v5.11.0

5.11.0 (August 14, 2026)

FEATURES:

• New Resources: Add support for GCP KMS secrets engine with vault_gcpkms_secret_backend and vault_gcpkms_secret_backend_key resources, vault_gcpkms_verify data source, and ephemeral resources vault_gcpkms_encrypt, vault_gcpkms_decrypt, vault_gcpkms_reencrypt, and vault_gcpkms_sign for cryptographic operations. Includes internal Plugin Framework mount_helpers for Vault mount operations to support incremental migration from SDKv2. (#2763)
• New resource for transform key configurations: vault_transform_key_configuration - Supports setting an auto_rotate_period and min_decryption_version to keys used in for tokenization transformations. This uses this endpoint to modify the configuration and this one to read configurations. (#2980)
• LDAP Role Level Password Policy Support: Added password_policy parameter to vault_ldap_secret_backend_static_role and vault_ldap_secret_backend_dynamic_role resources to support role-level password policy configuration (#2921). Requires Vault 2.2.0+.
• LDAP Rotate-on-Read Support: Added rotate_on_read and rotate_on_read_cooldown parameters to vault_ldap_secret_backend and vault_ldap_secret_backend_static_role resources, and rotated_on_read attribute to vault_ldap_static_role_credentials data source to support credential rotation on each read (#2960. Requires Vault Enterprise 2.2.0+.
• LDAP Account Unlock for Static Role: Added auto_unlock field (Optional+Computed) to vault_ldap_secret_backend and vault_ldap_secret_backend_static_role. When set at the mount level, Vault automatically unlocks the managed AD account after every successful static-role rotation, the per-role field overrides the mount-level setting, and when unset the role inherits the mount default. Active Directory schema only. Requires Vault Enterprise 2.2.0+.(#2977)
• Terraform Secret Engine Root Rotation Support: Add support for automated root token rotation via the rotation_period, rotation_schedule, rotation_window, and disable_automated_rotation fields, and add explicit_max_ttl to bound the lifetime of the rotated root token. Requires Vault 2.2.0+. (#2958)
• Add support for Kerberos auth backend: vault_kerberos_auth_backend_config, vault_kerberos_auth_backend_ldap_config, and vault_kerberos_auth_backend_group resources, and vault_kerberos_auth_backend_login ephemeral resource for Kerberos authentication. (#2819)
• Secrets Sync customer controlled encryption: vault_secrets_sync_aws_destination and vault_secrets_sync_gcp_destination now support Vault 2.2.0+ fields kms_key_id and replica_regions; and deprecated GCP legacy fields global_kms_key, locational_kms_keys, and replication_locations in favor of kms_key_id and replica_regions. (#2965)
• Add support for pkcs12_bundle and jks_bundle formats (without setting default values) in vault_pki_secret_backend_cert, vault_pki_secret_backend_root_cert, vault_pki_secret_backend_root_sign_intermediate, and vault_pki_secret_backend_sign (#2946). Requires Vault 2.0.5+.

IMPROVEMENTS:

• Migrated AWS provider dependency from aws-sdk-go (v1) to aws-sdk-go-v2 for improved performance and maintainability. (#2882)
• vault_identity_entity_alias: Add support for external_id and issuer fields. Available only for Vault Enterprise. (#2994)
• vault_aws_auth_backend_config_identity: Add support for canonical_arn as a valid value for the iam_alias parameter. Requires Vault 1.16+. (#2982)
• vault_jwt_auth_backend: Add string-to-integer conversion for groups_cap field in provider_config to support Okta provider configuration. (#2939)
• Autosnapshot support for AWS IRSA: Added documentation for IRSA usage per changes in Vault (hashicorp/raft-snapshotagent#49). IRSA feature requires Vault 2.2.0+
• Updated dependencies:
  • Bumped 13 Go module dependencies (#2969)
  • Bumped 10 Go module dependencies (#2990)
  • actions/checkout v7.0.0 → v7.0.1
  • actions/setup-go v6.4.0 → v7.0.0
  • actions/cache v5.0.5 → v6.1.0
  • golang.org/x/mod v0.37.0 → v0.40.0 (fixes GO-2026-6179, GO-2026-6180)
  • golang.org/x/crypto v0.54.0 → v0.55.0
  • golang.org/x/net v0.57.0 → v0.58.0
  • golang.org/x/text v0.40.0 → v0.41.0
  • golang.org/x/tools v0.47.0 → v0.49.0
  • cloud.google.com/go/iam v1.12.0 → v1.13.0
  • cloud.google.com/go/auth v0.20.0 → v0.23.0
  • github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0 → v1.23.0
  • github.com/aws/aws-sdk-go-v2 v1.43.0 → v1.43.5
  • github.com/aws/aws-sdk-go-v2/config v1.32.31 → v1.32.36
  • github.com/aws/aws-sdk-go-v2/credentials v1.19.30 → v1.19.35
  • github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.31 → v1.18.36
  • github.com/aws/aws-sdk-go-v2/service/iam v1.56.0 → v1.59.0
  • github.com/aws/aws-sdk-go-v2/service/sts v1.45.0 → v1.45.5
  • github.com/aws/smithy-go v1.27.3 → v1.27.7
  • github.com/hashicorp/terraform-plugin-log v0.10.0 → v0.11.0
  • github.com/moby/moby/client v0.5.0 → v0.5.1
  • google.golang.org/api v0.287.1 → v0.293.0
  • google.golang.org/genproto v0.0.0-20260622175928 → v0.0.0-20260810153831
  • google.golang.org/grpc v1.82.1 → v1.83.0
  • k8s.io/utils v0.0.0-20260617174310 → v0.0.0-20260707023825
• Build and CI changes:
  • Go 1.26.4 → 1.26.6 (fixes GO-2026-6088, GO-2026-6089, GO-2026-6090, GO-2026-6091, GO-2026-6218 in stdlib)
  • Vault Enterprise test images: 1.19.19-ent → 1.19.20-ent, 1.20.13-ent → 1.20.14-ent, 1.21.8-ent → 1.21.9-ent, 2.0.3-ent → 2.0.4-ent

BUG FIXES:

• vault_jwt_auth_backend: Fixed a perpetual diff where Vault returned non-string values that were silently dropped by Terraform’s TypeMap(TypeString) schema. All values are now converted to strings when read, preventing keys such as fetch_groups and groups_recurse_max_depth from appearing missing on every plan.(#2993)
• Fixed the token namespace being set as the provider namespace, even when set_namespace_from_token was false. (#2926)
• vault_pki_secret_backend_role: Fix crash when the Vault client was not successfully initialized (#2964)

v5.10.1

5.10.1 (June 26, 2026)

BREAKING CHANGES:

Reverted the 5.10.0 support for pkcs12_bundle and jks_bundle formats in formats in vault_pki_secret_backend_cert, vault_pki_secret_backend_root_cert, vault_pki_secret_backend_root_sign_intermediate, and vault_pki_secret_backend_sign that forced resource recreation. Configurations using these formats or their related arguments are no longer supported. (#2945)

v5.10.0

5.10.0 (June 23, 2026)

FEATURES:

• New Resource: vault_config_ui_default_auth - Manages UI default authentication configuration for the Vault GUI login form. Controls which authentication methods are displayed by default and as backup options for specific namespaces. Supports inheritance control for child namespaces. Enterprise-only feature requiring Vault 1.20.0+. (#2846)
• vault_config_control_group: Added initial implementation for vault_config_control_group resource in sys/config/control-group. (#2840)
• New Resource: vault_config_ui_header - Manages custom HTTP headers for the Vault UI. Supports security headers (CSP, HSTS, X-Frame-Options), CORS configuration, and custom organizational headers. Requires Vault 1.16.0+. (#2842)
• New Resource: Add support for RADIUS auth backend: vault_radius_auth_backend and vault_radius_auth_backend_user resource and vault_radius_auth_login ephemeral resource.(#2814)
• New Resource: vault_activation_flags for managing Vault features that are gated by one-time flags. Requires Vault 1.16 or later. Needs Vault enterprise license(#2861)
• New Resource: vault_oauth_resource_server_config_profile for managing OAuth Resource Server Configuration profiles in Vault Enterprise. Enables JWT-based authentication by defining how Vault validates JWT tokens from OAuth 2.0 resource servers. Supports both JWKS-based and static PEM key validation. Requires Vault 2.0.1+. (#2890)
• New Resource: vault_agent_registrationfor managing Agent Registry records in Vault Enterprise. Allows registering Vault agents with specific identity entities and configuring ceiling policies that limit maximum agent permissions. Requires Vault 2.0.1+. (#2885,2935)
• New Resource: vault_oauth_resource_server_config_profile Add optional_authorization_details to make RAR optional on OAuth resource server and agent registration. Requires Vault 2.0.3+.(#2930,#2933)
• New Resources: vault_userpass_auth_backend_user for user creation, deletion, password updates, and policy updates, and ephemeral resource vault_userpass_auth_login for authenticating with Userpass. (#2859)
• Add support for write only parameters for s3 backends for vault_raft_snapshot_agent_config by @drewmullen ([#2825]#2825)
• vault_transform_transformation: Added mapping_mode, stores and convergent fields to the resource. ([#2820] #2820)
• New Ephemeral Resource: vault_token for creating Vault tokens with automatic revocation. Supports service and batch tokens, as well as entity alias association, which was not supported in the SDKv2 resource. (#2877)
• New Resource: vault_config_group_policy_application - Manages the global group policy application mode for Vault Enterprise. Controls how policies attached to identity groups are applied across namespace boundaries. Supports within_namespace_hierarchy (default) and any modes. Requires Vault Enterprise 1.13.8+. (#2863)
• Add support for pkcs12_bundle and jks_bundle formats in vault_pki_secret_backend_cert, vault_pki_secret_backend_root_cert, vault_pki_secret_backend_root_sign_intermediate, and vault_pki_secret_backend_sign (#2908). Requires Vault 2.1+.
• vault_policy: Added allow_overwrite to optionally prevent overwriting Vault policies.(#2895)
• vault_managed_keys: Added support for usages and max_parallel fields. (#2887)

IMPROVEMENTS:

• resource/vault_token: Added deprecation warning to guide users toward the new ephemeral vault_token resource for better security and batch token support. (#2877)

• Replaced backend with mount in vault_aws_access_credentials resource's documentation and improved descriptions for a few other parameters.(#2911)

• Updated dependencies:

  • cloud.google.com/go/iam v1.9.0 -> v1.11.0
  • github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.1 -> v1.22.0
  • github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 -> v1.14.0
  • github.com/Azure/go-ntlmssp v0.1.0 -> v0.1.1
  • github.com/aws/aws-sdk-go-v2 v1.41.6 -> v1.42.0
  • github.com/aws/aws-sdk-go-v2/service/iam v1.53.8 -> v1.54.5
  • github.com/aws/aws-sdk-go-v2/service/sts v1.42.0 -> v1.43.3
  • github.com/aws/smithy-go v1.25.0 -> v1.27.2
  • github.com/go-sql-driver/mysql v1.9.3 -> v1.10.0
  • github.com/hashicorp/consul/api v1.34.1 -> v1.34.3
  • github.com/hashicorp/terraform-plugin-sdk/v2 v2.40.0 -> v2.40.1
  • github.com/hashicorp/terraform-plugin-testing v1.15.0 -> v1.16.0
  • github.com/hashicorp/vault-plugin-auth-jwt v0.26.1 -> v0.26.3
  • github.com/jackc/pgx/v5 v5.9.1 -> v5.9.2
  • github.com/moby/moby/client v0.4.1 -> v0.5.0
  • github.com/spiffe/go-spiffe/v2 v2.6.0 -> v2.8.1
  • golang.org/x/crypto v0.50.0 -> v0.53.0
  • golang.org/x/net v0.53.0 -> v0.56.0
  • google.golang.org/api v0.276.0 -> v0.286.0
  • google.golang.org/genproto v0.0.0-20260420184626 -> v0.0.0-20260622175928
  • google.golang.org/genproto/googleapis/api v0.0.0-20260414002931 -> v0.0.0-20260618152121
  • google.golang.org/genproto/googleapis/rpc v0.0.0-20260610212136 -> v0.0.0-20260618152121
  • k8s.io/utils v0.0.0-20260319190234 -> v0.0.0-20260617174310

v5.9.0

5.9.0 (April 22, 2026)

BREAKING CHANGES:

• Renamed all Vault 2.0 pki-external-ca resources from version 5.8.0 to a common prefix of vault_pki_external_ca_. (#2838)

FEATURES:

• New Resources: Add support for OS Secrets Engine with vault_os_secret_backend, vault_os_secret_backend_host, and vault_os_secret_backend_account resources for managing operating system credentials via SSH. Requires Vault 2.0.0+. (#2865)
• New Resources: vault_rotation_policy for managing rotation policies. Requires Vault 2.0.0+. (#2844)
• Add support for vault_quota_config resource. (#2837)
• New Resources: Add support for Vault Key Management secrets engine with resources for managing KMS providers (AWS KMS, Azure Key Vault, GCP Cloud KMS), cryptographic keys, key distribution, replication, and rotation (Vault Enterprise). (#2802)
• New Resources: vault_alicloud_secret_backend, vault_alicloud_secret_backend_role, and ephemeral resource vault_alicloud_access_credentials for managing AliCloud secrets engine. (#2858, #2874)
• New Resource: vault_plugin_runtime for managing plugin runtimes in Vault's plugin runtimes catalog. Requires Vault 1.15 or later.(#2835)
• Add support for CORS configuration: vault_sys_config_cors resource and data source for managing and reading Vault's CORS (Cross-Origin Resource Sharing) settings. (#2849)
• New Ephemeral Resource: Add vault_generic_endpoint ephemeral resource with response field extraction from data, auth, wrap_info, and lease metadata.(#2830)

IMPROVEMENTS:

• vault_cf_auth_backend_config: Added cf_password_wo_version to trigger updates when only cf_password_wo changes.(#2878)
• vault_pki_secret_backend_config_acme: Added new fields that control the PKI ACME challenge worker IP ranges that they can connect. ([#2839]#2839)
• Add support for metadata fields in azure_access_credentials and resource_azure_secret_backend_role resources. (#2734
• Add support for Enterprise Plugins in vault_plugin resource. (#2707)
• vault_ldap_secret_backend: Add self-managed support to ldap secrets engine. Requires Vault Enterprise 2.0+. (#2845)
• azure_static_role: Add support for importing existing credentials via new Vault import endpoint. (#2756)
• Updated dependencies:
  • cloud.google.com/go/auth v0.18.2 -> v0.20.0
  • cloud.google.com/go/cloudsqlconn v1.4.3 -> v1.20.2
  • cloud.google.com/go/iam v1.7.0 -> v1.9.0
  • filippo.io/edwards25519 v1.1.1 -> v1.2.0
  • github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 -> v1.21.1
  • github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 -> v1.12.0
  • github.com/aws/aws-sdk-go-v2 v1.41.5 -> v1.41.6
  • github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 -> v1.4.22
  • github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 -> v2.7.22
  • github.com/aws/aws-sdk-go-v2/service/iam v1.53.7 -> v1.53.8
  • github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 -> v1.13.8
  • github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 -> v1.13.22
  • github.com/aws/aws-sdk-go-v2/service/sts v1.41.10 -> v1.42.0
  • github.com/aws/smithy-go v1.24.3 -> v1.25.0
  • github.com/docker/docker v28.3.3+incompatible -> v28.5.2+incompatible
  • github.com/docker/go-connections v0.5.0 -> v0.7.0
  • github.com/fatih/color v1.18.0 -> v1.19.0
  • github.com/go-jose/go-jose/v3 v3.0.4 -> v3.0.5
  • github.com/go-jose/go-jose/v4 v4.1.3 -> v4.1.4
  • github.com/googleapis/gax-go/v2 v2.20.0 -> v2.21.0
  • github.com/hashicorp/consul/api v1.33.7 -> v1.34.1
  • github.com/hashicorp/go-secure-stdlib/plugincontainer v0.4.2 -> v0.5.0
  • github.com/hashicorp/terraform-plugin-mux v0.23.0 -> v0.23.1
  • github.com/hashicorp/vault/sdk v0.25.0 -> v0.25.1
  • github.com/jackc/pgtype v1.14.3 -> v1.14.4
  • github.com/oklog/run v1.1.0 -> v1.2.0
  • github.com/opencontainers/image-spec v1.1.0 -> v1.1.1
  • go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 -> v0.67.0
  • go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 -> v0.67.0
  • go.opentelemetry.io/otel v1.42.0 -> v1.43.0
  • go.opentelemetry.io/otel/metric v1.42.0 -> v1.43.0
  • go.opentelemetry.io/otel/trace v1.42.0 -> v1.43.0
  • golang.org/x/crypto v0.49.0 -> v0.50.0
  • golang.org/x/mod v0.33.0 -> v0.34.0
  • golang.org/x/net v0.52.0 -> v0.53.0
  • golang.org/x/sys v0.42.0 -> v0.43.0
  • golang.org/x/text v0.35.0 -> v0.36.0
  • golang.org/x/tools v0.42.0 -> v0.43.0
  • google.golang.org/api v0.273.1 -> v0.276.0
  • google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 -> v0.0.0-20260420184626-e10c466a9529
  • google.golang.org/genproto/googleapis/api v0.0.0-20260401001100-f93e5f3e9f0f -> v0.0.0-20260414002931-afd174a4e478
  • google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7 -> v0.0.0-20260414002931-afd174a4e478
  • google.golang.org/grpc v1.79.3 -> v1.80.0
  • k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 -> v0.0.0-20260319190234-28399d86e0b5

BUGS:

• vault_consul_secret_backend: Fixed validation logic to allow computed token values by correcting the condition that checks for token presence during plan phase. (#2823)
• vault_pki_external_ca_secret_backend_acme_account: Provide eab_kid and eab_key values through the ACME account creation request. ([#2851]#2852)
• provider/auth_login: Fix "Missing Region" error when using generic auth_login block for AWS authentication without explicit sts_region parameter. The provider now properly resolves AWS region from environment variables (AWS_REGION, AWS_DEFAULT_REGION) and EC2 instance metadata service (IMDS), consistent with auth_login_aws behavior. (#2786)
• provider/auth_aws: Fix auth_login_aws for Vault AWS auth backends configured with use_sts_region_from_client = true by generating a standard SigV4-signed GetCallerIdentity request with an Authorization header, and added support for custom STS endpoints. (#2841)
• resource_database_secret_backend_connection : Fixes a regression issue for resource_database_secret_backend_connection for elasticsearch. Reverted the field name from insecure_tls to insecure.
• vault_rabbitmq_secret_backend_role: Fixed spurious diff issue for vhost and vhost_topic fields by changing field type from TypeList to TypeSet. (#2872)
• provider/auth_aws: Fix auth_login_aws to avoid an unintended second STS AssumeRole call during web identity credential flows, while preserving manual role assumption for explicitly configured or env-derived aws_role_arn values in non-web-identity setups.(#2850)

Release Note:

• Vault Version Support: The Vault provider will be dropping Vault version support for Vault <= 1.18.x. This means that going forward only Vault server version 1.19.x and greater will be officially tested against.

v5.8.0

5.8.0 (March 12, 2026)

FEATURES:

• Add support for Cloudfoundry auth backend: vault_cf_auth_backend_config and vault_cf_auth_backend_role resources, and vault_cf_auth_login ephemeral resource for short-lived Vault tokens. (#2797)
• Add support for SPIFFE secrets backend. Requires Vault 2.0.0+. (#2660)
• Add support for pki-external-ca secrets backend. Requires Vault 2.0.0+. (#2771)
• Add new KMIP resources vault_kmip_secret_ca_generated, vault_kmip_secret_ca_imported, vault_kmip_secret_listener, and add support for the ca field in vault_kmip_secret_role: (#2773)
• vault_secrets_sync_azure_destination: Add support for Workload Identity Federation (WIF) fields identity_token_audience, identity_token_audience_wo_version, identity_token_ttl, and identity_token_key to enable token-based authentication with Azure. Requires Vault 2.0.0+. (#2790)
• vault_secrets_sync_aws_destination: Add support for Workload Identity Federation (WIF) fields identity_token_audience, identity_token_ttl, and identity_token_key to enable token-based authentication with AWS. Requires Vault 2.0.0+. (#2792)
• vault_secrets_sync_gcp_destination: Add support for Workload Identity Federation (WIF) fields identity_token_audience_wo, identity_token_audience_wo_version, identity_token_ttl, identity_token_key_wo, identity_token_key_wo_version and service_account_email to enable token-based authentication with GCP. Requires Vault 2.0.0+. (#2798)
• New Ephemeral Resource: Add ephemeral resource for vault_generic_secret (#2735)
• New Ephemeral Resource: Add ephemeral resource vault_terraform_token, by @drewmullen (#2616)

IMPROVEMENTS:

• vault_managed_keys: Add support for GCP Cloud KMS managed keys with parameters: credentials, project, key_ring, region, crypto_key, crypto_key_version, and algorithm. (#2769)
• vault_okta_auth_backend: Add support for write-only field api_token_wo with version counters to prevent sensitive credentials from being stored in Terraform state. Deprecate organization and token and replace with org_name and api_token respectively in vault_okta_auth_backend resource. (#2736)
• vault_kubernetes_secret_backend_role: Add support for token_default_audiences field to configure default audiences for generated Kubernetes tokens. Requires Vault 1.15+. (#2722)
• vault_raft_snapshot_agent_config: Add support for azure_auth_mode and azure_client_id fields for Azure Managed Identity authentication (Vault Enterprise 1.18.0+), and autoload_enabled field for automatic snapshot restoration (Vault Enterprise 1.21.0+). (#2758)
• vault_ssh_secret_backend_role: Add support for fields (default_extensions_template, exclude_cidr_list, port) and improve handling of key-type-specific fields (default_extensions, default_extensions_template, exclude_cidr_list, port) to prevent drift. Fields that are not applicable to a role's key type (CA or OTP) are now conditionally set in state only when returned by Vault, preventing perpetual drift when users configure fields that Vault ignores. CA key type supports: default_extensions, default_extensions_template. OTP key type supports: port, exclude_cidr_list. (#2747)
• Added remove_roots_from_chain field to vault_pki_secret_backend_root_cert and resource_pki_secret_backend_sign. (#2760)
• vault_pki_secret_backend_root_cert: Add support for use_pss and key_usage fields to configure PSS signature scheme and X.509 key usage constraints for root CA certificates. Requires Vault 1.18.0+ and 1.19.2+ respectively. (#2754)
• vault_pki_secret_backend_root_sign_intermediate: Add version check for key_usage field to ensure compatibility with Vault 1.19.2+ for configuring X.509 key usage constraints on intermediate CA certificates. (#2754)
• provider/auth_jwt: Add support for distributed_claim_access_token field in the auth_login_jwt configuration block. (#2782)
• vault_database_secret: Add support for additional credential types (rsa_private_key, client_certificate, private_key, private_key_type) in the ephemeral resource to support all database credential types available in Vault's database secrets engine. (#2767)
• vault_database_secret_backend_connection: Add support for top-level plugin_version and password_policy fields to allow configuration at the resource level in addition to engine-specific blocks. Add support for skip_static_role_import_rotation field to skip initial password rotation when creating static roles. This value is inherited by static roles that do not explicitly set skip_import_rotation. Requires Vault 1.19+ Enterprise. (#2748)
• vault_database_secret_backend_static_role: The skip_import_rotation field now correctly reads Vault's computed value into state. When not set in config, it inherits from the connection's skip_static_role_import_rotation setting. Requires Vault 1.19+ Enterprise. (#2748)
• vault_database_secret_mount: Added plugin_version,skip_static_role_import_rotation and password_policy fields to allow configuration at the resource level. (#2748)
• Updated dependencies:
  • github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 -> v1.21.0
  • github.com/aws/aws-sdk-go-v2 v1.32.5 -> v1.41.3
  • github.com/aws/aws-sdk-go-v2/service/iam v1.38.1 -> v1.53.5
  • github.com/aws/aws-sdk-go-v2/service/sts v1.33.1 -> v1.41.8
  • github.com/aws/smithy-go v1.22.1 -> v1.24.2
  • github.com/coreos/pkg v0.0.0-20230601102743-20bbbf26f4d8 -> v0.0.0-20240122114842-bbd7aa9bf6fb
  • github.com/go-viper/mapstructure/v2 v2.4.0 -> v2.5.0
  • github.com/googleapis/enterprise-certificate-proxy v0.3.12 -> v0.3.14
  • github.com/hashicorp/consul/api v1.33.0 -> v1.33.4
  • github.com/hashicorp/go-secure-stdlib/awsutil/v2 v2.1.1 -> v2.1.2
  • github.com/hashicorp/terraform-plugin-framework v1.16.1 -> v1.19.0
  • github.com/hashicorp/terraform-plugin-go v0.29.0 -> v0.31.0
  • github.com/hashicorp/terraform-plugin-mux v0.21.0 -> v0.23.0
  • github.com/hashicorp/terraform-plugin-sdk/v2 v2.38.1 -> v2.40.0
  • github.com/hashicorp/terraform-plugin-testing v1.13.3 -> v1.15.0
  • github.com/hashicorp/vault-plugin-auth-oci v0.20.0 -> v0.20.1
  • github.com/hashicorp/vault/sdk v0.22.0 -> v0.23.0
  • github.com/spiffe/go-spiffe/v2 v2.5.0 -> v2.6.0
  • golang.org/x/crypto v0.45.0 -> v0.49.0
  • golang.org/x/net v0.47.0 -> v0.52.0
  • golang.org/x/oauth2 v0.31.0 -> v0.36.0
  • golang.org/x/sync v0.19.0 -> v0.20.0
  • golang.org/x/sys v0.41.0 -> v0.42.0
  • golang.org/x/text v0.34.0 -> v0.35.0
  • golang.org/x/time v0.14.0 -> v0.15.0
  • golang.org/x/tools v0.41.0 -> v0.42.0
  • google.golang.org/api v0.251.0 -> v0.271.0
  • google.golang.org/genproto v0.0.0-20250603155806-513f23925822 -> v0.0.0-20260311181403-84a4fc48630c
  • google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 -> v0.0.0-20260226221140-a57be14db171
  • google.golang.org/genproto/googleapis/rpc v0.0.0-20260217215200-42d3e9bedb6d -> v0.0.0-20260226221140-a57be14db171
  • google.golang.org/grpc v1.79.1 -> v1.79.2
  • hashicorp/setup-terraform v3 -> v4
  • github.com/cloudflare/circl v1.6.1 -> v1.6.3
  • filippo.io/edwards25519 v1.1.0 -> v1.1.1
  • k8s.io/utils v0.0.0-20240102154912-e7106e64919e -> v0.0.0-20260210185600-b8788abfbbc2

BUGS:

• Clears the bindpass field in the state file after migrating to the write-only field in vault_ldap_auth_backend resource. (#2813)

v5.7.0

5.7.0 (February 5, 2026)

FEATURES:

• New Ephemeral Resource: vault_approle_auth_backend_role_secret_id - Generate AppRole SecretIDs on-demand with automatic cleanup. Requires Terraform 1.10+.(#2745)
• New Ephemeral Resource: Add Kubernetes service account token ephemeral resource vault_kubernetes_service_account_token: (#2712)

IMPROVEMENTS:

• vault_kmip_secret_role: Add support for additional KMIP operation fields (operation_import, operation_query, operation_encrypt, operation_decrypt, operation_create_key_pair, operation_delete_attribute, operation_rng_retrieve, operation_mac, operation_signature_verify, operation_sign, operation_rng_seed, operation_modify_attribute, operation_mac_verify, operation_rekey_key_pair) to grant granular permissions for KMIP operations. (#2744)

• vault_saml_auth_backend: Add support for validate_assertion_signature and validate_response_signature parameters to control SAML signature validation (Vault 1.19+)

• vault_approle_auth_backend_login: Add write-only fields secret_id_wo and secret_id_wo_version to support ephemeral SecretID values without persisting them in state.(#2745)

• vault_password_policy: Add field entropy_source field to specify an override to the default source of entropy (randomness) used to generate the passwords.(#2753)

• vault_mfa_totp: Add support for max_validation_attempts field to configure the maximum number of consecutive failed validation attempts allowed. (#2751)

• vault_mongodbatlas_secret_backend: Add support for write-only private key fields (private_key_wo, private_key_wo_version) to prevent sensitive credentials from being stored in Terraform state. (#2741)

• vault_consul_secret_backend: Add support for write-only fields (token_wo, token_wo_version, client_key_wo, client_key_wo_version) to prevent sensitive credentials from being stored in Terraform state. (#2730)

• vault_azure_auth_backend_config: Add support for write-only client secret fields (client_secret_wo, client_secret_wo_version) to prevent sensitive credentials from being stored in Terraform state. (#2726)

• vault_azure_secret_backend: Add support for write-only client_secret_wo and client_secret_wo_version fields to configure the client secret without storing it in state. Requires Terraform 1.11+. (#2721)

• vault_aws_secret_backend: Add write-only secret_key_wo and secret_key_wo_version fields to allow configuring the AWS secret key without storing it in Terraform state (#2713)

• vault_gcp_auth_backend: Add write-only credential support via credentials_wo and credentials_wo_version fields (#2724)

• vault_ldap_auth_backend: Add write-only field support for bindpass via bindpass_wo and bindpass_wo_version attributes (#2716)

• vault_ldap_secret_backend: Add write-only field support for bindpass via bindpass_wo and bindpass_wo_version attributes (#2719)

• vault_aws_auth_backend_client: Add write-only field support for secret_key (secret_key_wo and secret_key_wo_version) to prevent sensitive AWS credentials from being stored in Terraform state. (#2717)

• vault_jwt_auth_backend: Add support for write-only oidc_client_secret_wo and oidc_client_secret_wo_version fields to prevent storing sensitive OIDC client secrets in Terraform state. (#2714)

• vault_cert_auth_backend_role: Add support for ocsp_max_retries and ocsp_this_update_max_age fields for OCSP configuration. Requires Vault 1.16+. (#2749)

• vault_kubernetes_auth_backend_config: Add support for write-only token_reviewer_jwt_wo field with token_reviewer_jwt_wo_version to prevent sensitive JWT token from being stored in Terraform state (#2715)

• vault_kubernetes_secret_backend: Add write-only fields service_account_jwt_wo and service_account_jwt_wo_version for managing service account JWT credentials without storing them in state.(#2720)

• vault_nomad_secret_backend: Add support for write-only fields token_wo and client_key_wo with version counters to prevent sensitive credentials from being stored in Terraform state. (#2729)

• Add support for fields: context,managed_key_name,managed_key_id in vault_transit_secret_backend_key resource. (#2743)

• vault_rabbitmq_secret_backend: Add support for write-only password_wo and password_wo_version fields to configure the password without storing it in state. Requires Terraform 1.11+. (#2733)

• vault_approle_auth_backend_role_secret_id: Add support for token_bound_cidrs parameter to specify blocks of IP addresses which can use the auth tokens generated by a SecretID. (#2718)

• vault_secrets_sync_gcp_destination: Add support for replication field (replication_locations; Vault 1.18+), networking allowlist fields (allowed_ipv4_addresses, allowed_ipv6_addresses, allowed_ports, disable_strict_networking; Vault 1.19+), and encryption fields (global_kms_key, locational_kms_keys; Vault 1.19+) in vault_secrets_sync_gcp_destination resource. (#2699)

• Add support for networking allowlist fields (allowed_ipv4_addresses, allowed_ipv6_addresses, allowed_ports, disable_strict_networking) in vault_secrets_sync_azure_destination resource. Requires Vault 1.19+. (#2702)

• vault_database_secret_backend_connection: Add support for MongoDB write_concern parameter and TLS parameters (tls_ca, tls_certificate_key) (#2678)

• Add support for username_template parameter in vault_database_secret_backend_connection and vault_database_secrets_mount resource for MongoDB Atlas(#2674)

• Add support for username_template parameter in vault_database_secret_backend_connection and vault_database_secrets_mount resources for HANADB connections: (#2671)

• Add support for networking allowlist fields (allowed_ipv4_addresses, allowed_ipv6_addresses, allowed_ports, disable_strict_networking) in vault_secrets_sync_vercel_destination resource. Requires Vault 1.19+. (#2681)

• Add support for configuration parameters (allowed_ipv4_addresses,allowed_ipv6_addresses,allowed_ports,disable_strict_networking,secrets_location,environment_name) in vault_secrets_sync_gh_destination resource. Requires Vault 1.18+ for secrets_location,environment_name.Requires Vault 1.19+ for allowed_ipv4_addresses,allowed_ipv6_addresses,allowed_ports,disable_strict_networking.(#2697).

• Add support for tls_server_name , local_datacenter, socket_keep_alive, consistency and username_template parameters for Cassandra in vault_database_secret_backend_connection resource. (#2677)

• vault_secrets_sync_aws_destination: Add support for networking configuration parameters allowed_ipv4_addresses, allowed_ipv6_addresses, allowed_ports, and disable_strict_networking to control outbound connections from Vault to AWS Secrets Manager. Requires Vault 1.19.0+.(#2698)

• Updated dependencies:

  • github.com/hashicorp/go-secure-stdlib/awsutil v0.3.0 -> v2.1.1

• Docs: fix heredoc example for LDAP dynamic role LDIFs ([#2728]#2728)

• Docs: Update example to use write-only attribute ([#2731]#2731)

• Add support for local_secret_ids which may only be set at role creation. On updates the provider will send the original creation value to Vault to avoid unintentionally attempting to modify this immutable setting.The provider now surfaces Vault's native immutability error when an update attempts to change local_secret_ids.(#2723)

BUGS:

• provider/auth_login_aws: Fix issue where AWS authentication with IAM role assumption (aws_role_arn) was not working correctly due to incorrect credential handling ([#2679](https://githu...

v5.6.0

5.6.0 (December 19, 2025)

FEATURES:

• Add support for self managed workflow for rootless static roles in Oracle Secret Engine: (#2661)
• Add AWS access creds ephemeral resource: (#2659)
• Add AWS static access credentials ephemeral resource.: (#2657)
• Add GCP ephemeral resources for OAuth2 access token and service account key: (#2655)
• Add Azure access credentials ephemeral resource: (#2654)

IMPROVEMENTS:

• Added fields related to namespace used to create a role in kubernetes auth method: (#2644)

BUGS:

• Fix LDAP auth tune block read failure caused by extra /tune segment in the API request path (#2676)

v5.5.0

5.5.0 (Nov 20, 2025)

BEHAVIOR CHANGES: With v5.5.0, the default value for deny_null_bind in the vault_ldap_auth_backend resource has changed from false to true
to match with the Vault API defaults. Configurations that do not explicitly set deny_null_bind will now have it set to true upon upgrade, and
customers should verify that this change aligns with their intended LDAP authentication behavior. Furthermore, Customers should also consider
upgrading to Vault Community Edition 1.21.1 and Vault Enterprise 1.21.1, 1.20.6, 1.19.12, and 1.16.28, which no longer allows Vault to perform
unauthenticated or null binds against the LDAP server.

BUGS:

• vault_ldap_auth_backend: Fix incorrect deny_null_bind default. Set deny_null_bind to true if not provided in configuration (#2622)

FEATURES:

• Add support for alias_metadata field in auth resources (#2547)
• Add support for not_before_duration field in vault_pki_secret_backend_root_cert (#2664)

IMPROVEMENTS:

• Updated dependencies:
  • golang.org/x/crypto v0.41.0 -> v0.45.0
  • golang.org/x/net v0.43.0 -> v0.47.0
  • golang.org/x/mod v0.26.0 -> v0.29.0
  • golang.org/x/sync v0.16.0 -> v0.18.0
  • golang.org/x/sys v0.35.0 -> v0.38.0
  • golang.org/x/text v0.28.0 -> v0.31.0
  • golang.org/x/tools v0.35.0 -> v0.38.0

v5.4.0

5.4.0 (Nov 3, 2025)

BEHAVIOR CHANGES: Please refer to the upgrade topics
in the guide for details on all behavior changes.

FEATURES:

• Add support for Azure Static Secrets: (#2635)
• Add support for write-only token argument in vault_terraform_cloud_secret_backend resource (#2603)
• New parameters for vault_terraform_cloud_secret_role to support multi-team tokens, by @drewmullen (#2498)
• Add support for tune in vault_saml_auth_backend resource (#2566)
• Add support for tune in vault_ldap_auth_backend and vault_okta_auth_backend resources (#2602)
• Add support for allowed_sts_header_values parameter in vault_aws_auth_backend_client resource to specify additional headers allowed in STS requests
• New parameters for vault_gcp_secret_backend to support ttl and max_ttl, by @vijayavelsekar (#2627)
• Add support for request_timeout, dereference_aliases,enable_samaccountname_login and anonymous_group_search parameters in vault_ldap_auth_backend resource.(#2634)
• Add support for max_retries parameter in vault_aws_secret_backend resource. (#2623)
• Add support for iam_alias, iam_metadata, gce_alias and gce_metadata fields in vault_gcp_auth_backend resource (#2636)
• Add support for role_id field in vault_gcp_auth_backend_role resource (#2636)
• Add retry configuration fields (max_retries, retry_delay, max_retry_delay) to vault_azure_auth_backend_config resource for Azure API request resilience (#2629)
• Add new resources vault_spiffe_auth_backend_config and vault_spiffe_auth_backend_role (#2620)
• Add support for mfa_serial_number parameter in vault_aws_secret_backend_role resource. (#2637)
• Add support for persist_appparameters in vault_azure_secret_backend_role resource.
  (#2642)

BUGS:

• Fix pki config resources to allow unsetting of fields (to empty fields) (#2558)
• Fix tune auth mounts to allow unsetting of fields (setting fields to empty values) (#2605)
• Fix vault_pki_secret_backend_crl_config resource to allow disabling flags previously set to true (#2615)
• Fix the tune block issue where it always updates unless field values match Vault server defaults
  • vault_jwt_auth_backend resource (#2560)
  • vault_github_auth_backend and vault_auth_backend resources (#2565)
  • vault_saml_auth_backend resource (#2566)
  • vault_gcp_auth_backend and vault_oci_auth_backend resources (#2596)

v5.3.0

5.3.0 (Sep 4, 2025)

FEATURES:

• Add support for password phrases via the credential_type field in the vault_ldap_secret_backend resource (#2548)

IMPROVEMENTS:

• build(deps): bump the gomod-backward-compatible group with 5 updates: GH-2583
• Move to the standard CRT release workflow and tooling: GH-2582

BUGS:

• Fix azure_secret_backend_role to prevent persistent diff for null value on max_ttl and explicit_max_ttl argument (#2581)