Repository: hashicorp/terraform-provider-vault

Issue:
[Enhancement]: vault_azure_secret_backend support listing_visibility attribute
### Description

The `vault_azure_secret_backend` resource does not have support for any of the [mount configuration options](https://developer.hashicorp.com/vault/api-docs/system/mounts#config) supported by the Vault API, and in particular does not support [`listing_visibility`](https://developer.hashicorp.com/vault/api-docs/system/mounts#listing_visibility) so there is no way to make the engine visible in the UI through the provider.

Further, even if the more generic `vault_mount` resource had support for `listing_visibility` (as of writing this attribute is not currently supported, see #1303), it is not possible to combine `vault_mount` with `vault_azure_secret_backend` targeting the same path because `vault_azure_secret_backend` is not able to update existing engine configurations (unlike e.g., `vault_kv_secret_backend_v2`)

It looks like the implementation already constructs the required [`api.MountConfigInput`](https://pkg.go.dev/github.com/hashicorp/vault/api#MountConfigInput) object, but none of the attributes are exposed on the Terraform side:

https://github.com/hashicorp/terraform-provider-vault/blob/f69304303bddaf4f7a6b34428d03557e38d2e4d1/vault/resource_azure_secret_backend.go#L109-L112

### Affected Resource(s) and/or Data Source(s)

- vault_azure_secret_backend

### Potential Terraform Configuration

```terraform
resource "vault_azure_secret_backend" "azure" {
  path = "azure"

  tenant_id = "00000000-0000-0000-0000-000000000000"
  subscription_id = "00000000-0000-0000-0000-000000000000"
  client_id = "00000000-0000-0000-0000-000000000000"
  client_secret = "00000000-0000-0000-0000-000000000000"

  # new!
  listing_visibility = "unauth"
}
```


### References

- https://developer.hashicorp.com/vault/api-docs/system/mounts#config
- #1051

### Would you like to implement a fix?

None

Discussion:

Solution patch:
diff --git a/go.mod b/go.mod
index 9d6cfcf3..77b8a68b 100644
--- a/go.mod
+++ b/go.mod
@@ -23,7 +23,7 @@ require (
 	github.com/hashicorp/go-hclog v1.6.3
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/hashicorp/go-retryablehttp v0.7.7
-	github.com/hashicorp/go-secure-stdlib/awsutil v0.2.3
+	github.com/hashicorp/go-secure-stdlib/awsutil v0.3.0
 	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.9
 	github.com/hashicorp/go-version v1.7.0
 	github.com/hashicorp/terraform-plugin-framework v1.14.1
@@ -45,15 +45,15 @@ require (
 	github.com/stretchr/testify v1.10.0
 	golang.org/x/crypto v0.36.0
 	golang.org/x/net v0.37.0
-	golang.org/x/oauth2 v0.25.0
-	google.golang.org/api v0.219.0
+	golang.org/x/oauth2 v0.24.0
+	google.golang.org/api v0.214.0
 	google.golang.org/genproto v0.0.0-20241118233622-e639e219e697
-	k8s.io/utils v0.0.0-20230726121419-3b25d923346b
+	k8s.io/utils v0.0.0-20240102154912-e7106e64919e
 )
 
 require (
-	cloud.google.com/go/auth v0.14.0 // indirect
-	cloud.google.com/go/auth/oauth2adapt v0.2.7 // indirect
+	cloud.google.com/go/auth v0.13.0 // indirect
+	cloud.google.com/go/auth/oauth2adapt v0.2.6 // indirect
 	filippo.io/edwards25519 v1.1.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.8.0 // indirect
 	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
@@ -90,9 +90,9 @@ require (
 	github.com/golang/snappy v0.0.4 // indirect
 	github.com/google/certificate-transparency-go v1.3.1 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
-	github.com/google/s2a-go v0.1.9 // indirect
+	github.com/google/s2a-go v0.1.8 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.4 // indirect
-	github.com/googleapis/gax-go/v2 v2.14.1 // indirect
+	github.com/googleapis/gax-go/v2 v2.14.0 // indirect
 	github.com/gosimple/unidecode v1.0.1 // indirect
 	github.com/hashicorp/cap v0.6.0 // indirect
 	github.com/hashicorp/cap/ldap v0.0.0-20250106213447-9047b8b3240f // indirect
@@ -173,9 +173,9 @@ require (
 	github.com/zclconf/go-cty v1.16.2 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.54.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0 // indirect
-	go.opentelemetry.io/otel v1.32.0 // indirect
-	go.opentelemetry.io/otel/metric v1.32.0 // indirect
-	go.opentelemetry.io/otel/trace v1.32.0 // indirect
+	go.opentelemetry.io/otel v1.31.0 // indirect
+	go.opentelemetry.io/otel/metric v1.31.0 // indirect
+	go.opentelemetry.io/otel/trace v1.31.0 // indirect
 	go.uber.org/atomic v1.11.0 // indirect
 	golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842 // indirect
 	golang.org/x/mod v0.22.0 // indirect
@@ -185,10 +185,10 @@ require (
 	golang.org/x/time v0.9.0 // indirect
 	golang.org/x/tools v0.29.0 // indirect
 	google.golang.org/appengine v1.6.8 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250124145028-65684f501c47 // indirect
-	google.golang.org/grpc v1.70.0 // indirect
-	google.golang.org/protobuf v1.36.4 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20241113202542-65e8d215514f // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 // indirect
+	google.golang.org/grpc v1.69.4 // indirect
+	google.golang.org/protobuf v1.36.3 // indirect
 	gopkg.in/jcmturner/goidentity.v3 v3.0.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/go.sum b/go.sum
index 81625896..b0232a44 100644
--- a/go.sum
+++ b/go.sum
@@ -161,10 +161,10 @@ cloud.google.com/go/assuredworkloads v1.11.1/go.mod h1:+F04I52Pgn5nmPG36CWFtxmav
 cloud.google.com/go/assuredworkloads v1.11.2/go.mod h1:O1dfr+oZJMlE6mw0Bp0P1KZSlj5SghMBvTpZqIcUAW4=
 cloud.google.com/go/assuredworkloads v1.11.3/go.mod h1:vEjfTKYyRUaIeA0bsGJceFV2JKpVRgyG2op3jfa59Zs=
 cloud.google.com/go/assuredworkloads v1.11.4/go.mod h1:4pwwGNwy1RP0m+y12ef3Q/8PaiWrIDQ6nD2E8kvWI9U=
-cloud.google.com/go/auth v0.14.0 h1:A5C4dKV/Spdvxcl0ggWwWEzzP7AZMJSEIgrkngwhGYM=
-cloud.google.com/go/auth v0.14.0/go.mod h1:CYsoRL1PdiDuqeQpZE0bP2pnPrGqFcOkI0nldEQis+A=
-cloud.google.com/go/auth/oauth2adapt v0.2.7 h1:/Lc7xODdqcEw8IrZ9SvwnlLX6j9FHQM74z6cBk9Rw6M=
-cloud.google.com/go/auth/oauth2adapt v0.2.7/go.mod h1:NTbTTzfvPl1Y3V1nPpOgl2w6d/FjO7NNUQaWSox6ZMc=
+cloud.google.com/go/auth v0.13.0 h1:8Fu8TZy167JkW8Tj3q7dIkr2v4cndv41ouecJx0PAHs=
+cloud.google.com/go/auth v0.13.0/go.mod h1:COOjD9gwfKNKz+IIduatIhYJQIc0mG3H102r/EMxX6Q=
+cloud.google.com/go/auth/oauth2adapt v0.2.6 h1:V6a6XDu2lTwPZWOawrAa9HUK+DB2zfJyTuciBG5hFkU=
+cloud.google.com/go/auth/oauth2adapt v0.2.6/go.mod h1:AlmsELtlEBnaNTL7jCj8VQFLy6mbZv0s4Q7NGBeQ5E8=
 cloud.google.com/go/automl v1.5.0/go.mod h1:34EjfoFGMZ5sgJ9EoLsRtdPSNZLcfflJR39VbVNS2M0=
 cloud.google.com/go/automl v1.6.0/go.mod h1:ugf8a6Fx+zP0D59WLhqgTDsQI9w07o64uf/Is3Nh5p8=
 cloud.google.com/go/automl v1.7.0/go.mod h1:RL9MYCCsJEOmt0Wf3z9uzG0a7adTT1fe+aObgSpkCt8=
@@ -1909,8 +1909,8 @@ github.com/google/s2a-go v0.1.0/go.mod h1:OJpEgntRZo8ugHpF9hkoLJbS5dSI20XZeXJ9JV
 github.com/google/s2a-go v0.1.3/go.mod h1:Ej+mSEMGRnqRzjc7VtF+jdBwYG5fuJfiZ8ELkjEwM0A=
 github.com/google/s2a-go v0.1.4/go.mod h1:Ej+mSEMGRnqRzjc7VtF+jdBwYG5fuJfiZ8ELkjEwM0A=
 github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw=
-github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
-github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
+github.com/google/s2a-go v0.1.8 h1:zZDs9gcbt9ZPLV0ndSyQk6Kacx2g/X+SKYovpnz3SMM=
+github.com/google/s2a-go v0.1.8/go.mod h1:6iNWHTpQ+nfNRN5E00MSdfDwVesa8hhS32PhPO8deJA=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/google/tink/go v1.7.0/go.mod h1:GAUOd+QE3pgj9q8VKIGTCP33c/B7eb4NhxLcgTJZStM=
@@ -1948,8 +1948,8 @@ github.com/googleapis/gax-go/v2 v2.8.0/go.mod h1:4orTrqY6hXxxaUL4LHIPl6lGo8vAE38
 github.com/googleapis/gax-go/v2 v2.10.0/go.mod h1:4UOEnMCrxsSqQ940WnTiD6qJ63le2ev3xfyagutxiPw=
 github.com/googleapis/gax-go/v2 v2.11.0/go.mod h1:DxmR61SGKkGLa2xigwuZIQpkCI2S5iydzRfb3peWZJI=
 github.com/googleapis/gax-go/v2 v2.12.0/go.mod h1:y+aIqrI5eb1YGMVJfuV3185Ts/D7qKpsEkdD5+I6QGU=
-github.com/googleapis/gax-go/v2 v2.14.1 h1:hb0FFeiPaQskmvakKu5EbCbpntQn48jyHuvrkurSS/Q=
-github.com/googleapis/gax-go/v2 v2.14.1/go.mod h1:Hb/NubMaVM88SrNkvl8X/o8XWwDJEPqouaLeN2IUxoA=
+github.com/googleapis/gax-go/v2 v2.14.0 h1:f+jMrjBPl+DL9nI4IQzLUxMq7XrAqFYB7hBPqMNIe8o=
+github.com/googleapis/gax-go/v2 v2.14.0/go.mod h1:lhBCnjdLrWRaPvLWhmc8IS24m9mr07qSYnHncrgo+zk=
 github.com/googleapis/gnostic v0.4.1/go.mod h1:LRhVm6pbyptWbWbuZ38d1eyptfvIytN3ir6b65WBswg=
 github.com/googleapis/gnostic v0.5.1/go.mod h1:6U4PtQXGIEt/Z3h5MAT7FNofLnw9vXk2cUuW7uA/OeU=
 github.com/googleapis/gnostic v0.5.5/go.mod h1:7+EbHbldMins07ALC74bsA81Ovc97DwqyJO1AENw9kA=
@@ -2047,8 +2047,8 @@ github.com/hashicorp/go-retryablehttp v0.7.7/go.mod h1:pkQpWZeYWskR+D1tR2O5OcBFO
 github.com/hashicorp/go-rootcerts v1.0.0/go.mod h1:K6zTfqpRlCUIjkwsN4Z+hiSfzSTQa6eBIzfwKfwNnHU=
 github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
 github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
-github.com/hashicorp/go-secure-stdlib/awsutil v0.2.3 h1:AAQ6Vmo/ncfrZYtbpjhO+g0Qt+iNpYtl3UWT1NLmbYY=
-github.com/hashicorp/go-secure-stdlib/awsutil v0.2.3/go.mod h1:oKHSQs4ivIfZ3fbXGQOop1XuDfdSb8RIsWTGaAanSfg=
+github.com/hashicorp/go-secure-stdlib/awsutil v0.3.0 h1:I8bynUKMh9I7JdwtW9voJ0xmHvBpxQtLjrMFDYmhOxY=
+github.com/hashicorp/go-secure-stdlib/awsutil v0.3.0/go.mod h1:oKHSQs4ivIfZ3fbXGQOop1XuDfdSb8RIsWTGaAanSfg=
 github.com/hashicorp/go-secure-stdlib/base62 v0.1.1/go.mod h1:EdWO6czbmthiwZ3/PUsDV+UD1D5IRU4ActiaWGwt0Yw=
 github.com/hashicorp/go-secure-stdlib/base62 v0.1.2 h1:ET4pqyjiGmY09R5y+rSd70J2w45CtbWDNvGqWp/R3Ng=
 github.com/hashicorp/go-secure-stdlib/base62 v0.1.2/go.mod h1:EdWO6czbmthiwZ3/PUsDV+UD1D5IRU4ActiaWGwt0Yw=
@@ -2895,8 +2895,8 @@ go.opentelemetry.io/otel v1.7.0/go.mod h1:5BdUoMIz5WEs0vt0CUEMtSSaTSHBBVwrhnz7+n
 go.opentelemetry.io/otel v1.8.0/go.mod h1:2pkj+iMj0o03Y+cW6/m8Y4WkRdYN3AvCXCnzRMp9yvM=
 go.opentelemetry.io/otel v1.10.0/go.mod h1:NbvWjCthWHKBEUMpf0/v8ZRZlni86PpGFEMA9pnQSnQ=
 go.opentelemetry.io/otel v1.14.0/go.mod h1:o4buv+dJzx8rohcUeRmWUZhqupFvzWis188WlggnNeU=
-go.opentelemetry.io/otel v1.32.0 h1:WnBN+Xjcteh0zdk01SVqV55d/m62NJLJdIyb4y/WO5U=
-go.opentelemetry.io/otel v1.32.0/go.mod h1:00DCVSB0RQcnzlwyTfqtxSm+DRr9hpYrHjNGiBHVQIg=
+go.opentelemetry.io/otel v1.31.0 h1:NsJcKPIW0D0H3NgzPDHmo0WW6SptzPdqg/L1zsIm2hY=
+go.opentelemetry.io/otel v1.31.0/go.mod h1:O0C14Yl9FgkjqcCZAsE053C13OaddMYr/hz6clDkEJE=
 go.opentelemetry.io/otel/exporters/otlp v0.20.0 h1:PTNgq9MRmQqqJY0REVbZFvwkYOA85vbdQU/nVfxDyqg=
 go.opentelemetry.io/otel/exporters/otlp v0.20.0/go.mod h1:YIieizyaN77rtLJra0buKiNBOm9XQfkPEKBeuhoMwAM=
 go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.3.0/go.mod h1:VpP4/RMn8bv8gNo9uK7/IMY4mtWLELsS+JIP0inH0h4=
@@ -2923,8 +2923,8 @@ go.opentelemetry.io/otel/metric v0.20.0/go.mod h1:598I5tYlH1vzBjn+BTuhzTCSb/9deb
 go.opentelemetry.io/otel/metric v0.30.0/go.mod h1:/ShZ7+TS4dHzDFmfi1kSXMhMVubNoP0oIaBp70J6UXU=
 go.opentelemetry.io/otel/metric v0.31.0/go.mod h1:ohmwj9KTSIeBnDBm/ZwH2PSZxZzoOaG2xZeekTRzL5A=
 go.opentelemetry.io/otel/metric v0.37.0/go.mod h1:DmdaHfGt54iV6UKxsV9slj2bBRJcKC1B1uvDLIioc1s=
-go.opentelemetry.io/otel/metric v1.32.0 h1:xV2umtmNcThh2/a/aCP+h64Xx5wsj8qqnkYZktzNa0M=
-go.opentelemetry.io/otel/metric v1.32.0/go.mod h1:jH7CIbbK6SH2V2wE16W05BHCtIDzauciCRLoc/SyMv8=
+go.opentelemetry.io/otel/metric v1.31.0 h1:FSErL0ATQAmYHUIzSezZibnyVlft1ybhy4ozRPcF2fE=
+go.opentelemetry.io/otel/metric v1.31.0/go.mod h1:C3dEloVbLuYoX41KpmAhOqNriGbA+qqH6PQ5E5mUfnY=
 go.opentelemetry.io/otel/oteltest v0.20.0/go.mod h1:L7bgKf9ZB7qCwT9Up7i9/pn0PWIa9FqQ2IQ8LoxiGnw=
 go.opentelemetry.io/otel/sdk v0.20.0/go.mod h1:g/IcepuwNsoiX5Byy2nNV0ySUF1em498m7hBWC279Yc=
 go.opentelemetry.io/otel/sdk v1.0.1/go.mod h1:HrdXne+BiwsOHYYkBE5ysIcv2bvdZstxzmCQhxTcZkI=
@@ -2932,12 +2932,12 @@ go.opentelemetry.io/otel/sdk v1.3.0/go.mod h1:rIo4suHNhQwBIPg9axF8V9CA72Wz2mKF1t
 go.opentelemetry.io/otel/sdk v1.7.0/go.mod h1:uTEOTwaqIVuTGiJN7ii13Ibp75wJmYUDe374q6cZwUU=
 go.opentelemetry.io/otel/sdk v1.10.0/go.mod h1:vO06iKzD5baltJz1zarxMCNHFpUlUiOy4s65ECtn6kE=
 go.opentelemetry.io/otel/sdk v1.14.0/go.mod h1:bwIC5TjrNG6QDCHNWvW4HLHtUQ4I+VQDsnjhvyZCALM=
-go.opentelemetry.io/otel/sdk v1.32.0 h1:RNxepc9vK59A8XsgZQouW8ue8Gkb4jpWtJm9ge5lEG4=
-go.opentelemetry.io/otel/sdk v1.32.0/go.mod h1:LqgegDBjKMmb2GC6/PrTnteJG39I8/vJCAP9LlJXEjU=
+go.opentelemetry.io/otel/sdk v1.31.0 h1:xLY3abVHYZ5HSfOg3l2E5LUj2Cwva5Y7yGxnSW9H5Gk=
+go.opentelemetry.io/otel/sdk v1.31.0/go.mod h1:TfRbMdhvxIIr/B2N2LQW2S5v9m3gOQ/08KsbbO5BPT0=
 go.opentelemetry.io/otel/sdk/export/metric v0.20.0/go.mod h1:h7RBNMsDJ5pmI1zExLi+bJK+Dr8NQCh0qGhm1KDnNlE=
 go.opentelemetry.io/otel/sdk/metric v0.20.0/go.mod h1:knxiS8Xd4E/N+ZqKmUPf3gTTZ4/0TjTXukfxjzSTpHE=
-go.opentelemetry.io/otel/sdk/metric v1.32.0 h1:rZvFnvmvawYb0alrYkjraqJq0Z4ZUJAiyYCU9snn1CU=
-go.opentelemetry.io/otel/sdk/metric v1.32.0/go.mod h1:PWeZlq0zt9YkYAp3gjKZ0eicRYvOh1Gd+X99x6GHpCQ=
+go.opentelemetry.io/otel/sdk/metric v1.31.0 h1:i9hxxLJF/9kkvfHppyLL55aW7iIJz4JjxTeYusH7zMc=
+go.opentelemetry.io/otel/sdk/metric v1.31.0/go.mod h1:CRInTMVvNhUKgSAMbKyTMxqOBC0zgyxzW55lZzX43Y8=
 go.opentelemetry.io/otel/trace v0.20.0/go.mod h1:6GjCW8zgDjwGHGa6GkyeB8+/5vjT16gUEi0Nf1iBdgw=
 go.opentelemetry.io/otel/trace v1.0.1/go.mod h1:5g4i4fKLaX2BQpSBsxw8YYcgKpMMSW3x7ZTuYBr3sUk=
 go.opentelemetry.io/otel/trace v1.3.0/go.mod h1:c/VDhno8888bvQYmbYLqe41/Ldmr/KKunbvWM4/fEjk=
@@ -2945,8 +2945,8 @@ go.opentelemetry.io/otel/trace v1.7.0/go.mod h1:fzLSB9nqR2eXzxPXb2JW9IKE+ScyXA48
 go.opentelemetry.io/otel/trace v1.8.0/go.mod h1:0Bt3PXY8w+3pheS3hQUt+wow8b1ojPaTBoTCh2zIFI4=
 go.opentelemetry.io/otel/trace v1.10.0/go.mod h1:Sij3YYczqAdz+EhmGhE6TpTxUO5/F/AzrK+kxfGqySM=
 go.opentelemetry.io/otel/trace v1.14.0/go.mod h1:8avnQLK+CG77yNLUae4ea2JDQ6iT+gozhnZjy/rw9G8=
-go.opentelemetry.io/otel/trace v1.32.0 h1:WIC9mYrXf8TmY/EXuULKc8hR17vE+Hjv2cssQDe03fM=
-go.opentelemetry.io/otel/trace v1.32.0/go.mod h1:+i4rkvCraA+tG6AzwloGaCtkx53Fa+L+V8e9a7YvhT8=
+go.opentelemetry.io/otel/trace v1.31.0 h1:ffjsj1aRouKewfr85U2aGagJ46+MvodynlQ1HYdmJys=
+go.opentelemetry.io/otel/trace v1.31.0/go.mod h1:TXZkRk7SM2ZQLtR6eoAWQFIHPvzQ06FJAsO1tJg480A=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
 go.opentelemetry.io/proto/otlp v0.9.0/go.mod h1:1vKfU9rv61e9EVGthD1zNvUbiwPcimSsOPU9brfSHJg=
 go.opentelemetry.io/proto/otlp v0.11.0/go.mod h1:QpEjXPrNQzrFDZgoTo49dgHR9RYRSrg3NAKnUGl9YpQ=
@@ -3227,8 +3227,8 @@ golang.org/x/oauth2 v0.10.0/go.mod h1:kTpgurOux7LqtuxjuyZa4Gj2gdezIt/jQtGnNFfypQ
 golang.org/x/oauth2 v0.11.0/go.mod h1:LdF7O/8bLR/qWK9DrpXmbHLTouvRHK0SgJl0GmDBchk=
 golang.org/x/oauth2 v0.13.0/go.mod h1:/JMhi4ZRXAf4HG9LiNmxvk+45+96RUlVThiH8FzNBn0=
 golang.org/x/oauth2 v0.14.0/go.mod h1:lAtNWgaWfL4cm7j2OV8TxGi9Qb7ECORx8DktCY74OwM=
-golang.org/x/oauth2 v0.25.0 h1:CY4y7XT9v0cRI9oupztF8AgiIu99L/ksR/Xp/6jrZ70=
-golang.org/x/oauth2 v0.25.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
+golang.org/x/oauth2 v0.24.0 h1:KTBBxWqUa0ykRPLtV69rRto9TLXcqYkeswu48x/gvNE=
+golang.org/x/oauth2 v0.24.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -3650,8 +3650,8 @@ google.golang.org/api v0.128.0/go.mod h1:Y611qgqaE92On/7g65MQgxYul3c0rEB894kniWL
 google.golang.org/api v0.134.0/go.mod h1:sjRL3UnjTx5UqNQS9EWr9N8p7xbHpy1k0XGRLCf3Spk=
 google.golang.org/api v0.139.0/go.mod h1:CVagp6Eekz9CjGZ718Z+sloknzkDJE7Vc1Ckj9+viBk=
 google.golang.org/api v0.149.0/go.mod h1:Mwn1B7JTXrzXtnvmzQE2BD6bYZQ8DShKZDZbeN9I7qI=
-google.golang.org/api v0.219.0 h1:nnKIvxKs/06jWawp2liznTBnMRQBEPpGo7I+oEypTX0=
-google.golang.org/api v0.219.0/go.mod h1:K6OmjGm+NtLrIkHxv1U3a0qIf/0JOvAHd5O/6AoyKYE=
+google.golang.org/api v0.214.0 h1:h2Gkq07OYi6kusGOaT/9rnNljuXmqPnaig7WGPmKbwA=
+google.golang.org/api v0.214.0/go.mod h1:bYPpLG8AyeMWwDU6NXoB00xC0DFkikVvd5MfwoxjLqE=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -3840,8 +3840,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20231012201019-e917dd12ba7a/go.
 google.golang.org/genproto/googleapis/api v0.0.0-20231016165738-49dd2c1f3d0b/go.mod h1:IBQ646DjkDkvUIsVq/cc03FUFQ9wbZu7yE396YcL870=
 google.golang.org/genproto/googleapis/api v0.0.0-20231030173426-d783a09b4405/go.mod h1:oT32Z4o8Zv2xPQTg0pbVaPr0MPOH6f14RgXt7zfIpwg=
 google.golang.org/genproto/googleapis/api v0.0.0-20231106174013-bbf56f31fb17/go.mod h1:0xJLfVdJqpAPl8tDg1ujOCGzx6LFLttXT5NhllGOXY4=
-google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576 h1:CkkIfIt50+lT6NHAVoRYEyAvQGFM7xEwXUUywFvEb3Q=
-google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576/go.mod h1:1R3kvZ1dtP3+4p4d3G8uJ8rFk/fWlScl38vanWACI08=
+google.golang.org/genproto/googleapis/api v0.0.0-20241113202542-65e8d215514f h1:M65LEviCfuZTfrfzwwEoxVtgvfkFkBUbFnRbxCXuXhU=
+google.golang.org/genproto/googleapis/api v0.0.0-20241113202542-65e8d215514f/go.mod h1:Yo94eF2nj7igQt+TiJ49KxjIH8ndLYPZMIRSiRcEbg0=
 google.golang.org/genproto/googleapis/bytestream v0.0.0-20230530153820-e85fd2cbaebc/go.mod h1:ylj+BE99M198VPbBh6A8d9n3w8fChvyLK3wwBOjXBFA=
 google.golang.org/genproto/googleapis/bytestream v0.0.0-20230720185612-659f7aaaa771/go.mod h1:3QoBVwTHkXbY1oRGzlhwhOykfcATQN43LJ6iT8Wy8kE=
 google.golang.org/genproto/googleapis/bytestream v0.0.0-20230807174057-1744710a1577/go.mod h1:NjCQG/D8JandXxM57PZbAJL1DCNL6EypA0vPPwfsc7c=
@@ -3864,8 +3864,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20231012201019-e917dd12ba7a/go.
 google.golang.org/genproto/googleapis/rpc v0.0.0-20231016165738-49dd2c1f3d0b/go.mod h1:swOH3j0KzcDDgGUWr+SNpyTen5YrXjS3eyPzFYKc6lc=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20231030173426-d783a09b4405/go.mod h1:67X1fPuzjcrkymZzZV1vvkFeTn2Rvc6lYF9MYFGCcwE=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20231106174013-bbf56f31fb17/go.mod h1:oQ5rr10WTTMvP4A36n8JpR1OrO1BEiV4f78CneXZxkA=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250124145028-65684f501c47 h1:91mG8dNTpkC0uChJUQ9zCiRqx3GEEFOWaRZ0mI6Oj2I=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250124145028-65684f501c47/go.mod h1:+2Yz8+CLJbIfL9z73EW45avw8Lmge3xVElCP9zEKi50=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 h1:8ZmaLZE4XWrtU3MyClkYqqtl6Oegr3235h7jxsDyqCY=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576/go.mod h1:5uTbfoYQed2U9p3KIj2/Zzm02PYhndfdmML0qC3q3FU=
 google.golang.org/grpc v0.0.0-20160317175043-d3ddb4469d5a/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.8.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
@@ -3922,8 +3922,8 @@ google.golang.org/grpc v1.58.2/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSs
 google.golang.org/grpc v1.58.3/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSsCJk0=
 google.golang.org/grpc v1.59.0/go.mod h1:aUPDwccQo6OTjy7Hct4AfBPD1GptF4fyUjIkQ9YtF98=
 google.golang.org/grpc v1.61.0/go.mod h1:VUbo7IFqmF1QtCAstipjG0GIoq49KvMe9+h1jFLBNJs=
-google.golang.org/grpc v1.70.0 h1:pWFv03aZoHzlRKHWicjsZytKAiYCtNS0dHbXnIdq7jQ=
-google.golang.org/grpc v1.70.0/go.mod h1:ofIJqVKDXx/JiXrwr2IG4/zwdH9txy3IlF40RmcJSQw=
+google.golang.org/grpc v1.69.4 h1:MF5TftSMkd8GLw/m0KM6V8CMOCY6NZ1NQDPGFgbTt4A=
+google.golang.org/grpc v1.69.4/go.mod h1:vyjdE6jLBI76dgpDojsFGNaHlxdjXN9ghpnd2o7JGZ4=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
@@ -3944,8 +3944,8 @@ google.golang.org/protobuf v1.28.2-0.20230222093303-bc1253ad3743/go.mod h1:HV8QO
 google.golang.org/protobuf v1.29.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.36.4 h1:6A3ZDJHn/eNqc1i+IdefRzy/9PokBTPvcqMySR7NNIM=
-google.golang.org/protobuf v1.36.4/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.3 h1:82DV7MYdb8anAVi3qge1wSnMDrnKK7ebr+I0hHRN1BU=
+google.golang.org/protobuf v1.36.3/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/airbrake/gobrake.v2 v2.0.9/go.mod h1:/h5ZAUhDkGaJfjzjKLSjv6zCL6O0LLBxU4K+aSYdM/U=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -4067,8 +4067,8 @@ k8s.io/utils v0.0.0-20210930125809-cb0fa318a74b/go.mod h1:jPW/WVKK9YHAvNhRxK0md/
 k8s.io/utils v0.0.0-20220728103510-ee6ede2d64ed/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
 k8s.io/utils v0.0.0-20221107191617-1a15be271d1d/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 k8s.io/utils v0.0.0-20230220204549-a5ecb0141aa5/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-k8s.io/utils v0.0.0-20230726121419-3b25d923346b h1:sgn3ZU783SCgtaSJjpcVVlRqd6GSnlTLKgpAAttJvpI=
-k8s.io/utils v0.0.0-20230726121419-3b25d923346b/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+k8s.io/utils v0.0.0-20240102154912-e7106e64919e h1:eQ/4ljkx21sObifjzXwlPKpdGLrCfRziVtos3ofG/sQ=
+k8s.io/utils v0.0.0-20240102154912-e7106e64919e/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 lukechampine.com/uint128 v1.1.1/go.mod h1:c4eWIwlEGaxC/+H1VguhU4PHXNWDCDMUlWdIWl2j1gk=
 lukechampine.com/uint128 v1.2.0/go.mod h1:c4eWIwlEGaxC/+H1VguhU4PHXNWDCDMUlWdIWl2j1gk=
 modernc.org/cc/v3 v3.36.0/go.mod h1:NFUHyPn4ekoC/JHeZFfZurN6ixxawE1BnVonP/oahEI=
diff --git a/internal/consts/consts.go b/internal/consts/consts.go
index 534b242d..6c33ecc0 100644
--- a/internal/consts/consts.go
+++ b/internal/consts/consts.go
@@ -534,6 +534,7 @@ const (
 	FieldDeletionTime                         = "deletion_time"
 	FieldDestroyed                            = "destroyed"
 	FieldDeleteAllVersions                    = "delete_all_versions"
+	FieldForceNoCache                         = "force_no_cache"
 
 	/*
 		ephemeral resource constants and write-only attributes
diff --git a/vault/resource_aws_secret_backend.go b/vault/resource_aws_secret_backend.go
index a33ed5c4..c7c559be 100644
--- a/vault/resource_aws_secret_backend.go
+++ b/vault/resource_aws_secret_backend.go
@@ -19,7 +19,6 @@ import (
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/util"
-	"github.com/hashicorp/terraform-provider-vault/util/mountutil"
 )
 
 var awsSecretFields = []string{
@@ -155,6 +154,17 @@ func awsSecretBackendResource() *schema.Resource {
 		},
 	}, false)
 
+	// Add common mount schema to the resource
+	provider.MustAddSchema(r, getMountSchema(
+		consts.FieldPath,
+		consts.FieldType,
+		consts.FieldDescription,
+		consts.FieldDefaultLeaseTTL,
+		consts.FieldMaxLeaseTTL,
+		consts.FieldIdentityTokenKey,
+		consts.FieldLocal,
+	))
+
 	// Add common automated root rotation schema to the resource
 	provider.MustAddSchema(r, provider.GetAutomatedRootRotationSchema())
 
@@ -197,36 +207,17 @@ func awsSecretBackendCreate(ctx context.Context, d *schema.ResourceData, meta in
 	}
 
 	path := d.Get(consts.FieldPath).(string)
-	description := d.Get(consts.FieldDescription).(string)
-	defaultTTL := d.Get(consts.FieldDefaultLeaseTTL).(int)
-	maxTTL := d.Get(consts.FieldMaxLeaseTTL).(int)
 	accessKey := d.Get(consts.FieldAccessKey).(string)
 	secretKey := d.Get(consts.FieldSecretKey).(string)
 	region := d.Get(consts.FieldRegion).(string)
-	local := d.Get(consts.FieldLocal).(bool)
 
 	d.Partial(true)
 	log.Printf("[DEBUG] Mounting AWS backend at %q", path)
-	mountConfig := api.MountConfigInput{
-		DefaultLeaseTTL: fmt.Sprintf("%ds", defaultTTL),
-		MaxLeaseTTL:     fmt.Sprintf("%ds", maxTTL),
-	}
 
-	if useAPIVer116Enterprise {
-		identityTokenKey := d.Get(consts.FieldIdentityTokenKey).(string)
-		if identityTokenKey != "" {
-			mountConfig.IdentityTokenKey = identityTokenKey
-		}
-	}
-	err := client.Sys().MountWithContext(ctx, path, &api.MountInput{
-		Type:        consts.MountTypeAWS,
-		Description: description,
-		Local:       local,
-		Config:      mountConfig,
-	})
-	if err != nil {
-		return diag.Errorf("error mounting to %q: %s", path, err)
+	if err := createMount(ctx, d, meta, client, path, consts.MountTypeAWS); err != nil {
+		return diag.FromErr(err)
 	}
+
 	log.Printf("[DEBUG] Mounted AWS backend at %q", path)
 	d.SetId(path)
 
@@ -277,7 +268,7 @@ func awsSecretBackendCreate(ctx context.Context, d *schema.ResourceData, meta in
 		data[consts.FieldRegion] = region
 	}
 
-	_, err = client.Logical().WriteWithContext(ctx, path+"/config/root", data)
+	_, err := client.Logical().WriteWithContext(ctx, path+"/config/root", data)
 	if err != nil {
 		return diag.Errorf("error configuring root credentials for %q: %s", path, err)
 	}
@@ -302,20 +293,6 @@ func awsSecretBackendRead(ctx context.Context, d *schema.ResourceData, meta inte
 
 	path := d.Id()
 
-	log.Printf("[DEBUG] Reading AWS backend mount %q from Vault", path)
-
-	mount, err := mountutil.GetMount(ctx, client, path)
-	if err != nil {
-		if mountutil.IsMountNotFoundError(err) {
-			log.Printf("[WARN] Mount %q not found, removing from state.", path)
-			d.SetId("")
-			return nil
-		}
-		return diag.FromErr(err)
-	}
-
-	log.Printf("[DEBUG] Read AWS backend mount %q from Vault", path)
-
 	log.Printf("[DEBUG] Read AWS secret backend config/root %s", path)
 	resp, err := client.Logical().ReadWithContext(ctx, path+"/config/root")
 	if err != nil {
@@ -396,23 +373,10 @@ func awsSecretBackendRead(ctx context.Context, d *schema.ResourceData, meta inte
 	if err := d.Set(consts.FieldPath, path); err != nil {
 		return diag.FromErr(err)
 	}
-	if err := d.Set(consts.FieldDescription, mount.Description); err != nil {
-		return diag.FromErr(err)
-	}
-	if err := d.Set(consts.FieldDefaultLeaseTTL, mount.Config.DefaultLeaseTTL); err != nil {
-		return diag.FromErr(err)
-	}
-	if err := d.Set(consts.FieldMaxLeaseTTL, mount.Config.MaxLeaseTTL); err != nil {
-		return diag.FromErr(err)
-	}
-	if err := d.Set(consts.FieldLocal, mount.Local); err != nil {
+
+	if err := readMount(ctx, d, meta, true, false); err != nil {
 		return diag.FromErr(err)
 	}
-	if useAPIVer116 {
-		if err := d.Set(consts.FieldIdentityTokenKey, mount.Config.IdentityTokenKey); err != nil {
-			return diag.FromErr(err)
-		}
-	}
 
 	return nil
 }
@@ -427,34 +391,12 @@ func awsSecretBackendUpdate(ctx context.Context, d *schema.ResourceData, meta in
 		return diag.FromErr(e)
 	}
 
-	path := d.Id()
 	d.Partial(true)
 
-	path, err := util.Remount(d, client, consts.FieldPath, false)
-	if err != nil {
+	if err := updateMount(ctx, d, meta, true, false); err != nil {
 		return diag.FromErr(err)
 	}
-	if d.HasChanges(consts.FieldDefaultLeaseTTL, consts.FieldMaxLeaseTTL, consts.FieldDescription, consts.FieldIdentityTokenKey) {
-		description := d.Get(consts.FieldDescription).(string)
-		config := api.MountConfigInput{
-			Description:     &description,
-			DefaultLeaseTTL: fmt.Sprintf("%ds", d.Get(consts.FieldDefaultLeaseTTL)),
-			MaxLeaseTTL:     fmt.Sprintf("%ds", d.Get(consts.FieldMaxLeaseTTL)),
-		}
-
-		if useAPIVer116 {
-			identityTokenKey := d.Get(consts.FieldIdentityTokenKey).(string)
-			if identityTokenKey != "" {
-				config.IdentityTokenKey = identityTokenKey
-			}
-		}
-		log.Printf("[DEBUG] Updating mount config input for %q", path)
-		err := client.Sys().TuneMountWithContext(ctx, path, config)
-		if err != nil {
-			return diag.Errorf("error updating mount config input for %q: %s", path, err)
-		}
-		log.Printf("[DEBUG] Updated mount config input for %q", path)
-	}
+	path := d.Id()
 	if d.HasChanges(consts.FieldAccessKey,
 		consts.FieldSecretKey, consts.FieldRegion, consts.FieldIAMEndpoint,
 		consts.FieldSTSEndpoint, consts.FieldSTSFallbackEndpoints, consts.FieldSTSRegion, consts.FieldSTSFallbackRegions,
diff --git a/vault/resource_azure_secret_backend.go b/vault/resource_azure_secret_backend.go
index f2cc7747..bd8639a6 100644
--- a/vault/resource_azure_secret_backend.go
+++ b/vault/resource_azure_secret_backend.go
@@ -11,13 +11,10 @@ import (
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/vault/api"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	automatedrotationutil "github.com/hashicorp/terraform-provider-vault/internal/rotation"
-	"github.com/hashicorp/terraform-provider-vault/util"
-	"github.com/hashicorp/terraform-provider-vault/util/mountutil"
 )
 
 func azureSecretBackendResource() *schema.Resource {
@@ -108,6 +105,14 @@ func azureSecretBackendResource() *schema.Resource {
 		},
 	}, false)
 
+	// Add common mount schema to the resource
+	provider.MustAddSchema(r, getMountSchema(
+		consts.FieldPath,
+		consts.FieldType,
+		consts.FieldDescription,
+		consts.FieldIdentityTokenKey,
+	))
+
 	provider.MustAddSchema(r, provider.GetAutomatedRootRotationSchema())
 
 	return r
@@ -120,28 +125,13 @@ func azureSecretBackendCreate(ctx context.Context, d *schema.ResourceData, meta
 	}
 
 	path := d.Get(consts.FieldPath).(string)
-	description := d.Get(consts.FieldDescription).(string)
 	configPath := azureSecretBackendPath(path)
 
 	d.Partial(true)
 	log.Printf("[DEBUG] Mounting Azure backend at %q", path)
 
-	mountConfig := api.MountConfigInput{}
-	useAPIVer117Ent := provider.IsAPISupported(meta, provider.VaultVersion117) && provider.IsEnterpriseSupported(meta)
-	if useAPIVer117Ent {
-		identityTokenKey := d.Get(consts.FieldIdentityTokenKey).(string)
-		if identityTokenKey != "" {
-			mountConfig.IdentityTokenKey = identityTokenKey
-		}
-	}
-	input := &api.MountInput{
-		Type:        "azure",
-		Description: description,
-		Config:      mountConfig,
-	}
-
-	if err := client.Sys().MountWithContext(ctx, path, input); err != nil {
-		return diag.Errorf("error mounting to %q: %s", path, err)
+	if err := createMount(ctx, d, meta, client, path, consts.MountTypeAzure); err != nil {
+		return diag.FromErr(err)
 	}
 
 	log.Printf("[DEBUG] Mounted Azure backend at %q", path)
@@ -166,20 +156,6 @@ func azureSecretBackendRead(ctx context.Context, d *schema.ResourceData, meta in
 
 	path := d.Id()
 
-	log.Printf("[DEBUG] Reading Azure backend mount %q from Vault", path)
-
-	mount, err := mountutil.GetMount(ctx, client, path)
-	if err != nil {
-		if mountutil.IsMountNotFoundError(err) {
-			log.Printf("[WARN] Mount %q not found, removing from state.", path)
-			d.SetId("")
-			return nil
-		}
-		return diag.FromErr(err)
-	}
-
-	log.Printf("[DEBUG] Read Azure backend mount %q from Vault", path)
-
 	log.Printf("[DEBUG] Read Azure secret Backend config %s", path)
 	resp, err := client.Logical().ReadWithContext(ctx, azureSecretBackendPath(path))
 	if err != nil {
@@ -213,15 +189,8 @@ func azureSecretBackendRead(ctx context.Context, d *schema.ResourceData, meta in
 		return diag.FromErr(err)
 	}
 
-	if err := d.Set(consts.FieldDescription, mount.Description); err != nil {
-		return diag.FromErr(err)
-	}
-
 	useAPIVer117Ent := provider.IsAPISupported(meta, provider.VaultVersion117) && provider.IsEnterpriseSupported(meta)
 	if useAPIVer117Ent {
-		if err := d.Set(consts.FieldIdentityTokenKey, mount.Config.IdentityTokenKey); err != nil {
-			return diag.FromErr(err)
-		}
 		if err := d.Set(consts.FieldIdentityTokenAudience, resp.Data[consts.FieldIdentityTokenAudience]); err != nil {
 			return diag.FromErr(err)
 		}
@@ -237,6 +206,10 @@ func azureSecretBackendRead(ctx context.Context, d *schema.ResourceData, meta in
 		}
 	}
 
+	if err := readMount(ctx, d, meta, true, false); err != nil {
+		return diag.FromErr(err)
+	}
+
 	return nil
 }
 
@@ -246,26 +219,11 @@ func azureSecretBackendUpdate(ctx context.Context, d *schema.ResourceData, meta
 		return diag.FromErr(e)
 	}
 
-	path := d.Id()
-
-	path, err := util.Remount(d, client, consts.FieldPath, false)
-	if err != nil {
+	if err := updateMount(ctx, d, meta, true, false); err != nil {
 		return diag.FromErr(err)
 	}
 
-	if d.HasChanges(consts.FieldIdentityTokenKey, consts.FieldDescription) {
-		desc := d.Get(consts.FieldDescription).(string)
-		config := api.MountConfigInput{
-			Description: &desc,
-		}
-		useAPIVer117Ent := provider.IsAPISupported(meta, provider.VaultVersion117) && provider.IsEnterpriseSupported(meta)
-		if useAPIVer117Ent {
-			config.IdentityTokenKey = d.Get(consts.FieldIdentityTokenKey).(string)
-		}
-		if err := client.Sys().TuneMountWithContext(ctx, path, config); err != nil {
-			return diag.FromErr(err)
-		}
-	}
+	path := d.Id()
 
 	data := azureSecretBackendRequestData(d, meta)
 	if len(data) > 0 {
diff --git a/vault/resource_consul_secret_backend.go b/vault/resource_consul_secret_backend.go
index 24e38309..c2a5f4a6 100644
--- a/vault/resource_consul_secret_backend.go
+++ b/vault/resource_consul_secret_backend.go
@@ -11,18 +11,13 @@ import (
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 
-	"github.com/hashicorp/terraform-provider-vault/internal/consts"
-	"github.com/hashicorp/terraform-provider-vault/util"
-	"github.com/hashicorp/terraform-provider-vault/util/mountutil"
-
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/vault/api"
-
+	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 )
 
 func consulSecretBackendResource() *schema.Resource {
-	return provider.MustAddMountMigrationSchema(&schema.Resource{
+	r := provider.MustAddMountMigrationSchema(&schema.Resource{
 		CreateContext: consulSecretBackendCreate,
 		ReadContext:   provider.ReadContextWrapper(consulSecretBackendRead),
 		UpdateContext: consulSecretBackendUpdate,
@@ -115,6 +110,18 @@ func consulSecretBackendResource() *schema.Resource {
 			},
 		},
 	}, false)
+
+	// Add common mount schema to the resource
+	provider.MustAddSchema(r, getMountSchema(
+		consts.FieldPath,
+		consts.FieldType,
+		consts.FieldDescription,
+		consts.FieldDefaultLeaseTTL,
+		consts.FieldMaxLeaseTTL,
+		consts.FieldLocal,
+	))
+
+	return r
 }
 
 func consulSecretBackendCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
@@ -130,22 +137,16 @@ func consulSecretBackendCreate(ctx context.Context, d *schema.ResourceData, meta
 	caCert := d.Get("ca_cert").(string)
 	clientCert := d.Get("client_cert").(string)
 	clientKey := d.Get("client_key").(string)
-	local := d.Get("local").(bool)
 
 	configPath := consulSecretBackendConfigPath(path)
 
-	info := &api.MountInput{
-		Type:        consts.MountTypeConsul,
-		Description: d.Get("description").(string),
-		Local:       local,
-		Config: api.MountConfigInput{
-			DefaultLeaseTTL: fmt.Sprintf("%ds", d.Get("default_lease_ttl_seconds")),
-			MaxLeaseTTL:     fmt.Sprintf("%ds", d.Get("max_lease_ttl_seconds")),
-		},
-	}
-
 	log.Printf("[DEBUG] Mounting Consul backend at %q", path)
 
+	if err := createMount(ctx, d, meta, client, path, consts.MountTypeConsul); err != nil {
+		return diag.FromErr(err)
+	}
+
+	log.Printf("[DEBUG] Mounted Consul backend at %q", path)
 	// If a token isn't provided and the Vault version is less than 1.11, fail before
 	// mounting the path in Vault.
 	useAPIVer1 := provider.IsAPISupported(meta, provider.VaultVersion111)
@@ -155,11 +156,6 @@ func consulSecretBackendCreate(ctx context.Context, d *schema.ResourceData, meta
 Vault client version does not meet the minimum requirement for this feature (Vault 1.11+)`)
 	}
 
-	if err := client.Sys().Mount(path, info); err != nil {
-		return diag.Errorf("error mounting to %q: %s", path, err)
-	}
-	log.Printf("[DEBUG] Mounted Consul backend at %q", path)
-
 	log.Printf("[DEBUG] Writing Consul configuration to %q", configPath)
 	data := map[string]interface{}{
 		"address":     address,
@@ -197,37 +193,25 @@ func consulSecretBackendRead(ctx context.Context, d *schema.ResourceData, meta i
 	path := d.Id()
 	configPath := consulSecretBackendConfigPath(path)
 
-	log.Printf("[DEBUG] Reading Consul backend mount %q from Vault", path)
-
-	mount, err := mountutil.GetMount(ctx, client, path)
-	if err != nil {
-		if mountutil.IsMountNotFoundError(err) {
-			log.Printf("[WARN] Mount %q not found, removing from state.", path)
-			d.SetId("")
-			return nil
-		}
-		return diag.FromErr(err)
-	}
-
-	log.Printf("[DEBUG] Read Consul backend mount %q from Vault", path)
-
 	log.Printf("[DEBUG] Reading %s from Vault", configPath)
 	secret, err := client.Logical().Read(configPath)
 	if err != nil {
 		return diag.Errorf("error reading from Vault: %s", err)
 	}
 
-	d.Set("path", path)
-	d.Set("description", mount.Description)
-	d.Set("default_lease_ttl_seconds", mount.Config.DefaultLeaseTTL)
-	d.Set("max_lease_ttl_seconds", mount.Config.MaxLeaseTTL)
-	d.Set("local", mount.Local)
+	if err := d.Set("path", path); err != nil {
+		return diag.FromErr(err)
+	}
+	if err := readMount(ctx, d, meta, true, false); err != nil {
+		return diag.FromErr(err)
+	}
 
-	// token, sadly, we can't read out
-	// the API doesn't support it
-	// So... if it drifts, it drift.
-	d.Set("address", secret.Data["address"].(string))
-	d.Set("scheme", secret.Data["scheme"].(string))
+	if err := d.Set("address", secret.Data["address"].(string)); err != nil {
+		return diag.FromErr(err)
+	}
+	if err := d.Set("scheme", secret.Data["scheme"].(string)); err != nil {
+		return diag.FromErr(err)
+	}
 
 	return nil
 }
@@ -238,26 +222,13 @@ func consulSecretBackendUpdate(ctx context.Context, d *schema.ResourceData, meta
 		return diag.FromErr(e)
 	}
 
-	path := d.Id()
-	configPath := consulSecretBackendConfigPath(path)
-
-	path, err := util.Remount(d, client, consts.FieldPath, false)
-	if err != nil {
+	if err := updateMount(ctx, d, meta, true, false); err != nil {
 		return diag.FromErr(err)
 	}
 
-	if d.HasChange("default_lease_ttl_seconds") || d.HasChange("max_lease_ttl_seconds") {
-		config := api.MountConfigInput{
-			DefaultLeaseTTL: fmt.Sprintf("%ds", d.Get("default_lease_ttl_seconds")),
-			MaxLeaseTTL:     fmt.Sprintf("%ds", d.Get("max_lease_ttl_seconds")),
-		}
-
-		log.Printf("[DEBUG] Updating lease TTLs for %q", path)
-		if err := client.Sys().TuneMount(path, config); err != nil {
-			return diag.Errorf("error updating mount TTLs for %q: %s", path, err)
-		}
+	path := d.Id()
+	configPath := consulSecretBackendConfigPath(path)
 
-	}
 	if d.HasChange("address") || d.HasChange("token") || d.HasChange("scheme") ||
 		d.HasChange("ca_cert") || d.HasChange("client_cert") || d.HasChange("client_key") {
 		log.Printf("[DEBUG] Updating Consul configuration at %q", configPath)
diff --git a/vault/resource_database_secrets_mount.go b/vault/resource_database_secrets_mount.go
index 23adf756..4729b332 100644
--- a/vault/resource_database_secrets_mount.go
+++ b/vault/resource_database_secrets_mount.go
@@ -242,12 +242,12 @@ func databaseSecretsMountCreateOrUpdate(ctx context.Context, d *schema.ResourceD
 	var root string
 	if d.IsNewResource() {
 		root = d.Get("path").(string)
-		if err := createMount(d, client, root, consts.MountTypeDatabase); err != nil {
+		if err := createMount(ctx, d, meta, client, root, consts.MountTypeDatabase); err != nil {
 			return diag.FromErr(err)
 		}
 	} else {
-		if err := mountUpdate(d, meta); err != nil {
-			return diag.FromErr(err)
+		if err := mountUpdate(ctx, d, meta); err != nil {
+			return err
 		}
 		root = d.Id()
 	}
@@ -292,8 +292,8 @@ func databaseSecretsMountRead(ctx context.Context, d *schema.ResourceData, meta
 		return diag.FromErr(e)
 	}
 
-	if err := readMount(d, meta, true); err != nil {
-		return diag.FromErr(err)
+	if e := readMount(ctx, d, meta, true, false); e != nil {
+		return diag.FromErr(e)
 	}
 
 	root := d.Id()
@@ -331,8 +331,7 @@ func databaseSecretsMountRead(ctx context.Context, d *schema.ResourceData, meta
 }
 
 func databaseSecretsMountDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	err := mountDelete(d, meta)
-	return diag.FromErr(err)
+	return mountDelete(ctx, d, meta)
 }
 
 func readDBEngineConfig(d *schema.ResourceData, client *api.Client, store *dbConfigStore, name string, meta interface{}) error {
diff --git a/vault/resource_gcp_secret_backend.go b/vault/resource_gcp_secret_backend.go
index e40bce3f..157bd81b 100644
--- a/vault/resource_gcp_secret_backend.go
+++ b/vault/resource_gcp_secret_backend.go
@@ -7,18 +7,15 @@ import (
 	"context"
 	"fmt"
 	"github.com/hashicorp/go-cty/cty"
+	"github.com/hashicorp/vault/api"
 	"log"
 	"strings"
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/vault/api"
-
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	automatedrotationutil "github.com/hashicorp/terraform-provider-vault/internal/rotation"
-	"github.com/hashicorp/terraform-provider-vault/util"
-	"github.com/hashicorp/terraform-provider-vault/util/mountutil"
 )
 
 func gcpSecretBackendResource(name string) *schema.Resource {
@@ -125,6 +122,18 @@ func gcpSecretBackendResource(name string) *schema.Resource {
 		},
 	}, false)
 
+	// Add common mount schema to the resource
+	provider.MustAddSchema(r, getMountSchema(
+		consts.FieldPath,
+		consts.FieldType,
+		consts.FieldDescription,
+		consts.FieldDefaultLeaseTTL,
+		consts.FieldMaxLeaseTTL,
+		consts.FieldIdentityTokenKey,
+		consts.FieldAccessor,
+		consts.FieldLocal,
+	))
+
 	// Add common automated root rotation schema to the resource.
 	provider.MustAddSchema(r, provider.GetAutomatedRootRotationSchema())
 
@@ -138,38 +147,19 @@ func gcpSecretBackendCreate(ctx context.Context, d *schema.ResourceData, meta in
 	}
 
 	path := d.Get(consts.FieldPath).(string)
-	description := d.Get(consts.FieldDescription).(string)
-	defaultTTL := d.Get(consts.FieldDefaultLeaseTTL).(int)
-	maxTTL := d.Get(consts.FieldMaxLeaseTTL).(int)
-	local := d.Get(consts.FieldLocal).(bool)
-	identityTokenKey := d.Get(consts.FieldIdentityTokenKey).(string)
 
 	configPath := gcpSecretBackendConfigPath(path)
 
 	d.Partial(true)
 	log.Printf("[DEBUG] Mounting GCP backend at %q", path)
+
 	useAPIVer117Ent := provider.IsAPISupported(meta, provider.VaultVersion117) && provider.IsEnterpriseSupported(meta)
 	useAPIVer119Ent := provider.IsAPISupported(meta, provider.VaultVersion119) && provider.IsEnterpriseSupported(meta)
 
-	mountConfig := api.MountConfigInput{
-		DefaultLeaseTTL: fmt.Sprintf("%ds", defaultTTL),
-		MaxLeaseTTL:     fmt.Sprintf("%ds", maxTTL),
-	}
-
-	// ID Token Key is only used in GCP mounts for 1.17+
-	if useAPIVer117Ent {
-		mountConfig.IdentityTokenKey = identityTokenKey
+	if err := createMount(ctx, d, meta, client, path, consts.MountTypeGCP); err != nil {
+		return diag.FromErr(err)
 	}
 
-	err := client.Sys().Mount(path, &api.MountInput{
-		Type:        consts.MountTypeGCP,
-		Description: description,
-		Config:      mountConfig,
-		Local:       local,
-	})
-	if err != nil {
-		return diag.Errorf("error mounting to %q: %s", path, err)
-	}
 	log.Printf("[DEBUG] Mounted GCP backend at %q", path)
 	d.SetId(path)
 
@@ -226,37 +216,11 @@ func gcpSecretBackendRead(ctx context.Context, d *schema.ResourceData, meta inte
 
 	path := d.Id()
 
-	log.Printf("[DEBUG] Reading GCP backend mount %q from Vault", path)
-
-	mount, err := mountutil.GetMount(ctx, client, path)
-	if err != nil {
-		if mountutil.IsMountNotFoundError(err) {
-			log.Printf("[WARN] Mount %q not found, removing from state.", path)
-			d.SetId("")
-			return nil
-		}
-		return diag.FromErr(err)
-	}
-
-	log.Printf("[DEBUG] Read GCP backend mount %q from Vault", path)
-
 	if err := d.Set(consts.FieldPath, path); err != nil {
 		return diag.FromErr(err)
 	}
-	if err := d.Set(consts.FieldDescription, mount.Description); err != nil {
-		return diag.FromErr(err)
-	}
-	if err := d.Set(consts.FieldDefaultLeaseTTL, mount.Config.DefaultLeaseTTL); err != nil {
-		return diag.FromErr(err)
-	}
-	if err := d.Set(consts.FieldMaxLeaseTTL, mount.Config.MaxLeaseTTL); err != nil {
-		return diag.FromErr(err)
-	}
-	if err := d.Set(consts.FieldLocal, mount.Local); err != nil {
-		return diag.FromErr(err)
-	}
 
-	if err := d.Set(consts.FieldAccessor, mount.Accessor); err != nil {
+	if err := readMount(ctx, d, meta, true, false); err != nil {
 		return diag.FromErr(err)
 	}
 
@@ -296,13 +260,12 @@ func gcpSecretBackendUpdate(ctx context.Context, d *schema.ResourceData, meta in
 		return diag.FromErr(e)
 	}
 
-	_ = d.Id()
 	d.Partial(true)
 
-	path, err := util.Remount(d, client, consts.FieldPath, false)
-	if err != nil {
+	if err := updateMount(ctx, d, meta, true, false); err != nil {
 		return diag.FromErr(err)
 	}
+	path := d.Id()
 
 	useAPIVer117Ent := provider.IsAPISupported(meta, provider.VaultVersion117) && provider.IsEnterpriseSupported(meta)
 	useAPIVer119Ent := provider.IsAPISupported(meta, provider.VaultVersion119) && provider.IsEnterpriseSupported(meta)
diff --git a/vault/resource_kmip_secret_backend.go b/vault/resource_kmip_secret_backend.go
index ad65e91a..c881b900 100644
--- a/vault/resource_kmip_secret_backend.go
+++ b/vault/resource_kmip_secret_backend.go
@@ -6,16 +6,12 @@ package vault
 import (
 	"context"
 	"fmt"
-	"log"
-	"time"
-
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/util"
-	"github.com/hashicorp/terraform-provider-vault/util/mountutil"
-
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/vault/api"
+	"log"
 )
 
 var kmipAPIFields = []string{
@@ -31,14 +27,14 @@ var kmipAPIFields = []string{
 }
 
 func kmipSecretBackendResource() *schema.Resource {
-	return provider.MustAddMountMigrationSchema(&schema.Resource{
-		Create:        kmipSecretBackendCreate,
-		Read:          provider.ReadWrapper(kmipSecretBackendRead),
-		Update:        kmipSecretBackendUpdate,
-		Delete:        kmipSecretBackendDelete,
+	r := provider.MustAddMountMigrationSchema(&schema.Resource{
+		CreateContext: kmipSecretBackendCreate,
+		ReadContext:   provider.ReadContextWrapper(kmipSecretBackendRead),
+		UpdateContext: kmipSecretBackendUpdate,
+		DeleteContext: kmipSecretBackendDelete,
 		CustomizeDiff: getMountCustomizeDiffFunc(consts.FieldPath),
 		Importer: &schema.ResourceImporter{
-			State: schema.ImportStatePassthrough,
+			StateContext: schema.ImportStatePassthroughContext,
 		},
 
 		Schema: map[string]*schema.Schema{
@@ -113,92 +109,48 @@ func kmipSecretBackendResource() *schema.Resource {
 			},
 		},
 	}, false)
+
+	// Add common mount schema to the resource
+	provider.MustAddSchema(r, getMountSchema(
+		consts.FieldPath,
+		consts.FieldType,
+		consts.FieldDescription,
+	))
+
+	return r
 }
 
-func kmipSecretBackendCreate(d *schema.ResourceData, meta interface{}) error {
+func kmipSecretBackendCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	client, e := provider.GetClient(d, meta)
 	if e != nil {
-		return e
+		return diag.FromErr(e)
 	}
 	path := d.Get("path").(string)
-	defaultTLSClientTTL := fmt.Sprintf("%ds", d.Get("default_tls_client_ttl").(int))
 
 	log.Printf("[DEBUG] Mounting KMIP backend at %q", path)
-	if err := client.Sys().Mount(path, &api.MountInput{
-		Type:        consts.MountTypeKMIP,
-		Description: d.Get("description").(string),
-		Config: api.MountConfigInput{
-			DefaultLeaseTTL: defaultTLSClientTTL,
-		},
-	}); err != nil {
-		return fmt.Errorf("error mounting to %q, err=%w", path, err)
+	if err := createMount(ctx, d, meta, client, path, consts.MountTypeKMIP); err != nil {
+		return diag.FromErr(err)
 	}
 
 	log.Printf("[DEBUG] Mounted KMIP backend at %q", path)
 	d.SetId(path)
 
-	return kmipSecretBackendUpdate(d, meta)
+	return kmipSecretBackendUpdate(ctx, d, meta)
 }
 
-func kmipSecretBackendUpdate(d *schema.ResourceData, meta interface{}) error {
+func kmipSecretBackendUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	client, e := provider.GetClient(d, meta)
 	if e != nil {
-		return e
+		return diag.FromErr(e)
 	}
-	path := d.Id()
-
-	if !d.IsNewResource() && d.HasChange("path") {
-		src := path
-		dest := d.Get("path").(string)
-
-		log.Printf("[DEBUG] Remount %s to %s in Vault", src, dest)
 
-		err := client.Sys().Remount(src, dest)
-		if err != nil {
-			return fmt.Errorf("error remounting in Vault: %s", err)
+	if !d.IsNewResource() {
+		if err := updateMount(ctx, d, meta, true, false); err != nil {
+			return diag.FromErr(err)
 		}
-
-		ctx := context.Background()
-		// There is something similar in resource_mount.go, but in the call to TuneMount().
-		var tries int
-		for {
-			if tries > 10 {
-				return fmt.Errorf(
-					"mount %q did did not become available after %d tries, interval=1s", dest, tries)
-			}
-
-			enabled, err := mountutil.CheckMountEnabled(ctx, client, dest)
-			if err != nil {
-				return err
-			}
-			if !enabled {
-				tries++
-				time.Sleep(1 * time.Second)
-				continue
-			}
-
-			break
-		}
-
-		path = dest
-		d.SetId(path)
 	}
 
-	log.Printf("[DEBUG] Updating mount %s in Vault", path)
-
-	if d.HasChange("default_tls_client_ttl") || d.HasChange("description") {
-		tune := api.MountConfigInput{}
-		tune.DefaultLeaseTTL = fmt.Sprintf("%ds", d.Get("default_tls_client_ttl"))
-		description := d.Get("description").(string)
-		tune.Description = &description
-
-		log.Printf("[DEBUG] Updating mount for %q", path)
-		err := client.Sys().TuneMount(path, tune)
-		if err != nil {
-			return fmt.Errorf("error updating mount for %q, err=%w", path, err)
-		}
-		log.Printf("[DEBUG] Updated mount for %q", path)
-	}
+	path := d.Id()
 
 	data := map[string]interface{}{}
 	configPath := fmt.Sprintf("%s/config", path)
@@ -217,26 +169,26 @@ func kmipSecretBackendUpdate(d *schema.ResourceData, meta interface{}) error {
 		}
 	}
 
-	if _, err := client.Logical().Write(configPath, data); err != nil {
-		return fmt.Errorf("error updating KMIP config %q, err=%w", configPath, err)
+	if _, err := client.Logical().WriteWithContext(ctx, configPath, data); err != nil {
+		return diag.Errorf("error updating KMIP config %q, err=%s", configPath, err)
 	}
 
 	log.Printf("[DEBUG] Updated %q", configPath)
 
-	return kmipSecretBackendRead(d, meta)
+	return kmipSecretBackendRead(ctx, d, meta)
 }
 
-func kmipSecretBackendRead(d *schema.ResourceData, meta interface{}) error {
+func kmipSecretBackendRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	client, e := provider.GetClient(d, meta)
 	if e != nil {
-		return e
+		return diag.FromErr(e)
 	}
 
 	path := d.Id()
 	log.Printf("[DEBUG] Reading KMIP config at %s/config", path)
-	resp, err := client.Logical().Read(path + "/config")
+	resp, err := client.Logical().ReadWithContext(ctx, path+"/config")
 	if err != nil {
-		return fmt.Errorf("error reading KMIP config at %q/config: err=%w", path, err)
+		return diag.Errorf("error reading KMIP config at %q/config: err=%s", path, err)
 	}
 
 	if resp == nil {
@@ -248,30 +200,38 @@ func kmipSecretBackendRead(d *schema.ResourceData, meta interface{}) error {
 
 	for _, k := range kmipAPIFields {
 		if err := d.Set(k, resp.Data[k]); err != nil {
-			return fmt.Errorf("error setting state key %q on KMIP config, err=%w", k, err)
+			return diag.Errorf("error setting state key %q on KMIP config, err=%s", k, err)
 		}
 	}
 
+	if err := d.Set(consts.FieldPath, path); err != nil {
+		return diag.FromErr(err)
+	}
+
+	if err := readMount(ctx, d, meta, true, false); err != nil {
+		return diag.FromErr(err)
+	}
+
 	return nil
 }
 
-func kmipSecretBackendDelete(d *schema.ResourceData, meta interface{}) error {
+func kmipSecretBackendDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	client, e := provider.GetClient(d, meta)
 	if e != nil {
-		return e
+		return diag.FromErr(e)
 	}
 	path := d.Id()
 	log.Printf("[DEBUG] Unmounting KMIP backend %q", path)
 
-	if err := client.Sys().Unmount(path); err != nil {
+	if err := client.Sys().UnmountWithContext(ctx, path); err != nil {
 		if util.Is404(err) {
 			log.Printf("[WARN] %q not found, removing from state", path)
 			d.SetId("")
 
-			return fmt.Errorf("error unmounting KMIP backend from %q, err=%w", path, err)
+			return diag.Errorf("error unmounting KMIP backend from %q, err=%s", path, err)
 		}
 
-		return fmt.Errorf("error unmounting KMIP backend from %q, err=%w", path, err)
+		return diag.Errorf("error unmounting KMIP backend from %q, err=%s", path, err)
 	}
 
 	log.Printf("[DEBUG] Unmounted KMIP backend %q", path)
diff --git a/vault/resource_kubernetes_secret_backend.go b/vault/resource_kubernetes_secret_backend.go
index 7dd917fa..e3fad3d1 100644
--- a/vault/resource_kubernetes_secret_backend.go
+++ b/vault/resource_kubernetes_secret_backend.go
@@ -71,11 +71,11 @@ func kubernetesSecretBackendCreateUpdate(ctx context.Context, d *schema.Resource
 	var path string
 	if d.IsNewResource() {
 		path = d.Get(consts.FieldPath).(string)
-		if err := createMount(d, client, path, consts.MountTypeKubernetes); err != nil {
+		if err := createMount(ctx, d, meta, client, path, consts.MountTypeKubernetes); err != nil {
 			return diag.FromErr(err)
 		}
 	} else {
-		if err := updateMount(d, meta, true); err != nil {
+		if err := updateMount(ctx, d, meta, true, false); err != nil {
 			return diag.FromErr(err)
 		}
 		path = d.Id()
@@ -108,7 +108,7 @@ func kubernetesSecretBackendCreateUpdate(ctx context.Context, d *schema.Resource
 	return kubernetesSecretBackendRead(ctx, d, meta)
 }
 
-func kubernetesSecretBackendRead(_ context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+func kubernetesSecretBackendRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	client, err := provider.GetClient(d, meta)
 	if err != nil {
 		return diag.FromErr(err)
@@ -140,7 +140,7 @@ func kubernetesSecretBackendRead(_ context.Context, d *schema.ResourceData, meta
 		}
 	}
 
-	if err := readMount(d, meta, true); err != nil {
+	if err := readMount(ctx, d, meta, true, false); err != nil {
 		return diag.FromErr(err)
 	}
 
diff --git a/vault/resource_ldap_secret_backend.go b/vault/resource_ldap_secret_backend.go
index f67743d3..01c4516e 100644
--- a/vault/resource_ldap_secret_backend.go
+++ b/vault/resource_ldap_secret_backend.go
@@ -147,11 +147,11 @@ func createUpdateLDAPConfigResource(ctx context.Context, d *schema.ResourceData,
 	path := d.Get(consts.FieldPath).(string)
 	log.Printf("[DEBUG] Mounting LDAP mount at %q", path)
 	if d.IsNewResource() {
-		if err := createMount(d, client, path, consts.MountTypeLDAP); err != nil {
+		if err := createMount(ctx, d, meta, client, path, consts.MountTypeLDAP); err != nil {
 			return diag.FromErr(err)
 		}
 	} else {
-		if err := updateMount(d, meta, true); err != nil {
+		if err := updateMount(ctx, d, meta, true, false); err != nil {
 			return diag.FromErr(err)
 		}
 	}
@@ -205,7 +205,6 @@ func createUpdateLDAPConfigResource(ctx context.Context, d *schema.ResourceData,
 	}
 
 	// get automated rotation fields
-
 	if provider.IsAPISupported(meta, provider.VaultVersion119) && provider.IsEnterpriseSupported(meta) {
 		automatedrotationutil.ParseAutomatedRotationFields(d, data)
 	}
@@ -255,7 +254,6 @@ func readLDAPConfigResource(ctx context.Context, d *schema.ResourceData, meta in
 		consts.FieldUserAttr,
 		consts.FieldUserDN,
 	}
-
 	if provider.IsAPISupported(meta, provider.VaultVersion116) {
 		fields = append(fields, consts.FieldSkipStaticRoleImportRotation)
 	}
@@ -268,6 +266,10 @@ func readLDAPConfigResource(ctx context.Context, d *schema.ResourceData, meta in
 		}
 	}
 
+	if err := readMount(ctx, d, meta, true, false); err != nil {
+		return diag.FromErr(err)
+	}
+
 	// add automated rotation fields automatically
 	if provider.IsAPISupported(meta, provider.VaultVersion119) && provider.IsEnterpriseSupported(meta) {
 		if err := automatedrotationutil.PopulateAutomatedRotationFields(d, resp, path); err != nil {
@@ -275,10 +277,6 @@ func readLDAPConfigResource(ctx context.Context, d *schema.ResourceData, meta in
 		}
 	}
 
-	if err := readMount(d, meta, true); err != nil {
-		return diag.FromErr(err)
-	}
-
 	return nil
 }
 
diff --git a/vault/resource_mount.go b/vault/resource_mount.go
index b4c0fb28..048c4e48 100644
--- a/vault/resource_mount.go
+++ b/vault/resource_mount.go
@@ -6,6 +6,7 @@ package vault
 import (
 	"context"
 	"fmt"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"log"
 	"time"
 
@@ -57,6 +58,14 @@ func getMountSchema(excludes ...string) schemaMap {
 			Description: "Maximum possible lease duration for tokens and secrets in seconds",
 		},
 
+		// this field is cannot be tuned
+		consts.FieldForceNoCache: {
+			Type:        schema.TypeBool,
+			Optional:    true,
+			Computed:    true,
+			Description: "If set to true, disables caching.",
+		},
+
 		consts.FieldAuditNonHMACRequestKeys: {
 			Type:        schema.TypeList,
 			Computed:    true,
@@ -73,54 +82,6 @@ func getMountSchema(excludes ...string) schemaMap {
 			Elem:        &schema.Schema{Type: schema.TypeString},
 		},
 
-		consts.FieldAccessor: {
-			Type:        schema.TypeString,
-			Computed:    true,
-			Description: "Accessor of the mount",
-		},
-
-		consts.FieldLocal: {
-			Type:        schema.TypeBool,
-			Required:    false,
-			Optional:    true,
-			Computed:    false,
-			ForceNew:    true,
-			Description: "Local mount flag that can be explicitly set to true to enforce local mount in HA environment",
-		},
-
-		consts.FieldOptions: {
-			Type:        schema.TypeMap,
-			Required:    false,
-			Optional:    true,
-			Computed:    false,
-			ForceNew:    false,
-			Description: "Specifies mount type specific options that are passed to the backend",
-		},
-
-		consts.FieldSealWrap: {
-			Type:        schema.TypeBool,
-			Required:    false,
-			Optional:    true,
-			ForceNew:    true,
-			Computed:    true,
-			Description: "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability",
-		},
-
-		consts.FieldExternalEntropyAccess: {
-			Type:        schema.TypeBool,
-			Optional:    true,
-			Default:     false,
-			ForceNew:    true,
-			Description: "Enable the secrets engine to access Vault's external entropy source",
-		},
-
-		consts.FieldAllowedManagedKeys: {
-			Type:        schema.TypeSet,
-			Optional:    true,
-			Elem:        &schema.Schema{Type: schema.TypeString},
-			Description: "List of managed key registry entry names that the mount in question is allowed to access",
-		},
-
 		consts.FieldListingVisibility: {
 			Type:        schema.TypeString,
 			Optional:    true,
@@ -145,6 +106,19 @@ func getMountSchema(excludes ...string) schemaMap {
 			Description: "List of headers to allow and pass from the request to the plugin",
 		},
 
+		consts.FieldPluginVersion: {
+			Type:        schema.TypeString,
+			Optional:    true,
+			Description: "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'",
+		},
+
+		consts.FieldAllowedManagedKeys: {
+			Type:        schema.TypeSet,
+			Optional:    true,
+			Elem:        &schema.Schema{Type: schema.TypeString},
+			Description: "List of managed key registry entry names that the mount in question is allowed to access",
+		},
+
 		consts.FieldDelegatedAuthAccessors: {
 			Type:     schema.TypeList,
 			Optional: true,
@@ -154,16 +128,51 @@ func getMountSchema(excludes ...string) schemaMap {
 			Description: "List of headers to allow and pass from the request to the plugin",
 		},
 
-		consts.FieldPluginVersion: {
+		consts.FieldIdentityTokenKey: {
 			Type:        schema.TypeString,
 			Optional:    true,
-			Description: "Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'",
+			Description: "The key to use for signing plugin workload identity tokens",
 		},
 
-		consts.FieldIdentityTokenKey: {
-			Type:        schema.TypeString,
+		consts.FieldOptions: {
+			Type:        schema.TypeMap,
+			Required:    false,
 			Optional:    true,
-			Description: "The key to use for signing plugin workload identity tokens",
+			Computed:    false,
+			ForceNew:    false,
+			Description: "Specifies mount type specific options that are passed to the backend",
+		},
+
+		consts.FieldSealWrap: {
+			Type:        schema.TypeBool,
+			Required:    false,
+			Optional:    true,
+			ForceNew:    true,
+			Computed:    true,
+			Description: "Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability",
+		},
+
+		consts.FieldExternalEntropyAccess: {
+			Type:        schema.TypeBool,
+			Optional:    true,
+			Default:     false,
+			ForceNew:    true,
+			Description: "Enable the secrets engine to access Vault's external entropy source",
+		},
+
+		consts.FieldLocal: {
+			Type:        schema.TypeBool,
+			Required:    false,
+			Optional:    true,
+			Computed:    false,
+			ForceNew:    true,
+			Description: "Local mount flag that can be explicitly set to true to enforce local mount in HA environment",
+		},
+
+		consts.FieldAccessor: {
+			Type:        schema.TypeString,
+			Computed:    true,
+			Description: "Accessor of the mount",
 		},
 	}
 	for _, v := range excludes {
@@ -174,40 +183,41 @@ func getMountSchema(excludes ...string) schemaMap {
 
 func MountResource() *schema.Resource {
 	return &schema.Resource{
-		Create: mountWrite,
-		Update: mountUpdate,
-		Delete: mountDelete,
-		Read:   provider.ReadWrapper(mountRead),
+		CreateContext: mountWrite,
+		UpdateContext: mountUpdate,
+		DeleteContext: mountDelete,
+		ReadContext:   provider.ReadContextWrapper(mountRead),
 		Importer: &schema.ResourceImporter{
-			State: schema.ImportStatePassthrough,
+			StateContext: schema.ImportStatePassthroughContext,
 		},
 		Schema: getMountSchema(),
 	}
 }
 
-func mountWrite(d *schema.ResourceData, meta interface{}) error {
+func mountWrite(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	client, err := provider.GetClient(d, meta)
 	if err != nil {
-		return err
+		return diag.FromErr(err)
 	}
 
 	path := d.Get(consts.FieldPath).(string)
-	if err := createMount(d, client, path, d.Get(consts.FieldType).(string)); err != nil {
-		return err
+	if err := createMount(ctx, d, meta, client, path, d.Get(consts.FieldType).(string)); err != nil {
+		return diag.FromErr(err)
 	}
 
 	d.SetId(path)
 
-	return mountRead(d, meta)
+	return mountRead(ctx, d, meta)
 }
 
-func createMount(d *schema.ResourceData, client *api.Client, path string, mountType string) error {
+func createMount(ctx context.Context, d *schema.ResourceData, meta interface{}, client *api.Client, path string, mountType string) error {
 	input := &api.MountInput{
 		Type:        mountType,
 		Description: d.Get(consts.FieldDescription).(string),
 		Config: api.MountConfigInput{
 			DefaultLeaseTTL: fmt.Sprintf("%ds", d.Get(consts.FieldDefaultLeaseTTL)),
 			MaxLeaseTTL:     fmt.Sprintf("%ds", d.Get(consts.FieldMaxLeaseTTL)),
+			ForceNoCache:    d.Get(consts.FieldForceNoCache).(bool),
 		},
 		Local:                 d.Get(consts.FieldLocal).(bool),
 		Options:               mountOptions(d),
@@ -246,24 +256,32 @@ func createMount(d *schema.ResourceData, client *api.Client, path string, mountT
 		input.Config.PluginVersion = v.(string)
 	}
 
-	if v, ok := d.GetOk(consts.FieldIdentityTokenKey); ok {
-		input.Config.IdentityTokenKey = v.(string)
+	useAPIVer116Ent := provider.IsAPISupported(meta, provider.VaultVersion116) && provider.IsEnterpriseSupported(meta)
+	if useAPIVer116Ent {
+		if d.HasChange(consts.FieldIdentityTokenKey) {
+			input.Config.IdentityTokenKey = d.Get(consts.FieldIdentityTokenKey).(string)
+		}
 	}
 
 	log.Printf("[DEBUG] Creating mount %s in Vault", path)
 
-	if err := client.Sys().Mount(path, input); err != nil {
+	if err := client.Sys().MountWithContext(ctx, path, input); err != nil {
 		return fmt.Errorf("error writing to Vault: %s", err)
 	}
 
 	return nil
 }
 
-func mountUpdate(d *schema.ResourceData, meta interface{}) error {
-	return updateMount(d, meta, false)
+func mountUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	err := updateMount(ctx, d, meta, false, false)
+	if err != nil {
+		return diag.FromErr(err)
+	}
+
+	return nil
 }
 
-func updateMount(d *schema.ResourceData, meta interface{}, excludeType bool) error {
+func updateMount(ctx context.Context, d *schema.ResourceData, meta interface{}, excludeType bool, skipRemount bool) error {
 	client, err := provider.GetClient(d, meta)
 	if err != nil {
 		return err
@@ -290,18 +308,20 @@ func updateMount(d *schema.ResourceData, meta interface{}, excludeType bool) err
 
 	path := d.Id()
 
-	if d.HasChange(consts.FieldPath) {
-		newPath := d.Get(consts.FieldPath).(string)
+	if !skipRemount {
+		if d.HasChange(consts.FieldPath) {
+			newPath := d.Get(consts.FieldPath).(string)
 
-		log.Printf("[DEBUG] Remount %s to %s in Vault", path, newPath)
+			log.Printf("[DEBUG] Remount %s to %s in Vault", path, newPath)
 
-		err := client.Sys().Remount(d.Id(), newPath)
-		if err != nil {
-			return fmt.Errorf("error remounting in Vault: %s", err)
-		}
+			err := client.Sys().RemountWithContext(ctx, d.Id(), newPath)
+			if err != nil {
+				return fmt.Errorf("error remounting in Vault: %s", err)
+			}
 
-		d.SetId(newPath)
-		path = newPath
+			d.SetId(newPath)
+			path = newPath
+		}
 	}
 
 	if d.HasChange(consts.FieldAllowedManagedKeys) {
@@ -328,8 +348,11 @@ func updateMount(d *schema.ResourceData, meta interface{}, excludeType bool) err
 		config.PluginVersion = d.Get(consts.FieldPluginVersion).(string)
 	}
 
-	if d.HasChange(consts.FieldIdentityTokenKey) {
-		config.IdentityTokenKey = d.Get(consts.FieldIdentityTokenKey).(string)
+	useAPIVer116Ent := provider.IsAPISupported(meta, provider.VaultVersion116) && provider.IsEnterpriseSupported(meta)
+	if useAPIVer116Ent {
+		if d.HasChange(consts.FieldIdentityTokenKey) {
+			config.IdentityTokenKey = d.Get(consts.FieldIdentityTokenKey).(string)
+		}
 	}
 
 	log.Printf("[DEBUG] Updating mount %s in Vault", path)
@@ -337,7 +360,7 @@ func updateMount(d *schema.ResourceData, meta interface{}, excludeType bool) err
 	// TODO: remove this work-around once VAULT-5521 is fixed
 	var tries int
 	for {
-		if err := client.Sys().TuneMount(path, config); err != nil {
+		if err := client.Sys().TuneMountWithContext(ctx, path, config); err != nil {
 			if tries > 10 {
 				return fmt.Errorf("error updating Vault: %s", err)
 			}
@@ -348,31 +371,36 @@ func updateMount(d *schema.ResourceData, meta interface{}, excludeType bool) err
 		break
 	}
 
-	return readMount(d, meta, excludeType)
+	return readMount(ctx, d, meta, excludeType, skipRemount)
 }
 
-func mountDelete(d *schema.ResourceData, meta interface{}) error {
+func mountDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	client, err := provider.GetClient(d, meta)
 	if err != nil {
-		return err
+		return diag.FromErr(err)
 	}
 
 	path := d.Id()
 
 	log.Printf("[DEBUG] Unmounting %s from Vault", path)
 
-	if err := client.Sys().Unmount(path); err != nil {
-		return fmt.Errorf("error deleting from Vault: %s", err)
+	if err := client.Sys().UnmountWithContext(ctx, path); err != nil {
+		return diag.Errorf("error deleting from Vault: %s", err)
 	}
 
 	return nil
 }
 
-func mountRead(d *schema.ResourceData, meta interface{}) error {
-	return readMount(d, meta, false)
+func mountRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	err := readMount(ctx, d, meta, false, false)
+	if err != nil {
+		return diag.FromErr(err)
+	}
+
+	return nil
 }
 
-func readMount(d *schema.ResourceData, meta interface{}, excludeType bool) error {
+func readMount(ctx context.Context, d *schema.ResourceData, meta interface{}, excludeType bool, excludePath bool) error {
 	client, e := provider.GetClient(d, meta)
 	if e != nil {
 		return e
@@ -382,7 +410,6 @@ func readMount(d *schema.ResourceData, meta interface{}, excludeType bool) error
 
 	log.Printf("[DEBUG] Reading mount %s from Vault", path)
 
-	ctx := context.Background()
 	mount, err := mountutil.GetMount(ctx, client, path)
 	if err != nil {
 		if mountutil.IsMountNotFoundError(err) {
@@ -412,15 +439,23 @@ func readMount(d *schema.ResourceData, meta interface{}, excludeType bool) error
 		d.Set(consts.FieldType, mount.Type)
 	}
 
-	if err := d.Set(consts.FieldPath, path); err != nil {
-		return err
+	// some legacy resources use field "backend" instead of "path"
+	// legacy resources will set the backend parameter in their code
+	if !excludePath {
+		if err := d.Set(consts.FieldPath, path); err != nil {
+			return err
+		}
 	}
+
 	if err := d.Set(consts.FieldDescription, mount.Description); err != nil {
 		return err
 	}
 	if err := d.Set(consts.FieldDefaultLeaseTTL, mount.Config.DefaultLeaseTTL); err != nil {
 		return err
 	}
+	if err := d.Set(consts.FieldForceNoCache, mount.Config.ForceNoCache); err != nil {
+		return err
+	}
 	if err := d.Set(consts.FieldMaxLeaseTTL, mount.Config.MaxLeaseTTL); err != nil {
 		return err
 	}
@@ -454,11 +489,9 @@ func readMount(d *schema.ResourceData, meta interface{}, excludeType bool) error
 	if err := d.Set(consts.FieldAllowedResponseHeaders, mount.Config.AllowedResponseHeaders); err != nil {
 		return err
 	}
-
-	// @TODO add this back in when Vault 1.16.3 is released
-	// if err := d.Set(consts.FieldDelegatedAuthAccessors, mount.Config.DelegatedAuthAccessors); err != nil {
-	//	return err
-	// }
+	if err := d.Set(consts.FieldDelegatedAuthAccessors, mount.Config.DelegatedAuthAccessors); err != nil {
+		return err
+	}
 	if err := d.Set(consts.FieldListingVisibility, mount.Config.ListingVisibility); err != nil {
 		return err
 	}
diff --git a/vault/resource_nomad_secret_backend.go b/vault/resource_nomad_secret_backend.go
index 37e0ebea..9d75589e 100644
--- a/vault/resource_nomad_secret_backend.go
+++ b/vault/resource_nomad_secret_backend.go
@@ -6,16 +6,14 @@ package vault
 import (
 	"context"
 	"fmt"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"log"
 	"strings"
 
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/util"
-	"github.com/hashicorp/terraform-provider-vault/util/mountutil"
-
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/vault/api"
 )
 
 func nomadSecretAccessBackendResource() *schema.Resource {
@@ -99,43 +97,42 @@ func nomadSecretAccessBackendResource() *schema.Resource {
 			Description: "Maximum possible lease duration for secrets in seconds.",
 		},
 	}
-	return provider.MustAddMountMigrationSchema(&schema.Resource{
-		Create:        createNomadAccessConfigResource,
-		Update:        updateNomadAccessConfigResource,
-		Read:          provider.ReadWrapper(readNomadAccessConfigResource),
-		Delete:        deleteNomadAccessConfigResource,
+	r := provider.MustAddMountMigrationSchema(&schema.Resource{
+		CreateContext: createNomadAccessConfigResource,
+		UpdateContext: updateNomadAccessConfigResource,
+		ReadContext:   provider.ReadContextWrapper(readNomadAccessConfigResource),
+		DeleteContext: deleteNomadAccessConfigResource,
 		CustomizeDiff: getMountCustomizeDiffFunc(consts.FieldBackend),
 		Importer: &schema.ResourceImporter{
-			State: schema.ImportStatePassthrough,
+			StateContext: schema.ImportStatePassthroughContext,
 		},
 		Schema: fields,
 	}, false)
+
+	// Add common mount schema to the resource
+	provider.MustAddSchema(r, getMountSchema(
+		consts.FieldPath,
+		consts.FieldType,
+		consts.FieldDescription,
+		consts.FieldDefaultLeaseTTL,
+		consts.FieldMaxLeaseTTL,
+		consts.FieldLocal,
+	))
+
+	return r
 }
 
-func createNomadAccessConfigResource(d *schema.ResourceData, meta interface{}) error {
+func createNomadAccessConfigResource(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	client, e := provider.GetClient(d, meta)
 	if e != nil {
-		return e
+		return diag.FromErr(e)
 	}
 
 	backend := d.Get("backend").(string)
-	description := d.Get("description").(string)
-	defaultTTL := d.Get("default_lease_ttl_seconds").(int)
-	local := d.Get("local").(bool)
-	maxTTL := d.Get("max_lease_ttl_seconds").(int)
 
 	log.Printf("[DEBUG] Mounting Nomad backend at %q", backend)
-	err := client.Sys().Mount(backend, &api.MountInput{
-		Type:        consts.MountTypeNomad,
-		Description: description,
-		Local:       local,
-		Config: api.MountConfigInput{
-			DefaultLeaseTTL: fmt.Sprintf("%ds", defaultTTL),
-			MaxLeaseTTL:     fmt.Sprintf("%ds", maxTTL),
-		},
-	})
-	if err != nil {
-		return fmt.Errorf("error mounting to %q: %s", backend, err)
+	if err := createMount(ctx, d, meta, client, backend, consts.MountTypeNomad); err != nil {
+		return diag.FromErr(err)
 	}
 
 	log.Printf("[DEBUG] Mounted Nomad backend at %q", backend)
@@ -168,8 +165,8 @@ func createNomadAccessConfigResource(d *schema.ResourceData, meta interface{}) e
 
 	configPath := fmt.Sprintf("%s/config/access", backend)
 	log.Printf("[DEBUG] Writing %q", configPath)
-	if _, err := client.Logical().Write(configPath, data); err != nil {
-		return fmt.Errorf("error writing %q: %s", configPath, err)
+	if _, err := client.Logical().WriteWithContext(ctx, configPath, data); err != nil {
+		return diag.Errorf("error writing %q: %s", configPath, err)
 	}
 
 	dataLease := map[string]interface{}{}
@@ -183,44 +180,35 @@ func createNomadAccessConfigResource(d *schema.ResourceData, meta interface{}) e
 
 	configLeasePath := fmt.Sprintf("%s/config/lease", backend)
 	log.Printf("[DEBUG] Writing %q", configLeasePath)
-	if _, err := client.Logical().Write(configLeasePath, dataLease); err != nil {
-		return fmt.Errorf("error writing %q: %s", configLeasePath, err)
+	if _, err := client.Logical().WriteWithContext(ctx, configLeasePath, dataLease); err != nil {
+		return diag.Errorf("error writing %q: %s", configLeasePath, err)
 	}
 
 	log.Printf("[DEBUG] Wrote %q", configLeasePath)
-	return readNomadAccessConfigResource(d, meta)
+	return readNomadAccessConfigResource(ctx, d, meta)
 }
 
-func readNomadAccessConfigResource(d *schema.ResourceData, meta interface{}) error {
+func readNomadAccessConfigResource(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	client, e := provider.GetClient(d, meta)
 	if e != nil {
-		return e
+		return diag.FromErr(e)
 	}
 
-	path := d.Id()
-	log.Printf("[DEBUG] Reading %q", path)
+	backend := d.Id()
 
-	ctx := context.Background()
-	mount, err := mountutil.GetMount(ctx, client, path)
-	if err != nil {
-		if mountutil.IsMountNotFoundError(err) {
-			log.Printf("[WARN] Mount %q not found, removing from state.", path)
-			d.SetId("")
-			return nil
-		}
-		return err
+	if err := d.Set("backend", backend); err != nil {
+		return diag.FromErr(err)
+	}
+	if err := readMount(ctx, d, meta, true, true); err != nil {
+		return diag.FromErr(err)
 	}
 
-	d.Set("backend", d.Id())
-	d.Set("default_lease_ttl_seconds", mount.Config.DefaultLeaseTTL)
-	d.Set("max_lease_ttl_seconds", mount.Config.MaxLeaseTTL)
-
-	configPath := fmt.Sprintf("%s/config/access", d.Id())
+	configPath := fmt.Sprintf("%s/config/access", backend)
 	log.Printf("[DEBUG] Reading %q", configPath)
 
 	resp, err := client.Logical().Read(configPath)
 	if err != nil {
-		return fmt.Errorf("error reading %q: %s", configPath, err)
+		return diag.Errorf("error reading %q: %s", configPath, err)
 	}
 	log.Printf("[DEBUG] Read %q", configPath)
 	if resp == nil {
@@ -231,31 +219,31 @@ func readNomadAccessConfigResource(d *schema.ResourceData, meta interface{}) err
 
 	if val, ok := resp.Data["address"]; ok {
 		if err := d.Set("address", val); err != nil {
-			return fmt.Errorf("error setting state key 'address': %s", err)
+			return diag.Errorf("error setting state key 'address': %s", err)
 		}
 	}
 
 	if val, ok := resp.Data["ca_cert"]; ok {
 		if err := d.Set("ca_cert", val); err != nil {
-			return fmt.Errorf("error setting state key 'ca_cert': %s", err)
+			return diag.Errorf("error setting state key 'ca_cert': %s", err)
 		}
 	}
 
 	if val, ok := resp.Data["client_cert"]; ok {
 		if err := d.Set("client_cert", val); err != nil {
-			return fmt.Errorf("error setting state key 'client_cert': %s", err)
+			return diag.Errorf("error setting state key 'client_cert': %s", err)
 		}
 	}
 
 	if val, ok := resp.Data["client_key"]; ok {
 		if err := d.Set("client_key", val); err != nil {
-			return fmt.Errorf("error setting state key 'client_key': %s", err)
+			return diag.Errorf("error setting state key 'client_key': %s", err)
 		}
 	}
 
 	if val, ok := resp.Data["max_token_name_length"]; ok {
 		if err := d.Set("max_token_name_length", val); err != nil {
-			return fmt.Errorf("error setting state key 'max_token_name_length': %s", err)
+			return diag.Errorf("error setting state key 'max_token_name_length': %s", err)
 		}
 	}
 
@@ -264,7 +252,7 @@ func readNomadAccessConfigResource(d *schema.ResourceData, meta interface{}) err
 
 	resp, err = client.Logical().Read(configLeasePath)
 	if err != nil {
-		return fmt.Errorf("error reading %q: %s", configLeasePath, err)
+		return diag.Errorf("error reading %q: %s", configLeasePath, err)
 	}
 	log.Printf("[DEBUG] Read %q", configLeasePath)
 	if resp == nil {
@@ -275,45 +263,37 @@ func readNomadAccessConfigResource(d *schema.ResourceData, meta interface{}) err
 
 	if val, ok := resp.Data["max_ttl"]; ok {
 		if err := d.Set("max_ttl", val); err != nil {
-			return fmt.Errorf("error setting state key 'max_ttl': %s", err)
+			return diag.Errorf("error setting state key 'max_ttl': %s", err)
 		}
 	}
 
 	if val, ok := resp.Data["ttl"]; ok {
 		if err := d.Set("ttl", val); err != nil {
-			return fmt.Errorf("error setting state key 'ttl': %s", err)
+			return diag.Errorf("error setting state key 'ttl': %s", err)
 		}
 	}
 
 	return nil
 }
 
-func updateNomadAccessConfigResource(d *schema.ResourceData, meta interface{}) error {
-	backend := d.Id()
+func updateNomadAccessConfigResource(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 
 	client, e := provider.GetClient(d, meta)
 	if e != nil {
-		return e
+		return diag.FromErr(e)
 	}
 
-	tune := api.MountConfigInput{}
 	data := map[string]interface{}{}
 
-	backend, err := util.Remount(d, client, consts.FieldBackend, false)
-	if err != nil {
-		return err
+	if err := updateMount(ctx, d, meta, true, true); err != nil {
+		return diag.FromErr(err)
 	}
 
-	if d.HasChange("default_lease_ttl_seconds") || d.HasChange("max_lease_ttl_seconds") {
-		tune.DefaultLeaseTTL = fmt.Sprintf("%ds", d.Get("default_lease_ttl_seconds"))
-		tune.MaxLeaseTTL = fmt.Sprintf("%ds", d.Get("max_lease_ttl_seconds"))
-
-		log.Printf("[DEBUG] Updating mount lease TTLs for %q", backend)
-		err := client.Sys().TuneMount(backend, tune)
-		if err != nil {
-			return fmt.Errorf("error updating mount TTLs for %q: %s", backend, err)
-		}
-		log.Printf("[DEBUG] Updated lease TTLs for %q", backend)
+	// Remount backend after updating in case needed.
+	// we remount in a separate step due to the resource using the legacy "backend" field
+	backend, err := util.Remount(d, client, consts.FieldBackend, false)
+	if err != nil {
+		return diag.FromErr(err)
 	}
 
 	configPath := fmt.Sprintf("%s/config/access", backend)
@@ -344,7 +324,7 @@ func updateNomadAccessConfigResource(d *schema.ResourceData, meta interface{}) e
 	}
 
 	if _, err := client.Logical().Write(configPath, data); err != nil {
-		return fmt.Errorf("error updating access config %q: %s", configPath, err)
+		return diag.Errorf("error updating access config %q: %s", configPath, err)
 	}
 	log.Printf("[DEBUG] Updated %q", configPath)
 
@@ -362,17 +342,17 @@ func updateNomadAccessConfigResource(d *schema.ResourceData, meta interface{}) e
 	}
 
 	if _, err := client.Logical().Write(configLeasePath, dataLease); err != nil {
-		return fmt.Errorf("error updating lease config %q: %s", configLeasePath, err)
+		return diag.Errorf("error updating lease config %q: %s", configLeasePath, err)
 	}
 
 	log.Printf("[DEBUG] Updated %q", configLeasePath)
-	return readNomadAccessConfigResource(d, meta)
+	return readNomadAccessConfigResource(ctx, d, meta)
 }
 
-func deleteNomadAccessConfigResource(d *schema.ResourceData, meta interface{}) error {
+func deleteNomadAccessConfigResource(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	client, e := provider.GetClient(d, meta)
 	if e != nil {
-		return e
+		return diag.FromErr(e)
 	}
 
 	vaultPath := d.Id()
@@ -382,9 +362,9 @@ func deleteNomadAccessConfigResource(d *schema.ResourceData, meta interface{}) e
 	if err != nil && util.Is404(err) {
 		log.Printf("[WARN] %q not found, removing from state", vaultPath)
 		d.SetId("")
-		return fmt.Errorf("error unmounting Nomad backend from %q: %s", vaultPath, err)
+		return diag.Errorf("error unmounting Nomad backend from %q: %s", vaultPath, err)
 	} else if err != nil {
-		return fmt.Errorf("error unmounting Nomad backend from %q: %s", vaultPath, err)
+		return diag.Errorf("error unmounting Nomad backend from %q: %s", vaultPath, err)
 	}
 	log.Printf("[DEBUG] Unmounted Nomad backend %q", vaultPath)
 	return nil
diff --git a/vault/resource_rabbitmq_secret_backend.go b/vault/resource_rabbitmq_secret_backend.go
index 5404fe1b..c8793453 100644
--- a/vault/resource_rabbitmq_secret_backend.go
+++ b/vault/resource_rabbitmq_secret_backend.go
@@ -5,26 +5,21 @@ package vault
 
 import (
 	"context"
-	"fmt"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"log"
 	"strings"
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/vault/api"
-
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
-	"github.com/hashicorp/terraform-provider-vault/util"
-	"github.com/hashicorp/terraform-provider-vault/util/mountutil"
 )
 
 func rabbitMQSecretBackendResource() *schema.Resource {
-	return provider.MustAddMountMigrationSchema(&schema.Resource{
-		Create:        rabbitMQSecretBackendCreate,
-		Read:          provider.ReadWrapper(rabbitMQSecretBackendRead),
-		Update:        rabbitMQSecretBackendUpdate,
-		Delete:        rabbitMQSecretBackendDelete,
-		Exists:        rabbitMQSecretBackendExists,
+	r := provider.MustAddMountMigrationSchema(&schema.Resource{
+		CreateContext: rabbitMQSecretBackendCreate,
+		ReadContext:   provider.ReadContextWrapper(rabbitMQSecretBackendRead),
+		UpdateContext: rabbitMQSecretBackendUpdate,
+		DeleteContext: rabbitMQSecretBackendDelete,
 		CustomizeDiff: getMountCustomizeDiffFunc(consts.FieldPath),
 		Importer: &schema.ResourceImporter{
 			State: schema.ImportStatePassthrough,
@@ -94,18 +89,26 @@ func rabbitMQSecretBackendResource() *schema.Resource {
 			},
 		},
 	}, false)
+
+	// Add common mount schema to the resource
+	provider.MustAddSchema(r, getMountSchema(
+		consts.FieldPath,
+		consts.FieldType,
+		consts.FieldDescription,
+		consts.FieldDefaultLeaseTTL,
+		consts.FieldMaxLeaseTTL,
+	))
+
+	return r
 }
 
-func rabbitMQSecretBackendCreate(d *schema.ResourceData, meta interface{}) error {
+func rabbitMQSecretBackendCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	client, e := provider.GetClient(d, meta)
 	if e != nil {
-		return e
+		return diag.FromErr(e)
 	}
 
 	path := d.Get(consts.FieldPath).(string)
-	description := d.Get("description").(string)
-	defaultTTL := d.Get("default_lease_ttl_seconds").(int)
-	maxTTL := d.Get("max_lease_ttl_seconds").(int)
 	connectionUri := d.Get("connection_uri").(string)
 	username := d.Get("username").(string)
 	password := d.Get("password").(string)
@@ -113,17 +116,10 @@ func rabbitMQSecretBackendCreate(d *schema.ResourceData, meta interface{}) error
 
 	d.Partial(true)
 	log.Printf("[DEBUG] Mounting Rabbitmq backend at %q", path)
-	err := client.Sys().Mount(path, &api.MountInput{
-		Type:        consts.MountTypeRabbitMQ,
-		Description: description,
-		Config: api.MountConfigInput{
-			DefaultLeaseTTL: fmt.Sprintf("%ds", defaultTTL),
-			MaxLeaseTTL:     fmt.Sprintf("%ds", maxTTL),
-		},
-	})
-	if err != nil {
-		return fmt.Errorf("error mounting to %q: %s", path, err)
+	if err := createMount(ctx, d, meta, client, path, consts.MountTypeRabbitMQ); err != nil {
+		return diag.FromErr(err)
 	}
+
 	log.Printf("[DEBUG] Mounted Rabbitmq backend at %q", path)
 	d.SetId(path)
 
@@ -136,73 +132,44 @@ func rabbitMQSecretBackendCreate(d *schema.ResourceData, meta interface{}) error
 		"username_template": d.Get("username_template").(string),
 		"password_policy":   d.Get("password_policy").(string),
 	}
-	_, err = client.Logical().Write(path+"/config/connection", data)
+	_, err := client.Logical().Write(path+"/config/connection", data)
 	if err != nil {
-		return fmt.Errorf("error configuring connection credentials for %q: %s", path, err)
+		return diag.Errorf("error configuring connection credentials for %q: %s", path, err)
 	}
 	log.Printf("[DEBUG] Wrote connection credentials to %q", path+"/config/connection")
 	d.Partial(false)
-	return rabbitMQSecretBackendRead(d, meta)
+	return rabbitMQSecretBackendRead(ctx, d, meta)
 }
 
-func rabbitMQSecretBackendRead(d *schema.ResourceData, meta interface{}) error {
-	client, e := provider.GetClient(d, meta)
-	if e != nil {
-		return e
-	}
-
+func rabbitMQSecretBackendRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	path := d.Id()
 
 	log.Printf("[DEBUG] Reading RabbitMQ secret backend mount %q from Vault", path)
-	ctx := context.Background()
-	mount, err := mountutil.GetMount(ctx, client, path)
-	if err != nil {
-		if mountutil.IsMountNotFoundError(err) {
-			log.Printf("[WARN] Mount %q not found, removing from state.", path)
-			d.SetId("")
-			return nil
-		}
-		return err
+	if err := d.Set(consts.FieldPath, path); err != nil {
+		return diag.FromErr(err)
+	}
+	if err := readMount(ctx, d, meta, true, false); err != nil {
+		return diag.FromErr(err)
 	}
 
-	d.Set(consts.FieldPath, path)
-	d.Set("description", mount.Description)
-	d.Set("default_lease_ttl_seconds", mount.Config.DefaultLeaseTTL)
-	d.Set("max_lease_ttl_seconds", mount.Config.MaxLeaseTTL)
-
-	// access key, secret key, and region, sadly, we can't read out
-	// the API doesn't support it
-	// So... if they drift, they drift.
+	// the API can't serve the remaining fields
 
 	return nil
 }
 
-func rabbitMQSecretBackendUpdate(d *schema.ResourceData, meta interface{}) error {
+func rabbitMQSecretBackendUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	client, e := provider.GetClient(d, meta)
 	if e != nil {
-		return e
+		return diag.FromErr(e)
 	}
 
-	path := d.Id()
 	d.Partial(true)
 
-	path, err := util.Remount(d, client, consts.FieldPath, false)
-	if err != nil {
-		return err
+	if err := updateMount(ctx, d, meta, true, false); err != nil {
+		return diag.FromErr(err)
 	}
+	path := d.Id()
 
-	if d.HasChanges("default_lease_ttl_seconds", "max_lease_ttl_seconds") {
-		config := api.MountConfigInput{
-			DefaultLeaseTTL: fmt.Sprintf("%ds", d.Get("default_lease_ttl_seconds")),
-			MaxLeaseTTL:     fmt.Sprintf("%ds", d.Get("max_lease_ttl_seconds")),
-		}
-		log.Printf("[DEBUG] Updating lease TTLs for %q", path)
-		err := client.Sys().TuneMount(path, config)
-		if err != nil {
-			return fmt.Errorf("error updating mount TTLs for %q: %s", path, err)
-		}
-		log.Printf("[DEBUG] Updated lease TTLs for %q", path)
-	}
 	if d.HasChanges("connection_uri", "username", "password", "verify_connection", "username_template", "password_policy") {
 		log.Printf("[DEBUG] Updating connection credentials at %q", path+"/config/connection")
 		data := map[string]interface{}{
@@ -215,47 +182,26 @@ func rabbitMQSecretBackendUpdate(d *schema.ResourceData, meta interface{}) error
 		}
 		_, err := client.Logical().Write(path+"/config/connection", data)
 		if err != nil {
-			return fmt.Errorf("error configuring connection credentials for %q: %s", path, err)
+			return diag.Errorf("error configuring connection credentials for %q: %s", path, err)
 		}
 		log.Printf("[DEBUG] Updated root credentials at %q", path+"/config/connection")
 	}
 	d.Partial(false)
-	return rabbitMQSecretBackendRead(d, meta)
+	return rabbitMQSecretBackendRead(ctx, d, meta)
 }
 
-func rabbitMQSecretBackendDelete(d *schema.ResourceData, meta interface{}) error {
+func rabbitMQSecretBackendDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	client, e := provider.GetClient(d, meta)
 	if e != nil {
-		return e
+		return diag.FromErr(e)
 	}
 
 	path := d.Id()
 	log.Printf("[DEBUG] Unmounting RabbitMQ backend %q", path)
-	err := client.Sys().Unmount(path)
+	err := client.Sys().UnmountWithContext(ctx, path)
 	if err != nil {
-		return fmt.Errorf("error unmounting RabbitMQ backend from %q: %s", path, err)
+		return diag.Errorf("error unmounting RabbitMQ backend from %q: %s", path, err)
 	}
 	log.Printf("[DEBUG] Unmounted RabbitMQ backend %q", path)
 	return nil
 }
-
-func rabbitMQSecretBackendExists(d *schema.ResourceData, meta interface{}) (bool, error) {
-	client, e := provider.GetClient(d, meta)
-	if e != nil {
-		return false, e
-	}
-
-	path := d.Id()
-	log.Printf("[DEBUG] Checking if RabbitMQ backend exists at %q", path)
-
-	if _, err := mountutil.GetMount(context.Background(), client, path); err != nil {
-		if mountutil.IsMountNotFoundError(err) {
-			return false, nil
-		}
-
-		// TODO: returning true here is probably wrong. We should move existence checks to the Read function.
-		return true, err
-	}
-
-	return true, nil
-}
diff --git a/vault/resource_terraform_cloud_secret_backend.go b/vault/resource_terraform_cloud_secret_backend.go
index 72ea1a31..3f061557 100644
--- a/vault/resource_terraform_cloud_secret_backend.go
+++ b/vault/resource_terraform_cloud_secret_backend.go
@@ -5,29 +5,25 @@ package vault
 
 import (
 	"context"
-	"fmt"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-provider-vault/util"
 	"log"
 	"strings"
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/vault/api"
-
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
-	"github.com/hashicorp/terraform-provider-vault/util"
-	"github.com/hashicorp/terraform-provider-vault/util/mountutil"
 )
 
 func terraformCloudSecretBackendResource() *schema.Resource {
-	return provider.MustAddMountMigrationSchema(&schema.Resource{
-		Create:        terraformCloudSecretBackendCreate,
-		Read:          provider.ReadWrapper(terraformCloudSecretBackendRead),
-		Update:        terraformCloudSecretBackendUpdate,
-		Delete:        terraformCloudSecretBackendDelete,
-		Exists:        terraformCloudSecretBackendExists,
+	r := provider.MustAddMountMigrationSchema(&schema.Resource{
+		CreateContext: terraformCloudSecretBackendCreate,
+		ReadContext:   provider.ReadContextWrapper(terraformCloudSecretBackendRead),
+		UpdateContext: terraformCloudSecretBackendUpdate,
+		DeleteContext: terraformCloudSecretBackendDelete,
 		CustomizeDiff: getMountCustomizeDiffFunc(consts.FieldBackend),
 		Importer: &schema.ResourceImporter{
-			State: schema.ImportStatePassthrough,
+			StateContext: schema.ImportStatePassthroughContext,
 		},
 
 		Schema: map[string]*schema.Schema{
@@ -80,136 +76,107 @@ func terraformCloudSecretBackendResource() *schema.Resource {
 			},
 		},
 	}, false)
+
+	// Add common mount schema to the resource
+	provider.MustAddSchema(r, getMountSchema(
+		consts.FieldPath,
+		consts.FieldType,
+		consts.FieldDescription,
+		consts.FieldDefaultLeaseTTL,
+		consts.FieldMaxLeaseTTL,
+	))
+
+	return r
 }
 
-func terraformCloudSecretBackendCreate(d *schema.ResourceData, meta interface{}) error {
+func terraformCloudSecretBackendCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	client, e := provider.GetClient(d, meta)
 	if e != nil {
-		return e
+		return diag.FromErr(e)
 	}
 
 	backend := d.Get("backend").(string)
 	address := d.Get("address").(string)
 	token := d.Get("token").(string)
 	basePath := d.Get("base_path").(string)
-	description := d.Get("description").(string)
-	defaultLeaseTTL := d.Get("default_lease_ttl_seconds")
-	maxLeaseTTL := d.Get("max_lease_ttl_seconds")
 
 	configPath := terraformCloudSecretBackendConfigPath(backend)
 
-	info := &api.MountInput{
-		Type:        consts.MountTypeTerraform,
-		Description: description,
-		Config: api.MountConfigInput{
-			DefaultLeaseTTL: fmt.Sprintf("%ds", defaultLeaseTTL),
-			MaxLeaseTTL:     fmt.Sprintf("%ds", maxLeaseTTL),
-		},
-	}
-
 	log.Printf("[DEBUG] Mounting Terraform Cloud backend at %q", backend)
 
-	if err := client.Sys().Mount(backend, info); err != nil {
-		return fmt.Errorf("Error mounting to %q: %s", backend, err)
+	if err := createMount(ctx, d, meta, client, backend, consts.MountTypeTerraform); err != nil {
+		return diag.FromErr(err)
 	}
 
 	log.Printf("[DEBUG] Mounted Terraform Cloud backend at %q", backend)
 	d.SetId(backend)
 
-	d.Set("backend", backend)
-	d.Set("description", description)
-	d.Set("default_lease_ttl_seconds", defaultLeaseTTL)
-	d.Set("max_lease_ttl_seconds", maxLeaseTTL)
-
 	log.Printf("[DEBUG] Writing Terraform Cloud configuration to %q", configPath)
 	data := map[string]interface{}{
 		"address":   address,
 		"token":     token,
 		"base_path": basePath,
 	}
-	if _, err := client.Logical().Write(configPath, data); err != nil {
-		return fmt.Errorf("Error writing Terraform Cloud configuration for %q: %s", backend, err)
+	if _, err := client.Logical().WriteWithContext(ctx, configPath, data); err != nil {
+		return diag.Errorf("Error writing Terraform Cloud configuration for %q: %s", backend, err)
 	}
 	log.Printf("[DEBUG] Wrote Terraform Cloud configuration to %q", configPath)
-	d.Set("address", address)
-	d.Set("token", token)
-	d.Set("base_path", basePath)
 
-	return nil
+	return terraformCloudSecretBackendRead(ctx, d, meta)
 }
 
-func terraformCloudSecretBackendRead(d *schema.ResourceData, meta interface{}) error {
+func terraformCloudSecretBackendRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	client, e := provider.GetClient(d, meta)
 	if e != nil {
-		return e
+		return diag.FromErr(e)
 	}
 
 	backend := d.Id()
 	configPath := terraformCloudSecretBackendConfigPath(backend)
 
-	log.Printf("[DEBUG] Reading Terraform Cloud backend mount %q from Vault", backend)
-
-	ctx := context.Background()
-	mount, err := mountutil.GetMount(ctx, client, backend)
-	if err != nil {
-		if mountutil.IsMountNotFoundError(err) {
-			log.Printf("[WARN] Mount %q not found, removing from state.", backend)
-			d.SetId("")
-			return nil
-		}
-		return err
+	if err := d.Set("backend", backend); err != nil {
+		return diag.FromErr(err)
+	}
+	if err := readMount(ctx, d, meta, true, true); err != nil {
+		return diag.FromErr(err)
 	}
-
-	d.Set("backend", backend)
-	d.Set("description", mount.Description)
-	d.Set("default_lease_ttl_seconds", mount.Config.DefaultLeaseTTL)
-	d.Set("max_lease_ttl_seconds", mount.Config.MaxLeaseTTL)
 
 	log.Printf("[DEBUG] Reading %s from Vault", configPath)
-	secret, err := client.Logical().Read(configPath)
+	secret, err := client.Logical().ReadWithContext(ctx, configPath)
 	if err != nil {
-		return fmt.Errorf("error reading from Vault: %s", err)
+		return diag.Errorf("error reading from Vault: %s", err)
 	}
 
-	// token, sadly, we can't read out
-	// the API doesn't support it
-	// So... if it drifts, it drift.
-	d.Set("address", secret.Data["address"].(string))
-	d.Set("base_path", secret.Data["base_path"].(string))
+	if err := d.Set("address", secret.Data["address"].(string)); err != nil {
+		return diag.FromErr(err)
+	}
+	if err := d.Set("base_path", secret.Data["base_path"].(string)); err != nil {
+		return diag.FromErr(err)
+
+	}
 
 	return nil
 }
 
-func terraformCloudSecretBackendUpdate(d *schema.ResourceData, meta interface{}) error {
+func terraformCloudSecretBackendUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	client, e := provider.GetClient(d, meta)
 	if e != nil {
-		return e
+		return diag.FromErr(e)
 	}
 
-	backend := d.Id()
-	configPath := terraformCloudSecretBackendConfigPath(backend)
-
-	backend, e = util.Remount(d, client, consts.FieldBackend, false)
-	if e != nil {
-		return e
+	if err := updateMount(ctx, d, meta, true, true); err != nil {
+		return diag.FromErr(err)
 	}
 
-	if d.HasChange("default_lease_ttl_seconds") || d.HasChange("max_lease_ttl_seconds") {
-		defaultLeaseTTL := d.Get("default_lease_ttl_seconds")
-		maxLeaseTTL := d.Get("max_lease_ttl_seconds")
-		config := api.MountConfigInput{
-			DefaultLeaseTTL: fmt.Sprintf("%ds", defaultLeaseTTL),
-			MaxLeaseTTL:     fmt.Sprintf("%ds", maxLeaseTTL),
-		}
+	// Remount backend after updating in case needed.
+	// we remount in a separate step due to the resource using the legacy "backend" field
+	backend, err := util.Remount(d, client, consts.FieldBackend, false)
+	if err != nil {
+		return diag.FromErr(err)
+	}
 
-		log.Printf("[DEBUG] Updating lease TTLs for %q", backend)
-		if err := client.Sys().TuneMount(backend, config); err != nil {
-			return fmt.Errorf("Error updating mount TTLs for %q: %s", backend, err)
-		}
+	configPath := terraformCloudSecretBackendConfigPath(backend)
 
-		d.Set("default_lease_ttl_seconds", defaultLeaseTTL)
-		d.Set("max_lease_ttl_seconds", maxLeaseTTL)
-	}
 	if d.HasChange("address") || d.HasChange("token") || d.HasChange("base_path") {
 		log.Printf("[DEBUG] Updating Terraform Cloud configuration at %q", configPath)
 		data := map[string]interface{}{
@@ -217,56 +184,40 @@ func terraformCloudSecretBackendUpdate(d *schema.ResourceData, meta interface{})
 			"token":     d.Get("token").(string),
 			"base_path": d.Get("base_path").(string),
 		}
-		if _, err := client.Logical().Write(configPath, data); err != nil {
-			return fmt.Errorf("Error configuring Terraform Cloud configuration for %q: %s", backend, err)
+		if _, err := client.Logical().WriteWithContext(ctx, configPath, data); err != nil {
+			return diag.Errorf("Error configuring Terraform Cloud configuration for %q: %s", backend, err)
 		}
 		log.Printf("[DEBUG] Updated Terraform Cloud configuration at %q", configPath)
-		d.Set("address", data["address"])
-		d.Set("token", data["token"])
-		d.Set("base_path", data["base_path"])
+		if err := d.Set("address", data["address"]); err != nil {
+			return diag.FromErr(err)
+		}
+		if err := d.Set("token", data["token"]); err != nil {
+			return diag.FromErr(err)
+		}
+		if err := d.Set("base_path", data["base_path"]); err != nil {
+			return diag.FromErr(err)
+		}
 	}
-	return terraformCloudSecretBackendRead(d, meta)
+	return terraformCloudSecretBackendRead(ctx, d, meta)
 }
 
-func terraformCloudSecretBackendDelete(d *schema.ResourceData, meta interface{}) error {
+func terraformCloudSecretBackendDelete(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	client, e := provider.GetClient(d, meta)
 	if e != nil {
-		return e
+		return diag.FromErr(e)
 	}
 
 	backend := d.Id()
 
 	log.Printf("[DEBUG] Unmounting Terraform Cloud backend %q", backend)
-	err := client.Sys().Unmount(backend)
+	err := client.Sys().UnmountWithContext(ctx, backend)
 	if err != nil {
-		return fmt.Errorf("Error unmounting Terraform Cloud backend from %q: %s", backend, err)
+		return diag.Errorf("Error unmounting Terraform Cloud backend from %q: %s", backend, err)
 	}
 	log.Printf("[DEBUG] Unmounted Terraform Cloud backend %q", backend)
 	return nil
 }
 
-func terraformCloudSecretBackendExists(d *schema.ResourceData, meta interface{}) (bool, error) {
-	client, e := provider.GetClient(d, meta)
-	if e != nil {
-		return false, e
-	}
-
-	backend := d.Id()
-
-	log.Printf("[DEBUG] Checking if Terraform Cloud backend exists at %q", backend)
-
-	_, err := mountutil.GetMount(context.Background(), client, backend)
-	if err != nil {
-		if mountutil.IsMountNotFoundError(err) {
-			return false, nil
-		}
-
-		return true, fmt.Errorf("error retrieving list of mounts: %s", err)
-	}
-
-	return true, nil
-}
-
 func terraformCloudSecretBackendConfigPath(backend string) string {
 	return strings.Trim(backend, "/") + "/config"
 }
diff --git a/vault/resource_transit_secret_backend_key.go b/vault/resource_transit_secret_backend_key.go
index a82bc58b..45aa5a0b 100644
--- a/vault/resource_transit_secret_backend_key.go
+++ b/vault/resource_transit_secret_backend_key.go
@@ -85,7 +85,7 @@ func transitSecretBackendKeyResource() *schema.Resource {
 			"type": {
 				Type:        schema.TypeString,
 				Optional:    true,
-				Description: "Specifies the type of key to create. The currently-supported types are: aes128-gcm96, aes256-gcm96, chacha20-poly1305, ed25519, ecdsa-p256, ecdsa-p384, ecdsa-p521, hmac, rsa-2048, rsa-3072, rsa-4096",
+				Description: "Specifies the type of key to create. The currently-supported types are: `aes128-gcm96`, `aes256-gcm96` (default), `chacha20-poly1305`, `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `hmac`, `rsa-2048`, `rsa-3072`, `rsa-4096`, `managed_key`, `aes128-cmac`, `aes192-cmac`, `aes256-cmac`, `ml-dsa`, `hybrid`, and `slh-dsa`.",
 				ForceNew:    true,
 				Default:     "aes256-gcm96",
 			},
@@ -136,7 +136,7 @@ func transitSecretBackendKeyResource() *schema.Resource {
 			consts.FieldParameterSet: {
 				Type:        schema.TypeString,
 				Optional:    true,
-				Description: "The parameter set to use for ML-DSA. Required for ML-DSA and hybrid keys. Valid values are 44, 65, and 87.",
+				Description: "The parameter set to use for ML-DSA. Required for ML-DSA and hybrid keys.  Valid values for ML-DSA are `44`, `65`, and `87`. Valid values for SLH-DSA are `slh-dsa-sha2-128s`, `slh-dsa-shake-128s`, `slh-dsa-sha2-128f`, `slh-dsa-shake-128`, `slh-dsa-sha2-192s`, `slh-dsa-shake-192s`, `slh-dsa-sha2-192f`, `slh-dsa-shake-192f`, `slh-dsa-sha2-256s`, `slh-dsa-shake-256s`, `slh-dsa-sha2-256f`, and `slh-dsa-shake-256f`.",
 			},
 			consts.FieldHybridKeyTypeEC: {
 				Type:        schema.TypeString,
diff --git a/website/docs/r/aws_secret_backend.html.md b/website/docs/r/aws_secret_backend.html.md
index a5936931..be30aa9d 100644
--- a/website/docs/r/aws_secret_backend.html.md
+++ b/website/docs/r/aws_secret_backend.html.md
@@ -75,14 +75,6 @@ not begin or end with a `/`. Defaults to `aws`.
 * `disable_remount` - (Optional) If set, opts out of mount migration on path updates.
   See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
 
-* `description` - (Optional) A human-friendly description for this backend.
-
-* `default_lease_ttl_seconds` - (Optional) The default TTL for credentials
-issued by this backend.
-
-* `max_lease_ttl_seconds` - (Optional) The maximum TTL that can be requested
-for credentials issued by this backend.
-
 * `iam_endpoint` - (Optional) Specifies a custom HTTP IAM endpoint to use.
 
 * `sts_endpoint` - (Optional) Specifies a custom HTTP STS endpoint to use.
@@ -93,14 +85,10 @@ for credentials issued by this backend.
 
 * `sts_fallback_regions` - (Optional) Ordered list of `sts_region`s matching the fallback endpoints. Should correspond in order with those endpoints. Requires Vault 1.19+
 
-* `local` - (Optional) Specifies whether the secrets mount will be marked as local. Local mounts are not replicated to performance replicas.
-
 * `identity_token_audience` - (Optional) The audience claim value. Requires Vault 1.16+.
 
 * `identity_token_ttl` - (Optional) The TTL of generated identity tokens in seconds. Requires Vault 1.16+.
 
-* `identity_token_key` - (Optional) The key to use for signing identity tokens. Requires Vault 1.16+.
-
 * `role_arn` - (Optional) Role ARN to assume for plugin identity token federation. Requires Vault 1.16+.
 
 * `rotation_period` - (Optional) The amount of time in seconds Vault should wait before rotating the root credential. 
@@ -126,6 +114,48 @@ unbound and the minimum allowable window is `3600`. Requires Vault Enterprise 1.
 
 ```
 
+### Common Mount Arguments
+These arguments are common across all resources that mount a secret engine.
+
+* `description` - (Optional) Human-friendly description of the mount
+
+* `default_lease_ttl_seconds` - (Optional) Default lease duration for tokens and secrets in seconds
+
+* `max_lease_ttl_seconds` - (Optional) Maximum possible lease duration for tokens and secrets in seconds
+
+* `audit_non_hmac_response_keys` - (Optional) Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
+
+* `audit_non_hmac_request_keys` - (Optional) Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
+
+* `local` - (Optional) Boolean flag that can be explicitly set to true to enforce local mount in HA environment
+
+* `options` - (Optional) Specifies mount type specific options that are passed to the backend
+
+* `seal_wrap` - (Optional) Boolean flag that can be explicitly set to true to enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
+
+* `external_entropy_access` - (Optional) Boolean flag that can be explicitly set to true to enable the secrets engine to access Vault's external entropy source
+
+* `allowed_managed_keys` - (Optional) Set of managed key registry entry names that the mount in question is allowed to access
+
+* `listing_visibility` - (Optional) Specifies whether to show this mount in the UI-specific
+  listing endpoint. Valid values are `unauth` or `hidden`. If not set, behaves like `hidden`.
+
+* `passthrough_request_headers` - (Optional) List of headers to allow and pass from the request to
+  the plugin.
+
+* `allowed_response_headers` - (Optional) List of headers to allow, allowing a plugin to include
+  them in the response.
+
+* `delegated_auth_accessors` - (Optional)  List of allowed authentication mount accessors the
+  backend can request delegated authentication for.
+
+* `plugin_version` - (Optional) Specifies the semantic version of the plugin to use, e.g. "v1.0.0".
+  If unspecified, the server will select any matching unversioned plugin that may have been
+  registered, the latest versioned plugin registered, or a built-in plugin in that order of precedence.
+
+* `identity_token_key` - (Optional)  The key to use for signing plugin workload identity tokens. If
+  not provided, this will default to Vault's OIDC default key. Requires Vault Enterprise 1.16+.
+
 ## Attributes Reference
 
 No additional attributes are exported by this resource.
diff --git a/website/docs/r/azure_secret_backend.html.md b/website/docs/r/azure_secret_backend.html.md
index 9dc3ee02..5e998814 100644
--- a/website/docs/r/azure_secret_backend.html.md
+++ b/website/docs/r/azure_secret_backend.html.md
@@ -77,9 +77,6 @@ The following arguments are supported:
 - `identity_token_ttl` - (Optional) The TTL of generated identity tokens in seconds. Requires Vault 1.17+.
   *Available only for Vault Enterprise*
 
-- `identity_token_key` - (Optional) The key to use for signing identity tokens. Requires Vault 1.17+.
-  *Available only for Vault Enterprise*
-
 - `rotation_period` - (Optional) The amount of time in seconds Vault should wait before rotating the root credential.
   A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
   *Available only for Vault Enterprise*
@@ -98,6 +95,50 @@ The following arguments are supported:
 - `disable_remount` - (Optional) If set, opts out of mount migration on path updates.
   See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
 
+
+### Common Mount Arguments
+These arguments are common across all resources that mount a secret engine.
+
+* `description` - (Optional) Human-friendly description of the mount
+
+* `default_lease_ttl_seconds` - (Optional) Default lease duration for tokens and secrets in seconds
+
+* `max_lease_ttl_seconds` - (Optional) Maximum possible lease duration for tokens and secrets in seconds
+
+* `audit_non_hmac_response_keys` - (Optional) Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
+
+* `audit_non_hmac_request_keys` - (Optional) Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
+
+* `local` - (Optional) Boolean flag that can be explicitly set to true to enforce local mount in HA environment
+
+* `options` - (Optional) Specifies mount type specific options that are passed to the backend
+
+* `seal_wrap` - (Optional) Boolean flag that can be explicitly set to true to enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
+
+* `external_entropy_access` - (Optional) Boolean flag that can be explicitly set to true to enable the secrets engine to access Vault's external entropy source
+
+* `allowed_managed_keys` - (Optional) Set of managed key registry entry names that the mount in question is allowed to access
+
+* `listing_visibility` - (Optional) Specifies whether to show this mount in the UI-specific
+  listing endpoint. Valid values are `unauth` or `hidden`. If not set, behaves like `hidden`.
+
+* `passthrough_request_headers` - (Optional) List of headers to allow and pass from the request to
+  the plugin.
+
+* `allowed_response_headers` - (Optional) List of headers to allow, allowing a plugin to include
+  them in the response.
+
+* `delegated_auth_accessors` - (Optional)  List of allowed authentication mount accessors the
+  backend can request delegated authentication for.
+
+* `plugin_version` - (Optional) Specifies the semantic version of the plugin to use, e.g. "v1.0.0".
+  If unspecified, the server will select any matching unversioned plugin that may have been
+  registered, the latest versioned plugin registered, or a built-in plugin in that order of precedence.
+
+* `identity_token_key` - (Optional)  The key to use for signing plugin workload identity tokens. If
+  not provided, this will default to Vault's OIDC default key. Requires Vault Enterprise 1.16+.
+
+
 ## Attributes Reference
 
 No additional attributes are exported by this resource.
diff --git a/website/docs/r/consul_secret_backend.html.md b/website/docs/r/consul_secret_backend.html.md
index aba4262c..cd6db291 100644
--- a/website/docs/r/consul_secret_backend.html.md
+++ b/website/docs/r/consul_secret_backend.html.md
@@ -81,12 +81,47 @@ this is set you need to also set client_key.
 * `client_key` - (Optional) Client key used for Consul's TLS communication, must be x509 PEM encoded and if this is set
 you need to also set client_cert.
 
-* `default_lease_ttl_seconds` - (Optional) The default TTL for credentials issued by this backend.
+### Common Mount Arguments
+These arguments are common across all resources that mount a secret engine.
 
-* `max_lease_ttl_seconds` - (Optional) The maximum TTL that can be requested
-for credentials issued by this backend.
+* `description` - (Optional) Human-friendly description of the mount
 
-* `local` - (Optional) Specifies if the secret backend is local only.
+* `default_lease_ttl_seconds` - (Optional) Default lease duration for tokens and secrets in seconds
+
+* `max_lease_ttl_seconds` - (Optional) Maximum possible lease duration for tokens and secrets in seconds
+
+* `audit_non_hmac_response_keys` - (Optional) Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
+
+* `audit_non_hmac_request_keys` - (Optional) Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
+
+* `local` - (Optional) Boolean flag that can be explicitly set to true to enforce local mount in HA environment
+
+* `options` - (Optional) Specifies mount type specific options that are passed to the backend
+
+* `seal_wrap` - (Optional) Boolean flag that can be explicitly set to true to enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
+
+* `external_entropy_access` - (Optional) Boolean flag that can be explicitly set to true to enable the secrets engine to access Vault's external entropy source
+
+* `allowed_managed_keys` - (Optional) Set of managed key registry entry names that the mount in question is allowed to access
+
+* `listing_visibility` - (Optional) Specifies whether to show this mount in the UI-specific
+  listing endpoint. Valid values are `unauth` or `hidden`. If not set, behaves like `hidden`.
+
+* `passthrough_request_headers` - (Optional) List of headers to allow and pass from the request to
+  the plugin.
+
+* `allowed_response_headers` - (Optional) List of headers to allow, allowing a plugin to include
+  them in the response.
+
+* `delegated_auth_accessors` - (Optional)  List of allowed authentication mount accessors the
+  backend can request delegated authentication for.
+
+* `plugin_version` - (Optional) Specifies the semantic version of the plugin to use, e.g. "v1.0.0".
+  If unspecified, the server will select any matching unversioned plugin that may have been
+  registered, the latest versioned plugin registered, or a built-in plugin in that order of precedence.
+
+* `identity_token_key` - (Optional)  The key to use for signing plugin workload identity tokens. If
+  not provided, this will default to Vault's OIDC default key. Requires Vault Enterprise 1.16+.
 
 ## Attributes Reference
 
diff --git a/website/docs/r/gcp_secret_backend.html.md b/website/docs/r/gcp_secret_backend.html.md
index 695934bf..055ea02a 100644
--- a/website/docs/r/gcp_secret_backend.html.md
+++ b/website/docs/r/gcp_secret_backend.html.md
@@ -61,16 +61,6 @@ not begin or end with a `/`. Defaults to `gcp`.
 * `disable_remount` - (Optional) If set, opts out of mount migration on path updates.
   See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
 
-* `description` - (Optional) A human-friendly description for this backend.
-
-* `default_lease_ttl_seconds` - (Optional) The default TTL for credentials
-issued by this backend. Defaults to '0'.
-
-* `max_lease_ttl_seconds` - (Optional) The maximum TTL that can be requested
-for credentials issued by this backend. Defaults to '0'.
-
-* `local` - (Optional) Boolean flag that can be explicitly set to true to enforce local mount in HA environment
-
 * `service_account_email` – (Optional) Service Account to impersonate for plugin workload identity federation.
   Required with `identity_token_audience`. Requires Vault 1.17+. *Available only for Vault Enterprise*.
 
@@ -82,9 +72,6 @@ for credentials issued by this backend. Defaults to '0'.
   1 hour. Uses [duration format strings](https://developer.hashicorp.com/vault/docs/concepts/duration-format).
   Requires Vault 1.17+. *Available only for Vault Enterprise*.
 
-* `identity_token_key` - (Optional) The key to use for signing plugin identity
-  tokens. Requires Vault 1.17+. *Available only for Vault Enterprise*.
-
 * `rotation_period` - (Optional) The amount of time in seconds Vault should wait before rotating the root credential.
   A zero value tells Vault not to rotate the root credential. The minimum rotation period is 10 seconds. Requires Vault Enterprise 1.19+.
   *Available only for Vault Enterprise*.
@@ -101,6 +88,48 @@ for credentials issued by this backend. Defaults to '0'.
 
 * `credentials_wo_version` - (Optional)  The version of the `credentials_wo`. For more info see [updating write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes.html#updating-write-only-attributes).
 
+### Common Mount Arguments
+These arguments are common across all resources that mount a secret engine.
+
+* `description` - (Optional) Human-friendly description of the mount
+
+* `default_lease_ttl_seconds` - (Optional) Default lease duration for tokens and secrets in seconds
+
+* `max_lease_ttl_seconds` - (Optional) Maximum possible lease duration for tokens and secrets in seconds
+
+* `audit_non_hmac_response_keys` - (Optional) Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
+
+* `audit_non_hmac_request_keys` - (Optional) Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
+
+* `local` - (Optional) Boolean flag that can be explicitly set to true to enforce local mount in HA environment
+
+* `options` - (Optional) Specifies mount type specific options that are passed to the backend
+
+* `seal_wrap` - (Optional) Boolean flag that can be explicitly set to true to enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
+
+* `external_entropy_access` - (Optional) Boolean flag that can be explicitly set to true to enable the secrets engine to access Vault's external entropy source
+
+* `allowed_managed_keys` - (Optional) Set of managed key registry entry names that the mount in question is allowed to access
+
+* `listing_visibility` - (Optional) Specifies whether to show this mount in the UI-specific
+  listing endpoint. Valid values are `unauth` or `hidden`. If not set, behaves like `hidden`.
+
+* `passthrough_request_headers` - (Optional) List of headers to allow and pass from the request to
+  the plugin.
+
+* `allowed_response_headers` - (Optional) List of headers to allow, allowing a plugin to include
+  them in the response.
+
+* `delegated_auth_accessors` - (Optional)  List of allowed authentication mount accessors the
+  backend can request delegated authentication for.
+
+* `plugin_version` - (Optional) Specifies the semantic version of the plugin to use, e.g. "v1.0.0".
+  If unspecified, the server will select any matching unversioned plugin that may have been
+  registered, the latest versioned plugin registered, or a built-in plugin in that order of precedence.
+
+* `identity_token_key` - (Optional)  The key to use for signing plugin workload identity tokens. If
+  not provided, this will default to Vault's OIDC default key. Requires Vault Enterprise 1.16+.
+
 ## Ephemeral Attributes Reference
 
 The following write-only attributes are supported:
diff --git a/website/docs/r/kmip_secret_backend.html.md b/website/docs/r/kmip_secret_backend.html.md
index 895d762c..4b846f70 100644
--- a/website/docs/r/kmip_secret_backend.html.md
+++ b/website/docs/r/kmip_secret_backend.html.md
@@ -42,8 +42,6 @@ The following arguments are supported:
 * `disable_remount` - (Optional) If set, opts out of mount migration on path updates.
   See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
 
-* `description` - (Optional) A human-friendly description for this backend.
-
 * `listen_addrs` - (Optional) Addresses the KMIP server should listen on (`host:port`).
 
 * `server_hostnames` - (Optional) Hostnames to include in the server's TLS certificate as SAN DNS names. The first will be used as the common name (CN).
@@ -62,7 +60,47 @@ The following arguments are supported:
 
 * `default_tls_client_key_type` - (Optional) Client certificate key type, `rsa` or `ec`.
 
+### Common Mount Arguments
+These arguments are common across all resources that mount a secret engine.
+
+* `description` - (Optional) Human-friendly description of the mount
+
+* `default_lease_ttl_seconds` - (Optional) Default lease duration for tokens and secrets in seconds
+
+* `max_lease_ttl_seconds` - (Optional) Maximum possible lease duration for tokens and secrets in seconds
+
+* `audit_non_hmac_response_keys` - (Optional) Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
+
+* `audit_non_hmac_request_keys` - (Optional) Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
+
+* `local` - (Optional) Boolean flag that can be explicitly set to true to enforce local mount in HA environment
+
+* `options` - (Optional) Specifies mount type specific options that are passed to the backend
+
+* `seal_wrap` - (Optional) Boolean flag that can be explicitly set to true to enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
+
+* `external_entropy_access` - (Optional) Boolean flag that can be explicitly set to true to enable the secrets engine to access Vault's external entropy source
+
+* `allowed_managed_keys` - (Optional) Set of managed key registry entry names that the mount in question is allowed to access
+
+* `listing_visibility` - (Optional) Specifies whether to show this mount in the UI-specific
+  listing endpoint. Valid values are `unauth` or `hidden`. If not set, behaves like `hidden`.
+
+* `passthrough_request_headers` - (Optional) List of headers to allow and pass from the request to
+  the plugin.
+
+* `allowed_response_headers` - (Optional) List of headers to allow, allowing a plugin to include
+  them in the response.
+
+* `delegated_auth_accessors` - (Optional)  List of allowed authentication mount accessors the
+  backend can request delegated authentication for.
+
+* `plugin_version` - (Optional) Specifies the semantic version of the plugin to use, e.g. "v1.0.0".
+  If unspecified, the server will select any matching unversioned plugin that may have been
+  registered, the latest versioned plugin registered, or a built-in plugin in that order of precedence.
 
+* `identity_token_key` - (Optional)  The key to use for signing plugin workload identity tokens. If
+  not provided, this will default to Vault's OIDC default key. Requires Vault Enterprise 1.16+.
 
 ## Attributes Reference
 
diff --git a/website/docs/r/kubernetes_secret_backend.html.md b/website/docs/r/kubernetes_secret_backend.html.md
index 3826e586..e93ba02d 100644
--- a/website/docs/r/kubernetes_secret_backend.html.md
+++ b/website/docs/r/kubernetes_secret_backend.html.md
@@ -62,6 +62,48 @@ Additionally, the following arguments are supported:
 * `disable_local_ca_jwt` - (Optional) Disable defaulting to the local CA certificate and 
   service account JWT when Vault is running in a Kubernetes pod.
 
+### Common Mount Arguments
+These arguments are common across all resources that mount a secret engine.
+
+* `description` - (Optional) Human-friendly description of the mount
+
+* `default_lease_ttl_seconds` - (Optional) Default lease duration for tokens and secrets in seconds
+
+* `max_lease_ttl_seconds` - (Optional) Maximum possible lease duration for tokens and secrets in seconds
+
+* `audit_non_hmac_response_keys` - (Optional) Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
+
+* `audit_non_hmac_request_keys` - (Optional) Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
+
+* `local` - (Optional) Boolean flag that can be explicitly set to true to enforce local mount in HA environment
+
+* `options` - (Optional) Specifies mount type specific options that are passed to the backend
+
+* `seal_wrap` - (Optional) Boolean flag that can be explicitly set to true to enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
+
+* `external_entropy_access` - (Optional) Boolean flag that can be explicitly set to true to enable the secrets engine to access Vault's external entropy source
+
+* `allowed_managed_keys` - (Optional) Set of managed key registry entry names that the mount in question is allowed to access
+
+* `listing_visibility` - (Optional) Specifies whether to show this mount in the UI-specific
+  listing endpoint. Valid values are `unauth` or `hidden`. If not set, behaves like `hidden`.
+
+* `passthrough_request_headers` - (Optional) List of headers to allow and pass from the request to
+  the plugin.
+
+* `allowed_response_headers` - (Optional) List of headers to allow, allowing a plugin to include
+  them in the response.
+
+* `delegated_auth_accessors` - (Optional)  List of allowed authentication mount accessors the
+  backend can request delegated authentication for.
+
+* `plugin_version` - (Optional) Specifies the semantic version of the plugin to use, e.g. "v1.0.0".
+  If unspecified, the server will select any matching unversioned plugin that may have been
+  registered, the latest versioned plugin registered, or a built-in plugin in that order of precedence.
+
+* `identity_token_key` - (Optional)  The key to use for signing plugin workload identity tokens. If
+  not provided, this will default to Vault's OIDC default key. Requires Vault Enterprise 1.16+.
+
 ## Attributes Reference
 
 No additional attributes are exported by this resource.
diff --git a/website/docs/r/ldap_secret_backend.html.md b/website/docs/r/ldap_secret_backend.html.md
index f31c62de..9cbb84ff 100644
--- a/website/docs/r/ldap_secret_backend.html.md
+++ b/website/docs/r/ldap_secret_backend.html.md
@@ -59,18 +59,9 @@ The following arguments are supported:
 
 * `client_tls_key` - (Optional) Client certificate key to provide to the LDAP server, must be x509 PEM encoded.
 
-* `default_lease_ttl_seconds` - (Optional) Default lease duration for secrets in seconds.
-
-* `description` - (Optional) Human-friendly description of the mount for the Active Directory backend.
-
 * `insecure_tls` - (Optional) Skip LDAP server SSL Certificate verification. This is not recommended for production.
   Defaults to `false`.
 
-* `local` - (Optional) Mark the secrets engine as local-only. Local engines are not replicated or removed by
-  replication.Tolerance duration to use when checking the last rotation time.
-
-* `max_lease_ttl_seconds` - (Optional) Maximum possible lease duration for secrets in seconds.
-
 * `password_policy` - (Optional) Name of the password policy to use to generate passwords.
 
 * `request_timeout` - (Optional) Timeout, in seconds, for the connection when making requests against the server
@@ -104,6 +95,48 @@ The following arguments are supported:
 
 * `disable_automated_rotation` - (Optional) Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
 
+### Common Mount Arguments
+These arguments are common across all resources that mount a secret engine.
+
+* `description` - (Optional) Human-friendly description of the mount
+
+* `default_lease_ttl_seconds` - (Optional) Default lease duration for tokens and secrets in seconds
+
+* `max_lease_ttl_seconds` - (Optional) Maximum possible lease duration for tokens and secrets in seconds
+
+* `audit_non_hmac_response_keys` - (Optional) Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
+
+* `audit_non_hmac_request_keys` - (Optional) Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
+
+* `local` - (Optional) Boolean flag that can be explicitly set to true to enforce local mount in HA environment
+
+* `options` - (Optional) Specifies mount type specific options that are passed to the backend
+
+* `seal_wrap` - (Optional) Boolean flag that can be explicitly set to true to enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
+
+* `external_entropy_access` - (Optional) Boolean flag that can be explicitly set to true to enable the secrets engine to access Vault's external entropy source
+
+* `allowed_managed_keys` - (Optional) Set of managed key registry entry names that the mount in question is allowed to access
+
+* `listing_visibility` - (Optional) Specifies whether to show this mount in the UI-specific
+  listing endpoint. Valid values are `unauth` or `hidden`. If not set, behaves like `hidden`.
+
+* `passthrough_request_headers` - (Optional) List of headers to allow and pass from the request to
+  the plugin.
+
+* `allowed_response_headers` - (Optional) List of headers to allow, allowing a plugin to include
+  them in the response.
+
+* `delegated_auth_accessors` - (Optional)  List of allowed authentication mount accessors the
+  backend can request delegated authentication for.
+
+* `plugin_version` - (Optional) Specifies the semantic version of the plugin to use, e.g. "v1.0.0".
+  If unspecified, the server will select any matching unversioned plugin that may have been
+  registered, the latest versioned plugin registered, or a built-in plugin in that order of precedence.
+
+* `identity_token_key` - (Optional)  The key to use for signing plugin workload identity tokens. If
+  not provided, this will default to Vault's OIDC default key. Requires Vault Enterprise 1.16+.
+
 ## Attributes Reference
 
 No additional attributes are exported by this resource.
diff --git a/website/docs/r/nomad_secret_backend.html.md b/website/docs/r/nomad_secret_backend.html.md
index 0c625878..62dfabd5 100644
--- a/website/docs/r/nomad_secret_backend.html.md
+++ b/website/docs/r/nomad_secret_backend.html.md
@@ -58,13 +58,6 @@ x509 PEM encoded.
 
 * `client_key` - (Optional) Client certificate key to provide to the Nomad server, must be x509 PEM encoded.
 
-* `default_lease_ttl_seconds` - (Optional) Default lease duration for secrets in seconds.
-
-* `description` - (Optional) Human-friendly description of the mount for the Active Directory backend.
-
-* `local` - (Optional) Mark the secrets engine as local-only. Local engines are not replicated or removed by
-replication.Tolerance duration to use when checking the last rotation time.
-
 * `max_token_name_length` - (Optional) Specifies the maximum length to use for the name of the Nomad token
 generated with Generate Credential. If omitted, 0 is used and ignored, defaulting to the max value allowed
 by the Nomad version.
@@ -75,7 +68,47 @@ by the Nomad version.
 
 * `ttl` - (Optional) Specifies the ttl of the lease for the generated token.
 
+### Common Mount Arguments
+These arguments are common across all resources that mount a secret engine.
+
+* `description` - (Optional) Human-friendly description of the mount
+
+* `default_lease_ttl_seconds` - (Optional) Default lease duration for tokens and secrets in seconds
+
+* `max_lease_ttl_seconds` - (Optional) Maximum possible lease duration for tokens and secrets in seconds
+
+* `audit_non_hmac_response_keys` - (Optional) Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
+
+* `audit_non_hmac_request_keys` - (Optional) Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
+
+* `local` - (Optional) Boolean flag that can be explicitly set to true to enforce local mount in HA environment
+
+* `options` - (Optional) Specifies mount type specific options that are passed to the backend
+
+* `seal_wrap` - (Optional) Boolean flag that can be explicitly set to true to enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
+
+* `external_entropy_access` - (Optional) Boolean flag that can be explicitly set to true to enable the secrets engine to access Vault's external entropy source
+
+* `allowed_managed_keys` - (Optional) Set of managed key registry entry names that the mount in question is allowed to access
+
+* `listing_visibility` - (Optional) Specifies whether to show this mount in the UI-specific
+  listing endpoint. Valid values are `unauth` or `hidden`. If not set, behaves like `hidden`.
+
+* `passthrough_request_headers` - (Optional) List of headers to allow and pass from the request to
+  the plugin.
+
+* `allowed_response_headers` - (Optional) List of headers to allow, allowing a plugin to include
+  them in the response.
+
+* `delegated_auth_accessors` - (Optional)  List of allowed authentication mount accessors the
+  backend can request delegated authentication for.
+
+* `plugin_version` - (Optional) Specifies the semantic version of the plugin to use, e.g. "v1.0.0".
+  If unspecified, the server will select any matching unversioned plugin that may have been
+  registered, the latest versioned plugin registered, or a built-in plugin in that order of precedence.
 
+* `identity_token_key` - (Optional)  The key to use for signing plugin workload identity tokens. If
+  not provided, this will default to Vault's OIDC default key. Requires Vault Enterprise 1.16+.
 
 ## Attributes Reference
 
diff --git a/website/docs/r/rabbitmq_secret_backend.html.md b/website/docs/r/rabbitmq_secret_backend.html.md
index 5d7dbebc..bc97c2e0 100644
--- a/website/docs/r/rabbitmq_secret_backend.html.md
+++ b/website/docs/r/rabbitmq_secret_backend.html.md
@@ -61,13 +61,47 @@ not begin or end with a `/`. Defaults to `rabbitmq`.
 * `disable_remount` - (Optional) If set, opts out of mount migration on path updates.
   See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
 
-* `description` - (Optional) A human-friendly description for this backend.
+### Common Mount Arguments
+These arguments are common across all resources that mount a secret engine.
 
-* `default_lease_ttl_seconds` - (Optional) The default TTL for credentials
-issued by this backend.
+* `description` - (Optional) Human-friendly description of the mount
 
-* `max_lease_ttl_seconds` - (Optional) The maximum TTL that can be requested
-for credentials issued by this backend.
+* `default_lease_ttl_seconds` - (Optional) Default lease duration for tokens and secrets in seconds
+
+* `max_lease_ttl_seconds` - (Optional) Maximum possible lease duration for tokens and secrets in seconds
+
+* `audit_non_hmac_response_keys` - (Optional) Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
+
+* `audit_non_hmac_request_keys` - (Optional) Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
+
+* `local` - (Optional) Boolean flag that can be explicitly set to true to enforce local mount in HA environment
+
+* `options` - (Optional) Specifies mount type specific options that are passed to the backend
+
+* `seal_wrap` - (Optional) Boolean flag that can be explicitly set to true to enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
+
+* `external_entropy_access` - (Optional) Boolean flag that can be explicitly set to true to enable the secrets engine to access Vault's external entropy source
+
+* `allowed_managed_keys` - (Optional) Set of managed key registry entry names that the mount in question is allowed to access
+
+* `listing_visibility` - (Optional) Specifies whether to show this mount in the UI-specific
+  listing endpoint. Valid values are `unauth` or `hidden`. If not set, behaves like `hidden`.
+
+* `passthrough_request_headers` - (Optional) List of headers to allow and pass from the request to
+  the plugin.
+
+* `allowed_response_headers` - (Optional) List of headers to allow, allowing a plugin to include
+  them in the response.
+
+* `delegated_auth_accessors` - (Optional)  List of allowed authentication mount accessors the
+  backend can request delegated authentication for.
+
+* `plugin_version` - (Optional) Specifies the semantic version of the plugin to use, e.g. "v1.0.0".
+  If unspecified, the server will select any matching unversioned plugin that may have been
+  registered, the latest versioned plugin registered, or a built-in plugin in that order of precedence.
+
+* `identity_token_key` - (Optional)  The key to use for signing plugin workload identity tokens. If
+  not provided, this will default to Vault's OIDC default key. Requires Vault Enterprise 1.16+.
 
 ## Attributes Reference
 
diff --git a/website/docs/r/terraform_cloud_secret_backend.md b/website/docs/r/terraform_cloud_secret_backend.md
index ebc730c6..d8499f69 100644
--- a/website/docs/r/terraform_cloud_secret_backend.md
+++ b/website/docs/r/terraform_cloud_secret_backend.md
@@ -54,12 +54,47 @@ on `token`. Changing the value, however, _will_ overwrite the previously stored
 * `disable_remount` - (Optional) If set, opts out of mount migration on path updates.
   See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
 
-* `description` - (Optional) A human-friendly description for this backend.
+### Common Mount Arguments
+These arguments are common across all resources that mount a secret engine.
 
-* `default_lease_ttl_seconds` - (Optional) The default TTL for credentials issued by this backend.
+* `description` - (Optional) Human-friendly description of the mount
 
-* `max_lease_ttl_seconds` - (Optional) The maximum TTL that can be requested
-for credentials issued by this backend.
+* `default_lease_ttl_seconds` - (Optional) Default lease duration for tokens and secrets in seconds
+
+* `max_lease_ttl_seconds` - (Optional) Maximum possible lease duration for tokens and secrets in seconds
+
+* `audit_non_hmac_response_keys` - (Optional) Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
+
+* `audit_non_hmac_request_keys` - (Optional) Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
+
+* `local` - (Optional) Boolean flag that can be explicitly set to true to enforce local mount in HA environment
+
+* `options` - (Optional) Specifies mount type specific options that are passed to the backend
+
+* `seal_wrap` - (Optional) Boolean flag that can be explicitly set to true to enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
+
+* `external_entropy_access` - (Optional) Boolean flag that can be explicitly set to true to enable the secrets engine to access Vault's external entropy source
+
+* `allowed_managed_keys` - (Optional) Set of managed key registry entry names that the mount in question is allowed to access
+
+* `listing_visibility` - (Optional) Specifies whether to show this mount in the UI-specific
+  listing endpoint. Valid values are `unauth` or `hidden`. If not set, behaves like `hidden`.
+
+* `passthrough_request_headers` - (Optional) List of headers to allow and pass from the request to
+  the plugin.
+
+* `allowed_response_headers` - (Optional) List of headers to allow, allowing a plugin to include
+  them in the response.
+
+* `delegated_auth_accessors` - (Optional)  List of allowed authentication mount accessors the
+  backend can request delegated authentication for.
+
+* `plugin_version` - (Optional) Specifies the semantic version of the plugin to use, e.g. "v1.0.0".
+  If unspecified, the server will select any matching unversioned plugin that may have been
+  registered, the latest versioned plugin registered, or a built-in plugin in that order of precedence.
+
+* `identity_token_key` - (Optional)  The key to use for signing plugin workload identity tokens. If
+  not provided, this will default to Vault's OIDC default key. Requires Vault Enterprise 1.16+.
 
 ## Attributes Reference
 
diff --git a/website/docs/r/transit_secret_backend_key.html.md b/website/docs/r/transit_secret_backend_key.html.md
index 9442d2b4..8221b4b8 100644
--- a/website/docs/r/transit_secret_backend_key.html.md
+++ b/website/docs/r/transit_secret_backend_key.html.md
@@ -40,7 +40,7 @@ The following arguments are supported:
 
 * `name` - (Required) The name to identify this key within the backend. Must be unique within the backend.
 
-* `type` - (Optional) Specifies the type of key to create. The currently-supported types are: `aes128-gcm96`, `aes256-gcm96` (default), `chacha20-poly1305`, `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `hmac`, `rsa-2048`, `rsa-3072` and `rsa-4096`.
+* `type` - (Optional) Specifies the type of key to create. The currently-supported types are: `aes128-gcm96`, `aes256-gcm96` (default), `chacha20-poly1305`, `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `hmac`, `rsa-2048`, `rsa-3072`, `rsa-4096`, `managed_key`, `aes128-cmac`, `aes192-cmac`, `aes256-cmac`, `ml-dsa`, `hybrid`, and `slh-dsa`.
     * Refer to the Vault documentation on transit key types for more information: [Key Types](https://www.vaultproject.io/docs/secrets/transit#key-types)
 
 * `deletion_allowed` - (Optional) Specifies if the keyring is allowed to be deleted. Must be set to 'true' before terraform will be able to destroy keys.
@@ -63,8 +63,12 @@ The following arguments are supported:
 
 * `key_size` - (Optional) The key size in bytes for algorithms that allow variable key sizes. Currently only applicable to HMAC, where it must be between 32 and 512 bytes.
 
-* `parameter_set` - (Optional) The parameter set to use for ML-DSA. Required for
-  ML-DSA and hybrid keys. Valid values are `44`, `65`, and `87`.
+* `parameter_set` - (Optional) The parameter set to use for ML-DSA or SLH-DSA. Required for
+  ML-DSA, hybrid, and SLH-DSA keys.
+  Valid values for ML-DSA are `44`, `65`, and `87`.
+Valid values for SLH-DSA are `slh-dsa-sha2-128s`, `slh-dsa-shake-128s`, `slh-dsa-sha2-128f`, `slh-dsa-shake-128`, `slh-dsa-sha2-192s`,
+`slh-dsa-shake-192s`, `slh-dsa-sha2-192f`, `slh-dsa-shake-192f`, `slh-dsa-sha2-256s`, `slh-dsa-shake-256s`,
+`slh-dsa-sha2-256f`, and `slh-dsa-shake-256f`.
 
 * `hybrid_key_type_pqc` - (Optional) The post-quantum algorithm to use for hybrid signatures.
   Currently, ML-DSA is the only supported key type.



Test patch:
diff --git a/vault/resource_aws_secret_backend_test.go b/vault/resource_aws_secret_backend_test.go
index ed961e91..247d76dc 100644
--- a/vault/resource_aws_secret_backend_test.go
+++ b/vault/resource_aws_secret_backend_test.go
@@ -269,6 +269,99 @@ func TestAccAWSSecretBackend_remount(t *testing.T) {
 	})
 }
 
+func TestAccAWSSecretBackendRole_MountConfig(t *testing.T) {
+	path := acctest.RandomWithPrefix("tf-test-aws")
+
+	resourceType := "vault_aws_secret_backend"
+	resourceName := resourceType + ".test"
+	resource.Test(t, resource.TestCase{
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck: func() {
+			testutil.TestEntPreCheck(t)
+			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion117)
+		},
+		CheckDestroy: testCheckMountDestroyed(resourceType, consts.MountTypeAWS, consts.FieldPath),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAWSSecretBackendConfig_MountConfig(path, false),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, consts.FieldPath, path),
+					resource.TestCheckResourceAttr(resourceName, consts.FieldAccessKey, "access-key-test"),
+					resource.TestCheckResourceAttr(resourceName, consts.FieldSecretKey, "secret-key-test"),
+					resource.TestCheckResourceAttr(resourceName, "default_lease_ttl_seconds", "3600"),
+					resource.TestCheckResourceAttr(resourceName, "max_lease_ttl_seconds", "36000"),
+					resource.TestCheckResourceAttr(resourceName, "passthrough_request_headers.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "passthrough_request_headers.0", "header1"),
+					resource.TestCheckResourceAttr(resourceName, "passthrough_request_headers.1", "header2"),
+					resource.TestCheckResourceAttr(resourceName, "allowed_response_headers.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "allowed_response_headers.0", "header1"),
+					resource.TestCheckResourceAttr(resourceName, "allowed_response_headers.1", "header2"),
+					resource.TestCheckResourceAttr(resourceName, "listing_visibility", "hidden"),
+					resource.TestCheckResourceAttr(resourceName, "force_no_cache", "true"),
+				),
+			},
+			{
+				Config: testAccAWSSecretBackendConfig_MountConfig(path, true),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, consts.FieldPath, path),
+					resource.TestCheckResourceAttr(resourceName, consts.FieldAccessKey, "access-key-test"),
+					resource.TestCheckResourceAttr(resourceName, consts.FieldSecretKey, "secret-key-test"),
+					resource.TestCheckResourceAttr(resourceName, "default_lease_ttl_seconds", "7200"),
+					resource.TestCheckResourceAttr(resourceName, "max_lease_ttl_seconds", "48000"),
+					resource.TestCheckResourceAttr(resourceName, "passthrough_request_headers.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "passthrough_request_headers.0", "header1"),
+					resource.TestCheckResourceAttr(resourceName, "passthrough_request_headers.1", "header2"),
+					resource.TestCheckResourceAttr(resourceName, "allowed_response_headers.#", "3"),
+					resource.TestCheckResourceAttr(resourceName, "allowed_response_headers.0", "header1"),
+					resource.TestCheckResourceAttr(resourceName, "allowed_response_headers.1", "header2"),
+					resource.TestCheckResourceAttr(resourceName, "allowed_response_headers.1", "header2"),
+					resource.TestCheckResourceAttr(resourceName, "allowed_response_headers.2", "header3"),
+					resource.TestCheckResourceAttr(resourceName, "listing_visibility", "unauth"),
+					resource.TestCheckResourceAttr(resourceName, "force_no_cache", "true"),
+				),
+			},
+			testutil.GetImportTestStep(resourceName, false, nil,
+				consts.FieldDisableRemount,
+				consts.FieldSecretKey),
+		},
+	})
+}
+
+func testAccAWSSecretBackendConfig_MountConfig(path string, isUpdate bool) string {
+	if !isUpdate {
+
+		return fmt.Sprintf(`
+resource "vault_aws_secret_backend" "test" {
+  path 					      = "%s"
+  description 			      = "test desc"
+  access_key                  = "access-key-test"
+  secret_key                  = "secret-key-test"
+  default_lease_ttl_seconds   = 3600
+  max_lease_ttl_seconds       = 36000
+  passthrough_request_headers = ["header1", "header2"]
+  allowed_response_headers    = ["header1", "header2"]
+  delegated_auth_accessors    = ["header1", "header2"]
+  listing_visibility          = "hidden"
+  force_no_cache              = true
+}`, path)
+	} else {
+		return fmt.Sprintf(`
+resource "vault_aws_secret_backend" "test" {
+  path 					      = "%s"
+  description 			      = "test desc updated"
+  access_key                  = "access-key-test"
+  secret_key                  = "secret-key-test"
+  default_lease_ttl_seconds   = 7200
+  max_lease_ttl_seconds       = 48000
+  passthrough_request_headers = ["header1", "header2"]
+  allowed_response_headers    = ["header1", "header2", "header3"]
+  delegated_auth_accessors    = ["header1", "header2"]
+  listing_visibility          = "unauth"
+  force_no_cache              = true
+}`, path)
+	}
+}
+
 func testAccAWSSecretBackendConfig_basic(path, accessKey, secretKey string) string {
 	return fmt.Sprintf(`
 resource "vault_aws_secret_backend" "test" {
diff --git a/vault/resource_azure_secret_backend_test.go b/vault/resource_azure_secret_backend_test.go
index e137a872..85e54525 100644
--- a/vault/resource_azure_secret_backend_test.go
+++ b/vault/resource_azure_secret_backend_test.go
@@ -129,6 +129,68 @@ func TestAccAzureSecretBackend_wif(t *testing.T) {
 	})
 }
 
+func TestAccAzureSecretBackend_MountConfig(t *testing.T) {
+	path := acctest.RandomWithPrefix("tf-test-azure")
+
+	resourceType := "vault_azure_secret_backend"
+	resourceName := resourceType + ".test"
+	resource.Test(t, resource.TestCase{
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck: func() {
+			testutil.TestEntPreCheck(t)
+			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion117)
+		},
+		CheckDestroy: testCheckMountDestroyed(resourceType, consts.MountTypeAzure, consts.FieldPath),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAzureSecretBackendConfig_MountConfig(path, false),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, consts.FieldPath, path),
+					resource.TestCheckResourceAttr(resourceName, consts.FieldSubscriptionID, "11111111-2222-3333-4444-111111111111"),
+					resource.TestCheckResourceAttr(resourceName, consts.FieldTenantID, "22222222-3333-4444-5555-333333333333"),
+					resource.TestCheckResourceAttr(resourceName, consts.FieldClientID, "22222222-3333-4444-5555-444444444444"),
+					resource.TestCheckResourceAttr(resourceName, consts.FieldDescription, "test desc"),
+					resource.TestCheckResourceAttr(resourceName, "default_lease_ttl_seconds", "3600"),
+					resource.TestCheckResourceAttr(resourceName, "max_lease_ttl_seconds", "36000"),
+					resource.TestCheckResourceAttr(resourceName, "passthrough_request_headers.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "passthrough_request_headers.0", "header1"),
+					resource.TestCheckResourceAttr(resourceName, "passthrough_request_headers.1", "header2"),
+					resource.TestCheckResourceAttr(resourceName, "allowed_response_headers.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "allowed_response_headers.0", "header1"),
+					resource.TestCheckResourceAttr(resourceName, "allowed_response_headers.1", "header2"),
+					resource.TestCheckResourceAttr(resourceName, "listing_visibility", "hidden"),
+					resource.TestCheckResourceAttr(resourceName, "force_no_cache", "true"),
+				),
+			},
+			{
+				Config: testAccAzureSecretBackendConfig_MountConfig(path, true),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, consts.FieldPath, path),
+					resource.TestCheckResourceAttr(resourceName, consts.FieldSubscriptionID, "11111111-2222-3333-4444-111111111111"),
+					resource.TestCheckResourceAttr(resourceName, consts.FieldTenantID, "22222222-3333-4444-5555-333333333333"),
+					resource.TestCheckResourceAttr(resourceName, consts.FieldClientID, "22222222-3333-4444-5555-444444444444"),
+					resource.TestCheckResourceAttr(resourceName, consts.FieldDescription, "test desc updated"),
+					resource.TestCheckResourceAttr(resourceName, "default_lease_ttl_seconds", "7200"),
+					resource.TestCheckResourceAttr(resourceName, "max_lease_ttl_seconds", "48000"),
+					resource.TestCheckResourceAttr(resourceName, "passthrough_request_headers.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "passthrough_request_headers.0", "header1"),
+					resource.TestCheckResourceAttr(resourceName, "passthrough_request_headers.1", "header2"),
+					resource.TestCheckResourceAttr(resourceName, "allowed_response_headers.#", "3"),
+					resource.TestCheckResourceAttr(resourceName, "allowed_response_headers.0", "header1"),
+					resource.TestCheckResourceAttr(resourceName, "allowed_response_headers.1", "header2"),
+					resource.TestCheckResourceAttr(resourceName, "allowed_response_headers.1", "header2"),
+					resource.TestCheckResourceAttr(resourceName, "allowed_response_headers.2", "header3"),
+					resource.TestCheckResourceAttr(resourceName, "listing_visibility", "unauth"),
+					resource.TestCheckResourceAttr(resourceName, "force_no_cache", "true"),
+				),
+			},
+			testutil.GetImportTestStep(resourceName, false, nil,
+				consts.FieldDisableRemount,
+				consts.FieldClientSecret),
+		},
+	})
+}
+
 func TestAzureSecretBackend_remount(t *testing.T) {
 	testutil.SkipTestAcc(t)
 
@@ -305,6 +367,45 @@ resource "vault_azure_secret_backend" "test" {
 }`, path)
 }
 
+func testAccAzureSecretBackendConfig_MountConfig(path string, isUpdate bool) string {
+
+	if !isUpdate {
+		return fmt.Sprintf(`
+resource "vault_azure_secret_backend" "test" {
+  path 					      = "%s"
+  description 			      = "test desc"
+  subscription_id             = "11111111-2222-3333-4444-111111111111"
+  tenant_id                   = "22222222-3333-4444-5555-333333333333"
+  client_id                   = "22222222-3333-4444-5555-444444444444"
+  client_secret               = "12345678901234567890"
+  default_lease_ttl_seconds   = 3600
+  max_lease_ttl_seconds       = 36000
+  passthrough_request_headers = ["header1", "header2"]
+  allowed_response_headers    = ["header1", "header2"]
+  delegated_auth_accessors    = ["header1", "header2"]
+  listing_visibility          = "hidden"
+  force_no_cache              = true
+}`, path)
+	} else {
+		return fmt.Sprintf(`
+resource "vault_azure_secret_backend" "test" {
+  path 					      = "%s"
+  description 			      = "test desc updated"
+  subscription_id             = "11111111-2222-3333-4444-111111111111"
+  tenant_id                   = "22222222-3333-4444-5555-333333333333"
+  client_id                   = "22222222-3333-4444-5555-444444444444"
+  client_secret               = "12345678901234567890"
+  default_lease_ttl_seconds   = 7200
+  max_lease_ttl_seconds       = 48000
+  passthrough_request_headers = ["header1", "header2"]
+  allowed_response_headers    = ["header1", "header2", "header3"]
+  delegated_auth_accessors    = ["header1", "header2"]
+  listing_visibility          = "unauth"
+  force_no_cache              = true
+}`, path)
+	}
+}
+
 func testAccAzureSecretBackendConfig_automatedRotation(path string, rotationSchedule string, rotationWindow, rotationPeriod int, disableRotation bool) string {
 	return fmt.Sprintf(`
 resource "vault_azure_secret_backend" "test" {
diff --git a/vault/resource_mount_test.go b/vault/resource_mount_test.go
index f1ed5f8d..d3d91667 100644
--- a/vault/resource_mount_test.go
+++ b/vault/resource_mount_test.go
@@ -245,7 +245,7 @@ func TestResourceMount_IDTokenKey(t *testing.T) {
 		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestEntPreCheck(t)
-			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion116)
+			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion117)
 		},
 		Steps: []resource.TestStep{
 			{
@@ -262,10 +262,9 @@ func TestResourceMount_IDTokenKey(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "allowed_response_headers.0", "header1"),
 					resource.TestCheckResourceAttr(resourceName, "allowed_response_headers.1", "header2"),
 					resource.TestCheckResourceAttr(resourceName, "listing_visibility", "hidden"),
-					// @TODO add these back in when Vault 1.16.3 is released
-					// resource.TestCheckResourceAttr(resourceName, "delegated_auth_accessors.#", "2"),
-					// resource.TestCheckResourceAttr(resourceName, "delegated_auth_accessors.0", "header1"),
-					// resource.TestCheckResourceAttr(resourceName, "delegated_auth_accessors.1", "header2"),
+					resource.TestCheckResourceAttr(resourceName, "delegated_auth_accessors.#", "2"),
+					resource.TestCheckResourceAttr(resourceName, "delegated_auth_accessors.0", "header1"),
+					resource.TestCheckResourceAttr(resourceName, "delegated_auth_accessors.1", "header2"),
 				),
 			},
 			{
@@ -283,17 +282,13 @@ func TestResourceMount_IDTokenKey(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "allowed_response_headers.2", "header3"),
 					resource.TestCheckResourceAttr(resourceName, "listing_visibility", "unauth"),
 					resource.TestCheckResourceAttr(resourceName, "identity_token_key", "my-key"),
-					// @TODO add these back in when Vault 1.16.3 is released
-					// resource.TestCheckResourceAttr(resourceName, "delegated_auth_accessors.#", "3"),
-					// resource.TestCheckResourceAttr(resourceName, "delegated_auth_accessors.0", "header1"),
-					// resource.TestCheckResourceAttr(resourceName, "delegated_auth_accessors.1", "header2"),
-					// resource.TestCheckResourceAttr(resourceName, "delegated_auth_accessors.2", "header3"),
+					resource.TestCheckResourceAttr(resourceName, "delegated_auth_accessors.#", "3"),
+					resource.TestCheckResourceAttr(resourceName, "delegated_auth_accessors.0", "header1"),
+					resource.TestCheckResourceAttr(resourceName, "delegated_auth_accessors.1", "header2"),
+					resource.TestCheckResourceAttr(resourceName, "delegated_auth_accessors.2", "header3"),
 				),
 			},
-			// @TODO remove ignore_fields once Vault 1.16.3 is released
-			testutil.GetImportTestStep(resourceName, false, nil,
-				"delegated_auth_accessors",
-			),
+			testutil.GetImportTestStep(resourceName, false, nil),
 		},
 	})
 }