Repository: hashicorp/terraform-provider-vault

Issue:
[Bug]: `Provider GetResourceIdentitySchemas Not Implemented` Error
### Terraform Core Version

1.12.2

### Terraform Vault Provider Version

5.2.0

### Vault Server Version

N/A

### Affected Resource(s)

N/A - All, provider fails on a `terraform validate`.

### Expected Behavior

Terraform runs without issue.

### Actual Behavior

Error on completion of initialization due to provider bug.

### Relevant Error/Panic Output Snippet

```shell
╷
│ Error: Failed to load plugin schemas
│ 
│ Error while loading schemas for plugin components: Failed to obtain
│ provider schema: Could not load the schema for provider
│ registry.terraform.io/hashicorp/vault: failed to retrieve schema from
│ provider "registry.terraform.io/hashicorp/vault": Provider
│ GetResourceIdentitySchemas Not Implemented: A GetResourceIdentitySchemas
│ call was received by the provider, however the provider does not implement
│ the call. Either upgrade the provider to a version that implements resource
│ identity support or this is a bug in Terraform that should be reported to
│ the Terraform maintainers...
╵
```

### Terraform Configuration Files

```
terraform {
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "= 5.2.0"
    }
  }
  required_version = ">= 1.12"
}
```

### Steps to Reproduce

* `terraform init`
* `terraform validate`

### Debug Output


```
Initializing the backend...
Initializing provider plugins...
- Finding hashicorp/vault versions matching "5.2.0"...
- Installing hashicorp/vault v5.2.0...
- Installed hashicorp/vault v5.2.0 (signed by HashiCorp)
Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.
```

```
╷
│ Error: Failed to load plugin schemas
│ 
│ Error while loading schemas for plugin components: Failed to obtain provider schema: Could not load
│ the schema for provider registry.terraform.io/hashicorp/vault: failed to retrieve schema from provider
│ "registry.terraform.io/hashicorp/vault": Provider GetResourceIdentitySchemas Not Implemented: A
│ GetResourceIdentitySchemas call was received by the provider, however the provider does not implement
│ the call. Either upgrade the provider to a version that implements resource identity support or this
│ is a bug in Terraform that should be reported to the Terraform maintainers...
╵
```

### Panic Output

_No response_

### Important Factoids

Issue should be present on terraform-provider-vault 5.2.0 and terraform v1.12+ per references.  Upgrade of `terraform-plugin-framework` (#2552) needs additional dependencies per: 
https://github.com/hashicorp/terraform-plugin-framework/issues/1148 . Updating `terraform-plugin-go` (#2570), `terraform-pluginx-mux`  (#2569) and `terraform-plugin-testing`  (v1.13.1) the provider functions correctly.

### References

https://github.com/hashicorp/terraform-plugin-framework/issues/1148

### Would you like to implement a fix?

None

Discussion:
@ravikishore-m: We ran into the same problem with Terraform **v1.12.2** when using the Vault provider — every run failed with:

```
terraform validate -no-color

Error: Failed to load plugin schemas

Error while loading schemas for plugin components: Failed to obtain provider
schema: Could not load the schema for provider
registry.terraform.io/hashicorp/vault: failed to retrieve schema from
provider "registry.terraform.io/hashicorp/vault": Provider
GetResourceIdentitySchemas Not Implemented: A GetResourceIdentitySchemas call
was received by the provider, however the provider does not implement the
call. Either upgrade the provider to a version that implements resource
identity support or this is a bug in Terraform that should be reported to the
Terraform maintainers...
```

### Workaround we applied

1. Updated `provider.tf` to explicitly pin the Vault provider:

   ```hcl
   vault = {
     source  = "hashicorp/vault"
     version = "=5.1.0"
   }
   ```
2. Cleaned up local state & lockfile:

   ```bash
   rm -rf .terraform .terraform.lock.hcl
   ```
3. Reinitialized and migrated state with upgrade:

   ```bash
   terraform init -upgrade 
   ```
4. Verified configuration:

   ```bash
   terraform validate
   ```

### Outcome

After these steps, both `terraform validate` and `terraform plan` worked again in local and dev (GitHub Actions) environments.

### Note

Pinning `=5.1.0` has been a stable interim fix, but ideally the provider should fully support `GetResourceIdentitySchemas` in newer Terraform versions.
@mocofound: @auttley , thanks for the detailed issue report.  Provider version v5.2.1, which addresses the issue, has been released.

Solution patch:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 6535f388..869898b6 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -33,7 +33,7 @@ jobs:
       # this then the terraform-plugin-sdk will attempt to download it for each test!
       - uses: hashicorp/setup-terraform@v3
         with:
-          terraform_version: '1.11.*'
+          terraform_version: '1.12.*'
           terraform_wrapper: false
 
       - name: Cache go build
@@ -165,7 +165,7 @@ jobs:
       # this then the terraform-plugin-sdk will attempt to download it for each test!
       - uses: hashicorp/setup-terraform@v3
         with:
-          terraform_version: '1.11.*'
+          terraform_version: '1.12.*'
           terraform_wrapper: false
       - name: Check Terraform CLI version
         run: terraform --version
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 27608cc2..67bd6b4a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,11 +1,16 @@
 ## Unreleased
 
+## 5.2.1 (Aug 19, 2025)
+
 BUGS:
+
+* Fix a failure to initialize the provider due to incompatible dependencies ([#2575](https://github.com/hashicorp/terraform-provider-vault/pull/2575))
 * Fix `auth_login_gcp` field constraint on field `credentials` `service_account`
 * Fix `auth_login_azure` field constraint on field `vmss_name` `tenant_id` `client_id` `scope`
 * Fix `auth_login_kerberos` field constraint on fields `username` `service` `realm` `krb5conf_path` `keytab_path` `disable_fast_negotiation` `remove_instance_name`
 * Fix `auth_login_userpass` field constraint on field `password_file`
 * Fix `auth_login` field constraint on field `use_root_namespace`
+* Fix an issue where snowflake keypair auth was not supported on Vault versions earlier than 1.20 ([#2575](https://github.com/hashicorp/terraform-provider-vault/pull/2575))
 
 ## 5.2.0 (Aug 18, 2025)
 
diff --git a/go.mod b/go.mod
index be4414fe..53f7f42f 100644
--- a/go.mod
+++ b/go.mod
@@ -28,11 +28,11 @@ require (
 	github.com/hashicorp/go-version v1.7.0
 	github.com/hashicorp/terraform-plugin-framework v1.15.1
 	github.com/hashicorp/terraform-plugin-framework-validators v0.18.0
-	github.com/hashicorp/terraform-plugin-go v0.27.0
+	github.com/hashicorp/terraform-plugin-go v0.28.0
 	github.com/hashicorp/terraform-plugin-log v0.9.0
-	github.com/hashicorp/terraform-plugin-mux v0.18.0
+	github.com/hashicorp/terraform-plugin-mux v0.20.0
 	github.com/hashicorp/terraform-plugin-sdk/v2 v2.37.0
-	github.com/hashicorp/terraform-plugin-testing v1.12.0
+	github.com/hashicorp/terraform-plugin-testing v1.13.1
 	github.com/hashicorp/vault-plugin-auth-jwt v0.20.3
 	github.com/hashicorp/vault-plugin-auth-kerberos v0.11.0
 	github.com/hashicorp/vault-plugin-auth-oci v0.15.1
diff --git a/go.sum b/go.sum
index 2d39c5ce..acbc15b3 100644
--- a/go.sum
+++ b/go.sum
@@ -2131,16 +2131,16 @@ github.com/hashicorp/terraform-plugin-framework v1.15.1 h1:2mKDkwb8rlx/tvJTlIcpw
 github.com/hashicorp/terraform-plugin-framework v1.15.1/go.mod h1:hxrNI/GY32KPISpWqlCoTLM9JZsGH3CyYlir09bD/fI=
 github.com/hashicorp/terraform-plugin-framework-validators v0.18.0 h1:OQnlOt98ua//rCw+QhBbSqfW3QbwtVrcdWeQN5gI3Hw=
 github.com/hashicorp/terraform-plugin-framework-validators v0.18.0/go.mod h1:lZvZvagw5hsJwuY7mAY6KUz45/U6fiDR0CzQAwWD0CA=
-github.com/hashicorp/terraform-plugin-go v0.27.0 h1:ujykws/fWIdsi6oTUT5Or4ukvEan4aN9lY+LOxVP8EE=
-github.com/hashicorp/terraform-plugin-go v0.27.0/go.mod h1:FDa2Bb3uumkTGSkTFpWSOwWJDwA7bf3vdP3ltLDTH6o=
+github.com/hashicorp/terraform-plugin-go v0.28.0 h1:zJmu2UDwhVN0J+J20RE5huiF3XXlTYVIleaevHZgKPA=
+github.com/hashicorp/terraform-plugin-go v0.28.0/go.mod h1:FDa2Bb3uumkTGSkTFpWSOwWJDwA7bf3vdP3ltLDTH6o=
 github.com/hashicorp/terraform-plugin-log v0.9.0 h1:i7hOA+vdAItN1/7UrfBqBwvYPQ9TFvymaRGZED3FCV0=
 github.com/hashicorp/terraform-plugin-log v0.9.0/go.mod h1:rKL8egZQ/eXSyDqzLUuwUYLVdlYeamldAHSxjUFADow=
-github.com/hashicorp/terraform-plugin-mux v0.18.0 h1:7491JFSpWyAe0v9YqBT+kel7mzHAbO5EpxxT0cUL/Ms=
-github.com/hashicorp/terraform-plugin-mux v0.18.0/go.mod h1:Ho1g4Rr8qv0qTJlcRKfjjXTIO67LNbDtM6r+zHUNHJQ=
+github.com/hashicorp/terraform-plugin-mux v0.20.0 h1:3QpBnI9uCuL0Yy2Rq/kR9cOdmOFNhw88A2GoZtk5aXM=
+github.com/hashicorp/terraform-plugin-mux v0.20.0/go.mod h1:wSIZwJjSYk86NOTX3fKUlThMT4EAV1XpBHz9SAvjQr4=
 github.com/hashicorp/terraform-plugin-sdk/v2 v2.37.0 h1:NFPMacTrY/IdcIcnUB+7hsore1ZaRWU9cnB6jFoBnIM=
 github.com/hashicorp/terraform-plugin-sdk/v2 v2.37.0/go.mod h1:QYmYnLfsosrxjCnGY1p9c7Zj6n9thnEE+7RObeYs3fA=
-github.com/hashicorp/terraform-plugin-testing v1.12.0 h1:tpIe+T5KBkA1EO6aT704SPLedHUo55RenguLHcaSBdI=
-github.com/hashicorp/terraform-plugin-testing v1.12.0/go.mod h1:jbDQUkT9XRjAh1Bvyufq+PEH1Xs4RqIdpOQumSgSXBM=
+github.com/hashicorp/terraform-plugin-testing v1.13.1 h1:0nhSm8lngGTggqXptU4vunFI0S2XjLAhJg3RylC5aLw=
+github.com/hashicorp/terraform-plugin-testing v1.13.1/go.mod h1:b/hl6YZLm9fjeud/3goqh/gdqhZXbRfbHMkEiY9dZwc=
 github.com/hashicorp/terraform-registry-address v0.2.5 h1:2GTftHqmUhVOeuu9CW3kwDkRe4pcBDq0uuK5VJngU1M=
 github.com/hashicorp/terraform-registry-address v0.2.5/go.mod h1:PpzXWINwB5kuVS5CA7m1+eO2f1jKb5ZDIxrOPfpnGkg=
 github.com/hashicorp/terraform-svchost v0.1.1 h1:EZZimZ1GxdqFRinZ1tpJwVxxt49xc/S52uzrw4x0jKQ=
diff --git a/vault/resource_database_secret_backend_connection.go b/vault/resource_database_secret_backend_connection.go
index 0d979137..9003b294 100644
--- a/vault/resource_database_secret_backend_connection.go
+++ b/vault/resource_database_secret_backend_connection.go
@@ -1890,14 +1890,12 @@ func setDatabaseConnectionDataWithUserAndPrivateKey(d *schema.ResourceData, pref
 		// construct path to use GetRawConfig
 		path := cty.GetAttrPath(engineName).IndexInt(idx).GetAttr(consts.FieldPrivateKeyWO)
 
-		// ensure Vault version has private key support
-		vaultVersion120Check := provider.IsAPISupported(meta, provider.VaultVersion120)
-
 		if pwWo, _ := d.GetRawConfigAt(path); !pwWo.IsNull() {
-			if vaultVersion120Check {
+			// ensure Vault version has private key support
+			if provider.IsAPISupported(meta, provider.VaultVersion116) {
 				data[consts.FieldPrivateKey] = pwWo.AsString()
 			} else {
-				log.Printf("[WARN] field %q can only be used with Vault version %s or newer", consts.FieldPrivateKeyWO, provider.VaultVersion120)
+				log.Printf("[WARN] field %q can only be used with Vault version %s or newer", consts.FieldPrivateKeyWO, provider.VaultVersion116)
 			}
 		}
 	}



Test patch:
diff --git a/vault/resource_database_secret_backend_connection_test.go b/vault/resource_database_secret_backend_connection_test.go
index 6fbf545d..f6b82058 100644
--- a/vault/resource_database_secret_backend_connection_test.go
+++ b/vault/resource_database_secret_backend_connection_test.go
@@ -1191,7 +1191,7 @@ func TestAccDatabaseSecretBackendConnection_snowflake_keypair(t *testing.T) {
 		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
-			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion120)
+			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion116)
 		},
 		CheckDestroy: testAccDatabaseSecretBackendConnectionCheckDestroy,
 		Steps: []resource.TestStep{