bug(go) gRPC status codes were getting overwritten by the handlers (#94 )

* bug(go) gRPC status codes were getting overwritten by the handlers **Problem** * If the gRPC handlers received an error with a gRPC status code from checkHosts, it got overwritten by a plain error value. **Solution** * Added a check to each checkHosts call that passes on the error received (with its gRPC status) **Testing** * Added new unit tests for when the handlers receive an error from checkHosts with a status code. * Existing unit tests and terraform tests passed
feat(tests) Add Terraform testing to support Cross-account discovery (#89 )
2026-09-28 12:03:41 -05:00 · 2026-09-28 12:03:02 -05:00 · 2026-09-28 12:02:46 -05:00 · 2026-09-28 12:02:31 -05:00 · 2026-09-28 12:01:53 -05:00 · 2026-09-28 12:01:06 -05:00
27 changed files with 3536 additions and 537 deletions
@@ -4,6 +4,8 @@ on:
  - workflow_dispatch
  - push

+permissions: read-all
+
 jobs:
  test:
    runs-on: ubuntu-latest
@@ -25,6 +25,8 @@ Credential rotation can be turned off by setting the
 This plugin will attempt to assume a role when a `role_arn` is supplied through the
 `attributes` object. More information about assume an AWS role can be found [here](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html). This feature only works when the plugin is running on a self managed Boundary [worker](https://developer.hashicorp.com/boundary/tutorials/hcp-administration/hcp-manage-workers).

+To discover hosts across multiple AWS accounts, supply a `target_role_arn` in addition to `role_arn`. The plugin uses the principal credentials to assume the target role via a two-hop `AssumeRole` chain, enabling cross-account host discovery from a single worker. See [Attributes and Secrets](plugin/service/host/README.md#attributes-and-secrets) for the full list of `target_*` attributes.
+
 ### Environment Credentials

 This plugin will attempt to retrieve credentials from environment variables. More
@@ -4,6 +4,7 @@ go 1.25.7

 require (
 	github.com/aws/aws-sdk-go-v2 v1.41.7
+	github.com/aws/aws-sdk-go-v2/credentials v1.17.46
 	github.com/aws/aws-sdk-go-v2/service/ec2 v1.254.0
 	github.com/aws/aws-sdk-go-v2/service/iam v1.47.6
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.101.0
@@ -13,7 +14,7 @@ require (
 	github.com/google/uuid v1.6.0
 	github.com/hashicorp/boundary/sdk v0.0.59
 	github.com/hashicorp/go-multierror v1.1.1
-	github.com/hashicorp/go-secure-stdlib/awsutil/v2 v2.1.2
+	github.com/hashicorp/go-secure-stdlib/awsutil/v2 v2.1.3
 	github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0
 	github.com/hashicorp/terraform-json v0.23.0
 	github.com/mitchellh/mapstructure v1.5.0
@@ -26,7 +27,6 @@ require (
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.10 // indirect
 	github.com/aws/aws-sdk-go-v2/config v1.28.5 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.17.46 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.20 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23 // indirect
@@ -8,12 +8,8 @@ github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew
 github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
 github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI=
 github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
-github.com/aws/aws-sdk-go-v2 v1.39.1 h1:fWZhGAwVRK/fAN2tmt7ilH4PPAE11rDj7HytrmbZ2FE=
-github.com/aws/aws-sdk-go-v2 v1.39.1/go.mod h1:sDioUELIUO9Znk23YVmIk86/9DOpkbyyVb1i/gUNFXY=
 github.com/aws/aws-sdk-go-v2 v1.41.7 h1:DWpAJt66FmnnaRIOT/8ASTucrvuDPZASqhhLey6tLY8=
 github.com/aws/aws-sdk-go-v2 v1.41.7/go.mod h1:4LAfZOPHNVNQEckOACQx60Y8pSRjIkNZQz1w92xpMJc=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.1 h1:i8p8P4diljCr60PpJp6qZXNlgX4m2yQFpYk+9ZT+J4E=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.1/go.mod h1:ddqbooRZYNoJ2dsTwOty16rM+/Aqmk/GOXrK8cg7V00=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.10 h1:gx1AwW1Iyk9Z9dD9F4akX5gnN3QZwUB20GGKH/I+Rho=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.10/go.mod h1:qqY157uZoqm5OXq/amuaBJyC9hgBCBQnsaWnPe905GY=
 github.com/aws/aws-sdk-go-v2/config v1.28.5 h1:Za41twdCXbuyyWv9LndXxZZv3QhTG1DinqlFsSuvtI0=
@@ -22,42 +18,26 @@ github.com/aws/aws-sdk-go-v2/credentials v1.17.46 h1:AU7RcriIo2lXjUfHFnFKYsLCwgb
 github.com/aws/aws-sdk-go-v2/credentials v1.17.46/go.mod h1:1FmYyLGL08KQXQ6mcTlifyFXfJVCNJTVGuQP4m0d/UA=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.20 h1:sDSXIrlsFSFJtWKLQS4PUWRvrT580rrnuLydJrCQ/yA=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.20/go.mod h1:WZ/c+w0ofps+/OUqMwWgnfrgzZH1DZO1RIkktICsqnY=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.8 h1:6bgAZgRyT4RoFWhxS+aoGMFyE0cD1bSzFnEEi4bFPGI=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.8/go.mod h1:KcGkXFVU8U28qS4KvLEcPxytPZPBcRawaH2Pf/0jptE=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23 h1:GpT/TrnBYuE5gan2cZbTtvP+JlHsutdmlV2YfEyNde0=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23/go.mod h1:xYWD6BS9ywC5bS3sz9Xh04whO/hzK2plt2Zkyrp4JuA=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.8 h1:HhJYoES3zOz34yWEpGENqJvRVPqpmJyR3+AFg9ybhdY=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.8/go.mod h1:JnA+hPWeYAVbDssp83tv+ysAG8lTfLVXvSsyKg/7xNA=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23 h1:bpd8vxhlQi2r1hiueOw02f/duEPTMK59Q4QMAoTTtTo=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23/go.mod h1:15DfR2nw+CRHIk0tqNyifu3G1YdAOy68RftkhMDDwYk=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1 h1:VaRN3TlFdd6KxX1x3ILT5ynH6HvKgqdiXoTxAF4HQcQ=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1/go.mod h1:FbtygfRFze9usAadmnGJNc8KsP346kEe+y2/oyhGAGc=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.8 h1:1/bT9kDdLQzfZ1e6J6hpW+SfNDd6xrV8F3M2CuGyUz8=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.8/go.mod h1:RbdwTONAIi59ej/+1H+QzZORt5bcyAtbrS7FQb2pvz0=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24 h1:OQqn11BtaYv1WLUowvcA30MpzIu8Ti4pcLPIIyoKZrA=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24/go.mod h1:X5ZJyfwVrWA96GzPmUCWFQaEARPR7gCrpq2E92PJwAE=
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.254.0 h1:fTLR6dLDTGChAjecRPlVrKeznT0rVdzR4yn9Z68MTGk=
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.254.0/go.mod h1:V0jbRy1/IPapnkqgXSwVOFB+u5pnCwd9S+R3pKWULC4=
 github.com/aws/aws-sdk-go-v2/service/iam v1.47.6 h1:EWehQXACWr+6hzfZPwZChlfoVhiUCfLHE0Xh3kAfzWQ=
 github.com/aws/aws-sdk-go-v2/service/iam v1.47.6/go.mod h1:qRXgEBWPIltrWHQwU+HkyBvwh1QgeigFcaCGCIVrWk0=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 h1:oegbebPEMA/1Jny7kvwejowCaHz1FWZAQ94WXFNCyTM=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1/go.mod h1:kemo5Myr9ac0U9JfSjMo9yHLtw+pECEHsFtJ9tqCEI8=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9 h1:FLudkZLt5ci0ozzgkVo8BJGwvqNaZbTWb3UcucAateA=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9/go.mod h1:w7wZ/s9qK7c8g4al+UyoF1Sp/Z45UwMGcqIzLWVQHWk=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.8.8 h1:tIN8MFT1z5STK5kTdOT1TCfMN/bn5fSEnlKsTL8qBOU=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.8.8/go.mod h1:VKS56txtNWjKI8FqD/hliL0BcshyF4ZaLBa1rm2Y+5s=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.15 h1:ieLCO1JxUWuxTZ1cRd0GAaeX7O6cIxnwk7tc1LsQhC4=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.15/go.mod h1:e3IzZvQ3kAWNykvE0Tr0RDZCMFInMvhku3qNpcIQXhM=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.8 h1:M6JI2aGFEzYxsF6CXIuRBnkge9Wf9a2xU39rNeXgu10=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.8/go.mod h1:Fw+MyTwlwjFsSTE31mH211Np+CUslml8mzc0AFEG09s=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23 h1:pbrxO/kuIwgEsOPLkaHu0O+m4fNgLU8B3vxQ+72jTPw=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23/go.mod h1:/CMNUqoj46HpS3MNRDEDIwcgEnrtZlKRaHNaHxIFpNA=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.8 h1:AgYCo1Rb8XChJXA871BXHDNxNWOTAr6V5YdsRIBbgv0=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.8/go.mod h1:Au9dvIGm1Hbqnt29d3VakOCQuN9l0WrkDDTRq8biWS4=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.23 h1:03xatSQO4+AM1lTAbnRg5OK528EUg744nW7F73U8DKw=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.23/go.mod h1:M8l3mwgx5ToK7wot2sBBce/ojzgnPzZXUV445gTSyE8=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.88.2 h1:T7b3qniouutV5Wwa9B1q7gW+Y8s1B3g9RE9qa7zLBIM=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.88.2/go.mod h1:tW9TsLb6t1eaTdBE6LITyJW1m/+DjQPU78Q/jT2FJu8=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.101.0 h1:etqBTKY581iwLL/H/S2sVgk3C9lAsTJFeXWFDsDcWOU=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.101.0/go.mod h1:L2dcoOgS2VSgbPLvpak2NyUPsO1TBN7M45Z4H7DlRc4=
 github.com/aws/aws-sdk-go-v2/service/sso v1.24.6 h1:3zu537oLmsPfDMyjnUS2g+F2vITgy5pB74tHI+JBNoM=
@@ -66,8 +46,6 @@ github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.5 h1:K0OQAsDywb0ltlFrZm0JHPY3
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.5/go.mod h1:ORITg+fyuMoeiQFiVGoqB3OydVTLkClw/ljbblMq6Cc=
 github.com/aws/aws-sdk-go-v2/service/sts v1.38.5 h1:+LVB0xBqEgjQoqr9bGZbRzvg212B0f17JdflleJRNR4=
 github.com/aws/aws-sdk-go-v2/service/sts v1.38.5/go.mod h1:xoaxeqnnUaZjPjaICgIy5B+MHCSb/ZSOn4MvkFNOUA0=
-github.com/aws/smithy-go v1.23.0 h1:8n6I3gXzWJB2DxBDnfxgBaSX6oe0d/t10qGz7OKqMCE=
-github.com/aws/smithy-go v1.23.0/go.mod h1:t1ufH5HMublsJYulve2RKmHDC15xu1f26kHCp/HgceI=
 github.com/aws/smithy-go v1.25.1 h1:J8ERsGSU7d+aCmdQur5Txg6bVoYelvQJgtZehD12GkI=
 github.com/aws/smithy-go v1.25.1/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/bgentry/speakeasy v0.1.0 h1:ByYyxL9InA1OWqxJqqp2A5pYHUrCiAL6K3J+LKSsQkY=
@@ -116,8 +94,8 @@ github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+l
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/hashicorp/go-plugin v1.7.0 h1:YghfQH/0QmPNc/AZMTFE3ac8fipZyZECHdDPshfk+mA=
 github.com/hashicorp/go-plugin v1.7.0/go.mod h1:BExt6KEaIYx804z8k4gRzRLEvxKVb+kn0NMcihqOqb8=
-github.com/hashicorp/go-secure-stdlib/awsutil/v2 v2.1.2 h1:KlDrZWx/wYpnUcFPB0s9uhPjyNZoeIfhrV2MN/Ly76s=
-github.com/hashicorp/go-secure-stdlib/awsutil/v2 v2.1.2/go.mod h1:6+rVulOPNCQbL3Xv2iLCqM0JmU2WO2wRzP1C6hBKeB8=
+github.com/hashicorp/go-secure-stdlib/awsutil/v2 v2.1.3 h1:mLe7IMysLSedhuu00W7AXsbfb90AA7UKfZmw3OkJ8n4=
+github.com/hashicorp/go-secure-stdlib/awsutil/v2 v2.1.3/go.mod h1:6+rVulOPNCQbL3Xv2iLCqM0JmU2WO2wRzP1C6hBKeB8=
 github.com/hashicorp/go-secure-stdlib/base62 v0.1.2 h1:ET4pqyjiGmY09R5y+rSd70J2w45CtbWDNvGqWp/R3Ng=
 github.com/hashicorp/go-secure-stdlib/base62 v0.1.2/go.mod h1:EdWO6czbmthiwZ3/PUsDV+UD1D5IRU4ActiaWGwt0Yw=
 github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.13 h1:TayxZ5drfMP0G6T++WvnLESGLOWeHtdWDWWTAi2e3Qk=
@@ -186,3 +186,63 @@ func GetCredentialAttributes(in *structpb.Struct) (*CredentialAttributes, error)
 		RoleTags:                  roleTags,
 	}, nil
 }
+
+// GetTargetCredentialAttributes parses values out of a protobuf struct input and returns a CredentialAttributes used
+// for configuring a second AWS session. target_role_arn is required when parsing target credentials.
+// A status error is returned with an InvalidArgument code when target account attributes are missing
+// required values or have invalid value types.
+func GetTargetCredentialAttributes(in *structpb.Struct) (*CredentialAttributes, error) {
+	badFields := make(map[string]string)
+
+	// Parse the role ARN of the target account to AssumeRole into.
+	targetRoleArn, err := values.GetStringValue(in, ConstTargetRoleArn, true)
+	if err != nil {
+		badFields[fmt.Sprintf("attributes.%s", ConstTargetRoleArn)] = err.Error()
+	}
+
+	// try parsing target_region, fallback to region, adds target_region to bad fields only when malformed since not required
+	targetRegion, err := values.GetStringValue(in, ConstTargetRegion, false)
+	if err != nil {
+		badFields[fmt.Sprintf("attributes.%s", ConstTargetRegion)] = err.Error()
+	}
+	if targetRegion == "" {
+		targetRegion, err = values.GetStringValue(in, ConstRegion, true) // region is required for processing
+		if err != nil {
+			badFields[fmt.Sprintf("attributes.%s", ConstRegion)] = err.Error()
+		}
+	}
+
+	// the remaining fields are optional and only raise errors when malformed
+	disableCredentialRotation, err := values.GetBoolValue(in, ConstDisableCredentialRotation, false)
+	if err != nil {
+		badFields[fmt.Sprintf("attributes.%s", ConstDisableCredentialRotation)] = err.Error()
+	}
+
+	targetRoleExternalId, err := values.GetStringValue(in, ConstTargetRoleExternalId, false)
+	if err != nil {
+		badFields[fmt.Sprintf("attributes.%s", ConstTargetRoleExternalId)] = err.Error()
+	}
+
+	targetRoleSessionName, err := values.GetStringValue(in, ConstTargetRoleSessionName, false)
+	if err != nil {
+		badFields[fmt.Sprintf("attributes.%s", ConstTargetRoleSessionName)] = err.Error()
+	}
+
+	targetRoleTags, err := values.GetMapStringString(in, ConstTargetRoleTags, false)
+	if err != nil {
+		badFields[fmt.Sprintf("attributes.%s", ConstTargetRoleTags)] = err.Error()
+	}
+
+	if len(badFields) > 0 {
+		return nil, errors.InvalidArgumentError("Error in the attributes provided", badFields)
+	}
+
+	return &CredentialAttributes{
+		Region:                    targetRegion,
+		DisableCredentialRotation: disableCredentialRotation,
+		RoleArn:                   targetRoleArn,
+		RoleExternalId:            targetRoleExternalId,
+		RoleSessionName:           targetRoleSessionName,
+		RoleTags:                  targetRoleTags,
+	}, nil
+}
@@ -101,6 +101,232 @@ func TestGetCredentialAttributes(t *testing.T) {
 	}
 }

+func TestGetTargetCredentialAttributes(t *testing.T) {
+	const targetRoleArn = "arn:aws:iam::222222222222:role/Target"
+
+	cases := []struct {
+		name                string
+		in                  map[string]any
+		expected            *CredentialAttributes
+		expectedErrContains string
+	}{
+		{
+			name: "missing target_role_arn",
+			in: map[string]any{
+				ConstRegion: "us-west-2",
+			},
+			expectedErrContains: "attributes.target_role_arn: missing required value \"target_role_arn\"",
+		},
+		{
+			name:                "missing target_role_arn and region",
+			in:                  map[string]any{},
+			expectedErrContains: "attributes.target_role_arn: missing required value \"target_role_arn\"",
+		},
+		{
+			name: "empty target_role_arn",
+			in: map[string]any{
+				ConstRegion:        "us-west-2",
+				ConstTargetRoleArn: "",
+			},
+			expectedErrContains: "attributes.target_role_arn: value \"target_role_arn\" cannot be empty",
+		},
+		{
+			name: "wrong type target_role_arn",
+			in: map[string]any{
+				ConstRegion:        "us-west-2",
+				ConstTargetRoleArn: true,
+			},
+			expectedErrContains: "attributes.target_role_arn: unexpected type for value \"target_role_arn\": want string, got bool",
+		},
+		{
+			name: "target_region without target_role_arn",
+			in: map[string]any{
+				ConstRegion:       "us-west-2",
+				ConstTargetRegion: "eu-west-1",
+			},
+			expectedErrContains: "attributes.target_role_arn: missing required value \"target_role_arn\"",
+		},
+		{
+			name: "other target fields without target_role_arn",
+			in: map[string]any{
+				ConstRegion:                "us-west-2",
+				ConstTargetRoleExternalId:  "ext",
+				ConstTargetRoleSessionName: "sess",
+				ConstTargetRoleTags:        map[string]any{"k": "v"},
+			},
+			expectedErrContains: "attributes.target_role_arn: missing required value \"target_role_arn\"",
+		},
+		{
+			name: "target_role_arn uses region when target_region omitted",
+			in: map[string]any{
+				ConstRegion:        "us-west-2",
+				ConstTargetRoleArn: targetRoleArn,
+			},
+			expected: &CredentialAttributes{
+				Region:  "us-west-2",
+				RoleArn: targetRoleArn,
+			},
+		},
+		{
+			name: "target_role_arn without target_region or region",
+			in: map[string]any{
+				ConstTargetRoleArn: targetRoleArn,
+			},
+			expectedErrContains: "missing required value \"region\"",
+		},
+		{
+			name: "target_region overrides region",
+			in: map[string]any{
+				ConstRegion:        "us-west-2",
+				ConstTargetRegion:  "eu-west-1",
+				ConstTargetRoleArn: targetRoleArn,
+			},
+			expected: &CredentialAttributes{
+				Region:  "eu-west-1",
+				RoleArn: targetRoleArn,
+			},
+		},
+		{
+			name: "empty target_region falls back to region",
+			in: map[string]any{
+				ConstRegion:        "us-west-2",
+				ConstTargetRegion:  "",
+				ConstTargetRoleArn: targetRoleArn,
+			},
+			expected: &CredentialAttributes{
+				Region:  "us-west-2",
+				RoleArn: targetRoleArn,
+			},
+		},
+		{
+			name: "all optional target fields",
+			in: map[string]any{
+				ConstRegion:                    "us-west-2",
+				ConstDisableCredentialRotation: true,
+				ConstTargetRoleArn:             targetRoleArn,
+				ConstTargetRegion:              "eu-west-1",
+				ConstTargetRoleExternalId:      "target-ext",
+				ConstTargetRoleSessionName:     "target-sess",
+				ConstTargetRoleTags:            map[string]any{"env": "target"},
+			},
+			expected: &CredentialAttributes{
+				Region:                    "eu-west-1",
+				DisableCredentialRotation: true,
+				RoleArn:                   targetRoleArn,
+				RoleExternalId:            "target-ext",
+				RoleSessionName:           "target-sess",
+				RoleTags:                  map[string]string{"env": "target"},
+			},
+		},
+		{
+			name: "optional target fields omitted do not copy principal role fields",
+			in: map[string]any{
+				ConstRegion:          "us-west-2",
+				ConstRoleArn:         "arn:aws:iam::111111111111:role/Principal",
+				ConstRoleExternalId:  "principal-ext",
+				ConstRoleSessionName: "principal-sess",
+				ConstRoleTags:        map[string]any{"env": "principal"},
+				ConstTargetRoleArn:   targetRoleArn,
+			},
+			expected: &CredentialAttributes{
+				Region:  "us-west-2",
+				RoleArn: targetRoleArn,
+			},
+		},
+		{
+			name: "disable_credential_rotation false is copied",
+			in: map[string]any{
+				ConstRegion:                    "us-west-2",
+				ConstDisableCredentialRotation: false,
+				ConstTargetRoleArn:             targetRoleArn,
+			},
+			expected: &CredentialAttributes{
+				Region:                    "us-west-2",
+				DisableCredentialRotation: false,
+				RoleArn:                   targetRoleArn,
+			},
+		},
+		{
+			name: "wrong type target_region",
+			in: map[string]any{
+				ConstRegion:        "us-west-2",
+				ConstTargetRoleArn: targetRoleArn,
+				ConstTargetRegion:  true,
+			},
+			expectedErrContains: "attributes.target_region: unexpected type for value \"target_region\": want string, got bool",
+		},
+		{
+			name: "wrong type target_role_external_id",
+			in: map[string]any{
+				ConstRegion:               "us-west-2",
+				ConstTargetRoleArn:        targetRoleArn,
+				ConstTargetRoleExternalId: true,
+			},
+			expectedErrContains: "attributes.target_role_external_id: unexpected type for value \"target_role_external_id\": want string, got bool",
+		},
+		{
+			name: "wrong type target_role_session_name",
+			in: map[string]any{
+				ConstRegion:                "us-west-2",
+				ConstTargetRoleArn:         targetRoleArn,
+				ConstTargetRoleSessionName: true,
+			},
+			expectedErrContains: "attributes.target_role_session_name: unexpected type for value \"target_role_session_name\": want string, got bool",
+		},
+		{
+			name: "wrong type target_role_tags",
+			in: map[string]any{
+				ConstRegion:         "us-west-2",
+				ConstTargetRoleArn:  targetRoleArn,
+				ConstTargetRoleTags: true,
+			},
+			expectedErrContains: "attributes.target_role_tags: unexpected type for value \"target_role_tags\": want map[string]string, got bool",
+		},
+		{
+			name: "wrong type target_role_tag value",
+			in: map[string]any{
+				ConstRegion:        "us-west-2",
+				ConstTargetRoleArn: targetRoleArn,
+				ConstTargetRoleTags: map[string]any{
+					"env": true,
+				},
+			},
+			expectedErrContains: `unexpected type for value in map["env"]: want string, got bool`,
+		},
+		{
+			name: "wrong type disable_credential_rotation",
+			in: map[string]any{
+				ConstRegion:                    "us-west-2",
+				ConstTargetRoleArn:             targetRoleArn,
+				ConstDisableCredentialRotation: "sure",
+			},
+			expectedErrContains: "attributes.disable_credential_rotation: unexpected type for value \"disable_credential_rotation\": want bool, got string",
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			require := require.New(t)
+
+			input, err := structpb.NewStruct(tc.in)
+			require.NoError(err)
+
+			actual, err := GetTargetCredentialAttributes(input)
+			if tc.expectedErrContains != "" {
+				require.Error(err)
+				require.Nil(actual)
+				require.Contains(err.Error(), tc.expectedErrContains)
+				require.Equal(codes.InvalidArgument, status.Code(err))
+				return
+			}
+
+			require.NoError(err)
+			require.Equal(tc.expected, actual)
+		})
+	}
+}
+
 func TestGetCredentialsConfig(t *testing.T) {
 	cases := []struct {
 		name                string
@@ -4,10 +4,10 @@
 package credential

 const (
-	// ConstAccessKey is the key for the region in the aws credentials.
+	// ConstRegion is the key for the region in the aws credentials.
 	ConstRegion = "region"

-	// ConstAccessKey is the key for the access key id in the aws credentials.
+	// ConstAccessKeyId is the key for the access key id in the aws credentials.
 	ConstAccessKeyId = "access_key_id"

 	// ConstSecretAccessKey is the key for the secret access key in the aws credentials.
@@ -30,4 +30,19 @@ const (

 	// ConstRoleTags is the key for the tags used for assuming a IAM role.
 	ConstRoleTags = "role_tags"
+
+	// ConstTargetRegion is the key for the region of the target account in the aws credentials.
+	ConstTargetRegion = "target_region"
+
+	// ConstTargetRoleArn is the key for assuming a IAM role for the target account.
+	ConstTargetRoleArn = "target_role_arn"
+
+	// ConstTargetRoleExternalId is the key for the external id used for assuming a IAM role for the target account.
+	ConstTargetRoleExternalId = "target_role_external_id"
+
+	// ConstTargetRoleSessionName is the key for the session name used for assuming a IAM role of the target account.
+	ConstTargetRoleSessionName = "target_role_session_name"
+
+	// ConstTargetRoleTags is the key for the tags used for assuming a IAM role of the target account.
+	ConstTargetRoleTags = "target_role_tags"
 )
@@ -112,10 +112,35 @@ func NewAwsCredentialPersistedState(opts ...AwsCredentialPersistedStateOption) (
 // and runs sts.GetCallerIdentity for the current credentials, which is done
 // to check that the credentials are valid. This method returns a status error
 // with PluginError details.
+//
+// When RoleARN is set and no static key is present (ambient role path),
+// credentials are eagerly retrieved before calling GetCallerIdentity. This
+// forces sts:AssumeRole to be called immediately so that any role errors
+// (e.g. no such role, access denied) surface here rather than being deferred
+// to the first real AWS API call.
 func (s *AwsCredentialPersistedState) ValidateCreds(ctx context.Context) error {
 	if s.CredentialsConfig == nil {
 		return errors.BadRequestStatus("missing credentials config")
 	}
+
+	// For the ambient role path (RoleARN set, no static key), eagerly resolve
+	// the credential chain so that sts:AssumeRole is called now. Without this,
+	// the AssumeRoleProvider inside the chain is lazy and GetCallerIdentity
+	// would succeed even with an invalid role ARN (it uses the mock/ambient
+	// identity directly rather than the assumed one).
+	cc := s.CredentialsConfig
+	if cc.RoleARN != "" && cc.AccessKey == "" {
+		cfg, err := s.GenerateCredentialChain(ctx)
+		if err != nil {
+			st, _ := errors.ParseAWSError("validating credentials", err)
+			return st.Err()
+		}
+		if _, err := cfg.Credentials.Retrieve(ctx); err != nil {
+			st, _ := errors.ParseAWSError("validating credentials", err)
+			return st.Err()
+		}
+	}
+
 	if _, err := s.CredentialsConfig.GetCallerIdentity(ctx, s.testOpts...); err != nil {
 		st, _ := errors.ParseAWSError("validating credentials", err)
 		return st.Err()
@@ -29,6 +29,11 @@ const (
 	// the owner. This error cannot be resolved by retrying the request.
 	awsErrorAccessDenied = "AccessDenied"

+	// awsErrorUnauthorizedOperation is returned by EC2 when the caller is not
+	// authorized to perform the operation. This includes DryRun permission
+	// checks that fail (the counterpart to DryRunOperation success).
+	awsErrorUnauthorizedOperation = "UnauthorizedOperation"
+
 	// awsErrorInvalidAccessKeyId is returned when the credential does
 	// not exist. This error will persist until the credentials attached
 	// to the storage bucket is updated. This error can occur when the
@@ -66,8 +71,26 @@ const (

 	// RequestTimeoutException is returned when an http request takes longer than allowed
 	awsErrorRequestTimeoutException = "RequestTimeoutException"
+
+	// dryRunOperationErrorCode is returned by AWS when a DryRun request would have
+	// succeeded. It is a success signal disguised as an API error (typically HTTP 412).
+	dryRunOperationErrorCode = "DryRunOperation"
 )

+// IsDryRunSuccess reports whether err is the AWS DryRunOperation success signal.
+// A true result means the dry-run validated credentials, permissions, and parameters;
+// it must not be treated as a failure.
+func IsDryRunSuccess(err error) bool {
+	if err == nil {
+		return false
+	}
+	var apiErr smithy.APIError
+	if !errors.As(err, &apiErr) {
+		return false
+	}
+	return apiErr.ErrorCode() == dryRunOperationErrorCode
+}
+
 // InvalidArgumentError returns an grpc invalid argument status error.
 func InvalidArgumentError(msg string, f map[string]string) error {
 	var fieldMsgs []string
@@ -172,6 +195,8 @@ func ParseAWSError(op string, err error) (st *status.Status, permission *pb.Perm
 		switch apiErr.ErrorCode() {
 		case awsErrorAccessDenied:
 			fallthrough
+		case awsErrorUnauthorizedOperation:
+			fallthrough
 		case awsErrorInvalidAccessKeyId:
 			fallthrough
 		case awsErrorExpiredToken:
@@ -300,6 +300,17 @@ func Test_ParseAWSError(t *testing.T) {
 				CheckedAt:    timestamppb.Now(),
 			},
 		},
+		{
+			name:               "aws-request-unauthorized-operation",
+			err:                TestAwsError(awsErrorUnauthorizedOperation, "You are not authorized to perform this operation."),
+			expectedStatusCode: codes.PermissionDenied,
+			expectedStatusMsg:  "aws service unknown: invalid credentials: test",
+			expectedPermission: &pb.Permission{
+				State:        pb.StateType_STATE_TYPE_ERROR,
+				ErrorDetails: "You are not authorized to perform this operation.",
+				CheckedAt:    timestamppb.Now(),
+			},
+		},
 		{
 			name:               "aws-request-invalid-access-key-id",
 			err:                TestAwsError(awsErrorInvalidAccessKeyId, "The AWS Access Key Id you provided does not exist in our records."),
@@ -390,6 +401,46 @@ func Test_ParseAWSError(t *testing.T) {
 	}
 }

+func Test_IsDryRunSuccess(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		name string
+		err  error
+		want bool
+	}{
+		{
+			name: "nil",
+			want: false,
+		},
+		{
+			name: "plain error",
+			err:  fmt.Errorf("not an aws error"),
+			want: false,
+		},
+		{
+			name: "other api error",
+			err:  TestAwsError(awsErrorAccessDenied, "not authorized"),
+			want: false,
+		},
+		{
+			name: "dry run operation",
+			err:  TestAwsError(dryRunOperationErrorCode, "Request would have succeeded, but DryRun flag is set"),
+			want: true,
+		},
+		{
+			name: "wrapped dry run operation",
+			err:  fmt.Errorf("describe instances: %w", TestAwsError(dryRunOperationErrorCode, "Request would have succeeded, but DryRun flag is set")),
+			want: true,
+		},
+	}
+	for _, tt := range cases {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, IsDryRunSuccess(tt.err))
+		})
+	}
+}
+
 func Test_BadRequestStatusf(t *testing.T) {
 	require, assert := require.New(t), assert.New(t)
 	err := BadRequestStatusf("test: %s", "hello world")
@@ -109,13 +109,23 @@ The following `attributes` are valid on an AWS host catalog resource:
 - `region` (string): The region to configure the host catalog for. All host sets
  in this catalog will be configured for this region.
 - `role_arn` (string): The AWS Role ARN used for `AssumeRole` authentication. If
-  provided, `disable_credential_rotation` must be also set to `true.
- `role_external_id` (string):  The external id configured for the `AssumeRole`
+  provided, `disable_credential_rotation` must be also set to `true`.
+- `role_external_id` (string): The external ID configured for the principal `AssumeRole`
  provider.
- `role_session_name` (string): The session name configured for the `AssumeRole`
+- `role_session_name` (string): The session name configured for the principal `AssumeRole`
  provider.
- `role_tags` (object): The key-value pair tags configured for the `AssumeRole`
+- `role_tags` (object): The key-value pair tags configured for the principal `AssumeRole`
  provider.
+- `target_role_arn` (string): The AWS role ARN of the target IAM role to assume for
+  cross-account discovery. Required if any other `target_*` attributes are configured.
+- `target_region` (string): The region where the target hosts reside. Defaults to the
+  principal account `region` if omitted.
+- `target_role_external_id` (string): The external ID configured for the target
+  `AssumeRole` provider.
+- `target_role_session_name` (string): The session name configured for the target
+  `AssumeRole` provider.
+- `target_role_tags` (object): The key-value pair tags configured for the target
+  `AssumeRole` provider.

 The following `secrets` are required on an AWS host catalog resource:

@@ -20,6 +20,9 @@ import (
 type CatalogAttributes struct {
 	*cred.CredentialAttributes

+	// TargetAccount optionally holds the credentials used to AssumeRole into a second, affiliated account when provided.
+	TargetAccount *cred.CredentialAttributes
+
 	// DualStack is used for configuring how the aws client will resolve requests.
 	DualStack bool

@@ -39,6 +42,14 @@ func getCatalogAttributes(in *structpb.Struct) (*CatalogAttributes, error) {
 		return nil, err
 	}

+	var targetCredAttributes *cred.CredentialAttributes
+	if hasTargetAccountAttributes(in) {
+		targetCredAttributes, err = cred.GetTargetCredentialAttributes(in)
+		if err != nil {
+			return nil, err
+		}
+	}
+
 	dualStack, err := values.GetBoolValue(in, ConstAwsDualStack, false)
 	if err != nil {
 		badFields[fmt.Sprintf("attributes.%s", ConstAwsDualStack)] = err.Error()
@@ -66,6 +77,16 @@ func getCatalogAttributes(in *structpb.Struct) (*CatalogAttributes, error) {
 			continue
 		case cred.ConstRoleTags:
 			continue
+		case cred.ConstTargetRegion:
+			continue
+		case cred.ConstTargetRoleArn:
+			continue
+		case cred.ConstTargetRoleExternalId:
+			continue
+		case cred.ConstTargetRoleSessionName:
+			continue
+		case cred.ConstTargetRoleTags:
+			continue
 		default:
 			badFields[fmt.Sprintf("attributes.%s", s)] = "unrecognized field"
 		}
@@ -77,6 +98,7 @@ func getCatalogAttributes(in *structpb.Struct) (*CatalogAttributes, error) {

 	return &CatalogAttributes{
 		CredentialAttributes:  credAttributes,
+		TargetAccount:         targetCredAttributes,
 		DualStack:             dualStack,
 		InstanceAddressesOnly: instanceAddressesOnly,
 	}, nil
@@ -121,3 +143,19 @@ func getSetAttributes(in *structpb.Struct) (*SetAttributes, error) {

 	return &setAttrs, nil
 }
+
+func hasTargetAccountAttributes(in *structpb.Struct) bool {
+	fields := in.GetFields()
+
+	_, hasTargetRegion := fields[cred.ConstTargetRegion]
+	_, hasTargetRoleArn := fields[cred.ConstTargetRoleArn]
+	_, hasTargetRoleExternalID := fields[cred.ConstTargetRoleExternalId]
+	_, hasTargetRoleSessionName := fields[cred.ConstTargetRoleSessionName]
+	_, hasTargetRoleTags := fields[cred.ConstTargetRoleTags]
+
+	return hasTargetRegion ||
+		hasTargetRoleArn ||
+		hasTargetRoleExternalID ||
+		hasTargetRoleSessionName ||
+		hasTargetRoleTags
+}
@@ -118,6 +118,170 @@ func TestGetCatalogAttributes(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "target_region without target_role_arn",
+			in: &structpb.Struct{
+				Fields: map[string]*structpb.Value{
+					"region":        structpb.NewStringValue("us-west-2"),
+					"target_region": structpb.NewStringValue("eu-west-1"),
+				},
+			},
+			expectedErrContains: "attributes.target_role_arn: missing required value \"target_role_arn\"",
+		},
+		{
+			name: "target role field without target_role_arn",
+			in: &structpb.Struct{
+				Fields: map[string]*structpb.Value{
+					"region":                  structpb.NewStringValue("us-west-2"),
+					"target_role_external_id": structpb.NewStringValue("target-ext"),
+				},
+			},
+			expectedErrContains: "attributes.target_role_arn: missing required value \"target_role_arn\"",
+		},
+		{
+			name: "other target role fields without target_role_arn",
+			in: &structpb.Struct{
+				Fields: map[string]*structpb.Value{
+					"region":                   structpb.NewStringValue("us-west-2"),
+					"target_role_session_name": structpb.NewStringValue("target-session"),
+					"target_role_tags": structpb.NewStructValue(&structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							"env": structpb.NewStringValue("target"),
+						},
+					}),
+				},
+			},
+			expectedErrContains: "attributes.target_role_arn: missing required value \"target_role_arn\"",
+		},
+		{
+			name: "empty target_role_arn with target_region",
+			in: &structpb.Struct{
+				Fields: map[string]*structpb.Value{
+					"region":          structpb.NewStringValue("us-west-2"),
+					"target_role_arn": structpb.NewStringValue(""),
+					"target_region":   structpb.NewStringValue("eu-west-1"),
+				},
+			},
+			expectedErrContains: "attributes.target_role_arn: value \"target_role_arn\" cannot be empty",
+		},
+		{
+			name: "target_role_arn without target_region uses region; principal sts fields are not copied",
+			in: &structpb.Struct{
+				Fields: map[string]*structpb.Value{
+					"region":                      structpb.NewStringValue("us-west-2"),
+					"disable_credential_rotation": structpb.NewBoolValue(true),
+					"role_arn":                    structpb.NewStringValue("arn:aws:iam::111111111111:role/Principal"),
+					"role_external_id":            structpb.NewStringValue("principal-ext"),
+					"role_session_name":           structpb.NewStringValue("principal-sess"),
+					"role_tags": structpb.NewStructValue(&structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							"env": structpb.NewStringValue("principal"),
+						},
+					}),
+					"target_role_arn": structpb.NewStringValue("arn:aws:iam::222222222222:role/Target"),
+				},
+			},
+			expected: &CatalogAttributes{
+				CredentialAttributes: &cred.CredentialAttributes{
+					Region:                    "us-west-2",
+					DisableCredentialRotation: true,
+					RoleArn:                   "arn:aws:iam::111111111111:role/Principal",
+					RoleExternalId:            "principal-ext",
+					RoleSessionName:           "principal-sess",
+					RoleTags: map[string]string{
+						"env": "principal",
+					},
+				},
+				TargetAccount: &cred.CredentialAttributes{
+					Region:                    "us-west-2",
+					DisableCredentialRotation: true,
+					RoleArn:                   "arn:aws:iam::222222222222:role/Target",
+				},
+			},
+		},
+		{
+			name: "target attributes are independent of principal",
+			in: &structpb.Struct{
+				Fields: map[string]*structpb.Value{
+					"region":                      structpb.NewStringValue("us-west-2"),
+					"disable_credential_rotation": structpb.NewBoolValue(true),
+					"role_arn":                    structpb.NewStringValue("arn:aws:iam::111111111111:role/Principal"),
+					"role_external_id":            structpb.NewStringValue("principal-ext"),
+					"role_session_name":           structpb.NewStringValue("principal-sess"),
+					"role_tags": structpb.NewStructValue(&structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							"env": structpb.NewStringValue("principal"),
+						},
+					}),
+					"target_role_arn":          structpb.NewStringValue("arn:aws:iam::222222222222:role/Target"),
+					"target_region":            structpb.NewStringValue("eu-west-1"),
+					"target_role_external_id":  structpb.NewStringValue("target-ext"),
+					"target_role_session_name": structpb.NewStringValue("target-sess"),
+					"target_role_tags": structpb.NewStructValue(&structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							"env": structpb.NewStringValue("target"),
+						},
+					}),
+				},
+			},
+			expected: &CatalogAttributes{
+				CredentialAttributes: &cred.CredentialAttributes{
+					Region:                    "us-west-2",
+					DisableCredentialRotation: true,
+					RoleArn:                   "arn:aws:iam::111111111111:role/Principal",
+					RoleExternalId:            "principal-ext",
+					RoleSessionName:           "principal-sess",
+					RoleTags: map[string]string{
+						"env": "principal",
+					},
+				},
+				TargetAccount: &cred.CredentialAttributes{
+					Region:                    "eu-west-1",
+					DisableCredentialRotation: true,
+					RoleArn:                   "arn:aws:iam::222222222222:role/Target",
+					RoleExternalId:            "target-ext",
+					RoleSessionName:           "target-sess",
+					RoleTags: map[string]string{
+						"env": "target",
+					},
+				},
+			},
+		},
+		{
+			name: "catalog dual_stack and instance_addresses_only with target",
+			in: &structpb.Struct{
+				Fields: map[string]*structpb.Value{
+					"region":                  structpb.NewStringValue("us-west-2"),
+					"dual_stack":              structpb.NewBoolValue(true),
+					"instance_addresses_only": structpb.NewBoolValue(true),
+					"target_role_arn":         structpb.NewStringValue("arn:aws:iam::222222222222:role/Target"),
+				},
+			},
+			expected: &CatalogAttributes{
+				CredentialAttributes: &credential.CredentialAttributes{
+					Region:                    "us-west-2",
+					DisableCredentialRotation: false,
+				},
+				TargetAccount: &cred.CredentialAttributes{
+					Region:                    "us-west-2",
+					DisableCredentialRotation: false,
+					RoleArn:                   "arn:aws:iam::222222222222:role/Target",
+				},
+				DualStack:             true,
+				InstanceAddressesOnly: true,
+			},
+		},
+		{
+			name: "unknown field with target_role_arn",
+			in: &structpb.Struct{
+				Fields: map[string]*structpb.Value{
+					"region":          structpb.NewStringValue("us-west-2"),
+					"target_role_arn": structpb.NewStringValue("arn:aws:iam::222222222222:role/Target"),
+					"foo":             structpb.NewBoolValue(true),
+				},
+			},
+			expectedErrContains: "attributes.foo: unrecognized field",
+		},
 	}

 	for _, tc := range cases {
@@ -9,8 +9,11 @@ import (
 	"strings"

 	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/credentials/stscreds"
 	"github.com/aws/aws-sdk-go-v2/service/ec2"
 	"github.com/aws/aws-sdk-go-v2/service/ec2/types"
+	"github.com/aws/aws-sdk-go-v2/service/sts"
+	stsTypes "github.com/aws/aws-sdk-go-v2/service/sts/types"
 	"github.com/hashicorp/boundary-plugin-aws/internal/credential"
 	"github.com/hashicorp/boundary-plugin-aws/internal/errors"
 	pb "github.com/hashicorp/boundary/sdk/pbs/plugin"
@@ -32,6 +35,16 @@ type HostPlugin struct {
 	testCatalogStateOpts []awsCatalogPersistedStateOption
 }

+type hostSetQuery struct {
+	Id          string
+	Input       *ec2.DescribeInstancesInput
+	Output      *ec2.DescribeInstancesOutput
+	OutputHosts []*pb.ListHostsResponseHost
+}
+
+const errBuildDescribeInstancesInput = "error building DescribeInstances input: %s"
+const errDryRunFailed = "error performing DescribeInstances dry run: %s"
+
 // Ensure that we are implementing HostPluginServiceServer
 var _ pb.HostPluginServiceServer = (*HostPlugin)(nil)

@@ -73,6 +86,15 @@ func (p *HostPlugin) OnCreateCatalog(ctx context.Context, req *pb.OnCreateCatalo
 		}
 	}

+	// Validate assumed-role credentials at catalog-creation time so that an
+	// invalid role_arn is rejected immediately rather than silently falling
+	// back to ambient credentials.
+	if credential.GetCredentialType(credState.CredentialsConfig) == credential.DynamicAWS {
+		if err := credState.ValidateCreds(ctx); err != nil {
+			return nil, err
+		}
+	}
+
 	catalogState, err := newAwsCatalogPersistedState(
 		append([]awsCatalogPersistedStateOption{
 			withCredentials(credState),
@@ -82,13 +104,21 @@ func (p *HostPlugin) OnCreateCatalog(ctx context.Context, req *pb.OnCreateCatalo
 		return nil, errors.BadRequestStatusf("error setting up persisted state: %s", err)
 	}

-	// perform dry run to ensure we can interact with AWS as expected.
 	opts := []ec2Option{}
 	if catalogAttributes.DualStack {
 		opts = append(opts, WithDualStack(catalogAttributes.DualStack))
 	}
-	if st := dryRunValidation(ctx, catalogState, opts); st != nil {
-		return nil, st.Err()
+	input, err := buildDescribeInstancesInput(&SetAttributes{}, true)
+	if err != nil {
+		return nil, status.Errorf(codes.Unknown, errBuildDescribeInstancesInput, err)
+	}
+	// Run a DescribeInstances request with DryRun set to true to ensure
+	// we can interact with AWS resources as expected.
+	if _, err := checkHosts(ctx, catalogState, input, opts, catalogAttributes.TargetAccount); err != nil {
+		if _, ok := status.FromError(err); ok {
+			return nil, err
+		}
+		return nil, fmt.Errorf(errDryRunFailed, err)
 	}

 	persistedProto, err := catalogState.toProto()
@@ -163,6 +193,15 @@ func (p *HostPlugin) OnUpdateCatalog(ctx context.Context, req *pb.OnUpdateCatalo
 		if err != nil {
 			return nil, errors.BadRequestStatusf("error setting up new credential persisted state: %s", err)
 		}
+
+		// Validate assumed-role credentials when the role_arn changes so that
+		// an invalid ARN is caught before replacing the existing credential state.
+		if credential.GetCredentialType(newCredState.CredentialsConfig) == credential.DynamicAWS {
+			if err := newCredState.ValidateCreds(ctx); err != nil {
+				return nil, err
+			}
+		}
+
 		newCatalogState, err := newAwsCatalogPersistedState(
 			append([]awsCatalogPersistedStateOption{
 				withCredentials(newCredState),
@@ -171,12 +210,22 @@ func (p *HostPlugin) OnUpdateCatalog(ctx context.Context, req *pb.OnUpdateCatalo
 		if err != nil {
 			return nil, errors.BadRequestStatusf("error loading persisted state: %s", err)
 		}
+
 		opts := []ec2Option{}
 		if newCatalogAttributes.DualStack {
 			opts = append(opts, WithDualStack(newCatalogAttributes.DualStack))
 		}
-		if st := dryRunValidation(ctx, newCatalogState, opts); st != nil {
-			return nil, st.Err()
+		input, err := buildDescribeInstancesInput(&SetAttributes{}, true)
+		if err != nil {
+			return nil, status.Errorf(codes.Unknown, errBuildDescribeInstancesInput, err)
+		}
+		// Run a DescribeInstances request with DryRun set to true to ensure
+		// we can interact with AWS resources as expected.
+		if _, err := checkHosts(ctx, newCatalogState, input, opts, newCatalogAttributes.TargetAccount); err != nil {
+			if _, ok := status.FromError(err); ok {
+				return nil, err
+			}
+			return nil, fmt.Errorf(errDryRunFailed, err)
 		}

 		// Replace the existing credential state.
@@ -216,13 +265,21 @@ func (p *HostPlugin) OnUpdateCatalog(ctx context.Context, req *pb.OnUpdateCatalo
 		return nil, errors.BadRequestStatusf("error loading persisted state: %s", err)
 	}

-	// perform dry run to ensure we can interact with AWS as expected.
 	opts := []ec2Option{}
 	if newCatalogAttributes.DualStack {
 		opts = append(opts, WithDualStack(newCatalogAttributes.DualStack))
 	}
-	if st := dryRunValidation(ctx, catalogState, opts); st != nil {
-		return nil, st.Err()
+	input, err := buildDescribeInstancesInput(&SetAttributes{}, true)
+	if err != nil {
+		return nil, status.Errorf(codes.Unknown, errBuildDescribeInstancesInput, err)
+	}
+	// Run a DescribeInstances request with DryRun set to true to ensure
+	// we can interact with AWS resources as expected.
+	if _, err := checkHosts(ctx, catalogState, input, opts, newCatalogAttributes.TargetAccount); err != nil {
+		if _, ok := status.FromError(err); ok {
+			return nil, err
+		}
+		return nil, fmt.Errorf(errDryRunFailed, err)
 	}

 	persistedProto, err := catalogState.toProto()
@@ -366,18 +423,23 @@ func (p *HostPlugin) OnCreateSet(ctx context.Context, req *pb.OnCreateSetRequest
 		return nil, err
 	}

-	describeInstanceFilters, err := buildFilters(setAttrs)
-	if err != nil {
-		return nil, errors.BadRequestStatusf("error building set filters: %s", err)
-	}
-
 	opts := []ec2Option{}
 	if catalogAttributes.DualStack {
 		opts = append(opts, WithDualStack(catalogAttributes.DualStack))
 	}
-	if st := dryRunValidation(ctx, catalogState, opts, describeInstanceFilters...); st != nil {
-		return nil, st.Err()
+	input, err := buildDescribeInstancesInput(setAttrs, true)
+	if err != nil {
+		return nil, status.Errorf(codes.Unknown, errBuildDescribeInstancesInput, err)
 	}
+	// Run a DescribeInstances request with DryRun set to true to ensure
+	// we can interact with AWS resources as expected.
+	if _, err := checkHosts(ctx, catalogState, input, opts, catalogAttributes.TargetAccount); err != nil {
+		if _, ok := status.FromError(err); ok {
+			return nil, err
+		}
+		return nil, fmt.Errorf(errDryRunFailed, err)
+	}
+
 	return &pb.OnCreateSetResponse{}, nil
 }

@@ -431,17 +493,21 @@ func (p *HostPlugin) OnUpdateSet(ctx context.Context, req *pb.OnUpdateSetRequest
 		return nil, err
 	}

-	describeInstanceFilters, err := buildFilters(setAttrs)
-	if err != nil {
-		return nil, errors.BadRequestStatusf("error building set filters: %s", err)
-	}
-
 	opts := []ec2Option{}
 	if catalogAttributes.DualStack {
 		opts = append(opts, WithDualStack(catalogAttributes.DualStack))
 	}
-	if st := dryRunValidation(ctx, catalogState, opts, describeInstanceFilters...); st != nil {
-		return nil, st.Err()
+	input, err := buildDescribeInstancesInput(setAttrs, true)
+	if err != nil {
+		return nil, status.Errorf(codes.Unknown, errBuildDescribeInstancesInput, err)
+	}
+	// Run a DescribeInstances request with DryRun set to true to ensure
+	// we can interact with AWS resources as expected.
+	if _, err := checkHosts(ctx, catalogState, input, opts, catalogAttributes.TargetAccount); err != nil {
+		if _, ok := status.FromError(err); ok {
+			return nil, err
+		}
+		return nil, fmt.Errorf(errDryRunFailed, err)
 	}

 	return &pb.OnUpdateSetResponse{}, nil
@@ -495,13 +561,6 @@ func (p *HostPlugin) ListHosts(ctx context.Context, req *pb.ListHostsRequest) (*
 	}

 	// Build all the queries in advance.
-	type hostSetQuery struct {
-		Id          string
-		Input       *ec2.DescribeInstancesInput
-		Output      *ec2.DescribeInstancesOutput
-		OutputHosts []*pb.ListHostsResponseHost
-	}
-
 	queries := make([]hostSetQuery, len(sets))
 	for i, set := range sets {
 		// Validate Id since we use it in output
@@ -531,20 +590,26 @@ func (p *HostPlugin) ListHosts(ctx context.Context, req *pb.ListHostsRequest) (*
 	if catalogAttributes.DualStack {
 		opts = append(opts, WithDualStack(catalogAttributes.DualStack))
 	}
-	ec2Client, err := catalogState.EC2Client(ctx, opts...)
-	if err != nil {
-		return nil, errors.BadRequestStatusf("error getting EC2 client: %s", err)
-	}

 	// Run all queries now and assemble output.
 	var maxLen int
 	for i, query := range queries {
-		output, err := ec2Client.DescribeInstances(ctx, query.Input)
+		output, err := checkHosts(ctx, catalogState, query.Input, opts, catalogAttributes.TargetAccount)
 		if err != nil {
-			return nil, errors.BadRequestStatusf("error running DescribeInstances for host set id %q: %s", query.Id, err)
+			// Mapped AWS failures are already gRPC statuses from checkHosts.
+			if _, ok := status.FromError(err); ok {
+				return nil, err
+			}
+			if catalogAttributes.TargetAccount != nil {
+				return nil, status.Errorf(codes.Unknown, "unable to list hosts for host set %q: %v", query.Id, err)
+			}
+			return nil, status.Errorf(codes.Unknown, "error retrieving host results for host set id %q: %v", query.Id, err)
 		}

 		queries[i].Output = output
+		if output == nil {
+			continue
+		}

 		// Process the output here, we will normalize this into a single
 		// set of hosts afterwards (possibly removing duplicates).
@@ -552,7 +617,7 @@ func (p *HostPlugin) ListHosts(ctx context.Context, req *pb.ListHostsRequest) (*
 			for _, instance := range reservation.Instances {
 				host, err := awsInstanceToHost(instance, catalogAttributes)
 				if err != nil {
-					return nil, errors.BadRequestStatusf("error processing host results for host set id %q: %s", query.Id, err)
+					return nil, status.Errorf(codes.Unknown, "error processing host results for host set id %q: %v", query.Id, err)
 				}

 				queries[i].OutputHosts = append(queries[i].OutputHosts, host)
@@ -601,11 +666,11 @@ func buildFilters(attrs *SetAttributes) ([]types.Filter, error) {
 		splitFilter := strings.Split(filterAttr, "=")
 		switch {
 		case len(splitFilter) != 2:
-			return nil, fmt.Errorf("expected filter %q to contain a single equal sign", filterAttr)
+			return nil, errors.BadRequestStatusf("expected filter %q to contain a single equal sign", filterAttr)
 		case len(splitFilter[0]) == 0:
-			return nil, fmt.Errorf("filter %q contains an empty filter key", filterAttr)
+			return nil, errors.BadRequestStatusf("filter %q contains an empty filter key", filterAttr)
 		case len(splitFilter[1]) == 0:
-			return nil, fmt.Errorf("filter %q contains an empty value", filterAttr)
+			return nil, errors.BadRequestStatusf("filter %q contains an empty value", filterAttr)
 		}

 		filterKey, filterValue := splitFilter[0], splitFilter[1]
@@ -634,9 +699,13 @@ func buildFilters(attrs *SetAttributes) ([]types.Filter, error) {
 }

 func buildDescribeInstancesInput(attrs *SetAttributes, dryRun bool) (*ec2.DescribeInstancesInput, error) {
+	if attrs == nil {
+		attrs = &SetAttributes{}
+	}
+
 	filters, err := buildFilters(attrs)
 	if err != nil {
-		return nil, fmt.Errorf("error building filters: %w", err)
+		return nil, err
 	}

 	return &ec2.DescribeInstancesInput{
@@ -707,26 +776,121 @@ func awsInstanceToHost(instance types.Instance, catalogAttributes *CatalogAttrib
 	return result, nil
 }

-// dryRunValidation performs an AWS DescribeInstances call to verify the state's
-// credentials, the host listing functionality as well as the filters, if any
-// are passed in. This function can therefore be used for both host catalog and
-// host set validation.
-func dryRunValidation(ctx context.Context, state *awsCatalogPersistedState, ec2Opts []ec2Option, filters ...types.Filter) *status.Status {
-	if state == nil {
-		return status.New(codes.InvalidArgument, "persisted state is required")
+func checkHosts(ctx context.Context,
+	principalCatalogState *awsCatalogPersistedState,
+	input *ec2.DescribeInstancesInput,
+	opts []ec2Option,
+	target *credential.CredentialAttributes,
+) (*ec2.DescribeInstancesOutput, error) {
+	if principalCatalogState == nil {
+		return nil, fmt.Errorf("unable to create EC2 client from catalog state")
 	}

-	ec2Client, err := state.EC2Client(ctx, ec2Opts...)
+	var ec2Client EC2API
+	var err error
+	if target == nil {
+		// use the principal account to execute the DescribeInstances command
+		ec2Client, err = principalCatalogState.EC2Client(ctx, opts...)
+		if err != nil {
+			if st, _ := errors.ParseAWSError("EC2 client setup", err); st.Code() != codes.Unknown {
+				return nil, st.Err()
+			}
+			return nil, err
+		}
+	} else {
+		// use the target account to execute the DescribeInstances command
+		ec2Client, err = ec2ClientForTarget(ctx, principalCatalogState, target, opts)
+		if err != nil {
+			if _, ok := status.FromError(err); ok {
+				return nil, err
+			}
+			return nil, fmt.Errorf("EC2 client setup failed for target account: %w", err)
+		}
+	}
+
+	output, err := ec2Client.DescribeInstances(ctx, input)
 	if err != nil {
-		return status.New(codes.InvalidArgument, fmt.Sprintf("error getting EC2 client: %s", err))
+		if errors.IsDryRunSuccess(err) {
+			// DryRunOperation: request would have succeeded; not a failure.
+			return nil, nil
+		}
+		if st, _ := errors.ParseAWSError("DescribeInstances", err); st.Code() != codes.Unknown {
+			return nil, st.Err()
+		}
+		if target != nil {
+			return nil, fmt.Errorf("EC2 DescribeInstances failed for target account: %w", err)
+		}
+		return nil, err
 	}

-	_, err = ec2Client.DescribeInstances(ctx, &ec2.DescribeInstancesInput{Filters: filters})
+	return output, nil
+}
+
+// ec2ClientForTarget builds an EC2 client to query the target account.
+// The hop is a continuation of the principal session: STS AssumeRole is called
+// as the principal to get to the target, then EC2 uses the resulting temporary credentials.
+// This is not a second worker-level credential chain on the target attributes.
+func ec2ClientForTarget(
+	ctx context.Context,
+	principalCatalogState *awsCatalogPersistedState,
+	target *credential.CredentialAttributes,
+	opts []ec2Option) (EC2API, error) {
+	// Reuse the principal SDK config (HTTP client, retries, logger, and the
+	// principal identity).
+	principalCfg, err := principalCatalogState.GenerateCredentialChain(ctx)
 	if err != nil {
-		return status.New(codes.FailedPrecondition, fmt.Sprintf("aws describe instances failed: %s", err))
+		if st, _ := errors.ParseAWSError("EC2 client setup for target account", err); st.Code() != codes.Unknown {
+			return nil, st.Err()
+		}
+		return nil, fmt.Errorf("principal AWS configuration could not be loaded: %w", err)
+	}
+	if principalCfg == nil {
+		return nil, fmt.Errorf("nil principal AWS configuration while configuring EC2 client for target account")
 	}

-	return nil
+	// STS must run as the principal so the target role's trust policy sees that
+	// identity, not the worker's. Session name, external ID, and tags are
+	// forwarded from attrs when set so the AssumeRole matches the target role's configuration.
+	stsClient := sts.NewFromConfig(*principalCfg)
+	provider := stscreds.NewAssumeRoleProvider(stsClient, target.RoleArn, func(o *stscreds.AssumeRoleOptions) {
+		if target.RoleSessionName != "" {
+			o.RoleSessionName = target.RoleSessionName
+		}
+		if target.RoleExternalId != "" {
+			o.ExternalID = &target.RoleExternalId
+		}
+		for k, v := range target.RoleTags {
+			o.Tags = append(o.Tags, stsTypes.Tag{
+				Key:   aws.String(k),
+				Value: aws.String(v),
+			})
+		}
+	})
+
+	// Same worker SDK environment as the principal; only identity and region change.
+	targetCfg := principalCfg.Copy()
+	targetCfg.Credentials = aws.NewCredentialsCache(provider)
+	if target.Region != "" {
+		targetCfg.Region = target.Region
+	}
+
+	parsed, err := getOpts(opts...)
+	if err != nil {
+		return nil, fmt.Errorf("EC2 client options are invalid: %w", err)
+	}
+	// Dual-stack is the worker's path to AWS endpoints, not per-account. Apply
+	// it on the hopped client the same way EC2Client does for the principal.
+	var ec2Opts []func(*ec2.Options)
+	if parsed.withDualStack {
+		ec2Opts = append(ec2Opts, ec2.WithEndpointResolverV2(&endpointResolver{
+			dualStack: parsed.withDualStack,
+		}))
+	}
+
+	if principalCatalogState.testEC2APIFunc != nil {
+		return principalCatalogState.testEC2APIFunc(targetCfg)
+	}
+	return ec2.NewFromConfig(targetCfg, ec2Opts...), nil
 }

 // appendDistinct will append the elements to the slice
@@ -16,8 +16,11 @@ import (
 	"github.com/aws/aws-sdk-go-v2/service/ec2/types"
 	"github.com/aws/aws-sdk-go-v2/service/iam"
 	iamTypes "github.com/aws/aws-sdk-go-v2/service/iam/types"
+	"github.com/aws/aws-sdk-go-v2/service/sts"
+	stsTypes "github.com/aws/aws-sdk-go-v2/service/sts/types"
 	"github.com/google/go-cmp/cmp"
 	"github.com/hashicorp/boundary-plugin-aws/internal/credential"
+	awserrors "github.com/hashicorp/boundary-plugin-aws/internal/errors"
 	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/hostcatalogs"
 	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/hostsets"
 	pb "github.com/hashicorp/boundary/sdk/pbs/plugin"
@@ -28,6 +31,38 @@ import (
 	"google.golang.org/protobuf/testing/protocmp"
 	"google.golang.org/protobuf/types/known/structpb"
 )
+// testRoleARN is a syntactically valid ARN used for role_arn test cases.
+// All STS calls against it are handled by injected mocks — no real AWS
+// account is contacted.
+const testRoleARN = "arn:aws:iam::123456789012:role/BoundaryTestRole"
+
+// validAssumeRoleOutput returns a mock AssumeRoleOutput with synthetic
+// temporary credentials for use with WithSTSAPIFunc.
+func validAssumeRoleOutput() *sts.AssumeRoleOutput {
+	return &sts.AssumeRoleOutput{
+		Credentials: &stsTypes.Credentials{
+			AccessKeyId:     aws.String("ASIAmockassumedkey"),
+			SecretAccessKey: aws.String("mockassumedsecret"),
+			SessionToken:    aws.String("mockassumedsessiontoken"),
+			Expiration:      aws.Time(time.Now().Add(time.Hour)),
+		},
+	}
+}
+
+// catalogAttrsStruct builds a catalog attributes structpb for the given
+// region. roleArn is written only when non-empty. disableRotation must be
+// set explicitly to avoid implicit rotation behaviour in tests.
+func catalogAttrsStruct(region, roleArn string, disableRotation bool) *structpb.Struct {
+	fields := map[string]*structpb.Value{
+		credential.ConstRegion:                    structpb.NewStringValue(region),
+		credential.ConstDisableCredentialRotation: structpb.NewBoolValue(disableRotation),
+	}
+	if roleArn != "" {
+		fields[credential.ConstRoleArn] = structpb.NewStringValue(roleArn)
+	}
+	return &structpb.Struct{Fields: fields}
+}
+

 func TestPluginOnCreateCatalogSuccess(t *testing.T) {
 	tests := []struct {
@@ -138,17 +173,13 @@ func TestPluginOnCreateCatalogSuccess(t *testing.T) {
 			},
 		},
 		{
+			// role_arn set, no static keys. AssumeRole mock succeeds.
+			// Persisted secrets are empty — dynamic credentials are not stored.
 			name: "usingAssumeRole",
 			req: &pb.OnCreateCatalogRequest{
 				Catalog: &hostcatalogs.HostCatalog{
 					Attrs: &hostcatalogs.HostCatalog_Attributes{
-						Attributes: &structpb.Struct{
-							Fields: map[string]*structpb.Value{
-								credential.ConstRegion:                    structpb.NewStringValue("us-east-1"),
-								credential.ConstRoleArn:                   structpb.NewStringValue("arn:0123:test:rolearn"),
-								credential.ConstDisableCredentialRotation: structpb.NewBoolValue(true),
-							},
-						},
+						Attributes: catalogAttrsStruct("us-east-1", testRoleARN, true),
 					},
 				},
 			},
@@ -158,6 +189,13 @@ func TestPluginOnCreateCatalogSuccess(t *testing.T) {
 					testMockEC2WithDescribeInstancesOutput(&ec2.DescribeInstancesOutput{}),
 				)),
 			},
+			credOpts: []credential.AwsCredentialPersistedStateOption{
+				credential.WithStateTestOpts([]awsutil.Option{
+					awsutil.WithSTSAPIFunc(awsutil.NewMockSTS(
+						awsutil.WithAssumeRoleOutput(validAssumeRoleOutput()),
+					)),
+				}),
+			},
 			expRsp: &pb.OnCreateCatalogResponse{Persisted: &pb.HostCatalogPersisted{Secrets: &structpb.Struct{}}},
 		},
 	}
@@ -315,6 +353,20 @@ func TestPluginOnUpdateCatalogSuccess(t *testing.T) {
 					testMockEC2WithDescribeInstancesOutput(&ec2.DescribeInstancesOutput{}),
 				)),
 			},
+			credOpts: []credential.AwsCredentialPersistedStateOption{
+				credential.WithStateTestOpts([]awsutil.Option{
+					awsutil.WithSTSAPIFunc(awsutil.NewMockSTS(
+						awsutil.WithAssumeRoleOutput(&sts.AssumeRoleOutput{
+							Credentials: &stsTypes.Credentials{
+								AccessKeyId:     aws.String("ASIAfoobar"),
+								SecretAccessKey: aws.String("secretkeyfoobar"),
+								SessionToken:    aws.String("sessiontokenfoobar"),
+								Expiration:      aws.Time(time.Now().Add(time.Hour)),
+							},
+						}),
+					)),
+				}),
+			},
 			expRsp: &pb.OnUpdateCatalogResponse{
 				Persisted: &pb.HostCatalogPersisted{Secrets: &structpb.Struct{}},
 			},
@@ -421,6 +473,16 @@ func TestPluginOnUpdateCatalogSuccess(t *testing.T) {
 			credOpts: []credential.AwsCredentialPersistedStateOption{
 				credential.WithStateTestOpts([]awsutil.Option{
 					awsutil.WithIAMAPIFunc(awsutil.NewMockIAM()),
+					awsutil.WithSTSAPIFunc(awsutil.NewMockSTS(
+						awsutil.WithAssumeRoleOutput(&sts.AssumeRoleOutput{
+							Credentials: &stsTypes.Credentials{
+								AccessKeyId:     aws.String("ASIAfoobar"),
+								SecretAccessKey: aws.String("secretkeyfoobar"),
+								SessionToken:    aws.String("sessiontokenfoobar"),
+								Expiration:      aws.Time(time.Now().Add(time.Hour)),
+							},
+						}),
+					)),
 				}),
 			},
 			expRsp: &pb.OnUpdateCatalogResponse{
@@ -742,8 +804,72 @@ func TestPluginOnCreateCatalogErr(t *testing.T) {
 					testMockEC2WithDescribeInstancesError(errors.New(testDescribeInstancesError)),
 				)),
 			},
-			expectedErrContains: "aws describe instances failed: DescribeInstances error",
-			expectedErrCode:     codes.FailedPrecondition,
+			// checkHosts returns the DescribeInstances error as-is rather than
+			// wrapping it in a gRPC FailedPrecondition status like the old
+			// dryRunValidation did. A plain Go error maps to codes.Unknown.
+			expectedErrContains: testDescribeInstancesError,
+			expectedErrCode:     codes.Unknown,
+		},
+		{
+			name: "dry run status error preserves gRPC code",
+			req: &pb.OnCreateCatalogRequest{
+				Catalog: &hostcatalogs.HostCatalog{
+					Secrets: &structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							credential.ConstAccessKeyId:     structpb.NewStringValue("AKIA_foobar"),
+							credential.ConstSecretAccessKey: structpb.NewStringValue("bazqux"),
+						},
+					},
+					Attrs: &hostcatalogs.HostCatalog_Attributes{
+						Attributes: &structpb.Struct{
+							Fields: map[string]*structpb.Value{
+								credential.ConstRegion:                    structpb.NewStringValue("us-west-2"),
+								credential.ConstDisableCredentialRotation: structpb.NewBoolValue(true),
+							},
+						},
+					},
+				},
+			},
+			catalogOpts: []awsCatalogPersistedStateOption{
+				withTestEC2APIFunc(newTestMockEC2(
+					nil,
+					testMockEC2WithDescribeInstancesError(awserrors.TestAwsError("AccessDenied", "not authorized to perform ec2:DescribeInstances")),
+				)),
+			},
+			// checkHosts wraps the AWS error via ParseAWSError into a gRPC
+			// PermissionDenied status. OnCreateCatalog's dry-run error handler
+			// should preserve that status code, not re-wrap it as Unknown.
+			expectedErrContains: "invalid credentials",
+			expectedErrCode:     codes.PermissionDenied,
+		},
+		{
+			// BUG FIX: role_arn set, no static keys. AssumeRole mock returns
+			// an error. ValidateCreds now eagerly calls Retrieve() which forces
+			// sts:AssumeRole, so the error surfaces here at creation time.
+			// Previously this succeeded silently via the ambient credential chain.
+			name: "role_arn AssumeRole error — correctly rejected",
+			req: &pb.OnCreateCatalogRequest{
+				Catalog: &hostcatalogs.HostCatalog{
+					Attrs: &hostcatalogs.HostCatalog_Attributes{
+						Attributes: catalogAttrsStruct("us-east-1", testRoleARN, true),
+					},
+				},
+			},
+			credOpts: []credential.AwsCredentialPersistedStateOption{
+				credential.WithStateTestOpts([]awsutil.Option{
+					awsutil.WithSTSAPIFunc(awsutil.NewMockSTS(
+						awsutil.WithAssumeRoleError(errors.New("simulated AssumeRole failure")),
+					)),
+				}),
+			},
+			catalogOpts: []awsCatalogPersistedStateOption{
+				withTestEC2APIFunc(newTestMockEC2(
+					nil,
+					testMockEC2WithDescribeInstancesOutput(&ec2.DescribeInstancesOutput{}),
+				)),
+			},
+			expectedErrContains: "simulated AssumeRole failure",
+			expectedErrCode:     codes.Unknown,
 		},
 	}

@@ -994,8 +1120,11 @@ func TestPluginOnUpdateCatalogErr(t *testing.T) {
 					testMockEC2WithDescribeInstancesError(errors.New(testDescribeInstancesError)),
 				)),
 			},
-			expectedErrContains: "aws describe instances failed: DescribeInstances error",
-			expectedErrCode:     codes.FailedPrecondition,
+			//checkHosts returns the DesribeInstances errror as-is rather than wrapping it
+			// in a gRpc FailedPrecodndition status like the old dryRunValidiation did.
+			// A plain Go error maps to codeds.Unknown.
+			expectedErrContains: testDescribeInstancesError,
+			expectedErrCode:     codes.Unknown,
 		},
 		{
 			name: "new incoming dynamic credential update dry run error",
@@ -1030,14 +1159,27 @@ func TestPluginOnUpdateCatalogErr(t *testing.T) {
 					},
 				},
 			},
+			// ValidateCreds is called for DynamicAWS credentials before the dry-run
+			// DescribeInstances. Provide a mock STS that returns a successful AssumeRole
+			// so the validate step passes and execution reaches the EC2 mock.
+			credOpts: []credential.AwsCredentialPersistedStateOption{
+				credential.WithStateTestOpts([]awsutil.Option{
+					awsutil.WithSTSAPIFunc(awsutil.NewMockSTS(
+						awsutil.WithAssumeRoleOutput(validAssumeRoleOutput()),
+					)),
+				}),
+			},
 			catalogOpts: []awsCatalogPersistedStateOption{
 				withTestEC2APIFunc(newTestMockEC2(
 					nil,
 					testMockEC2WithDescribeInstancesError(errors.New(testDescribeInstancesError)),
 				)),
 			},
-			expectedErrContains: "aws describe instances failed: DescribeInstances error",
-			expectedErrCode:     codes.FailedPrecondition,
+			// checkHosts returns the DescribeInstances error as-is rather than wrapping it
+			// in a gRPC FailedPrecondition status like the old dryRunValidiation did.
+			// A plain Go error maps to codes.Unknown.
+			expectedErrContains: testDescribeInstancesError,
+			expectedErrCode:     codes.Unknown,
 		},
 		{
 			name: "replace creds error",
@@ -1211,8 +1353,53 @@ func TestPluginOnUpdateCatalogErr(t *testing.T) {
 					testMockEC2WithDescribeInstancesError(fmt.Errorf("oops there was an error")),
 				)),
 			},
-			expectedErrContains: "aws describe instances failed: oops there was an error",
-			expectedErrCode:     codes.FailedPrecondition,
+			// checkHosts returns the DescribeInstances error as-is rather than wrapping it
+			// in a gRPC FailedPrecondition status like the old dryRunValidiation did.
+			// A plain Go error maps to codes.Unknown.
+			expectedErrContains: "oops there was an error",
+			expectedErrCode:     codes.Unknown,
+		},
+		{
+			name: "final dry run gRPC status error preserves code",
+			req: &pb.OnUpdateCatalogRequest{
+				CurrentCatalog: &hostcatalogs.HostCatalog{
+					Attrs: &hostcatalogs.HostCatalog_Attributes{
+						Attributes: &structpb.Struct{
+							Fields: map[string]*structpb.Value{
+								credential.ConstRegion: structpb.NewStringValue("us-west-2"),
+							},
+						},
+					},
+				},
+				NewCatalog: &hostcatalogs.HostCatalog{
+					Attrs: &hostcatalogs.HostCatalog_Attributes{
+						Attributes: &structpb.Struct{
+							Fields: map[string]*structpb.Value{
+								credential.ConstRegion: structpb.NewStringValue("us-west-2"),
+							},
+						},
+					},
+				},
+				Persisted: &pb.HostCatalogPersisted{
+					Secrets: &structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							credential.ConstAccessKeyId:          structpb.NewStringValue("AKIA_foobar"),
+							credential.ConstSecretAccessKey:      structpb.NewStringValue("bazqux"),
+							credential.ConstCredsLastRotatedTime: structpb.NewStringValue("2006-01-02T15:04:05+07:00"),
+						},
+					},
+				},
+			},
+			catalogOpts: []awsCatalogPersistedStateOption{
+				withTestEC2APIFunc(newTestMockEC2(
+					nil,
+					testMockEC2WithDescribeInstancesError(awserrors.TestAwsError("AccessDenied", "not authorized to perform ec2:DescribeInstances")),
+				)),
+			},
+			// ParseAWSError maps AccessDenied to PermissionDenied. The dry-run
+			// error handler should preserve that gRPC status, not wrap it as Unknown.
+			expectedErrContains: "invalid credentials",
+			expectedErrCode:     codes.PermissionDenied,
 		},
 	}

@@ -1565,8 +1752,57 @@ func TestPluginOnCreateSetErr(t *testing.T) {
 					testMockEC2WithDescribeInstancesError(errors.New(testDescribeInstancesError)),
 				)),
 			},
-			expectedErrContains: fmt.Sprintf("aws describe instances failed: %s", testDescribeInstancesError),
-			expectedErrCode:     codes.FailedPrecondition,
+			expectedErrContains: testDescribeInstancesError,
+			expectedErrCode:     codes.Unknown,
+		},
+		{
+			name: "dry run gRPC status error preserves code",
+			req: &pb.OnCreateSetRequest{
+				Catalog: &hostcatalogs.HostCatalog{
+					Attrs: &hostcatalogs.HostCatalog_Attributes{
+						Attributes: &structpb.Struct{
+							Fields: map[string]*structpb.Value{
+								credential.ConstRegion:                    structpb.NewStringValue("us-west-2"),
+								credential.ConstDisableCredentialRotation: structpb.NewBoolValue(true),
+							},
+						},
+					},
+				},
+				Persisted: &pb.HostCatalogPersisted{
+					Secrets: &structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							credential.ConstAccessKeyId:     structpb.NewStringValue("AKIA_foobar"),
+							credential.ConstSecretAccessKey: structpb.NewStringValue("bazqux"),
+						},
+					},
+				},
+				Set: &hostsets.HostSet{
+					Id: "foobar",
+					Attrs: &hostsets.HostSet_Attributes{
+						Attributes: &structpb.Struct{
+							Fields: map[string]*structpb.Value{
+								ConstDescribeInstancesFilters: structpb.NewListValue(
+									&structpb.ListValue{
+										Values: []*structpb.Value{
+											structpb.NewStringValue("tag-key=foo"),
+										},
+									},
+								),
+							},
+						},
+					},
+				},
+			},
+			catalogOpts: []awsCatalogPersistedStateOption{
+				withTestEC2APIFunc(newTestMockEC2(
+					nil,
+					testMockEC2WithDescribeInstancesError(awserrors.TestAwsError("AccessDenied", "not authorized to perform ec2:DescribeInstances")),
+				)),
+			},
+			// ParseAWSError maps AccessDenied to PermissionDenied. The dry-run
+			// error handler should preserve that gRPC status, not wrap it as Unknown.
+			expectedErrContains: "invalid credentials",
+			expectedErrCode:     codes.PermissionDenied,
 		},
 	}

@@ -1828,8 +2064,56 @@ func TestPluginOnUpdateSetErr(t *testing.T) {
 					testMockEC2WithDescribeInstancesError(errors.New(testDescribeInstancesError)),
 				)),
 			},
-			expectedErrContains: fmt.Sprintf("aws describe instances failed: %s", testDescribeInstancesError),
-			expectedErrCode:     codes.FailedPrecondition,
+			expectedErrContains: testDescribeInstancesError,
+			expectedErrCode:     codes.Unknown,
+		},
+		{
+			name: "dry run gRPC status error preserves code",
+			req: &pb.OnUpdateSetRequest{
+				Catalog: &hostcatalogs.HostCatalog{
+					Attrs: &hostcatalogs.HostCatalog_Attributes{
+						Attributes: &structpb.Struct{
+							Fields: map[string]*structpb.Value{
+								credential.ConstRegion:                    structpb.NewStringValue("us-west-2"),
+								credential.ConstDisableCredentialRotation: structpb.NewBoolValue(true),
+							},
+						},
+					},
+				},
+				Persisted: &pb.HostCatalogPersisted{
+					Secrets: &structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							credential.ConstAccessKeyId:     structpb.NewStringValue("AKIA_foobar"),
+							credential.ConstSecretAccessKey: structpb.NewStringValue("bazqux"),
+						},
+					},
+				},
+				NewSet: &hostsets.HostSet{
+					Attrs: &hostsets.HostSet_Attributes{
+						Attributes: &structpb.Struct{
+							Fields: map[string]*structpb.Value{
+								ConstDescribeInstancesFilters: structpb.NewListValue(
+									&structpb.ListValue{
+										Values: []*structpb.Value{
+											structpb.NewStringValue("tag-key=foo"),
+										},
+									},
+								),
+							},
+						},
+					},
+				},
+			},
+			catalogOpts: []awsCatalogPersistedStateOption{
+				withTestEC2APIFunc(newTestMockEC2(
+					nil,
+					testMockEC2WithDescribeInstancesError(awserrors.TestAwsError("AccessDenied", "not authorized to perform ec2:DescribeInstances")),
+				)),
+			},
+			// ParseAWSError maps AccessDenied to PermissionDenied. The dry-run
+			// error handler should preserve that gRPC status, not wrap it as Unknown.
+			expectedErrContains: "invalid credentials",
+			expectedErrCode:     codes.PermissionDenied,
 		},
 	}

@@ -1849,6 +2133,162 @@ func TestPluginOnUpdateSetErr(t *testing.T) {
 	}
 }

+func testListHostsSet(id, filter string) *hostsets.HostSet {
+	return &hostsets.HostSet{
+		Id: id,
+		Attrs: &hostsets.HostSet_Attributes{
+			Attributes: &structpb.Struct{
+				Fields: map[string]*structpb.Value{
+					ConstDescribeInstancesFilters: structpb.NewListValue(
+						&structpb.ListValue{
+							Values: []*structpb.Value{
+								structpb.NewStringValue(filter),
+							},
+						},
+					),
+				},
+			},
+		},
+	}
+}
+
+func testListHostsPersisted() *pb.HostCatalogPersisted {
+	return &pb.HostCatalogPersisted{
+		Secrets: &structpb.Struct{
+			Fields: map[string]*structpb.Value{
+				credential.ConstAccessKeyId:     structpb.NewStringValue("AKIA_foobar"),
+				credential.ConstSecretAccessKey: structpb.NewStringValue("bazqux"),
+			},
+		},
+	}
+}
+
+func testExpectedDescribeInput(filterKey, filterValue string) *ec2.DescribeInstancesInput {
+	return &ec2.DescribeInstancesInput{
+		DryRun: aws.Bool(false),
+		Filters: []types.Filter{
+			{
+				Name:   aws.String(filterKey),
+				Values: []string{filterValue},
+			},
+			{
+				Name:   aws.String("instance-state-name"),
+				Values: []string{string(types.InstanceStateNameRunning)},
+			},
+		},
+	}
+}
+
+func TestPluginListHosts(t *testing.T) {
+	describeOutput := &ec2.DescribeInstancesOutput{
+		Reservations: []types.Reservation{
+			{
+				Instances: []types.Instance{
+					{
+						InstanceId:       aws.String("i-shared"),
+						PrivateIpAddress: aws.String("10.0.0.1"),
+					},
+				},
+			},
+		},
+	}
+
+	cases := []struct {
+		name             string
+		catalogFields    map[string]*structpb.Value
+		sets             []*hostsets.HostSet
+		expectedRegion   string
+		expectedHosts    []*pb.ListHostsResponseHost
+		expectedInputs   []*ec2.DescribeInstancesInput
+		expectedDescribe int
+	}{
+		{
+			name: "principal account lists hosts",
+			catalogFields: map[string]*structpb.Value{
+				credential.ConstRegion: structpb.NewStringValue("us-west-2"),
+			},
+			sets: []*hostsets.HostSet{
+				testListHostsSet("set-1", "tag-key=foo"),
+			},
+			expectedRegion: "us-west-2",
+			expectedHosts: []*pb.ListHostsResponseHost{
+				{
+					ExternalId: "i-shared",
+					SetIds:     []string{"set-1"},
+				},
+			},
+			expectedInputs: []*ec2.DescribeInstancesInput{
+				testExpectedDescribeInput("tag-key", "foo"),
+			},
+			expectedDescribe: 1,
+		},
+		{
+			name: "target account lists hosts without querying principal",
+			catalogFields: map[string]*structpb.Value{
+				credential.ConstRegion:        structpb.NewStringValue("us-west-2"),
+				credential.ConstTargetRoleArn: structpb.NewStringValue("arn:aws:iam::222222222222:role/Target"),
+				credential.ConstTargetRegion:  structpb.NewStringValue("eu-west-1"),
+			},
+			sets: []*hostsets.HostSet{
+				testListHostsSet("set-1", "tag-key=foo"),
+				testListHostsSet("set-2", "tag-key=bar"),
+			},
+			expectedRegion: "eu-west-1",
+			expectedHosts: []*pb.ListHostsResponseHost{
+				{
+					ExternalId: "i-shared",
+					SetIds:     []string{"set-1", "set-2"},
+				},
+			},
+			expectedInputs: []*ec2.DescribeInstancesInput{
+				testExpectedDescribeInput("tag-key", "foo"),
+				testExpectedDescribeInput("tag-key", "bar"),
+			},
+			expectedDescribe: 2,
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			require := require.New(t)
+			state := &testMockEC2State{}
+			p := &HostPlugin{
+				testCatalogStateOpts: []awsCatalogPersistedStateOption{
+					withTestEC2APIFunc(newTestMockEC2(
+						state,
+						testMockEC2WithDescribeInstancesOutput(describeOutput),
+					)),
+				},
+			}
+
+			resp, err := p.ListHosts(context.Background(), &pb.ListHostsRequest{
+				Catalog: &hostcatalogs.HostCatalog{
+					Attrs: &hostcatalogs.HostCatalog_Attributes{
+						Attributes: &structpb.Struct{Fields: tc.catalogFields},
+					},
+				},
+				Persisted: testListHostsPersisted(),
+				Sets:      tc.sets,
+			})
+			require.NoError(err)
+			require.NotNil(resp)
+			require.Len(resp.GetHosts(), len(tc.expectedHosts))
+			for i, expected := range tc.expectedHosts {
+				require.Equal(expected.ExternalId, resp.Hosts[i].ExternalId)
+				require.Equal(expected.SetIds, resp.Hosts[i].SetIds)
+			}
+
+			require.Equal(tc.expectedDescribe, state.DescribeInstancesCallCount)
+			require.Len(state.ClientRegions, tc.expectedDescribe)
+			for _, region := range state.ClientRegions {
+				require.Equal(tc.expectedRegion, region)
+			}
+			require.Equal(tc.expectedInputs, state.DescribeInstancesInputs)
+		})
+	}
+}
+
 func TestPluginListHostsErr(t *testing.T) {
 	cases := []struct {
 		name                string
@@ -2130,9 +2570,103 @@ func TestPluginListHostsErr(t *testing.T) {
 					testMockEC2WithDescribeInstancesError(errors.New(testDescribeInstancesError)),
 				)),
 			},
-			expectedErrContains: fmt.Sprintf("error running DescribeInstances for host set id \"foobar\": %s", testDescribeInstancesError),
+			expectedErrContains: fmt.Sprintf("error retrieving host results for host set id \"foobar\": %s", testDescribeInstancesError),
+			expectedErrCode:     codes.Unknown,
+		},
+		{
+			name: "target attributes missing target_role_arn",
+			req: &pb.ListHostsRequest{
+				Catalog: &hostcatalogs.HostCatalog{
+					Attrs: &hostcatalogs.HostCatalog_Attributes{
+						Attributes: &structpb.Struct{
+							Fields: map[string]*structpb.Value{
+								credential.ConstRegion:       structpb.NewStringValue("us-west-2"),
+								credential.ConstTargetRegion: structpb.NewStringValue("eu-west-1"),
+							},
+						},
+					},
+				},
+			},
+			expectedErrContains: "attributes.target_role_arn: missing required value \"target_role_arn\"",
 			expectedErrCode:     codes.InvalidArgument,
 		},
+		{
+			name: "target EC2 client error",
+			req: &pb.ListHostsRequest{
+				Catalog: &hostcatalogs.HostCatalog{
+					Attrs: &hostcatalogs.HostCatalog_Attributes{
+						Attributes: &structpb.Struct{
+							Fields: map[string]*structpb.Value{
+								credential.ConstRegion:        structpb.NewStringValue("us-west-2"),
+								credential.ConstTargetRoleArn: structpb.NewStringValue("arn:aws:iam::222222222222:role/Target"),
+							},
+						},
+					},
+				},
+				Persisted: &pb.HostCatalogPersisted{
+					Secrets: &structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							credential.ConstAccessKeyId:          structpb.NewStringValue("AKIA_foobar"),
+							credential.ConstSecretAccessKey:      structpb.NewStringValue("bazqux"),
+							credential.ConstCredsLastRotatedTime: structpb.NewStringValue("2006-01-02T15:04:05+07:00"),
+						},
+					},
+				},
+				Sets: []*hostsets.HostSet{
+					{
+						Id: "foobar",
+						Attrs: &hostsets.HostSet_Attributes{
+							Attributes: &structpb.Struct{
+								Fields: map[string]*structpb.Value{
+									ConstDescribeInstancesFilters: structpb.NewListValue(
+										&structpb.ListValue{
+											Values: []*structpb.Value{
+												structpb.NewStringValue("tag-key=foo"),
+											},
+										},
+									),
+								},
+							},
+						},
+					},
+				},
+			},
+			catalogOpts: []awsCatalogPersistedStateOption{
+				withTestEC2APIFunc(func(...aws.Config) (EC2API, error) {
+					return nil, errors.New("test EC2 client error")
+				}),
+			},
+			expectedErrContains: "unable to list hosts for host set \"foobar\": EC2 client setup failed for target account: test EC2 client error",
+			expectedErrCode:     codes.Unknown,
+		},
+		{
+			name: "target DescribeInstances error",
+			req: &pb.ListHostsRequest{
+				Catalog: &hostcatalogs.HostCatalog{
+					Attrs: &hostcatalogs.HostCatalog_Attributes{
+						Attributes: &structpb.Struct{
+							Fields: map[string]*structpb.Value{
+								credential.ConstRegion:        structpb.NewStringValue("us-west-2"),
+								credential.ConstTargetRoleArn: structpb.NewStringValue("arn:aws:iam::222222222222:role/Target"),
+								credential.ConstTargetRegion:  structpb.NewStringValue("eu-west-1"),
+							},
+						},
+					},
+				},
+				Persisted: testListHostsPersisted(),
+				Sets: []*hostsets.HostSet{
+					testListHostsSet("foobar", "tag-key=foo"),
+				},
+			},
+			catalogOpts: []awsCatalogPersistedStateOption{
+				withTestEC2APIFunc(newTestMockEC2(
+					nil,
+					testMockEC2WithDescribeInstancesError(errors.New(testDescribeInstancesError)),
+				)),
+			},
+			expectedErrContains: "unable to list hosts for host set \"foobar\": EC2 DescribeInstances failed for target account: DescribeInstances error",
+			expectedErrCode:     codes.Unknown,
+		},
 		{
 			name: "awsInstanceToHost error",
 			req: &pb.ListHostsRequest{
@@ -2192,7 +2726,115 @@ func TestPluginListHostsErr(t *testing.T) {
 				)),
 			},
 			expectedErrContains: "error processing host results for host set id \"foobar\": response integrity error: missing instance id",
-			expectedErrCode:     codes.InvalidArgument,
+			expectedErrCode:     codes.Unknown,
+		},
+		{
+			name: "DescribeInstances AccessDenied",
+			req: &pb.ListHostsRequest{
+				Catalog: &hostcatalogs.HostCatalog{
+					Attrs: &hostcatalogs.HostCatalog_Attributes{
+						Attributes: &structpb.Struct{
+							Fields: map[string]*structpb.Value{
+								credential.ConstRegion: structpb.NewStringValue("us-west-2"),
+							},
+						},
+					},
+				},
+				Persisted: testListHostsPersisted(),
+				Sets: []*hostsets.HostSet{
+					testListHostsSet("foobar", "tag-key=foo"),
+				},
+			},
+			catalogOpts: []awsCatalogPersistedStateOption{
+				withTestEC2APIFunc(newTestMockEC2(
+					nil,
+					testMockEC2WithDescribeInstancesError(awserrors.TestAwsError("AccessDenied", "not authorized to perform ec2:DescribeInstances")),
+				)),
+			},
+			expectedErrContains: "invalid credentials",
+			expectedErrCode:     codes.PermissionDenied,
+		},
+		{
+			name: "DescribeInstances UnauthorizedOperation",
+			req: &pb.ListHostsRequest{
+				Catalog: &hostcatalogs.HostCatalog{
+					Attrs: &hostcatalogs.HostCatalog_Attributes{
+						Attributes: &structpb.Struct{
+							Fields: map[string]*structpb.Value{
+								credential.ConstRegion: structpb.NewStringValue("us-west-2"),
+							},
+						},
+					},
+				},
+				Persisted: testListHostsPersisted(),
+				Sets: []*hostsets.HostSet{
+					testListHostsSet("foobar", "tag-key=foo"),
+				},
+			},
+			catalogOpts: []awsCatalogPersistedStateOption{
+				withTestEC2APIFunc(newTestMockEC2(
+					nil,
+					testMockEC2WithDescribeInstancesError(awserrors.TestAwsError("UnauthorizedOperation", "You are not authorized to perform this operation.")),
+				)),
+			},
+			expectedErrContains: "invalid credentials",
+			expectedErrCode:     codes.PermissionDenied,
+		},
+		{
+			name: "target DescribeInstances AccessDenied",
+			req: &pb.ListHostsRequest{
+				Catalog: &hostcatalogs.HostCatalog{
+					Attrs: &hostcatalogs.HostCatalog_Attributes{
+						Attributes: &structpb.Struct{
+							Fields: map[string]*structpb.Value{
+								credential.ConstRegion:        structpb.NewStringValue("us-west-2"),
+								credential.ConstTargetRoleArn: structpb.NewStringValue("arn:aws:iam::222222222222:role/Target"),
+								credential.ConstTargetRegion:  structpb.NewStringValue("eu-west-1"),
+							},
+						},
+					},
+				},
+				Persisted: testListHostsPersisted(),
+				Sets: []*hostsets.HostSet{
+					testListHostsSet("foobar", "tag-key=foo"),
+				},
+			},
+			catalogOpts: []awsCatalogPersistedStateOption{
+				withTestEC2APIFunc(newTestMockEC2(
+					nil,
+					testMockEC2WithDescribeInstancesError(awserrors.TestAwsError("AccessDenied", "not authorized to perform ec2:DescribeInstances")),
+				)),
+			},
+			expectedErrContains: "invalid credentials",
+			expectedErrCode:     codes.PermissionDenied,
+		},
+		{
+			name: "target EC2 client AccessDenied",
+			req: &pb.ListHostsRequest{
+				Catalog: &hostcatalogs.HostCatalog{
+					Attrs: &hostcatalogs.HostCatalog_Attributes{
+						Attributes: &structpb.Struct{
+							Fields: map[string]*structpb.Value{
+								credential.ConstRegion:        structpb.NewStringValue("us-west-2"),
+								credential.ConstTargetRoleArn: structpb.NewStringValue("arn:aws:iam::222222222222:role/Target"),
+							},
+						},
+					},
+				},
+				Persisted: testListHostsPersisted(),
+				Sets: []*hostsets.HostSet{
+					testListHostsSet("foobar", "tag-key=foo"),
+				},
+			},
+			catalogOpts: []awsCatalogPersistedStateOption{
+				withTestEC2APIFunc(func(...aws.Config) (EC2API, error) {
+					return nil, awserrors.TestAwsError("AccessDenied", "not authorized to assume role")
+				}),
+			},
+			// ec2ClientForTarget returns testEC2APIFunc errors unparsed; checkHosts
+			// only preserves existing gRPC statuses, so this surfaces as Unknown.
+			expectedErrContains: "unable to list hosts for host set \"foobar\": EC2 client setup failed for target account: api error AccessDenied: not authorized to assume role",
+			expectedErrCode:     codes.Unknown,
 		},
 	}

@@ -2383,6 +3025,21 @@ func TestBuildDescribeInstancesInput(t *testing.T) {
 			require.Equal(tc.expected, actual)
 		})
 	}
+
+	t.Run("nil attrs, dry run", func(t *testing.T) {
+		require := require.New(t)
+		actual, err := buildDescribeInstancesInput(nil, true)
+		require.NoError(err)
+		require.Equal(&ec2.DescribeInstancesInput{
+			DryRun: aws.Bool(true),
+			Filters: []types.Filter{
+				{
+					Name:   aws.String("instance-state-name"),
+					Values: []string{string(types.InstanceStateNameRunning)},
+				},
+			},
+		}, actual)
+	})
 }

 func TestAwsInstanceToHost(t *testing.T) {
@@ -2821,54 +3478,3 @@ func TestAppendDistinct(t *testing.T) {
 		})
 	}
 }
-
-func TestDryRunValidation(t *testing.T) {
-	t.Run("nil credential state", func(t *testing.T) {
-		st := dryRunValidation(context.Background(), nil, nil)
-		require.NotNil(t, st)
-		require.Equal(t, codes.InvalidArgument.String(), st.Code().String())
-		require.Equal(t, "persisted state is required", st.Message())
-	})
-
-	t.Run("ec2ClientErr", func(t *testing.T) {
-		st := dryRunValidation(context.Background(), &awsCatalogPersistedState{
-			AwsCredentialPersistedState: &credential.AwsCredentialPersistedState{
-				CredentialsConfig: &awsutil.CredentialsConfig{},
-			},
-			testEC2APIFunc: func(...aws.Config) (EC2API, error) {
-				return nil, fmt.Errorf("oops ec2 client err")
-			},
-		}, []ec2Option{})
-		require.NotNil(t, st)
-		require.Equal(t, codes.InvalidArgument.String(), st.Code().String())
-		require.Equal(t, "error getting EC2 client: oops ec2 client err", st.Message())
-	})
-
-	t.Run("describeInstancesErr", func(t *testing.T) {
-		st := dryRunValidation(context.Background(), &awsCatalogPersistedState{
-			AwsCredentialPersistedState: &credential.AwsCredentialPersistedState{
-				CredentialsConfig: &awsutil.CredentialsConfig{
-					AccessKey: "AKIAfoo",
-					SecretKey: "baz",
-				},
-			},
-			testEC2APIFunc: newTestMockEC2(nil, testMockEC2WithDescribeInstancesError(fmt.Errorf("oops describe instances error"))),
-		}, []ec2Option{})
-		require.NotNil(t, st)
-		require.Equal(t, codes.FailedPrecondition.String(), st.Code().String())
-		require.Equal(t, "aws describe instances failed: oops describe instances error", st.Message())
-	})
-
-	t.Run("success", func(t *testing.T) {
-		st := dryRunValidation(context.Background(), &awsCatalogPersistedState{
-			AwsCredentialPersistedState: &credential.AwsCredentialPersistedState{
-				CredentialsConfig: &awsutil.CredentialsConfig{
-					AccessKey: "AKIAfoo",
-					SecretKey: "baz",
-				},
-			},
-			testEC2APIFunc: newTestMockEC2(nil, testMockEC2WithDescribeInstancesOutput(&ec2.DescribeInstancesOutput{})),
-		}, []ec2Option{})
-		require.Nil(t, st)
-	})
-}
@@ -22,11 +22,17 @@ const (
 type testMockEC2State struct {
 	DescribeInstancesCalled      bool
 	DescribeInstancesInputParams *ec2.DescribeInstancesInput
+	DescribeInstancesCallCount   int
+	DescribeInstancesInputs      []*ec2.DescribeInstancesInput
+	ClientRegions                []string
 }

 func (s *testMockEC2State) Reset() {
 	s.DescribeInstancesCalled = false
 	s.DescribeInstancesInputParams = nil
+	s.DescribeInstancesCallCount = 0
+	s.DescribeInstancesInputs = nil
+	s.ClientRegions = nil
 }

 type testMockEC2 struct {
@@ -72,7 +78,10 @@ func newTestMockEC2(state *testMockEC2State, opts ...testMockEC2Option) ec2APIFu
 			if cfg.Region != "" {
 				m.Region = cfg.Region
 			}
+		}

+		if state != nil {
+			state.ClientRegions = append(state.ClientRegions, m.Region)
 		}

 		return m, nil
@@ -83,6 +92,8 @@ func (m *testMockEC2) DescribeInstances(ctx context.Context, input *ec2.Describe
 	if m.State != nil {
 		m.State.DescribeInstancesCalled = true
 		m.State.DescribeInstancesInputParams = input
+		m.State.DescribeInstancesCallCount++
+		m.State.DescribeInstancesInputs = append(m.State.DescribeInstancesInputs, input)
 	}

 	if m.DescribeInstancesError != nil {
@@ -11,5 +11,5 @@ const (
 	ConstAwsDualStack = "dual_stack"

 	// defaultStreamChunkSize is the recommened chunk size for sending data through a stream
-	defaultStreamChunkSize = 65536 // 64 KiB
+	defaultStreamChunkSize = 1 << 20 // 1 MiB
 )
@@ -665,6 +665,23 @@ func (p *StoragePlugin) GetObject(req *pb.GetObjectRequest, stream pb.StoragePlu
 	return nil
 }

+const (
+	// multipartThreshold is the file size, in bytes, above which PutObject
+	// uploads an object using a multipart upload instead of a single PutObject
+	// request. 8 MiB matches the AWS CLI and boto3 defaults.
+	multipartThreshold = 8 * 1024 * 1024 // 8 MiB
+
+	// defaultMultipartPartSize is the default size, in bytes, of each part
+	// uploaded during a multipart upload. It is kept equal to
+	// multipartThreshold so a multipart upload always has at least two parts
+	// (S3 requires every part except the last to be at least 5 MiB).
+	defaultMultipartPartSize = 8 * 1024 * 1024 // 8 MiB
+
+	// maxMultipartParts is the maximum number of parts S3 permits for a single
+	// multipart upload.
+	maxMultipartParts = 10000
+)
+
 // PutObject is called when putting objects into an s3 bucket.
 func (p *StoragePlugin) PutObject(ctx context.Context, req *pb.PutObjectRequest) (*pb.PutObjectResponse, error) {
 	if req == nil {
@@ -751,6 +768,32 @@ func (p *StoragePlugin) PutObject(ctx context.Context, req *pb.PutObjectRequest)
 	}
 	objectKey := path.Join(bucket.GetBucketPrefix(), req.GetKey())

+	// decodedChecksum is the raw SHA-256 digest of the entire object. Boundary
+	// compares this byte-for-byte against the hash it computed locally before
+	// the upload, so it must always be the whole-object checksum regardless of
+	// whether a single PutObject or a multipart upload is used.
+	decodedChecksum, err := base64.StdEncoding.DecodeString(checksum)
+	if err != nil {
+		return nil, errors.UnknownStatus("failed to decode checksum value")
+	}
+
+	// for larger files, use a multipart upload instead of a single PutObject
+	// request.
+	if info.Size() > multipartThreshold {
+		partSize := int64(defaultMultipartPartSize)
+		// S3 allows at most maxMultipartParts parts per upload, so grow the
+		// part size for very large objects to stay within that limit.
+		if sz := info.Size(); sz/partSize >= maxMultipartParts {
+			partSize = (sz + maxMultipartParts - 1) / maxMultipartParts
+		}
+		if err := p.putObjectMultipart(ctx, req, storageState, bucket.GetBucketName(), objectKey, file, partSize, opts...); err != nil {
+			return nil, err
+		}
+		return &pb.PutObjectResponse{
+			ChecksumSha_256: decodedChecksum,
+		}, nil
+	}
+
 	putCall := func(s3Client S3API) (any, error) {
 		return s3Client.PutObject(ctx, &s3.PutObjectInput{
 			Bucket:            aws.String(bucket.GetBucketName()),
@@ -772,15 +815,126 @@ func (p *StoragePlugin) PutObject(ctx context.Context, req *pb.PutObjectRequest)
 	if checksum != *resp.ChecksumSHA256 {
 		return nil, checksumMistmatchStatus()
 	}
-	decodedChecksum, err := base64.StdEncoding.DecodeString(*resp.ChecksumSHA256)
-	if err != nil {
-		return nil, errors.UnknownStatus("failed to decode checksum value from aws")
-	}
 	return &pb.PutObjectResponse{
 		ChecksumSha_256: decodedChecksum,
 	}, nil
 }

+// putObjectMultipart uploads file to the given bucket and key using an S3
+// multipart upload. The file is split into parts of partSize bytes (the final
+// part may be smaller) and each part is uploaded with its own SHA-256 checksum
+// so S3 can verify part integrity on the wire.
+//
+// If any step fails the upload is aborted on a best-effort basis to avoid
+// leaving orphaned parts behind, which would otherwise continue to accrue
+// storage charges.
+func (p *StoragePlugin) putObjectMultipart(
+	ctx context.Context,
+	req *pb.PutObjectRequest,
+	storageState *awsStoragePersistedState,
+	bucketName, objectKey string,
+	file *os.File,
+	partSize int64,
+	opts ...s3Option,
+) error {
+	bucketId := req.GetBucket().GetId()
+
+	createCall := func(s3Client S3API) (any, error) {
+		return s3Client.CreateMultipartUpload(ctx, &s3.CreateMultipartUploadInput{
+			Bucket:            aws.String(bucketName),
+			Key:               aws.String(objectKey),
+			ChecksumAlgorithm: types.ChecksumAlgorithmSha256,
+		})
+	}
+	createResp, err := p.call(ctx, createCall, bucketId, storageState, opts...)
+	if err != nil {
+		return parseS3Error("create multipart upload", err, req).Err()
+	}
+	uploadId := createResp.(*s3.CreateMultipartUploadOutput).UploadId
+
+	// once the upload has been created, any subsequent failure must abort it so
+	// uploaded parts are not orphaned.
+	abort := func() {
+		abortCall := func(s3Client S3API) (any, error) {
+			return s3Client.AbortMultipartUpload(ctx, &s3.AbortMultipartUploadInput{
+				Bucket:   aws.String(bucketName),
+				Key:      aws.String(objectKey),
+				UploadId: uploadId,
+			})
+		}
+		// best effort: the failure that triggered the abort is more useful to
+		// the caller than an error from the abort itself.
+		_, _ = p.call(ctx, abortCall, bucketId, storageState, opts...)
+	}
+
+	var completedParts []types.CompletedPart
+	buf := make([]byte, partSize)
+	var partNumber int32 = 1
+	for {
+		n, readErr := io.ReadFull(file, buf)
+		if readErr == io.EOF {
+			// previous iteration consumed the final bytes of the file
+			break
+		}
+		if readErr != nil && readErr != io.ErrUnexpectedEOF {
+			abort()
+			return errors.UnknownStatusf("failed to read file: %s", readErr)
+		}
+
+		partData := buf[:n]
+		sum := sha256.Sum256(partData)
+		partChecksum := base64.StdEncoding.EncodeToString(sum[:])
+
+		pn := partNumber
+		uploadCall := func(s3Client S3API) (any, error) {
+			return s3Client.UploadPart(ctx, &s3.UploadPartInput{
+				Bucket:            aws.String(bucketName),
+				Key:               aws.String(objectKey),
+				UploadId:          uploadId,
+				PartNumber:        aws.Int32(pn),
+				Body:              bytes.NewReader(partData),
+				ContentLength:     aws.Int64(int64(n)),
+				ChecksumAlgorithm: types.ChecksumAlgorithmSha256,
+				ChecksumSHA256:    aws.String(partChecksum),
+			})
+		}
+		uploadResp, err := p.call(ctx, uploadCall, bucketId, storageState, opts...)
+		if err != nil {
+			abort()
+			return parseS3Error("upload part", err, req).Err()
+		}
+		part := uploadResp.(*s3.UploadPartOutput)
+		completedParts = append(completedParts, types.CompletedPart{
+			ETag:           part.ETag,
+			ChecksumSHA256: part.ChecksumSHA256,
+			PartNumber:     aws.Int32(pn),
+		})
+
+		partNumber++
+		if readErr == io.ErrUnexpectedEOF {
+			// the final, short part
+			break
+		}
+	}
+
+	completeCall := func(s3Client S3API) (any, error) {
+		return s3Client.CompleteMultipartUpload(ctx, &s3.CompleteMultipartUploadInput{
+			Bucket:   aws.String(bucketName),
+			Key:      aws.String(objectKey),
+			UploadId: uploadId,
+			MultipartUpload: &types.CompletedMultipartUpload{
+				Parts: completedParts,
+			},
+		})
+	}
+	if _, err := p.call(ctx, completeCall, bucketId, storageState, opts...); err != nil {
+		abort()
+		return parseS3Error("complete multipart upload", err, req).Err()
+	}
+
+	return nil
+}
+
 // DeleteObjects is used to delete one or many objects from an s3 bucket.
 func (p *StoragePlugin) DeleteObjects(ctx context.Context, req *pb.DeleteObjectsRequest) (*pb.DeleteObjectsResponse, error) {
 	if req.GetKeyPrefix() == "" {
@@ -3715,6 +3715,195 @@ func TestStoragePlugin_PutObject(t *testing.T) {
 	}
 }

+func TestStoragePlugin_PutObjectMultipart(t *testing.T) {
+	td := t.TempDir()
+
+	// genFile writes size bytes of deterministic content to a temp file and
+	// returns its path along with the raw SHA-256 digest of the whole file.
+	genFile := func(t *testing.T, name string, size int) (string, []byte) {
+		t.Helper()
+		data := make([]byte, size)
+		for i := range data {
+			data[i] = byte(i % 251)
+		}
+		fp := path.Join(td, name)
+		require.NoError(t, os.WriteFile(fp, data, 0o600))
+		sum := sha256.Sum256(data)
+		return fp, sum[:]
+	}
+
+	validRequest := func(p string) *pb.PutObjectRequest {
+		return &pb.PutObjectRequest{
+			Bucket: &storagebuckets.StorageBucket{
+				BucketName:   "external-obj-store",
+				BucketPrefix: "prefix",
+				Secrets:      credential.MockStaticCredentialSecrets(),
+				Attributes: &structpb.Struct{
+					Fields: map[string]*structpb.Value{
+						credential.ConstRegion: structpb.NewStringValue("us-west-2"),
+					},
+				},
+			},
+			Key:  "mock-object",
+			Path: p,
+		}
+	}
+
+	t.Run("multipart success spanning multiple parts", func(t *testing.T) {
+		require, assert := require.New(t), assert.New(t)
+		// 20 MiB with 8 MiB parts -> 3 parts (8, 8, 4 MiB).
+		fp, wholeChecksum := genFile(t, "large-file", 20*1024*1024)
+
+		state := &testMockS3State{}
+		p := &StoragePlugin{
+			testCredStateOpts: validSTSMock(),
+			testStorageStateOpts: []awsStoragePersistedStateOption{
+				withTestS3APIFunc(newTestMockS3(state)),
+			},
+		}
+
+		resp, err := p.PutObject(context.Background(), validRequest(fp))
+		require.NoError(err)
+		require.NotNil(resp)
+
+		// Boundary must receive the whole-object SHA-256, not the multipart
+		// composite checksum.
+		assert.True(bytes.Equal(wholeChecksum, resp.GetChecksumSha_256()))
+
+		// The single-shot PutObject path must not have been used.
+		assert.False(state.PutObjectCalled)
+		assert.True(state.CreateMultipartUploadCalled)
+		assert.Equal(3, state.UploadPartCallCount)
+		assert.True(state.CompleteMultipartUploadCalled)
+		assert.False(state.AbortMultipartUploadCalled)
+
+		// The reassembled part bodies must equal the original file content.
+		orig, err := os.ReadFile(fp)
+		require.NoError(err)
+		assert.True(bytes.Equal(orig, state.UploadPartBody))
+
+		// The object key must include the configured bucket prefix.
+		require.NotNil(state.CreateMultipartUploadInputParams)
+		assert.Equal("prefix/mock-object", aws.ToString(state.CreateMultipartUploadInputParams.Key))
+	})
+
+	t.Run("file just above threshold uses two parts", func(t *testing.T) {
+		require, assert := require.New(t), assert.New(t)
+		// 8 MiB + 1 byte -> 2 parts (8 MiB, 1 byte).
+		fp, wholeChecksum := genFile(t, "just-over", 8*1024*1024+1)
+
+		state := &testMockS3State{}
+		p := &StoragePlugin{
+			testCredStateOpts: validSTSMock(),
+			testStorageStateOpts: []awsStoragePersistedStateOption{
+				withTestS3APIFunc(newTestMockS3(state)),
+			},
+		}
+
+		resp, err := p.PutObject(context.Background(), validRequest(fp))
+		require.NoError(err)
+		assert.True(bytes.Equal(wholeChecksum, resp.GetChecksumSha_256()))
+		assert.Equal(2, state.UploadPartCallCount)
+		assert.True(state.CompleteMultipartUploadCalled)
+	})
+
+	t.Run("file at threshold uses single PutObject", func(t *testing.T) {
+		require, assert := require.New(t), assert.New(t)
+		// Exactly 8 MiB is not above the threshold, so the single-shot path is used.
+		fp, wholeChecksum := genFile(t, "at-threshold", 8*1024*1024)
+		checksum := base64.StdEncoding.EncodeToString(wholeChecksum)
+
+		state := &testMockS3State{}
+		p := &StoragePlugin{
+			testCredStateOpts: validSTSMock(),
+			testStorageStateOpts: []awsStoragePersistedStateOption{
+				withTestS3APIFunc(newTestMockS3(
+					state,
+					testMockS3WithPutObjectOutput(&s3.PutObjectOutput{
+						ChecksumSHA256: aws.String(checksum),
+					}),
+				)),
+			},
+		}
+
+		resp, err := p.PutObject(context.Background(), validRequest(fp))
+		require.NoError(err)
+		assert.True(bytes.Equal(wholeChecksum, resp.GetChecksumSha_256()))
+		assert.True(state.PutObjectCalled)
+		assert.False(state.CreateMultipartUploadCalled)
+	})
+
+	t.Run("create multipart upload error", func(t *testing.T) {
+		require, assert := require.New(t), assert.New(t)
+		fp, _ := genFile(t, "create-err", 20*1024*1024)
+
+		state := &testMockS3State{}
+		p := &StoragePlugin{
+			testCredStateOpts: validSTSMock(),
+			testStorageStateOpts: []awsStoragePersistedStateOption{
+				withTestS3APIFunc(newTestMockS3(
+					state,
+					testMockS3WithCreateMultipartUploadError(TestAwsS3Error("AccessDenied", "CreateMultipartUpload", "not authorized")),
+				)),
+			},
+		}
+
+		resp, err := p.PutObject(context.Background(), validRequest(fp))
+		require.Error(err)
+		assert.Nil(resp)
+		assert.Equal(codes.PermissionDenied, status.Code(err))
+		// Nothing was created, so nothing should be aborted.
+		assert.False(state.AbortMultipartUploadCalled)
+	})
+
+	t.Run("upload part error aborts upload", func(t *testing.T) {
+		require, assert := require.New(t), assert.New(t)
+		fp, _ := genFile(t, "upload-err", 20*1024*1024)
+
+		state := &testMockS3State{}
+		p := &StoragePlugin{
+			testCredStateOpts: validSTSMock(),
+			testStorageStateOpts: []awsStoragePersistedStateOption{
+				withTestS3APIFunc(newTestMockS3(
+					state,
+					testMockS3WithUploadPartErrorOnPart(2, TestAwsS3Error("AccessDenied", "UploadPart", "not authorized")),
+				)),
+			},
+		}
+
+		resp, err := p.PutObject(context.Background(), validRequest(fp))
+		require.Error(err)
+		assert.Nil(resp)
+		assert.Equal(codes.PermissionDenied, status.Code(err))
+		assert.True(state.CreateMultipartUploadCalled)
+		assert.False(state.CompleteMultipartUploadCalled)
+		// The failed upload must be aborted to avoid orphaned parts.
+		assert.True(state.AbortMultipartUploadCalled)
+	})
+
+	t.Run("complete multipart upload error aborts upload", func(t *testing.T) {
+		require, assert := require.New(t), assert.New(t)
+		fp, _ := genFile(t, "complete-err", 20*1024*1024)
+
+		state := &testMockS3State{}
+		p := &StoragePlugin{
+			testCredStateOpts: validSTSMock(),
+			testStorageStateOpts: []awsStoragePersistedStateOption{
+				withTestS3APIFunc(newTestMockS3(
+					state,
+					testMockS3WithCompleteMultipartUploadError(TestAwsS3Error("InternalError", "CompleteMultipartUpload", "boom")),
+				)),
+			},
+		}
+
+		resp, err := p.PutObject(context.Background(), validRequest(fp))
+		require.Error(err)
+		assert.Nil(resp)
+		assert.Equal(3, state.UploadPartCallCount)
+		assert.True(state.AbortMultipartUploadCalled)
+	})
+}
+
 func TestStoragePlugin_DeleteObjects(t *testing.T) {
 	validRequest := func() *pb.DeleteObjectsRequest {
 		return &pb.DeleteObjectsRequest{
@@ -7,9 +7,13 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"net/http"
 	"net/url"
+	"time"

 	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/aws/retry"
+	awshttp "github.com/aws/aws-sdk-go-v2/aws/transport/http"
 	"github.com/aws/aws-sdk-go-v2/service/s3"
 	smithyEndpoints "github.com/aws/smithy-go/endpoints"
 	"github.com/hashicorp/boundary-plugin-aws/internal/credential"
@@ -22,6 +26,10 @@ type S3API interface {
 	GetObject(ctx context.Context, params *s3.GetObjectInput, optFns ...func(*s3.Options)) (*s3.GetObjectOutput, error)
 	HeadObject(ctx context.Context, params *s3.HeadObjectInput, optFns ...func(*s3.Options)) (*s3.HeadObjectOutput, error)
 	PutObject(ctx context.Context, params *s3.PutObjectInput, optFns ...func(*s3.Options)) (*s3.PutObjectOutput, error)
+	CreateMultipartUpload(ctx context.Context, params *s3.CreateMultipartUploadInput, optFns ...func(*s3.Options)) (*s3.CreateMultipartUploadOutput, error)
+	UploadPart(ctx context.Context, params *s3.UploadPartInput, optFns ...func(*s3.Options)) (*s3.UploadPartOutput, error)
+	CompleteMultipartUpload(ctx context.Context, params *s3.CompleteMultipartUploadInput, optFns ...func(*s3.Options)) (*s3.CompleteMultipartUploadOutput, error)
+	AbortMultipartUpload(ctx context.Context, params *s3.AbortMultipartUploadInput, optFns ...func(*s3.Options)) (*s3.AbortMultipartUploadOutput, error)
 	DeleteObjects(ctx context.Context, params *s3.DeleteObjectsInput, optFns ...func(*s3.Options)) (*s3.DeleteObjectsOutput, error)
 	ListObjectsV2(ctx context.Context, params *s3.ListObjectsV2Input, optFns ...func(*s3.Options)) (*s3.ListObjectsV2Output, error)
 	Credentials() aws.Credentials
@@ -118,7 +126,10 @@ func (s *awsStoragePersistedState) s3Client(ctx context.Context, opt ...s3Option
 	if err != nil {
 		return nil, fmt.Errorf("failed to retrieve credentials: %v\n", err)
 	}
-
+	err = newTransport(awsCfg)
+	if err != nil {
+		return nil, fmt.Errorf("failed to configure new http transport: %v", err)
+	}
 	c := s3.NewFromConfig(*awsCfg, s3Opts...)
 	return &s3Client{Client: c, creds: creds}, nil
 }
@@ -202,3 +213,30 @@ func (e *endpointResolver) ResolveEndpoint(ctx context.Context, params s3.Endpoi
 	}
 	return
 }
+
+// newTransport returns an http Transport object. The http transport object utilizes the
+// default transport created by minio. The following transport fields are updated to provide
+// more reliable connectivity when handling larger objects:
+// MaxResponseHeaderBytes is set to 1MiB to prevent header reads from stalling.
+// WriteBufferSize is set to 1MiB, matching the default buffer size used in Boundary storage.
+// ReadBufferSize is set to 1MiB, matching the default buffer size used in Boundary storage.
+// ForceAttemptHTTP2 is set to true, supporting more resilient multiplexing and avoids HOL blocking on retries.
+// IdleConnTimeout is set to 2 minutes.
+func newTransport(cfg *aws.Config) error {
+	if cfg == nil {
+		return fmt.Errorf("missing aws configuration")
+	}
+	cfg.HTTPClient = awshttp.NewBuildableClient().WithTransportOptions(func(transport *http.Transport) {
+		transport.MaxResponseHeaderBytes = 1 << 20  // 1 MiB prevents header read from stalling
+		transport.WriteBufferSize = 1 << 20         // 1 MiB write buffer (default is 4 KiB)
+		transport.ReadBufferSize = 1 << 20          // 1 MiB read buffer (default is 4 KiB)
+		transport.ForceAttemptHTTP2 = true          // enables HTTP/2 where supported more resilient multiplexing, avoids HOL blocking on retries
+		transport.IdleConnTimeout = 2 * time.Minute // double the idle connection timeout, default is 1 minute
+	})
+	cfg.Retryer = func() aws.Retryer {
+		return retry.NewStandard(func(o *retry.StandardOptions) {
+			o.MaxAttempts = 20
+		})
+	}
+	return nil
+}
@@ -6,6 +6,8 @@ package storage
 import (
 	"bytes"
 	"context"
+	"crypto/sha256"
+	"encoding/base64"
 	"fmt"
 	"io"
 	"testing"
@@ -39,6 +41,23 @@ type testMockS3State struct {
 	PutObjectInputParams *s3.PutObjectInput
 	PutObjectBody        []byte

+	CreateMultipartUploadCalled      bool
+	CreateMultipartUploadInputParams *s3.CreateMultipartUploadInput
+
+	UploadPartCalled      bool
+	UploadPartCallCount   int
+	UploadPartInputParams []*s3.UploadPartInput
+	// UploadPartBody is the concatenation, in part-number order, of every
+	// part body received by UploadPart. It can be compared against the full
+	// object that was expected to be uploaded.
+	UploadPartBody []byte
+
+	CompleteMultipartUploadCalled      bool
+	CompleteMultipartUploadInputParams *s3.CompleteMultipartUploadInput
+
+	AbortMultipartUploadCalled      bool
+	AbortMultipartUploadInputParams *s3.AbortMultipartUploadInput
+
 	HeadObjectCalled      bool
 	HeadObjectInputParams *s3.HeadObjectInput

@@ -57,6 +76,16 @@ func (s *testMockS3State) Reset() {
 	s.PutObjectCalled = false
 	s.PutObjectInputParams = nil
 	s.PutObjectBody = nil
+	s.CreateMultipartUploadCalled = false
+	s.CreateMultipartUploadInputParams = nil
+	s.UploadPartCalled = false
+	s.UploadPartCallCount = 0
+	s.UploadPartInputParams = nil
+	s.UploadPartBody = nil
+	s.CompleteMultipartUploadCalled = false
+	s.CompleteMultipartUploadInputParams = nil
+	s.AbortMultipartUploadCalled = false
+	s.AbortMultipartUploadInputParams = nil
 	s.HeadObjectCalled = false
 	s.HeadObjectInputParams = nil
 	s.ListObjectsV2Called = false
@@ -81,6 +110,19 @@ type testMockS3 struct {
 	PutObjectOutput *s3.PutObjectOutput
 	PutObjectErr    error

+	// mocked responses for the multipart upload calls
+	CreateMultipartUploadOutput *s3.CreateMultipartUploadOutput
+	CreateMultipartUploadErr    error
+	UploadPartOutput            *s3.UploadPartOutput
+	UploadPartErr               error
+	// UploadPartErrOnPart, when greater than zero, causes UploadPart to return
+	// UploadPartErr (or a generic error) only for the matching part number.
+	UploadPartErrOnPart           int32
+	CompleteMultipartUploadOutput *s3.CompleteMultipartUploadOutput
+	CompleteMultipartUploadErr    error
+	AbortMultipartUploadOutput    *s3.AbortMultipartUploadOutput
+	AbortMultipartUploadErr       error
+
 	// mocked responses for headObject
 	HeadObjectOutput *s3.HeadObjectOutput
 	HeadObjectErr    error
@@ -114,6 +156,63 @@ func testMockS3WithPutObjectError(e error) testMockS3Option {
 	}
 }

+func testMockS3WithCreateMultipartUploadOutput(o *s3.CreateMultipartUploadOutput) testMockS3Option {
+	return func(m *testMockS3) error {
+		m.CreateMultipartUploadOutput = o
+		return nil
+	}
+}
+
+func testMockS3WithCreateMultipartUploadError(e error) testMockS3Option {
+	return func(m *testMockS3) error {
+		m.CreateMultipartUploadErr = e
+		return nil
+	}
+}
+
+func testMockS3WithUploadPartOutput(o *s3.UploadPartOutput) testMockS3Option {
+	return func(m *testMockS3) error {
+		m.UploadPartOutput = o
+		return nil
+	}
+}
+
+func testMockS3WithUploadPartError(e error) testMockS3Option {
+	return func(m *testMockS3) error {
+		m.UploadPartErr = e
+		return nil
+	}
+}
+
+func testMockS3WithUploadPartErrorOnPart(partNumber int32, e error) testMockS3Option {
+	return func(m *testMockS3) error {
+		m.UploadPartErr = e
+		m.UploadPartErrOnPart = partNumber
+		return nil
+	}
+}
+
+func testMockS3WithCompleteMultipartUploadOutput(o *s3.CompleteMultipartUploadOutput) testMockS3Option {
+	return func(m *testMockS3) error {
+		m.CompleteMultipartUploadOutput = o
+		return nil
+	}
+}
+
+func testMockS3WithCompleteMultipartUploadError(e error) testMockS3Option {
+	return func(m *testMockS3) error {
+		m.CompleteMultipartUploadErr = e
+		return nil
+	}
+}
+
+func testMockS3WithAbortMultipartUploadError(e error) testMockS3Option {
+	return func(m *testMockS3) error {
+		m.AbortMultipartUploadErr = e
+		return nil
+	}
+}
+
 func testMockS3WithGetObjectOutput(o *s3.GetObjectOutput) testMockS3Option {
 	return func(m *testMockS3) error {
 		m.GetObjectOutput = o
@@ -255,6 +354,95 @@ func (m *testMockS3) PutObject(ctx context.Context, params *s3.PutObjectInput, o
 	return m.PutObjectOutput, nil
 }

+func (m *testMockS3) CreateMultipartUpload(ctx context.Context, params *s3.CreateMultipartUploadInput, optFns ...func(*s3.Options)) (*s3.CreateMultipartUploadOutput, error) {
+	if m.State != nil {
+		m.State.CreateMultipartUploadCalled = true
+		m.State.CreateMultipartUploadInputParams = params
+	}
+
+	if m.CreateMultipartUploadErr != nil {
+		return nil, m.CreateMultipartUploadErr
+	}
+
+	if m.CreateMultipartUploadOutput != nil {
+		return m.CreateMultipartUploadOutput, nil
+	}
+	return &s3.CreateMultipartUploadOutput{
+		UploadId: aws.String("test-upload-id"),
+	}, nil
+}
+
+func (m *testMockS3) UploadPart(ctx context.Context, params *s3.UploadPartInput, optFns ...func(*s3.Options)) (*s3.UploadPartOutput, error) {
+	if m.State != nil {
+		m.State.UploadPartCalled = true
+		m.State.UploadPartCallCount++
+		m.State.UploadPartInputParams = append(m.State.UploadPartInputParams, params)
+	}
+
+	// always drain the body so the part data can be asserted on and so the
+	// reader is not left dangling.
+	var data []byte
+	if params.Body != nil {
+		var err error
+		data, err = io.ReadAll(params.Body)
+		if err != nil {
+			return nil, err
+		}
+		if m.State != nil {
+			m.State.UploadPartBody = append(m.State.UploadPartBody, data...)
+		}
+	}
+
+	if m.UploadPartErr != nil {
+		if m.UploadPartErrOnPart == 0 || (params.PartNumber != nil && *params.PartNumber == m.UploadPartErrOnPart) {
+			return nil, m.UploadPartErr
+		}
+	}
+
+	if m.UploadPartOutput != nil {
+		return m.UploadPartOutput, nil
+	}
+	// echo the supplied part checksum so CompleteMultipartUpload can be built
+	// the way the real service would allow.
+	sum := sha256.Sum256(data)
+	return &s3.UploadPartOutput{
+		ETag:           aws.String(fmt.Sprintf("etag-%d", aws.ToInt32(params.PartNumber))),
+		ChecksumSHA256: aws.String(base64.StdEncoding.EncodeToString(sum[:])),
+	}, nil
+}
+
+func (m *testMockS3) CompleteMultipartUpload(ctx context.Context, params *s3.CompleteMultipartUploadInput, optFns ...func(*s3.Options)) (*s3.CompleteMultipartUploadOutput, error) {
+	if m.State != nil {
+		m.State.CompleteMultipartUploadCalled = true
+		m.State.CompleteMultipartUploadInputParams = params
+	}
+
+	if m.CompleteMultipartUploadErr != nil {
+		return nil, m.CompleteMultipartUploadErr
+	}
+
+	if m.CompleteMultipartUploadOutput != nil {
+		return m.CompleteMultipartUploadOutput, nil
+	}
+	return &s3.CompleteMultipartUploadOutput{}, nil
+}
+
+func (m *testMockS3) AbortMultipartUpload(ctx context.Context, params *s3.AbortMultipartUploadInput, optFns ...func(*s3.Options)) (*s3.AbortMultipartUploadOutput, error) {
+	if m.State != nil {
+		m.State.AbortMultipartUploadCalled = true
+		m.State.AbortMultipartUploadInputParams = params
+	}
+
+	if m.AbortMultipartUploadErr != nil {
+		return nil, m.AbortMultipartUploadErr
+	}
+
+	if m.AbortMultipartUploadOutput != nil {
+		return m.AbortMultipartUploadOutput, nil
+	}
+	return &s3.AbortMultipartUploadOutput{}, nil
+}
+
 func (m *testMockS3) ListObjectsV2(ctx context.Context, params *s3.ListObjectsV2Input, optFns ...func(*s3.Options)) (*s3.ListObjectsV2Output, error) {
 	if m.State != nil {
 		m.State.ListObjectsV2Called = true
@@ -0,0 +1,304 @@
+// Copyright IBM Corp. 2021, 2026
+// SPDX-License-Identifier: MPL-2.0
+
+package testing
+
+// This file contains table-driven test infrastructure for AssumeRole and
+// cross-role (two-hop) Dynamic Host Catalog scenarios. Each plugin operation
+// has a corresponding case type and runner function. The orchestrator in
+// e2e_host_test.go populates the case tables using the Terraform outputs.
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/hashicorp/boundary-plugin-aws/internal/credential"
+	"github.com/hashicorp/boundary-plugin-aws/plugin/service/host"
+	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/hostcatalogs"
+	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/hostsets"
+	pb "github.com/hashicorp/boundary/sdk/pbs/plugin"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/structpb"
+)
+
+// ---------------------------------------------------------------------------
+// Attr builders
+// ---------------------------------------------------------------------------
+
+// roleArnAttrs builds catalog attributes for a single-hop AssumeRole catalog.
+func roleArnAttrs(region, roleArn string) map[string]any {
+	return map[string]any{
+		credential.ConstRegion:                    region,
+		credential.ConstDisableCredentialRotation: true,
+		credential.ConstRoleArn:                   roleArn,
+	}
+}
+
+// crossRoleAttrs builds catalog attributes for a two-hop cross-role catalog.
+func crossRoleAttrs(region, principalRoleArn, targetRoleArn string) map[string]any {
+	return map[string]any{
+		credential.ConstRegion:                    region,
+		credential.ConstDisableCredentialRotation: true,
+		credential.ConstRoleArn:                   principalRoleArn,
+		credential.ConstTargetRoleArn:             targetRoleArn,
+	}
+}
+
+// tagFilterSetAttrs builds set attributes with a single tag-key filter.
+func tagFilterSetAttrs(tags []string) map[string]any {
+	return map[string]any{
+		host.ConstDescribeInstancesFilters: []any{fmt.Sprintf("tag-key=%s", strings.Join(tags, ","))},
+	}
+}
+
+// requireTagInstancesMatchProvisioned asserts that every instance ID in tagInstancesMap
+// is present in provisionedIds (the raw []any slice from a Terraform output).
+func requireTagInstancesMatchProvisioned(t *testing.T, provisionedIds []any, tagInstancesMap map[string][]string) {
+	t.Helper()
+	idSet := make(map[string]struct{}, len(provisionedIds))
+	for _, id := range provisionedIds {
+		idSet[id.(string)] = struct{}{}
+	}
+	for tag, ids := range tagInstancesMap {
+		for _, id := range ids {
+			require.Contains(t, idSet, id, "instance ID %s in tag bucket %q was not provisioned by Terraform", id, tag)
+		}
+	}
+}
+
+// buildExpectedTagInstancesMap builds a map of tag key to instance IDs from a Terraform instance_tags output map.
+func buildExpectedTagInstancesMap(rawTags map[string]any, expectedTags []string) map[string][]string {
+	tagMap := make(map[string][]string)
+	for instanceId, instanceTags := range rawTags {
+		for tagKey := range instanceTags.(map[string]any) {
+			for _, expectedTag := range expectedTags {
+				if tagKey == expectedTag {
+					tagMap[tagKey] = append(tagMap[tagKey], instanceId)
+				}
+			}
+		}
+	}
+	return tagMap
+}
+
+// ---------------------------------------------------------------------------
+// Table-driven runners
+// ---------------------------------------------------------------------------
+
+type onCreateCatalogCase struct {
+	name         string
+	catalogAttrs map[string]any
+	wantErr      string // empty = expect success with empty persisted secrets
+}
+
+func testOnCreateCatalogCases(ctx context.Context, t *testing.T, p *host.HostPlugin, cases []onCreateCatalogCase) {
+	t.Helper()
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Helper()
+			require := require.New(t)
+			attrs, err := structpb.NewStruct(tc.catalogAttrs)
+			require.NoError(err)
+			resp, err := p.OnCreateCatalog(ctx, &pb.OnCreateCatalogRequest{
+				Catalog: &hostcatalogs.HostCatalog{
+					Attrs: &hostcatalogs.HostCatalog_Attributes{Attributes: attrs},
+				},
+			})
+			if tc.wantErr != "" {
+				require.Error(err)
+				st, ok := status.FromError(err)
+				require.True(ok)
+				require.Contains(st.Message(), tc.wantErr)
+				return
+			}
+			require.NoError(err)
+			require.NotNil(resp)
+			// Dynamic credentials are never stored — persisted secrets should be empty.
+			require.Empty(resp.GetPersisted().GetSecrets().GetFields())
+		})
+	}
+}
+
+type onUpdateCatalogCase struct {
+	name         string
+	catalogAttrs map[string]any // used for both current and new when currentAttrs/newAttrs are nil
+	currentAttrs map[string]any // optional: override current catalog attrs
+	newAttrs     map[string]any // optional: override new catalog attrs
+	wantErr      string
+}
+
+func testOnUpdateCatalogCases(ctx context.Context, t *testing.T, p *host.HostPlugin, cases []onUpdateCatalogCase) {
+	t.Helper()
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Helper()
+			require := require.New(t)
+			currentRaw := tc.catalogAttrs
+			if tc.currentAttrs != nil {
+				currentRaw = tc.currentAttrs
+			}
+			newRaw := tc.catalogAttrs
+			if tc.newAttrs != nil {
+				newRaw = tc.newAttrs
+			}
+			currentAttrs, err := structpb.NewStruct(currentRaw)
+			require.NoError(err)
+			newAttrs, err := structpb.NewStruct(newRaw)
+			require.NoError(err)
+			resp, err := p.OnUpdateCatalog(ctx, &pb.OnUpdateCatalogRequest{
+				CurrentCatalog: &hostcatalogs.HostCatalog{
+					Attrs: &hostcatalogs.HostCatalog_Attributes{Attributes: currentAttrs},
+				},
+				NewCatalog: &hostcatalogs.HostCatalog{
+					Attrs: &hostcatalogs.HostCatalog_Attributes{Attributes: newAttrs},
+				},
+				Persisted: &pb.HostCatalogPersisted{},
+			})
+			if tc.wantErr != "" {
+				require.Error(err)
+				st, ok := status.FromError(err)
+				require.True(ok)
+				require.Contains(st.Message(), tc.wantErr)
+				return
+			}
+			require.NoError(err)
+			require.NotNil(resp)
+			// Dynamic credentials are never stored — persisted secrets should be empty.
+			require.Empty(resp.GetPersisted().GetSecrets().GetFields())
+		})
+	}
+}
+
+type onSetCase struct {
+	name         string
+	catalogAttrs map[string]any
+	tags         []string // nil = no filter (empty set attrs)
+	wantErr      string
+}
+
+func testOnCreateSetCases(ctx context.Context, t *testing.T, p *host.HostPlugin, cases []onSetCase) {
+	t.Helper()
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Helper()
+			require := require.New(t)
+			catalogAttrs, err := structpb.NewStruct(tc.catalogAttrs)
+			require.NoError(err)
+			setRaw := map[string]any{host.ConstDescribeInstancesFilters: []any{}}
+			if len(tc.tags) > 0 {
+				setRaw = tagFilterSetAttrs(tc.tags)
+			}
+			setAttrs, err := structpb.NewStruct(setRaw)
+			require.NoError(err)
+			resp, err := p.OnCreateSet(ctx, &pb.OnCreateSetRequest{
+				Catalog:   &hostcatalogs.HostCatalog{Attrs: &hostcatalogs.HostCatalog_Attributes{Attributes: catalogAttrs}},
+				Set:       &hostsets.HostSet{Attrs: &hostsets.HostSet_Attributes{Attributes: setAttrs}},
+				Persisted: &pb.HostCatalogPersisted{},
+			})
+			if tc.wantErr != "" {
+				require.Error(err)
+				st, ok := status.FromError(err)
+				require.True(ok)
+				require.Contains(st.Message(), tc.wantErr)
+				return
+			}
+			require.NoError(err)
+			require.NotNil(resp)
+		})
+	}
+}
+
+func testOnUpdateSetCases(ctx context.Context, t *testing.T, p *host.HostPlugin, cases []onSetCase) {
+	t.Helper()
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Helper()
+			require := require.New(t)
+			catalogAttrs, err := structpb.NewStruct(tc.catalogAttrs)
+			require.NoError(err)
+			setRaw := map[string]any{host.ConstDescribeInstancesFilters: []any{}}
+			if len(tc.tags) > 0 {
+				setRaw = tagFilterSetAttrs(tc.tags)
+			}
+			setAttrs, err := structpb.NewStruct(setRaw)
+			require.NoError(err)
+			set := &hostsets.HostSet{Attrs: &hostsets.HostSet_Attributes{Attributes: setAttrs}}
+			resp, err := p.OnUpdateSet(ctx, &pb.OnUpdateSetRequest{
+				Catalog:    &hostcatalogs.HostCatalog{Attrs: &hostcatalogs.HostCatalog_Attributes{Attributes: catalogAttrs}},
+				CurrentSet: set,
+				NewSet:     set,
+				Persisted:  &pb.HostCatalogPersisted{},
+			})
+			if tc.wantErr != "" {
+				require.Error(err)
+				st, ok := status.FromError(err)
+				require.True(ok)
+				require.Contains(st.Message(), tc.wantErr)
+				return
+			}
+			require.NoError(err)
+			require.NotNil(resp)
+		})
+	}
+}
+
+type listHostsCase struct {
+	name         string
+	catalogAttrs map[string]any
+	tags         []string
+	expected     map[string][]string // nil = don't assert instances (error cases)
+	wantErr      string
+}
+
+func testListHostsCases(ctx context.Context, t *testing.T, p *host.HostPlugin, cases []listHostsCase) {
+	t.Helper()
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Helper()
+			require := require.New(t)
+			catalogAttrs, err := structpb.NewStruct(tc.catalogAttrs)
+			require.NoError(err)
+			sets := make([]*hostsets.HostSet, len(tc.tags))
+			for i, tag := range tc.tags {
+				setAttrs, err := structpb.NewStruct(map[string]any{
+					host.ConstDescribeInstancesFilters: []any{fmt.Sprintf("tag-key=%s", tag)},
+				})
+				require.NoError(err)
+				sets[i] = &hostsets.HostSet{
+					Id:    fmt.Sprintf("hostset-%d", i),
+					Attrs: &hostsets.HostSet_Attributes{Attributes: setAttrs},
+				}
+			}
+			resp, err := p.ListHosts(ctx, &pb.ListHostsRequest{
+				Catalog:   &hostcatalogs.HostCatalog{Attrs: &hostcatalogs.HostCatalog_Attributes{Attributes: catalogAttrs}},
+				Sets:      sets,
+				Persisted: &pb.HostCatalogPersisted{},
+			})
+			if tc.wantErr != "" {
+				require.Error(err)
+				st, ok := status.FromError(err)
+				require.True(ok)
+				require.Contains(st.Message(), tc.wantErr)
+				return
+			}
+			require.NoError(err)
+			require.NotNil(resp)
+			expectedInstances := make(map[string][]string)
+			for i, tag := range tc.tags {
+				for _, instanceId := range tc.expected[tag] {
+					expectedInstances[instanceId] = append(expectedInstances[instanceId], fmt.Sprintf("hostset-%d", i))
+				}
+			}
+			actualInstances := make(map[string][]string)
+			for _, h := range resp.GetHosts() {
+				actualInstances[h.ExternalId] = h.SetIds
+			}
+			require.Equal(expectedInstances, actualInstances)
+			t.Logf("success: %d hosts matched", len(actualInstances))
+		})
+	}
+}
+
@@ -0,0 +1,396 @@
+// Copyright IBM Corp. 2021, 2026
+// SPDX-License-Identifier: MPL-2.0
+
+package testing
+
+// This file contains helper functions for the static-credential (access key /
+// secret access key) test paths exercised by TestHostPlugin in e2e_host_test.go.
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/hashicorp/boundary-plugin-aws/internal/credential"
+	"github.com/hashicorp/boundary-plugin-aws/plugin/service/host"
+	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/hostcatalogs"
+	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/hostsets"
+	pb "github.com/hashicorp/boundary/sdk/pbs/plugin"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/types/known/structpb"
+)
+
+func testPluginOnCreateCatalog(ctx context.Context, t *testing.T, p *host.HostPlugin, region, accessKeyId, secretAccessKey string, rotate bool) (string, string) {
+	t.Helper()
+	t.Logf("testing OnCreateCatalog (region=%s, rotate=%t)", region, rotate)
+	require := require.New(t)
+
+	reqAttrs, err := structpb.NewStruct(map[string]any{
+		credential.ConstRegion:                    region,
+		credential.ConstDisableCredentialRotation: !rotate,
+	})
+	require.NoError(err)
+	reqSecrets, err := structpb.NewStruct(map[string]any{
+		credential.ConstAccessKeyId:     accessKeyId,
+		credential.ConstSecretAccessKey: secretAccessKey,
+	})
+	require.NoError(err)
+	request := &pb.OnCreateCatalogRequest{
+		Catalog: &hostcatalogs.HostCatalog{
+			Attrs: &hostcatalogs.HostCatalog_Attributes{
+				Attributes: reqAttrs,
+			},
+			Secrets: reqSecrets,
+		},
+	}
+	response, err := p.OnCreateCatalog(ctx, request)
+	require.NoError(err)
+	require.NotNil(response)
+	persisted := response.GetPersisted()
+	require.NotNil(persisted)
+	return validatePersistedSecrets(t, persisted.GetSecrets(), accessKeyId, secretAccessKey, rotate)
+}
+
+func testPluginOnUpdateCatalog(
+	ctx context.Context, t *testing.T, p *host.HostPlugin,
+	region, currentAccessKeyId, currentSecretAccessKey, newAccessKeyId, newSecretAccessKey string,
+	rotated, rotate bool,
+) (string, string) {
+	t.Helper()
+	t.Logf("testing OnUpdateCatalog (region=%s, newcreds=%t, rotated=%t, rotate=%t)", region, newAccessKeyId != "" && newSecretAccessKey != "", rotated, rotate)
+	require := require.New(t)
+
+	// Take a timestamp of the current time to get a point in time to
+	// reference, ensuring that we are updating credential rotation
+	// timestamps.
+	currentCredsLastRotatedTime := time.Now()
+
+	reqCurrentAttrs, err := structpb.NewStruct(map[string]any{
+		credential.ConstRegion:                    region,
+		credential.ConstDisableCredentialRotation: !rotated,
+	})
+	require.NoError(err)
+	reqNewAttrs, err := structpb.NewStruct(map[string]any{
+		credential.ConstRegion:                    region,
+		credential.ConstDisableCredentialRotation: !rotate,
+	})
+	require.NoError(err)
+	var reqSecrets *structpb.Struct
+	if newAccessKeyId != "" && newSecretAccessKey != "" {
+		reqSecrets, err = structpb.NewStruct(map[string]any{
+			credential.ConstAccessKeyId:     newAccessKeyId,
+			credential.ConstSecretAccessKey: newSecretAccessKey,
+		})
+		require.NoError(err)
+	}
+	reqPersistedSecrets, err := structpb.NewStruct(map[string]any{
+		credential.ConstAccessKeyId:     currentAccessKeyId,
+		credential.ConstSecretAccessKey: currentSecretAccessKey,
+		credential.ConstCredsLastRotatedTime: func() string {
+			if rotated {
+				return currentCredsLastRotatedTime.Format(time.RFC3339Nano)
+			}
+
+			return (time.Time{}).Format(time.RFC3339Nano)
+		}(),
+	})
+	require.NoError(err)
+	require.NotNil(reqPersistedSecrets)
+	request := &pb.OnUpdateCatalogRequest{
+		CurrentCatalog: &hostcatalogs.HostCatalog{
+			Attrs: &hostcatalogs.HostCatalog_Attributes{
+				Attributes: reqCurrentAttrs,
+			},
+		},
+		NewCatalog: &hostcatalogs.HostCatalog{
+			Attrs: &hostcatalogs.HostCatalog_Attributes{
+				Attributes: reqNewAttrs,
+			},
+			Secrets: reqSecrets,
+		},
+		Persisted: &pb.HostCatalogPersisted{
+			Secrets: reqPersistedSecrets,
+		},
+	}
+	response, err := p.OnUpdateCatalog(ctx, request)
+	require.NoError(err)
+	require.NotNil(response)
+	persisted := response.GetPersisted()
+	require.NotNil(persisted)
+	return validateUpdateSecrets(t, persisted.GetSecrets(), currentCredsLastRotatedTime, currentAccessKeyId, currentSecretAccessKey, newAccessKeyId, newSecretAccessKey, rotated, rotate)
+}
+
+func testPluginOnDeleteCatalog(ctx context.Context, t *testing.T, p *host.HostPlugin, region, accessKeyId, secretAccessKey string, rotated bool) {
+	t.Helper()
+	t.Logf("testing OnDeleteCatalog (region=%s, rotated=%t)", region, rotated)
+	require := require.New(t)
+
+	reqAttrs, err := structpb.NewStruct(map[string]any{
+		credential.ConstRegion:                    region,
+		credential.ConstDisableCredentialRotation: !rotated,
+	})
+	require.NoError(err)
+	reqSecrets, err := structpb.NewStruct(map[string]any{
+		credential.ConstAccessKeyId:     accessKeyId,
+		credential.ConstSecretAccessKey: secretAccessKey,
+	})
+	require.NoError(err)
+	reqPersistedSecrets, err := structpb.NewStruct(map[string]any{
+		credential.ConstAccessKeyId:     accessKeyId,
+		credential.ConstSecretAccessKey: secretAccessKey,
+		credential.ConstCredsLastRotatedTime: func() string {
+			if rotated {
+				return time.Now().Format(time.RFC3339Nano)
+			}
+
+			return (time.Time{}).Format(time.RFC3339Nano)
+		}(),
+	})
+	require.NoError(err)
+	request := &pb.OnDeleteCatalogRequest{
+		Catalog: &hostcatalogs.HostCatalog{
+			Attrs: &hostcatalogs.HostCatalog_Attributes{
+				Attributes: reqAttrs,
+			},
+			Secrets: reqSecrets,
+		},
+		Persisted: &pb.HostCatalogPersisted{
+			Secrets: reqPersistedSecrets,
+		},
+	}
+	response, err := p.OnDeleteCatalog(ctx, request)
+	require.NoError(err)
+	require.NotNil(response)
+
+	// We want to test the validity of the credentials post-deletion.
+	if rotated {
+		// The credentials should no longer be valid.
+		requireCredentialsInvalid(t, accessKeyId, secretAccessKey)
+	} else {
+		// The credentials should still be valid. Sleep 10s first just to
+		// be sure, since we're not rotating.
+		time.Sleep(time.Second * 10)
+		requireCredentialsValid(t, accessKeyId, secretAccessKey)
+	}
+}
+
+func testPluginOnCreateUpdateSet(ctx context.Context, t *testing.T, p *host.HostPlugin, region, accessKeyId, secretAccessKey string, tags []string) {
+	t.Helper()
+	t.Logf("testing OnCreateSet (region=%s, tags=%v)", region, tags)
+	require := require.New(t)
+	catalogAttrs, err := structpb.NewStruct(map[string]any{
+		credential.ConstRegion:                    region,
+		credential.ConstDisableCredentialRotation: true, // Note that this does nothing in sets, but just noting for tests
+	})
+	require.NoError(err)
+	setAttrs, err := structpb.NewStruct(map[string]any{
+		host.ConstDescribeInstancesFilters: []any{fmt.Sprintf("tag-key=%s", strings.Join(tags, ","))},
+	})
+	require.NoError(err)
+	reqPersistedSecrets, err := structpb.NewStruct(map[string]any{
+		credential.ConstAccessKeyId:          accessKeyId,
+		credential.ConstSecretAccessKey:      secretAccessKey,
+		credential.ConstCredsLastRotatedTime: (time.Time{}).Format(time.RFC3339Nano),
+	})
+	require.NoError(err)
+	createRequest := &pb.OnCreateSetRequest{
+		Catalog: &hostcatalogs.HostCatalog{
+			Attrs: &hostcatalogs.HostCatalog_Attributes{
+				Attributes: catalogAttrs,
+			},
+		},
+		Set: &hostsets.HostSet{
+			Attrs: &hostsets.HostSet_Attributes{
+				Attributes: setAttrs,
+			},
+		},
+		Persisted: &pb.HostCatalogPersisted{
+			Secrets: reqPersistedSecrets,
+		},
+	}
+	createResponse, err := p.OnCreateSet(ctx, createRequest)
+	require.NoError(err)
+	require.NotNil(createResponse)
+
+	// Do an update test in the same function, as it's pretty much the
+	// same function right now.
+	t.Logf("testing OnUpdateSet (region=%s, tags=%v)", region, tags)
+	updateRequest := &pb.OnUpdateSetRequest{
+		Catalog: &hostcatalogs.HostCatalog{
+			Attrs: &hostcatalogs.HostCatalog_Attributes{
+				Attributes: catalogAttrs,
+			},
+		},
+		CurrentSet: &hostsets.HostSet{
+			Attrs: &hostsets.HostSet_Attributes{
+				Attributes: setAttrs,
+			},
+		},
+		NewSet: &hostsets.HostSet{
+			Attrs: &hostsets.HostSet_Attributes{
+				Attributes: setAttrs,
+			},
+		},
+		Persisted: &pb.HostCatalogPersisted{
+			Secrets: reqPersistedSecrets,
+		},
+	}
+	updateResponse, err := p.OnUpdateSet(ctx, updateRequest)
+	require.NoError(err)
+	require.NotNil(updateResponse)
+}
+
+func testPluginListHosts(ctx context.Context, t *testing.T, p *host.HostPlugin, region, accessKeyId, secretAccessKey string, tags []string, expected map[string][]string) {
+	t.Helper()
+	t.Logf("testing ListHosts (region=%s, tags=%v)", region, tags)
+	require := require.New(t)
+	catalogAttrs, err := structpb.NewStruct(map[string]any{
+		credential.ConstRegion:                    region,
+		credential.ConstDisableCredentialRotation: true, // Note that this does nothing in sets, but just noting for tests
+	})
+	require.NoError(err)
+	sets := make([]*hostsets.HostSet, len(tags))
+	for i, tag := range tags {
+		setAttrs, err := structpb.NewStruct(map[string]any{
+			host.ConstDescribeInstancesFilters: []any{fmt.Sprintf("tag-key=%s", tag)},
+		})
+		require.NoError(err)
+		sets[i] = &hostsets.HostSet{
+			Id: fmt.Sprintf("hostset-%d", i),
+			Attrs: &hostsets.HostSet_Attributes{
+				Attributes: setAttrs,
+			},
+		}
+	}
+	reqPersistedSecrets, err := structpb.NewStruct(map[string]any{
+		credential.ConstAccessKeyId:          accessKeyId,
+		credential.ConstSecretAccessKey:      secretAccessKey,
+		credential.ConstCredsLastRotatedTime: (time.Time{}).Format(time.RFC3339Nano),
+	})
+	require.NoError(err)
+	request := &pb.ListHostsRequest{
+		Catalog: &hostcatalogs.HostCatalog{
+			Attrs: &hostcatalogs.HostCatalog_Attributes{
+				Attributes: catalogAttrs,
+			},
+		},
+		Sets: sets,
+		Persisted: &pb.HostCatalogPersisted{
+			Secrets: reqPersistedSecrets,
+		},
+	}
+	response, err := p.ListHosts(ctx, request)
+	require.NoError(err)
+	require.NotNil(response)
+
+	// Validate the returned instances by ID. Assemble the instance
+	// details from the expected set.
+	expectedInstances := make(map[string][]string)
+	for i, tag := range tags {
+		for _, instanceId := range expected[tag] {
+			expectedInstances[instanceId] = append(expectedInstances[instanceId], fmt.Sprintf("hostset-%d", i))
+		}
+	}
+
+	// Take the returned hosts by ID and create the same kind of map.
+	actualInstances := make(map[string][]string)
+	for _, host := range response.GetHosts() {
+		actualInstances[host.ExternalId] = host.SetIds
+	}
+
+	// Compare
+	require.Equal(expectedInstances, actualInstances)
+	// Success
+	t.Logf("testing ListHosts: success (region=%s, tags=%v, expected/actual=(len=%d, ids=%s))", region, tags, len(actualInstances), actualInstances)
+}
+
+func testInstanceAddressesOnlyListHosts(ctx context.Context, t *testing.T, p *host.HostPlugin, tf *TestTerraformer, region, accessKeyId, secretAccessKey string) {
+	t.Helper()
+	t.Logf("testing testInstanceAddressesOnlyListHosts")
+
+	// Get the instance details from tf output
+	instanceID, err := tf.GetOutputString("multi_address_instance_id")
+	require.NoError(t, err)
+	primaryAddresses, err := tf.GetOutputMap("multi_address_primary_addresses")
+	require.NoError(t, err)
+	secondaryAddresses, err := tf.GetOutputMap("multi_address_secondary_addresses")
+	require.NoError(t, err)
+
+	var primary, allAddresses []string
+	for _, addr := range primaryAddresses {
+		primary = append(primary, addr.(string))
+	}
+	allAddresses = append(allAddresses, primary...)
+	for _, addr := range secondaryAddresses {
+		allAddresses = append(allAddresses, addr.(string))
+	}
+
+	cases := []struct {
+		name                  string
+		instanceAddressesOnly bool
+		expectedIPs           []string
+	}{
+		{
+			name:        "all addresses",
+			expectedIPs: allAddresses,
+		},
+		{
+			name:                  "instance addresses only",
+			instanceAddressesOnly: true,
+			expectedIPs:           primary,
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			require := require.New(t)
+
+			catalogAttrMap := map[string]any{
+				credential.ConstRegion:                    region,
+				credential.ConstDisableCredentialRotation: true,
+			}
+			if tc.instanceAddressesOnly {
+				catalogAttrMap[host.ConstInstanceAddressesOnly] = true
+			}
+
+			catalogAttrs, err := structpb.NewStruct(catalogAttrMap)
+			require.NoError(err)
+			setAttrs, err := structpb.NewStruct(map[string]any{
+				host.ConstDescribeInstancesFilters: []any{fmt.Sprintf("instance-id=%s", instanceID)},
+			})
+			require.NoError(err)
+
+			reqPersistedSecrets, err := structpb.NewStruct(map[string]any{
+				credential.ConstAccessKeyId:          accessKeyId,
+				credential.ConstSecretAccessKey:      secretAccessKey,
+				credential.ConstCredsLastRotatedTime: (time.Time{}).Format(time.RFC3339Nano),
+			})
+			require.NoError(err)
+			request := &pb.ListHostsRequest{
+				Catalog: &hostcatalogs.HostCatalog{
+					Attrs: &hostcatalogs.HostCatalog_Attributes{
+						Attributes: catalogAttrs,
+					},
+				},
+				Sets: []*hostsets.HostSet{{
+					Id:    "hostset-0",
+					Attrs: &hostsets.HostSet_Attributes{Attributes: setAttrs},
+				}},
+				Persisted: &pb.HostCatalogPersisted{
+					Secrets: reqPersistedSecrets,
+				},
+			}
+
+			response, err := p.ListHosts(ctx, request)
+			require.NoError(err)
+			require.Len(response.GetHosts(), 1)
+			hostResp := response.GetHosts()[0]
+
+			require.Equal(instanceID, hostResp.ExternalId)
+			require.ElementsMatch(hostResp.IpAddresses, tc.expectedIPs)
+		})
+	}
+}
@@ -3,21 +3,24 @@

 package testing

+// This file contains the TestHostPlugin orchestrator. It deploys the Terraform
+// workspace, collects outputs, and calls the per-credential-type helper
+// functions defined in e2e_host_static_test.go and e2e_host_assumerole_test.go.
+
 import (
 	"context"
-	"fmt"
 	"os"
-	"strings"
 	"testing"
-	"time"

-	"github.com/hashicorp/boundary-plugin-aws/internal/credential"
 	"github.com/hashicorp/boundary-plugin-aws/plugin/service/host"
-	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/hostcatalogs"
-	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/hostsets"
-	pb "github.com/hashicorp/boundary/sdk/pbs/plugin"
 	"github.com/stretchr/testify/require"
-	"google.golang.org/protobuf/types/known/structpb"
+)
+
+const (
+	envTargetAccessKeyId     = "TARGET_AWS_ACCESS_KEY_ID"
+	envTargetSecretAccessKey = "TARGET_AWS_SECRET_ACCESS_KEY"
+	envTargetSessionToken    = "TARGET_AWS_SESSION_TOKEN"
+	envTargetRegion          = "TARGET_AWS_REGION"
 )

 const expectedEc2InstanceCount = 5
@@ -35,7 +38,29 @@ func TestHostPlugin(t *testing.T) {
 	}

 	require := require.New(t)
-	tf, err := NewTestTerraformer("testdata/host")
+
+	// Collect cross-account credentials up front so they can be passed as
+	// Terraform variables. The cross-account section is skipped (not failed)
+	// when these are absent, but we need the values available before Deploy.
+	targetAccessKeyId := os.Getenv(envTargetAccessKeyId)
+	targetSecretAccessKey := os.Getenv(envTargetSecretAccessKey)
+	targetSessionToken := os.Getenv(envTargetSessionToken)
+	targetRegion := os.Getenv(envTargetRegion)
+	if targetRegion == "" {
+		targetRegion = region
+	}
+
+	tfVars := map[string]string{}
+	if targetAccessKeyId != "" && targetSecretAccessKey != "" {
+		tfVars["target_access_key_id"] = targetAccessKeyId
+		tfVars["target_secret_access_key"] = targetSecretAccessKey
+		tfVars["target_region"] = targetRegion
+		if targetSessionToken != "" {
+			tfVars["target_session_token"] = targetSessionToken
+		}
+	}
+
+	tf, err := NewTestTerraformer("testdata/host", tfVars)
 	require.NoError(err)
 	require.NotNil(tf)

@@ -137,16 +162,9 @@ func TestHostPlugin(t *testing.T) {
 	// Reassign the keyid and secret first.
 	keyid, secret = iamAccessKeyIds[5].(string), iamSecretAccessKeys[5].(string)
 	// Process the collection of instances and index by expected tag names.
-	expectedTagInstancesMap := make(map[string][]string)
-	for instanceId, instanceTags := range ec2InstanceTags {
-		for tagKey := range instanceTags.(map[string]any) {
-			for _, expectedTag := range expectedTags {
-				if tagKey == expectedTag {
-					expectedTagInstancesMap[tagKey] = append(expectedTagInstancesMap[tagKey], instanceId)
-				}
-			}
-		}
-	}
+	expectedTagInstancesMap := buildExpectedTagInstancesMap(ec2InstanceTags, expectedTags)
+
+	requireTagInstancesMatchProvisioned(t, ec2InstanceIds, expectedTagInstancesMap)

 	cases := [][]string{
 		{expectedTags[0]},
@@ -168,377 +186,162 @@ func TestHostPlugin(t *testing.T) {

 	// finally lets test instance_addresses_only catalog attribute correctly syncs only instance addresses
 	testInstanceAddressesOnlyListHosts(ctx, t, p, tf, region, keyid, secret)
-}

-func testPluginOnCreateCatalog(ctx context.Context, t *testing.T, p *host.HostPlugin, region, accessKeyId, secretAccessKey string, rotate bool) (string, string) {
-	t.Helper()
-	t.Logf("testing OnCreateCatalog (region=%s, rotate=%t)", region, rotate)
-	require := require.New(t)
+	// ********************
+	// * AssumeRole - Happy Path & Error Cases
+	// ********************
+	assumeRoleArn, err := tf.GetOutputString("assume_role_arn")
+	require.NoError(err)

-	reqAttrs, err := structpb.NewStruct(map[string]any{
-		credential.ConstRegion:                    region,
-		credential.ConstDisableCredentialRotation: !rotate,
+	noTrustRoleArn, err := tf.GetOutputString("assume_role_no_trust_arn")
+	require.NoError(err)
+
+	missingPermRoleArn, err := tf.GetOutputString("assume_role_no_ec2_permission_arn")
+	require.NoError(err)
+
+	testOnCreateCatalogCases(ctx, t, p, []onCreateCatalogCase{
+		{name: "assume role happy path", catalogAttrs: roleArnAttrs(region, assumeRoleArn)},
+		{name: "assume role no trust", catalogAttrs: roleArnAttrs(region, noTrustRoleArn), wantErr: "AccessDenied"},
+		{name: "assume role missing ec2 permission", catalogAttrs: roleArnAttrs(region, missingPermRoleArn), wantErr: "UnauthorizedOperation"},
 	})
-	require.NoError(err)
-	reqSecrets, err := structpb.NewStruct(map[string]any{
-		credential.ConstAccessKeyId:     accessKeyId,
-		credential.ConstSecretAccessKey: secretAccessKey,
+	testOnUpdateCatalogCases(ctx, t, p, []onUpdateCatalogCase{
+		{name: "assume role happy path", catalogAttrs: roleArnAttrs(region, assumeRoleArn)},
+		{name: "assume role no trust", catalogAttrs: roleArnAttrs(region, noTrustRoleArn), wantErr: "AccessDenied"},
+		{name: "assume role missing ec2 permission", currentAttrs: roleArnAttrs(region, assumeRoleArn), newAttrs: roleArnAttrs(region, missingPermRoleArn), wantErr: "UnauthorizedOperation"},
 	})
-	require.NoError(err)
-	request := &pb.OnCreateCatalogRequest{
-		Catalog: &hostcatalogs.HostCatalog{
-			Attrs: &hostcatalogs.HostCatalog_Attributes{
-				Attributes: reqAttrs,
-			},
-			Secrets: reqSecrets,
-		},
-	}
-	response, err := p.OnCreateCatalog(ctx, request)
-	require.NoError(err)
-	require.NotNil(response)
-	persisted := response.GetPersisted()
-	require.NotNil(persisted)
-	return validatePersistedSecrets(t, persisted.GetSecrets(), accessKeyId, secretAccessKey, rotate)
-}
-
-func testPluginOnUpdateCatalog(
-	ctx context.Context, t *testing.T, p *host.HostPlugin,
-	region, currentAccessKeyId, currentSecretAccessKey, newAccessKeyId, newSecretAccessKey string,
-	rotated, rotate bool,
-) (string, string) {
-	t.Helper()
-	t.Logf("testing OnUpdateCatalog (region=%s, newcreds=%t, rotated=%t, rotate=%t)", region, newAccessKeyId != "" && newSecretAccessKey != "", rotated, rotate)
-	require := require.New(t)
-
-	// Take a timestamp of the current time to get a point in time to
-	// reference, ensuring that we are updating credential rotation
-	// timestamps.
-	currentCredsLastRotatedTime := time.Now()
-
-	reqCurrentAttrs, err := structpb.NewStruct(map[string]any{
-		credential.ConstRegion:                    region,
-		credential.ConstDisableCredentialRotation: !rotated,
+	testOnCreateSetCases(ctx, t, p, []onSetCase{
+		{name: "assume role happy path", catalogAttrs: roleArnAttrs(region, assumeRoleArn), tags: cases[0]},
+		{name: "assume role no trust", catalogAttrs: roleArnAttrs(region, noTrustRoleArn), wantErr: "AccessDenied"},
+		{name: "assume role missing ec2 permission", catalogAttrs: roleArnAttrs(region, missingPermRoleArn), wantErr: "UnauthorizedOperation"},
 	})
-	require.NoError(err)
-	reqNewAttrs, err := structpb.NewStruct(map[string]any{
-		credential.ConstRegion:                    region,
-		credential.ConstDisableCredentialRotation: !rotate,
+	testOnUpdateSetCases(ctx, t, p, []onSetCase{
+		{name: "assume role happy path", catalogAttrs: roleArnAttrs(region, assumeRoleArn), tags: cases[0]},
+		{name: "assume role no trust", catalogAttrs: roleArnAttrs(region, noTrustRoleArn), wantErr: "AccessDenied"},
+		{name: "assume role missing ec2 permission", catalogAttrs: roleArnAttrs(region, missingPermRoleArn), wantErr: "UnauthorizedOperation"},
 	})
-	require.NoError(err)
-	var reqSecrets *structpb.Struct
-	if newAccessKeyId != "" && newSecretAccessKey != "" {
-		reqSecrets, err = structpb.NewStruct(map[string]any{
-			credential.ConstAccessKeyId:     newAccessKeyId,
-			credential.ConstSecretAccessKey: newSecretAccessKey,
-		})
-		require.NoError(err)
-	}
-	reqPersistedSecrets, err := structpb.NewStruct(map[string]any{
-		credential.ConstAccessKeyId:     currentAccessKeyId,
-		credential.ConstSecretAccessKey: currentSecretAccessKey,
-		credential.ConstCredsLastRotatedTime: func() string {
-			if rotated {
-				return currentCredsLastRotatedTime.Format(time.RFC3339Nano)
-			}
-
-			return (time.Time{}).Format(time.RFC3339Nano)
-		}(),
+	testListHostsCases(ctx, t, p, []listHostsCase{
+		{name: "assume role happy path", catalogAttrs: roleArnAttrs(region, assumeRoleArn), tags: cases[0], expected: expectedTagInstancesMap},
+		{name: "assume role no trust", catalogAttrs: roleArnAttrs(region, noTrustRoleArn), tags: cases[0], wantErr: "AccessDenied"},
+		{name: "assume role missing ec2 permission", catalogAttrs: roleArnAttrs(region, missingPermRoleArn), tags: cases[0], wantErr: "UnauthorizedOperation"},
 	})
-	require.NoError(err)
-	require.NotNil(reqPersistedSecrets)
-	request := &pb.OnUpdateCatalogRequest{
-		CurrentCatalog: &hostcatalogs.HostCatalog{
-			Attrs: &hostcatalogs.HostCatalog_Attributes{
-				Attributes: reqCurrentAttrs,
-			},
-		},
-		NewCatalog: &hostcatalogs.HostCatalog{
-			Attrs: &hostcatalogs.HostCatalog_Attributes{
-				Attributes: reqNewAttrs,
-			},
-			Secrets: reqSecrets,
-		},
-		Persisted: &pb.HostCatalogPersisted{
-			Secrets: reqPersistedSecrets,
-		},
-	}
-	response, err := p.OnUpdateCatalog(ctx, request)
-	require.NoError(err)
-	require.NotNil(response)
-	persisted := response.GetPersisted()
-	require.NotNil(persisted)
-	return validateUpdateSecrets(t, persisted.GetSecrets(), currentCredsLastRotatedTime, currentAccessKeyId, currentSecretAccessKey, newAccessKeyId, newSecretAccessKey, rotated, rotate)
-}

-func testPluginOnDeleteCatalog(ctx context.Context, t *testing.T, p *host.HostPlugin, region, accessKeyId, secretAccessKey string, rotated bool) {
-	t.Helper()
-	t.Logf("testing OnDeleteCatalog (region=%s, rotated=%t)", region, rotated)
-	require := require.New(t)
+	// ********************
+	// * Cross-Role AssumeRole - Happy Path & Error Cases
+	// ********************
+	// These tests exercise the two-hop role chain within a single AWS account.
+	// The principal role has no ec2:DescribeInstances; the target role
+	// (assume_role) does. The plugin must assume the principal first, then use
+	// those credentials to assume the target role before calling DescribeInstances.
+	// This validates the plugin's chained credential logic without requiring a
+	// second AWS account.
+	crossRolePrincipalArn, err := tf.GetOutputString("cross_role_principal_arn")
+	require.NoError(err)

-	reqAttrs, err := structpb.NewStruct(map[string]any{
-		credential.ConstRegion:                    region,
-		credential.ConstDisableCredentialRotation: !rotated,
+	crossRolePrincipalNoTrustArn, err := tf.GetOutputString("cross_role_principal_no_trust_arn")
+	require.NoError(err)
+
+	crossRoleTargetNoTrustArn, err := tf.GetOutputString("cross_role_target_no_trust_arn")
+	require.NoError(err)
+
+	crossRoleTargetNoEc2PermissionArn, err := tf.GetOutputString("cross_role_target_no_ec2_permission_arn")
+	require.NoError(err)
+
+	// assume_role_arn is reused as the cross-role target — it has ec2:DescribeInstances
+	// and its trust policy allows the cross-role principal to assume it.
+	testOnCreateCatalogCases(ctx, t, p, []onCreateCatalogCase{
+		{name: "cross-role happy path", catalogAttrs: crossRoleAttrs(region, crossRolePrincipalArn, assumeRoleArn)},
+		{name: "cross-role principal no trust", catalogAttrs: crossRoleAttrs(region, crossRolePrincipalNoTrustArn, assumeRoleArn), wantErr: "AccessDenied"},
+		{name: "cross-role target no trust", catalogAttrs: crossRoleAttrs(region, crossRolePrincipalArn, crossRoleTargetNoTrustArn), wantErr: "AccessDenied"},
+		{name: "cross-role target missing ec2 permission", catalogAttrs: crossRoleAttrs(region, crossRolePrincipalArn, crossRoleTargetNoEc2PermissionArn), wantErr: "UnauthorizedOperation"},
 	})
-	require.NoError(err)
-	reqSecrets, err := structpb.NewStruct(map[string]any{
-		credential.ConstAccessKeyId:     accessKeyId,
-		credential.ConstSecretAccessKey: secretAccessKey,
+	testOnUpdateCatalogCases(ctx, t, p, []onUpdateCatalogCase{
+		{name: "cross-role happy path", catalogAttrs: crossRoleAttrs(region, crossRolePrincipalArn, assumeRoleArn)},
+		{name: "cross-role principal no trust", catalogAttrs: crossRoleAttrs(region, crossRolePrincipalNoTrustArn, assumeRoleArn), wantErr: "AccessDenied"},
+		{name: "cross-role target no trust", catalogAttrs: crossRoleAttrs(region, crossRolePrincipalArn, crossRoleTargetNoTrustArn), wantErr: "AccessDenied"},
+		{name: "cross-role target missing ec2 permission", catalogAttrs: crossRoleAttrs(region, crossRolePrincipalArn, crossRoleTargetNoEc2PermissionArn), wantErr: "UnauthorizedOperation"},
 	})
-	require.NoError(err)
-	reqPersistedSecrets, err := structpb.NewStruct(map[string]any{
-		credential.ConstAccessKeyId:     accessKeyId,
-		credential.ConstSecretAccessKey: secretAccessKey,
-		credential.ConstCredsLastRotatedTime: func() string {
-			if rotated {
-				return time.Now().Format(time.RFC3339Nano)
-			}
-
-			return (time.Time{}).Format(time.RFC3339Nano)
-		}(),
+	testOnCreateSetCases(ctx, t, p, []onSetCase{
+		{name: "cross-role happy path", catalogAttrs: crossRoleAttrs(region, crossRolePrincipalArn, assumeRoleArn), tags: cases[0]},
+		{name: "cross-role principal no trust", catalogAttrs: crossRoleAttrs(region, crossRolePrincipalNoTrustArn, assumeRoleArn), wantErr: "AccessDenied"},
+		{name: "cross-role target no trust", catalogAttrs: crossRoleAttrs(region, crossRolePrincipalArn, crossRoleTargetNoTrustArn), wantErr: "AccessDenied"},
+		{name: "cross-role target missing ec2 permission", catalogAttrs: crossRoleAttrs(region, crossRolePrincipalArn, crossRoleTargetNoEc2PermissionArn), wantErr: "UnauthorizedOperation"},
 	})
-	require.NoError(err)
-	request := &pb.OnDeleteCatalogRequest{
-		Catalog: &hostcatalogs.HostCatalog{
-			Attrs: &hostcatalogs.HostCatalog_Attributes{
-				Attributes: reqAttrs,
-			},
-			Secrets: reqSecrets,
-		},
-		Persisted: &pb.HostCatalogPersisted{
-			Secrets: reqPersistedSecrets,
-		},
-	}
-	response, err := p.OnDeleteCatalog(ctx, request)
-	require.NoError(err)
-	require.NotNil(response)
-
-	// We want to test the validity of the credentials post-deletion.
-	if rotated {
-		// The credentials should no longer be valid.
-		requireCredentialsInvalid(t, accessKeyId, secretAccessKey)
+	testOnUpdateSetCases(ctx, t, p, []onSetCase{
+		{name: "cross-role happy path", catalogAttrs: crossRoleAttrs(region, crossRolePrincipalArn, assumeRoleArn), tags: cases[0]},
+		{name: "cross-role principal no trust", catalogAttrs: crossRoleAttrs(region, crossRolePrincipalNoTrustArn, assumeRoleArn), wantErr: "AccessDenied"},
+		{name: "cross-role target no trust", catalogAttrs: crossRoleAttrs(region, crossRolePrincipalArn, crossRoleTargetNoTrustArn), wantErr: "AccessDenied"},
+		{name: "cross-role target missing ec2 permission", catalogAttrs: crossRoleAttrs(region, crossRolePrincipalArn, crossRoleTargetNoEc2PermissionArn), wantErr: "UnauthorizedOperation"},
+	})
+	testListHostsCases(ctx, t, p, []listHostsCase{
+		{name: "cross-role happy path", catalogAttrs: crossRoleAttrs(region, crossRolePrincipalArn, assumeRoleArn), tags: cases[0], expected: expectedTagInstancesMap},
+		{name: "cross-role principal no trust", catalogAttrs: crossRoleAttrs(region, crossRolePrincipalNoTrustArn, assumeRoleArn), tags: cases[0], wantErr: "AccessDenied"},
+		{name: "cross-role target no trust", catalogAttrs: crossRoleAttrs(region, crossRolePrincipalArn, crossRoleTargetNoTrustArn), tags: cases[0], wantErr: "AccessDenied"},
+		{name: "cross-role target missing ec2 permission", catalogAttrs: crossRoleAttrs(region, crossRolePrincipalArn, crossRoleTargetNoEc2PermissionArn), tags: cases[0], wantErr: "UnauthorizedOperation"},
+	})
+	// ********************
+	// * Cross-Account AssumeRole - Happy Path & Error Cases
+	// ********************
+	// These tests require credentials for a second AWS account supplied via
+	// TARGET_AWS_ACCESS_KEY_ID, TARGET_AWS_SECRET_ACCESS_KEY, and (for
+	// temporary credentials) TARGET_AWS_SESSION_TOKEN. They are skipped
+	// (not failed) when the access key ID or secret access key are absent.
+	if targetAccessKeyId == "" || targetSecretAccessKey == "" {
+		t.Log("skipping cross-account tests: set TARGET_AWS_ACCESS_KEY_ID and TARGET_AWS_SECRET_ACCESS_KEY to enable")
 	} else {
-		// The credentials should still be valid. Sleep 10s first just to
-		// be sure, since we're not rotating.
-		time.Sleep(time.Second * 10)
-		requireCredentialsValid(t, accessKeyId, secretAccessKey)
-	}
-}
-
-func testPluginOnCreateUpdateSet(ctx context.Context, t *testing.T, p *host.HostPlugin, region, accessKeyId, secretAccessKey string, tags []string) {
-	t.Helper()
-	t.Logf("testing OnCreateSet (region=%s, tags=%v)", region, tags)
-	require := require.New(t)
-	catalogAttrs, err := structpb.NewStruct(map[string]any{
-		credential.ConstRegion:                    region,
-		credential.ConstDisableCredentialRotation: true, // Note that this does nothing in sets, but just noting for tests
-	})
-	require.NoError(err)
-	setAttrs, err := structpb.NewStruct(map[string]any{
-		host.ConstDescribeInstancesFilters: []any{fmt.Sprintf("tag-key=%s", strings.Join(tags, ","))},
-	})
-	require.NoError(err)
-	reqPersistedSecrets, err := structpb.NewStruct(map[string]any{
-		credential.ConstAccessKeyId:          accessKeyId,
-		credential.ConstSecretAccessKey:      secretAccessKey,
-		credential.ConstCredsLastRotatedTime: (time.Time{}).Format(time.RFC3339Nano),
-	})
-	require.NoError(err)
-	createRequest := &pb.OnCreateSetRequest{
-		Catalog: &hostcatalogs.HostCatalog{
-			Attrs: &hostcatalogs.HostCatalog_Attributes{
-				Attributes: catalogAttrs,
-			},
-		},
-		Set: &hostsets.HostSet{
-			Attrs: &hostsets.HostSet_Attributes{
-				Attributes: setAttrs,
-			},
-		},
-		Persisted: &pb.HostCatalogPersisted{
-			Secrets: reqPersistedSecrets,
-		},
-	}
-	createResponse, err := p.OnCreateSet(ctx, createRequest)
-	require.NoError(err)
-	require.NotNil(createResponse)
-
-	// Do an update test in the same function, as it's pretty much the
-	// same function right now.
-	t.Logf("testing OnUpdateSet (region=%s, tags=%v)", region, tags)
-	updateRequest := &pb.OnUpdateSetRequest{
-		Catalog: &hostcatalogs.HostCatalog{
-			Attrs: &hostcatalogs.HostCatalog_Attributes{
-				Attributes: catalogAttrs,
-			},
-		},
-		CurrentSet: &hostsets.HostSet{
-			Attrs: &hostsets.HostSet_Attributes{
-				Attributes: setAttrs,
-			},
-		},
-		NewSet: &hostsets.HostSet{
-			Attrs: &hostsets.HostSet_Attributes{
-				Attributes: setAttrs,
-			},
-		},
-		Persisted: &pb.HostCatalogPersisted{
-			Secrets: reqPersistedSecrets,
-		},
-	}
-	updateResponse, err := p.OnUpdateSet(ctx, updateRequest)
-	require.NoError(err)
-	require.NotNil(updateResponse)
-}
-
-func testPluginListHosts(ctx context.Context, t *testing.T, p *host.HostPlugin, region, accessKeyId, secretAccessKey string, tags []string, expected map[string][]string) {
-	t.Helper()
-	t.Logf("testing ListHosts (region=%s, tags=%v)", region, tags)
-	require := require.New(t)
-	catalogAttrs, err := structpb.NewStruct(map[string]any{
-		credential.ConstRegion:                    region,
-		credential.ConstDisableCredentialRotation: true, // Note that this does nothing in sets, but just noting for tests
-	})
-	require.NoError(err)
-	sets := make([]*hostsets.HostSet, len(tags))
-	for i, tag := range tags {
-		setAttrs, err := structpb.NewStruct(map[string]any{
-			host.ConstDescribeInstancesFilters: []any{fmt.Sprintf("tag-key=%s", tag)},
-		})
+		crossAccountPrincipalArn, err := tf.GetOutputString("cross_account_principal_arn")
 		require.NoError(err)
-		sets[i] = &hostsets.HostSet{
-			Id: fmt.Sprintf("hostset-%d", i),
-			Attrs: &hostsets.HostSet_Attributes{
-				Attributes: setAttrs,
-			},
-		}
-	}
-	reqPersistedSecrets, err := structpb.NewStruct(map[string]any{
-		credential.ConstAccessKeyId:          accessKeyId,
-		credential.ConstSecretAccessKey:      secretAccessKey,
-		credential.ConstCredsLastRotatedTime: (time.Time{}).Format(time.RFC3339Nano),
-	})
-	require.NoError(err)
-	request := &pb.ListHostsRequest{
-		Catalog: &hostcatalogs.HostCatalog{
-			Attrs: &hostcatalogs.HostCatalog_Attributes{
-				Attributes: catalogAttrs,
-			},
-		},
-		Sets: sets,
-		Persisted: &pb.HostCatalogPersisted{
-			Secrets: reqPersistedSecrets,
-		},
-	}
-	response, err := p.ListHosts(ctx, request)
-	require.NoError(err)
-	require.NotNil(response)

-	// Validate the returned instances by ID. Assemble the instance
-	// details from the expected set.
-	expectedInstances := make(map[string][]string)
-	for i, tag := range tags {
-		for _, instanceId := range expected[tag] {
-			expectedInstances[instanceId] = append(expectedInstances[instanceId], fmt.Sprintf("hostset-%d", i))
-		}
-	}
+		crossAccountPrincipalNoTrustArn, err := tf.GetOutputString("cross_account_principal_no_trust_arn")
+		require.NoError(err)

-	// Take the returned hosts by ID and create the same kind of map.
-	actualInstances := make(map[string][]string)
-	for _, host := range response.GetHosts() {
-		actualInstances[host.ExternalId] = host.SetIds
-	}
+		crossAccountTargetArn, err := tf.GetOutputString("cross_account_target_arn")
+		require.NoError(err)

-	// Compare
-	require.Equal(expectedInstances, actualInstances)
-	// Success
-	t.Logf("testing ListHosts: success (region=%s, tags=%v, expected/actual=(len=%d, ids=%s))", region, tags, len(actualInstances), actualInstances)
-}
+		crossAccountTargetNoTrustArn, err := tf.GetOutputString("cross_account_target_no_trust_arn")
+		require.NoError(err)

-func testInstanceAddressesOnlyListHosts(ctx context.Context, t *testing.T, p *host.HostPlugin, tf *TestTerraformer, region, accessKeyId, secretAccessKey string) {
-	t.Helper()
-	t.Logf("testing testInstanceAddressesOnlyListHosts")
+		crossAccountTargetNoEc2PermissionArn, err := tf.GetOutputString("cross_account_target_no_ec2_permission_arn")
+		require.NoError(err)

-	// Get the instance details from tf output
-	instanceID, err := tf.GetOutputString("multi_address_instance_id")
-	require.NoError(t, err)
-	primaryAddresses, err := tf.GetOutputMap("multi_address_primary_addresses")
-	require.NoError(t, err)
-	secondaryAddresses, err := tf.GetOutputMap("multi_address_secondary_addresses")
-	require.NoError(t, err)
+		targetEc2InstanceIds, err := tf.GetOutputSlice("target_instance_ids")
+		require.NoError(err)
+		require.Len(targetEc2InstanceIds, expectedEc2InstanceCount)

-	var primary, allAddresses []string
-	for _, addr := range primaryAddresses {
-		primary = append(primary, addr.(string))
-	}
-	allAddresses = append(allAddresses, primary...)
-	for _, addr := range secondaryAddresses {
-		allAddresses = append(allAddresses, addr.(string))
-	}
+		targetEc2InstanceTags, err := tf.GetOutputMap("target_instance_tags")
+		require.NoError(err)
+		expectedTargetTagInstancesMap := buildExpectedTagInstancesMap(targetEc2InstanceTags, expectedTags)

-	cases := []struct {
-		name                  string
-		instanceAddressesOnly bool
-		expectedIPs           []string
-	}{
-		{
-			name:        "all addresses",
-			expectedIPs: allAddresses,
-		},
-		{
-			name:                  "instance addresses only",
-			instanceAddressesOnly: true,
-			expectedIPs:           primary,
-		},
-	}
+		requireTagInstancesMatchProvisioned(t, targetEc2InstanceIds, expectedTargetTagInstancesMap)

-	for _, tc := range cases {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			require := require.New(t)
-
-			catalogAttrMap := map[string]any{
-				credential.ConstRegion:                    region,
-				credential.ConstDisableCredentialRotation: true,
-			}
-			if tc.instanceAddressesOnly {
-				catalogAttrMap[host.ConstInstanceAddressesOnly] = true
-			}
-
-			catalogAttrs, err := structpb.NewStruct(catalogAttrMap)
-			require.NoError(err)
-			setAttrs, err := structpb.NewStruct(map[string]any{
-				host.ConstDescribeInstancesFilters: []any{fmt.Sprintf("instance-id=%s", instanceID)},
-			})
-			require.NoError(err)
-
-			reqPersistedSecrets, err := structpb.NewStruct(map[string]any{
-				credential.ConstAccessKeyId:          accessKeyId,
-				credential.ConstSecretAccessKey:      secretAccessKey,
-				credential.ConstCredsLastRotatedTime: (time.Time{}).Format(time.RFC3339Nano),
-			})
-			require.NoError(err)
-			request := &pb.ListHostsRequest{
-				Catalog: &hostcatalogs.HostCatalog{
-					Attrs: &hostcatalogs.HostCatalog_Attributes{
-						Attributes: catalogAttrs,
-					},
-				},
-				Sets: []*hostsets.HostSet{{
-					Id:    "hostset-0",
-					Attrs: &hostsets.HostSet_Attributes{Attributes: setAttrs},
-				}},
-				Persisted: &pb.HostCatalogPersisted{
-					Secrets: reqPersistedSecrets,
-				},
-			}
-
-			response, err := p.ListHosts(ctx, request)
-			require.NoError(err)
-			require.Len(response.GetHosts(), 1)
-			hostResp := response.GetHosts()[0]
-
-			require.Equal(instanceID, hostResp.ExternalId)
-			require.ElementsMatch(hostResp.IpAddresses, tc.expectedIPs)
+		testOnCreateCatalogCases(ctx, t, p, []onCreateCatalogCase{
+			{name: "cross-account happy path", catalogAttrs: crossRoleAttrs(targetRegion, crossAccountPrincipalArn, crossAccountTargetArn)},
+			{name: "cross-account principal no trust", catalogAttrs: crossRoleAttrs(targetRegion, crossAccountPrincipalNoTrustArn, crossAccountTargetArn), wantErr: "AccessDenied"},
+			{name: "cross-account target no trust", catalogAttrs: crossRoleAttrs(targetRegion, crossAccountPrincipalArn, crossAccountTargetNoTrustArn), wantErr: "AccessDenied"},
+			{name: "cross-account target missing ec2 permission", catalogAttrs: crossRoleAttrs(targetRegion, crossAccountPrincipalArn, crossAccountTargetNoEc2PermissionArn), wantErr: "UnauthorizedOperation"},
+		})
+		testOnUpdateCatalogCases(ctx, t, p, []onUpdateCatalogCase{
+			{name: "cross-account happy path", catalogAttrs: crossRoleAttrs(targetRegion, crossAccountPrincipalArn, crossAccountTargetArn)},
+			{name: "cross-account principal no trust", catalogAttrs: crossRoleAttrs(targetRegion, crossAccountPrincipalNoTrustArn, crossAccountTargetArn), wantErr: "AccessDenied"},
+			{name: "cross-account target no trust", catalogAttrs: crossRoleAttrs(targetRegion, crossAccountPrincipalArn, crossAccountTargetNoTrustArn), wantErr: "AccessDenied"},
+			{name: "cross-account target missing ec2 permission", catalogAttrs: crossRoleAttrs(targetRegion, crossAccountPrincipalArn, crossAccountTargetNoEc2PermissionArn), wantErr: "UnauthorizedOperation"},
+		})
+		testOnCreateSetCases(ctx, t, p, []onSetCase{
+			{name: "cross-account happy path", catalogAttrs: crossRoleAttrs(targetRegion, crossAccountPrincipalArn, crossAccountTargetArn), tags: cases[0]},
+			{name: "cross-account principal no trust", catalogAttrs: crossRoleAttrs(targetRegion, crossAccountPrincipalNoTrustArn, crossAccountTargetArn), wantErr: "AccessDenied"},
+			{name: "cross-account target no trust", catalogAttrs: crossRoleAttrs(targetRegion, crossAccountPrincipalArn, crossAccountTargetNoTrustArn), wantErr: "AccessDenied"},
+			{name: "cross-account target missing ec2 permission", catalogAttrs: crossRoleAttrs(targetRegion, crossAccountPrincipalArn, crossAccountTargetNoEc2PermissionArn), wantErr: "UnauthorizedOperation"},
+		})
+		testOnUpdateSetCases(ctx, t, p, []onSetCase{
+			{name: "cross-account happy path", catalogAttrs: crossRoleAttrs(targetRegion, crossAccountPrincipalArn, crossAccountTargetArn), tags: cases[0]},
+			{name: "cross-account principal no trust", catalogAttrs: crossRoleAttrs(targetRegion, crossAccountPrincipalNoTrustArn, crossAccountTargetArn), wantErr: "AccessDenied"},
+			{name: "cross-account target no trust", catalogAttrs: crossRoleAttrs(targetRegion, crossAccountPrincipalArn, crossAccountTargetNoTrustArn), wantErr: "AccessDenied"},
+			{name: "cross-account target missing ec2 permission", catalogAttrs: crossRoleAttrs(targetRegion, crossAccountPrincipalArn, crossAccountTargetNoEc2PermissionArn), wantErr: "UnauthorizedOperation"},
+		})
+		testListHostsCases(ctx, t, p, []listHostsCase{
+			{name: "cross-account happy path", catalogAttrs: crossRoleAttrs(targetRegion, crossAccountPrincipalArn, crossAccountTargetArn), tags: cases[0], expected: expectedTargetTagInstancesMap},
+			{name: "cross-account principal no trust", catalogAttrs: crossRoleAttrs(targetRegion, crossAccountPrincipalNoTrustArn, crossAccountTargetArn), tags: cases[0], wantErr: "AccessDenied"},
+			{name: "cross-account target no trust", catalogAttrs: crossRoleAttrs(targetRegion, crossAccountPrincipalArn, crossAccountTargetNoTrustArn), tags: cases[0], wantErr: "AccessDenied"},
+			{name: "cross-account target missing ec2 permission", catalogAttrs: crossRoleAttrs(targetRegion, crossAccountPrincipalArn, crossAccountTargetNoEc2PermissionArn), tags: cases[0], wantErr: "UnauthorizedOperation"},
 		})
 	}
 }
@@ -0,0 +1,206 @@
+# Copyright IBM Corp. 2021, 2026
+# SPDX-License-Identifier: MPL-2.0
+
+resource "random_id" "assume_role_name" {
+  prefix      = "BoundaryPluginAssumeRole"
+  byte_length = 4
+}
+
+resource "aws_iam_role" "assume_role" {
+  name = random_id.assume_role_name.dec
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = ["sts:AssumeRole", "sts:SetSourceIdentity"]
+        Effect = "Allow"
+        Principal = {
+          AWS = data.aws_caller_identity.current.arn
+        }
+      },
+      # Also trusted by the cross-role principal role so it can be used
+      # as the target in two-hop AssumeRole tests.
+      {
+        Action = ["sts:AssumeRole", "sts:SetSourceIdentity"]
+        Effect = "Allow"
+        Principal = {
+          AWS = aws_iam_role.cross_role_principal.arn
+        }
+      },
+    ]
+  })
+
+  tags = {
+    "boundary-demo" = local.hashicorp_email
+  }
+}
+
+resource "aws_iam_role_policy_attachment" "assume_role_ec2_describeinstances" {
+  role       = aws_iam_role.assume_role.name
+  policy_arn = aws_iam_policy.ec2_describeinstances.arn
+}
+
+output "assume_role_arn" {
+  value = aws_iam_role.assume_role.arn
+}
+
+# Error case: role exists with ec2:DescribeInstances but trust policy
+# does not allow the caller to assume it.
+resource "random_id" "assume_role_no_trust_name" {
+  prefix      = "BoundaryPluginNoTrust"
+  byte_length = 4
+}
+
+resource "aws_iam_role" "assume_role_no_trust" {
+  name = random_id.assume_role_no_trust_name.dec
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = ["sts:AssumeRole", "sts:SetSourceIdentity"]
+        Effect = "Deny"
+        Principal = {
+          AWS = data.aws_caller_identity.current.arn
+        }
+      },
+    ]
+  })
+
+  tags = {
+    "boundary-demo" = local.hashicorp_email
+  }
+}
+
+output "assume_role_no_trust_arn" {
+  value = aws_iam_role.assume_role_no_trust.arn
+}
+
+# Error case: role exists and the caller can assume it, but has no
+# ec2:DescribeInstances permission.
+# Also trusted by cross_role_principal so this same role can be reused as the
+# no-EC2-permission target in two-hop (cross-role) error case tests.
+resource "random_id" "assume_role_no_ec2_permission_name" {
+  prefix      = "BoundaryPluginNoEC2Perm"
+  byte_length = 4
+}
+
+resource "aws_iam_role" "assume_role_no_ec2_permission" {
+  name = random_id.assume_role_no_ec2_permission_name.dec
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = ["sts:AssumeRole", "sts:SetSourceIdentity"]
+        Effect = "Allow"
+        Principal = {
+          AWS = data.aws_caller_identity.current.arn
+        }
+      },
+      # Also trusted by the cross-role principal so it can serve as the
+      # no-EC2-permission target in two-hop error case tests.
+      {
+        Action = ["sts:AssumeRole", "sts:SetSourceIdentity"]
+        Effect = "Allow"
+        Principal = {
+          AWS = aws_iam_role.cross_role_principal.arn
+        }
+      },
+    ]
+  })
+
+  tags = {
+    "boundary-demo" = local.hashicorp_email
+  }
+}
+
+output "assume_role_no_ec2_permission_arn" {
+  value = aws_iam_role.assume_role_no_ec2_permission.arn
+}
+
+# Cross-role (two-hop) principal role.
+# The test runner can assume this role. It has permission to AssumeRole into
+# aws_iam_role.assume_role (the target role) but has no ec2:DescribeInstances
+# of its own. This simulates the principal side of a two-hop role chain: the
+# plugin must assume the principal first, then use those credentials to assume
+# the target role before calling DescribeInstances.
+# Note: both roles are in the same AWS account. This tests the plugin's
+# two-hop credential chain logic without requiring a second account.
+resource "random_id" "cross_role_principal_name" {
+  prefix      = "BoundaryPluginCRPrincipal"
+  byte_length = 4
+}
+
+resource "aws_iam_role" "cross_role_principal" {
+  name = random_id.cross_role_principal_name.dec
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = ["sts:AssumeRole", "sts:SetSourceIdentity"]
+        Effect = "Allow"
+        Principal = {
+          AWS = data.aws_caller_identity.current.arn
+        }
+      },
+    ]
+  })
+
+  tags = {
+    "boundary-demo" = local.hashicorp_email
+  }
+}
+
+# Single policy granting cross_role_principal permission to assume all target
+# roles it needs for both happy path and error case tests.
+resource "aws_iam_policy" "cross_role_principal_assume_targets" {
+  name = "${random_id.cross_role_principal_name.dec}-assume-targets"
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = ["sts:AssumeRole", "sts:SetSourceIdentity"]
+        Effect = "Allow"
+        Resource = [
+          aws_iam_role.assume_role.arn,
+          aws_iam_role.assume_role_no_ec2_permission.arn,
+        ]
+      },
+    ]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "cross_role_principal_assume_targets" {
+  role       = aws_iam_role.cross_role_principal.name
+  policy_arn = aws_iam_policy.cross_role_principal_assume_targets.arn
+}
+
+output "cross_role_principal_arn" {
+  value = aws_iam_role.cross_role_principal.arn
+}
+
+# Error case: caller cannot assume the principal role (first hop denied).
+# Reuses assume_role_no_trust — it already has a Deny trust policy for the
+# caller, so it also serves as an unassumable principal in two-hop tests.
+output "cross_role_principal_no_trust_arn" {
+  value = aws_iam_role.assume_role_no_trust.arn
+}
+
+# Error case: principal can be assumed, but the target role's trust policy
+# does not allow the principal to assume it (second hop denied).
+# Reuses assume_role_no_trust as the target — its Deny trust policy blocks
+# all callers including cross_role_principal.
+output "cross_role_target_no_trust_arn" {
+  value = aws_iam_role.assume_role_no_trust.arn
+}
+
+# Error case: both hops succeed but the target has no ec2:DescribeInstances.
+# Reuses assume_role_no_ec2_permission — its trust policy allows
+# cross_role_principal (see above), and it has no EC2 permission.
+output "cross_role_target_no_ec2_permission_arn" {
+  value = aws_iam_role.assume_role_no_ec2_permission.arn
+}
@@ -0,0 +1,322 @@
+# Copyright IBM Corp. 2021, 2026
+# SPDX-License-Identifier: MPL-2.0
+
+# Cross-account Dynamic Host Catalog test infrastructure.
+#
+# This file provisions the IAM resources needed to test two-hop AssumeRole
+# across two separate AWS accounts:
+#
+#   Account A (principal account) — the default provider
+#     * cross_account_principal: the plugin assumes this role first.
+#       It has sts:AssumeRole permission on the target role in Account B.
+#
+#   Account B (target account) — the "target" provider alias
+#     * cross_account_target: holds ec2:DescribeInstances; its trust policy
+#       allows the Account A principal role to assume it. (happy path)
+#     * cross_account_target_no_ec2_permission: same trust policy but no
+#       ec2:DescribeInstances. (error case)
+#     * cross_account_target_no_trust: exists in Account B but its trust
+#       policy does not allow the Account A principal. (error case)
+#
+# Prerequisites:
+#   TARGET_AWS_ACCESS_KEY_ID, TARGET_AWS_SECRET_ACCESS_KEY, and (for temporary
+#   credentials) TARGET_AWS_SESSION_TOKEN must be set to credentials that have
+#   sufficient IAM permissions in Account B. The test runner skips this
+#   section when the access key ID or secret access key are absent.
+
+# ---------------------------------------------------------------------------
+# Provider for Account B (target account)
+# ---------------------------------------------------------------------------
+
+provider "aws" {
+  alias      = "target"
+  region     = var.target_region
+  access_key = var.target_access_key_id
+  secret_key = var.target_secret_access_key
+  token      = var.target_session_token
+}
+
+data "aws_caller_identity" "target" {
+  provider = aws.target
+}
+
+# ---------------------------------------------------------------------------
+# Variables for Account B credentials and region
+# ---------------------------------------------------------------------------
+
+variable "target_access_key_id" {
+  description = "AWS access key ID for the target account (Account B)."
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
+variable "target_secret_access_key" {
+  description = "AWS secret access key for the target account (Account B)."
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
+variable "target_session_token" {
+  description = "AWS session token for the target account (Account B). Required when using temporary (STS) credentials."
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
+variable "target_region" {
+  description = "AWS region for the target account (Account B). Defaults to the same region as Account A."
+  type        = string
+  default     = ""
+}
+
+# ---------------------------------------------------------------------------
+# Account A: cross_account_principal role
+# ---------------------------------------------------------------------------
+
+resource "random_id" "cross_account_principal_name" {
+  prefix      = "BoundaryPluginCAPrincipal"
+  byte_length = 4
+}
+
+resource "aws_iam_role" "cross_account_principal" {
+  name = random_id.cross_account_principal_name.dec
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action    = ["sts:AssumeRole", "sts:SetSourceIdentity"]
+        Effect    = "Allow"
+        Principal = { AWS = data.aws_caller_identity.current.arn }
+      },
+    ]
+  })
+
+  tags = {
+    "boundary-demo" = local.hashicorp_email
+  }
+}
+
+# Allow the principal role to assume the happy-path and no-EC2-permission
+# target roles in Account B.
+resource "aws_iam_policy" "cross_account_principal_assume_targets" {
+  name = "${random_id.cross_account_principal_name.dec}-assume-targets"
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action   = ["sts:AssumeRole", "sts:SetSourceIdentity"]
+        Effect   = "Allow"
+        Resource = [
+          aws_iam_role.cross_account_target.arn,
+          aws_iam_role.cross_account_target_no_ec2_permission.arn,
+        ]
+      },
+    ]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "cross_account_principal_assume_targets" {
+  role       = aws_iam_role.cross_account_principal.name
+  policy_arn = aws_iam_policy.cross_account_principal_assume_targets.arn
+}
+
+output "cross_account_principal_arn" {
+  value = aws_iam_role.cross_account_principal.arn
+}
+
+# Error case: caller cannot assume the principal role (first hop denied).
+# Reuses assume_role_no_trust from iam_assume_role.tf — its Deny trust policy
+# also blocks the test runner from assuming it as a principal.
+output "cross_account_principal_no_trust_arn" {
+  value = aws_iam_role.assume_role_no_trust.arn
+}
+
+# ---------------------------------------------------------------------------
+# Account B: happy-path target role
+# ---------------------------------------------------------------------------
+
+resource "random_id" "cross_account_target_name" {
+  prefix      = "BoundaryPluginCATarget"
+  byte_length = 4
+}
+
+resource "aws_iam_role" "cross_account_target" {
+  provider = aws.target
+  name     = random_id.cross_account_target_name.dec
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action    = ["sts:AssumeRole", "sts:SetSourceIdentity"]
+        Effect    = "Allow"
+        Principal = { AWS = aws_iam_role.cross_account_principal.arn }
+      },
+    ]
+  })
+
+  tags = {
+    "boundary-demo" = local.hashicorp_email
+  }
+}
+
+resource "aws_iam_policy" "cross_account_target_ec2_describeinstances" {
+  provider = aws.target
+  name     = "${random_id.cross_account_target_name.dec}-ec2"
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action   = ["ec2:DescribeInstances"]
+        Effect   = "Allow"
+        Resource = "*"
+      },
+    ]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "cross_account_target_ec2_describeinstances" {
+  provider   = aws.target
+  role       = aws_iam_role.cross_account_target.name
+  policy_arn = aws_iam_policy.cross_account_target_ec2_describeinstances.arn
+}
+
+output "cross_account_target_arn" {
+  value = aws_iam_role.cross_account_target.arn
+}
+
+# ---------------------------------------------------------------------------
+# Account B: error case — both hops succeed but target has no ec2:DescribeInstances
+# ---------------------------------------------------------------------------
+
+resource "random_id" "cross_account_target_no_ec2_permission_name" {
+  prefix      = "BoundaryPluginCATargetNoEC2"
+  byte_length = 4
+}
+
+resource "aws_iam_role" "cross_account_target_no_ec2_permission" {
+  provider = aws.target
+  name     = random_id.cross_account_target_no_ec2_permission_name.dec
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action    = ["sts:AssumeRole", "sts:SetSourceIdentity"]
+        Effect    = "Allow"
+        Principal = { AWS = aws_iam_role.cross_account_principal.arn }
+      },
+    ]
+  })
+
+  tags = {
+    "boundary-demo" = local.hashicorp_email
+  }
+}
+
+output "cross_account_target_no_ec2_permission_arn" {
+  value = aws_iam_role.cross_account_target_no_ec2_permission.arn
+}
+
+# ---------------------------------------------------------------------------
+# Account B: error case — principal cannot assume this target (second hop denied)
+# ---------------------------------------------------------------------------
+
+resource "random_id" "cross_account_target_no_trust_name" {
+  prefix      = "BoundaryPluginCATargetNoTrust"
+  byte_length = 4
+}
+
+resource "aws_iam_role" "cross_account_target_no_trust" {
+  provider = aws.target
+  name     = random_id.cross_account_target_no_trust_name.dec
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action    = ["sts:AssumeRole", "sts:SetSourceIdentity"]
+        Effect    = "Deny"
+        Principal = { AWS = aws_iam_role.cross_account_principal.arn }
+      },
+    ]
+  })
+
+  tags = {
+    "boundary-demo" = local.hashicorp_email
+  }
+}
+
+output "cross_account_target_no_trust_arn" {
+  value = aws_iam_role.cross_account_target_no_trust.arn
+}
+
+# ---------------------------------------------------------------------------
+# Account B: EC2 instance for cross-account host discovery validation
+# ---------------------------------------------------------------------------
+
+data "aws_availability_zones" "target_azs" {
+  count    = var.target_access_key_id != "" ? 1 : 0
+  provider = aws.target
+}
+
+data "aws_ami" "target_ubuntu" {
+  count       = var.target_access_key_id != "" ? 1 : 0
+  provider    = aws.target
+  most_recent = true
+
+  filter {
+    name   = "name"
+    values = ["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"]
+  }
+
+  filter {
+    name   = "virtualization-type"
+    values = ["hvm"]
+  }
+
+  owners = ["099720109477"] # Canonical
+}
+
+resource "aws_vpc" "target_vpc" {
+  count                            = var.target_access_key_id != "" ? 1 : 0
+  provider                         = aws.target
+  cidr_block                       = "10.1.0.0/16"
+  assign_generated_ipv6_cidr_block = true
+}
+
+resource "aws_subnet" "target_subnet" {
+  count                           = var.target_access_key_id != "" ? 1 : 0
+  provider                        = aws.target
+  vpc_id                          = aws_vpc.target_vpc[0].id
+  cidr_block                      = aws_vpc.target_vpc[0].cidr_block
+  ipv6_cidr_block                 = cidrsubnet(aws_vpc.target_vpc[0].ipv6_cidr_block, 8, 0)
+  availability_zone               = data.aws_availability_zones.target_azs[0].names[0]
+  map_public_ip_on_launch         = true
+  assign_ipv6_address_on_creation = true
+}
+
+resource "aws_instance" "target_instances" {
+  count         = var.target_access_key_id != "" ? length(local.instance_tags) : 0
+  provider      = aws.target
+  ami           = data.aws_ami.target_ubuntu[0].id
+  instance_type = "t3.nano"
+  subnet_id     = aws_subnet.target_subnet[0].id
+
+  tags = local.instance_tags[count.index]
+}
+
+output "target_instance_ids" {
+  value = aws_instance.target_instances.*.id
+}
+
+output "target_instance_tags" {
+  value = {
+    for _, r in aws_instance.target_instances : r.id => r.tags
+  }
+}
@@ -39,6 +39,10 @@ type TestTerraformer struct {
 	// The working directory for Terraform commands.
 	workDir string

+	// vars holds optional key/value pairs passed as -var flags to every
+	// Terraform command that accepts them (apply, destroy, plan).
+	vars map[string]string
+
 	// The Terraform state. Use the Output method to look up particular
 	// outputs from the Terraform state.
 	state *tfjson.State
@@ -53,8 +57,9 @@ type TestTerraformer struct {

 // NewTestTerraformer initializes a Terraform directory. It just
 // returns an initialized project, it does not perform any actions on
-// it.
-func NewTestTerraformer(workDir string) (*TestTerraformer, error) {
+// it. An optional vars map may be provided; each entry is passed as a
+// -var flag to Terraform commands.
+func NewTestTerraformer(workDir string, vars ...map[string]string) (*TestTerraformer, error) {
 	tfPath, err := exec.LookPath("terraform")
 	if err != nil {
 		return nil, fmt.Errorf("LookPath error: %w", err)
@@ -64,10 +69,24 @@ func NewTestTerraformer(workDir string) (*TestTerraformer, error) {
 		return nil, errors.New("workDir is empty")
 	}

-	return &TestTerraformer{
+	tf := &TestTerraformer{
 		tfPath:  tfPath,
 		workDir: workDir,
-	}, nil
+	}
+	if len(vars) > 0 {
+		tf.vars = vars[0]
+	}
+	return tf, nil
+}
+
+// varArgs converts the stored vars map into a slice of -var flags
+// suitable for appending to a Terraform command's argument list.
+func (t *TestTerraformer) varArgs() []string {
+	args := make([]string, 0, len(t.vars)*2)
+	for k, v := range t.vars {
+		args = append(args, "-var", fmt.Sprintf("%s=%s", k, v))
+	}
+	return args
 }

 // Deploy runs the following commands, in order: init, apply, plan,
@@ -214,7 +233,8 @@ func (t *TestTerraformer) init() error {

 // apply runs "terraform apply" in the project's working directory.
 func (t *TestTerraformer) apply() error {
-	cmd := exec.Command(t.tfPath, "apply", "-input=false", "-auto-approve")
+	args := append([]string{"apply", "-input=false", "-auto-approve"}, t.varArgs()...)
+	cmd := exec.Command(t.tfPath, args...)
 	cmd.Dir = t.workDir
 	stdoutStderr, err := cmd.CombinedOutput()
 	if err != nil {
@@ -226,7 +246,8 @@ func (t *TestTerraformer) apply() error {

 // destroy runs "terraform destroy" in the project's working directory.
 func (t *TestTerraformer) destroy() error {
-	cmd := exec.Command(t.tfPath, "destroy", "-input=false", "-auto-approve")
+	args := append([]string{"destroy", "-input=false", "-auto-approve"}, t.varArgs()...)
+	cmd := exec.Command(t.tfPath, args...)
 	cmd.Dir = t.workDir
 	stdoutStderr, err := cmd.CombinedOutput()
 	if err != nil {
@@ -242,7 +263,8 @@ func (t *TestTerraformer) destroy() error {
 // it's run to get the data for for importing the state via
 // terraform-json. The apply method ignores the plan generated here.
 func (t *TestTerraformer) plan() error {
-	cmd := exec.Command(t.tfPath, "plan", "-input=false", "-out=plan.tfplan")
+	args := append([]string{"plan", "-input=false", "-out=plan.tfplan"}, t.varArgs()...)
+	cmd := exec.Command(t.tfPath, args...)
 	cmd.Dir = t.workDir
 	stdoutStderr, err := cmd.CombinedOutput()
 	if err != nil {
Author	SHA1	Message	Date
Matt Romanelli	bed5cf8f82	bug(go) gRPC status codes were getting overwritten by the handlers (#94 ) * bug(go) gRPC status codes were getting overwritten by the handlers Problem * If the gRPC handlers received an error with a gRPC status code from checkHosts, it got overwritten by a plain error value. Solution * Added a check to each checkHosts call that passes on the error received (with its gRPC status) Testing * Added new unit tests for when the handlers receive an error from checkHosts with a status code. * Existing unit tests and terraform tests passed	2026-09-28 12:03:41 -05:00
Matt Romanelli	86273c5fcd	feat(tests) Add Terraform testing to support Cross-account discovery (#89 ) * feat(tests) Add Terraform testing to support Cross-account discovery Problem * To support cross-account DHC discovery, we need to add terraform configurations and tests to test against live AWS data. * However, there was nothing in place to support any AssumeRole testing, irrespective of cross-account. Solution * Added a new terraform file, iam_assume_role.tf, to contain the new terraform configurations for single-account AssumeRole and cross-role * Added a second terraform file, iam_cross_account.tf, to contain the new terraform configurations for cross-account * Refactored how the tests are organized. The previous static test cases used a system where a separate function was created for each test. This was moved to a dedicated file, e2e_host_static_test.go. * For AssumeRole tests (single account, cross role, and cross account), this system wasn't ideal since there are so many test cases and they are all extremely similar. A table driven system was better that passed in a set of variables to shared test helpers. A dedicated file, e2e_host_assumerole_test.go, was created to contain the testing infrastructure for AssumeRole tests. * e2e_host_test.go remains the main test runner that then calls e2e_host_assumerole_test.go and e2e_host_static_test.go * The terraform tests work by setting environment variables for the AWS account that you want to configure the terraform for. The existing setup worked for single-account and cross-role. However, to support cross-account, support had to be added for a second set of credentials. The second set of environment variables can now be set with the TARGET_ prefix. Some configuration in testing.go had to be added to support creating/destroying multiple terraform setups. Testing * The single account tests pass as expected. However, a bug was discovered during this process that will be addressed later. * The cross-role and cross-account tests failed as expected because this featured has not yet been delivered. * It was noticed that some of the existing static tests were flaky. The problem and fix were identified and will be addressed later.	2026-09-28 12:03:02 -05:00
Delaine Rogers	6b88a88c38	fix(host): fix role_arn fallback bug (#82 ) * Fix role arn fallthrough bug * add unit test * bump awsutil version * fix tests	2026-09-28 12:02:46 -05:00
Ryan Flynn	173e95051d	feat(cli) Update error handling for checkHosts, Target EC2 client logic (#91 ) * feat(cli) Update error handling for checkHosts, Target EC2 client logic * feat(cli) Add UnauthorizedOperation handling to errors.go	2026-09-28 12:02:31 -05:00
rebecca-yohandryanflynn9299	adba0e7a89	feat(host): replace dryRunValidation with checkHosts in catalog and set handlers (ICU-19979) (#87 ) * temporary commit * feat(host): replace dryRunValidation with checkHosts in catalog and set handlers * refactor(host): clean up comments and fix typos in dry-run validation blocks * refactor(host): address PR feedback on dry-run validation blocks * refactor(host): remove dead dryRunValidation function and its tests * refactor(host): extract dry run error message as a constant * refactor(host): propagate BadRequestStatusf from buildFilters through buildDescribeInstancesInput --------- Co-authored-by: ryanflynn9299 <ryan.flynn001@gmail.com>	2026-09-28 12:01:53 -05:00
Ryan Flynn	ec00344f5a	feat(cli) Implement infra to support cross account AssumeRole for DHC on ListHosts (#86 )	2026-09-28 12:01:06 -05:00
Ryan Flynn	0cd593a433	feat(cli) Implement parsing of target-prefixed attrs for cross account dynamic host catalogs (#84 )	2026-09-28 12:00:57 -05:00
Delaine RogersandDelaine Rogers	0d36d4de0b	feat(host): Allow nil setAttributes for buildDescribeInstancesInput (#79 ) * Allow nil setAttributes * move the nil check --------- Co-authored-by: Delaine Rogers <delainerogers@dhcp-9-16-190-160.sjs-us.ibm.com>	2026-09-28 12:00:33 -05:00
Matt Romanelli	fded8acb19	Updated the READMEs for cross-account discovery	2026-09-28 12:00:23 -05:00
Susmitha Girumala	163ec69771	Update github test workflow permissions to read-only (#76 ) Set GITHUB_TOKEN to read-only permission by default	2026-07-14 15:31:58 -04:00
Piotr KazmierczakandHugo	e8a0b0bf10	feat(storage): support multipart uploads (#72 ) This changeset implements multipart uploads. AWS caps PutObject calls at 5 GiB, effectively causing the plugin to error on any upload larger than that. Multipart limit is 8 TiB, which should be plenty for most use cases. Multipart implementation is size-gated: we only switch to multipart uploads once the file size is greater than multipartThreshold, which is currently set to 8 MiB, and we set the part size to 8 MiB as well (this follows AWS CLI and boto3). That gives us ~78 GiB max object before we auto-scale, due to 10,000 part cap on AWS. --------- Co-authored-by: Hugo <10965479+hugoghx@users.noreply.github.com>	2026-06-26 16:34:32 +02:00
Damian Debkowski	4c8e95fcd8	fix: improve http transport (#73 )	2026-06-24 07:12:41 -07:00