Repository: hashicorp/terraform-provider-vault

Issue:
Feature Request: Add resources to configure OCI auth backend
I would like to see support for configuring the OCI (Oracle Cloud Infrastructure) auth backend using this provider.

I believe the following resources would allow one to completely manage the auth backend using terraform:
- `vault_oci_auth_backend_config`
- `vault_oci_auth_backend_role`

Discussion:

Solution patch:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4937474d..c4ced061 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,7 @@ FEATURES:
 * Add support for `jwks_pairs` in `vault_jwt_auth_backend` resource. Requires Vault 1.16+ ([#2523](https://github.com/hashicorp/terraform-provider-vault/pull/2523))
 * Add support for `root_password_ttl` in `vault_azure_secret_backend` resource. Requires Vault 1.15+ ([#2529](https://github.com/hashicorp/terraform-provider-vault/pull/2529))
 * Add support for managed key parameters in the SSH CA config endpoint ([#2480](https://github.com/hashicorp/terraform-provider-vault/pull/2480))
+* Add new resources `vault_oci_auth_backend` and `vault_oci_auth_backend_role` to manage OCI auth backend and roles. ([#1761](https://github.com/hashicorp/terraform-provider-vault/pull/1761))
 
 ## 5.1.0 (Jul 9, 2025)
 
diff --git a/internal/consts/consts.go b/internal/consts/consts.go
index 53e3169e..534b242d 100644
--- a/internal/consts/consts.go
+++ b/internal/consts/consts.go
@@ -14,465 +14,465 @@ const (
 	FieldPath = "path"
 	// FieldMount should be used for all new non-backend-mounting resources.
 	// In other words, resources that depend on a backend-mounting resource should use this.
-	FieldMount                         = "mount"
-	FieldBindDN                        = "binddn"
-	FieldBindPass                      = "bindpass"
-	FieldCertificate                   = "certificate"
-	FieldClientTLSCert                 = "client_tls_cert"
-	FieldClientTLSKey                  = "client_tls_key"
-	FieldDistinguishedNames            = "distinguished_names"
-	FieldUPNDomain                     = "upndomain"
-	FieldStartTLS                      = "starttls"
-	FieldConnectionTimeout             = "connection_timeout"
-	FieldRequestTimeout                = "request_timeout"
-	FieldSchema                        = "schema"
-	FieldPasswordPolicy                = "password_policy"
-	FieldLength                        = "length"
-	FieldInsecureTLS                   = "insecure_tls"
-	FieldURL                           = "url"
-	FieldUserAttr                      = "userattr"
-	FieldUserDN                        = "userdn"
-	FieldRotationPeriod                = "rotation_period"
-	FieldPaths                         = "paths"
-	FieldParameters                    = "parameters"
-	FieldMethod                        = "method"
-	FieldNamespace                     = "namespace"
-	FieldUseRootNamespace              = "use_root_namespace"
-	FieldNamespaceID                   = "namespace_id"
-	FieldNamespacePath                 = "namespace_path"
-	FieldPathFQ                        = "path_fq"
-	FieldPathsFQ                       = "paths_fq"
-	FieldData                          = "data"
-	FieldDisableRead                   = "disable_read"
-	FieldName                          = "name"
-	FieldVersion                       = "version"
-	FieldMetadata                      = "metadata"
-	FieldNames                         = "names"
-	FieldLeaseID                       = "lease_id"
-	FieldLeaseDuration                 = "lease_duration"
-	FieldLeaseRenewable                = "lease_renewable"
-	FieldDepth                         = "depth"
-	FieldDataJSON                      = "data_json"
-	FieldDN                            = "dn"
-	FieldRole                          = "role"
-	FieldRoles                         = "roles"
-	FieldDescription                   = "description"
-	FieldTTL                           = "ttl"
-	FieldMaxTTL                        = "max_ttl"
-	FieldDefaultLeaseTTL               = "default_lease_ttl_seconds"
-	FieldDefaultTTL                    = "default_ttl"
-	FieldMaxLeaseTTL                   = "max_lease_ttl_seconds"
-	FieldAuditNonHMACRequestKeys       = "audit_non_hmac_request_keys"
-	FieldAuditNonHMACResponseKeys      = "audit_non_hmac_response_keys"
-	FieldLastPassword                  = "last_password"
-	FieldLastVaultRotation             = "last_vault_rotation"
-	FieldLocal                         = "local"
-	FieldSealWrap                      = "seal_wrap"
-	FieldExternalEntropyAccess         = "external_entropy_access"
-	FieldAWS                           = "aws"
-	FieldPKCS                          = "pkcs"
-	FieldAzure                         = "azure"
-	FieldLibrary                       = "library"
-	FieldKeyLabel                      = "key_label"
-	FieldKeyID                         = "key_id"
-	FieldMechanism                     = "mechanism"
-	FieldPin                           = "pin"
-	FieldSlot                          = "slot"
-	FieldTokenLabel                    = "token_label"
-	FieldCurve                         = "curve"
-	FieldKeyBits                       = "key_bits"
-	FieldSignatureBits                 = "signature_bits"
-	FieldSKID                          = "skid"
-	FieldUsePSS                        = "use_pss"
-	FieldForceRWSession                = "force_rw_session"
-	FieldAccessKey                     = "access_key"
-	FieldSecretKey                     = "secret_key"
-	FieldEndpoint                      = "endpoint"
-	FieldKeyType                       = "key_type"
-	FieldKMSKey                        = "kms_key"
-	FieldRegion                        = "region"
-	FieldTenantID                      = "tenant_id"
-	FieldClientID                      = "client_id"
-	FieldClientSecret                  = "client_secret"
-	FieldEnvironment                   = "environment"
-	FieldVaultName                     = "vault_name"
-	FieldKeyName                       = "key_name"
-	FieldResource                      = "resource"
-	FieldAllowGenerateKey              = "allow_generate_key"
-	FieldAllowReplaceKey               = "allow_replace_key"
-	FieldAllowStoreKey                 = "allow_store_key"
-	FieldAnyMount                      = "any_mount"
-	FieldID                            = "id"
-	FieldUUID                          = "uuid"
-	FieldMountAccessor                 = "mount_accessor"
-	FieldUsername                      = "username"
-	FieldPassword                      = "password"
-	FieldPasswordFile                  = "password_file"
-	FieldClientAuth                    = "client_auth"
-	FieldAuthLoginGeneric              = "auth_login"
-	FieldAuthLoginUserpass             = "auth_login_userpass"
-	FieldAuthLoginAWS                  = "auth_login_aws"
-	FieldAuthLoginCert                 = "auth_login_cert"
-	FieldAuthLoginGCP                  = "auth_login_gcp"
-	FieldAuthLoginKerberos             = "auth_login_kerberos"
-	FieldAuthLoginRadius               = "auth_login_radius"
-	FieldAuthLoginOCI                  = "auth_login_oci"
-	FieldAuthLoginOIDC                 = "auth_login_oidc"
-	FieldAuthLoginJWT                  = "auth_login_jwt"
-	FieldAuthLoginAzure                = "auth_login_azure"
-	FieldAuthLoginTokenFile            = "auth_login_token_file"
-	FieldIAMHttpRequestMethod          = "iam_http_request_method"
-	FieldIAMRequestURL                 = "iam_request_url"
-	FieldIAMRequestBody                = "iam_request_body"
-	FieldIAMRequestHeaders             = "iam_request_headers"
-	FieldAWSAccessKeyID                = "aws_access_key_id"
-	FieldAWSSecretAccessKey            = "aws_secret_access_key"
-	FieldAWSSessionToken               = "aws_session_token"
-	FieldAWSRoleARN                    = "aws_role_arn"
-	FieldAWSRoleSessionName            = "aws_role_session_name"
-	FieldAWSWebIdentityTokenFile       = "aws_web_identity_token_file"
-	FieldAWSSTSEndpoint                = "aws_sts_endpoint"
-	FieldAWSIAMEndpoint                = "aws_iam_endpoint"
-	FieldAWSProfile                    = "aws_profile"
-	FieldAWSRegion                     = "aws_region"
-	FieldAWSSharedCredentialsFile      = "aws_shared_credentials_file"
-	FieldHeaderValue                   = "header_value"
-	FieldDisableRemount                = "disable_remount"
-	FieldCACertFile                    = "ca_cert_file"
-	FieldCACertDir                     = "ca_cert_dir"
-	FieldCertFile                      = "cert_file"
-	FieldKeyFile                       = "key_file"
-	FieldSkipTLSVerify                 = "skip_tls_verify"
-	FieldTLSServerName                 = "tls_server_name"
-	FieldAddress                       = "address"
-	FieldJWT                           = "jwt"
-	FieldCredentials                   = "credentials"
-	FieldClientEmail                   = "client_email"
-	FieldServiceAccount                = "service_account"
-	FieldAuthorization                 = "authorization"
-	FieldToken                         = "token"
-	FieldService                       = "service"
-	FieldRealm                         = "realm"
-	FieldKeytabPath                    = "keytab_path"
-	FieldKRB5ConfPath                  = "krb5conf_path"
-	FieldDisableFastNegotiation        = "disable_fast_negotiation"
-	FieldRemoveInstanceName            = "remove_instance_name"
-	FieldAuthType                      = "auth_type"
-	FieldRequestHeaders                = "request_headers"
-	FieldCallbackAddress               = "callback_address"
-	FieldCallbackListenerAddress       = "callback_listener_address"
-	FieldScope                         = "scope"
-	FieldSubscriptionID                = "subscription_id"
-	FieldResourceGroupName             = "resource_group_name"
-	FieldVMName                        = "vm_name"
-	FieldVMSSName                      = "vmss_name"
-	FieldUsernameFormat                = "username_format"
-	FieldIntegrationKey                = "integration_key"
-	FieldAPIHostname                   = "api_hostname"
-	FieldPushInfo                      = "push_info"
-	FieldUsePasscode                   = "use_passcode"
-	FieldIssuer                        = "issuer"
-	FieldPeriod                        = "period"
-	FieldKeySize                       = "key_size"
-	FieldQRSize                        = "qr_size"
-	FieldAlgorithm                     = "algorithm"
-	FieldDigits                        = "digits"
-	FieldSkew                          = "skew"
-	FieldMaxValidationAttempts         = "max_validation_attempts"
-	FieldOrgName                       = "org_name"
-	FieldAPIToken                      = "api_token"
-	FieldBaseURL                       = "base_url"
-	FieldPrimaryEmail                  = "primary_email"
-	FieldSettingsFileBase64            = "settings_file_base64"
-	FieldUseSignature                  = "use_signature"
-	FieldIdpURL                        = "idp_url"
-	FieldAdminURL                      = "admin_url"
-	FieldAuthenticatorURL              = "authenticator_url"
-	FieldOrgAlias                      = "org_alias"
-	FieldType                          = "type"
-	FieldMethodID                      = "method_id"
-	FieldMFAMethodIDs                  = "mfa_method_ids"
-	FieldAccessors                     = "accessors"
-	FieldAuthMethodAccessors           = "auth_method_accessors"
-	FieldAuthMethodTypes               = "auth_method_types"
-	FieldIdentityGroupIDs              = "identity_group_ids"
-	FieldIdentityEntityIDs             = "identity_entity_ids"
-	FieldWrappingAccessor              = "wrapping_accessor"
-	FieldRoleName                      = "role_name"
-	FieldPolicies                      = "policies"
-	FieldNoParent                      = "no_parent"
-	FieldNoDefaultPolicy               = "no_default_policy"
-	FieldRenewable                     = "renewable"
-	FieldExplicitMaxTTL                = "explicit_max_ttl"
-	FieldWrappingTTL                   = "wrapping_ttl"
-	FieldDisplayName                   = "display_name"
-	FieldNumUses                       = "num_uses"
-	FieldRenewMinLease                 = "renew_min_lease"
-	FieldRenewIncrement                = "renew_increment"
-	FieldLeaseStarted                  = "lease_started"
-	FieldClientToken                   = "client_token"
-	FieldWrappedToken                  = "wrapped_token"
-	FieldOrphan                        = "orphan"
-	FieldVaultVersionOverride          = "vault_version_override"
-	FieldSkipGetVaultVersion           = "skip_get_vault_version"
-	FieldMemberEntityIDs               = "member_entity_ids"
-	FieldMemberGroupIDs                = "member_group_ids"
-	FieldExclusive                     = "exclusive"
-	FieldGroupID                       = "group_id"
-	FieldGroupName                     = "group_name"
-	FieldExternal                      = "external"
-	FieldExternalValidation            = "external_validation"
-	FieldInternal                      = "internal"
-	FieldFailureTolerance              = "failure_tolerance"
-	FieldHealthy                       = "healthy"
-	FieldLeader                        = "leader"
-	FieldOptimisticFailureTolerance    = "optimistic_failure_tolerance"
-	FieldVoters                        = "voters"
-	FieldRedundancyZones               = "redundancy_zones"
-	FieldRedundancyZonesJSON           = "redundancy_zones_json"
-	FieldServers                       = "servers"
-	FieldServersJSON                   = "servers_json"
-	FieldUpgradeInfo                   = "upgrade_info"
-	FieldUpgradeInfoJSON               = "upgrade_info_json"
-	FieldMaxVersions                   = "max_versions"
-	FieldCASRequired                   = "cas_required"
-	FieldDeleteVersionAfter            = "delete_version_after"
-	FieldCustomMetadata                = "custom_metadata"
-	FieldCustomMetadataJSON            = "custom_metadata_json"
-	FieldIAMAlias                      = "iam_alias"
-	FieldIAMMetadata                   = "iam_metadata"
-	FieldEC2Alias                      = "ec2_alias"
-	FieldEC2Metadata                   = "ec2_metadata"
-	FieldPublicKey                     = "public_key"
-	FieldPrivateKey                    = "private_key"
-	FieldImpersonatedAccount           = "impersonated_account"
-	FieldServiceAccountEmail           = "service_account_email"
-	FieldTokenScopes                   = "token_scopes"
-	FieldServiceAccountProject         = "service_account_project"
-	FieldOrganizationID                = "organization_id"
-	FieldProjectID                     = "project_id"
-	FieldIPAddresses                   = "ip_addresses"
-	FieldCIDRBlocks                    = "cidr_blocks"
-	FieldProjectRoles                  = "project_roles"
-	FieldCreationLDIF                  = "creation_ldif"
-	FieldDeletionLDIF                  = "deletion_ldif"
-	FieldRollbackLDIF                  = "rollback_ldif"
-	FieldUsernameTemplate              = "username_template"
-	FieldServiceAccountNames           = "service_account_names"
-	FieldDisableCheckInEnforcement     = "disable_check_in_enforcement"
-	FieldSkipChildToken                = "skip_child_token"
-	FieldTokenPolicies                 = "token_policies"
-	FieldManagedKeyName                = "managed_key_name"
-	FieldManagedKeyID                  = "managed_key_id"
-	FieldIssuerRef                     = "issuer_ref"
-	FieldAllowLocalhost                = "allow_localhost"
-	FieldAllowedDomains                = "allowed_domains"
-	FieldAllowedDomainsTemplate        = "allowed_domains_template"
-	FieldAllowedDigestAlgorithms       = "allowed_digest_algorithms"
-	FieldAllowedEncryptionAlgorithms   = "allowed_encryption_algorithms"
-	FieldAllowBareDomains              = "allow_bare_domains"
-	FieldAllowSubdomains               = "allow_subdomains"
-	FieldAllowGlobDomains              = "allow_glob_domains"
-	FieldAllowAnyName                  = "allow_any_name"
-	FieldEnforceHostnames              = "enforce_hostnames"
-	FieldAllowIPSans                   = "allow_ip_sans"
-	FieldAllowedURISans                = "allowed_uri_sans"
-	FieldAllowedURISansTemplate        = "allowed_uri_sans_template"
-	FieldAllowedUserIds                = "allowed_user_ids"
-	FieldAllowWildcardCertificates     = "allow_wildcard_certificates"
-	FieldAllowedOtherSans              = "allowed_other_sans"
-	FieldServerFlag                    = "server_flag"
-	FieldClientFlag                    = "client_flag"
-	FieldCodeSigningFlag               = "code_signing_flag"
-	FieldEmailProtectionFlag           = "email_protection_flag"
-	FieldKeyUsage                      = "key_usage"
-	FieldExtKeyUsage                   = "ext_key_usage"
-	FieldExtKeyUsageOIDs               = "ext_key_usage_oids"
-	FieldUseCSRCommonName              = "use_csr_common_name"
-	FieldUseCSRSans                    = "use_csr_sans"
-	FieldOU                            = "ou"
-	FieldOrganization                  = "organization"
-	FieldCountry                       = "country"
-	FieldLocality                      = "locality"
-	FieldProvince                      = "province"
-	FieldStreetAddress                 = "street_address"
-	FieldPostalCode                    = "postal_code"
-	FieldGenerateLease                 = "generate_lease"
-	FieldNoStore                       = "no_store"
-	FieldRequireCN                     = "require_cn"
-	FieldPolicyIdentifiers             = "policy_identifiers"
-	FieldPolicyIdentifier              = "policy_identifier"
-	FieldBasicConstraintsValidForNonCA = "basic_constraints_valid_for_non_ca"
-	FieldNotBeforeDuration             = "not_before_duration"
-	FieldAllowedSerialNumbers          = "allowed_serial_numbers"
-	FieldOID                           = "oid"
-	FieldCPS                           = "cps"
-	FieldNotice                        = "notice"
-	FieldCommonName                    = "common_name"
-	FieldAltNames                      = "alt_names"
-	FieldFormat                        = "format"
-	FieldPrivateKeyFormat              = "private_key_format"
-	FieldOu                            = "ou"
-	FieldIssuingCA                     = "issuing_ca"
-	FieldSerial                        = "serial"
-	FieldSerialNumber                  = "serial_number"
-	FieldIPSans                        = "ip_sans"
-	FieldURISans                       = "uri_sans"
-	FieldOtherSans                     = "other_sans"
-	FieldMaxPathLength                 = "max_path_length"
-	FieldExcludeCNFromSans             = "exclude_cn_from_sans"
-	FieldPermittedDNSDomains           = "permitted_dns_domains"
-	FieldExcludedDNSDomains            = "excluded_dns_domains"
-	FieldPermittedIPRanges             = "permitted_ip_ranges"
-	FieldExcludedIPRanges              = "excluded_ip_ranges"
-	FieldPermittedEmailAddresses       = "permitted_email_addresses"
-	FieldExcludedEmailAddresses        = "excluded_email_addresses"
-	FieldPermittedURIDomains           = "permitted_uri_domains"
-	FieldExcludedURIDomains            = "excluded_uri_domains"
-	FieldIssuerName                    = "issuer_name"
-	FieldUserIds                       = "user_ids"
-	FieldIssuerID                      = "issuer_id"
-	FieldKeyRef                        = "key_ref"
-	FieldPemBundle                     = "pem_bundle"
-	FieldCAChain                       = "ca_chain"
-	FieldRestrictCAChainToIssuer       = "restrict_ca_chain_to_issuer"
-	FieldCSR                           = "csr"
-	FieldUseCSRValues                  = "use_csr_values"
-	FieldCertificateBundle             = "certificate_bundle"
-	FieldRevoke                        = "revoke"
-	FieldRevokeWithKey                 = "revoke_with_key"
-	FieldPrivateKeyType                = "private_key_type"
-	FieldAddBasicConstraints           = "add_basic_constraints"
-	FieldExported                      = "exported"
-	FieldExpiration                    = "expiration"
-	FieldAutoRenew                     = "auto_renew"
-	FieldMinSecondsRemaining           = "min_seconds_remaining"
-	FieldRenewPending                  = "renew_pending"
-	FieldImportedIssuers               = "imported_issuers"
-	FieldImportedKeys                  = "imported_keys"
-	FieldExisting                      = "existing"
-	FieldLeafNotAfterBehavior          = "leaf_not_after_behavior"
-	FieldManualChain                   = "manual_chain"
-	FieldUsage                         = "usage"
-	FieldKeys                          = "keys"
-	FieldKeyInfo                       = "key_info"
-	FieldKeyInfoJSON                   = "key_info_json"
-	FieldRevocationSignatureAlgorithm  = "revocation_signature_algorithm"
-	FieldIssuingCertificates           = "issuing_certificates"
-	FieldCRLDistributionPoints         = "crl_distribution_points"
-	FieldOCSPServers                   = "ocsp_servers"
-	FieldEnableAIAURLTemplating        = "enable_aia_url_templating"
-	FieldCredentialConfig              = "credential_config"
-	FieldDBName                        = "db_name"
-	FieldCreationStatements            = "creation_statements"
-	FieldRevocationStatements          = "revocation_statements"
-	FieldRollbackStatements            = "rollback_statements"
-	FieldRenewStatements               = "renew_statements"
-	FieldCredentialType                = "credential_type"
-	FieldFilename                      = "filename"
-	FieldDefault                       = "default"
-	FieldRotationStatements            = "rotation_statements"
-	FieldRotationSchedule              = "rotation_schedule"
-	FieldRotationWindow                = "rotation_window"
-	FieldKubernetesCACert              = "kubernetes_ca_cert"
-	FieldDisableLocalCAJWT             = "disable_local_ca_jwt"
-	FieldKubernetesHost                = "kubernetes_host"
-	FieldServiceAccountJWT             = "service_account_jwt"
-	FieldDisableISSValidation          = "disable_iss_validation"
-	FieldPEMKeys                       = "pem_keys"
-	FieldSetNamespaceFromToken         = "set_namespace_from_token"
-	FieldAzureRoles                    = "azure_roles"
-	FieldRoleID                        = "role_id"
-	FieldAzureGroups                   = "azure_groups"
-	FieldObjectID                      = "object_id"
-	FieldApplicationObjectID           = "application_object_id"
-	FieldPermanentlyDelete             = "permanently_delete"
-	FieldSignInAudience                = "sign_in_audience"
-	FieldTags                          = "tags"
-	FieldSkipStaticRoleImportRotation  = "skip_static_role_import_rotation"
-	FieldSkipImportRotation            = "skip_import_rotation"
-	FieldCustomTags                    = "custom_tags"
-	FieldSecretNameTemplate            = "secret_name_template"
-	FieldIAMEndpoint                   = "iam_endpoint"
-	FieldSTSEndpoint                   = "sts_endpoint"
-	FieldSTSFallbackEndpoints          = "sts_fallback_endpoints"
-	FieldIdentityTokenAudience         = "identity_token_audience"
-	FieldIdentityTokenTTL              = "identity_token_ttl"
-	FieldRoleArn                       = "role_arn"
-	FieldAccessor                      = "accessor"
-	FieldOptions                       = "options"
-	FieldAllowedManagedKeys            = "allowed_managed_keys"
-	FieldIdentityTokenKey              = "identity_token_key"
-	FieldCIDRList                      = "cidr_list"
-	FieldSecretID                      = "secret_id"
-	FieldWrappingToken                 = "wrapping_token"
-	FieldWithWrappedAccessor           = "with_wrapped_accessor"
-	FieldExternalID                    = "external_id"
-	FieldAppName                       = "app_name"
-	FieldInstallationID                = "installation_id"
-	FieldAppID                         = "app_id"
-	FieldAIAPath                       = "aia_path"
-	FieldTLSMinVersion                 = "tls_min_version"
-	FieldTLSMaxVersion                 = "tls_max_version"
-	FieldCaseSensitiveNames            = "case_sensitive_names"
-	FieldMaxPageSize                   = "max_page_size"
-	FieldUserFilter                    = "userfilter"
-	FieldDiscoverDN                    = "discoverdn"
-	FieldDenyNullBind                  = "deny_null_bind"
-	FieldGroupFilter                   = "groupfilter"
-	FieldGroupDN                       = "groupdn"
-	FieldGroupAttr                     = "groupattr"
-	FieldUsernameAsAlias               = "username_as_alias"
-	FieldUseTokenGroups                = "use_token_groups"
-	FieldTitle                         = "title"
-	FieldMessageBase64                 = "message_base64"
-	FieldAuthenticated                 = "authenticated"
-	FieldStartTime                     = "start_time"
-	FieldEndTime                       = "end_time"
-	FieldLink                          = "link"
-	FieldGranularity                   = "granularity"
-	FieldGranularityLevel              = "granularity_level"
-	FieldEC2Endpoint                   = "ec2_endpoint"
-	FieldSTSRegion                     = "sts_region"
-	FieldSTSFallbackRegions            = "sts_fallback_regions"
-	FieldIAMServerIDHeaderValue        = "iam_server_id_header_value"
-	FieldListingVisibility             = "listing_visibility"
-	FieldPassthroughRequestHeaders     = "passthrough_request_headers"
-	FieldAllowedResponseHeaders        = "allowed_response_headers"
-	FieldDelegatedAuthAccessors        = "delegated_auth_accessors"
-	FieldPluginVersion                 = "plugin_version"
-	FieldEnabled                       = "enabled"
-	FieldDefaultMount                  = "default_mount"
-	FieldDefaultPathPolicy             = "default_path_policy"
-	FieldLabelToPathPolicy             = "label_to_path_policy"
-	FieldAuthenticators                = "authenticators"
-	FieldEnableSentinelParsing         = "enable_sentinel_parsing"
-	FieldAuditFields                   = "audit_fields"
-	FieldDisabledValidations           = "disabled_validations"
-	FieldLastUpdated                   = "last_updated"
-	FieldCustomEndpoint                = "custom_endpoint"
-	FieldPrivateKeyID                  = "private_key_id"
-	FieldTune                          = "tune"
-	FieldMaxRetries                    = "max_retries"
-	FieldSessionTags                   = "session_tags"
-	FieldSelfManagedPassword           = "self_managed_password"
-	FieldAllowedIssuers                = "allowed_issuers"
-	FieldAllowedRoles                  = "allowed_roles"
-	FieldAllowRoleExtKeyUsage          = "allow_role_ext_key_usage"
-	FieldDefaultDirectoryPolicy        = "default_directory_policy"
-	FieldDnsResolver                   = "dns_resolver"
-	FieldEabPolicy                     = "eab_policy"
-	FieldCnValidations                 = "cn_validations"
-	FieldsCreatedOn                    = "created_on"
-	FieldEabKey                        = "key"
-	FieldAcmeDirectory                 = "acme_directory"
-	FieldEabId                         = "eab_id"
-	FieldAssumeRoleArn                 = "assume_role_arn"
-	FieldAssumeRoleSessionName         = "assume_role_session_name"
-	FieldMaxCrlEntries                 = "max_crl_entries"
-	FieldChallenge                     = "challenge"
-	FieldRootPasswordTTL               = "root_password_ttl"
-
+	FieldMount                          = "mount"
+	FieldBindDN                         = "binddn"
+	FieldBindPass                       = "bindpass"
+	FieldCertificate                    = "certificate"
+	FieldClientTLSCert                  = "client_tls_cert"
+	FieldClientTLSKey                   = "client_tls_key"
+	FieldDistinguishedNames             = "distinguished_names"
+	FieldUPNDomain                      = "upndomain"
+	FieldStartTLS                       = "starttls"
+	FieldConnectionTimeout              = "connection_timeout"
+	FieldRequestTimeout                 = "request_timeout"
+	FieldSchema                         = "schema"
+	FieldPasswordPolicy                 = "password_policy"
+	FieldLength                         = "length"
+	FieldInsecureTLS                    = "insecure_tls"
+	FieldURL                            = "url"
+	FieldUserAttr                       = "userattr"
+	FieldUserDN                         = "userdn"
+	FieldRotationPeriod                 = "rotation_period"
+	FieldPaths                          = "paths"
+	FieldParameters                     = "parameters"
+	FieldMethod                         = "method"
+	FieldNamespace                      = "namespace"
+	FieldUseRootNamespace               = "use_root_namespace"
+	FieldNamespaceID                    = "namespace_id"
+	FieldNamespacePath                  = "namespace_path"
+	FieldPathFQ                         = "path_fq"
+	FieldPathsFQ                        = "paths_fq"
+	FieldData                           = "data"
+	FieldDisableRead                    = "disable_read"
+	FieldName                           = "name"
+	FieldVersion                        = "version"
+	FieldMetadata                       = "metadata"
+	FieldNames                          = "names"
+	FieldLeaseID                        = "lease_id"
+	FieldLeaseDuration                  = "lease_duration"
+	FieldLeaseRenewable                 = "lease_renewable"
+	FieldDepth                          = "depth"
+	FieldDataJSON                       = "data_json"
+	FieldDN                             = "dn"
+	FieldRole                           = "role"
+	FieldRoles                          = "roles"
+	FieldDescription                    = "description"
+	FieldTTL                            = "ttl"
+	FieldMaxTTL                         = "max_ttl"
+	FieldDefaultLeaseTTL                = "default_lease_ttl_seconds"
+	FieldDefaultTTL                     = "default_ttl"
+	FieldMaxLeaseTTL                    = "max_lease_ttl_seconds"
+	FieldAuditNonHMACRequestKeys        = "audit_non_hmac_request_keys"
+	FieldAuditNonHMACResponseKeys       = "audit_non_hmac_response_keys"
+	FieldLastPassword                   = "last_password"
+	FieldLastVaultRotation              = "last_vault_rotation"
+	FieldLocal                          = "local"
+	FieldSealWrap                       = "seal_wrap"
+	FieldExternalEntropyAccess          = "external_entropy_access"
+	FieldAWS                            = "aws"
+	FieldPKCS                           = "pkcs"
+	FieldAzure                          = "azure"
+	FieldLibrary                        = "library"
+	FieldKeyLabel                       = "key_label"
+	FieldKeyID                          = "key_id"
+	FieldMechanism                      = "mechanism"
+	FieldPin                            = "pin"
+	FieldSlot                           = "slot"
+	FieldTokenLabel                     = "token_label"
+	FieldCurve                          = "curve"
+	FieldKeyBits                        = "key_bits"
+	FieldSignatureBits                  = "signature_bits"
+	FieldSKID                           = "skid"
+	FieldUsePSS                         = "use_pss"
+	FieldForceRWSession                 = "force_rw_session"
+	FieldAccessKey                      = "access_key"
+	FieldSecretKey                      = "secret_key"
+	FieldEndpoint                       = "endpoint"
+	FieldKeyType                        = "key_type"
+	FieldKMSKey                         = "kms_key"
+	FieldRegion                         = "region"
+	FieldTenantID                       = "tenant_id"
+	FieldClientID                       = "client_id"
+	FieldClientSecret                   = "client_secret"
+	FieldEnvironment                    = "environment"
+	FieldVaultName                      = "vault_name"
+	FieldKeyName                        = "key_name"
+	FieldResource                       = "resource"
+	FieldAllowGenerateKey               = "allow_generate_key"
+	FieldAllowReplaceKey                = "allow_replace_key"
+	FieldAllowStoreKey                  = "allow_store_key"
+	FieldAnyMount                       = "any_mount"
+	FieldID                             = "id"
+	FieldUUID                           = "uuid"
+	FieldMountAccessor                  = "mount_accessor"
+	FieldUsername                       = "username"
+	FieldPassword                       = "password"
+	FieldPasswordFile                   = "password_file"
+	FieldClientAuth                     = "client_auth"
+	FieldAuthLoginGeneric               = "auth_login"
+	FieldAuthLoginUserpass              = "auth_login_userpass"
+	FieldAuthLoginAWS                   = "auth_login_aws"
+	FieldAuthLoginCert                  = "auth_login_cert"
+	FieldAuthLoginGCP                   = "auth_login_gcp"
+	FieldAuthLoginKerberos              = "auth_login_kerberos"
+	FieldAuthLoginRadius                = "auth_login_radius"
+	FieldAuthLoginOCI                   = "auth_login_oci"
+	FieldAuthLoginOIDC                  = "auth_login_oidc"
+	FieldAuthLoginJWT                   = "auth_login_jwt"
+	FieldAuthLoginAzure                 = "auth_login_azure"
+	FieldAuthLoginTokenFile             = "auth_login_token_file"
+	FieldIAMHttpRequestMethod           = "iam_http_request_method"
+	FieldIAMRequestURL                  = "iam_request_url"
+	FieldIAMRequestBody                 = "iam_request_body"
+	FieldIAMRequestHeaders              = "iam_request_headers"
+	FieldAWSAccessKeyID                 = "aws_access_key_id"
+	FieldAWSSecretAccessKey             = "aws_secret_access_key"
+	FieldAWSSessionToken                = "aws_session_token"
+	FieldAWSRoleARN                     = "aws_role_arn"
+	FieldAWSRoleSessionName             = "aws_role_session_name"
+	FieldAWSWebIdentityTokenFile        = "aws_web_identity_token_file"
+	FieldAWSSTSEndpoint                 = "aws_sts_endpoint"
+	FieldAWSIAMEndpoint                 = "aws_iam_endpoint"
+	FieldAWSProfile                     = "aws_profile"
+	FieldAWSRegion                      = "aws_region"
+	FieldAWSSharedCredentialsFile       = "aws_shared_credentials_file"
+	FieldHeaderValue                    = "header_value"
+	FieldDisableRemount                 = "disable_remount"
+	FieldCACertFile                     = "ca_cert_file"
+	FieldCACertDir                      = "ca_cert_dir"
+	FieldCertFile                       = "cert_file"
+	FieldKeyFile                        = "key_file"
+	FieldSkipTLSVerify                  = "skip_tls_verify"
+	FieldTLSServerName                  = "tls_server_name"
+	FieldAddress                        = "address"
+	FieldJWT                            = "jwt"
+	FieldCredentials                    = "credentials"
+	FieldClientEmail                    = "client_email"
+	FieldServiceAccount                 = "service_account"
+	FieldAuthorization                  = "authorization"
+	FieldToken                          = "token"
+	FieldService                        = "service"
+	FieldRealm                          = "realm"
+	FieldKeytabPath                     = "keytab_path"
+	FieldKRB5ConfPath                   = "krb5conf_path"
+	FieldDisableFastNegotiation         = "disable_fast_negotiation"
+	FieldRemoveInstanceName             = "remove_instance_name"
+	FieldAuthType                       = "auth_type"
+	FieldRequestHeaders                 = "request_headers"
+	FieldCallbackAddress                = "callback_address"
+	FieldCallbackListenerAddress        = "callback_listener_address"
+	FieldScope                          = "scope"
+	FieldSubscriptionID                 = "subscription_id"
+	FieldResourceGroupName              = "resource_group_name"
+	FieldVMName                         = "vm_name"
+	FieldVMSSName                       = "vmss_name"
+	FieldUsernameFormat                 = "username_format"
+	FieldIntegrationKey                 = "integration_key"
+	FieldAPIHostname                    = "api_hostname"
+	FieldPushInfo                       = "push_info"
+	FieldUsePasscode                    = "use_passcode"
+	FieldIssuer                         = "issuer"
+	FieldPeriod                         = "period"
+	FieldKeySize                        = "key_size"
+	FieldQRSize                         = "qr_size"
+	FieldAlgorithm                      = "algorithm"
+	FieldDigits                         = "digits"
+	FieldSkew                           = "skew"
+	FieldMaxValidationAttempts          = "max_validation_attempts"
+	FieldOrgName                        = "org_name"
+	FieldAPIToken                       = "api_token"
+	FieldBaseURL                        = "base_url"
+	FieldPrimaryEmail                   = "primary_email"
+	FieldSettingsFileBase64             = "settings_file_base64"
+	FieldUseSignature                   = "use_signature"
+	FieldIdpURL                         = "idp_url"
+	FieldAdminURL                       = "admin_url"
+	FieldAuthenticatorURL               = "authenticator_url"
+	FieldOrgAlias                       = "org_alias"
+	FieldType                           = "type"
+	FieldMethodID                       = "method_id"
+	FieldMFAMethodIDs                   = "mfa_method_ids"
+	FieldAccessors                      = "accessors"
+	FieldAuthMethodAccessors            = "auth_method_accessors"
+	FieldAuthMethodTypes                = "auth_method_types"
+	FieldIdentityGroupIDs               = "identity_group_ids"
+	FieldIdentityEntityIDs              = "identity_entity_ids"
+	FieldWrappingAccessor               = "wrapping_accessor"
+	FieldRoleName                       = "role_name"
+	FieldPolicies                       = "policies"
+	FieldNoParent                       = "no_parent"
+	FieldNoDefaultPolicy                = "no_default_policy"
+	FieldRenewable                      = "renewable"
+	FieldExplicitMaxTTL                 = "explicit_max_ttl"
+	FieldWrappingTTL                    = "wrapping_ttl"
+	FieldDisplayName                    = "display_name"
+	FieldNumUses                        = "num_uses"
+	FieldRenewMinLease                  = "renew_min_lease"
+	FieldRenewIncrement                 = "renew_increment"
+	FieldLeaseStarted                   = "lease_started"
+	FieldClientToken                    = "client_token"
+	FieldWrappedToken                   = "wrapped_token"
+	FieldOrphan                         = "orphan"
+	FieldVaultVersionOverride           = "vault_version_override"
+	FieldSkipGetVaultVersion            = "skip_get_vault_version"
+	FieldMemberEntityIDs                = "member_entity_ids"
+	FieldMemberGroupIDs                 = "member_group_ids"
+	FieldExclusive                      = "exclusive"
+	FieldGroupID                        = "group_id"
+	FieldGroupName                      = "group_name"
+	FieldExternal                       = "external"
+	FieldExternalValidation             = "external_validation"
+	FieldInternal                       = "internal"
+	FieldFailureTolerance               = "failure_tolerance"
+	FieldHealthy                        = "healthy"
+	FieldLeader                         = "leader"
+	FieldOptimisticFailureTolerance     = "optimistic_failure_tolerance"
+	FieldVoters                         = "voters"
+	FieldRedundancyZones                = "redundancy_zones"
+	FieldRedundancyZonesJSON            = "redundancy_zones_json"
+	FieldServers                        = "servers"
+	FieldServersJSON                    = "servers_json"
+	FieldUpgradeInfo                    = "upgrade_info"
+	FieldUpgradeInfoJSON                = "upgrade_info_json"
+	FieldMaxVersions                    = "max_versions"
+	FieldCASRequired                    = "cas_required"
+	FieldDeleteVersionAfter             = "delete_version_after"
+	FieldCustomMetadata                 = "custom_metadata"
+	FieldCustomMetadataJSON             = "custom_metadata_json"
+	FieldIAMAlias                       = "iam_alias"
+	FieldIAMMetadata                    = "iam_metadata"
+	FieldEC2Alias                       = "ec2_alias"
+	FieldEC2Metadata                    = "ec2_metadata"
+	FieldPublicKey                      = "public_key"
+	FieldPrivateKey                     = "private_key"
+	FieldImpersonatedAccount            = "impersonated_account"
+	FieldServiceAccountEmail            = "service_account_email"
+	FieldTokenScopes                    = "token_scopes"
+	FieldServiceAccountProject          = "service_account_project"
+	FieldOrganizationID                 = "organization_id"
+	FieldProjectID                      = "project_id"
+	FieldIPAddresses                    = "ip_addresses"
+	FieldCIDRBlocks                     = "cidr_blocks"
+	FieldProjectRoles                   = "project_roles"
+	FieldCreationLDIF                   = "creation_ldif"
+	FieldDeletionLDIF                   = "deletion_ldif"
+	FieldRollbackLDIF                   = "rollback_ldif"
+	FieldUsernameTemplate               = "username_template"
+	FieldServiceAccountNames            = "service_account_names"
+	FieldDisableCheckInEnforcement      = "disable_check_in_enforcement"
+	FieldSkipChildToken                 = "skip_child_token"
+	FieldTokenPolicies                  = "token_policies"
+	FieldManagedKeyName                 = "managed_key_name"
+	FieldManagedKeyID                   = "managed_key_id"
+	FieldIssuerRef                      = "issuer_ref"
+	FieldAllowLocalhost                 = "allow_localhost"
+	FieldAllowedDomains                 = "allowed_domains"
+	FieldAllowedDomainsTemplate         = "allowed_domains_template"
+	FieldAllowedDigestAlgorithms        = "allowed_digest_algorithms"
+	FieldAllowedEncryptionAlgorithms    = "allowed_encryption_algorithms"
+	FieldAllowBareDomains               = "allow_bare_domains"
+	FieldAllowSubdomains                = "allow_subdomains"
+	FieldAllowGlobDomains               = "allow_glob_domains"
+	FieldAllowAnyName                   = "allow_any_name"
+	FieldEnforceHostnames               = "enforce_hostnames"
+	FieldAllowIPSans                    = "allow_ip_sans"
+	FieldAllowedURISans                 = "allowed_uri_sans"
+	FieldAllowedURISansTemplate         = "allowed_uri_sans_template"
+	FieldAllowedUserIds                 = "allowed_user_ids"
+	FieldAllowWildcardCertificates      = "allow_wildcard_certificates"
+	FieldAllowedOtherSans               = "allowed_other_sans"
+	FieldServerFlag                     = "server_flag"
+	FieldClientFlag                     = "client_flag"
+	FieldCodeSigningFlag                = "code_signing_flag"
+	FieldEmailProtectionFlag            = "email_protection_flag"
+	FieldKeyUsage                       = "key_usage"
+	FieldExtKeyUsage                    = "ext_key_usage"
+	FieldExtKeyUsageOIDs                = "ext_key_usage_oids"
+	FieldUseCSRCommonName               = "use_csr_common_name"
+	FieldUseCSRSans                     = "use_csr_sans"
+	FieldOU                             = "ou"
+	FieldOrganization                   = "organization"
+	FieldCountry                        = "country"
+	FieldLocality                       = "locality"
+	FieldProvince                       = "province"
+	FieldStreetAddress                  = "street_address"
+	FieldPostalCode                     = "postal_code"
+	FieldGenerateLease                  = "generate_lease"
+	FieldNoStore                        = "no_store"
+	FieldRequireCN                      = "require_cn"
+	FieldPolicyIdentifiers              = "policy_identifiers"
+	FieldPolicyIdentifier               = "policy_identifier"
+	FieldBasicConstraintsValidForNonCA  = "basic_constraints_valid_for_non_ca"
+	FieldNotBeforeDuration              = "not_before_duration"
+	FieldAllowedSerialNumbers           = "allowed_serial_numbers"
+	FieldOID                            = "oid"
+	FieldCPS                            = "cps"
+	FieldNotice                         = "notice"
+	FieldCommonName                     = "common_name"
+	FieldAltNames                       = "alt_names"
+	FieldFormat                         = "format"
+	FieldPrivateKeyFormat               = "private_key_format"
+	FieldOu                             = "ou"
+	FieldIssuingCA                      = "issuing_ca"
+	FieldSerial                         = "serial"
+	FieldSerialNumber                   = "serial_number"
+	FieldIPSans                         = "ip_sans"
+	FieldURISans                        = "uri_sans"
+	FieldOtherSans                      = "other_sans"
+	FieldMaxPathLength                  = "max_path_length"
+	FieldExcludeCNFromSans              = "exclude_cn_from_sans"
+	FieldPermittedDNSDomains            = "permitted_dns_domains"
+	FieldExcludedDNSDomains             = "excluded_dns_domains"
+	FieldPermittedIPRanges              = "permitted_ip_ranges"
+	FieldExcludedIPRanges               = "excluded_ip_ranges"
+	FieldPermittedEmailAddresses        = "permitted_email_addresses"
+	FieldExcludedEmailAddresses         = "excluded_email_addresses"
+	FieldPermittedURIDomains            = "permitted_uri_domains"
+	FieldExcludedURIDomains             = "excluded_uri_domains"
+	FieldIssuerName                     = "issuer_name"
+	FieldUserIds                        = "user_ids"
+	FieldIssuerID                       = "issuer_id"
+	FieldKeyRef                         = "key_ref"
+	FieldPemBundle                      = "pem_bundle"
+	FieldCAChain                        = "ca_chain"
+	FieldRestrictCAChainToIssuer        = "restrict_ca_chain_to_issuer"
+	FieldCSR                            = "csr"
+	FieldUseCSRValues                   = "use_csr_values"
+	FieldCertificateBundle              = "certificate_bundle"
+	FieldRevoke                         = "revoke"
+	FieldRevokeWithKey                  = "revoke_with_key"
+	FieldPrivateKeyType                 = "private_key_type"
+	FieldAddBasicConstraints            = "add_basic_constraints"
+	FieldExported                       = "exported"
+	FieldExpiration                     = "expiration"
+	FieldAutoRenew                      = "auto_renew"
+	FieldMinSecondsRemaining            = "min_seconds_remaining"
+	FieldRenewPending                   = "renew_pending"
+	FieldImportedIssuers                = "imported_issuers"
+	FieldImportedKeys                   = "imported_keys"
+	FieldExisting                       = "existing"
+	FieldLeafNotAfterBehavior           = "leaf_not_after_behavior"
+	FieldManualChain                    = "manual_chain"
+	FieldUsage                          = "usage"
+	FieldKeys                           = "keys"
+	FieldKeyInfo                        = "key_info"
+	FieldKeyInfoJSON                    = "key_info_json"
+	FieldRevocationSignatureAlgorithm   = "revocation_signature_algorithm"
+	FieldIssuingCertificates            = "issuing_certificates"
+	FieldCRLDistributionPoints          = "crl_distribution_points"
+	FieldOCSPServers                    = "ocsp_servers"
+	FieldEnableAIAURLTemplating         = "enable_aia_url_templating"
+	FieldCredentialConfig               = "credential_config"
+	FieldDBName                         = "db_name"
+	FieldCreationStatements             = "creation_statements"
+	FieldRevocationStatements           = "revocation_statements"
+	FieldRollbackStatements             = "rollback_statements"
+	FieldRenewStatements                = "renew_statements"
+	FieldCredentialType                 = "credential_type"
+	FieldFilename                       = "filename"
+	FieldDefault                        = "default"
+	FieldRotationStatements             = "rotation_statements"
+	FieldRotationSchedule               = "rotation_schedule"
+	FieldRotationWindow                 = "rotation_window"
+	FieldKubernetesCACert               = "kubernetes_ca_cert"
+	FieldDisableLocalCAJWT              = "disable_local_ca_jwt"
+	FieldKubernetesHost                 = "kubernetes_host"
+	FieldServiceAccountJWT              = "service_account_jwt"
+	FieldDisableISSValidation           = "disable_iss_validation"
+	FieldPEMKeys                        = "pem_keys"
+	FieldSetNamespaceFromToken          = "set_namespace_from_token"
+	FieldAzureRoles                     = "azure_roles"
+	FieldRoleID                         = "role_id"
+	FieldAzureGroups                    = "azure_groups"
+	FieldObjectID                       = "object_id"
+	FieldApplicationObjectID            = "application_object_id"
+	FieldPermanentlyDelete              = "permanently_delete"
+	FieldSignInAudience                 = "sign_in_audience"
+	FieldTags                           = "tags"
+	FieldSkipStaticRoleImportRotation   = "skip_static_role_import_rotation"
+	FieldSkipImportRotation             = "skip_import_rotation"
+	FieldCustomTags                     = "custom_tags"
+	FieldSecretNameTemplate             = "secret_name_template"
+	FieldIAMEndpoint                    = "iam_endpoint"
+	FieldSTSEndpoint                    = "sts_endpoint"
+	FieldSTSFallbackEndpoints           = "sts_fallback_endpoints"
+	FieldIdentityTokenAudience          = "identity_token_audience"
+	FieldIdentityTokenTTL               = "identity_token_ttl"
+	FieldRoleArn                        = "role_arn"
+	FieldAccessor                       = "accessor"
+	FieldOptions                        = "options"
+	FieldAllowedManagedKeys             = "allowed_managed_keys"
+	FieldIdentityTokenKey               = "identity_token_key"
+	FieldCIDRList                       = "cidr_list"
+	FieldSecretID                       = "secret_id"
+	FieldWrappingToken                  = "wrapping_token"
+	FieldWithWrappedAccessor            = "with_wrapped_accessor"
+	FieldExternalID                     = "external_id"
+	FieldAppName                        = "app_name"
+	FieldInstallationID                 = "installation_id"
+	FieldAppID                          = "app_id"
+	FieldAIAPath                        = "aia_path"
+	FieldTLSMinVersion                  = "tls_min_version"
+	FieldTLSMaxVersion                  = "tls_max_version"
+	FieldCaseSensitiveNames             = "case_sensitive_names"
+	FieldMaxPageSize                    = "max_page_size"
+	FieldUserFilter                     = "userfilter"
+	FieldDiscoverDN                     = "discoverdn"
+	FieldDenyNullBind                   = "deny_null_bind"
+	FieldGroupFilter                    = "groupfilter"
+	FieldGroupDN                        = "groupdn"
+	FieldGroupAttr                      = "groupattr"
+	FieldUsernameAsAlias                = "username_as_alias"
+	FieldUseTokenGroups                 = "use_token_groups"
+	FieldTitle                          = "title"
+	FieldMessageBase64                  = "message_base64"
+	FieldAuthenticated                  = "authenticated"
+	FieldStartTime                      = "start_time"
+	FieldEndTime                        = "end_time"
+	FieldLink                           = "link"
+	FieldGranularity                    = "granularity"
+	FieldGranularityLevel               = "granularity_level"
+	FieldEC2Endpoint                    = "ec2_endpoint"
+	FieldSTSRegion                      = "sts_region"
+	FieldSTSFallbackRegions             = "sts_fallback_regions"
+	FieldIAMServerIDHeaderValue         = "iam_server_id_header_value"
+	FieldListingVisibility              = "listing_visibility"
+	FieldPassthroughRequestHeaders      = "passthrough_request_headers"
+	FieldAllowedResponseHeaders         = "allowed_response_headers"
+	FieldDelegatedAuthAccessors         = "delegated_auth_accessors"
+	FieldPluginVersion                  = "plugin_version"
+	FieldEnabled                        = "enabled"
+	FieldDefaultMount                   = "default_mount"
+	FieldDefaultPathPolicy              = "default_path_policy"
+	FieldLabelToPathPolicy              = "label_to_path_policy"
+	FieldAuthenticators                 = "authenticators"
+	FieldEnableSentinelParsing          = "enable_sentinel_parsing"
+	FieldAuditFields                    = "audit_fields"
+	FieldDisabledValidations            = "disabled_validations"
+	FieldLastUpdated                    = "last_updated"
+	FieldCustomEndpoint                 = "custom_endpoint"
+	FieldPrivateKeyID                   = "private_key_id"
+	FieldTune                           = "tune"
+	FieldMaxRetries                     = "max_retries"
+	FieldSessionTags                    = "session_tags"
+	FieldSelfManagedPassword            = "self_managed_password"
+	FieldAllowedIssuers                 = "allowed_issuers"
+	FieldAllowedRoles                   = "allowed_roles"
+	FieldAllowRoleExtKeyUsage           = "allow_role_ext_key_usage"
+	FieldDefaultDirectoryPolicy         = "default_directory_policy"
+	FieldDnsResolver                    = "dns_resolver"
+	FieldEabPolicy                      = "eab_policy"
+	FieldCnValidations                  = "cn_validations"
+	FieldsCreatedOn                     = "created_on"
+	FieldEabKey                         = "key"
+	FieldAcmeDirectory                  = "acme_directory"
+	FieldEabId                          = "eab_id"
+	FieldAssumeRoleArn                  = "assume_role_arn"
+	FieldAssumeRoleSessionName          = "assume_role_session_name"
+	FieldMaxCrlEntries                  = "max_crl_entries"
+	FieldChallenge                      = "challenge"
+	FieldRootPasswordTTL                = "root_password_ttl"
+	FieldOCIHomeTenancyID               = "home_tenancy_id"
 	FieldDisableCriticalExtensionChecks = "disable_critical_extension_checks"
 	FieldDisablePathLengthChecks        = "disable_path_length_checks"
 	FieldDisableNameChecks              = "disable_name_checks"
diff --git a/vault/provider.go b/vault/provider.go
index ccef9ed9..364f8b4c 100644
--- a/vault/provider.go
+++ b/vault/provider.go
@@ -481,6 +481,14 @@ var (
 			Resource:      UpdateSchemaResource(nomadSecretBackendRoleResource()),
 			PathInventory: []string{"/nomad/role/{role}"},
 		},
+		"vault_oci_auth_backend": {
+			Resource:      UpdateSchemaResource(ociAuthBackendResource()),
+			PathInventory: []string{"/auth/oci/config"},
+		},
+		"vault_oci_auth_backend_role": {
+			Resource:      UpdateSchemaResource(ociAuthBackendRoleResource()),
+			PathInventory: []string{"/auth/oci/role/{role}"},
+		},
 		"vault_policy": {
 			Resource:      UpdateSchemaResource(policyResource()),
 			PathInventory: []string{"/sys/policy/{name}"},
diff --git a/vault/resource_oci_auth_backend.go b/vault/resource_oci_auth_backend.go
new file mode 100644
index 00000000..231f9ba8
--- /dev/null
+++ b/vault/resource_oci_auth_backend.go
@@ -0,0 +1,247 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package vault
+
+import (
+	"context"
+	"log"
+	"strings"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-provider-vault/internal/consts"
+	"github.com/hashicorp/terraform-provider-vault/util"
+	"github.com/hashicorp/terraform-provider-vault/util/mountutil"
+	"github.com/hashicorp/vault/api"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+
+	"github.com/hashicorp/terraform-provider-vault/internal/provider"
+)
+
+func ociAuthBackendResource() *schema.Resource {
+	r := provider.MustAddMountMigrationSchema(&schema.Resource{
+		CreateContext: ociAuthBackendWrite,
+		UpdateContext: ociAuthBackendUpdate,
+		ReadContext:   provider.ReadContextWrapper(ociAuthBackendRead),
+		DeleteContext: ociAuthBackendDelete,
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+		CustomizeDiff: getMountCustomizeDiffFunc(consts.FieldPath),
+		Schema: map[string]*schema.Schema{
+			consts.FieldPath: {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Description: "Unique name of the auth backend to configure.",
+				Default:     consts.MountTypeOCI,
+				// standardize on no beginning or trailing slashes
+				StateFunc: func(v interface{}) string {
+					return strings.Trim(v.(string), "/")
+				},
+			},
+			consts.FieldDescription: {
+				Type:     schema.TypeString,
+				Optional: true,
+			},
+			consts.FieldAccessor: {
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: "The accessor of the auth backend",
+			},
+			consts.FieldOCIHomeTenancyID: {
+				Type:        schema.TypeString,
+				Required:    true,
+				Description: " The Tenancy OCID of your OCI account.",
+				Sensitive:   true,
+			},
+			consts.FieldTune: authMountTuneSchema(),
+		},
+	}, false)
+
+	// Add common automated root rotation schema to the resource.
+	provider.MustAddSchema(r, provider.GetAutomatedRootRotationSchema())
+
+	return r
+}
+
+func ociAuthBackendWrite(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	client, e := provider.GetClient(d, meta)
+	if e != nil {
+		return diag.FromErr(e)
+	}
+
+	path := d.Get(consts.FieldPath).(string)
+	desc := d.Get(consts.FieldDescription).(string)
+
+	log.Printf("[DEBUG] Enabling %s auth backend %q", consts.AuthMethodOCI, path)
+	err := client.Sys().EnableAuthWithOptionsWithContext(ctx, path, &api.EnableAuthOptions{
+		Type:        consts.AuthMethodOCI,
+		Description: desc,
+	})
+
+	if err != nil {
+		return diag.Errorf("error enabling %s auth backend %q: %s", consts.AuthMethodOCI, path, err)
+	}
+	log.Printf("[DEBUG] Enabled %s auth backend %q", consts.AuthMethodOCI, path)
+
+	d.SetId(path)
+
+	return ociAuthBackendUpdate(ctx, d, meta)
+}
+
+func ociAuthBackendUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	client, e := provider.GetClient(d, meta)
+	if e != nil {
+		return diag.FromErr(e)
+	}
+
+	ociPath := d.Id()
+	ociAuthPath := "auth/" + ociPath
+	path := ociAuthBackendConfigPath(ociPath)
+
+	if !d.IsNewResource() {
+		newMount, err := util.Remount(d, client, consts.FieldPath, true)
+		if err != nil {
+			return diag.FromErr(err)
+		}
+
+		ociAuthPath = "auth/" + newMount
+		path = ociAuthBackendConfigPath(newMount)
+
+		if d.HasChanges(consts.FieldDescription) {
+			desc := d.Get(consts.FieldDescription).(string)
+			config := api.MountConfigInput{
+				Description: &desc,
+			}
+			if err := client.Sys().TuneMountWithContext(ctx, path, config); err != nil {
+				return diag.FromErr(err)
+			}
+		}
+	}
+
+	data := map[string]interface{}{}
+	data[consts.FieldOCIHomeTenancyID] = d.Get(consts.FieldOCIHomeTenancyID)
+
+	if d.HasChange(consts.FieldTune) {
+		log.Printf("[INFO] %s Auth %q tune configuration changed", consts.AuthMethodOCI, ociAuthPath)
+		if raw, ok := d.GetOk(consts.FieldTune); ok {
+			log.Printf("[DEBUG] Writing %s auth tune to %q", consts.AuthMethodOCI, ociAuthPath)
+			err := authMountTune(ctx, client, ociAuthPath, raw)
+			if err != nil {
+				return nil
+			}
+		}
+	}
+
+	if d.HasChange(consts.FieldDescription) {
+		description := d.Get(consts.FieldDescription).(string)
+		tune := api.MountConfigInput{Description: &description}
+		err := client.Sys().TuneMountWithContext(ctx, ociAuthPath, tune)
+		if err != nil {
+			log.Printf("[ERROR] Error updating %s auth description at %q", consts.AuthMethodOCI, ociAuthPath)
+			return diag.FromErr(err)
+		}
+	}
+
+	log.Printf("[DEBUG] Writing %s config at path %q", consts.AuthMethodOCI, path)
+	_, err := client.Logical().WriteWithContext(ctx, path, data)
+	if err != nil {
+		d.SetId("")
+		return diag.Errorf("error writing %s config %q: %s", consts.AuthMethodOCI, path, err)
+	}
+
+	log.Printf("[DEBUG] Wrote %s config %q", consts.AuthMethodOCI, path)
+
+	return ociAuthBackendRead(ctx, d, meta)
+}
+
+func ociAuthBackendRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	client, e := provider.GetClient(d, meta)
+	if e != nil {
+		return diag.FromErr(e)
+	}
+
+	ociPath := d.Id()
+	ociAuthPath := "auth/" + ociPath
+	path := ociAuthBackendConfigPath(ociPath)
+
+	log.Printf("[DEBUG] Reading %s auth backend config %q", consts.AuthMethodOCI, path)
+	resp, err := client.Logical().ReadWithContext(ctx, path)
+	if err != nil {
+		return diag.Errorf("error reading %s auth backend config %q: %s", consts.AuthMethodOCI, path, err)
+	}
+	log.Printf("[DEBUG] Read %s auth backend config %q", consts.AuthMethodOCI, path)
+
+	if resp == nil {
+		log.Printf("[WARN] %s auth backend config %q not found, removing from state", consts.AuthMethodOCI, path)
+		d.SetId("")
+		return nil
+	}
+
+	params := []string{
+		consts.FieldOCIHomeTenancyID,
+	}
+
+	for _, param := range params {
+		if err := d.Set(param, resp.Data[param]); err != nil {
+			return diag.FromErr(err)
+		}
+	}
+
+	mount, err := mountutil.GetAuthMount(ctx, client, ociPath)
+	if err != nil {
+		if mountutil.IsMountNotFoundError(err) {
+			log.Printf("[WARN] Mount %q not found, removing from state.", ociPath)
+			d.SetId("")
+			return nil
+		}
+		return diag.FromErr(err)
+	}
+
+	log.Printf("[DEBUG] Reading %s auth tune from '%s/tune'", consts.AuthMethodOCI, ociAuthPath)
+	rawTune, err := authMountTuneGet(ctx, client, ociAuthPath)
+	if err != nil {
+		return diag.Errorf("error reading tune information from Vault: %s", err)
+	}
+	data := map[string]interface{}{}
+	data[consts.FieldTune] = []map[string]interface{}{rawTune}
+	if err := util.SetResourceData(d, data); err != nil {
+		return diag.FromErr(err)
+	}
+
+	if err := d.Set(consts.FieldAccessor, mount.Accessor); err != nil {
+		return diag.FromErr(err)
+	}
+	if err := d.Set(consts.FieldDescription, mount.Description); err != nil {
+		return diag.FromErr(err)
+	}
+	// set the auth backend's path
+	if err := d.Set(consts.FieldPath, ociPath); err != nil {
+		return diag.FromErr(err)
+	}
+
+	return nil
+}
+
+func ociAuthBackendDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	client, e := provider.GetClient(d, meta)
+	if e != nil {
+		return diag.FromErr(e)
+	}
+
+	path := d.Id()
+
+	log.Printf("[DEBUG] Deleting %s auth backend %q", consts.AuthMethodOCI, path)
+	err := client.Sys().DisableAuthWithContext(ctx, path)
+	if err != nil {
+		return diag.Errorf("error deleting %s auth backend %q: %q", consts.AuthMethodOCI, path, err)
+	}
+	log.Printf("[DEBUG] Deleted %s auth backend %q", consts.AuthMethodOCI, path)
+
+	return nil
+}
+
+func ociAuthBackendConfigPath(path string) string {
+	return "auth/" + strings.Trim(path, "/") + "/config"
+}
diff --git a/vault/resource_oci_auth_backend_role.go b/vault/resource_oci_auth_backend_role.go
new file mode 100644
index 00000000..30c8ab55
--- /dev/null
+++ b/vault/resource_oci_auth_backend_role.go
@@ -0,0 +1,218 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package vault
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"regexp"
+	"strings"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-vault/internal/consts"
+
+	"github.com/hashicorp/terraform-provider-vault/internal/provider"
+)
+
+var (
+	ociAuthBackendFromPathRegex  = regexp.MustCompile("^auth/(.+)/role/[^/]+$")
+	ociAuthRoleNameFromPathRegex = regexp.MustCompile("^auth/.+/role/([^/]+)$")
+)
+
+func ociAuthBackendRoleResource() *schema.Resource {
+	fields := map[string]*schema.Schema{
+		"name": {
+			Type:        schema.TypeString,
+			Required:    true,
+			Description: "Name of the role.",
+			ForceNew:    true,
+		},
+		"ocid_list": {
+			Type:        schema.TypeList,
+			Optional:    true,
+			Description: "A list of Group or Dynamic Group OCIDs that can take this role.",
+			Elem: &schema.Schema{
+				Type: schema.TypeString,
+			},
+		},
+		"backend": {
+			Type:        schema.TypeString,
+			Optional:    true,
+			Description: "Unique name of the auth backend to configure.",
+			ForceNew:    true,
+			Default:     "oci",
+			// standardise on no beginning or trailing slashes
+			StateFunc: func(v interface{}) string {
+				return strings.Trim(v.(string), "/")
+			},
+		},
+	}
+
+	addTokenFields(fields, &addTokenFieldsConfig{})
+
+	return &schema.Resource{
+		SchemaVersion: 1,
+
+		CreateContext: ociAuthRoleCreate,
+		UpdateContext: ociAuthRoleUpdate,
+		ReadContext:   provider.ReadContextWrapper(ociAuthRoleRead),
+		DeleteContext: ociAuthRoleDelete,
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+		Schema: fields,
+	}
+}
+
+func ociRoleUpdateFields(d *schema.ResourceData, data map[string]interface{}, create bool) {
+	updateTokenFields(d, data, create)
+
+	if _, ok := d.GetOk("ocid_list"); ok {
+		iOL := d.Get("ocid_list").([]interface{})
+		ocid_list := make([]string, len(iOL))
+		for i, iO := range iOL {
+			ocid_list[i] = iO.(string)
+		}
+		data["ocid_list"] = strings.Join(ocid_list, ",")
+	}
+}
+
+func ociAuthRoleCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	client, e := provider.GetClient(d, meta)
+	if e != nil {
+		return diag.FromErr(e)
+	}
+
+	backend := d.Get("backend").(string)
+	name := d.Get("name").(string)
+
+	path := ociRoleResourcePath(backend, name)
+
+	data := map[string]interface{}{}
+	ociRoleUpdateFields(d, data, true)
+
+	log.Printf("[DEBUG] Writing role %q to %s auth backend", path, consts.AuthMethodOCI)
+	d.SetId(path)
+	_, err := client.Logical().Write(path, data)
+	if err != nil {
+		d.SetId("")
+		return diag.Errorf("Error writing %s auth role %q: %s", consts.AuthMethodOCI, path, err)
+	}
+	log.Printf("[DEBUG] Wrote role %q to %s auth backend", path, consts.AuthMethodOCI)
+
+	return ociAuthRoleRead(ctx, d, meta)
+}
+
+func ociAuthRoleUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	client, e := provider.GetClient(d, meta)
+	if e != nil {
+		return diag.FromErr(e)
+	}
+	path := d.Id()
+
+	data := map[string]interface{}{}
+	ociRoleUpdateFields(d, data, false)
+
+	log.Printf("[DEBUG] Updating role %q in %s auth backend", path, consts.AuthMethodOCI)
+	_, err := client.Logical().Write(path, data)
+	if err != nil {
+		return diag.Errorf("Error updating %s auth role %q: %s", consts.AuthMethodOCI, path, err)
+	}
+	log.Printf("[DEBUG] Updated role %q to %s auth backend", path, consts.AuthMethodOCI)
+
+	return ociAuthRoleRead(ctx, d, meta)
+}
+
+func ociAuthRoleRead(_ context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	client, e := provider.GetClient(d, meta)
+	if e != nil {
+		return diag.FromErr(e)
+	}
+	path := d.Id()
+
+	log.Printf("[DEBUG] Reading %s role %q", consts.AuthMethodOCI, path)
+	resp, err := client.Logical().Read(path)
+	if err != nil {
+		return diag.Errorf("Error reading %s role %q: %s", consts.AuthMethodOCI, path, err)
+	}
+	log.Printf("[DEBUG] Read %s role %q", consts.AuthMethodOCI, path)
+
+	if resp == nil {
+		log.Printf("[WARN] %s role %q not found, removing from state", consts.AuthMethodOCI, path)
+		d.SetId("")
+		return nil
+	}
+
+	backend, err := ociAuthResourceBackendFromPath(path)
+	if err != nil {
+		return diag.Errorf("invalid path %q for %s auth backend role: %s", path, consts.AuthMethodOCI, err)
+	}
+	d.Set("backend", backend)
+	name, err := ociAuthResourceRoleFromPath(path)
+	if err != nil {
+		return diag.Errorf("invalid path %q for %s auth backend role: %s", path, consts.AuthMethodOCI, err)
+	}
+	d.Set("name", name)
+
+	if err := readTokenFields(d, resp); err != nil {
+		return diag.FromErr(err)
+	}
+
+	for _, k := range []string{"ocid_list"} {
+		if v, ok := resp.Data[k]; ok {
+			if err := d.Set(k, v); err != nil {
+				return diag.Errorf("error reading %s for %s Auth Backend Role %q: %q", k, path, consts.AuthMethodOCI, err)
+			}
+		}
+	}
+
+	diags := checkCIDRs(d, TokenFieldBoundCIDRs)
+
+	return diags
+}
+
+func ociAuthRoleDelete(_ context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	client, e := provider.GetClient(d, meta)
+	if e != nil {
+		return diag.FromErr(e)
+	}
+	path := d.Id()
+
+	log.Printf("[DEBUG] Deleting %s auth backend role %q", consts.AuthMethodOCI, path)
+	_, err := client.Logical().Delete(path)
+	if err != nil {
+		return diag.Errorf("error deleting %s auth backend role %q", consts.AuthMethodOCI, path)
+	}
+	log.Printf("[DEBUG] Deleted %s auth backend role %q", consts.AuthMethodOCI, path)
+
+	return nil
+}
+
+func ociRoleResourcePath(backend, role string) string {
+	return "auth/" + strings.Trim(backend, "/") + "/role/" + strings.Trim(role, "/")
+}
+
+func ociAuthResourceBackendFromPath(path string) (string, error) {
+	if !ociAuthBackendFromPathRegex.MatchString(path) {
+		return "", fmt.Errorf("no backend found")
+	}
+	res := ociAuthBackendFromPathRegex.FindStringSubmatch(path)
+	if len(res) != 2 {
+		return "", fmt.Errorf("unexpected number of matches (%d) for backend", len(res))
+	}
+	return res[1], nil
+}
+
+func ociAuthResourceRoleFromPath(path string) (string, error) {
+	if !ociAuthRoleNameFromPathRegex.MatchString(path) {
+		return "", fmt.Errorf("no role found")
+	}
+	res := ociAuthRoleNameFromPathRegex.FindStringSubmatch(path)
+	if len(res) != 2 {
+		return "", fmt.Errorf("unexpected number of matches (%d) for role", len(res))
+	}
+	return res[1], nil
+}
diff --git a/website/docs/r/oci_auth_backend.html.md b/website/docs/r/oci_auth_backend.html.md
new file mode 100644
index 00000000..8807484c
--- /dev/null
+++ b/website/docs/r/oci_auth_backend.html.md
@@ -0,0 +1,91 @@
+---
+layout: "vault"
+page_title: "Vault: vault_oci_auth_backend resource"
+sidebar_current: "docs-vault-resource-oci-auth-backend"
+description: |-
+  Configures the OCI (Oracle Cloud Infrastructure) Auth Backend in Vault.
+---
+
+# vault\_oci\_auth\_backend
+
+Configures the OCI (Oracle Cloud Infrastructure) Auth Backend in Vault.
+
+This resource sets the home tenancy id that Vault will use when making
+API requests on behalf of an OCI Auth Backend.
+
+For more information, see the
+[Vault docs](https://developer.hashicorp.com/vault/api-docs/auth/oci#configure-home-tenancy-method).
+
+~> **Important** All data provided in the resource configuration will be
+written in cleartext to state and plan files generated by Terraform, and
+will appear in the console output when Terraform runs. Protect these
+artifacts accordingly. See
+[the main provider documentation](../index.html)
+for more details.
+
+## Example Usage
+
+```hcl
+resource "vault_oci_auth_backend" "example" {
+  path            = vault_auth_backend.example.path
+  home_tenancy_id = "ocid1.tenancy.oc1..aaaaaaaah7zkvaffv26pzyauoe2zbnionqvhvsexamplee557wakiofi4ysgqq"
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `description` - (Optional) A description of the auth backend.
+
+* `namespace` - (Optional) The namespace to provision the resource in.
+  The value should not contain leading or trailing forward slashes.
+  The `namespace` is always relative to the provider's configured [namespace](/docs/providers/vault#namespace).
+   *Available only for Vault Enterprise*.
+
+* `home_tenancy_id` - (Required) The Tenancy OCID of your OCI account.
+
+* `tune` - (Optional) Extra configuration block. Structure is documented below.
+
+The `tune` block is used to tune the auth backend:
+
+* `default_lease_ttl` - (Optional) Specifies the default time-to-live.
+  If set, this overrides the global default.
+  Must be a valid [duration string](https://golang.org/pkg/time/#ParseDuration)
+
+* `max_lease_ttl` - (Optional) Specifies the maximum time-to-live.
+  If set, this overrides the global default.
+  Must be a valid [duration string](https://golang.org/pkg/time/#ParseDuration)
+
+* `audit_non_hmac_response_keys` - (Optional) Specifies the list of keys that will
+  not be HMAC'd by audit devices in the response data object.
+
+* `audit_non_hmac_request_keys` - (Optional) Specifies the list of keys that will
+  not be HMAC'd by audit devices in the request data object.
+
+* `listing_visibility` - (Optional) Specifies whether to show this mount in
+  the UI-specific listing endpoint. Valid values are "unauth" or "hidden".
+
+* `passthrough_request_headers` - (Optional) List of headers to whitelist and
+  pass from the request to the backend.
+
+* `allowed_response_headers` - (Optional) List of headers to whitelist and allowing
+  a plugin to include them in the response.
+
+* `token_type` - (Optional) Specifies the type of tokens that should be returned by
+  the mount. Valid values are "default-service", "default-batch", "service", "batch".
+
+
+For more details on the usage of each argument, consult the [Vault OCI API documentation](https://developer.hashicorp.com/vault/api-docs/auth/oci#configure-home-tenancy-method).
+
+## Attributes Reference
+
+No additional attributes are exported by this resource.
+
+## Import
+
+OCI auth backends can be imported using the backend's `path`, e.g.
+
+```
+$ terraform import vault_oci_auth_backend.example oci
+```
diff --git a/website/docs/r/oci_auth_backend_role.html.md b/website/docs/r/oci_auth_backend_role.html.md
new file mode 100644
index 00000000..3919ad71
--- /dev/null
+++ b/website/docs/r/oci_auth_backend_role.html.md
@@ -0,0 +1,97 @@
+---
+layout: "vault"
+page_title: "Vault: vault_oci_auth_backend_role resource"
+sidebar_current: "docs-vault-resource-oci-auth-backend-role"
+description: |-
+  Manages OCI (Oracle Cloud Infrastructure) auth backend roles in Vault.
+---
+
+# vault\_oci\_auth\_backend\_role
+
+Manages an OCI (Oracle Cloud Infrastructure) auth backend role in a 
+Vault server. Roles constrain the instances or principals that can
+perform the login operation against the backend. See the [Vault
+documentation](https://developer.hashicorp.com/vault/docs/auth/oci) for
+more information.
+
+## Example Usage
+
+```hcl
+resource "vault_oci_auth_backend" "oci" {
+  path            = "oci"
+  home_tenancy_id = "ocid1.tenancy.oc1..aaaaaaaah7zkvaffv26pzyauoe2zbnionqvhvsexamplee557wakiofi4ysgqq"
+}
+
+resource "vault_oci_auth_backend_role" "example" {
+  backend        = vault_oci_auth_backend.oci.path
+  name           = "test-role"
+  ocid_list      = ["ocid1.group.oc1..aaaaaaaabmyiinfq32y5aha3r2yo4exampleo4yg3fjk2sbne4567tropaa", "ocid1.dynamicgroup.oc1..aaaaaaaabvfwct33xri5examplegov4zyjp3rd5d7sk9jjdggxijhco56hrq"]
+  token_ttl      = 60
+  token_max_ttl  = 120
+  token_policies = ["default", "dev", "prod"]
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `namespace` - (Optional) The namespace to provision the resource in.
+  The value should not contain leading or trailing forward slashes.
+  The `namespace` is always relative to the provider's configured [namespace](/docs/providers/vault#namespace).
+   *Available only for Vault Enterprise*.
+
+* `name` - (Required) The name of the role.
+
+* `ocid_list` - (Required) The list of Group or Dynamic Group OCIDs that can take this role.
+
+### Common Token Arguments
+
+These arguments are common across several Authentication Token resources since Vault 1.2.
+
+* `token_ttl` - (Optional) The incremental lifetime for generated tokens in number of seconds.
+  Its current value will be referenced at renewal time.
+
+* `token_max_ttl` - (Optional) The maximum lifetime for generated tokens in number of seconds.
+  Its current value will be referenced at renewal time.
+
+* `token_period` - (Optional) If set, indicates that the
+  token generated using this role should never expire. The token should be renewed within the
+  duration specified by this value. At each renewal, the token's TTL will be set to the
+  value of this field. Specified in seconds.
+
+* `token_policies` - (Optional) List of policies to encode onto generated tokens. Depending
+  on the auth method, this list may be supplemented by user/group/other values.
+
+* `token_bound_cidrs` - (Optional) List of CIDR blocks; if set, specifies blocks of IP
+  addresses which can authenticate successfully, and ties the resulting token to these blocks
+  as well.
+
+* `token_explicit_max_ttl` - (Optional) If set, will encode an
+  [explicit max TTL](https://www.vaultproject.io/docs/concepts/tokens.html#token-time-to-live-periodic-tokens-and-explicit-max-ttls)
+  onto the token in number of seconds. This is a hard cap even if `token_ttl` and
+  `token_max_ttl` would otherwise allow a renewal.
+
+* `token_no_default_policy` - (Optional) If set, the default policy will not be set on
+  generated tokens; otherwise it will be added to the policies set in token_policies.
+
+* `token_num_uses` - (Optional) The [maximum number](https://developer.hashicorp.com/vault/api-docs/auth/oci#token_num_uses)
+   of times a generated token may be used (within its lifetime); 0 means unlimited.
+
+* `token_type` - (Optional) The type of token that should be generated. Can be `service`,
+  `batch`, or `default` to use the mount's tuned default (which unless changed will be
+  `service` tokens). For token store roles, there are two additional possibilities:
+  `default-service` and `default-batch` which specify the type to return unless the client
+  requests a different type at generation time.
+
+## Attributes Reference
+
+No additional attributes are exported by this resource.
+
+## Import
+
+OCI auth backend roles can be imported using `auth/`, the `backend` path, `/role/`, and the `role` name e.g.
+
+```
+$ terraform import vault_oci_auth_backend_role.example auth/oci/role/test-role
+```



Test patch:
diff --git a/vault/resource_oci_auth_backend_role_test.go b/vault/resource_oci_auth_backend_role_test.go
new file mode 100644
index 00000000..ce613828
--- /dev/null
+++ b/vault/resource_oci_auth_backend_role_test.go
@@ -0,0 +1,200 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package vault
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+
+	"github.com/hashicorp/terraform-provider-vault/internal/provider"
+	"github.com/hashicorp/terraform-provider-vault/testutil"
+)
+
+func TestOCIAuthBackendRole_basic(t *testing.T) {
+	backend := acctest.RandomWithPrefix("tf-test-oci-backend")
+	name := acctest.RandomWithPrefix("tf-test-oci-role")
+
+	resourceName := "vault_oci_auth_backend_role.test"
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testOCIAuthBackendRoleDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testOCIAuthBackendRoleConfig_basic(backend, name),
+				Check:  testOCIAuthBackendRoleCheck_attrs(resourceName, backend, name),
+			},
+		},
+	})
+}
+
+func TestOCIAuthBackendRole(t *testing.T) {
+	backend := acctest.RandomWithPrefix("tf-test-oci-backend")
+	name := acctest.RandomWithPrefix("tf-test-oci-role")
+
+	resourceName := "vault_oci_auth_backend_role.test"
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testOCIAuthBackendRoleDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testOCIAuthBackendRoleConfig(backend, name),
+				Check: resource.ComposeTestCheckFunc(
+					testOCIAuthBackendRoleCheck_attrs(resourceName, backend, name),
+					resource.TestCheckResourceAttr(resourceName, "token_ttl", "300"),
+					resource.TestCheckResourceAttr(resourceName, "token_max_ttl", "600"),
+					resource.TestCheckResourceAttr(resourceName, "token_policies.#", "2"),
+				),
+			},
+			{
+				Config: testOCIAuthBackendRoleUnset(backend, name),
+				Check: resource.ComposeTestCheckFunc(
+					testOCIAuthBackendRoleCheck_attrs(resourceName, backend, name),
+					resource.TestCheckResourceAttr(resourceName, "token_ttl", "0"),
+					resource.TestCheckResourceAttr(resourceName, "token_max_ttl", "0"),
+					resource.TestCheckResourceAttr(resourceName, "token_policies.#", "0"),
+				),
+			},
+		},
+	})
+}
+
+func testOCIAuthBackendRoleDestroy(s *terraform.State) error {
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "vault_oci_auth_backend_role" {
+			continue
+		}
+
+		client, e := provider.GetClient(rs.Primary, testProvider.Meta())
+		if e != nil {
+			return e
+		}
+
+		secret, err := client.Logical().Read(rs.Primary.ID)
+		if err != nil {
+			return fmt.Errorf("Error checking for OCI auth backend role %q: %s", rs.Primary.ID, err)
+		}
+		if secret != nil {
+			return fmt.Errorf("OCI auth backend role %q still exists", rs.Primary.ID)
+		}
+	}
+	return nil
+}
+
+func testOCIAuthBackendRoleCheck_attrs(resourceName, backend, name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, err := testutil.GetResourceFromRootModule(s, resourceName)
+		if err != nil {
+			return err
+		}
+
+		client, err := provider.GetClient(rs.Primary, testProvider.Meta())
+		if err != nil {
+			return err
+		}
+
+		path := rs.Primary.ID
+
+		endpoint := "auth/" + strings.Trim(backend, "/") + "/role/" + name
+		if endpoint != path {
+			return fmt.Errorf("expected ID to be %q, got %q instead", endpoint, path)
+		}
+
+		authMounts, err := client.Sys().ListAuth()
+		if err != nil {
+			return err
+		}
+		authMount := authMounts[strings.Trim(backend, "/")+"/"]
+
+		if authMount == nil {
+			return fmt.Errorf("auth mount %s not present", backend)
+		}
+
+		if "oci" != authMount.Type {
+			return fmt.Errorf("incorrect mount type: %s", authMount.Type)
+		}
+		attrs := map[string]string{
+			"ocid_list": "ocid_list",
+		}
+
+		for _, v := range commonTokenFields {
+			attrs[v] = v
+		}
+
+		tAttrs := []*testutil.VaultStateTest{}
+		for k, v := range attrs {
+			ta := &testutil.VaultStateTest{
+				ResourceName: resourceName,
+				StateAttr:    k,
+				VaultAttr:    v,
+			}
+			switch k {
+			case TokenFieldPolicies:
+				ta.AsSet = true
+			}
+
+			tAttrs = append(tAttrs, ta)
+		}
+
+		return testutil.AssertVaultState(client, s, path, tAttrs...)
+	}
+}
+
+func testOCIAuthBackendRoleConfig_basic(backend, name string) string {
+	return fmt.Sprintf(`
+resource "vault_oci_auth_backend" "config" {
+  path = "%s"
+  home_tenancy_id = "ocid1.tenancy.oc1..aaaaaaaah7zkvaffv26pzyauoe2zbnionqvhvsexamplee557wakiofi4ysgqq"
+}
+
+resource "vault_oci_auth_backend_role" "test" {
+    backend        = vault_oci_auth_backend.config.path
+    name           = "%s"
+    ocid_list      = ["ocid1.group.oc1..aaaaaaaabmyiinfq32y5aha3r2yo4exampleo4yg3fjk2sbne4567tropaa", "ocid1.dynamicgroup.oc1..aaaaaaaabvfwct33xri5examplegov4zyjp3rd5d7sk9jjdggxijhco56hrq"]
+    token_ttl      = 300
+    token_max_ttl  = 600
+    token_policies = ["policy_a", "policy_b"]
+}
+`, backend, name)
+}
+
+func testOCIAuthBackendRoleConfig(backend, name string) string {
+	return fmt.Sprintf(`
+resource "vault_oci_auth_backend" "config" {
+  path = "%s"
+  home_tenancy_id = "ocid1.tenancy.oc1..aaaaaaaah7zkvaffv26pzyauoe2zbnionqvhvsexamplee557wakiofi4ysgqq"
+}
+
+resource "vault_oci_auth_backend_role" "test" {
+    backend        = vault_oci_auth_backend.config.path
+    name           = "%s"
+    token_ttl      = 300
+    token_max_ttl  = 600
+    token_policies = ["policy_a", "policy_b"]
+    ocid_list      = ["ocid1.dynamicgroup.oc1..aaaaaaaabvfwc45fh7dkexampleov4zyjp3rd5d7sk95jjdggdijhco5793f"]
+}
+`, backend, name)
+}
+
+func testOCIAuthBackendRoleUnset(backend, name string) string {
+	return fmt.Sprintf(`
+resource "vault_oci_auth_backend" "config" {
+  path = "%s"
+  home_tenancy_id = "ocid1.tenancy.oc1..aaaaaaaah7zkvaffv26pzyauoe2zbnionqvhvsexamplee557wakiofi4ysgqq"
+}
+
+resource "vault_oci_auth_backend_role" "test" {
+    backend   = vault_oci_auth_backend.config.path
+    name      = "%s"
+    ocid_list = ["ocid1.dynamicgroup.oc1..aaaaaaaabvfwc45fh7dkexampleov4zyjp3rd5d7sk95jjdggdijhco5793f"]
+}
+`, backend, name)
+}
diff --git a/vault/resource_oci_auth_backend_test.go b/vault/resource_oci_auth_backend_test.go
new file mode 100644
index 00000000..0c2c0275
--- /dev/null
+++ b/vault/resource_oci_auth_backend_test.go
@@ -0,0 +1,136 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package vault
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/hashicorp/terraform-provider-vault/internal/provider"
+	"github.com/hashicorp/terraform-provider-vault/testutil"
+)
+
+func TestAccOCIAuthBackendConfig_import(t *testing.T) {
+	path := acctest.RandomWithPrefix("oci")
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckOCIAuthBackendConfigDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccOCIAuthBackendConfig_basic(path),
+				Check:  testAccOCIAuthBackendConfigCheck_attrs(path),
+			},
+			{
+				ResourceName:      "vault_oci_auth_backend.config",
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"disable_remount",
+				},
+			},
+		},
+	})
+}
+
+func TestAccOCIAuthBackendConfig_basic(t *testing.T) {
+	path := acctest.RandomWithPrefix("oci")
+	resource.Test(t, resource.TestCase{
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccCheckOCIAuthBackendConfigDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccOCIAuthBackendConfig_basic(path),
+				Check:  testAccOCIAuthBackendConfigCheck_attrs(path),
+			},
+			{
+				Config: testAccOCIAuthBackendConfig_updated(path),
+				Check:  testAccOCIAuthBackendConfigCheck_attrs(path),
+			},
+		},
+	})
+}
+
+func testAccCheckOCIAuthBackendConfigDestroy(s *terraform.State) error {
+	config := testProvider.Meta().(*provider.ProviderMeta).MustGetClient()
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "vault_oci_auth_backend" {
+			continue
+		}
+		secret, err := config.Logical().Read(rs.Primary.ID)
+		if err != nil {
+			return fmt.Errorf("error checking for OCI auth backend %q config: %s", rs.Primary.ID, err)
+		}
+		if secret != nil {
+			return fmt.Errorf("OCI auth backend %q still configured", rs.Primary.ID)
+		}
+	}
+	return nil
+}
+
+func testAccOCIAuthBackendConfig_basic(path string) string {
+	return fmt.Sprintf(`
+resource "vault_oci_auth_backend" "config" {
+  path = "%s"
+  home_tenancy_id = "ocid1.tenancy.oc1..aaaaaaaah7zkvaffv26pzyauoe2zbnionqvhvsexamplee557wakiofi4ysgqq"
+}
+`, path)
+}
+
+func testAccOCIAuthBackendConfigCheck_attrs(backend string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		resourceState := s.Modules[0].Resources["vault_oci_auth_backend.config"]
+		if resourceState == nil {
+			return fmt.Errorf("resource not found in state")
+		}
+
+		instanceState := resourceState.Primary
+		if instanceState == nil {
+			return fmt.Errorf("resource has no primary instance")
+		}
+
+		endpoint := "auth/" + backend + "/config"
+
+		if backend != instanceState.ID {
+			return fmt.Errorf("expected ID to be %q, got %q", backend, instanceState.ID)
+		}
+
+		config := testProvider.Meta().(*provider.ProviderMeta).MustGetClient()
+		resp, err := config.Logical().Read(endpoint)
+		if err != nil {
+			return fmt.Errorf("error reading back oci auth config from %q: %s", endpoint, err)
+		}
+		if resp == nil {
+			return fmt.Errorf("OCI auth not configured at %q", endpoint)
+		}
+		attrs := map[string]string{
+			"home_tenancy_id": "home_tenancy_id",
+		}
+
+		for stateAttr, apiAttr := range attrs {
+			if resp.Data[apiAttr] == nil && instanceState.Attributes[stateAttr] == "" {
+				continue
+			}
+			if resp.Data[apiAttr] != instanceState.Attributes[stateAttr] {
+				return fmt.Errorf("expected %s (%s) of %q to be %q, got %q", apiAttr, stateAttr, endpoint, instanceState.Attributes[stateAttr], resp.Data[apiAttr])
+			}
+		}
+		return nil
+	}
+}
+
+func testAccOCIAuthBackendConfig_updated(backend string) string {
+	return fmt.Sprintf(`
+resource "vault_oci_auth_backend" "config" {
+  path = "%s"
+  home_tenancy_id = "ocid1.tenancy.oc1..aaaaaaaah7zkvaffv26pzyauoe2zbnionqvhvsexamplee557wakiofi4ysgqq"
+}`, backend)
+}