CHANGELOG.md

5.12.0 (Unreleased)

FEATURES:

• New Resources: Add support for PKI External CA DNS-01 challenge providers with vault_pki_external_ca_secret_backend_dns_provider_aws_route53, vault_pki_external_ca_secret_backend_dns_provider_azure, vault_pki_external_ca_secret_backend_dns_provider_gcp, and vault_pki_external_ca_secret_backend_dns_provider_rfc2136 resources. Also adds default_nameserver to vault_pki_external_ca_secret_backend_acme_account and dns_provider_name/dns_provider_type to vault_pki_external_ca_secret_backend_role. Requires Vault 2.1.0 or later. (#3014)

• New Ephemeral Resource: vault_azure_access_token for fetching Azure OAuth2 access tokens from Vault's Azure secrets engine static role credentials. Requires Vault 2.2.0 or later. (#2974)

• New Resource for tokenization transforms: Add new resources vault_transform_transformation_tokenization and vault_transform_transformation_tokenization_store for tokenization transformations in transform secrets engine and tokenization stores. Uses this endpoint to support creating and updating of tokenization transformations and this endpoint for tokenization stores. Supported parameters include name, mapping_mode, max_ttl, allowed_roles, stores, convergent, deletion_allowed for vault_transform_transformation_tokenization and name, type, driver, connection_string, username, password, supported_transformations, schema, max_open_connections, max_idle_connections, max_connection_lifetime for vault_transform_transformation_tokenization_store.

IMPROVEMENTS:

• vault_cert_auth_backend_role: Add certificate_wo and certificate_wo_version write-only fields to allow ephemeral resource values, to supply the CA certificate. The certificate field is now Computed and ForceNew has been removed enabling in-place updates when the certificate changes instead of resource replacement.

• vault_ldap_auth_backend: emit a warning when the auth mount or its config is not found during refresh, so users see an actionable message in terraform plan output rather than a silent state removal. (#2997)

• Update supported Vault version for PKI formats pkcs12_bundle and jks_bundle to require Vault 2.1.0+ (not 2.0.5+) per latest Vault versioning strategy. (#2950)

BUG FIXES:

• vault_mount: Fix spurious ForceNew destroy when importing a kv-v2 mount. Vault returns type=kv+options.version=2 on import; a DiffSuppressFunc now suppresses the kv/kv-v2 alias diff so the next plan is clean. (#3007)
• vault_terraform_cloud_secret_backend: Fix logic gap in Read where execution would fall through to a stray GET <backend>/config call after readMount detected the mount was deleted out-of-band and cleared the resource ID. Add util.Is404 guard to Delete so that terraform destroy succeeds cleanly when the mount has already been removed from Vault. (#3006)

5.11.0 (August 14, 2026)

FEATURES:

• vault_azure_auth_backend_config: Add auth_type field to explicitly control how Vault authenticates to Azure APIs. Valid values are root_creds, plugin_wif, msi, and aks_wif. When omitted, Vault retains its existing credential-discovery behaviour for backward compatibility (#2999). Requires Vault 2.2.0+.

• New Resources: Add support for GCP KMS secrets engine with vault_gcpkms_secret_backend and vault_gcpkms_secret_backend_key resources, vault_gcpkms_verify data source, and ephemeral resources vault_gcpkms_encrypt, vault_gcpkms_decrypt, vault_gcpkms_reencrypt, and vault_gcpkms_sign for cryptographic operations. Includes internal Plugin Framework mount_helpers for Vault mount operations to support incremental migration from SDKv2. (#2763)

• New resource for transform key configurations: vault_transform_key_configuration - Supports setting an auto_rotate_period and min_decryption_version to keys used in for tokenization transformations. This uses this endpoint to modify the configuration and this one to read configurations. (#2980)

• LDAP Role Level Password Policy Support: Added password_policy parameter to vault_ldap_secret_backend_static_role and vault_ldap_secret_backend_dynamic_role resources to support role-level password policy configuration (#2921). Requires Vault 2.2.0+.

• LDAP Rotate-on-Read Support: Added rotate_on_read and rotate_on_read_cooldown parameters to vault_ldap_secret_backend and vault_ldap_secret_backend_static_role resources, and rotated_on_read attribute to vault_ldap_static_role_credentials data source to support credential rotation on each read (#2960. Requires Vault Enterprise 2.2.0+.

• LDAP Account Unlock for Static Role: Added auto_unlock field (Optional+Computed) to vault_ldap_secret_backend and vault_ldap_secret_backend_static_role. When set at the mount level, Vault automatically unlocks the managed AD account after every successful static-role rotation, the per-role field overrides the mount-level setting, and when unset the role inherits the mount default. Active Directory schema only. Requires Vault Enterprise 2.2.0+.(#2977)

• Terraform Secret Engine Root Rotation Support: Add support for automated root token rotation via the rotation_period, rotation_schedule, rotation_window, and disable_automated_rotation fields, and add explicit_max_ttl to bound the lifetime of the rotated root token. Requires Vault 2.2.0+. (#2958)

• Add support for Kerberos auth backend: vault_kerberos_auth_backend_config, vault_kerberos_auth_backend_ldap_config, and vault_kerberos_auth_backend_group resources, and vault_kerberos_auth_backend_login ephemeral resource for Kerberos authentication. (#2819)

• Secrets Sync customer controlled encryption: vault_secrets_sync_aws_destination and vault_secrets_sync_gcp_destination now support Vault 2.2.0+ fields kms_key_id and replica_regions; and deprecated GCP legacy fields global_kms_key, locational_kms_keys, and replication_locations in favor of kms_key_id and replica_regions. (#2965)

• Add support for pkcs12_bundle and jks_bundle formats (without setting default values) in vault_pki_secret_backend_cert, vault_pki_secret_backend_root_cert, vault_pki_secret_backend_root_sign_intermediate, and vault_pki_secret_backend_sign (#2946). Requires Vault 2.0.5+.

IMPROVEMENTS:

• Migrated AWS provider dependency from aws-sdk-go (v1) to aws-sdk-go-v2 for improved performance and maintainability. (#2882)
• vault_identity_entity_alias: Add support for external_id and issuer fields. Available only for Vault Enterprise. (#2994)
• vault_aws_auth_backend_config_identity: Add support for canonical_arn as a valid value for the iam_alias parameter. Requires Vault 1.16+. (#2982)
• vault_jwt_auth_backend: Add string-to-integer conversion for groups_cap field in provider_config to support Okta provider configuration. (#2939)
• Autosnapshot support for AWS IRSA: Added documentation for IRSA usage per changes in Vault (hashicorp/raft-snapshotagent#49). IRSA feature requires Vault 2.2.0+
• Updated dependencies:
  • Bumped 13 Go module dependencies (#2969)
  • Bumped 10 Go module dependencies (#2990)
  • actions/checkout v7.0.0 → v7.0.1
  • actions/setup-go v6.4.0 → v7.0.0
  • actions/cache v5.0.5 → v6.1.0
  • golang.org/x/mod v0.37.0 → v0.40.0 (fixes GO-2026-6179, GO-2026-6180)
  • golang.org/x/crypto v0.54.0 → v0.55.0
  • golang.org/x/net v0.57.0 → v0.58.0
  • golang.org/x/text v0.40.0 → v0.41.0
  • golang.org/x/tools v0.47.0 → v0.49.0
  • cloud.google.com/go/iam v1.12.0 → v1.13.0
  • cloud.google.com/go/auth v0.20.0 → v0.23.0
  • github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0 → v1.23.0
  • github.com/aws/aws-sdk-go-v2 v1.43.0 → v1.43.5
  • github.com/aws/aws-sdk-go-v2/config v1.32.31 → v1.32.36
  • github.com/aws/aws-sdk-go-v2/credentials v1.19.30 → v1.19.35
  • github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.31 → v1.18.36
  • github.com/aws/aws-sdk-go-v2/service/iam v1.56.0 → v1.59.0
  • github.com/aws/aws-sdk-go-v2/service/sts v1.45.0 → v1.45.5
  • github.com/aws/smithy-go v1.27.3 → v1.27.7
  • github.com/hashicorp/terraform-plugin-log v0.10.0 → v0.11.0
  • github.com/moby/moby/client v0.5.0 → v0.5.1
  • google.golang.org/api v0.287.1 → v0.293.0
  • google.golang.org/genproto v0.0.0-20260622175928 → v0.0.0-20260810153831
  • google.golang.org/grpc v1.82.1 → v1.83.0
  • k8s.io/utils v0.0.0-20260617174310 → v0.0.0-20260707023825
• Build and CI changes:
  • Go 1.26.4 → 1.26.6 (fixes GO-2026-6088, GO-2026-6089, GO-2026-6090, GO-2026-6091, GO-2026-6218 in stdlib)
  • Vault Enterprise test images: 1.19.19-ent → 1.19.20-ent, 1.20.13-ent → 1.20.14-ent, 1.21.8-ent → 1.21.9-ent, 2.0.3-ent → 2.0.4-ent

BUG FIXES:

• vault_jwt_auth_backend: Fixed a perpetual diff where Vault returned non-string values that were silently dropped by Terraform’s TypeMap(TypeString) schema. All values are now converted to strings when read, preventing keys such as fetch_groups and groups_recurse_max_depth from appearing missing on every plan.(#2993)
• Fixed the token namespace being set as the provider namespace, even when set_namespace_from_token was false. (#2926)
• vault_pki_secret_backend_role: Fix crash when the Vault client was not successfully initialized (#2964)

5.10.1 (June 26, 2026)

BREAKING CHANGES:

Reverted the 5.10.0 support for pkcs12_bundle and jks_bundle formats in formats in vault_pki_secret_backend_cert, vault_pki_secret_backend_root_cert, vault_pki_secret_backend_root_sign_intermediate, and vault_pki_secret_backend_sign that forced resource recreation. Configurations using these formats or their related arguments are no longer supported. (#2945)

5.10.0 (June 23, 2026)

FEATURES:

• New Resource: vault_config_ui_default_auth - Manages UI default authentication configuration for the Vault GUI login form. Controls which authentication methods are displayed by default and as backup options for specific namespaces. Supports inheritance control for child namespaces. Enterprise-only feature requiring Vault 1.20.0+. (#2846)
• vault_config_control_group: Added initial implementation for vault_config_control_group resource in sys/config/control-group. (#2840)
• New Resource: vault_config_ui_header - Manages custom HTTP headers for the Vault UI. Supports security headers (CSP, HSTS, X-Frame-Options), CORS configuration, and custom organizational headers. Requires Vault 1.16.0+. (#2842)
• New Resource: Add support for RADIUS auth backend: vault_radius_auth_backend and vault_radius_auth_backend_user resource and vault_radius_auth_login ephemeral resource.(#2814)
• New Resource: vault_activation_flags for managing Vault features that are gated by one-time flags. Requires Vault 1.16 or later. Needs Vault enterprise license(#2861)
• New Resource: vault_oauth_resource_server_config_profile for managing OAuth Resource Server Configuration profiles in Vault Enterprise. Enables JWT-based authentication by defining how Vault validates JWT tokens from OAuth 2.0 resource servers. Supports both JWKS-based and static PEM key validation. Requires Vault 2.0.1+. (#2890)
• New Resource: vault_agent_registrationfor managing Agent Registry records in Vault Enterprise. Allows registering Vault agents with specific identity entities and configuring ceiling policies that limit maximum agent permissions. Requires Vault 2.0.1+. (#2885,2935)
• New Resource: vault_oauth_resource_server_config_profile Add optional_authorization_details to make RAR optional on OAuth resource server and agent registration. Requires Vault 2.0.3+.(#2930,#2933)
• New Resources: vault_userpass_auth_backend_user for user creation, deletion, password updates, and policy updates, and ephemeral resource vault_userpass_auth_login for authenticating with Userpass. (#2859)
• Add support for write only parameters for s3 backends for vault_raft_snapshot_agent_config by @drewmullen ([#2825]#2825)
• vault_transform_transformation: Added mapping_mode, stores and convergent fields to the resource. ([#2820] #2820)
• New Ephemeral Resource: vault_token for creating Vault tokens with automatic revocation. Supports service and batch tokens, as well as entity alias association, which was not supported in the SDKv2 resource. (#2877)
• New Resource: vault_config_group_policy_application - Manages the global group policy application mode for Vault Enterprise. Controls how policies attached to identity groups are applied across namespace boundaries. Supports within_namespace_hierarchy (default) and any modes. Requires Vault Enterprise 1.13.8+. (#2863)
• Add support for pkcs12_bundle and jks_bundle formats in vault_pki_secret_backend_cert, vault_pki_secret_backend_root_cert, vault_pki_secret_backend_root_sign_intermediate, and vault_pki_secret_backend_sign (#2908). Requires Vault 2.1+.
• vault_policy: Added allow_overwrite to optionally prevent overwriting Vault policies.(#2895)
• vault_managed_keys: Added support for usages and max_parallel fields. (#2887)

IMPROVEMENTS:

• resource/vault_token: Added deprecation warning to guide users toward the new ephemeral vault_token resource for better security and batch token support. (#2877)

• Replaced backend with mount in vault_aws_access_credentials resource's documentation and improved descriptions for a few other parameters.(#2911)

• Updated dependencies:

  • cloud.google.com/go/iam v1.9.0 -> v1.11.0
  • github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.1 -> v1.22.0
  • github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 -> v1.14.0
  • github.com/Azure/go-ntlmssp v0.1.0 -> v0.1.1
  • github.com/aws/aws-sdk-go-v2 v1.41.6 -> v1.42.0
  • github.com/aws/aws-sdk-go-v2/service/iam v1.53.8 -> v1.54.5
  • github.com/aws/aws-sdk-go-v2/service/sts v1.42.0 -> v1.43.3
  • github.com/aws/smithy-go v1.25.0 -> v1.27.2
  • github.com/go-sql-driver/mysql v1.9.3 -> v1.10.0
  • github.com/hashicorp/consul/api v1.34.1 -> v1.34.3
  • github.com/hashicorp/terraform-plugin-sdk/v2 v2.40.0 -> v2.40.1
  • github.com/hashicorp/terraform-plugin-testing v1.15.0 -> v1.16.0
  • github.com/hashicorp/vault-plugin-auth-jwt v0.26.1 -> v0.26.3
  • github.com/jackc/pgx/v5 v5.9.1 -> v5.9.2
  • github.com/moby/moby/client v0.4.1 -> v0.5.0
  • github.com/spiffe/go-spiffe/v2 v2.6.0 -> v2.8.1
  • golang.org/x/crypto v0.50.0 -> v0.53.0
  • golang.org/x/net v0.53.0 -> v0.56.0
  • google.golang.org/api v0.276.0 -> v0.286.0
  • google.golang.org/genproto v0.0.0-20260420184626 -> v0.0.0-20260622175928
  • google.golang.org/genproto/googleapis/api v0.0.0-20260414002931 -> v0.0.0-20260618152121
  • google.golang.org/genproto/googleapis/rpc v0.0.0-20260610212136 -> v0.0.0-20260618152121
  • k8s.io/utils v0.0.0-20260319190234 -> v0.0.0-20260617174310

5.9.0 (April 22, 2026)

BREAKING CHANGES:

• Renamed all Vault 2.0 pki-external-ca resources from version 5.8.0 to a common prefix of vault_pki_external_ca_. (#2838)

FEATURES:

• New Resources: Add support for OS Secrets Engine with vault_os_secret_backend, vault_os_secret_backend_host, and vault_os_secret_backend_account resources for managing operating system credentials via SSH. Requires Vault 2.0.0+. (#2865)
• New Resources: vault_rotation_policy for managing rotation policies. Requires Vault 2.0.0+. (#2844)
• Add support for vault_quota_config resource. (#2837)
• New Resources: Add support for Vault Key Management secrets engine with resources for managing KMS providers (AWS KMS, Azure Key Vault, GCP Cloud KMS), cryptographic keys, key distribution, replication, and rotation (Vault Enterprise). (#2802)
• New Resources: vault_alicloud_secret_backend, vault_alicloud_secret_backend_role, and ephemeral resource vault_alicloud_access_credentials for managing AliCloud secrets engine. (#2858, #2874)
• New Resource: vault_plugin_runtime for managing plugin runtimes in Vault's plugin runtimes catalog. Requires Vault 1.15 or later.(#2835)
• Add support for CORS configuration: vault_sys_config_cors resource and data source for managing and reading Vault's CORS (Cross-Origin Resource Sharing) settings. (#2849)
• New Ephemeral Resource: Add vault_generic_endpoint ephemeral resource with response field extraction from data, auth, wrap_info, and lease metadata.(#2830)

IMPROVEMENTS:

• vault_cf_auth_backend_config: Added cf_password_wo_version to trigger updates when only cf_password_wo changes.(#2878)
• vault_pki_secret_backend_config_acme: Added new fields that control the PKI ACME challenge worker IP ranges that they can connect. ([#2839]#2839)
• Add support for metadata fields in azure_access_credentials and resource_azure_secret_backend_role resources. (#2734)
• Add support for Enterprise Plugins in vault_plugin resource. (#2707)
• vault_ldap_secret_backend: Add self-managed support to ldap secrets engine. Requires Vault Enterprise 2.0+. (#2845)
• azure_static_role: Add support for importing existing credentials via new Vault import endpoint. (#2756)
• Updated dependencies:
  • cloud.google.com/go/auth v0.18.2 -> v0.20.0
  • cloud.google.com/go/cloudsqlconn v1.4.3 -> v1.20.2
  • cloud.google.com/go/iam v1.7.0 -> v1.9.0
  • filippo.io/edwards25519 v1.1.1 -> v1.2.0
  • github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 -> v1.21.1
  • github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 -> v1.12.0
  • github.com/aws/aws-sdk-go-v2 v1.41.5 -> v1.41.6
  • github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 -> v1.4.22
  • github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 -> v2.7.22
  • github.com/aws/aws-sdk-go-v2/service/iam v1.53.7 -> v1.53.8
  • github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 -> v1.13.8
  • github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 -> v1.13.22
  • github.com/aws/aws-sdk-go-v2/service/sts v1.41.10 -> v1.42.0
  • github.com/aws/smithy-go v1.24.3 -> v1.25.0
  • github.com/docker/docker v28.3.3+incompatible -> v28.5.2+incompatible
  • github.com/docker/go-connections v0.5.0 -> v0.7.0
  • github.com/fatih/color v1.18.0 -> v1.19.0
  • github.com/go-jose/go-jose/v3 v3.0.4 -> v3.0.5
  • github.com/go-jose/go-jose/v4 v4.1.3 -> v4.1.4
  • github.com/googleapis/gax-go/v2 v2.20.0 -> v2.21.0
  • github.com/hashicorp/consul/api v1.33.7 -> v1.34.1
  • github.com/hashicorp/go-secure-stdlib/plugincontainer v0.4.2 -> v0.5.0
  • github.com/hashicorp/terraform-plugin-mux v0.23.0 -> v0.23.1
  • github.com/hashicorp/vault/sdk v0.25.0 -> v0.25.1
  • github.com/jackc/pgtype v1.14.3 -> v1.14.4
  • github.com/oklog/run v1.1.0 -> v1.2.0
  • github.com/opencontainers/image-spec v1.1.0 -> v1.1.1
  • go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 -> v0.67.0
  • go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 -> v0.67.0
  • go.opentelemetry.io/otel v1.42.0 -> v1.43.0
  • go.opentelemetry.io/otel/metric v1.42.0 -> v1.43.0
  • go.opentelemetry.io/otel/trace v1.42.0 -> v1.43.0
  • golang.org/x/crypto v0.49.0 -> v0.50.0
  • golang.org/x/mod v0.33.0 -> v0.34.0
  • golang.org/x/net v0.52.0 -> v0.53.0
  • golang.org/x/sys v0.42.0 -> v0.43.0
  • golang.org/x/text v0.35.0 -> v0.36.0
  • golang.org/x/tools v0.42.0 -> v0.43.0
  • google.golang.org/api v0.273.1 -> v0.276.0
  • google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 -> v0.0.0-20260420184626-e10c466a9529
  • google.golang.org/genproto/googleapis/api v0.0.0-20260401001100-f93e5f3e9f0f -> v0.0.0-20260414002931-afd174a4e478
  • google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7 -> v0.0.0-20260414002931-afd174a4e478
  • google.golang.org/grpc v1.79.3 -> v1.80.0
  • k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 -> v0.0.0-20260319190234-28399d86e0b5

BUGS:

• vault_consul_secret_backend: Fixed validation logic to allow computed token values by correcting the condition that checks for token presence during plan phase. (#2823)
• vault_pki_external_ca_secret_backend_acme_account: Provide eab_kid and eab_key values through the ACME account creation request. ([#2851]#2852)
• provider/auth_login: Fix "Missing Region" error when using generic auth_login block for AWS authentication without explicit sts_region parameter. The provider now properly resolves AWS region from environment variables (AWS_REGION, AWS_DEFAULT_REGION) and EC2 instance metadata service (IMDS), consistent with auth_login_aws behavior. (#2786)
• provider/auth_aws: Fix auth_login_aws for Vault AWS auth backends configured with use_sts_region_from_client = true by generating a standard SigV4-signed GetCallerIdentity request with an Authorization header, and added support for custom STS endpoints. (#2841)
• resource_database_secret_backend_connection : Fixes a regression issue for resource_database_secret_backend_connection for elasticsearch. Reverted the field name from insecure_tls to insecure.
• vault_rabbitmq_secret_backend_role: Fixed spurious diff issue for vhost and vhost_topic fields by changing field type from TypeList to TypeSet. (#2872)
• provider/auth_aws: Fix auth_login_aws to avoid an unintended second STS AssumeRole call during web identity credential flows, while preserving manual role assumption for explicitly configured or env-derived aws_role_arn values in non-web-identity setups.(#2850)

Release Note:

• Vault Version Support: The Vault provider will be dropping Vault version support for Vault <= 1.18.x. This means that going forward only Vault server version 1.19.x and greater will be officially tested against.

5.8.0 (March 12, 2026)

FEATURES:

• Add support for CF auth backend: vault_cf_auth_backend_config and vault_cf_auth_backend_role resources, and vault_cf_auth_login ephemeral resource for short-lived Vault tokens.
• Add support for SPIFFE secrets backend: (#2660)
• Add support for pki-external-ca secrets backend: (#2771)
• Add new KMIP resources vault_kmip_secret_ca_generated, vault_kmip_secret_ca_imported, vault_kmip_secret_listener, and add support for the ca field in vault_kmip_secret_role: (#2773)
• vault_secrets_sync_azure_destination: Add support for Workload Identity Federation (WIF) fields identity_token_audience, identity_token_audience_wo_version, identity_token_ttl, and identity_token_key to enable token-based authentication with Azure. Requires Vault 2.0.0+. (#2790)
• vault_secrets_sync_aws_destination: Add support for Workload Identity Federation (WIF) fields identity_token_audience, identity_token_ttl, and identity_token_key to enable token-based authentication with AWS. Requires Vault 2.0.0+. (#2792)
• vault_secrets_sync_gcp_destination: Add support for Workload Identity Federation (WIF) fields identity_token_audience_wo, identity_token_audience_wo_version, identity_token_ttl, identity_token_key_wo, identity_token_key_wo_version and service_account_email to enable token-based authentication with GCP. Requires Vault 2.0.0+. (#2798)
• New Ephemeral Resource: Add ephemeral resource for vault_generic_secret (#2735)
• New Ephemeral Resource: Add ephemeral resource vault_terraform_token, by @drewmullen (#2616)

IMPROVEMENTS:

• vault_managed_keys: Add support for GCP Cloud KMS managed keys with parameters: credentials, project, key_ring, region, crypto_key, crypto_key_version, and algorithm. (#2769)
• vault_okta_auth_backend: Add support for write-only field api_token_wo with version counters to prevent sensitive credentials from being stored in Terraform state. Deprecate organization and token and replace with org_name and api_token respectively in vault_okta_auth_backend resource. (#2736)
• vault_kubernetes_secret_backend_role: Add support for token_default_audiences field to configure default audiences for generated Kubernetes tokens. Requires Vault 1.15+. (#2722)
• vault_raft_snapshot_agent_config: Add support for azure_auth_mode and azure_client_id fields for Azure Managed Identity authentication (Vault Enterprise 1.18.0+), and autoload_enabled field for automatic snapshot restoration (Vault Enterprise 1.21.0+). (#2758)
• vault_ssh_secret_backend_role: Add support for fields (default_extensions_template, exclude_cidr_list, port) and improve handling of key-type-specific fields (default_extensions, default_extensions_template, exclude_cidr_list, port) to prevent drift. Fields that are not applicable to a role's key type (CA or OTP) are now conditionally set in state only when returned by Vault, preventing perpetual drift when users configure fields that Vault ignores. CA key type supports: default_extensions, default_extensions_template. OTP key type supports: port, exclude_cidr_list. (#2747)
• Added remove_roots_from_chain field to vault_pki_secret_backend_root_cert and resource_pki_secret_backend_sign. (#2760)
• vault_pki_secret_backend_root_cert: Add support for use_pss and key_usage fields to configure PSS signature scheme and X.509 key usage constraints for root CA certificates. Requires Vault 1.18.0+ and 1.19.2+ respectively. (#2754)
• vault_pki_secret_backend_root_sign_intermediate: Add version check for key_usage field to ensure compatibility with Vault 1.19.2+ for configuring X.509 key usage constraints on intermediate CA certificates. (#2754)
• provider/auth_jwt: Add support for distributed_claim_access_token field in the auth_login_jwt configuration block. (#2782)
• vault_database_secret: Add support for additional credential types (rsa_private_key, client_certificate, private_key, private_key_type) in the ephemeral resource to support all database credential types available in Vault's database secrets engine. (#2767)
• Updated dependencies:
  • github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 -> v1.21.0
  • github.com/aws/aws-sdk-go-v2 v1.32.5 -> v1.41.3
  • github.com/aws/aws-sdk-go-v2/service/iam v1.38.1 -> v1.53.5
  • github.com/aws/aws-sdk-go-v2/service/sts v1.33.1 -> v1.41.8
  • github.com/aws/smithy-go v1.22.1 -> v1.24.2
  • github.com/coreos/pkg v0.0.0-20230601102743-20bbbf26f4d8 -> v0.0.0-20240122114842-bbd7aa9bf6fb
  • github.com/go-viper/mapstructure/v2 v2.4.0 -> v2.5.0
  • github.com/googleapis/enterprise-certificate-proxy v0.3.12 -> v0.3.14
  • github.com/hashicorp/consul/api v1.33.0 -> v1.33.4
  • github.com/hashicorp/go-secure-stdlib/awsutil/v2 v2.1.1 -> v2.1.2
  • github.com/hashicorp/terraform-plugin-framework v1.16.1 -> v1.19.0
  • github.com/hashicorp/terraform-plugin-go v0.29.0 -> v0.31.0
  • github.com/hashicorp/terraform-plugin-mux v0.21.0 -> v0.23.0
  • github.com/hashicorp/terraform-plugin-sdk/v2 v2.38.1 -> v2.40.0
  • github.com/hashicorp/terraform-plugin-testing v1.13.3 -> v1.15.0
  • github.com/hashicorp/vault-plugin-auth-oci v0.20.0 -> v0.20.1
  • github.com/hashicorp/vault/sdk v0.22.0 -> v0.23.0
  • github.com/spiffe/go-spiffe/v2 v2.5.0 -> v2.6.0
  • golang.org/x/crypto v0.45.0 -> v0.49.0
  • golang.org/x/net v0.47.0 -> v0.52.0
  • golang.org/x/oauth2 v0.31.0 -> v0.36.0
  • golang.org/x/sync v0.19.0 -> v0.20.0
  • golang.org/x/sys v0.41.0 -> v0.42.0
  • golang.org/x/text v0.34.0 -> v0.35.0
  • golang.org/x/time v0.14.0 -> v0.15.0
  • golang.org/x/tools v0.41.0 -> v0.42.0
  • google.golang.org/api v0.251.0 -> v0.271.0
  • google.golang.org/genproto v0.0.0-20250603155806-513f23925822 -> v0.0.0-20260311181403-84a4fc48630c
  • google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 -> v0.0.0-20260226221140-a57be14db171
  • google.golang.org/genproto/googleapis/rpc v0.0.0-20260217215200-42d3e9bedb6d -> v0.0.0-20260226221140-a57be14db171
  • google.golang.org/grpc v1.79.1 -> v1.79.2
  • hashicorp/setup-terraform v3 -> v4
  • github.com/cloudflare/circl v1.6.1 -> v1.6.3
  • filippo.io/edwards25519 v1.1.0 -> v1.1.1
  • k8s.io/utils v0.0.0-20240102154912-e7106e64919e -> v0.0.0-20260210185600-b8788abfbbc2

BUGS:

• Clears the bindpass field in the state file after migrating to the write-only field in vault_ldap_auth_backend resource. (#2813)

5.7.0 (February 5, 2026)

FEATURES:

• New Ephemeral Resource: vault_approle_auth_backend_role_secret_id - Generate AppRole SecretIDs on-demand with automatic cleanup. Requires Terraform 1.10+.(#2745)
• New Ephemeral Resource: Add Kubernetes service account token ephemeral resource vault_kubernetes_service_account_token: (#2712)

IMPROVEMENTS:

• vault_kmip_secret_role: Add support for additional KMIP operation fields (operation_import, operation_query, operation_encrypt, operation_decrypt, operation_create_key_pair, operation_delete_attribute, operation_rng_retrieve, operation_mac, operation_signature_verify, operation_sign, operation_rng_seed, operation_modify_attribute, operation_mac_verify, operation_rekey_key_pair) to grant granular permissions for KMIP operations. (#2744)

• vault_saml_auth_backend: Add support for validate_assertion_signature and validate_response_signature parameters to control SAML signature validation (Vault 1.19+)

• vault_approle_auth_backend_login: Add write-only fields secret_id_wo and secret_id_wo_version to support ephemeral SecretID values without persisting them in state.(#2745)

• vault_password_policy: Add field entropy_source field to specify an override to the default source of entropy (randomness) used to generate the passwords.(#2753)

• vault_mfa_totp: Add support for max_validation_attempts field to configure the maximum number of consecutive failed validation attempts allowed. (#2751)

• vault_mongodbatlas_secret_backend: Add support for write-only private key fields (private_key_wo, private_key_wo_version) to prevent sensitive credentials from being stored in Terraform state. (#2741)

• vault_consul_secret_backend: Add support for write-only fields (token_wo, token_wo_version, client_key_wo, client_key_wo_version) to prevent sensitive credentials from being stored in Terraform state. (#2730)

• vault_azure_auth_backend_config: Add support for write-only client secret fields (client_secret_wo, client_secret_wo_version) to prevent sensitive credentials from being stored in Terraform state. (#2726)

• vault_azure_secret_backend: Add support for write-only client_secret_wo and client_secret_wo_version fields to configure the client secret without storing it in state. Requires Terraform 1.11+. (#2721)

• vault_aws_secret_backend: Add write-only secret_key_wo and secret_key_wo_version fields to allow configuring the AWS secret key without storing it in Terraform state (#2713)

• vault_gcp_auth_backend: Add write-only credential support via credentials_wo and credentials_wo_version fields (#2724)

• vault_ldap_auth_backend: Add write-only field support for bindpass via bindpass_wo and bindpass_wo_version attributes (#2716)

• vault_ldap_secret_backend: Add write-only field support for bindpass via bindpass_wo and bindpass_wo_version attributes (#2719)

• vault_aws_auth_backend_client: Add write-only field support for secret_key (secret_key_wo and secret_key_wo_version) to prevent sensitive AWS credentials from being stored in Terraform state. (#2717)

• vault_jwt_auth_backend: Add support for write-only oidc_client_secret_wo and oidc_client_secret_wo_version fields to prevent storing sensitive OIDC client secrets in Terraform state. (#2714)

• vault_cert_auth_backend_role: Add support for ocsp_max_retries and ocsp_this_update_max_age fields for OCSP configuration. Requires Vault 1.16+. (#2749)

• vault_kubernetes_auth_backend_config: Add support for write-only token_reviewer_jwt_wo field with token_reviewer_jwt_wo_version to prevent sensitive JWT token from being stored in Terraform state (#2715)

• vault_kubernetes_secret_backend: Add write-only fields service_account_jwt_wo and service_account_jwt_wo_version for managing service account JWT credentials without storing them in state.(#2720)

• vault_nomad_secret_backend: Add support for write-only fields token_wo and client_key_wo with version counters to prevent sensitive credentials from being stored in Terraform state. (#2729)

• Add support for fields: context,managed_key_name,managed_key_id in vault_transit_secret_backend_key resource. (#2743)

• vault_rabbitmq_secret_backend: Add support for write-only password_wo and password_wo_version fields to configure the password without storing it in state. Requires Terraform 1.11+. (#2733)

• vault_approle_auth_backend_role_secret_id: Add support for token_bound_cidrs parameter to specify blocks of IP addresses which can use the auth tokens generated by a SecretID. (#2718)

• vault_secrets_sync_gcp_destination: Add support for replication field (replication_locations; Vault 1.18+), networking allowlist fields (allowed_ipv4_addresses, allowed_ipv6_addresses, allowed_ports, disable_strict_networking; Vault 1.19+), and encryption fields (global_kms_key, locational_kms_keys; Vault 1.19+) in vault_secrets_sync_gcp_destination resource. (#2699)

• Add support for networking allowlist fields (allowed_ipv4_addresses, allowed_ipv6_addresses, allowed_ports, disable_strict_networking) in vault_secrets_sync_azure_destination resource. Requires Vault 1.19+. (#2702)

• vault_database_secret_backend_connection: Add support for MongoDB write_concern parameter and TLS parameters (tls_ca, tls_certificate_key) (#2678)

• Add support for username_template parameter in vault_database_secret_backend_connection and vault_database_secrets_mount resource for MongoDB Atlas(#2674)

• Add support for username_template parameter in vault_database_secret_backend_connection and vault_database_secrets_mount resources for HANADB connections: (#2671)

• Add support for networking allowlist fields (allowed_ipv4_addresses, allowed_ipv6_addresses, allowed_ports, disable_strict_networking) in vault_secrets_sync_vercel_destination resource. Requires Vault 1.19+. (#2681)

• Add support for configuration parameters (allowed_ipv4_addresses,allowed_ipv6_addresses,allowed_ports,disable_strict_networking,secrets_location,environment_name) in vault_secrets_sync_gh_destination resource. Requires Vault 1.18+ for secrets_location,environment_name.Requires Vault 1.19+ for allowed_ipv4_addresses,allowed_ipv6_addresses,allowed_ports,disable_strict_networking.(#2697).

• Add support for tls_server_name , local_datacenter, socket_keep_alive, consistency and username_template parameters for Cassandra in vault_database_secret_backend_connection resource. (#2677)

• vault_secrets_sync_aws_destination: Add support for networking configuration parameters allowed_ipv4_addresses, allowed_ipv6_addresses, allowed_ports, and disable_strict_networking to control outbound connections from Vault to AWS Secrets Manager. Requires Vault 1.19.0+.(#2698)

• Updated dependencies:

  • github.com/hashicorp/go-secure-stdlib/awsutil v0.3.0 -> v2.1.1

• Docs: fix heredoc example for LDAP dynamic role LDIFs ([#2728]#2728)

• Docs: Update example to use write-only attribute ([#2731]#2731)

• vault_database_secret_backend_connection: Add support for top-level plugin_version and password_policy fields to allow configuration at the resource level in addition to engine-specific blocks. (#2748)

• vault_database_secret_backend_connection: Add support for skip_static_role_import_rotation field to skip initial password rotation when creating static roles. This value is inherited by static roles that do not explicitly set skip_import_rotation. Requires Vault 1.19+ Enterprise. (#2748)

• vault_database_secret_backend_static_role: The skip_import_rotation field now correctly reads Vault's computed value into state. When not set in config, it inherits from the connection's skip_static_role_import_rotation setting. Requires Vault 1.19+ Enterprise. (#2748)

• vault_database_secret_mount: Added plugin_version,skip_static_role_import_rotation and password_policy fields to allow configuration at the resource level(#2748)

• Add support for local_secret_ids which may only be set at role creation. On updates the provider will send the original creation value to Vault to avoid unintentionally attempting to modify this immutable setting.The provider now surfaces Vault's native immutability error when an update attempts to change local_secret_ids.(#2723)

BUGS:

• provider/auth_login_aws: Fix issue where AWS authentication with IAM role assumption (aws_role_arn) was not working correctly due to incorrect credential handling (#2679)
• Fix plugin_name attribute not correctly use in vault_database_secret_backend_connection. (#2705)

5.6.0 (December 19, 2025)

FEATURES:

• Add support for self managed workflow for rootless static roles in Oracle Secret Engine: (#2661)
• Add AWS access creds ephemeral resource: (#2659)
• Add AWS static access credentials ephemeral resource.: (#2657)
• Add GCP ephemeral resources for OAuth2 access token and service account key: (#2655)
• Add Azure access credentials ephemeral resource: (#2654)

IMPROVEMENTS:

• Added fields related to namespace used to create a role in kubernetes auth method: (#2644)

BUGS:

• Fix LDAP auth tune block read failure caused by extra /tune segment in the API request path (#2676)

5.5.0 (Nov 19, 2025)

BEHAVIOR CHANGES: With v5.5.0, the default value for deny_null_bind in the vault_ldap_auth_backend resource has changed from false to true to match with the Vault API defaults. Configurations that do not explicitly set deny_null_bind will now have it set to true upon upgrade, and customers should verify that this change aligns with their intended LDAP authentication behavior. Furthermore, Customers should also consider upgrading to Vault Community Edition 1.21.1 and Vault Enterprise 1.21.1, 1.20.6, 1.19.12, and 1.16.28, which no longer allows Vault to perform unauthenticated or null binds against the LDAP server.

SECURITY:

• vault_ldap_auth_backend: Fix incorrect deny_null_bind default. Set deny_null_bind to true if not provided in configuration (#2622) (CVE-13357,HCSEC-2025-33)

FEATURES:

• Add support for alias_metadata field in auth resources (#2547)
• Add support for not_before_duration field in vault_pki_secret_backend_root_cert (#2664)

IMPROVEMENTS:

• Updated dependencies:
  • golang.org/x/crypto v0.41.0 -> v0.45.0
  • golang.org/x/net v0.43.0 -> v0.47.0
  • golang.org/x/mod v0.26.0 -> v0.29.0
  • golang.org/x/sync v0.16.0 -> v0.18.0
  • golang.org/x/sys v0.35.0 -> v0.38.0
  • golang.org/x/text v0.28.0 -> v0.31.0
  • golang.org/x/tools v0.35.0 -> v0.38.0

5.4.0 (Nov 3, 2025)

BEHAVIOR CHANGES: Please refer to the upgrade topics in the guide for details on all behavior changes.

FEATURES:

• Add support for Azure Static Secrets: (#2635)
• Add support for write-only token argument in vault_terraform_cloud_secret_backend resource (#2603)
• New parameters for vault_terraform_cloud_secret_role to support multi-team tokens, by @drewmullen (#2498)
• Add support for tune in vault_saml_auth_backend resource (#2566)
• Add support for tune in vault_ldap_auth_backend and vault_okta_auth_backend resources (#2602)
• Add support for allowed_sts_header_values parameter in vault_aws_auth_backend_client resource to specify additional headers allowed in STS requests
• New parameters for vault_gcp_secret_backend to support ttl and max_ttl, by @vijayavelsekar (#2627)
• Add support for request_timeout, dereference_aliases,enable_samaccountname_login and anonymous_group_search parameters in vault_ldap_auth_backend resource.(#2634)
• Add support for max_retries parameter in vault_aws_secret_backend resource. (#2623)
• Add support for iam_alias, iam_metadata, gce_alias and gce_metadata fields in vault_gcp_auth_backend resource (#2636)
• Add support for role_id field in vault_gcp_auth_backend_role resource (#2636)
• Add retry configuration fields (max_retries, retry_delay, max_retry_delay) to vault_azure_auth_backend_config resource for Azure API request resilience (#2629)
• Add new resources vault_spiffe_auth_backend_config and vault_spiffe_auth_backend_role (#2620)
• Add support for mfa_serial_number parameter in vault_aws_secret_backend_role resource. (#2637)
• Add support for persist_appparameters in vault_azure_secret_backend_role resource. (#2642)

BUGS:

• Fix pki config resources to allow unsetting of fields (to empty fields) (#2558)
• Fix tune auth mounts to allow unsetting of fields (setting fields to empty values) (#2605)
• Fix vault_pki_secret_backend_crl_config resource to allow disabling flags previously set to true (#2615)
• Fix the tune block issue where it always updates unless field values match Vault server defaults
  • vault_jwt_auth_backend resource (#2560)
  • vault_github_auth_backend and vault_auth_backend resources (#2565)
  • vault_saml_auth_backend resource (#2566)
  • vault_gcp_auth_backend and vault_oci_auth_backend resources (#2596)

5.3.0 (Sep 4, 2025)

FEATURES:

• Add support for password phrases via the credential_type field in the vault_ldap_secret_backend resource (#2548)

IMPROVEMENTS:

• build(deps): bump the gomod-backward-compatible group with 5 updates: GH-2583
• Move to the standard CRT release workflow and tooling: GH-2582

BUGS:

• Fix azure_secret_backend_role to prevent persistent diff for null value on max_ttl and explicit_max_ttl argument (#2581)

5.2.1 (Aug 19, 2025)

BUGS:

• Fix a failure to initialize the provider due to incompatible dependencies (#2575)
• Fix auth_login_gcp field constraint on field credentials service_account
• Fix auth_login_azure field constraint on field vmss_name tenant_id client_id scope
• Fix auth_login_kerberos field constraint on fields username service realm krb5conf_path keytab_path disable_fast_negotiation remove_instance_name
• Fix auth_login_userpass field constraint on field password_file
• Fix auth_login field constraint on field use_root_namespace
• Fix to allow Snowflake keypair auth with Vault 1.16+ (#2575)

5.2.0 (Aug 18, 2025)

FEATURES:

• Add support for jwks_pairs in vault_jwt_auth_backend resource. Requires Vault 1.16+ (#2523)
• Add support for root_password_ttl in vault_azure_secret_backend resource. Requires Vault 1.15+ (#2529)
• Add support for managed key parameters in the SSH CA config endpoint (#2480)
• Add new resources vault_oci_auth_backend and vault_oci_auth_backend_role to manage OCI auth backend and roles. (#1761)
• Add support for log_level in vault_pki_secret_backend_config_scep resource. Requires Vault 1.20.1+ (#2525)

IMPROVEMENTS:

• Bump Go version to 1.24.6: (#2550)
• Ensure all resources that use custom mounts support all mount parameters. (#2332)
• Updated dependencies:
  • golang.org/x/oauth2 v0.24.0 -> v0.30.0
  • github.com/cloudflare/circl v1.3.7 -> v1.6.1
  • github.com/go-jose/go-jose/v3 v3.0.3 -> v3.0.4
  • github.com/go-jose/go-jose/v4 v4.0.4 -> v4.1.2
  • github.com/golang-jwt/jwt/v5 v5.2.2 -> v5.3.0
  • cloud.google.com/go/iam v1.2.2 -> v1.5.2
  • cloud.google.com/go/compute/metadata v0.6.0 -> v0.8.0
  • github.com/Azure/azure-sdk-for-go/sdk/azcore v1.11.1 -> v1.18.2
  • github.com/aws/aws-sdk-go v1.55.6 -> v1.55.8
  • github.com/go-sql-driver/mysql v1.8.1 -> v1.9.3
  • github.com/hashicorp/consul/api v1.27.0 -> v1.32.1
  • github.com/hashicorp/terraform-plugin-framework v1.14.1 -> 1.15.1
  • github.com/hashicorp/terraform-plugin-framework-validators v0.17.0 -> v0.18.0
  • hashicorp/ghaction-terraform-provider-release v4.0.1 -> v5.0.0

BUGS:

• Fix panic when reading the vault_gcp_secret_backend resource. (#2549)
• Fix regression where VAULT_NAMESPACE was not being honored, causing child namespaces to be created in the root namespace instead (#2540)

5.1.0 (Jul 9, 2025)

FEATURES:

• Add support for key_usage to vault_pki_secret_backend_root_sign_intermediate (#2421)

• Add private_key_wo and private_key_wo_version fields to Snowflake DB secrets engine config (#2508)

• Add support for group_by and secondary_rate on resource vault_quota_rate_limit. Requires Vault Enterprise 1.20.0+ (#2476)

• Add support for Transit CMAC endpoint (#2488)

• Add new resource vault_scep_auth_backend_role to manage roles in a SCEP auth backend. #2479.

• Add new datasource and resource vault_pki_secret_backend_config_scep for PKI SCEP configuration. #2487.

5.0.0 (May 21, 2025)

Important: 5.X multiplexes the Vault provider to use the Terraform Plugin Framework, upgrades to Terraform 1.11.x, and adds support for Ephemeral Resources and Write-Only attributes. Please refer to the Terraform Vault Provider 5.0.0 Upgrade Guide for specific details around the changes.

VERSION COMPATIBILITY: 5.X is officially supported and tested against Vault server versions >= 1.15.x. 5.X supports Terraform versions >= 1.11.x in order to support ephemeral resources and write-only attributes.

BREAKING CHANGES: Please refer to the upgrade topics in the guide for details on all breaking changes.

FEATURES:

• Add new ephemeral resources/attributes (#2457):
  • Add new ephemeral resource vault_kv_secret_v2
  • Add new ephemeral resource vault_database_secret
  • Add new write-only attribute data_json_wo (along with data_json_wo_version) to resource vault_kv_secret_v2
  • Add new write-only attribute credentials_wo, (along with credentials_wo_version) to resource vault_gcp_secret_backend
  • Add new write-only attribute password_wo, (along with password_wo_version to resource) vault_database_secret_backend_connection

BUGS:

• fix vault_policy_document data source regression to allow empty capabilities (#2466)

4.8.0 (Apr 23, 2025)

FEATURES:

• Add support for recursive search in data_vault_namespaces #2408
• Add support for subscribe_event_types in data_source_policy_document #2445
• Add support for explicit_max_ttl in vault_azure_secret_backend_role resources. Requires Vault 1.18+ (#2438).

BUGS:

• Fix credential validation failures in vault_azure_access_credentials data source caused by Azure RBAC propagation delays using azure_groups #2437

4.7.0 (Mar 12, 2025)

FEATURES:

• Update vault_pki_secret_backend_root_cert and vault_pki_secret_backend_root_sign_intermediate to support the new fields for the name constraints extension. Requires Vault 1.19+ (#2396).
• Update vault_pki_secret_backend_issuer resource with the new issuer configuration fields to control certificate verification. Requires Vault Enterprise 1.19+ (#2400).
• Add support for certificate revocation with revoke_with_key in vault_pki_secret_backend_cert (#2242)
• Add support for signature_bits field to vault_pki_secret_backend_role, vault_pki_secret_backend_root_cert, vault_pki_secret_backend_root_sign_intermediate and vault_pki_secret_backend_intermediate_cert_request ([#2401])(#2401)
• Add support for key_usage and serial_number to vault_pki_secret_backend_intermediate_cert_request ([#2404])(#2404)
• Add support for skip_import_rotation in vault_database_secret_backend_static_role. Requires Vault Enterprise 1.18.5+ (#2386).
• Add support for not_after in vault_pki_secret_backend_cert, vault_pki_secret_backend_role, vault_pki_secret_backend_root_cert, vault_pki_secret_backend_root_sign_intermediate, and vault_pki_secret_backend_sign (#2385).
• Update vault_pki_secret_backend_config_acme to support the max_ttl field. #2411
• Add new data source vault_ssh_secret_backend_sign. (#2409)
• Add support for disabled_validations in vault_pki_secret_backend_config_cmpv2 #2412
• Add credential_type and credential_config to database_secret_backend_static_role to support features like rsa keys for Snowflake DB engines with static roles #2384
• Add support for missing parameters to vault_pki_secret_backend_root_sign_intermediate: not_before_duration, skid and use_pss #2417
• Add support for use_pss, no_store_metadata, and serial_number_source to vault_pki_secret_backend_role #2420
• Add support for Transit sign and verify endpoints (#2418)
• Add new data source vault_pki_secret_backend_cert_metadata and support for cert_metadata in vault_pki_secret_backend_cert and vault_pki_secret_backend_sign #2422
• Add support for max_crl_entries in vault_pki_secret_backend_crl_config #2423
• Add support for new Automated Root Rotation parameters in several plugins. Requires Vault Enterprise 1.19.0+.
  • AWS Auth/Secrets (#2414)
  • Azure Auth/Secrets (#2428)
  • DB Secrets (#2414).
  • LDAP Auth/Secrets (#2428)
  • GCP Auth/Secrets (#2427)
• Add new resource vault_pki_secret_backend_config_auto_tidy to set PKI automatic tidy configuration #1934
• Add support for cross-account management of static roles in AWS Secrets: (#2413)

BUGS:

• Do not panic on Vault PKI roles without the cn_validations field: (#2398)

IMPROVEMENTS:

• Update pki_secret_backend_crl_config to be more resilent to unknown response fields (#2429)

4.6.0 (Jan 15, 2025)

FEATURES:

• Update vault_kubernetes_auth_backend_role to support bound_service_account_namespace_selector, enabling the use of namespace selectors for allowing Kubernetes namespaces to access roles. (#2379)
• Update vault_database_secret_backend_connectionto support password_authentication for PostgreSQL, allowing to encrypt password before being passed to PostgreSQL (#2371)
• Add support for external_id field for the vault_aws_auth_backend_sts_role resource (#2370)
• Add support for ACME configuration with the vault_pki_secret_backend_config_acme resource. Requires Vault 1.14+ (#2157).
• Update vault_pki_secret_backend_role to support the cn_validations role field (#1820).
• Add new resource vault_pki_secret_backend_acme_eab to manage PKI ACME external account binding tokens. Requires Vault 1.14+. (#2367)
• Add new data source and resource vault_pki_secret_backend_config_cmpv2. Requires Vault 1.18+. Available only for Vault Enterprise (#2330)

IMPROVEMENTS:

• Support the event subscribe policy capability for vault_policy_document data source (#2293)

4.5.0 (Nov 19, 2024)

FEATURES:

• Update vault_database_secret_backend_connection to support inline TLS config for PostgreSQL (#2339)
• Update vault_database_secret_backend_connection to support skip_verification config for Cassandra (#2346)
• Update vault_approle_auth_backend_role_secret_id to support num_uses and ttl fields (#2345)
• Add support for allow_empty_principals field for the vault_ssh_secret_backend_role resource (#2354)
• Update vault_gcp_secret_impersonated_account to support setting ttl (#2318)
• Add support for connection_timeout field for the vault_ldap_auth_backend resource (#2358)
• Add support for Rootless Configuration for Static Roles to Postgres DB (#2341)
• Add support for use_annotations_as_alias_metadata field for the vault_kubernetes_auth_backend_config resource (#2226)

BUGS:

• Remove consul secret backend role from state if not found on vault: (#2321)

4.4.0 (Aug 7, 2024)

FEATURES:

• Update vault_aws_secret_backend_role to support setting session_tags and external_id (#2290)

BUGS:

• fix vault_ssh_secret_backend_ca where a schema change forced the resource to be replaced (#2308)
• fix a bug where a read on non-existent auth or secret mount resulted in an error that prevented the provider from completing successfully (#2289)

4.3.0 (Jun 17, 2024)

FEATURES:

• Add support for iam_tags in vault_aws_secret_backend_role (#2231).
• Add support for inheritable on vault_quota_rate_limit and vault_quota_lease_count. Requires Vault 1.15+.: (#2133).
• Add support for new WIF fields in vault_gcp_secret_backend. Requires Vault 1.17+. Available only for Vault Enterprise (#2249).
• Add support for new WIF fields in vault_azure_secret_backend. Requires Vault 1.17+. Available only for Vault Enterprise (#2250)
• Add support for new WIF fields in vault_aws_auth_backend_client. Requires Vault 1.17+. Available only for Vault Enterprise (#2243).
• Add support for new WIF fields in vault_gcp_auth_backend (#2256)
• Add support for new WIF fields in vault_azure_auth_backend_config. Requires Vault 1.17+. Available only for Vault Enterprise (#2254).
• Add new data source and resource vault_pki_secret_backend_config_est. Requires Vault 1.16+. Available only for Vault Enterprise (#2246)
• Support missing token parameters on vault_okta_auth_backend resource: (#2210)
• Add support for max_retries in vault_aws_auth_backend_client: (#2270)
• Add new resources vault_plugin and vault_plugin_pinned_version: (#2159)
• Add key_type and key_bits to vault_ssh_secret_backend_ca: (#1454)

IMPROVEMENTS:

• return a useful error when delete fails for the vault_jwt_auth_backend_role resource: (#2232) BUGS:
• Remove dependency on github.com/hashicorp/vault package: (#2251)
• Add missing custom_tags and secret_name_template fields to vault_secrets_sync_azure_destination resource (#2247)
• Fix handling of 0 value within field max_path_length in vault_pki_secret_backend_root_cert and vault_pki_secret_backend_root_sign_intermediate resources (#2253)

4.2.0 (Mar 27, 2024)

FEATURES:

• Add granularity to Secrets Sync destination resources. Requires Vault 1.16+ Enterprise. (#2202)
• Add support for allowed_kubernetes_namespace_selector in vault_kubernetes_secret_backend_role (#2180).
• Add new data source vault_namespace. Requires Vault Enterprise: (#2208).
• Add new data source vault_namespaces. Requires Vault Enterprise: (#2212).

IMPROVEMENTS:

• Enable Secrets Sync Association resource to track sync status across all subkeys of a secret. Requires Vault 1.16+ Enterprise. (#2202)

BUGS:

• fix vault_approle_auth_backend_role_secret_id regression to handle 404 errors (#2204)
• fix vault_kv_secret and vault_kv_secret_v2 failure to update secret data modified outside terraform (#2207)
• fix vault_kv_secret_v2 failing on imported resource when data_json should be ignored (#2207)

4.1.0 (Mar 20, 2024)

CHANGES TO VAULT POLICY REQUIREMENTS:

• Important: This release requires read policies to be set at the path level for mount metadata. The v4.0.0 release required read permissions at sys/auth/:path which was a sudo endpoint. The v4.1.0 release changed that to instead require permissions at the sys/mounts/auth/:path level and sudo is no longer required. Please refer to the details in the Terraform Vault Provider 4.0.0 Upgrade Guide.

FEATURES:

• Add new resource vault_config_ui_custom_message. Requires Vault 1.16+ Enterprise: (#2154).

IMPROVEMENTS:

• do not require sudo permissions for auth read operations (#2198)

BUGS:

• fix vault_azure_access_credentials to default to Azure Public Cloud (#2190)

4.0.0 (Mar 13, 2024)

Important: This release requires read policies to be set at the path level for mount metadata. For example, instead of permissions at sys/auth you must set permissions at the sys/auth/:path level. Please refer to the details in the Terraform Vault Provider 4.0.0 Upgrade Guide.

FEATURES:

• Add support for PKI Secrets Engine cluster configuration with the vault_pki_secret_backend_config_cluster resource. Requires Vault 1.13+ (#1949).
• Add support to enable_templating in vault_pki_secret_backend_config_urls (#2147).
• Add support for skip_import_rotation and skip_static_role_import_rotation in ldap_secret_backend_static_role and ldap_secret_backend respectively. Requires Vault 1.16+ (#2128).
• Improve logging to track full API exchanges between the provider and Vault (#2139)
• Add new vault_plugin and vault_plugin_pinned_version resources for managing external plugins (#2159)

IMPROVEMENTS:

• Improve performance of READ operations across many resources: (#2145), (#2152)
• Add the metadata version in returned values for vault_kv_secret_v2 data source: (#2095)
• Add new secret sync destination fields: (#2150)

BUGS:

• Handle graceful destruction of resources when approle is deleted out-of-band (#2142).
• Ensure errors are returned on read operations for vault_ldap_secret_backend_static_role, vault_ldap_secret_backend_library_set, and vault_ldap_secret_backend_static_role (#2156).
• Ensure proper use of issuer endpoints for root sign intermediate resource: (#2160)
• Fix issuer data overwrites on updates: (#2186)

3.25.0 (Feb 14, 2024)

FEATURES:

• Add destination and association resources to support Secrets Sync. Requires Vault 1.16+ (#2098).
• Add support for configuration of plugin WIF to the AWS Secret Backend. Requires Vault 1.16+ (#2138).
• Add support for Oracle database plugin configuration options split_statements and disconnect_sessions: (#2085)

IMPROVEMENTS:

• Add an API client lock to the vault_identity_group_alias resource: (#2140)

3.24.0 (Jan 17, 2024)

FEATURES:

• Add support for ext_key_usage_oids in vault_pki_secret_backend_role (#2108)
• Adds support to vault_gcp_auth_backend for common backend tune parameters (#1997).
• Adds support to vault_azure_secret_backend_role for sign_in_audience and tags. Requires Vault 1.16+. (#2101).

BUGS:

• fix vault_kv_secret_v2 drift when "data" is in secret name/path (#2104)
• fix vault_database_secret_backend_connection: allow mysql_rds,mysql_aurora,mysql_legacy options of vault_database_secret_backend_connection terraform resource to allow specifying tls_ca and tls_certificate_key (#2106)
• Fix ignored description updates for aws_secret_backend resource (#2057)

IMPROVEMENTS:

• Updated dependencies (#2129):
  • cloud.google.com/go/iam v1.1.2 -> v1.1.5
  • github.com/Azure/azure-sdk-for-go/sdk/azcore v1.8.0 -> v1.9.1
  • github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.4.0 -> v1.5.0
  • github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.1.1 -> v1.2.0
  • github.com/aws/aws-sdk-go v1.45.24 -> v1.49.22
  • github.com/google/uuid v1.3.1 -> v1.5.0
  • github.com/hashicorp/go-hclog v1.5.0 -> v1.6.2
  • github.com/hashicorp/go-retryablehttp v0.7.4 -> v0.7.5
  • github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7 -> v0.1.8
  • github.com/hashicorp/terraform-plugin-sdk/v2 v2.29.0 -> v2.31.0
  • github.com/hashicorp/vault-plugin-auth-jwt v0.17.0 -> v0.18.0
  • github.com/hashicorp/vault/sdk v0.10.0 -> v0.10.2
  • golang.org/x/crypto v0.14.0 -> v0.18.0
  • golang.org/x/net v0.15.0 -> v0.20.0
  • golang.org/x/oauth2 v0.12.0 -> v0.16.0
  • google.golang.org/api v0.144.0 -> v0.156.0
  • google.golang.org/genproto v0.0.0-20231002182017-d307bd883b97 -> v0.0.0-20240116215550-a9fa1716bcac
  • k8s.io/utils v0.0.0-20230726121419-3b25d923346b -> v0.0.0-20240102154912-e7106e64919e

3.23.0 (Nov 15, 2023)

FEATURES:

• Add support for lazily authenticating to Vault: (#2049)

BUGS:

• Fix vault_identity_group loses externally managed policies on updates when external_policies = true (#2084)
• Fix regression in vault_azure_access_credentials where we returned prematurely on 401 responses:(#2086)

3.22.0 (Nov 1, 2023)

FEATURES:

• Add support for configuring SAML Auth resources (#2053)
• Add support for custom_metadata on vault_namespace: (#2033)
• Add support for OCSP* role fields for the cert auth resource: (#2056)
• Add field set_namespace_from_token to Provider configuration (#2070)
• Support authenticating to the root namespace from within an auth_login*: (#2066)

BUGS:

• Fix panic when reading client_secret from a public oidc client (#2048)
• Fix API request missing roles field for mongodbatlas_secret_role resource (#2047)
• Fix bug when updating vault_azure_secret_backend_role: (#2063)
• Fix audience string ordering for auth_login_gcp causing GCE auth to fail (#2064)

IMPROVEMENTS:

• Updated dependencies: (#2038)
  • github.com/aws/aws-sdk-go v1.44.106 -> v1.45.24
• Updated dependencies: (#2050)
  • github.com/Azure/azure-sdk-for-go/sdk/azcore v0.22.0 -> v1.8.0
  • github.com/Azure/azure-sdk-for-go/sdk/azidentity v0.13.2 -> v1.4.0
  • github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v0.3.1 -> v1.1.1
  • github.com/Azure/go-autorest/autorest v0.11.29 removed

3.21.0 (Oct 9, 2023)

FEATURES:

• Add GCP CloudSQL support to Postgres, MySQL DB engines: (#2012)
• Add support for DB Adv TTL Mgmt: (#2011)
• Add support for setting not_before_duration argument on vault_ssh_secret_backend_role: (#2019)
• Add support for hmac key type and key_size to vault_transit_secret_backend_key: (#2034)
• Add support for roles to both rate limit and lease count quotas: (#1994)
• Add allowed_email_sans field to write and update functions of vault_cert_auth_backend_role: (#1140)
• Add support for local parameter in aws secret engine: (#2013)

BUGS:

• Fix duplicate timestamp and incorrect level messages: (#2031)
• Fix panic when setting key_usage to an array of empty string and enable it to unset the key usage constraints: (#2036)
• Add state migrator for external_member_group_ids in Identity Group (#2043)
• Fix drift detection for the kv-v2 secrets resource when disable_read is enabled: (#2039)
• Add state migrator in secrets/auth backends for disable_remount parameter (#2037)
• Fix failure when auth_login is specified and vault token is picked up from the runtime/execution environment: (#2029)
• Remove logging of password key: (#2044)

IMPROVEMENTS:

• Oracle DB engine enablement on HCP Vault: (#2006)
• Ensure sensitive values are masked in vault_approle_auth_backend_login plan output (#2008)
• Updated dependencies: (#2038)
  • cloud.google.com/go/compute v1.10.0 removed
  • cloud.google.com/go/compute/metadata v0.2.3 added
  • cloud.google.com/go/iam v0.3.0 -> v1.1.2
  • github.com/Azure/go-autorest/autorest v0.11.24 -> v0.11.29
  • github.com/cenkalti/backoff/v4 v4.1.2 -> v4.2.1
  • github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f -> v0.0.0-20230601102743-20bbbf26f4d8
  • github.com/denisenkom/go-mssqldb v0.12.0 -> v0.12.3
  • github.com/go-sql-driver/mysql v1.6.0 -> v1.7.1
  • github.com/google/uuid v1.3.0 -> v1.3.1
  • github.com/gosimple/slug v1.11.0 -> v1.13.1
  • github.com/hashicorp/go-cty v1.4.1-0.20200414143053-d3edf31b6320 -> v1.4.1-0.20200723130312-85980079f637
  • github.com/hashicorp/go-retryablehttp v0.7.1 -> v0.7.4
  • github.com/hashicorp/terraform-plugin-sdk/v2 v2.16.0 -> v2.29.0
  • github.com/hashicorp/vault-plugin-auth-jwt v0.13.2-0.20221012184020-28cc68ee722b -> v0.17.0
  • github.com/hashicorp/vault-plugin-auth-kerberos v0.8.0 -> v0.10.1
  • github.com/hashicorp/vault-plugin-auth-oci v0.13.0-pre -> v0.14.2
  • github.com/hashicorp/vault/api v1.9.3-0.20230628215639-3ca33976762c -> v1.10.0
  • github.com/hashicorp/vault/sdk v0.6.0 -> v0.10.0
  • github.com/jcmturner/gokrb5/v8 v8.4.2 -> v8.4.4
  • golang.org/x/crypto v0.6.0 -> v0.14.0
  • golang.org/x/net v0.7.0 -> v0.15.0
  • golang.org/x/oauth2 v0.0.0-20221006150949-b44042a4b9c1 -> v0.12.0
  • google.golang.org/api v0.98.0 -> v0.144.0
  • google.golang.org/genproto v0.0.0-20221010155953-15ba04fc1c0e -> v0.0.0-20231002182017-d307bd883b97
  • k8s.io/utils v0.0.0-20220210201930-3a6ce19ff2f9 -> v0.0.0-20230726121419-3b25d923346b

3.20.1 (Sep 13, 2023)

IMPROVEMENTS:

• Update dependencies (#1958)
  • github.com/hashicorp/go-secure-stdlib/awsutil v0.1.6 -> v0.2.3
• Add local variable to aws_secret_backend resource, in order to mark the mount as non - replicated

BUGS:

• Update k8s-auth config to support unsetting the K8s CA Cert: (#2005)

3.20.0 (Aug 30, 2023)

FEATURES:

• Add support for setting permanently_delete argument on resource_azure_secret_backend_role: (#1958)
• Add use_sts_region_from_client to AWS Auth Config: (#1963)
• Add accessor attribute for vault_gcp_auth_backend resource: (#1980)

BUGS:

• Fixes a panic that can occur when Vault lookup-self API returns nil token info (#1978)
• Resolve TF state for PKI Multi-Issuer workflows: (#1973)
• Check the seal-status on the default namespace: (#1967)

3.19.0 (Aug 2, 2023)

FEATURES:

• Add support for User ID configuration for PKI Secrets Engine: (#1936)
• Add support for use_sts_region_from_client in vault_aws_auth_backend_client available in Vault v1.15.0+: (#1963)

BUGS:

• auth/aws: enable namespace support for AWS backend config identity: (#1961)
• Retry Write on kv-v2 config: (#1955)
• Update vault_identity_entity to exclude policies from Vault request if external_policies is true: (#1950)
• Bump Go version to fix macOS resolver issue: (#1941)

3.18.0 (Jul 12, 2023)

FEATURES:

• Add support to set default issuers configuration for PKI Secrets Engine: (#1937)
• Add new auth_login_token_file method: (#1928)
• Update HTTP transport wrapper to support TLSConfig cloning: (#1926)

BUGS:

• secrets/pki: fix server_flag being ignored: (#1933)

3.17.0 (June 21, 2023)

FEATURES:

• Add support for multi-issuer functionality to PKI: (#1910)
• Add x509 support to database roles: (#1901)
• Add AWS Static Roles support: (#1877)
• Add support for max_page_size in the vault_ldap_auth_backend: (#1878)

BUGS:

• Fix DB Engine password overwrite for remaining databases: (#1912)

3.16.0 (June 7, 2023)

FEATURES:

• Add support for LDAP secrets engine: (#1859)
• Add new data source vault_auth_backends: (#1827)
• Support allowed_domains_template on ssh_secret_backend_role. Fixes #1675: (#1676)

IMPROVEMENTS:

• Add support for retrying kv-v2 secret data writes: (#1887)
• Add back support for deriving the provider namespace from the Vault token's: (#1841)

BUGS:

• Fix DB engine password overwrite: (#1876)
• azure/auth: fix config path parsing: (#1871)

3.15.2 (May 3, 2023)

BUGS:

• Revert #1830 which introduced a unexpected breaking change in the way authentication is done within a namespace: (#1840)

3.15.1 (May 3, 2023)

BUGS:

• Ensure that the auth_login honours the provider's namespace: (#1830)

3.15.0 (April 17, 2023)

FEATURES:

• Add support for MongoDB Atlas Secrets engine: (#1816)

BUGS:

• Fix panic while importing namespaces: (#1818)
• Avoid writing empty strings to Vault when creating PKCS managed keys: (#1803)
• Fix possible panic with autopilot import: (#1801)
• Ensure that the qr_size can be properly configured for MFA TOTP: (#1750)

3.14.0 (March 15, 2023)

FEATURES:

• Add PKI Unified CRL parameters: (#1789)
• Add resource for GCP impersonated account support: (#1745)

BUGS:

• Add nil check for IsEnterpriseSupported util: (#1787)
• Fix KV incorrect metadata path for prefixed mounts: (#1781)

3.13.0 (February 17, 2023)

FEATURES:

• Add new resource for AWS Auth Backend config identity: (#1724)
• Support default_user_template field on vault_ssh_secret_backend_role: (#1725)

IMPROVEMENTS:

• Secrets from the AD, AWS, Azure & Nomad Secrets Engines are sensitive: (#1726)
• Add enterprise check for new Raft Autopilot parameter: (#1721)

BUGS:

• Fix KVV2 datasource upon retrieval of soft deleted secrets: (#1760)
• Fix issue where removing optional fields in database secrets backend connection resource did not reset the fields to their default values: (#1737)
• Fix construction of metadata path in KV V2 resource: (#1722)

3.12.0 (January 5, 2023)

IMPROVEMENTS:

• Add support for importing the PKI CRL config: (#1710)
• Ensure duplicate alias names are handled properly in LookupEntityAlias: (#1708)
• Add support for a Raft Autopilot State datasource: (#1705)
• Add support for adding metadata to a KV V2 Secret: (#1687)
• Set AWS credentials sensitive: (#1678)
• Set ForceNew on the path field of namespaces: (#1713)

BUGS:

• Fix removed MSGraph param in Azure Secrets: (#1682)
• Fix KV V2 data source when specifying a version: (#1677)
• Ensure that vault_kv_secret_backend_v2 mount is correctly imported: (#1701)

3.11.0 (November 16, 2022)

IMPROVEMENTS:

• Add Basic Constraints attribute to vault_pki_secret_backend_intermediate_cert_request: (#1661)
• Add Redis database secrets engine support: (#1659)
• Add support for setting deletion_allowed on a transformation: (#1650)

BUGS:

• Fix panic while importing MFA Duo resource: (#1669)
• Fix GCP auth with service account credentials: (#1648)

3.10.0 (October 26, 2022)

IMPROVEMENTS:

• Add support for externally managed Group Member IDs to Vault Identity Group: (#1630)
• Support configuring vault version handling: (#1646)

BUGS:

• Ensure that namespaced github auth mounts are destroyed: (#1637)
• Ensure all AuthLogin instances are validated on call to Login(): (#1631)

3.9.1 (October 06, 2022)

BUGS:

• Use the correct AWS login headers within auth_generic: (#1625)
• Fix resource recreation following out-of-band changes in Vault: (#1567)

3.9.0 (October 05, 2022)

IMPROVEMENTS:

• Add first-class Azure login support: (#1617)
• Add first-class OIDC andJWT login support: (#1615)
• Add first-class OCI login support: (#1614)
• Add first-class Radius login support: (#1609)
• Add first-class Kerberos login support: (#1608)
• Add first-class GCP login support: (#1607)
• Add first-class TLS certificates login support: (#1605)
• Add first-class auth login config support for AWS: (#1599) (#1618)
• Add support for login MFA resources: (#1620)
• Add Managed Keys support: (#1508)
• Add support to perform semantic version comparisons against Vault's server version: (#1426)
• Add Mount Migration support to all secrets/auth backends: (#1594)
• Use new semantic version checking for Consul secrets backend logic: (#1593)
• Docs: Fix vault_kv_secret_backend_v2 delete_version_after example: (#1602)
• Support creating Azure secret backend role by specifying the role_id: (#1573)
• Add Redis ElastiCache database secrets engine support: (#1596)
• vault_pki_secret_backend_cert: Report when renewal is pending: (#1597)
• Accept data source values in the token field for Consul secrets backend: (#1600)

BUGS:

• Fix erroneous persistent diff in the vault_token resource.: (#1622)
• Fix data_source_azure_access_credentials US Government Cloud: (#1590)
• Add kv-v2 write retry: (#1579)

3.8.2 (August 11, 2022)

IMPROVEMENTS:

• Add bootstrap field to Consul backend resources: (#1571)
• Add data field to KV data sources: (#1577)

BUGS:

• fix: remove unnecessary nesting of secret data for KV-V1 secrets: (#1570)

NOTES:

• vault_kv_secret no longer stores secrets in Vault under a nested data object. In versions 3.8.1 and below, the kv resource inadvertently nested the value under data. To remedy this please update any consumers of this KV and run a terraform apply to properly set the value.

3.8.1 (August 04, 2022)

IMPROVEMENTS:

• docs: Fix broken provider.namespace links: (#1562)
• docs: Add Azure example for r/raft_snapshot_agent_config: (#1534)
• docs: Document namespaced resource import: (#1561)
• docs: Add more visible note that d/aws_access_credentials cannot be renewed: (#1464)

BUGS:

• fix: Persist namespace to state on resource import: (#1563)
• fix: Update all transform resources with namespace support: (#1558)
• fix: Make password_policy conflict with the formatter field: (#1557)
• fix: Correct typo in r/pki_secret_backend_root_cert description: (#1511)

3.8.0 (July 26, 2022)

FEATURES:

• Adds support for Kubernetes secrets engine: (#1515)
• PKI: Add support for CPS URL in custom policy identifiers: (#1495)

IMPROVEMENTS:

• Fix Import for OIDC Scope resource: (#1548)
• Update entity alias creation to use entity lookup api: (#1517) (#1552)
• Add support for Consul secrets engine enhancements: (#1518)
• auth/gcp: adds custom_endpoint parameter to backend config: (#1482)
• auth/jwt: adds user_claim_json_pointer and max_age to roles: (#1478)

BUGS:

• Support updating backend descriptions: (#1550) (#1543)
• Properly set the base64_pem in Vault for Couchbase: (#1545)
• Fix bug where some rabbitmq config changes trigger erroneous mount recreation: (#1542)
• Update *kv_secrets* resources to support namespaces: (#1529)
• Do not validate JSON on OIDC scope template: (#1547)

3.7.0 (June 15, 2022)

FEATURES:

• Support setting namespace by resource (#1305) (#1479)
• Add dedicated KV (v1/v2) secret engine resources, and data sources, supersedes vault_generic_secret (#1457)

IMPROVEMENTS:

• Update vault libs to v1.10.3 (#1483)
• Drop debug log calls containing the full vault response (#1477)
• resource/token: Add metadata support (#1470)
• resource/vault_ldap_auth_backend: support LDAP username_as_alias attribute: (#1460)
• resource/vault_quota_rate_limit: Add support for interval and block_interval: (#1084)
• ci: Test against vault-enterprise 1.10.3-ent: (#1461)

BUGS:

• resource/auth_backend: validate path, disallowing leading/trailing / (#1471)
• resource/vault_jwt_auth_backend_role: fix bound_claims not being unset when empty (#1469)
• resource/cert_auth_backend: add the correct field name: allowed_organizational_units (#1496)

3.6.0 (May 18, 2022)

IMPROVEMENTS:

• resource/pki_secret_backend_root_cert: Force new root CA resource creation on out-of-band changes. (#1428)
• resource/pki_secret_backend_intermediate_set_signed: Document complete usage example. (#1452)
• resource/pki_secret_backend_config_urls: Add support for importing PKI config URLs (#1451)
• vault/resource_pki_secret_backend*: Extend revocation support to other resources (#1446)
• vault/resource_pki_secret_backend*: Force new root CA/cert resource creation on out-of-band changes. (#1432)
• datasource/generic_secret: Improve documentation. (#1390)
• resource/ldap_auth_backend: Support setting userfilter. (#1378)
• resource/aws_auth_backend_role: Add role_id as a computed field. (#1377)
• Auth: Handle CIDR prefix being stripped for hosts in token_bound_cidrs (#1346)
• Add allowed_serial_numbers support (#1119)
• resource/pki_secret_backend_role: Allow key_type to be set to any. (#791)
• resource/aws_secret_backend_role: Add user_path and permissions_boundary_arn arguments. (#781)

BUGS:

• resource/pki_secret_backend_root_sign_intermediate: Ensure that the certificate_bundle, and ca_chain do not contain duplicate certificates. (#1428)
• resource/identity_entity_alias: Serialize create, update, and delete operations in order to prevent alias mismatches. (#1429)
• database_secret*: Ignore mongodb-atlas private_key on read from Vault. mismatches. (#1438)
• resource/auth_backend: Remove ForceNew behavior when updating description. (#1439)
• resource/identity_group_member_entity_ids: Properly handle nil member_entity_ids in response. (#1448)
• resource/pki_secret_backend_role: Fix TTL handling in PKI role. (#1447)
• resource/pki_secret_backend_role: key_usage value should be computed. (#1443)
• resource/vault_pki_secret_backend_{cert,sign}: Properly force a new resource whenever the cert is near expiry. (#1440)
• resource/identity_entity_alias: Remove read operation on entity alias update. (#1434)

3.5.0 (April 20, 2022)

FEATURES:

• Add MFA support: new resources vault_mfa_okta, vault_mfa_totp, vault_mfa_pingid (#1395)
• New resource/database_secrets_mount: Configures any number of database secrets engines under a single, dedicated mount resource (#1400)

IMPROVEMENTS:

• data/vault_generic_secret: Add new field with_lease_start_time to vault_generic_secret datasource (#1414)
• resource/vault_ssh_secret_backend_role: support configuring multiple public SSH key lengths in vault-1.10+ (#1413)
• resource/database_secret*: Add support for configuring TLS, and the username_template field for the ElasticSearch.
• resource/pki_secret_backend_cert: Add support for optionally revoking the certificate upon resource destruction. (#1411)
• provider: Add support for setting the tls_server_name to use as the SNI host when connecting via TLS. (#1145
• docs: Add links to Learn Tutorials. (#1399)

BUGS:

• resource/identity_group: Fix issue where the group's member_entity_ids were being unset in error on update. (#1409)
• resource/transit_secret_backend_key: Add auto_rotate_period field which deprecates auto_rotate_interval. (#1402)

3.4.1 (March 31, 2022)

BUGS:

• data/azure_access_credentials: Fix panic when tenant_id and subscription_id are specified together; add new environment override field (#1391).

IMPROVEMENTS:

• resource/rabbitmq_secret_backend: Add support for the password_policy and username_template fields (#1276)

3.4.0 (March 24, 2022)

FEATURES:

• data/azure_access_credentials Add subscription_id and tenant_id fields to used during credential validation (#1384)
• Add OIDC Provider support: new resources vault_identity_oidc_scope, vault_identity_oidc_assignment, vault_identity_oidc_client , vault_identity_oidc_provider, vault_identity_oidc_public_keys, vault_identity_oidc_openid_config (#1363)

BUGS:

• data/azure_access_credentials: Fix credential validation (#1381).

IMPROVEMENTS:

• resource/database_secret_backend_connection: Add disable_escaping parameter support to Redshift, HanaDB, Postgres and MSSQL (#1321)
• resource/transit_secret_backend_key: Add auto_rotate_interval parameter support to Transit Key Backend (#1345)
• resource/consul_secret_backend_role: Add support for Consul role (#1366)
• resource/consul_secret_backend_role: Add support for Consul namespaces and partitions (#1367)
• resource/github_auth_backend: Add support for organization_id field (#1296)
• resource/approle_auth_backend_role_secret_id: Add with_wrapped_accessor to control how the resource ID is set (#1166)

3.3.1 (February 25, 2022)

BUGS:

• resource/identity_group: Report an error upon duplicate resource creation failure. Document group name caveats. (#1352)
• resource/pki_secret_backend_root_sign_intermediate: Fix panic when reading ca_chain from Vault (#1357)
• resource/raft_snapshot_agent_config: Properly handle nil response on read (#1360)
• resource/identity_*: Ensure non-existent entities are handled properly (#1361)
• resource/dentity_group_member_entity_ids: Properly handle nil member_identity_ids on read (#1356)

3.3.0 (February 17, 2022)

FEATURES:

• Add KMIP support: new resources vault_kmip_secret_backend, vault_kmip_secret_scope and vault_kmip_secret_role (#1339)

BUGS:

• resource/kubernetes_auth_backend_config: Ensure disable_iss_validation is honored in all cases (#1315)
• resource/database_secret_backend_connection: Add error handling for unrecognized plugins on read (#1325)
• resource/kubernetes_auth_backend_config: Prevent persistent diff for kubernetes_ca_cert when it is loaded by the backend (#1337)

IMPROVEMENTS:

• resource/token_auth_backend_role: Add allowed_policies_glob and disallowed_polices_glob (#1316)
• resource/database_secret_backend_connection: Add support for configuring the secret engine's plugin_name (#1320)
• resource/pki_secret_backend_root_sign_intermediate: Update schema for ca_chain from string to a list of issuing_ca and certificate, add new certificate_bundle attribute that provides the concatenation of the intermediate and issuing CA certificates (PEM encoded) (#1330)
• resource/azure_secret_backend: Add support for setting use_microsoft_graph_api (#1335)
• r/d/kubernetes_auth_backend_role: Add support for setting and getting alias_name_source (#1336)
• resource/database_secret_backend_connection: Add username and password fields to all DB Engines that support them (#1331)
• resource/token_auth_backend_role: Add support for setting allowed_entity_aliases (#1126)
• resource/ad_secret_backend: Restore deprecated formatter, and length fields. (#1341)
• resource/ldap_auth_backend: Add support for setting case_sensitive_names (#1176)

3.2.1 (January 20, 2022)

BUGS:

• resource/rabbitmq_secret_backend_role: Add nil check when reading RabbitMQ role from Vault (#1312)

3.2.0 (January 19, 2022)

BUGS:

• resource/aws_secret_backend_role: Ensure all updated fields are applied (#1277)

IMPROVEMENTS:

• resource/database_secret_backend_connection: Add support for configuring Redshift databases (#1279)
• resource/pki_secret_backend_intermediate_cert_request: Add support for the ed25519 key_type (#1278)
• resource/rabbitmq_secret_backend_role: Add support for vhost_topics (#1246)
• resource/vault_mount: Add support for audit_non_hmac_request_keys and audit_non_hmac_response_keys (#1297)
• resource/vault_aws_secret_backend: Add support for username_template (#1292)

3.1.1 (December 22, 2021)

BUGS:

• Prevent new entity read failures when the VAULT_TOKEN environment variable is not set (#1270)

3.1.0 (December 22, 2021)

FEATURES:

• provider: Add support retrying entity reads for Client Controlled Consistency type operations (#1263)
• provider: Add support for optionally creating a batch child token via the skip_child_token option (#775)

IMPROVEMENTS:

• data/policy_document: Add support for patch capability for vault-1.9+. (#1238)
• resource/database_secret_backend_connection: Add support for InfluxDB connections (#1121)
• resource/generic_secret: Add support for deleting all version data for a KV-V2 secret (#1254)
• resource/database_secret_backend_connection: Add support configuring Contained Databases for mssql (#1259)
• resource/vault_jwt_auth_backend: Add oidc_response_mode, oidc_response_types, and namespace_in_state fields (#1244)
• Add better error reporting whenever invalid JSON metadata is encountered (#1262)
• resource/vault_identity_entity_alias: Add custom_metadata support for entity aliases (#1235)
• resource/approle_auth_backend_role_secret_id: Update Vault provider to be compatible with Vault 1.9 changes (#1242)
• provider: Encrypt logged HTTP secret header values (#1250)
• provider: Optionally log request and response bodies (#1251)

BUGS:

• resource/identity_group_policies: Fix potential nil panic in type conversion for API policies (#1245)
• resource/aws_secret_backend_role: Fix for properly detecting changes in the JSON policy document (#1014)

3.0.1 (November 23, 2021)

BUGS:

• resource/aws_secret_backend_role: Prevent invalid policy_arns from being created (#1229)
• resource/approle_auth_backend_secret_id: Handle nil cidr_list introduced in vault-1.9.0 (#1230)
• resource/kubernetes_auth_backend_config: Ensure disable_iss_validation is properly set in vault-1.9+ (#1231)

3.0.0 (November 17, 2021)

FEATURES:

• New Resource vault_raft_autopilot: Configure Vault's Raft Autopilot settings (#1210)

IMPROVEMENTS:

• Upgrade Terraform Plugin SDK to v2
• Add support for client controlled consistency on Vault Enterprise (#1188)
• resource/jwt_auth_backend_role: Add field disable_bound_claims_parsing to disable bound claim value parsing, which is useful when values contain commas (#1200)
• resource/transform_template: Add encode_format and decode_formats fields for Vault Enterprise with the Advanced Data Protection Transform Module (#1214)
• data/generic_secret: Store lease_start_time UTC. (#1216)
• resource/identity_entity_alias: Add support for configuring custom_metadata. (#1235)

BUGS:

• data/gcp_auth_backend_role: Report an error when attempting to access a nonexistent role. (#1184)
• data/generic_secret: Ensure lease_start_time is stored in RFC3339 format. (#770)

2.24.1 (October 05, 2021)

BUGS:

• resource/vault_raft_snapshot_agent_config: Fix bug where cloud provider was missing and google_endpoint is returned as false instead of null (#1173)

2.24.0 (September 15, 2021)

FEATURES:

• New Database Resource: Added support for the snowflake-database-plugin to vault_database_secret_backend_connection (#983)
• resource/vault_raft_snapshot_agent_config: Provision Raft Snapshot Agent Configurations in Vault Enterprise. (#1139)

IMPROVEMENTS:

• resource/database_secret_backend_connection: Add username_template to vault_database_secret_backend_connection (#1103)
• resource/ldap_auth_backend: Allow the creation of local mounts (#1115)
• resource/jwt_auth_backend: Allow the creation of local mounts (#1115)
• resource/consul_secret_backend: Allow the creation of local mounts (#1115)

BUGS:

• resource/vault_identity_group: Fix bug where member_entity_ids & member_group_ids were attempted to be managed on external identity groups (#1134)

2.23.0 (August 18, 2021)

FEATURES:

• New Resource vault_gcp_secret_static_account: Provision Static Accounts in the GCP Secrets Engine (#1094)

IMPROVEMENTS:

• resource/database_secret_backend/mysql: Add tls_certificate_key and tls_ca options (#1098)

BUGS:

• resource/jwt_auth_backend: Fixed bug where provider_config did not configure non-string values correctly (#1118)
• resource/gcp_auth_backend: Support importing resource (#1125)
• resource/okta_auth_backend: Support importing resource (#1123)
• resource/audit: List audit only once during read (#1138)
• resource/identity_oidc_key: Error handling for identity oidc key vault calls (#1142)

2.22.1 (July 23, 2021)

BUGS:

• resource/vault_identity_group: Correctly handle the case of a preexisting identity group, suggest resource import in this case (#1014)
• resource/jwt_auth_backend: Reverted (#960) due to migration errors (#1114)

2.22.0 (July 22, 2021)

FEATURES:

• New Resource vault_quota_lease_count: Adds ability to manage lease-count quota's (Vault Enterprise Feature) (#948)

IMPROVEMENTS:

• Remove last dependency on github.com/terraform-providers (#1090)

BUGS:

• resource/vault_identity_group: Fix bug where metadata values are not removed if removed from file (#1061)
• resource/jwt_auth_backend: Fixed bug where provider_config only supported string values (#960)
• provider: Fix inconsistent handling of namespace when wrapping_ttl was specified in any resource (#1107)

2.21.0 (June 17, 2021)

FEATURES:

• data/vault_gcp_auth_backend_role: Added GCP auth role data source to fetch role ID (#1011)

IMPROVEMENTS:

• provider/auth_login: Supprt AWS STS signing when method=aws for in auth_type (#1060)
• resource/vault_ldap_auth_backend: Add client_tls_cert and client_tls_key options (#1074)
• resource/vault_identity_entityAdded additional logging information about entity (#987)

2.20.0 (May 19, 2021)

IMPROVEMENTS:

• resource/vault_azure_secret_backend: Added support for updating the backend (#1009)
• resource/vault_aws_secret_backend: Add iam_endpoint and sts_endpoint options (#1043)

BUG FIXES:

• resource/vault_gcp_auth_backend: Support nested backend paths (#1050)
• resource/vault_kubernetes_auth_backend_role: allow unset audience (#1022)
• resource/vault_identity_entity: Fix bug where values are not removed if removed from file (#1054)

2.19.1 (April 21, 2021)

SECURITY:

• resource/vault_gcp_auth_backend_role: Fixed typo in bound_labels parameter name causing no values to be applied to created roles CVE-2021-30476 (#1028)

2.19.0 (March 17, 2021)

FEATURES:

• New Resource: terraform_cloud_secret resources (#959)

IMPROVEMENTS:

• resource/pki_secret_backend: Support allowed_domains_template option for vault_pki_secret_backend_role (#869)

BUG FIXES:

• resource/vault_identity_group: Don't send name parameter unless specified (#1002)

2.18.0 (January 21, 2021)

FEATURES:

• New Resource: vault_password_policy resource (#927)

IMPROVEMENTS:

• resource/vault_consul_secret_backend: Extend consul secret engine definition to cover all vault parameters (#910)
• resource/vault_jwt_auth_backend: Added support for provider_config (#943)

2.17.0 (December 15, 2020)

FEATURES:

• New Data Source: vault_nomad_access_token data source (#923)
• New Resource: vault_nomad_secret_backend resource (#923)
• New Resource: vault_nomad_secret_role resource (#923)

IMPROVEMENTS:

• resource/vault_audit: added support for local mount to prevent replicating the audit backend (#915)
• resource/jwt_auth_backend_role: Added support for using globs in matching bound_claims (#877)
• resource/vault_aws_auth_backend_client: Added sts_region parameter (#931)
• resource/vault_azure_secret_backend_role: Added support for azure_groups (#891)
• resource/vault_identity_oidc_role: client_id parameter can optionally be configured (#815)

BUG FIXES:

• resource/vault_identity_entity: Fixed nil pointer exception (#899)
• resource/vault_mount: Fixed bug where mount was deleted when description was changed (#929)

2.16.0 (November 19, 2020)

FEATURES:

• New Data Source: vault_ad_access_credentials data source (#902)
• New Resource: vault_ad_secret_backend resource (#902)
• New Resource: vault_ad_secret_role resource (#902)
• New Resource: vault_ad_secret_library resource (#902)

IMPROVEMENTS:

• resource/vault_gcp_auth_backend: added support for local mount to prevent replicating the secret engine (#861)
• data.vault_aws_access_credentials: Add optional ttl parameter to data source (#878)

BUG FIXES:

• resource/vault_jwt_auth_backend: Fix possible reoccuring diff when using oidc_client_secret (#803)

2.15.0 (October 21, 2020)

FEATURES:

• New Data Source: vault_transit_decrypt data source (#872).
• New Data Source: vault_transit_encrypt data source (#872).

IMPROVEMENTS:

• resource/vault_gcp_secret_backend: added support for local mount to prevent replicating the secret engine (#855)
• resource/vault_ssh_secret_backend_role: added support for new allowed_users_template argument(#875)
• resource/vault_ssh_secret_backend_role: added support for new algorithm_signer argument(#809)
• resource/vault_kubernetes_auth_backend_config: Add disable_iss_validation and disable_local_ca_jwt config parameters to k8s auth backend (#870)
• data/vault_kubernetes_auth_backend_config: Add disable_iss_validation and disable_local_ca_jwt config parameters to k8s auth backend (#870)

2.14.0 (September 15, 2020)

FEATURES:

• New Resource: vault_quota_rate_limit resource to manage resource quota limit (#825).

BUG FIXES:

• resource/vault_aws_secret_backend_role: fix AWS Secrets Engine Role resource to allow only IAM Groups (#862)
• resource/vault_ssh_secret_backend_ca: detect misconfigured resource and remove from state (#856)

2.13.0 (August 27, 2020)

IMPROVEMENTS:

• resource/transit_secret_backend_key: add supported by Vault type of algorithm rsa-3072 (#773)
• data.vault_generic_secret: Mark data and data_json as Sensitive (#844)
• Add iam_groups to vault_aws_secret_backend_role (#826)
• Add support for uri_sans parameter for resource vault_pki_secret_backend_cert (#759)

BUG FIXES:

• data/vault_generic_secret: Fix perpetual diff when using Terraform v0.13.0 (#849)
• data.vault_aws_access_credentials: Re-add support for passing region information stored in Vault backend to AWS Config (#841)

2.12.2 (July 31, 2020)

BUG FIXES:

• data.vault_aws_access_credentials: Revert #832, which inadvertently introduced issues when the token policy did not have the required permissions to read the root configuration. (#837)

2.12.1 (July 30, 2020)

BUG FIXES:

• data.vault_aws_access_credentials: Add support for passing region information stored in Vault backend to AWS Config (#832)

2.12.0 (July 20, 2020)

FEATURES:

• New Resource: vault_identity_group_member_entity_ids (#724).
• New Resource: vault_transform_alphabet (#783).
• New Resource: vault_transform_role (#783).
• New Resource: vault_transform_template (#783).
• New Resource: vault_transform_transformation (#783).
• New Data Source: vault_transform_encode data source (#783).
• New Data Source: vault_transform_decode data source (#783).

IMPROVEMENTS:

• resource/vault_mount: Adds support for the external_entropy_access field (#792).
• resource/vault_jwt_auth_backend: enable existing JWT Auth backends to be imported (#806).
• resource/vault_jwt_auth_backend: store type and tune information in state (#806).

2.11.0 (May 21, 2020)

IMPROVEMENTS:

• Add headers provider configuration setting to allow setting HTTP headers for all requests to the Vault server (#730).

BUG FIXES:

• vault_jwt_auth_backend: Fix plan error when oidc_discovery_url, jwks_url, or jwt_validation_pubkeys is set to a value that is not known until apply time (#753).
• vault_pki_secret_backend_root_cert, vault_pki_secret_backend_root_sign_intermediate, and vault_pki_secret_backend_sign: Fix serial field (#761).
• vault_token: Avoid panic when vault_token is gone from the server (#740).
• vault_approle_auth_backend_role: Fix perpetual diff when policies and period are updated to be token_policies and token_period (#744).
• vault_jwt_auth_backend_role: Fix crash when bound_audiences is empty (#763).
• vault_identity_group: Fix removal of policies, member_group_ids, and member_entity_ids (#766).

2.10.0 (April 03, 2020)

FEATURES:

• Add vault_azure_access_credentials data source that retries creds before returning them (#713).
• To vault_database_secret_backend_connection, add support for the elasticsearch-database-plugin (#704).

IMPROVEMENTS:

• Add add_address_to_env argument to set the value of the provider's address argument as the VAULT_ADDR environment variable in the Terraform process, enabling VAULT_ADDR external token helpers to work with this provider (#651).
• Provide the ability to encrypt generated tokens using Keybase when using /auth/token/create, /auth/token/create-orphan, or /auth/token/create/{role_name} (#686).

BUG FIXES:

• In vault_aws_auth_backend_role, allow role_arns and policy_arns to be used together (#710).

2.9.0 (March 13, 2020)

FEATURES:

• Add vault_alicloud_auth_backend_role resource (#673).

IMPROVEMENTS:

• Allow / character in the group_name field of the okta_auth_backend_group resource (#687).
• Support not_before_duration property in pki_secret_backend_role (#698).

BUG FIXES:

• Fix vault_cert_auth_backend_role deletion (#690).
• Fix use_token_groups changes not being applied properly in vault_ldap_auth_backend resource (#674).

2.8.0 (February 05, 2020)

IMPROVEMENTS:

• Adds ability to choose a specific AWS ARN in vault_aws_access_credentials when a Vault role has multiple ARNs configured (#661).
• Updates to Go 1.13 (#642).
• Adds doc on multiple namespace support (#654).
• Sorts vault_policy_document data source allowed/denied parameters by key name (#656).
• Adds support to vault_auth_backend for common backend tune parameters. Also allows updating Max TTL, Default TTL and Visibility Listing tuning settings on vault_auth_backend without forcing a new resource (#650).

BUG FIXES:

• Fix panic when reading unconfigured PKI mount URLs (#641).
• Update JWT bound_audiences to be optional (649).
• Solves permanent diff with the Mongo database connection URL (#659 and #662).
• Fixes an issue where the "vault_ldap_auth_backend_user" resource did not respect an empty groups value (#655).

2.7.1 (January 03, 2020)

BUG FIXES:

• For the /gcp/config endpoint, fixes issue where credentials weren't being updated when changed (#635).
• For the /aws/config/root endpoint, no longer requires access_key or secret_key (#634).

2.7.0 (December 06, 2019)

FEATURES:

• For the /sys/auth endpoint, adds a new data source (#606).

IMPROVEMENTS:

• For the Vault child token created for Terraform to use during a run, adds a token_name field for easier identification in Vault (#594).
• For the /ssh/roles/{role} endpoint, adds support for allowed_user_key_lengths (#605).
• For the /sys/mounts/{path} endpoint, adds support for seal_wrap (#616).
• For the /auth/kubernetes/config endpoints, adds support for issuer (#601).
• For the /auth/kubernetes/role/{name} endpoints, adds support for audience (#601).

BUG FIXES:

• For the /identity/entity-alias endpoint, fixes updates to the name field (#610).

2.6.0 (November 08, 2019)

FEATURES:

• Adds a resource for the /database/static-roles/{name} endpoint (#577).
• Adds a resource for the /identity/lookup/entity endpoint (#587).

IMPROVEMENTS:

• Improved deprecation notices for Vault 1.2 token.* fields (#565).
• Adds new JWT Auth role fields introduced with Vault 1.2 (#566).
• Eliminates the need to add an outer delay while waiting for AWS creds to propagate (#571).
• For the /consul/roles/{name} endpoint, adds support for ttl, max_ttl, token_type, and local fields (#581).
• For the /sys/namespaces/{path} endpoint, uses the path for the namespace ID to allow imports (#570).

BUG FIXES:

• Fix panic when trying to write an entity alias that already exists (#573).

2.5.0 (October 17, 2019)

IMPROVEMENTS:

• Migrates to using the standalone Terraform plugin SDK (#558).

2.4.0 (October 11, 2019)

FEATURES:

• Adds support for alternative auth methods using a method-agnostic implementation (#552).
• Adds a resource for the "/consul/roles/{name}" endpoint (#480).
• Adds a resource for the "/pki/config/crl" endpoint (#506).

IMPROVEMENTS:

• Adds support for Vault 1.2+ token fields to LDAP auth (#553)
• Adds support for configuring the Transit cache (#548)
• Adds support for updates to the identity group alias field (#536).
• Adds support for reading the AWS access key and region from the AWS client config (#539).
• In AWS auth, only updates the access key and secret if they've changed (#540).
• Adds support for "root_rotation_statements" in the database secret engine's connection params (#530).
• Adds support for token_type and allowed_response_headers in Github and JWT auth backends (#556)

BUG FIXES:

• Fixes incorrect handling of user and team policies in the Github auth backend (#543).

2.3.0 (September 06, 2019)

IMPROVEMENTS:

• Adds support for importing roles in "vault_gcp_auth_backend_role" (#517).
• Adds support for importing groups in "vault_okta_auth_backend_group" (#514).
• Adds JWKS configuration options to "vault_jwt_auth_backend" (#483).
• Adds support for response wrapping to "vault_approle_auth_backend_role_secret_id" (#518).

BUG FIXES:

• Fixes an issue where using mount type "kv-v2" in "vault_mount" would continuously recreate the resource (#515).
• Fixes an issue where the "vault_token" resource would try to renew the access token instead of the resource token (#423).
• In the "vault_gcp_auth_backend", marks "credentials" as optional rather than required (#509).
• Fixes an issue where "vault_pki_secret_backend_config_urls" was forming an invalid URL for updating (#512).

2.2.0 (August 09, 2019)

FEATURES:

• Adds a datasource for the "/identity/lookup/entity" and "/identity/lookup/group" endpoints (#494).
• Adds a resource for the "/azure/roles/{name}" endpoint (#493).
• Adds a resource for the "/identity/oidc/config", "/identity/oidc/key/{name}", "/identity/oidc/key/{key_name}", and "/identity/oidc/role/{name}" endpoints (#488).
• Adds a resource for the "/transit/keys/{name}" endpoint (#477).
• Adds a resource for the "/sys/mfa/method/duo/{name}" endpoint (#443).
• Adds a resource for the "/azure/config" endpoint (#481).

IMPROVEMENTS:

• Adds a lock to prevent races in identity group resources (#492 and #495).
• Adds support for new common token fields on roles that were introduced in Vault 1.2.0 (#478 and #487).
• Adds the ability to run a coverage report to learn what Vault OpenAPI endpoints are and aren't supported (#466).
• Exposes the "local" flag on the vault_mount resource (#462).

BUG FIXES:

• resource/aws_auth_backend_client: Backend supports nested paths [#461]
• Adds "ForceNew" to the "groupname" parameter on the LDAP auth groups endpoint so if there's a change, the old group is deleted (#465).
• Fixes issue with a permanent diff in vault_gcp_secret_roleset (#476).

2.1.0 (July 05, 2019)

IMPROVEMENTS:

• For aws_secret_backend_role, adds support for default_sts_ttl and max_sts_ttl (#444).

BUG FIXES:

• Fixes ordering issues with aws_auth_backend_role and aws_auth_backend_role_tags (#439).
• Supports providing lists for bound_claims (#455).
• Resolves issue with persistent diffs on vault_generic_secret (#456).

2.0.0 (June 19, 2019)

FEATURES:

• Adds support for using the Vault provider with Terraform 0.12. See the upgrade guide (#446)

BACKWARDS INCOMPATIBILITIES/NOTES:

• all: deprecated fields are now removed (#446)
• auth_backend: the path field and id now no longer have a trailing slash (#446)
• database_secret_backend_role: the _statements fields are now a list, not strings (#446)
• pki_secret_backend_config_urls: the certificate fields are now lists, not strings (#446)
• pki_secret_backend_role: the certificate fields are now lists, not strings (#446)
• pki_secret_backend_sign: the ca_chain field is now a list, not a string (#446)
• rabbitmq_secret_backend_role: the vhosts field is now a vhost block (#446)

IMPROVEMENTS:

• azure_auth_backend_role: client_secret will now be set in state (#446)

BUG FIXES:

• namespace: namespaces will now be removed from state instead of erroring when they're not found (#446)

1.9.0 (June 12, 2019)

IMPROVEMENTS:

• Adds support for role_arns on aws_secret_backend_role(#407).
• Updates the vendored version of Vault to 1.1.2 so features introduced since then can be added (#413).
• Implements accessor attribute on the Okta auth backend (#420).
• Allows the Vault token to be read from the environment (#434).
• Supports project_id and bound_projects in the GCP auth backend's roles (#411).

BUG FIXES:

• Fixes a case on vault_aws_auth_backend_role where resolve_aws_unique_ids could not be updated from true to false without recreating the resource (#382).
• Removes default TTL's from the GCP secret backend resource, letting them instead be set by Vault (#426).

1.8.0 (May 07, 2019)

FEATURES:

• Adds OIDC support to the JWT auth backend (#398).
• New Resource: Adds a vault_pki_secret_backend_config_urls resource (#399).

IMPROVEMENTS:

• Adds support for automatically renewing certificates in the PKI certs backend (#386).
• Adds support for uri_sans in the PKI secret backend (#373).
• Allows a user to delete all policies in the AWS auth role resource (#395).

BUG FIXES:

• Fixes the ability to handle JWT roles that lack policies (#389).
• Allows vault_ldap_auth resources to be imported (#387).
• Fixes issue with trailing slashes for the Vault namespaces resource (#391).
• Fixes a bug with namespaces where the path was being overwritten (#396).

1.7.0 (April 03, 2019)

FEATURES:

• New Resource: Adds a "Flexible Generic Secret" resource so it can be used to consume Vault APIs that don't yet have a resource (#244).
• New Resource: Adds a token resource (#337).
• New Resource: Adds a GCP secret roleset resource (#312).
• New Resource: Adds a vault_identity_group_policies resource (#321).

IMPROVEMENTS:

• For the LDAP auth method, adds support for the use_token_groups field (#367).
• Adds the ability to set max_retries on the Vault client (#355).
• For the Github auth method, adds support for the accessor field (#350).
• For the generic secrets resource, adds support for a data field (#330).
• For the JWT auth backend, adds support for a groups_claim_delimiter_pattern on roles (#296).
• For the JWT auth backend, adds a role_type field (#317).
• For the JWT auth backend, adds a jwt_supported_algs field (#345).

BUG FIXES:

• Fixes TTL parsing on PKI certificate creation (#314).
• Fixes ability to update the data field on database secrets engine connections (#340).
• Unmarks policy_document and policy_arns from being in conflict with each other (#344).

1.6.0 (March 06, 2019)

FEATURES:

• Adds compatibility with Vault 1.0 (#292).
• New Resource: Supports the SSH secrets engine role endpoint (#285, #303, and #331).
• New Data Source: Adds a vault_policy_document data source (#283).
• New Resource: Adds a namespace resource (#338).

IMPROVEMENTS:

• Adds a guide for how to contribute in the least iterations possible.
• For the TLS Certificates auth method, adds support for the following role fields: allowed_common_names, allowed_dns_sans, allowed_email_sans, allowed_uri_sans, and allowed_organization_units (#282).
• For the GCP auth method, adds support for the following role fields: add_group_aliases, max_jwt_exp, and allow_gce_inference (#308 and #318).
• For the Kubernetes auth method, adds support for bound_cidrs (#305).
• For vault_identity_group, fixes issue with policies not being updated properly (#301).
• For the AWS secret engine, updates to the current role fields (#323).

BUG FIXES:

• Marks the token_reviewer_jwt sensitive (#282).
• Fixes an issue where boolean parameters were not set when the value was false in the AWS role resource (#302).
• Guards for a nil CA chain in resource_pki_secret_backend_cert (#310).

1.5.0 (January 30, 2019)

FEATURES:

• Adds support for namespaces (#262)
• Adds support for EGP and RGP, a.k.a. Sentinel (#264)
• New Resource: Supports the PKI secrets backend (#158)
• New Resource: Supports identity entities and entity aliases (#247 and #287)
• New Resource: Supports Github auth backend (#255)
• New Resource: Supports Azure auth backend (#275)
• New Resource: Supports JWT auth backend (#272)

BUG FIXES:

• Fixes a panic related to max_connection_lifetime parameters in the database secrets backends (#250)
• Fixes issue where the role_name on token_auth_backend_role would not be updated (#279)
• Fixes wrong response data from gcp_auth_backend_role (#243)

1.4.1 (December 14, 2018)

BUG FIXES:

• Fixes an issue with database resources where db statements were overwritten when not provided (#260)

1.4.0 (December 11, 2018)

FEATURES:

• New Resource: vault_gcp_auth_backend (#198)
• New Resource: vault_identity_group (#220)
• New Resource: vault_identity_group_alias (#220)

IMPROVEMENTS:

• Makes gcp_secret_backend credentials optional (#239)
• Adds more configuration parameters for auth_backend (#245)

BUG FIXES:

• Fixes issue with vault_database_secret_backend_connection always updating the connection URL (#217)

1.3.1 (November 06, 2018)

BUG FIXES:

• Solves issue where the incorrect KV store was selected for older Vault versions as described in #229.

1.3.0 (November 05, 2018)

FEATURES:

• New Resource: Supports KV V2 (#156)
• New Resource: vault_gcp_secret_backend (#212)
• New Resource: vault_aws_auth_backend_roletag_blacklist (#27)
• New Resources: vault_rabbitmq_secret_backend and vault_rabbitmq_secret_backend_role (#216)

IMPROVEMENTS:

• Adds bound_zones, bound_regions, bound_instance_groups, and bound_labels for GCP auth roles via #227
• Exports the LDAP auth backend accessor via #195
• Allows for templated database backends via #168

BUG FIXES:

• #222 ensures that booleans on AWS roles default to values matchiing Vault's defaults

1.2.0 (October 26, 2018)

FEATURES:

• New Resource: vault_jwt_auth_backend_role (#188)
• New Resources: vault_kubernetes_auth_backend_config and vault_kubernetes_auth_backend_role (#94)
• New Resource: vault_ssh_secret_backend_ca (#163)
• New Feature: Support for the Vault token helper (#136)

IMPROVEMENTS:

• Re-adds changes to vault_aws_auth_backend_role from #53
• Adds backwards compatibility for the above via #189
• Adds bound_ec2_instance_id to vault_aws_auth_backend_role (#135)
• Adds mysql_rds, mysql_aurora, and mysql_legacy to the MySQL backend via #87
• Makes audit device path optional via #180
• Adds the field accessor to resource_auth_backend and resource_mount via #150
• Marks bindpass as sensitive in the vault_ldap_auth_backend (#184)

BUG FIXES:

• Fixes inablity to destroy a secret ID after consumption (#97) via #148

1.1.4 (September 20, 2018)

BUG FIXES:

• Reverts breaking changes to vault_aws_auth_backend_role introduced by (#53)

1.1.3 (September 18, 2018)

FEATURES:

• New Resource: vault_consul_secret_backend (#59)
• New Resource: vault_cert_auth_backend_role (#123)
• New Resource: vault_gcp_auth_backend_role (#124)
• New Resource: vault_ldap_auth_backend (#126)
• New Resource: vault_ldap_auth_backend_user (#126)
• New Resource: vault_ldap_auth_backend_group (#126)

1.1.2 (September 14, 2018)

FEATURES:

• New Resource: vault_audit (#81)
• New Resource: vault_token_auth_backend_role (#80)

UPDATES:

• Update to vendoring Vault 0.11.1. Introduces some breaking changes for some back ends so update with care.

1.1.1 (July 23, 2018)

BUG FIXES:

• Fix panic in vault_approle_auth_backend_role when used with Vault 0.10 (#103)

1.1.0 (April 09, 2018)

FEATURES:

• New Resource: vault_okta_auth_backend (#8)
• New Resource: vault_okta_auth_backend_group (#8)
• New Resource: vault_okta_auth_backend_user (#8)
• New Resource: vault_approle_auth_backend_login (#34)
• New Resource: vault_approle_auth_backend_role_secret_id (#31)
• New Resource: vault_database_secret_backend_connection (#37)

BUG FIXES:

• Fix bug in policy_arn parameter of vault_aws_secret_backend_role (#49)
• Fix panic in vault_generic_secret when reading a missing secret (#55)
• Fix bug in vault_aws_secret_backend_role preventing use of nested paths (#79)
• Fix bug in vault_aws_auth_backend_role that failed to update the role name when it changed (#86)

1.0.0 (November 16, 2017)

BACKWARDS INCOMPATIBILITIES / NOTES:

• vault_auth_backend's ID has changed from the type to the path of the auth backend. Interpolations referring to the .id of a vault_auth_backend should be updated to use its .type property. (#12)
• vault_generic_secret's allow_read field is deprecated; use disable_read instead. If disable_read is set to false or not set, the secret will be read. If disable_read is true and allow_read is false or not set, the secret will not be read. If disable_read is true and allow_read is true, the secret will be read. (#17)

FEATURES:

• New Data Source: aws_access_credentials (#20)
• New Resource: aws_auth_backend_cert (#21)
• New Resource: aws_auth_backend_client (#19)
• New Resource: aws_auth_backend_login (#28)
• New Resource: aws_auth_backend_role (#24)
• New Resource: aws_auth_backend_sts_role (#22)

IMPROVEMENTS:

• vault_auth_backends are now importable. (#12)
• vault_policys are now importable (#15)
• vault_mounts are now importable (#16)
• vault_generic_secrets are now importable (#17)

BUG FIXES:

0.1.0 (June 21, 2017)

NOTES: