: Edge cases
+	t.Run("EdgeCases", func(t *testing.T) {
+		// Subtest for a prefix that doesn't exist
+		t.Run("NonExistentPrefix", func(t *testing.T) {
+			r := require.New(t)
+			t.Logf("testing ListObjects for a non-existent prefix")
+			req := &pb.ListObjectsRequest{
+				Bucket:    bucket,
+				KeyPrefix: "this/prefix/does/not/exist/",
+				Recursive: false,
+			}
+			resp, err := p.ListObjects(ctx, req)
+			r.NoError(err)
+			r.NotNil(resp)
+			r.Empty(resp.Objects)
+		})
+
+		// Subtest for listing inside a known empty directory
+		t.Run("InsideEmptyDirectory", func(t *testing.T) {
+			r := require.New(t)
+			t.Logf("testing ListObjects inside an empty directory")
+			req := &pb.ListObjectsRequest{
+				Bucket:    bucket,
+				KeyPrefix: "list-objects-paginated/empty-dirs/dir-10/",
+				Recursive: false,
+			}
+			resp, err := p.ListObjects(ctx, req)
+			r.NoError(err)
+			r.NotNil(resp)
+			r.Empty(resp.Objects)
+		})
+	})
+}
@@ -1,24 +1,20 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2021, 2026
 # SPDX-License-Identifier: MPL-2.0

-variable "iam_user_prefix" {
-  default = "boundary-plugin-host-aws-test-iam-user"
-}
-
-variable "iam_user_count" {
-  default = 6
-}
-
 resource "random_id" "aws_iam_user_name" {
  count       = var.iam_user_count
-  prefix      = "${var.iam_user_prefix}-${count.index}"
+  prefix      = "demo-${local.hashicorp_email}-boundary-iam-user"
  byte_length = 4
 }

 resource "aws_iam_user" "user" {
-  count         = var.iam_user_count
-  name          = random_id.aws_iam_user_name[count.index].dec
-  force_destroy = true
+  count                = var.iam_user_count
+  name                 = random_id.aws_iam_user_name[count.index].dec
+  force_destroy        = true
+  permissions_boundary = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/DemoUser"
+  tags = {
+    "boundary-demo" = local.hashicorp_email
+  }
 }

 resource "aws_iam_access_key" "user_initial_key" {
@@ -26,8 +22,13 @@ resource "aws_iam_access_key" "user_initial_key" {
  user  = aws_iam_user.user[count.index].name
 }

+resource "random_id" "aws_ec2_policy_name" {
+  prefix      = "BoundaryPluginHost"
+  byte_length = 4
+}
+
 resource "aws_iam_policy" "ec2_describeinstances" {
-  name = "BoundaryPluginHostAwsTestDescribeInstancesPolicy"
+  name = random_id.aws_ec2_policy_name.dec

  policy = <<EOF
 {
@@ -51,9 +52,15 @@ resource "aws_iam_user_policy_attachment" "user_ec2_describeinstances_attachment
  policy_arn = aws_iam_policy.ec2_describeinstances.arn
 }

+resource "random_id" "aws_iam_policy_name" {
+  count       = var.iam_user_count
+  prefix      = "BoundaryPluginCredentials"
+  byte_length = 4
+}
+
 resource "aws_iam_policy" "user_self_manage_policy" {
  count = var.iam_user_count
-  name  = "BoundaryPluginHostAwsTestUserSelfManagePolicy-${count.index}"
+  name  = random_id.aws_iam_policy_name[count.index].dec

  policy = <<EOF
 {
@@ -1,11 +1,11 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2021, 2026
 # SPDX-License-Identifier: MPL-2.0

 terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
-      version = "~> 3.0"
+      version = "~> 6.0"
    }
  }
 }
@@ -0,0 +1,49 @@
+# Copyright IBM Corp. 2021, 2026
+# SPDX-License-Identifier: MPL-2.0
+
+data "aws_caller_identity" "current" {}
+
+variable "iam_user_count" {
+  default = 6
+}
+
+# We are using a shared account for testing so make sure the stale ec2
+# machine tags don't match for this test run
+resource "random_id" "foo_key" {
+  prefix      = "foo"
+  byte_length = 4
+}
+
+resource "random_id" "bar_key" {
+  prefix      = "bar"
+  byte_length = 4
+}
+
+resource "random_id" "baz_key" {
+  prefix      = "baz"
+  byte_length = 4
+}
+
+locals {
+  hashicorp_email = split(":", data.aws_caller_identity.current.user_id)[1]
+
+  instance_tags = [
+    {
+      "${random_id.foo_key.dec}" = "true"
+    },
+    {
+      "${random_id.foo_key.dec}" = "true"
+      "${random_id.bar_key.dec}" = "true"
+    },
+    {
+      "${random_id.bar_key.dec}" = "true"
+    },
+    {
+      "${random_id.bar_key.dec}" = "true"
+      "${random_id.baz_key.dec}" = "true"
+    },
+    {
+      "${random_id.baz_key.dec}" = "true"
+    },
+  ]
+}
@@ -1,28 +1,6 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2021, 2026
 # SPDX-License-Identifier: MPL-2.0

-variable "instance_tags" {
-  default = [
-    {
-      "foo" = "true",
-    },
-    {
-      "foo" = "true",
-      "bar" = "true",
-    },
-    {
-      "bar" = "true",
-    },
-    {
-      "bar" = "true",
-      "baz" = "true",
-    },
-    {
-      "baz" = "true",
-    },
-  ]
-}
-
 data "aws_availability_zones" "azs" {}

 data "aws_ami" "ubuntu" {
@@ -42,22 +20,117 @@ data "aws_ami" "ubuntu" {
 }

 resource "aws_vpc" "vpc" {
-  cidr_block = "10.0.0.0/16"
+  cidr_block                       = "10.0.0.0/16"
+  assign_generated_ipv6_cidr_block = true
 }

 resource "aws_subnet" "subnet" {
-  vpc_id            = aws_vpc.vpc.id
-  cidr_block        = aws_vpc.vpc.cidr_block
-  availability_zone = data.aws_availability_zones.azs.names[0]
+  vpc_id                          = aws_vpc.vpc.id
+  cidr_block                      = aws_vpc.vpc.cidr_block
+  ipv6_cidr_block                 = cidrsubnet(aws_vpc.vpc.ipv6_cidr_block, 8, 0)
+  availability_zone               = data.aws_availability_zones.azs.names[0]
+  map_public_ip_on_launch         = true
+  assign_ipv6_address_on_creation = true
+}
+
+# Need to add a gateway for public IP addr assignments
+resource "aws_internet_gateway" "igw" {
+  vpc_id = aws_vpc.vpc.id
+}
+
+resource "aws_route_table" "public" {
+  vpc_id = aws_vpc.vpc.id
+
+  route {
+    cidr_block = "0.0.0.0/0"
+    gateway_id = aws_internet_gateway.igw.id
+  }
+
+  route {
+    ipv6_cidr_block = "::/0"
+    gateway_id      = aws_internet_gateway.igw.id
+  }
+}
+
+resource "aws_route_table_association" "public" {
+  subnet_id      = aws_subnet.subnet.id
+  route_table_id = aws_route_table.public.id
 }

 resource "aws_instance" "instances" {
-  count         = length(var.instance_tags)
+  count         = length(local.instance_tags)
  ami           = data.aws_ami.ubuntu.id
  instance_type = "t3.nano"
  subnet_id     = aws_subnet.subnet.id

-  tags = var.instance_tags[count.index]
+  tags = local.instance_tags[count.index]
+}
+
+resource "aws_instance" "multi_address_instance" {
+  ami                         = data.aws_ami.ubuntu.id
+  instance_type               = "t3.nano"
+  subnet_id                   = aws_subnet.subnet.id
+  secondary_private_ips       = ["10.0.10.10"]
+  ipv6_address_count          = 1
+  associate_public_ip_address = true
+
+  tags = {
+    Name            = "boundary-multi-address-instance"
+    "boundary-demo" = local.hashicorp_email
+  }
+}
+
+resource "aws_network_interface" "multi_address_secondary_eni" {
+  subnet_id      = aws_subnet.subnet.id
+  private_ips    = ["10.0.20.10"]
+  ipv6_addresses = [cidrhost(aws_subnet.subnet.ipv6_cidr_block, 32)]
+
+  tags = {
+    Name            = "boundary-multi-address-secondary-eni"
+    "boundary-demo" = local.hashicorp_email
+  }
+}
+
+resource "aws_network_interface_attachment" "multi_address_secondary_eni" {
+  instance_id          = aws_instance.multi_address_instance.id
+  network_interface_id = aws_network_interface.multi_address_secondary_eni.id
+  device_index         = 1
+}
+
+resource "aws_eip" "multi_address_primary" {
+  domain                    = "vpc"
+  network_interface         = aws_instance.multi_address_instance.primary_network_interface_id
+  associate_with_private_ip = aws_instance.multi_address_instance.private_ip
+  depends_on                = [aws_internet_gateway.igw, aws_route_table_association.public]
+
+  tags = {
+    Name            = "boundary-multi-address-primary-eip"
+    "boundary-demo" = local.hashicorp_email
+  }
+}
+
+resource "aws_eip" "multi_address_primary_secondary_private" {
+  domain                    = "vpc"
+  network_interface         = aws_instance.multi_address_instance.primary_network_interface_id
+  associate_with_private_ip = "10.0.10.10"
+  depends_on                = [aws_internet_gateway.igw, aws_route_table_association.public, aws_instance.multi_address_instance]
+
+  tags = {
+    Name            = "boundary-multi-address-primary-secondary-eip"
+    "boundary-demo" = local.hashicorp_email
+  }
+}
+
+resource "aws_eip" "multi_address_secondary_eni" {
+  domain                    = "vpc"
+  network_interface         = aws_network_interface.multi_address_secondary_eni.id
+  associate_with_private_ip = "10.0.20.10"
+  depends_on                = [aws_internet_gateway.igw, aws_route_table_association.public, aws_network_interface_attachment.multi_address_secondary_eni]
+
+  tags = {
+    Name            = "boundary-multi-address-secondary-eni-eip"
+    "boundary-demo" = local.hashicorp_email
+  }
 }

 output "instance_ids" {
@@ -74,4 +147,34 @@ output "instance_tags" {
  value = {
    for _, r in aws_instance.instances : r.id => r.tags
  }
-}
+}
+
+output "instance_tag_keys" {
+  value = [
+    random_id.foo_key.dec,
+    random_id.bar_key.dec,
+    random_id.baz_key.dec,
+  ]
+}
+
+output "multi_address_instance_id" {
+  value = aws_instance.multi_address_instance.id
+}
+
+output "multi_address_primary_addresses" {
+  value = {
+    private_ip = aws_instance.multi_address_instance.private_ip
+    public_ip  = aws_eip.multi_address_primary.public_ip
+    ipv6       = tolist(aws_instance.multi_address_instance.ipv6_addresses)[0]
+  }
+}
+
+output "multi_address_secondary_addresses" {
+  value = {
+    primary_eni_private_ip   = "10.0.10.10"
+    primary_eni_public_ip    = aws_eip.multi_address_primary_secondary_private.public_ip
+    secondary_eni_private_ip = aws_network_interface.multi_address_secondary_eni.private_ip
+    secondary_eni_public_ip  = aws_eip.multi_address_secondary_eni.public_ip
+    secondary_eni_ipv6       = tolist(aws_network_interface.multi_address_secondary_eni.ipv6_addresses)[0]
+  }
+}
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2021, 2026
 # SPDX-License-Identifier: MPL-2.0

 resource "random_id" "foo" {
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2021, 2026
 # SPDX-License-Identifier: MPL-2.0

 resource "aws_iam_role" "valid" {
@@ -34,10 +34,18 @@ resource "aws_iam_policy" "valid" {
        "s3:GetObject",
        "s3:DeleteObject",
        "s3:GetObjectAttributes",
-        "s3:ListBucket"
+        "s3:ListBucket",
+        "s3:DeleteObject"
      ],
      "Effect": "Allow",
      "Resource": "${aws_s3_bucket.test.arn}*"
+    },
+    {
+      "Action": [
+        "s3:ListBucket"
+      ],
+      "Effect": "Allow",
+      "Resource": "${aws_s3_bucket.test.arn}"
    }
  ]

@@ -196,7 +204,7 @@ resource "aws_iam_role_policy_attachment" "missing_delete_obj" {
 # Static Credential Testing
 resource "random_id" "user_name" {
  count       = var.iam_user_count
-  prefix      = "demo-${local.hashicorp_email}-boundary-iam-user"
+  prefix      = "demo-${local.hashicorp_email}" # Do Not Remove/Edit. This is a requirement to obtain access in creating a iam user in the dev account.
  byte_length = 4
 }

@@ -204,10 +212,8 @@ resource "aws_iam_user" "test" {
  count                = var.iam_user_count
  name                 = random_id.user_name[count.index].dec
  force_destroy        = true
-  permissions_boundary = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/DemoUser"
-  tags = {
-    "boundary-demo" = local.hashicorp_email
-  }
+  permissions_boundary = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/DemoUser" # Do Not Remove/Edit. This is a requirement to obtain access in creating a iam user in the dev account.
+  tags                 = local.tags
 }

 resource "aws_iam_access_key" "test" {
@@ -277,17 +283,15 @@ resource "aws_iam_user_policy_attachment" "missing_delete_obj" {
 # Edge case for missing GetObject permission

 resource "random_id" "missing_get_obj" {
-  prefix      =  "demo-${local.hashicorp_email}-boundary-iam-user"
+  prefix      = "demo-${local.hashicorp_email}" # Do Not Remove/Edit. This is a requirement to obtain access in creating a iam user in the dev account.
  byte_length = 4
 }

 resource "aws_iam_user" "missing_get_obj" {
-  name          = random_id.missing_get_obj.dec
-  force_destroy = true
-  permissions_boundary = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/DemoUser"
-  tags = {
-    "boundary-demo" = local.hashicorp_email
-  }
+  name                 = random_id.missing_get_obj.dec
+  force_destroy        = true
+  permissions_boundary = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/DemoUser" # Do Not Remove/Edit. This is a requirement to obtain access in creating a iam user in the dev account.
+  tags                 = local.tags
 }

 resource "aws_iam_access_key" "missing_get_obj" {
@@ -302,17 +306,15 @@ resource "aws_iam_user_policy_attachment" "missing_get_obj" {
 # Edge case for missing PutObject permission

 resource "random_id" "missing_put_obj" {
-  prefix      =  "demo-${local.hashicorp_email}-boundary-iam-user"
+  prefix      = "demo-${local.hashicorp_email}" # Do Not Remove/Edit. This is a requirement to obtain access in creating a iam user in the dev account.
  byte_length = 4
 }

 resource "aws_iam_user" "missing_put_obj" {
-  name          = random_id.missing_put_obj.dec
-  force_destroy = true
-  permissions_boundary = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/DemoUser"
-  tags = {
-    "boundary-demo" = local.hashicorp_email
-  }
+  name                 = random_id.missing_put_obj.dec
+  force_destroy        = true
+  permissions_boundary = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/DemoUser" # Do Not Remove/Edit. This is a requirement to obtain access in creating a iam user in the dev account.
+  tags                 = local.tags
 }

 resource "aws_iam_access_key" "missing_put_obj" {
@@ -1,11 +1,11 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2021, 2026
 # SPDX-License-Identifier: MPL-2.0

 terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
-      version = "~> 3.0"
+      version = "~> 6.0"
    }
  }
 }
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2021, 2026
 # SPDX-License-Identifier: MPL-2.0

 output "bucket_name" {
@@ -6,19 +6,19 @@ output "bucket_name" {
 }

 output "valid_policy_arn" {
-    value = aws_iam_role.valid.arn
+  value = aws_iam_role.valid.arn
 }

 output "missing_put_obj_policy_arn" {
-    value = aws_iam_role.missing_put_obj.arn
+  value = aws_iam_role.missing_put_obj.arn
 }

 output "missing_get_obj_policy_arn" {
-    value = aws_iam_role.missing_get_obj.arn
+  value = aws_iam_role.missing_get_obj.arn
 }

 output "missing_delete_obj_policy_arn" {
-    value = aws_iam_role.missing_delete_obj.arn
+  value = aws_iam_role.missing_delete_obj.arn
 }

 output "iam_user_names" {
@@ -67,4 +67,9 @@ output "iam_access_key_missing_delete_obj" {
 output "iam_secret_access_key_missing_delete_obj" {
  value     = aws_iam_access_key.missing_delete_obj.secret
  sensitive = true
-}
+}
+
+output "s3_pagination_test_object_count" {
+  description = "The number of S3 objects created for each pagination test scenario."
+  value       = local.s3_pagination_test_object_count
+}
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2021, 2026
 # SPDX-License-Identifier: MPL-2.0

 resource "aws_s3_bucket" "test" {
@@ -9,9 +9,17 @@ resource "aws_s3_bucket" "test" {

 resource "aws_s3_bucket_public_access_block" "secure_access" {
  bucket = aws_s3_bucket.test.id
-  
+
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
-}
+}
+resource "aws_s3_object" "s3_files" {
+  for_each = local.s3_files
+
+  bucket  = aws_s3_bucket.test.id
+  key     = each.key
+  content = each.value
+  tags    = local.tags
+}
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2021, 2026
 # SPDX-License-Identifier: MPL-2.0

 data "aws_caller_identity" "current" {}
@@ -16,7 +16,47 @@ locals {
  hashicorp_email = split(":", data.aws_caller_identity.current.user_id)[1]
  tags = {
    User        = split(":", data.aws_caller_identity.current.user_id)[1]
-    Repo        = "boundary-plugin-aws" 
+    Repo        = "boundary-plugin-aws"
    Environment = "Demo"
  }
+
+  # total number of objects of each type to create
+  s3_pagination_test_object_count = 350
+  # Dynamically build a flat map of S3 objects:
+  # - root-level text files
+  # - nested JSON files
+  # - placeholder "empty directories"
+  # - some static files in list-objects directory
+  # This map is consumed directly by an aws_s3_object resource
+  s3_files = merge(
+    # Root-level text files
+    {
+      for i in range(local.s3_pagination_test_object_count) :
+      "list-objects-paginated/root-file-${i}.txt" => "This is a root-level file #${i}."
+    },
+
+    # Nested JSON files inside sub-directories
+    {
+      for i in range(local.s3_pagination_test_object_count) :
+      "list-objects-paginated/nested-dir-${i}/data-file-${i}.json" =>
+      jsonencode({
+        id      = i,
+        message = "This is a nested JSON file #${i}."
+      })
+    },
+
+    # "Empty" directories (in S3 these are just placeholder objects ending with `/`)
+    {
+      for i in range(local.s3_pagination_test_object_count) :
+      "list-objects-paginated/empty-dir-${i}/dir-${i}/" => "" # zero-length object to mimic directory
+    },
+
+    # Static example files in list-objects directory
+    {
+      "list-objects/file1.txt"            = "This is the content for file 1."
+      "list-objects/data.json"            = jsonencode({ key = "value", items = [1, 2, 3] })
+      "list-objects/nested-dir/file2.txt" = "This is a nested file."
+      "list-objects/empty-nested-dir/"    = ""
+    }
+  )
 }
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package testing
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package testing
Author	SHA1	Message	Date
Delaine Rogers	3a6ede4909	demo unit tests showing the bug	2026-08-04 16:25:54 -07:00
Susmitha Girumala	163ec69771	Update github test workflow permissions to read-only (#76 ) Set GITHUB_TOKEN to read-only permission by default	2026-07-14 15:31:58 -04:00
Piotr KazmierczakandHugo	e8a0b0bf10	feat(storage): support multipart uploads (#72 ) This changeset implements multipart uploads. AWS caps PutObject calls at 5 GiB, effectively causing the plugin to error on any upload larger than that. Multipart limit is 8 TiB, which should be plenty for most use cases. Multipart implementation is size-gated: we only switch to multipart uploads once the file size is greater than multipartThreshold, which is currently set to 8 MiB, and we set the part size to 8 MiB as well (this follows AWS CLI and boto3). That gives us ~78 GiB max object before we auto-scale, due to 10,000 part cap on AWS. --------- Co-authored-by: Hugo <10965479+hugoghx@users.noreply.github.com>	2026-06-26 16:34:32 +02:00
Damian Debkowski	4c8e95fcd8	fix: improve http transport (#73 )	2026-06-24 07:12:41 -07:00
Louis Ruch	01f8da94e4	feat(host): add catalog attribute to only sync instance primary addresses (#71 ) * feat(host): add catalog attribute to only sync instance primary addresses	2026-05-27 13:12:34 -07:00
aditya2548	241901319d	feat: add ListObjects method & relevant e2e tests	2026-05-14 14:55:01 -05:00
Louis Ruch	56f89a5dcf	test(host): update e2e testing to support shared test enviro creds (#69 )	2026-05-14 10:59:38 -07:00
hashicorp-copywrite[bot]	5b7b669b41	[COMPLIANCE] Add/Update Copyright Headers (#68 ) Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com>	2026-05-11 22:37:05 -07:00
dependabot[bot]	7b4ee7f403	build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 (#66 ) Bumps [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2) from 1.69.0 to 1.97.3. - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](https://github.com/aws/aws-sdk-go-v2/compare/service/s3/v1.69.0...service/s3/v1.97.3) --- updated-dependencies: - dependency-name: github.com/aws/aws-sdk-go-v2/service/s3 dependency-version: 1.97.3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-22 21:14:09 -07:00
dependabot[bot]	916324ee64	build(deps): bump google.golang.org/grpc from 1.68.0 to 1.79.3 (#65 ) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.68.0 to 1.79.3. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.68.0...v1.79.3) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.79.3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-22 21:09:52 -07:00
dependabot[bot]	11d3d6d523	build(deps): bump golang.org/x/crypto from 0.36.0 to 0.45.0 (#62 ) Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.36.0 to 0.45.0. - [Commits](https://github.com/golang/crypto/compare/v0.36.0...v0.45.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.45.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-01-25 22:10:57 -08:00
oss-core-libraries-dashboard[bot]andhashicorp-copywrite[bot]	4758d5d9cd	[COMPLIANCE] Update Copyright and License Headers (Batch 1 of 1) (#64 ) Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com>	2026-01-16 15:56:19 -08:00
Emilia	42e2126217	fix: Allow shared credentials in GenerateCredentialChain (#63 ) * allow shared creds * fix non-const printf format strings for go 1.24 * add .env and .envrc to .gitignore	2025-12-04 12:46:02 -05:00
Katrina Schwark	5d098ac71d	Add PCI review checklist to PR template (#61 )	2025-06-30 11:57:23 -06:00
dependabot[bot]	949976ec19	build(deps): bump golang.org/x/net from 0.36.0 to 0.38.0 (#60 ) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.36.0 to 0.38.0. - [Commits](https://github.com/golang/net/compare/v0.36.0...v0.38.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.38.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-04-16 16:23:17 -07:00
dependabot[bot]	49f692e7a8	build(deps): bump golang.org/x/net from 0.33.0 to 0.36.0 (#59 ) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.33.0 to 0.36.0. - [Commits](https://github.com/golang/net/compare/v0.33.0...v0.36.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-03-17 09:58:09 -07:00