Repository: hashicorp/terraform-provider-vault

Issue:
[Bug]: `vault_aws_auth_backend_role` eventual consistency
### Terraform Core Version

1.11.0

### Terraform Vault Provider Version

4.7.0

### Vault Server Version

1.18.4

### Affected Resource(s)

* `vault_aws_auth_backend_role`

### Expected Behavior

Terraform apply to succeed on the first attempt

### Actual Behavior

The first terraform apply fails with `unable to resolve ARN "arn:aws:iam::111122223333:role/ai-demo-lambda-role" to internal ID: unable to fetch current caller: InvalidClientTokenId: The security token included in the request is invalid.`. The next terraform apply works without any code changes. This suggests an eventual consistency bug

### Relevant Error/Panic Output Snippet

```shell
Plan: 7 to add, 0 to change, 0 to destroy.
vault_auth_backend.aws: Creating...
aws_iam_user.vault_mount_user: Creating...
aws_iam_role.lambda: Creating...
aws_iam_user.vault_mount_user: Creation complete after 2s [id=demo-example@example.com]
aws_iam_user_policy_attachment.vault_mount_user: Creating...
aws_iam_access_key.vault_mount_user: Creating...
aws_iam_role.lambda: Creation complete after 2s [id=ai-demo-lambda-role]
aws_iam_access_key.vault_mount_user: Creation complete after 0s [id=AKIAUBKFCJKSPCBUMUX5]
vault_auth_backend.aws: Creation complete after 2s [id=aws]
vault_aws_auth_backend_client.client: Creating...
aws_iam_user_policy_attachment.vault_mount_user: Creation complete after 0s [id=demo-example@example.com-20250325143354906400000001]
vault_aws_auth_backend_client.client: Creation complete after 1s [id=auth/aws/config/client]
vault_aws_auth_backend_role.lambda_role: Creating...
╷
│ Error: error writing AWS auth backend role "auth/aws/role/example-lambda-role": error writing to path "auth/aws/role/example-lambda-role", err=Error making API request.
│ 
│ Namespace: admin
│ URL: PUT https://ai-demo-public-vault-768431d7.2b151a21.z1.hashicorp.cloud:8200/v1/auth/aws/role/example-lambda-role
│ Code: 400. Errors:
│ 
│ * unable to resolve ARN "arn:aws:iam::111122223333:role/ai-demo-lambda-role" to internal ID: unable to fetch current caller: InvalidClientTokenId: The security token included in the request is invalid.
│       status code: 403, request id: 03dbd4bf-37e4-40f7-9ae2-7ee33d700b8d hello
│ 
│   with vault_aws_auth_backend_role.lambda_role,
│   on vault.tf line 55, in resource "vault_aws_auth_backend_role" "lambda_role":
│   55: resource "vault_aws_auth_backend_role" "lambda_role" {
│ 
╵
```

### Terraform Configuration Files

```hcl
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
    vault = {
      source  = "hashicorp/vault"
      version = "~> 4.0"
    }
  }
}

provider "aws" {
  region = "REPLACE"
}

provider "vault" {
  address   = "REPLACE"
  namespace = "REPLACE"
}

resource "aws_iam_role" "lambda" {
  name               = "example-lambda-role"
  assume_role_policy = data.aws_iam_policy_document.assume_role_lambda.json
}

data "aws_iam_policy_document" "assume_role_lambda" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

data "aws_caller_identity" "current" {}

locals {
  my_email = split("/", data.aws_caller_identity.current.arn)[2]
}

resource "aws_iam_user" "vault_mount_user" {
  name                 = "demo-${local.my_email}"
  permissions_boundary = data.aws_iam_policy.demo_user_permissions_boundary.arn
  force_destroy        = true
}

data "aws_iam_policy" "demo_user_permissions_boundary" {
  name = "DemoUser"
}

resource "aws_iam_user_policy_attachment" "vault_mount_user" {
  user       = aws_iam_user.vault_mount_user.name
  policy_arn = data.aws_iam_policy.demo_user_permissions_boundary.arn
}

resource "aws_iam_access_key" "vault_mount_user" {
  user = aws_iam_user.vault_mount_user.name
}

resource "vault_auth_backend" "aws" {
  type        = "aws"
  path        = "aws"
  description = "AWS authentication method for Lambda extension"
}

resource "vault_aws_auth_backend_client" "client" {
  backend    = vault_auth_backend.aws.path
  access_key = aws_iam_access_key.vault_mount_user.id
  secret_key = aws_iam_access_key.vault_mount_user.secret
}

resource "vault_aws_auth_backend_role" "lambda_role" {
  backend                  = vault_auth_backend.aws.path
  role                     = "example-lambda-role"
  auth_type                = "iam"
  bound_iam_principal_arns = [aws_iam_role.lambda.arn]
  token_ttl                = 960
  token_max_ttl            = 1200
  token_policies           = ["default"]
}
```

### Steps to Reproduce

1. Prepare Vault Server. Sample code to bootstrap the Vault Server can be found here: https://github.com/hashi-demo-lab/securing_ai_agents/tree/main/hcp_vault. This runs Vault Dedicated on HCP. Once done, replace values in `provider "vault" {` accordingly. 
2. Prepare AWS credentials and set the region in `provider "aws" {`
3. To run the snippet above, your AWS Account must have the permission boundary named `DemoUser`.

### Debug Output

_No response_

### Panic Output

_No response_

### Important Factoids

_No response_

### References

_No response_

### Would you like to implement a fix?

Yes

Discussion:

Solution patch:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index c468494d..90949e0f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -33,7 +33,7 @@ jobs:
       # this then the terraform-plugin-sdk will attempt to download it for each test!
       - uses: hashicorp/setup-terraform@v3
         with:
-          terraform_version: '1.7.*'
+          terraform_version: '1.11.*'
           terraform_wrapper: false
 
       - name: Cache go build
@@ -64,10 +64,10 @@ jobs:
       matrix:
         image:
         - "vault-enterprise:1.15.16-ent"
-        - "vault-enterprise:1.16.15-ent"
-        - "vault-enterprise:1.17.11-ent"
-        - "vault-enterprise:1.18.4-ent"
-        - "vault-enterprise:1.19.0-ent"
+        - "vault-enterprise:1.16.21-ent"
+        - "vault-enterprise:1.17.17-ent"
+        - "vault-enterprise:1.18.10-ent"
+        - "vault-enterprise:1.19.5-ent"
         - "vault:latest"
     services:
       vault:
@@ -101,7 +101,7 @@ jobs:
         ports:
           - 1433:1433
       mongo:
-        image: docker.mirror.hashicorp.services/mongo:latest
+        image: mongo:latest
         env:
           MONGO_INITDB_ROOT_USERNAME: root
           MONGO_INITDB_ROOT_PASSWORD: mongodb
@@ -165,7 +165,7 @@ jobs:
       # this then the terraform-plugin-sdk will attempt to download it for each test!
       - uses: hashicorp/setup-terraform@v3
         with:
-          terraform_version: '1.7.*'
+          terraform_version: '1.11.*'
           terraform_wrapper: false
       - name: Check Terraform CLI version
         run: terraform --version
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 784561dd..c965e979 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,47 @@
 ## Unreleased
 
+* Add support for key_usage to `vault_pki_secret_backend_root_sign_intermediate` ([#2421])(https://github.com/hashicorp/terraform-provider-vault/pull/2421)
+
+
+## 5.0.0 (May 21, 2025)
+
+**Important**: `5.X` multiplexes the Vault provider to use the [Terraform Plugin Framework](https://developer.hashicorp.com/terraform/plugin/framework),
+upgrades to Terraform `1.11.x`, and adds support for Ephemeral Resources and Write-Only attributes.
+Please refer to the
+[Terraform Vault Provider 5.0.0 Upgrade Guide](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/version_5_upgrade) for specific
+details around the changes.
+
+VERSION COMPATIBILITY:
+`5.X` is officially supported and tested against Vault server versions >= `1.15.x`.
+`5.X` supports Terraform versions >= `1.11.x` in order to support ephemeral resources and write-only attributes.
+
+BREAKING CHANGES:
+Please refer to the [upgrade topics](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/version_5_upgrade.html#upgrade-topics)
+in the guide for details on all breaking changes.
+
+FEATURES:
+* Add new ephemeral resources/attributes ([#2457](https://github.com/hashicorp/terraform-provider-vault/pull/2457)):
+  * Add new ephemeral resource `vault_kv_secret_v2`
+  * Add new ephemeral resource `vault_database_secret`
+  * Add new write-only attribute `data_json_wo` (along with `data_json_wo_version`) to resource `vault_kv_secret_v2`
+  * Add new write-only attribute `credentials_wo`, (along with `credentials_wo_version`) to resource `vault_gcp_secret_backend`
+  * Add new write-only attribute `password_wo`, (along with `password_wo_version` to resource) `vault_database_secret_backend_connection`
+
+BUGS:
+* fix `vault_policy_document` data source regression to allow empty `capabilities` ([#2466](https://github.com/hashicorp/terraform-provider-vault/pull/2466))
+
+## 4.8.0 (Apr 23, 2025)
+
+FEATURES:
+
+* Add support for `recursive` search in `data_vault_namespaces` [#2408](https://github.com/hashicorp/terraform-provider-vault/pull/2408)
+* Add support for `subscribe_event_types` in `data_source_policy_document` [#2445](https://github.com/hashicorp/terraform-provider-vault/pull/2445)
+* Add support for `explicit_max_ttl` in `vault_azure_secret_backend_role` resources. Requires Vault 1.18+ ([#2438](https://github.com/hashicorp/terraform-provider-vault/pull/2438)).
+
+BUGS:
+
+* Fix credential validation failures in `vault_azure_access_credentials` data source caused by Azure RBAC propagation delays using `azure_groups` [#2437](https://github.com/hashicorp/terraform-provider-vault/pull/2437)
+
 ## 4.7.0 (Mar 12, 2025)
 
 FEATURES:
diff --git a/go.mod b/go.mod
index 44f80a43..b03076cb 100644
--- a/go.mod
+++ b/go.mod
@@ -1,119 +1,128 @@
 module github.com/hashicorp/terraform-provider-vault
 
-go 1.21
+go 1.23.3
+
+toolchain go1.23.4
 
 require (
-	cloud.google.com/go/compute/metadata v0.2.3
-	cloud.google.com/go/iam v1.1.5
+	cloud.google.com/go/compute/metadata v0.6.0
+	cloud.google.com/go/iam v1.2.2
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.11.1
 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.6.0
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0
-	github.com/aws/aws-sdk-go v1.50.13
-	github.com/cenkalti/backoff/v4 v4.2.1
+	github.com/aws/aws-sdk-go v1.55.6
+	github.com/cenkalti/backoff/v4 v4.3.0
 	github.com/coreos/pkg v0.0.0-20230601102743-20bbbf26f4d8
 	github.com/denisenkom/go-mssqldb v0.12.3
-	github.com/go-sql-driver/mysql v1.7.1
-	github.com/go-test/deep v1.1.0
+	github.com/go-sql-driver/mysql v1.8.1
+	github.com/go-test/deep v1.1.1
 	github.com/google/uuid v1.6.0
 	github.com/gosimple/slug v1.13.1
 	github.com/hashicorp/consul/api v1.27.0
 	github.com/hashicorp/errwrap v1.1.0
 	github.com/hashicorp/go-cleanhttp v0.5.2
-	github.com/hashicorp/go-cty v1.4.1-0.20200723130312-85980079f637
+	github.com/hashicorp/go-cty v1.5.0
 	github.com/hashicorp/go-hclog v1.6.3
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/hashicorp/go-retryablehttp v0.7.7
-	github.com/hashicorp/go-secure-stdlib/awsutil v0.3.0
-	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8
-	github.com/hashicorp/go-version v1.6.0
-	github.com/hashicorp/terraform-plugin-sdk/v2 v2.31.0
+	github.com/hashicorp/go-secure-stdlib/awsutil v0.2.3
+	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.9
+	github.com/hashicorp/go-version v1.7.0
+	github.com/hashicorp/terraform-plugin-framework v1.14.1
+	github.com/hashicorp/terraform-plugin-framework-validators v0.17.0
+	github.com/hashicorp/terraform-plugin-go v0.26.0
+	github.com/hashicorp/terraform-plugin-log v0.9.0
+	github.com/hashicorp/terraform-plugin-mux v0.18.0
+	github.com/hashicorp/terraform-plugin-sdk/v2 v2.36.1
+	github.com/hashicorp/terraform-plugin-testing v1.12.0
 	github.com/hashicorp/vault-plugin-auth-jwt v0.20.3
 	github.com/hashicorp/vault-plugin-auth-kerberos v0.11.0
 	github.com/hashicorp/vault-plugin-auth-oci v0.15.1
-	github.com/hashicorp/vault/api v1.14.0
-	github.com/hashicorp/vault/sdk v0.13.0
+	github.com/hashicorp/vault/api v1.16.0
+	github.com/hashicorp/vault/sdk v0.15.2
 	github.com/jackc/pgx/v4 v4.18.3
 	github.com/jcmturner/gokrb5/v8 v8.4.4
 	github.com/mitchellh/go-homedir v1.1.0
 	github.com/mitchellh/mapstructure v1.5.0
-	github.com/stretchr/testify v1.9.0
-	golang.org/x/crypto v0.31.0
-	golang.org/x/net v0.33.0
-	golang.org/x/oauth2 v0.18.0
-	google.golang.org/api v0.163.0
-	google.golang.org/genproto v0.0.0-20240125205218-1f4bbc51befe
-	k8s.io/utils v0.0.0-20240102154912-e7106e64919e
+	github.com/stretchr/testify v1.10.0
+	golang.org/x/crypto v0.36.0
+	golang.org/x/net v0.37.0
+	golang.org/x/oauth2 v0.25.0
+	google.golang.org/api v0.219.0
+	google.golang.org/genproto v0.0.0-20241118233622-e639e219e697
+	k8s.io/utils v0.0.0-20230726121419-3b25d923346b
 )
 
 require (
-	cloud.google.com/go/compute v1.23.3 // indirect
+	cloud.google.com/go/auth v0.14.0 // indirect
+	cloud.google.com/go/auth/oauth2adapt v0.2.7 // indirect
+	filippo.io/edwards25519 v1.1.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.8.0 // indirect
 	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
 	github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2 // indirect
-	github.com/Microsoft/go-winio v0.6.1 // indirect
-	github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371 // indirect
+	github.com/Microsoft/go-winio v0.6.2 // indirect
+	github.com/ProtonMail/go-crypto v1.1.3 // indirect
 	github.com/agext/levenshtein v1.2.2 // indirect
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
 	github.com/armon/go-metrics v0.4.1 // indirect
 	github.com/armon/go-radix v1.0.0 // indirect
 	github.com/cenkalti/backoff/v3 v3.2.2 // indirect
 	github.com/cloudflare/circl v1.3.7 // indirect
-	github.com/containerd/containerd v1.7.12 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/coreos/go-oidc/v3 v3.10.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/distribution/reference v0.6.0 // indirect
-	github.com/docker/docker v25.0.6+incompatible // indirect
-	github.com/docker/go-connections v0.4.0 // indirect
+	github.com/docker/docker v27.2.1+incompatible // indirect
+	github.com/docker/go-connections v0.5.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/evanphx/json-patch/v5 v5.6.0 // indirect
-	github.com/fatih/color v1.16.0 // indirect
+	github.com/fatih/color v1.17.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/frankban/quicktest v1.14.6 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.5 // indirect
 	github.com/go-jose/go-jose/v3 v3.0.3 // indirect
-	github.com/go-jose/go-jose/v4 v4.0.1 // indirect
-	github.com/go-ldap/ldap/v3 v3.4.6 // indirect
-	github.com/go-logr/logr v1.4.1 // indirect
+	github.com/go-jose/go-jose/v4 v4.0.4 // indirect
+	github.com/go-ldap/ldap/v3 v3.4.8 // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
 	github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect
 	github.com/golang-sql/sqlexp v0.1.0 // indirect
-	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
-	github.com/google/go-cmp v0.6.0 // indirect
-	github.com/google/s2a-go v0.1.7 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect
-	github.com/googleapis/gax-go/v2 v2.12.0 // indirect
+	github.com/google/certificate-transparency-go v1.3.1 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/google/s2a-go v0.1.9 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.4 // indirect
+	github.com/googleapis/gax-go/v2 v2.14.1 // indirect
 	github.com/gosimple/unidecode v1.0.1 // indirect
 	github.com/hashicorp/cap v0.6.0 // indirect
-	github.com/hashicorp/cap/ldap v0.0.0-20240328153749-fcfe271d0227 // indirect
+	github.com/hashicorp/cap/ldap v0.0.0-20250106213447-9047b8b3240f // indirect
 	github.com/hashicorp/go-checkpoint v0.5.0 // indirect
+	github.com/hashicorp/go-hmac-drbg v0.0.0-20210916214228-a6e5a68489f6 // indirect
 	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
 	github.com/hashicorp/go-kms-wrapping/entropy/v2 v2.0.1 // indirect
-	github.com/hashicorp/go-kms-wrapping/v2 v2.0.16 // indirect
-	github.com/hashicorp/go-plugin v1.6.0 // indirect
+	github.com/hashicorp/go-kms-wrapping/v2 v2.0.18 // indirect
+	github.com/hashicorp/go-plugin v1.6.2 // indirect
 	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
 	github.com/hashicorp/go-secure-stdlib/base62 v0.1.2 // indirect
+	github.com/hashicorp/go-secure-stdlib/cryptoutil v0.1.1 // indirect
 	github.com/hashicorp/go-secure-stdlib/mlock v0.1.3 // indirect
-	github.com/hashicorp/go-secure-stdlib/plugincontainer v0.3.0 // indirect
+	github.com/hashicorp/go-secure-stdlib/permitpool v1.0.0 // indirect
+	github.com/hashicorp/go-secure-stdlib/plugincontainer v0.4.1 // indirect
 	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
 	github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.3 // indirect
 	github.com/hashicorp/go-sockaddr v1.0.6 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
 	github.com/hashicorp/golang-lru v1.0.2 // indirect
-	github.com/hashicorp/hc-install v0.6.2 // indirect
+	github.com/hashicorp/hc-install v0.9.1 // indirect
 	github.com/hashicorp/hcl v1.0.1-vault-5 // indirect
-	github.com/hashicorp/hcl/v2 v2.19.1 // indirect
+	github.com/hashicorp/hcl/v2 v2.23.0 // indirect
 	github.com/hashicorp/logutils v1.0.0 // indirect
 	github.com/hashicorp/serf v0.10.1 // indirect
-	github.com/hashicorp/terraform-exec v0.19.0 // indirect
-	github.com/hashicorp/terraform-json v0.18.0 // indirect
-	github.com/hashicorp/terraform-plugin-go v0.20.0 // indirect
-	github.com/hashicorp/terraform-plugin-log v0.9.0 // indirect
-	github.com/hashicorp/terraform-registry-address v0.2.3 // indirect
+	github.com/hashicorp/terraform-exec v0.22.0 // indirect
+	github.com/hashicorp/terraform-json v0.24.0 // indirect
+	github.com/hashicorp/terraform-registry-address v0.2.4 // indirect
 	github.com/hashicorp/terraform-svchost v0.1.1 // indirect
 	github.com/hashicorp/yamux v0.1.1 // indirect
 	github.com/jackc/chunkreader/v2 v2.0.1 // indirect
@@ -122,15 +131,15 @@ require (
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgproto3/v2 v2.3.3 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
-	github.com/jackc/pgtype v1.14.0 // indirect
+	github.com/jackc/pgtype v1.14.3 // indirect
 	github.com/jcmturner/aescts/v2 v2.0.0 // indirect
 	github.com/jcmturner/dnsutils/v2 v2.0.0 // indirect
 	github.com/jcmturner/gofork v1.7.6 // indirect
 	github.com/jcmturner/goidentity/v6 v6.0.1 // indirect
 	github.com/jcmturner/rpc/v2 v2.0.3 // indirect
-	github.com/jmespath/go-jmespath v0.4.0 // indirect
+	github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24 // indirect
 	github.com/joshlf/go-acl v0.0.0-20200411065538-eae00ae38531 // indirect
-	github.com/klauspost/compress v1.16.7 // indirect
+	github.com/klauspost/compress v1.17.11 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
@@ -139,47 +148,49 @@ require (
 	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
 	github.com/mitchellh/pointerstructure v1.2.1 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
+	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/patternmatcher v0.5.0 // indirect
 	github.com/moby/sys/sequential v0.5.0 // indirect
-	github.com/moby/sys/user v0.1.0 // indirect
+	github.com/moby/sys/user v0.2.0 // indirect
+	github.com/moby/sys/userns v0.1.0 // indirect
 	github.com/natefinch/atomic v1.0.1 // indirect
 	github.com/oklog/run v1.1.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.1.0-rc2.0.20221005185240-3a7f492d3f1b // indirect
+	github.com/opencontainers/image-spec v1.1.0 // indirect
 	github.com/oracle/oci-go-sdk/v59 v59.0.0 // indirect
 	github.com/patrickmn/go-cache v2.1.0+incompatible // indirect
-	github.com/petermattis/goid v0.0.0-20180202154549-b0b1615b78e5 // indirect
+	github.com/petermattis/goid v0.0.0-20240813172612-4fcff4a6cae7 // indirect
 	github.com/pierrec/lz4 v2.6.1+incompatible // indirect
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/robfig/cron/v3 v3.0.1 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
-	github.com/sasha-s/go-deadlock v0.2.0 // indirect
+	github.com/sasha-s/go-deadlock v0.3.5 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/sony/gobreaker v0.5.0 // indirect
 	github.com/vmihailenco/msgpack v4.0.4+incompatible // indirect
 	github.com/vmihailenco/msgpack/v5 v5.4.1 // indirect
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
-	github.com/zclconf/go-cty v1.14.1 // indirect
-	go.opencensus.io v0.24.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.47.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0 // indirect
-	go.opentelemetry.io/otel v1.24.0 // indirect
-	go.opentelemetry.io/otel/metric v1.24.0 // indirect
-	go.opentelemetry.io/otel/trace v1.24.0 // indirect
+	github.com/zclconf/go-cty v1.16.2 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.54.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0 // indirect
+	go.opentelemetry.io/otel v1.32.0 // indirect
+	go.opentelemetry.io/otel/metric v1.32.0 // indirect
+	go.opentelemetry.io/otel/trace v1.32.0 // indirect
 	go.uber.org/atomic v1.11.0 // indirect
-	golang.org/x/exp v0.0.0-20240222234643-814bf88cf225 // indirect
-	golang.org/x/mod v0.17.0 // indirect
-	golang.org/x/sync v0.10.0 // indirect
-	golang.org/x/sys v0.28.0 // indirect
-	golang.org/x/text v0.21.0 // indirect
-	golang.org/x/time v0.5.0 // indirect
-	golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
+	golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842 // indirect
+	golang.org/x/mod v0.22.0 // indirect
+	golang.org/x/sync v0.12.0 // indirect
+	golang.org/x/sys v0.31.0 // indirect
+	golang.org/x/text v0.23.0 // indirect
+	golang.org/x/time v0.9.0 // indirect
+	golang.org/x/tools v0.29.0 // indirect
 	google.golang.org/appengine v1.6.8 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20240125205218-1f4bbc51befe // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240125205218-1f4bbc51befe // indirect
-	google.golang.org/grpc v1.61.1 // indirect
-	google.golang.org/protobuf v1.34.1 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250124145028-65684f501c47 // indirect
+	google.golang.org/grpc v1.70.0 // indirect
+	google.golang.org/protobuf v1.36.4 // indirect
 	gopkg.in/jcmturner/goidentity.v3 v3.0.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/go.sum b/go.sum
index 3187f446..81625896 100644
--- a/go.sum
+++ b/go.sum
@@ -161,6 +161,10 @@ cloud.google.com/go/assuredworkloads v1.11.1/go.mod h1:+F04I52Pgn5nmPG36CWFtxmav
 cloud.google.com/go/assuredworkloads v1.11.2/go.mod h1:O1dfr+oZJMlE6mw0Bp0P1KZSlj5SghMBvTpZqIcUAW4=
 cloud.google.com/go/assuredworkloads v1.11.3/go.mod h1:vEjfTKYyRUaIeA0bsGJceFV2JKpVRgyG2op3jfa59Zs=
 cloud.google.com/go/assuredworkloads v1.11.4/go.mod h1:4pwwGNwy1RP0m+y12ef3Q/8PaiWrIDQ6nD2E8kvWI9U=
+cloud.google.com/go/auth v0.14.0 h1:A5C4dKV/Spdvxcl0ggWwWEzzP7AZMJSEIgrkngwhGYM=
+cloud.google.com/go/auth v0.14.0/go.mod h1:CYsoRL1PdiDuqeQpZE0bP2pnPrGqFcOkI0nldEQis+A=
+cloud.google.com/go/auth/oauth2adapt v0.2.7 h1:/Lc7xODdqcEw8IrZ9SvwnlLX6j9FHQM74z6cBk9Rw6M=
+cloud.google.com/go/auth/oauth2adapt v0.2.7/go.mod h1:NTbTTzfvPl1Y3V1nPpOgl2w6d/FjO7NNUQaWSox6ZMc=
 cloud.google.com/go/automl v1.5.0/go.mod h1:34EjfoFGMZ5sgJ9EoLsRtdPSNZLcfflJR39VbVNS2M0=
 cloud.google.com/go/automl v1.6.0/go.mod h1:ugf8a6Fx+zP0D59WLhqgTDsQI9w07o64uf/Is3Nh5p8=
 cloud.google.com/go/automl v1.7.0/go.mod h1:RL9MYCCsJEOmt0Wf3z9uzG0a7adTT1fe+aObgSpkCt8=
@@ -304,13 +308,13 @@ cloud.google.com/go/compute v1.21.0/go.mod h1:4tCnrn48xsqlwSAiLf1HXMQk8CONslYbdi
 cloud.google.com/go/compute v1.23.0/go.mod h1:4tCnrn48xsqlwSAiLf1HXMQk8CONslYbdiEZc9FEIbM=
 cloud.google.com/go/compute v1.23.1/go.mod h1:CqB3xpmPKKt3OJpW2ndFIXnA9A4xAy/F3Xp1ixncW78=
 cloud.google.com/go/compute v1.23.2/go.mod h1:JJ0atRC0J/oWYiiVBmsSsrRnh92DhZPG4hFDcR04Rns=
-cloud.google.com/go/compute v1.23.3 h1:6sVlXXBmbd7jNX0Ipq0trII3e4n1/MsADLK6a+aiVlk=
 cloud.google.com/go/compute v1.23.3/go.mod h1:VCgBUoMnIVIR0CscqQiPJLAG25E3ZRZMzcFZeQ+h8CI=
 cloud.google.com/go/compute/metadata v0.1.0/go.mod h1:Z1VN+bulIf6bt4P/C37K4DyZYZEXYonfTBHHFPO/4UU=
 cloud.google.com/go/compute/metadata v0.2.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
 cloud.google.com/go/compute/metadata v0.2.1/go.mod h1:jgHgmJd2RKBGzXqF5LR2EZMGxBkeanZ9wwa75XHJgOM=
-cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
 cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
+cloud.google.com/go/compute/metadata v0.6.0 h1:A6hENjEsCDtC1k8byVsgwvVcioamEHvZ4j01OwKxG9I=
+cloud.google.com/go/compute/metadata v0.6.0/go.mod h1:FjyFAW1MW0C203CEOMDTu3Dk1FlqW3Rga40jzHL4hfg=
 cloud.google.com/go/contactcenterinsights v1.3.0/go.mod h1:Eu2oemoePuEFc/xKFPjbTuPSj0fYJcPls9TFlPNnHHY=
 cloud.google.com/go/contactcenterinsights v1.4.0/go.mod h1:L2YzkGbPsv+vMQMCADxJoT9YiTTnSEd6fEvCeHTYVck=
 cloud.google.com/go/contactcenterinsights v1.6.0/go.mod h1:IIDlT6CLcDoyv79kDv8iWxMSTZhLxSCofVV5W6YFM/w=
@@ -593,8 +597,9 @@ cloud.google.com/go/iam v1.1.1/go.mod h1:A5avdyVL2tCppe4unb0951eI9jreack+RJ0/d+K
 cloud.google.com/go/iam v1.1.2/go.mod h1:A5avdyVL2tCppe4unb0951eI9jreack+RJ0/d+KUZOU=
 cloud.google.com/go/iam v1.1.3/go.mod h1:3khUlaBXfPKKe7huYgEpDn6FtgRyMEqbkvBxrQyY5SE=
 cloud.google.com/go/iam v1.1.4/go.mod h1:l/rg8l1AaA+VFMho/HYx2Vv6xinPSLMF8qfhRPIZ0L8=
-cloud.google.com/go/iam v1.1.5 h1:1jTsCu4bcsNsE4iiqNT5SHwrDRCfRmIaaaVFhRveTJI=
 cloud.google.com/go/iam v1.1.5/go.mod h1:rB6P/Ic3mykPbFio+vo7403drjlgvoWfYpJhMXEbzv8=
+cloud.google.com/go/iam v1.2.2 h1:ozUSofHUGf/F4tCNy/mu9tHLTaxZFLOUiKzjcgWHGIA=
+cloud.google.com/go/iam v1.2.2/go.mod h1:0Ys8ccaZHdI1dEUilwzqng/6ps2YB6vRsjIe00/+6JY=
 cloud.google.com/go/iap v1.4.0/go.mod h1:RGFwRJdihTINIe4wZ2iCP0zF/qu18ZwyKxrhMhygBEc=
 cloud.google.com/go/iap v1.5.0/go.mod h1:UH/CGgKd4KyohZL5Pt0jSKE4m3FR51qg6FKQ/z/Ix9A=
 cloud.google.com/go/iap v1.6.0/go.mod h1:NSuvI9C/j7UdjGjIde7t7HBz+QTwBcapPE07+sSRcLk=
@@ -1142,6 +1147,8 @@ cloud.google.com/go/workflows v1.12.3/go.mod h1:fmOUeeqEwPzIU81foMjTRQIdwQHADi/v
 dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
 dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
+filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
+filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 gioui.org v0.0.0-20210308172011-57750fc8a0a6/go.mod h1:RSH6KIUZ0p2xy5zHDxgAM4zumjgTw83q2ge/PI+yyw8=
 git.sr.ht/~sbinet/gg v0.3.1/go.mod h1:KGYtlADtqsqANL9ueOFkWymvzUvLMQllU5Ixo+8v3pc=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20210715213245-6c3934b029d8/go.mod h1:CzsSbkDixRphAF5hS6wbMKq0eI6ccJRb7/A0M6JBnwg=
@@ -1173,8 +1180,9 @@ github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0/go.mod h1:5kakwfW5CjC9KK+Q4wjXAg+ShuIm2mBMua0ZFj2C8PE=
 github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78/go.mod h1:LmzpDX56iTiv29bbRTIsUNlaFfuhWRQBWjQdVyAevI8=
 github.com/Azure/go-ansiterm v0.0.0-20210608223527-2377c96fe795/go.mod h1:LmzpDX56iTiv29bbRTIsUNlaFfuhWRQBWjQdVyAevI8=
-github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 h1:UQHMgLO+TxOElx5B5HZ4hJQsoJ/PvUvKRhJHDQXO8P8=
 github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
+github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25UVaW/CKtUDjefjrs0SPonmDGUVOYP0=
+github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/Azure/go-autorest v10.8.1+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
 github.com/Azure/go-autorest v14.2.0+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
 github.com/Azure/go-autorest/autorest v0.11.1/go.mod h1:JFgpikqFJ/MleTTxwepExTKnFUKKszPS8UavbQYUMuw=
@@ -1203,8 +1211,9 @@ github.com/BurntSushi/toml v1.2.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbi
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/DataDog/datadog-go v3.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ=
 github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c/go.mod h1:X0CRv0ky0k6m906ixxpzmDRLvX58TFUKS2eePweuyxk=
-github.com/Masterminds/semver/v3 v3.1.1 h1:hLg3sBzpNErnxhQtUy/mmLR2I9foDujNK030IGemrRc=
 github.com/Masterminds/semver/v3 v3.1.1/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
+github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0rYXWg0=
+github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
 github.com/Microsoft/go-winio v0.4.11/go.mod h1:VhR8bwka0BXejwEJY73c50VrPtXAaKcyvVC4A4RozmA=
 github.com/Microsoft/go-winio v0.4.14/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jBhyzoq1bpyYA=
 github.com/Microsoft/go-winio v0.4.15-0.20190919025122-fc70bd9a86b5/go.mod h1:tTuCMEN+UleMWgg9dVx4Hu52b1bJo+59jBh3ajtinzw=
@@ -1216,8 +1225,9 @@ github.com/Microsoft/go-winio v0.4.17/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOp
 github.com/Microsoft/go-winio v0.5.1/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
 github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
 github.com/Microsoft/go-winio v0.6.0/go.mod h1:cTAf44im0RAYeL23bpB+fzCyDH2MJiz2BO69KH/soAE=
-github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
 github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
+github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
+github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/Microsoft/hcsshim v0.8.6/go.mod h1:Op3hHsoHPAvb6lceZHDtd9OkTew38wNoXnJs8iY7rUg=
 github.com/Microsoft/hcsshim v0.8.7-0.20190325164909-8abdbb8205e4/go.mod h1:Op3hHsoHPAvb6lceZHDtd9OkTew38wNoXnJs8iY7rUg=
 github.com/Microsoft/hcsshim v0.8.7/go.mod h1:OHd7sQqRFrYd3RmSgbgji+ctCwkbq2wbEYNSzOYtcBQ=
@@ -1233,8 +1243,6 @@ github.com/Microsoft/hcsshim v0.9.3/go.mod h1:7pLA8lDk46WKDWlVsENo92gC0XFa8rbKfy
 github.com/Microsoft/hcsshim v0.9.4/go.mod h1:7pLA8lDk46WKDWlVsENo92gC0XFa8rbKfyFRBqxEbCc=
 github.com/Microsoft/hcsshim v0.9.6/go.mod h1:7pLA8lDk46WKDWlVsENo92gC0XFa8rbKfyFRBqxEbCc=
 github.com/Microsoft/hcsshim v0.10.0-rc.7/go.mod h1:ILuwjA+kNW+MrN/w5un7n3mTqkwsFu4Bp05/okFUZlE=
-github.com/Microsoft/hcsshim v0.11.4 h1:68vKo2VN8DE9AdN4tnkWnmdhqdbpUFM8OF3Airm7fz8=
-github.com/Microsoft/hcsshim v0.11.4/go.mod h1:smjE4dvqPX9Zldna+t5FG3rnoHhaB7QYxPRqGcpAD9w=
 github.com/Microsoft/hcsshim/test v0.0.0-20201218223536-d3e5debf77da/go.mod h1:5hlzMzRKMLyo42nCZ9oml8AdTlq/0cvIaBv6tK1RehU=
 github.com/Microsoft/hcsshim/test v0.0.0-20210227013316-43a75bb4edd3/go.mod h1:mw7qgWloBUl75W/gVH3cQszUg1+gUITj7D6NY7ywVnY=
 github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ=
@@ -1243,8 +1251,8 @@ github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 h1:TngWCqHvy9oXAN6lEV
 github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5/go.mod h1:lmUJ/7eu/Q8D7ML55dXQrVaamCz2vxCfdQBasLZfHKk=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/OneOfOne/xxhash v1.2.8/go.mod h1:eZbhyaAYD41SGSSsnmcpxVoRiQ/MPUTjUdIIOT9Um7Q=
-github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371 h1:kkhsdkhsCvIsutKu5zLMgWtgh9YxGCNAw8Ad8hjwfYg=
-github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
+github.com/ProtonMail/go-crypto v1.1.3 h1:nRBOetoydLeUb4nHajyO2bKqMLfWQ/ZPwkXqXxPxCFk=
+github.com/ProtonMail/go-crypto v1.1.3/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
 github.com/PuerkitoBio/purell v1.0.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/urlesc v0.0.0-20160726150825-5bd2802263f2/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
@@ -1262,8 +1270,8 @@ github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuy
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
-github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74 h1:Kk6a4nehpJ3UuJRqlA3JxYxBZEqCeOmATOvrbT4p9RA=
-github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
+github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa h1:LHTHcTQiSGT7VVbI0o4wBRNQIgn917usHWOd6VAffYI=
+github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
 github.com/alexflint/go-filemutex v0.0.0-20171022225611-72bdc8eae2ae/go.mod h1:CgnQgUtFrFz9mxFNtED3jI5tLDjKlOM+oUF/sTk6ps0=
 github.com/alexflint/go-filemutex v1.1.0/go.mod h1:7P4iRhttt/nUvUOrYIhcpMzv2G6CY9UnI16Z+UJqRyk=
 github.com/alexflint/go-filemutex v1.2.0/go.mod h1:mYyQSWvw9Tx2/H2n9qXPb52tTYfE0pZAWcBq5mK025c=
@@ -1294,8 +1302,8 @@ github.com/aws/aws-sdk-go v1.15.11/go.mod h1:mFuSZ37Z9YOHbQEwBWztmVzqXrEkub65tZo
 github.com/aws/aws-sdk-go v1.34.0/go.mod h1:5zCpMtNQVjRREroY7sYe8lOMRSxkhG6MZveU8YkpAk0=
 github.com/aws/aws-sdk-go v1.43.9/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
 github.com/aws/aws-sdk-go v1.43.16/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
-github.com/aws/aws-sdk-go v1.50.13 h1:yeXram2g7q8uKkQkAEeZyk9FmPzxI4UpGwAZGZtEGmM=
-github.com/aws/aws-sdk-go v1.50.13/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
+github.com/aws/aws-sdk-go v1.55.6 h1:cSg4pvZ3m8dgYcgqB97MrcdjUmZ1BeMYKUxMMB89IPk=
+github.com/aws/aws-sdk-go v1.55.6/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
 github.com/benbjohnson/clock v1.0.3/go.mod h1:bGMdMPoPVvcYyt1gHDf4J2KE153Yf9BuiUKYMaxlTDM=
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/beorn7/perks v0.0.0-20160804104726-4c0e84591b9a/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
@@ -1314,14 +1322,14 @@ github.com/boombuler/barcode v1.0.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl
 github.com/boombuler/barcode v1.0.1/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/bshuster-repo/logrus-logstash-hook v0.4.1/go.mod h1:zsTqEiSzDgAa/8GZR7E1qaXrhYNDKBYy5/dWPTIflbk=
 github.com/bshuster-repo/logrus-logstash-hook v1.0.0/go.mod h1:zsTqEiSzDgAa/8GZR7E1qaXrhYNDKBYy5/dWPTIflbk=
-github.com/bufbuild/protocompile v0.4.0 h1:LbFKd2XowZvQ/kajzguUp2DC9UEIQhIq77fZZlaQsNA=
 github.com/bufbuild/protocompile v0.4.0/go.mod h1:3v93+mbWn/v3xzN+31nwkJfrEpAUwp+BagBSZWx+TP8=
+github.com/bufbuild/protocompile v0.10.0 h1:+jW/wnLMLxaCEG8AX9lD0bQ5v9h1RUiMKOBOT5ll9dM=
+github.com/bufbuild/protocompile v0.10.0/go.mod h1:G9qQIQo0xZ6Uyj6CMNz0saGmx2so+KONo8/KrELABiY=
 github.com/buger/jsonparser v0.0.0-20180808090653-f4dd9f5a6b44/go.mod h1:bbYlZJ7hK1yFx9hf58LP0zeX7UjIGs20ufpu3evjr+s=
 github.com/buger/jsonparser v1.1.1/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
 github.com/bugsnag/bugsnag-go v0.0.0-20141110184014-b1d153021fcd/go.mod h1:2oa8nejYd4cQ/b0hMIopN0lCRxU0bueqREvZLWFrtK8=
 github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b/go.mod h1:obH5gd0BsqsP2LwDJ9aOkm/6J86V6lyAXCoQWGw3K50=
 github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0/go.mod h1:D/8v3kj0zr8ZAKg1AQ6crr+5VwKN5eIywRkfhyM/+dE=
-github.com/bwesterb/go-ristretto v1.2.3/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
 github.com/bytecodealliance/wasmtime-go v0.36.0/go.mod h1:q320gUxqyI8yB+ZqRuaJOEnGkAnHh6WtJjMaT2CW4wI=
 github.com/cenkalti/backoff v2.2.1+incompatible h1:tNowT99t7UNflLxfYYSlKYsBpXdEet03Pg2g16Swow4=
 github.com/cenkalti/backoff v2.2.1+incompatible/go.mod h1:90ReRw6GdpyfrHakVjL/QHaoyV4aDUVVkXQJJJ3NXXM=
@@ -1332,8 +1340,8 @@ github.com/cenkalti/backoff/v4 v4.1.1/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInq
 github.com/cenkalti/backoff/v4 v4.1.2/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
 github.com/cenkalti/backoff/v4 v4.1.3/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
 github.com/cenkalti/backoff/v4 v4.2.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
-github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
-github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/census-instrumentation/opencensus-proto v0.3.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/census-instrumentation/opencensus-proto v0.4.1/go.mod h1:4T9NM4+4Vw91VeyqjLS6ao50K5bOcLKN6Q42XnYaRYw=
@@ -1359,7 +1367,6 @@ github.com/cilium/ebpf v0.9.1/go.mod h1:+OhNOIXx/Fnu1IE8bJz2dzOA+VSfyTfdNUVdlQnx
 github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible/go.mod h1:nmEj6Dob7S7YxXgwXpfOuvO54S+tGdZdw9fuRZt25Ag=
 github.com/circonus-labs/circonusllhist v0.1.3/go.mod h1:kMXHVDlOchFAehlya5ePtbp5jckzBHf4XRpQvBOLI+I=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cloudflare/circl v1.3.3/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
 github.com/cloudflare/circl v1.3.7 h1:qlCDlTPz2n9fu58M0Nh1J/JzcFpfgkFHHX3O35r5vcU=
 github.com/cloudflare/circl v1.3.7/go.mod h1:sRTcRWXGLrKw6yIGJ+l7amYJFfAXbZG0kBSc8r4zxgA=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
@@ -1377,7 +1384,6 @@ github.com/cncf/xds/go v0.0.0-20230105202645-06c439db220b/go.mod h1:eXthEFrGJvWH
 github.com/cncf/xds/go v0.0.0-20230310173818-32f1caf87195/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20230428030218-4003588d1b74/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20230607035331-e9ce68804cb4/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20231109132714-523115ebc101 h1:7To3pQ+pZo0i3dsWEbinPNFs5gPSBOsJtx3wTT94VBY=
 github.com/cncf/xds/go v0.0.0-20231109132714-523115ebc101/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cockroachdb/apd v1.1.0 h1:3LFP3629v+1aKXU5Q37mxmRxX/pIu1nijXydLShEq5I=
 github.com/cockroachdb/apd v1.1.0/go.mod h1:8Sl8LxpKi29FqWXR16WEFZRNSz3SoPzUzeMeY4+DwBQ=
@@ -1431,8 +1437,6 @@ github.com/containerd/containerd v1.6.6/go.mod h1:ZoP1geJldzCVY3Tonoz7b1IXk8rIX0
 github.com/containerd/containerd v1.6.8/go.mod h1:By6p5KqPK0/7/CgO/A6t/Gz+CUYUu2zf1hUaaymVXB0=
 github.com/containerd/containerd v1.6.9/go.mod h1:XVicUvkxOrftE2Q1YWUXgZwkkAxwQYNOFzYWvfVfEfQ=
 github.com/containerd/containerd v1.7.0/go.mod h1:QfR7Efgb/6X2BDpTPJRvPTYDE9rsF0FsXX9J8sIs/sc=
-github.com/containerd/containerd v1.7.12 h1:+KQsnv4VnzyxWcfO9mlxxELaoztsDEjOuCMPAuPqgU0=
-github.com/containerd/containerd v1.7.12/go.mod h1:/5OMpE1p0ylxtEUGY8kuCYkDRzJm9NO1TFMWjUpdevk=
 github.com/containerd/continuity v0.0.0-20190426062206-aaeac12a7ffc/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
 github.com/containerd/continuity v0.0.0-20190815185530-f2a389ac0a02/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
 github.com/containerd/continuity v0.0.0-20191127005431-f65d91d395eb/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
@@ -1441,9 +1445,8 @@ github.com/containerd/continuity v0.0.0-20201208142359-180525291bb7/go.mod h1:kR
 github.com/containerd/continuity v0.0.0-20210208174643-50096c924a4e/go.mod h1:EXlVlkqNba9rJe3j7w3Xa924itAMLgZH4UD/Q4PExuQ=
 github.com/containerd/continuity v0.1.0/go.mod h1:ICJu0PwR54nI0yPEnJ6jcS+J7CZAUXrLh8lPo2knzsM=
 github.com/containerd/continuity v0.2.2/go.mod h1:pWygW9u7LtS1o4N/Tn0FoCFDIXZ7rxcMX7HX1Dmibvk=
+github.com/containerd/continuity v0.3.0 h1:nisirsYROK15TAMVukJOUyGJjz4BNQJBVsNvAXZJ/eg=
 github.com/containerd/continuity v0.3.0/go.mod h1:wJEAIwKOm/pBZuBd0JmeTvnLquTB1Ag8espWhkykbPM=
-github.com/containerd/continuity v0.4.2 h1:v3y/4Yz5jwnvqPKJJ+7Wf93fyWoCB3F5EclWG023MDM=
-github.com/containerd/continuity v0.4.2/go.mod h1:F6PTNCKepoxEaXLQp3wDAjygEnImnZ/7o4JzpodfroQ=
 github.com/containerd/fifo v0.0.0-20180307165137-3d5202aec260/go.mod h1:ODA38xgv3Kuk8dQz2ZQXpnv/UZZUHUCL7pnLehbXgQI=
 github.com/containerd/fifo v0.0.0-20190226154929-a9fb20d87448/go.mod h1:ODA38xgv3Kuk8dQz2ZQXpnv/UZZUHUCL7pnLehbXgQI=
 github.com/containerd/fifo v0.0.0-20200410184934-f15a3290365b/go.mod h1:jPQ2IAeZRCYxpS/Cm1495vGFww6ecHmMk1YJH2Q5ln0=
@@ -1547,8 +1550,8 @@ github.com/creack/pty v1.1.11/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ
 github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
 github.com/cyphar/filepath-securejoin v0.2.2/go.mod h1:FpkQEhXnPnOthhzymB7CGsFk2G9VLXONKD9G7QGMM+4=
 github.com/cyphar/filepath-securejoin v0.2.3/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
-github.com/cyphar/filepath-securejoin v0.2.4 h1:Ugdm7cg7i6ZK6x3xDF1oEu1nfkyfH53EtKeQYTC3kyg=
-github.com/cyphar/filepath-securejoin v0.2.4/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
+github.com/cyphar/filepath-securejoin v0.2.5 h1:6iR5tXJ/e6tJZzzdMc1km3Sa7RRIVBKAK32O2s7AYfo=
+github.com/cyphar/filepath-securejoin v0.2.5/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
 github.com/d2g/dhcp4 v0.0.0-20170904100407-a1d1b6c41b1c/go.mod h1:Ct2BUK8SB0YC1SMSibvLzxjeJLnrYEVLULFNiHY9YfQ=
 github.com/d2g/dhcp4client v1.0.0/go.mod h1:j0hNfjhrt2SxUOw55nL0ATM/z4Yt3t2Kd1mW34z5W5s=
 github.com/d2g/dhcp4server v0.0.0-20181031114812-7d4a0a7f59a5/go.mod h1:Eo87+Kg/IX2hfWJfwxMzLyuSZyxSoAug2nGa1G2QAi8=
@@ -1592,13 +1595,14 @@ github.com/docker/docker v20.10.17+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05
 github.com/docker/docker v20.10.20+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker v24.0.5+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker v24.0.9+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker v25.0.6+incompatible h1:5cPwbwriIcsua2REJe8HqQV+6WlWc1byg2QSXzBxBGg=
-github.com/docker/docker v25.0.6+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v27.2.1+incompatible h1:fQdiLfW7VLscyoeYEBz7/J8soYFDZV1u6VW6gJEjNMI=
+github.com/docker/docker v27.2.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.6.3/go.mod h1:WRaJzqw3CTB9bk10avuGsjVBZsD05qeibJ1/TYlvc0Y=
 github.com/docker/docker-credential-helpers v0.6.4/go.mod h1:ofX3UI0Gz1TteYBjtgs07O36Pyasyp66D2uKT7H8W1c=
 github.com/docker/docker-credential-helpers v0.7.0/go.mod h1:rETQfLdHNT3foU5kuNkFR1R1V12OJRRO5lzt2D1b5X0=
-github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
 github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
+github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
+github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
 github.com/docker/go-events v0.0.0-20170721190031-9461782956ad/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
 github.com/docker/go-metrics v0.0.0-20180209012529-399ea8c73916/go.mod h1:/u0gXw0Gay3ceNrsHubL3BtdOL2fHf93USgMTe0W5dI=
@@ -1639,7 +1643,6 @@ github.com/envoyproxy/protoc-gen-validate v0.9.1/go.mod h1:OKNgG7TCp5pF4d6XftA0+
 github.com/envoyproxy/protoc-gen-validate v0.10.0/go.mod h1:DRjgyB0I43LtJapqN6NiRwroiAU2PaFuvk/vjgh61ss=
 github.com/envoyproxy/protoc-gen-validate v0.10.1/go.mod h1:DRjgyB0I43LtJapqN6NiRwroiAU2PaFuvk/vjgh61ss=
 github.com/envoyproxy/protoc-gen-validate v1.0.1/go.mod h1:0vj8bNkYbSTNS2PIyH87KZaeN4x9zpL9Qt8fQC7d+vs=
-github.com/envoyproxy/protoc-gen-validate v1.0.2 h1:QkIBuU5k+x7/QXPvPPnWXWlCdaBFApVqftFV6k087DA=
 github.com/envoyproxy/protoc-gen-validate v1.0.2/go.mod h1:GpiZQP3dDbg4JouG/NNS7QWXpgx6x8QiMKdmN72jogE=
 github.com/evanphx/json-patch v4.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/evanphx/json-patch v4.11.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
@@ -1651,8 +1654,8 @@ github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5Kwzbycv
 github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
 github.com/fatih/color v1.14.1/go.mod h1:2oHN61fhTpgcxD3TSWCgKDiH1+x4OiDVVGH8WlgGZGg=
-github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
-github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
+github.com/fatih/color v1.17.0 h1:GlRw1BRJxkpqUCBKzKOw098ed57fEsKeNjpTe3cSjK4=
+github.com/fatih/color v1.17.0/go.mod h1:YZ7TlrGPkiz6ku9fK3TLD/pl3CpsiFyu8N92HLgmosI=
 github.com/fatih/structs v1.1.0 h1:Q7juDM0QtcnhCpeyLGQKyg4TOIghuNXrkL32pHAUMxo=
 github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga6PJ7M=
 github.com/felixge/httpsnoop v1.0.1/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
@@ -1669,9 +1672,8 @@ github.com/foxcpp/go-mockdns v0.0.0-20210729171921-fb145fc6f897/go.mod h1:lgRN6+
 github.com/frankban/quicktest v1.10.0/go.mod h1:ui7WezCLWMWxVWr1GETZY3smRy0G4KWq9vcPtJmFl7Y=
 github.com/frankban/quicktest v1.11.3/go.mod h1:wRf/ReqHper53s+kmmSZizM8NamnL3IM0I9ntUbOk+k=
 github.com/frankban/quicktest v1.13.0/go.mod h1:qLE0fzW0VuyUAJgPU19zByoIr0HtCHN/r/VLSOOIySU=
+github.com/frankban/quicktest v1.14.0 h1:+cqqvzZV87b4adx/5ayVOaYZ2CrvM4ejQvUdBzPPUss=
 github.com/frankban/quicktest v1.14.0/go.mod h1:NeW+ay9A/U67EYXNFA1nPE8e/tnQv/09mUdL/ijj8og=
-github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
-github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
 github.com/fsnotify/fsnotify v1.5.1/go.mod h1:T3375wBYaZdLLcVNkcVbzGHY7f1l/uK5T5Ai1i3InKU=
@@ -1696,10 +1698,10 @@ github.com/go-fonts/liberation v0.2.0/go.mod h1:K6qoJYypsmfVjWg8KOVDQhLc8UDgIK2H
 github.com/go-fonts/stix v0.1.0/go.mod h1:w/c1f0ldAUlJmLBvlbkvVXLAD+tAMqobIIQpmnUIzUY=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
-github.com/go-git/go-billy/v5 v5.5.0 h1:yEY4yhzCDuMGSv83oGxiBotRzhwhNr8VZyphhiu+mTU=
-github.com/go-git/go-billy/v5 v5.5.0/go.mod h1:hmexnoNsr2SJU1Ju67OaNz5ASJY3+sHgFRpCtpDCKow=
-github.com/go-git/go-git/v5 v5.10.1 h1:tu8/D8i+TWxgKpzQ3Vc43e+kkhXqtsZCKI/egajKnxk=
-github.com/go-git/go-git/v5 v5.10.1/go.mod h1:uEuHjxkHap8kAl//V5F/nNWwqIYtP/402ddd05mp0wg=
+github.com/go-git/go-billy/v5 v5.6.0 h1:w2hPNtoehvJIxR00Vb4xX94qHQi/ApZfX+nBE2Cjio8=
+github.com/go-git/go-billy/v5 v5.6.0/go.mod h1:sFDq7xD3fn3E0GOwUSZqHo9lrkmx8xJhA0ZrfvjBRGM=
+github.com/go-git/go-git/v5 v5.13.0 h1:vLn5wlGIh/X78El6r3Jr+30W16Blk0CTcxTYcYPWi5E=
+github.com/go-git/go-git/v5 v5.13.0/go.mod h1:Wjo7/JyVKtQgUNdXYXIepzWfJQkUEIGvkvVkiXRR/zw=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -1708,8 +1710,8 @@ github.com/go-ini/ini v1.66.6/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3I
 github.com/go-jose/go-jose/v3 v3.0.1/go.mod h1:RNkWWRld676jZEYoV3+XK8L2ZnNSvIsxFMht0mSX+u8=
 github.com/go-jose/go-jose/v3 v3.0.3 h1:fFKWeig/irsp7XD2zBxvnmA/XaRWp5V3CBsZXJF7G7k=
 github.com/go-jose/go-jose/v3 v3.0.3/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
-github.com/go-jose/go-jose/v4 v4.0.1 h1:QVEPDE3OluqXBQZDcnNvQrInro2h0e4eqNbnZSWqS6U=
-github.com/go-jose/go-jose/v4 v4.0.1/go.mod h1:WVf9LFMHh/QVrmqrOfqun0C45tMe3RoiKJMPvgWwLfY=
+github.com/go-jose/go-jose/v4 v4.0.4 h1:VsjPI33J0SB9vQM6PLmNjoHqMQNGPiZ0rHL7Ni7Q6/E=
+github.com/go-jose/go-jose/v4 v4.0.4/go.mod h1:NKb5HO1EZccyMpiZNbdUw/14tiXNyUJh188dfnMCAfc=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
@@ -1719,8 +1721,8 @@ github.com/go-latex/latex v0.0.0-20210823091927-c0d11ff05a81/go.mod h1:SX0U8uGpx
 github.com/go-ldap/ldap/v3 v3.1.10/go.mod h1:5Zun81jBTabRaI8lzN7E1JjyEl1g6zI6u9pd8luAK4Q=
 github.com/go-ldap/ldap/v3 v3.4.1/go.mod h1:iYS1MdmrmceOJ1QOTnRXrIs7i3kloqtmGQjRvjKpyMg=
 github.com/go-ldap/ldap/v3 v3.4.4/go.mod h1:fe1MsuN5eJJ1FeLT/LEBVdWfNWKh459R7aXgXtJC+aI=
-github.com/go-ldap/ldap/v3 v3.4.6 h1:ert95MdbiG7aWo/oPYp9btL3KJlMPKnP58r09rI8T+A=
-github.com/go-ldap/ldap/v3 v3.4.6/go.mod h1:IGMQANNtxpsOzj7uUAMjpGBaOVTC4DYyIy8VsTdxmtc=
+github.com/go-ldap/ldap/v3 v3.4.8 h1:loKJyspcRezt2Q3ZRMq2p/0v8iOurlmeXDPw6fikSvQ=
+github.com/go-ldap/ldap/v3 v3.4.8/go.mod h1:qS3Sjlu76eHfHGpUdWkAXQTw4beih+cHsco2jXlIXrk=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
@@ -1732,8 +1734,8 @@ github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbV
 github.com/go-logr/logr v1.2.1/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.2.3/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
-github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
+github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.0/go.mod h1:YkVgnZu1ZjjL7xTxrfm/LLZBfkhTqSR1ydtm6jTKKwI=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
@@ -1757,13 +1759,15 @@ github.com/go-pdf/fpdf v0.5.0/go.mod h1:HzcnA+A23uwogo0tp9yU+l3V+KXhiESpt1PMayhO
 github.com/go-pdf/fpdf v0.6.0/go.mod h1:HzcnA+A23uwogo0tp9yU+l3V+KXhiESpt1PMayhOh5M=
 github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
 github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
-github.com/go-sql-driver/mysql v1.7.1 h1:lUIinVbN1DY0xBg0eMOzmmtGoHwWBbvnWubQUrtU8EI=
 github.com/go-sql-driver/mysql v1.7.1/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI=
+github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpvNJ1Y=
+github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
 github.com/go-test/deep v1.0.2/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
-github.com/go-test/deep v1.1.0 h1:WOcxcdHcvdgThNXjw0t76K42FXTU7HpNQWHpA2HHNlg=
 github.com/go-test/deep v1.1.0/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
+github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
+github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
 github.com/goccy/go-json v0.9.7/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
 github.com/goccy/go-json v0.9.11/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
@@ -1774,8 +1778,9 @@ github.com/godbus/dbus/v5 v5.0.3/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5x
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/godbus/dbus/v5 v5.0.6/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/gofrs/uuid v4.0.0+incompatible h1:1SD/1F5pU8p29ybwgQSwpQk+mwdRrXCYuPhW6m+TnJw=
 github.com/gofrs/uuid v4.0.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
+github.com/gofrs/uuid v4.3.0+incompatible h1:CaSVZxm5B+7o45rtab4jC2G37WGYX1zQfuU2i6DSvnc=
+github.com/gofrs/uuid v4.3.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
 github.com/gogo/googleapis v1.2.0/go.mod h1:Njal3psf3qN6dwBtQfUmBZh2ybovJ0tlu3o/AC7HYjU=
 github.com/gogo/googleapis v1.4.0/go.mod h1:5YRNX2z1oM5gXdAkurHa942MDgEJyk02w4OecKY87+c=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
@@ -1844,9 +1849,12 @@ github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEW
 github.com/gomodule/redigo v1.8.2/go.mod h1:P9dn9mFrCBvWhGE1wpxx6fgq7BAeLBk+UUUzlpkBYO0=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/btree v1.0.1 h1:gK4Kx5IaGY9CD5sPJ36FHiBJ6ZXl0kilRiiCj+jdYp4=
 github.com/google/btree v1.0.1/go.mod h1:xXMiIv4Fb/0kKde4SpL7qlzvu5cMJDRkFDxJfI9uaxA=
+github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
+github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
 github.com/google/cel-go v0.12.6/go.mod h1:Jk7ljRzLBhkmiAwBoUxB1sZSCVBAzkqPF25olK/iRDw=
+github.com/google/certificate-transparency-go v1.3.1 h1:akbcTfQg0iZlANZLn0L9xOeWtyCIdeoYhKrqi5iH3Go=
+github.com/google/certificate-transparency-go v1.3.1/go.mod h1:gg+UQlx6caKEDQ9EElFOujyxEQEfOiQzAt6782Bvi8k=
 github.com/google/flatbuffers v1.12.1/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
 github.com/google/flatbuffers v2.0.8+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
 github.com/google/gnostic v0.5.7-v3refs/go.mod h1:73MKFl6jIHelAJNaBGFzt3SPtZULs9dYrGFt8OiIsHQ=
@@ -1865,8 +1873,9 @@ github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
 github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/go-containerregistry v0.5.1/go.mod h1:Ct15B4yir3PLOP5jsy0GNeYVaIZs/MK/Jz5any1wFW0=
 github.com/google/go-containerregistry v0.13.0/go.mod h1:J9FQ+eSS4a1aC2GNZxvNpbWhgp0487v+cgiilB4FqDo=
 github.com/google/go-pkcs11 v0.2.0/go.mod h1:6eQoGcuNJpa7jnd5pMGdkSaQpNDYvPlXWMcjXXThLlY=
@@ -1899,8 +1908,9 @@ github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm4
 github.com/google/s2a-go v0.1.0/go.mod h1:OJpEgntRZo8ugHpF9hkoLJbS5dSI20XZeXJ9JVywLlM=
 github.com/google/s2a-go v0.1.3/go.mod h1:Ej+mSEMGRnqRzjc7VtF+jdBwYG5fuJfiZ8ELkjEwM0A=
 github.com/google/s2a-go v0.1.4/go.mod h1:Ej+mSEMGRnqRzjc7VtF+jdBwYG5fuJfiZ8ELkjEwM0A=
-github.com/google/s2a-go v0.1.7 h1:60BLSyTrOV4/haCDW4zb1guZItoSq8foHCXrAnjBo/o=
 github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw=
+github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
+github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/google/tink/go v1.7.0/go.mod h1:GAUOd+QE3pgj9q8VKIGTCP33c/B7eb4NhxLcgTJZStM=
@@ -1920,8 +1930,9 @@ github.com/googleapis/enterprise-certificate-proxy v0.2.1/go.mod h1:AwSRAtLfXpU5
 github.com/googleapis/enterprise-certificate-proxy v0.2.3/go.mod h1:AwSRAtLfXpU5Nm3pW+v7rGDHp09LsPtGY9MduiEsR9k=
 github.com/googleapis/enterprise-certificate-proxy v0.2.4/go.mod h1:AwSRAtLfXpU5Nm3pW+v7rGDHp09LsPtGY9MduiEsR9k=
 github.com/googleapis/enterprise-certificate-proxy v0.2.5/go.mod h1:RxW0N9901Cko1VOCW3SXCpWP+mlIEkk2tP7jnHy9a3w=
-github.com/googleapis/enterprise-certificate-proxy v0.3.2 h1:Vie5ybvEvT75RniqhfFxPRy3Bf7vr3h0cechB90XaQs=
 github.com/googleapis/enterprise-certificate-proxy v0.3.2/go.mod h1:VLSiSSBs/ksPL8kq3OBOQ6WRI2QnaFynd1DCjZ62+V0=
+github.com/googleapis/enterprise-certificate-proxy v0.3.4 h1:XYIDZApgAnrN1c855gTgghdIA6Stxb52D5RnLI1SLyw=
+github.com/googleapis/enterprise-certificate-proxy v0.3.4/go.mod h1:YKe7cfqYXjKGpGvmSg28/fFvhNzinZQm8DGnaburhGA=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
 github.com/googleapis/gax-go/v2 v2.1.0/go.mod h1:Q3nei7sK6ybPYH7twZdmQpAd1MKb7pfu6SK+H1/DsU0=
@@ -1936,8 +1947,9 @@ github.com/googleapis/gax-go/v2 v2.7.1/go.mod h1:4orTrqY6hXxxaUL4LHIPl6lGo8vAE38
 github.com/googleapis/gax-go/v2 v2.8.0/go.mod h1:4orTrqY6hXxxaUL4LHIPl6lGo8vAE38/qKbhSAKP6QI=
 github.com/googleapis/gax-go/v2 v2.10.0/go.mod h1:4UOEnMCrxsSqQ940WnTiD6qJ63le2ev3xfyagutxiPw=
 github.com/googleapis/gax-go/v2 v2.11.0/go.mod h1:DxmR61SGKkGLa2xigwuZIQpkCI2S5iydzRfb3peWZJI=
-github.com/googleapis/gax-go/v2 v2.12.0 h1:A+gCJKdRfqXkr+BIRGtZLibNXf0m1f9E4HG56etFpas=
 github.com/googleapis/gax-go/v2 v2.12.0/go.mod h1:y+aIqrI5eb1YGMVJfuV3185Ts/D7qKpsEkdD5+I6QGU=
+github.com/googleapis/gax-go/v2 v2.14.1 h1:hb0FFeiPaQskmvakKu5EbCbpntQn48jyHuvrkurSS/Q=
+github.com/googleapis/gax-go/v2 v2.14.1/go.mod h1:Hb/NubMaVM88SrNkvl8X/o8XWwDJEPqouaLeN2IUxoA=
 github.com/googleapis/gnostic v0.4.1/go.mod h1:LRhVm6pbyptWbWbuZ38d1eyptfvIytN3ir6b65WBswg=
 github.com/googleapis/gnostic v0.5.1/go.mod h1:6U4PtQXGIEt/Z3h5MAT7FNofLnw9vXk2cUuW7uA/OeU=
 github.com/googleapis/gnostic v0.5.5/go.mod h1:7+EbHbldMins07ALC74bsA81Ovc97DwqyJO1AENw9kA=
@@ -1971,12 +1983,12 @@ github.com/grpc-ecosystem/grpc-gateway v1.16.0 h1:gmcG1KaJ57LophUzW0Hy8NmPhnMZb4
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0/go.mod h1:hgWBS7lorOAVIJEQMi4ZsPv9hVvWI6+ch50m39Pf2Ks=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3/go.mod h1:o//XUCC/F+yRGJoPO/VU0GSB0f8Nhgmxx0VIRUvaC0w=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 h1:YBftPWNWd4WwGqtY2yeZL2ef8rHAxPBD8KFhJpmcqms=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0/go.mod h1:YN5jB8ie0yfIUg6VvR9Kz84aCaG7AsGZnLjhHbUqwPg=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.1 h1:/c3QmbOGMGTOumP2iT/rCwB7b0QDGLKzqOmktBjT+Is=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.1/go.mod h1:5SN9VR2LTsRFsrEC6FHgRbTWrTHu6tqPeKxEQv15giM=
 github.com/hashicorp/cap v0.6.0 h1:uOSdbtXu8zsbRyjwpiTy6QiuX3+5paAbNkYlop7QexM=
 github.com/hashicorp/cap v0.6.0/go.mod h1:DwzHkoG6pxSARiqwvAgxmCPUpTTCCw2wVuPrIFOzpe0=
-github.com/hashicorp/cap/ldap v0.0.0-20240328153749-fcfe271d0227 h1:R5CMNyBNZqODw2DcGaSa2X96AgtLotXsH7aOa07zTTI=
-github.com/hashicorp/cap/ldap v0.0.0-20240328153749-fcfe271d0227/go.mod h1:Ofp5fMLl1ImcwjNGu9FtEwNOdxA0LYoWpcWQE2vltuI=
+github.com/hashicorp/cap/ldap v0.0.0-20250106213447-9047b8b3240f h1:iixO0KNqHfSMImUgaHnMHTzmu0FVLwk7VzIZf6++wak=
+github.com/hashicorp/cap/ldap v0.0.0-20250106213447-9047b8b3240f/go.mod h1:vGqAhHKOR5gadKWjwhoWp3RKto/tmhVOtH8gcD0c8ss=
 github.com/hashicorp/consul/api v1.1.0/go.mod h1:VmuI/Lkw1nC05EYQWNKwWGbkg+FbDBtguAZLlVdkD9Q=
 github.com/hashicorp/consul/api v1.27.0 h1:gmJ6DPKQog1426xsdmgk5iqDyoRiNc+ipBdJOqKQFjc=
 github.com/hashicorp/consul/api v1.27.0/go.mod h1:JkekNRSou9lANFdt+4IKx3Za7XY0JzzpQjEb4Ivo1c8=
@@ -1993,8 +2005,8 @@ github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtng
 github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
-github.com/hashicorp/go-cty v1.4.1-0.20200723130312-85980079f637 h1:Ud/6/AdmJ1R7ibdS0Wo5MWPj0T1R0fkpaD087bBaW8I=
-github.com/hashicorp/go-cty v1.4.1-0.20200723130312-85980079f637/go.mod h1:EiZBMaudVLy8fmjf9Npq1dq9RalhveqZG5w/yz3mHWs=
+github.com/hashicorp/go-cty v1.5.0 h1:EkQ/v+dDNUqnuVpmS5fPqyY71NXVgT5gf32+57xY8g0=
+github.com/hashicorp/go-cty v1.5.0/go.mod h1:lFUCG5kd8exDobgSfyj4ONE/dc822kiYMguVKdHGMLM=
 github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
 github.com/hashicorp/go-hclog v0.14.1/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
 github.com/hashicorp/go-hclog v0.16.2/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
@@ -2002,6 +2014,8 @@ github.com/hashicorp/go-hclog v1.5.0/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVH
 github.com/hashicorp/go-hclog v1.6.2/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
 github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
 github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
+github.com/hashicorp/go-hmac-drbg v0.0.0-20210916214228-a6e5a68489f6 h1:kBoJV4Xl5FLtBfnBjDvBxeNSy2IRITSGs73HQsFUEjY=
+github.com/hashicorp/go-hmac-drbg v0.0.0-20210916214228-a6e5a68489f6/go.mod h1:y+HSOcOGB48PkUxNyLAiCiY6rEENu+E+Ss4LG8QHwf4=
 github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
 github.com/hashicorp/go-immutable-radix v1.3.1 h1:DKHmCUm2hRBK510BaiZlwvpD40f8bJFeZnpfm2KLowc=
 github.com/hashicorp/go-immutable-radix v1.3.1/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
@@ -2010,8 +2024,8 @@ github.com/hashicorp/go-kms-wrapping/entropy/v2 v2.0.0/go.mod h1:xvb32K2keAc+R8D
 github.com/hashicorp/go-kms-wrapping/entropy/v2 v2.0.1 h1:KIge4FHZEDb2/xjaWgmBheCTgRL6HV4sgTfDsH876L8=
 github.com/hashicorp/go-kms-wrapping/entropy/v2 v2.0.1/go.mod h1:aHO1EoFD0kBYLBedqxXgalfFT8lrWfP7kpuSoaqGjH0=
 github.com/hashicorp/go-kms-wrapping/v2 v2.0.8/go.mod h1:qTCjxGig/kjuj3hk1z8pOUrzbse/GxB1tGfbrq8tGJg=
-github.com/hashicorp/go-kms-wrapping/v2 v2.0.16 h1:WZeXfD26QMWYC35at25KgE021SF9L3u9UMHK8fJAdV0=
-github.com/hashicorp/go-kms-wrapping/v2 v2.0.16/go.mod h1:ZiKZctjRTLEppuRwrttWkp71VYMbTTCkazK4xT7U/NQ=
+github.com/hashicorp/go-kms-wrapping/v2 v2.0.18 h1:DLfC677GfKEpSAFpEWvl1vXsGpEcSHmbhBaPLrdDQHc=
+github.com/hashicorp/go-kms-wrapping/v2 v2.0.18/go.mod h1:t/eaR/mi2mw3klfl1WEAuiLKrlZ/Q8cosmsT+RIPLu0=
 github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
 github.com/hashicorp/go-msgpack v0.5.5 h1:i9R9JSrqIz0QVLz3sz+i3YJdT7TTSLcfLLzJi9aZTuI=
 github.com/hashicorp/go-msgpack v0.5.5/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
@@ -2023,8 +2037,8 @@ github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9
 github.com/hashicorp/go-plugin v1.4.3/go.mod h1:5fGEH17QVwTTcR0zV7yhDPLLmFX9YSZ38b18Udy6vYQ=
 github.com/hashicorp/go-plugin v1.5.1/go.mod h1:w1sAEES3g3PuV/RzUrgow20W2uErMly84hhD3um1WL4=
 github.com/hashicorp/go-plugin v1.5.2/go.mod h1:w1sAEES3g3PuV/RzUrgow20W2uErMly84hhD3um1WL4=
-github.com/hashicorp/go-plugin v1.6.0 h1:wgd4KxHJTVGGqWBq4QPB1i5BZNEx9BR8+OFmHDmTk8A=
-github.com/hashicorp/go-plugin v1.6.0/go.mod h1:lBS5MtSSBZk0SHc66KACcjjlU6WzEVP/8pwz68aMkCI=
+github.com/hashicorp/go-plugin v1.6.2 h1:zdGAEd0V1lCaU0u+MxWQhtSDQmahpkwOun8U8EiRVog=
+github.com/hashicorp/go-plugin v1.6.2/go.mod h1:CkgLQ5CZqNmdL9U9JzM532t8ZiYQ35+pj3b1FD37R0Q=
 github.com/hashicorp/go-retryablehttp v0.5.3/go.mod h1:9B5zBasrRhHXnJnui7y6sL7es7NDiJgTc6Er0maI1Xs=
 github.com/hashicorp/go-retryablehttp v0.6.6/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
 github.com/hashicorp/go-retryablehttp v0.7.1/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
@@ -2033,11 +2047,13 @@ github.com/hashicorp/go-retryablehttp v0.7.7/go.mod h1:pkQpWZeYWskR+D1tR2O5OcBFO
 github.com/hashicorp/go-rootcerts v1.0.0/go.mod h1:K6zTfqpRlCUIjkwsN4Z+hiSfzSTQa6eBIzfwKfwNnHU=
 github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
 github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
-github.com/hashicorp/go-secure-stdlib/awsutil v0.3.0 h1:I8bynUKMh9I7JdwtW9voJ0xmHvBpxQtLjrMFDYmhOxY=
-github.com/hashicorp/go-secure-stdlib/awsutil v0.3.0/go.mod h1:oKHSQs4ivIfZ3fbXGQOop1XuDfdSb8RIsWTGaAanSfg=
+github.com/hashicorp/go-secure-stdlib/awsutil v0.2.3 h1:AAQ6Vmo/ncfrZYtbpjhO+g0Qt+iNpYtl3UWT1NLmbYY=
+github.com/hashicorp/go-secure-stdlib/awsutil v0.2.3/go.mod h1:oKHSQs4ivIfZ3fbXGQOop1XuDfdSb8RIsWTGaAanSfg=
 github.com/hashicorp/go-secure-stdlib/base62 v0.1.1/go.mod h1:EdWO6czbmthiwZ3/PUsDV+UD1D5IRU4ActiaWGwt0Yw=
 github.com/hashicorp/go-secure-stdlib/base62 v0.1.2 h1:ET4pqyjiGmY09R5y+rSd70J2w45CtbWDNvGqWp/R3Ng=
 github.com/hashicorp/go-secure-stdlib/base62 v0.1.2/go.mod h1:EdWO6czbmthiwZ3/PUsDV+UD1D5IRU4ActiaWGwt0Yw=
+github.com/hashicorp/go-secure-stdlib/cryptoutil v0.1.1 h1:VaLXp47MqD1Y2K6QVrA9RooQiPyCgAbnfeJg44wKuJk=
+github.com/hashicorp/go-secure-stdlib/cryptoutil v0.1.1/go.mod h1:hH8rgXHh9fPSDPerG6WzABHsHF+9ZpLhRI1LPk4JZ8c=
 github.com/hashicorp/go-secure-stdlib/mlock v0.1.1/go.mod h1:zq93CJChV6L9QTfGKtfBxKqD7BqqXx5O04A/ns2p5+I=
 github.com/hashicorp/go-secure-stdlib/mlock v0.1.2/go.mod h1:zq93CJChV6L9QTfGKtfBxKqD7BqqXx5O04A/ns2p5+I=
 github.com/hashicorp/go-secure-stdlib/mlock v0.1.3 h1:kH3Rhiht36xhAfhuHyWJDgdXXEx9IIZhDGRk24CDhzg=
@@ -2045,12 +2061,14 @@ github.com/hashicorp/go-secure-stdlib/mlock v0.1.3/go.mod h1:ov1Q0oEDjC3+A4BwsG2
 github.com/hashicorp/go-secure-stdlib/parseutil v0.1.1/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=
 github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=
 github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8 h1:iBt4Ew4XEGLfh6/bPk4rSYmuZJGizr6/x/AEizP0CQc=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8/go.mod h1:aiJI+PIApBRQG7FZTEBx5GiiX+HbOHilUdNxUZi4eV0=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.1.9 h1:FW0YttEnUNDJ2WL9XcrrfteS1xW8u+sh4ggM8pN5isQ=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.1.9/go.mod h1:Ll013mhdmsVDuoIXVfBtvgGJsXDYkTw1kooNcoCXuE0=
 github.com/hashicorp/go-secure-stdlib/password v0.1.1/go.mod h1:9hH302QllNwu1o2TGYtSk8I8kTAN0ca1EHpwhm5Mmzo=
+github.com/hashicorp/go-secure-stdlib/permitpool v1.0.0 h1:U6y5MXGiDVOOtkWJ6o/tu1TxABnI0yKTQWJr7z6BpNk=
+github.com/hashicorp/go-secure-stdlib/permitpool v1.0.0/go.mod h1:ecDb3o+8D4xtP0nTCufJaAVawHavy5M2eZ64Nq/8/LM=
 github.com/hashicorp/go-secure-stdlib/plugincontainer v0.2.2/go.mod h1:7xQt0+IfRmzYBLpFx+4MYfLpBdd1PT1VatGKRswf7xE=
-github.com/hashicorp/go-secure-stdlib/plugincontainer v0.3.0 h1:KMWpBsC65ZBXDpoxJ0n2/zVfZaZIW73k2d8cy5Dv/Kk=
-github.com/hashicorp/go-secure-stdlib/plugincontainer v0.3.0/go.mod h1:qKYwSZ2EOpppko5ud+Sh9TrUgiTAZSaQCr8XWIYXsbM=
+github.com/hashicorp/go-secure-stdlib/plugincontainer v0.4.1 h1:JY+zGg8gOmslwif1fiCqT5Hu1SikLZQcHkmQhCoA9gY=
+github.com/hashicorp/go-secure-stdlib/plugincontainer v0.4.1/go.mod h1:jW3KCTvdPyAdVecOUwiiO2XaYgUJ/isigt++ISkszkY=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4=
@@ -2069,21 +2087,22 @@ github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/b
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-version v1.2.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
-github.com/hashicorp/go-version v1.6.0 h1:feTTfFNnjP967rlCxM/I9g701jU+RN74YKx2mOkIeek=
 github.com/hashicorp/go-version v1.6.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/hashicorp/go-version v1.7.0 h1:5tqGy27NaOTB8yJKUZELlFAS/LTKJkrmONwQKeRZfjY=
+github.com/hashicorp/go-version v1.7.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/go.net v0.0.1/go.mod h1:hjKkEWcCURg++eb33jQU7oqQcI9XDCnUzHA0oac0k90=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
 github.com/hashicorp/golang-lru v1.0.2 h1:dV3g9Z/unq5DpblPpw+Oqcv4dU/1omnb4Ok8iPY6p1c=
 github.com/hashicorp/golang-lru v1.0.2/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
-github.com/hashicorp/hc-install v0.6.2 h1:V1k+Vraqz4olgZ9UzKiAcbman9i9scg9GgSt/U3mw/M=
-github.com/hashicorp/hc-install v0.6.2/go.mod h1:2JBpd+NCFKiHiu/yYCGaPyPHhZLxXTpz8oreHa/a3Ps=
+github.com/hashicorp/hc-install v0.9.1 h1:gkqTfE3vVbafGQo6VZXcy2v5yoz2bE0+nhZXruCuODQ=
+github.com/hashicorp/hc-install v0.9.1/go.mod h1:pWWvN/IrfeBK4XPeXXYkL6EjMufHkCK5DvwxeLKuBf0=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/hashicorp/hcl v1.0.1-vault-5 h1:kI3hhbbyzr4dldA8UdTb7ZlVVlI2DACdCfz31RPDgJM=
 github.com/hashicorp/hcl v1.0.1-vault-5/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
-github.com/hashicorp/hcl/v2 v2.19.1 h1://i05Jqznmb2EXqa39Nsvyan2o5XyMowW5fnCKW5RPI=
-github.com/hashicorp/hcl/v2 v2.19.1/go.mod h1:ThLC89FV4p9MPW804KVbe/cEXoQ8NZEh+JtMeeGErHE=
+github.com/hashicorp/hcl/v2 v2.23.0 h1:Fphj1/gCylPxHutVSEOf2fBOh1VE4AuLV7+kbJf3qos=
+github.com/hashicorp/hcl/v2 v2.23.0/go.mod h1:62ZYHrXgPoX8xBnzl8QzbWq4dyDsDtfCRgIq1rbJEvA=
 github.com/hashicorp/logutils v1.0.0 h1:dLEQVugN8vlakKOUE3ihGLTZJRB4j+M2cdTm/ORI65Y=
 github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
 github.com/hashicorp/mdns v1.0.0/go.mod h1:tL+uN++7HEJ6SQLQ2/p+z2pH24WQKWjBPkE0mNTz8vQ=
@@ -2094,18 +2113,26 @@ github.com/hashicorp/memberlist v0.5.0/go.mod h1:yvyXLpo0QaGE59Y7hDTsTzDD25JYBZ4
 github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/JwenrHc=
 github.com/hashicorp/serf v0.10.1 h1:Z1H2J60yRKvfDYAOZLd2MU0ND4AH/WDz7xYHDWQsIPY=
 github.com/hashicorp/serf v0.10.1/go.mod h1:yL2t6BqATOLGc5HF7qbFkTfXoPIY0WZdWHfEvMqbG+4=
-github.com/hashicorp/terraform-exec v0.19.0 h1:FpqZ6n50Tk95mItTSS9BjeOVUb4eg81SpgVtZNNtFSM=
-github.com/hashicorp/terraform-exec v0.19.0/go.mod h1:tbxUpe3JKruE9Cuf65mycSIT8KiNPZ0FkuTE3H4urQg=
-github.com/hashicorp/terraform-json v0.18.0 h1:pCjgJEqqDESv4y0Tzdqfxr/edOIGkjs8keY42xfNBwU=
-github.com/hashicorp/terraform-json v0.18.0/go.mod h1:qdeBs11ovMzo5puhrRibdD6d2Dq6TyE/28JiU4tIQxk=
-github.com/hashicorp/terraform-plugin-go v0.20.0 h1:oqvoUlL+2EUbKNsJbIt3zqqZ7wi6lzn4ufkn/UA51xQ=
-github.com/hashicorp/terraform-plugin-go v0.20.0/go.mod h1:Rr8LBdMlY53a3Z/HpP+ZU3/xCDqtKNCkeI9qOyT10QE=
+github.com/hashicorp/terraform-exec v0.22.0 h1:G5+4Sz6jYZfRYUCg6eQgDsqTzkNXV+fP8l+uRmZHj64=
+github.com/hashicorp/terraform-exec v0.22.0/go.mod h1:bjVbsncaeh8jVdhttWYZuBGj21FcYw6Ia/XfHcNO7lQ=
+github.com/hashicorp/terraform-json v0.24.0 h1:rUiyF+x1kYawXeRth6fKFm/MdfBS6+lW4NbeATsYz8Q=
+github.com/hashicorp/terraform-json v0.24.0/go.mod h1:Nfj5ubo9xbu9uiAoZVBsNOjvNKB66Oyrvtit74kC7ow=
+github.com/hashicorp/terraform-plugin-framework v1.14.1 h1:jaT1yvU/kEKEsxnbrn4ZHlgcxyIfjvZ41BLdlLk52fY=
+github.com/hashicorp/terraform-plugin-framework v1.14.1/go.mod h1:xNUKmvTs6ldbwTuId5euAtg37dTxuyj3LHS3uj7BHQ4=
+github.com/hashicorp/terraform-plugin-framework-validators v0.17.0 h1:0uYQcqqgW3BMyyve07WJgpKorXST3zkpzvrOnf3mpbg=
+github.com/hashicorp/terraform-plugin-framework-validators v0.17.0/go.mod h1:VwdfgE/5Zxm43flraNa0VjcvKQOGVrcO4X8peIri0T0=
+github.com/hashicorp/terraform-plugin-go v0.26.0 h1:cuIzCv4qwigug3OS7iKhpGAbZTiypAfFQmw8aE65O2M=
+github.com/hashicorp/terraform-plugin-go v0.26.0/go.mod h1:+CXjuLDiFgqR+GcrM5a2E2Kal5t5q2jb0E3D57tTdNY=
 github.com/hashicorp/terraform-plugin-log v0.9.0 h1:i7hOA+vdAItN1/7UrfBqBwvYPQ9TFvymaRGZED3FCV0=
 github.com/hashicorp/terraform-plugin-log v0.9.0/go.mod h1:rKL8egZQ/eXSyDqzLUuwUYLVdlYeamldAHSxjUFADow=
-github.com/hashicorp/terraform-plugin-sdk/v2 v2.31.0 h1:Bl3e2ei2j/Z3Hc2HIS15Gal2KMKyLAZ2om1HCEvK6es=
-github.com/hashicorp/terraform-plugin-sdk/v2 v2.31.0/go.mod h1:i2C41tszDjiWfziPQDL5R/f3Zp0gahXe5No/MIO9rCE=
-github.com/hashicorp/terraform-registry-address v0.2.3 h1:2TAiKJ1A3MAkZlH1YI/aTVcLZRu7JseiXNRHbOAyoTI=
-github.com/hashicorp/terraform-registry-address v0.2.3/go.mod h1:lFHA76T8jfQteVfT7caREqguFrW3c4MFSPhZB7HHgUM=
+github.com/hashicorp/terraform-plugin-mux v0.18.0 h1:7491JFSpWyAe0v9YqBT+kel7mzHAbO5EpxxT0cUL/Ms=
+github.com/hashicorp/terraform-plugin-mux v0.18.0/go.mod h1:Ho1g4Rr8qv0qTJlcRKfjjXTIO67LNbDtM6r+zHUNHJQ=
+github.com/hashicorp/terraform-plugin-sdk/v2 v2.36.1 h1:WNMsTLkZf/3ydlgsuXePa3jvZFwAJhruxTxP/c1Viuw=
+github.com/hashicorp/terraform-plugin-sdk/v2 v2.36.1/go.mod h1:P6o64QS97plG44iFzSM6rAn6VJIC/Sy9a9IkEtl79K4=
+github.com/hashicorp/terraform-plugin-testing v1.12.0 h1:tpIe+T5KBkA1EO6aT704SPLedHUo55RenguLHcaSBdI=
+github.com/hashicorp/terraform-plugin-testing v1.12.0/go.mod h1:jbDQUkT9XRjAh1Bvyufq+PEH1Xs4RqIdpOQumSgSXBM=
+github.com/hashicorp/terraform-registry-address v0.2.4 h1:JXu/zHB2Ymg/TGVCRu10XqNa4Sh2bWcqCNyKWjnCPJA=
+github.com/hashicorp/terraform-registry-address v0.2.4/go.mod h1:tUNYTVyCtU4OIGXXMDp7WNcJ+0W1B4nmstVDgHMjfAU=
 github.com/hashicorp/terraform-svchost v0.1.1 h1:EZZimZ1GxdqFRinZ1tpJwVxxt49xc/S52uzrw4x0jKQ=
 github.com/hashicorp/terraform-svchost v0.1.1/go.mod h1:mNsjQfZyf/Jhz35v6/0LWcv26+X7JPS+buii2c9/ctc=
 github.com/hashicorp/vault-plugin-auth-jwt v0.20.3 h1:mLsdorH4m43rBqybHDZKl33rrmc80ens4hSB6E7i9o0=
@@ -2117,12 +2144,12 @@ github.com/hashicorp/vault-plugin-auth-oci v0.15.1/go.mod h1:i3KYRLQFpAIJuvbXHBM
 github.com/hashicorp/vault/api v1.4.1/go.mod h1:LkMdrZnWNrFaQyYYazWVn7KshilfDidgVBq6YiTq/bM=
 github.com/hashicorp/vault/api v1.9.1/go.mod h1:78kktNcQYbBGSrOjQfHjXN32OhhxXnbYl3zxpd2uPUs=
 github.com/hashicorp/vault/api v1.11.0/go.mod h1:si+lJCYO7oGkIoNPAN8j3azBLTn9SjMGS+jFaHd1Cck=
-github.com/hashicorp/vault/api v1.14.0 h1:Ah3CFLixD5jmjusOgm8grfN9M0d+Y8fVR2SW0K6pJLU=
-github.com/hashicorp/vault/api v1.14.0/go.mod h1:pV9YLxBGSz+cItFDd8Ii4G17waWOQ32zVjMWHe/cOqk=
+github.com/hashicorp/vault/api v1.16.0 h1:nbEYGJiAPGzT9U4oWgaaB0g+Rj8E59QuHKyA5LhwQN4=
+github.com/hashicorp/vault/api v1.16.0/go.mod h1:KhuUhzOD8lDSk29AtzNjgAu2kxRA9jL9NAbkFlqvkBA=
 github.com/hashicorp/vault/sdk v0.4.1/go.mod h1:aZ3fNuL5VNydQk8GcLJ2TV8YCRVvyaakYkhZRoVuhj0=
 github.com/hashicorp/vault/sdk v0.10.2/go.mod h1:VxJIQgftEX7FCDM3i6TTLjrZszAeLhqPicNbCVNRg4I=
-github.com/hashicorp/vault/sdk v0.13.0 h1:UmcLF+7r70gy1igU44Suflgio30P2GOL4MkHPhJuiP8=
-github.com/hashicorp/vault/sdk v0.13.0/go.mod h1:LxhNTWRG99mXg9xijBCnCnIus+brLC5uFsQUQ4zgOnU=
+github.com/hashicorp/vault/sdk v0.15.2 h1:Rp5Yp4lyBhlWgq24ZVb2n/YN47RKOAvmx/jlMfS9ku4=
+github.com/hashicorp/vault/sdk v0.15.2/go.mod h1:2Wj2tHIgfz0gNWgEPWBbCXFIiPrq96E8FTjPNV9J1Bc=
 github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
 github.com/hashicorp/yamux v0.1.1 h1:yrQxtgseBDrq9Y652vSRDvsKCJKOUD+GzTS4Y0Y8pvE=
 github.com/hashicorp/yamux v0.1.1/go.mod h1:CtWFDAQgb7dxtzFs4tWbplKIe2jSi3+5vKbgIO0SLnQ=
@@ -2184,13 +2211,15 @@ github.com/jackc/pgtype v0.0.0-20190421001408-4ed0de4755e0/go.mod h1:hdSHsc1V01C
 github.com/jackc/pgtype v0.0.0-20190824184912-ab885b375b90/go.mod h1:KcahbBH1nCMSo2DXpzsoWOAfFkdEtEJpPbVLq8eE+mc=
 github.com/jackc/pgtype v0.0.0-20190828014616-a8802b16cc59/go.mod h1:MWlu30kVJrUS8lot6TQqcg7mtthZ9T0EoIBFiJcmcyw=
 github.com/jackc/pgtype v1.8.1-0.20210724151600-32e20a603178/go.mod h1:C516IlIV9NKqfsMCXTdChteoXmwgUceqaLfjg2e3NlM=
-github.com/jackc/pgtype v1.14.0 h1:y+xUdabmyMkJLyApYuPj38mW+aAIqCe5uuBB51rH3Vw=
 github.com/jackc/pgtype v1.14.0/go.mod h1:LUMuVrfsFfdKGLw+AFFVv6KtHOFMwRgDDzBt76IqCA4=
+github.com/jackc/pgtype v1.14.3 h1:h6W9cPuHsRWQFTWUZMAKMgG5jSwQI0Zurzdvlx3Plus=
+github.com/jackc/pgtype v1.14.3/go.mod h1:aKeozOde08iifGosdJpz9MBZonJOUJxqNpPBcMJTlVA=
 github.com/jackc/pgx/v4 v4.0.0-20190420224344-cc3461e65d96/go.mod h1:mdxmSJJuR08CZQyj1PVQBHy9XOp5p8/SHH6a0psbY9Y=
 github.com/jackc/pgx/v4 v4.0.0-20190421002000-1b8f0016e912/go.mod h1:no/Y67Jkk/9WuGR0JG/JseM9irFbnEPbuWV2EELPNuM=
 github.com/jackc/pgx/v4 v4.0.0-pre1.0.20190824185557-6972a5742186/go.mod h1:X+GQnOEnf1dqHGpw7JmHqHc1NxDoalibchSk9/RWuDc=
 github.com/jackc/pgx/v4 v4.12.1-0.20210724153913-640aa07df17c/go.mod h1:1QD0+tgSXP7iUjYm9C1NxKhny7lq6ee99u/z+IHFcgs=
 github.com/jackc/pgx/v4 v4.18.1/go.mod h1:FydWkUyadDmdNH/mHnGob881GawxeEm7TcMCzkb+qQE=
+github.com/jackc/pgx/v4 v4.18.2/go.mod h1:Ey4Oru5tH5sB6tV7hDmfWFahwF15Eb7DNXlRKx2CkVw=
 github.com/jackc/pgx/v4 v4.18.3 h1:dE2/TrEsGX3RBprb3qryqSV9Y60iZN1C6i8IrmW9/BA=
 github.com/jackc/pgx/v4 v4.18.3/go.mod h1:Ey4Oru5tH5sB6tV7hDmfWFahwF15Eb7DNXlRKx2CkVw=
 github.com/jackc/puddle v0.0.0-20190413234325-e4ced69a3a2b/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
@@ -2217,15 +2246,17 @@ github.com/jhump/gopoet v0.1.0/go.mod h1:me9yfT6IJSlOL3FCfrg+L6yzUEZ+5jW6WHt4Sk+
 github.com/jhump/goprotoc v0.5.0/go.mod h1:VrbvcYrQOrTi3i0Vf+m+oqQWk9l72mjkJCYo7UvLHRQ=
 github.com/jhump/protoreflect v1.6.0/go.mod h1:eaTn3RZAmMBcV0fifFvlm6VHNz3wSkYyXYWUh7ymB74=
 github.com/jhump/protoreflect v1.11.0/go.mod h1:U7aMIjN0NWq9swDP7xDdoMfRHb35uiuTd3Z9nFXJf5E=
-github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c=
 github.com/jhump/protoreflect v1.15.1/go.mod h1:jD/2GMKKE6OqX8qTjhADU1e6DShO+gavG9e0Q693nKo=
+github.com/jhump/protoreflect v1.16.0 h1:54fZg+49widqXYQ0b+usAFHbMkBGR4PpXrsHc8+TBDg=
+github.com/jhump/protoreflect v1.16.0/go.mod h1:oYPd7nPvcBw/5wlDfm/AVmU9zH9BgqGCI469pGxfj/8=
 github.com/jimlambrt/gldap v0.1.13 h1:jxmVQn0lfmFbM9jglueoau5LLF/IGRti0SKf0vB753M=
 github.com/jimlambrt/gldap v0.1.13/go.mod h1:nlC30c7xVphjImg6etk7vg7ZewHCCvl1dfAhO3ZJzPg=
 github.com/jmespath/go-jmespath v0.0.0-20160202185014-0b12d6b521d8/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
 github.com/jmespath/go-jmespath v0.0.0-20160803190731-bd40a432e4c7/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
 github.com/jmespath/go-jmespath v0.3.0/go.mod h1:9QtRXoHjLGCJ5IBSaohpXITPlowMeeYCZ7fLUTSywik=
-github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
 github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
+github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24 h1:liMMTbpW34dhU4az1GN0pTPADwNmvoRSeoZ6PItiqnY=
+github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
 github.com/joefitzgerald/rainbow-reporter v0.1.0/go.mod h1:481CNgqmVHQZzdIbN52CupLJyoVwB10FQ/IQlF1pdL8=
@@ -2266,8 +2297,8 @@ github.com/klauspost/compress v1.15.9/go.mod h1:PhcZ0MbTNciWF3rruxRgKxI5NkcHHrHU
 github.com/klauspost/compress v1.15.11/go.mod h1:QPwzmACJjUTFsnSHH934V6woptycfrDDJnH7hvFVbGM=
 github.com/klauspost/compress v1.16.0/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
 github.com/klauspost/compress v1.16.5/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
-github.com/klauspost/compress v1.16.7 h1:2mk3MPGNzKyxErAw8YaohYh69+pa4sIQSC0fPGCFR9I=
-github.com/klauspost/compress v1.16.7/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
+github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc=
+github.com/klauspost/compress v1.17.11/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
 github.com/klauspost/cpuid/v2 v2.0.4/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
 github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
@@ -2299,8 +2330,9 @@ github.com/lib/pq v0.0.0-20180327071824-d34b9ff171c2/go.mod h1:5WUZQaWbwv1U+lTRe
 github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.1.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
-github.com/lib/pq v1.10.2 h1:AqzbZs4ZoCBp+GtejcpCpcxM3zlSMx29dXbUSeVtJb8=
 github.com/lib/pq v1.10.2/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
+github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/linuxkit/virtsock v0.0.0-20201010232012-f8cee7dfc7a3/go.mod h1:3r6x7q95whyfWQpmGZTu3gk3v2YkMi05HEzl7Tf7YEo=
 github.com/lyft/protoc-gen-star v0.6.0/go.mod h1:TGAoBVkt8w7MPG72TrKIu85MIdXwDuzJYeZuUPFPNwA=
 github.com/lyft/protoc-gen-star v0.6.1/go.mod h1:TGAoBVkt8w7MPG72TrKIu85MIdXwDuzJYeZuUPFPNwA=
@@ -2390,6 +2422,8 @@ github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx
 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/mndrix/tap-go v0.0.0-20171203230836-629fa407e90b/go.mod h1:pzzDgJWZ34fGzaAZGFW22KVZDfyrYW+QABMrWnJBnSs=
+github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
+github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
 github.com/moby/patternmatcher v0.5.0 h1:YCZgJOeULcxLw1Q+sVR636pmS7sPEn1Qo2iAN6M7DBo=
 github.com/moby/patternmatcher v0.5.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
@@ -2404,8 +2438,10 @@ github.com/moby/sys/signal v0.6.0/go.mod h1:GQ6ObYZfqacOwTtlXvcmh9A26dVRul/hbOZn
 github.com/moby/sys/signal v0.7.0/go.mod h1:GQ6ObYZfqacOwTtlXvcmh9A26dVRul/hbOZn88Kg8Tg=
 github.com/moby/sys/symlink v0.1.0/go.mod h1:GGDODQmbFOjFsXvfLVn3+ZRxkch54RkSiGqsZeMYowQ=
 github.com/moby/sys/symlink v0.2.0/go.mod h1:7uZVF2dqJjG/NsClqul95CqKOBRQyYSNnJ6BMgR/gFs=
-github.com/moby/sys/user v0.1.0 h1:WmZ93f5Ux6het5iituh9x2zAG7NFY9Aqi49jjE1PaQg=
-github.com/moby/sys/user v0.1.0/go.mod h1:fKJhFOnsCN6xZ5gSfbM6zaHGgDJMrqt9/reuj4T7MmU=
+github.com/moby/sys/user v0.2.0 h1:OnpapJsRp25vkhw8TFG6OLJODNh/3rEwRWtJ3kakwRM=
+github.com/moby/sys/user v0.2.0/go.mod h1:RYstrcWOJpVh+6qzUqp2bU3eaRpdiQeKGlKitaH0PM8=
+github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
+github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
 github.com/moby/term v0.0.0-20200312100748-672ec06f55cd/go.mod h1:DdlQx2hp0Ss5/fLikoLlEeIYiATotOjgB//nb973jeo=
 github.com/moby/term v0.0.0-20201216013528-df9cb8a40635/go.mod h1:FBS0z0QWA44HXygs7VXDUOGoN/1TV3RuWkLO04am3wc=
 github.com/moby/term v0.0.0-20210610120745-9d4ed1856297/go.mod h1:vgPCkQMyxTZ7IDy8SXRufE172gr8+K/JE/7hHFxHW3A=
@@ -2492,8 +2528,9 @@ github.com/opencontainers/image-spec v1.0.2-0.20211117181255-693428a734f5/go.mod
 github.com/opencontainers/image-spec v1.0.2/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
 github.com/opencontainers/image-spec v1.0.3-0.20211202183452-c5a74bcca799/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
 github.com/opencontainers/image-spec v1.1.0-rc2/go.mod h1:3OVijpioIKYWTqjiG0zfF6wvoJ4fAXGbjdZuI2NgsRQ=
-github.com/opencontainers/image-spec v1.1.0-rc2.0.20221005185240-3a7f492d3f1b h1:YWuSjZCQAPM8UUBLkYUk1e+rZcvWHJmFb6i6rM44Xs8=
 github.com/opencontainers/image-spec v1.1.0-rc2.0.20221005185240-3a7f492d3f1b/go.mod h1:3OVijpioIKYWTqjiG0zfF6wvoJ4fAXGbjdZuI2NgsRQ=
+github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
+github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
 github.com/opencontainers/runc v0.0.0-20190115041553-12f6a991201f/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
 github.com/opencontainers/runc v0.1.1/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
 github.com/opencontainers/runc v1.0.0-rc8.0.20190926000215-3e425f80a8c9/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
@@ -2540,8 +2577,8 @@ github.com/pelletier/go-toml v1.9.3/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCko
 github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
 github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
 github.com/peterh/liner v0.0.0-20170211195444-bf27d3ba8e1d/go.mod h1:xIteQHvHuaLYG9IFj6mSxM0fCKrs34IrEQUhOYuGPHc=
-github.com/petermattis/goid v0.0.0-20180202154549-b0b1615b78e5 h1:q2e307iGHPdTGp0hoxKjt1H5pDo6utceo3dQVK3I5XQ=
-github.com/petermattis/goid v0.0.0-20180202154549-b0b1615b78e5/go.mod h1:jvVRKCrJTQWu0XVbaOlby/2lO20uSCHEMzzplHXte1o=
+github.com/petermattis/goid v0.0.0-20240813172612-4fcff4a6cae7 h1:Dx7Ovyv/SFnMFw3fD4oEoeorXc6saIiQ23LrGLth0Gw=
+github.com/petermattis/goid v0.0.0-20240813172612-4fcff4a6cae7/go.mod h1:pxMtw7cyUw6B2bRH0ZBANSPg+AoSud1I1iyJHI69jH4=
 github.com/phayes/freeport v0.0.0-20220201140144-74d24b5ae9f5/go.mod h1:iIss55rKnNBTvrwdmkUpLnDpZoAHvWaiq5+iMmen4AE=
 github.com/phpdave11/gofpdf v1.4.2/go.mod h1:zpO6xFn9yxo3YLyMvW8HcKWVdbNqgIfOOp2dXMnm1mY=
 github.com/phpdave11/gofpdi v1.0.12/go.mod h1:vBmVV0Do6hSBHC8uKUQ71JGW+ZGQq74llk/7bXwjDoI=
@@ -2620,6 +2657,8 @@ github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40T
 github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
 github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
+github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
+github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
 github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
@@ -2644,8 +2683,8 @@ github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIH
 github.com/safchain/ethtool v0.0.0-20190326074333-42ed695e3de8/go.mod h1:Z0q5wiBQGYcxhMZ6gUqHn6pYNLypFAvaL3UvgZLR0U4=
 github.com/safchain/ethtool v0.0.0-20210803160452-9aa261dae9b1/go.mod h1:Z0q5wiBQGYcxhMZ6gUqHn6pYNLypFAvaL3UvgZLR0U4=
 github.com/safchain/ethtool v0.2.0/go.mod h1:WkKB1DnNtvsMlDmQ50sgwowDJV/hGbJSOvJoEXs1AJQ=
-github.com/sasha-s/go-deadlock v0.2.0 h1:lMqc+fUb7RrFS3gQLtoQsJ7/6TV/pAIFvBsqX73DK8Y=
-github.com/sasha-s/go-deadlock v0.2.0/go.mod h1:StQn567HiB1fF2yJ44N9au7wOhrPS3iZqiDbRupzT10=
+github.com/sasha-s/go-deadlock v0.3.5 h1:tNCOEEDG6tBqrNDOX35j/7hL5FcFViG6awUGROb2NsU=
+github.com/sasha-s/go-deadlock v0.3.5/go.mod h1:bugP6EGbdGYObIlx7pUZtWqlvo8k9H6vCBBsiChJQ5U=
 github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
 github.com/sclevine/agouti v3.0.0+incompatible/go.mod h1:b4WX9W9L1sfQKXeJf1mUTLZKJ48R1S7H23Ji7oFO5Bw=
 github.com/sclevine/spec v1.2.0/go.mod h1:W4J29eT/Kzv7/b9IWLB055Z+qvVC9vt0Arko24q7p+U=
@@ -2655,11 +2694,12 @@ github.com/seccomp/libseccomp-golang v0.9.1/go.mod h1:GbW5+tmTXfcxTToHLXlScSlAvW
 github.com/seccomp/libseccomp-golang v0.9.2-0.20210429002308-3879420cc921/go.mod h1:JA8cRccbGaA1s33RQf7Y1+q9gHmZX1yB/z9WDN1C6fg=
 github.com/seccomp/libseccomp-golang v0.9.2-0.20220502022130-f33da4d89646/go.mod h1:JA8cRccbGaA1s33RQf7Y1+q9gHmZX1yB/z9WDN1C6fg=
 github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
-github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
-github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
+github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
+github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/shopspring/decimal v0.0.0-20180709203117-cd690d0c9e24/go.mod h1:M+9NzErvs504Cn4c5DxATwIqPbtswREoFCre64PpcG4=
-github.com/shopspring/decimal v1.2.0 h1:abSATXmQEYyShuxI4/vyW3tV1MrKAJzCZ/0zLUXYbsQ=
 github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
+github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
+github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/sirupsen/logrus v1.0.4-0.20170822132746-89742aefa4b2/go.mod h1:pMByvHTf9Beacp5x1UXfOR9xyW/9antXMhjMPG0dEzc=
 github.com/sirupsen/logrus v1.0.6/go.mod h1:pMByvHTf9Beacp5x1UXfOR9xyW/9antXMhjMPG0dEzc=
@@ -2672,8 +2712,8 @@ github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic
 github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/skeema/knownhosts v1.2.1 h1:SHWdIUa82uGZz+F+47k8SY4QhhI291cXCpopT1lK2AQ=
-github.com/skeema/knownhosts v1.2.1/go.mod h1:xYbVRSPxqBZFrdmDyMmsOs+uX1UZC3nTN3ThzgDxUwo=
+github.com/skeema/knownhosts v1.3.0 h1:AM+y0rI04VksttfwjkSTNQorvGqmwATnvnAHpSgc0LY=
+github.com/skeema/knownhosts v1.3.0/go.mod h1:sPINvnADmT/qYH1kfv+ePMmOBTH6Tbl7b5LvTDjFK7M=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
 github.com/smartystreets/goconvey v0.0.0-20190330032615-68dc04aab96a/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
 github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
@@ -2731,8 +2771,8 @@ github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o
 github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
-github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/syndtr/gocapability v0.0.0-20170704070218-db04d3cc01c8/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
 github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
@@ -2798,8 +2838,10 @@ github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5t
 github.com/yvasiyarov/go-metrics v0.0.0-20140926110328-57bccd1ccd43/go.mod h1:aX5oPXxHm3bOH+xeAttToC8pqch2ScQN/JoXYupl6xs=
 github.com/yvasiyarov/gorelic v0.0.0-20141212073537-a9bba5b9ab50/go.mod h1:NUSPSUX/bi6SeDMUh6brw0nXpxHnc96TguQh0+r/ssA=
 github.com/yvasiyarov/newrelic_platform_go v0.0.0-20140908184405-b21fdbd4370f/go.mod h1:GlGEuHIJweS1mbCqG+7vt2nvWLzLLnRHbXz5JKd/Qbg=
-github.com/zclconf/go-cty v1.14.1 h1:t9fyA35fwjjUMcmL5hLER+e/rEPqrbCK1/OSE4SI9KA=
-github.com/zclconf/go-cty v1.14.1/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
+github.com/zclconf/go-cty v1.16.2 h1:LAJSwc3v81IRBZyUVQDUdZ7hs3SYs9jv0eZJDWHD/70=
+github.com/zclconf/go-cty v1.16.2/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
+github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940 h1:4r45xpDWB6ZMSMNJFMOjqrGHynW3DIBuR2H9j0ug+Mo=
+github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940/go.mod h1:CmBdvvj3nqzfzJ6nTCIwDTPZ56aVGvDrmztiO5g3qrM=
 github.com/zeebo/assert v1.3.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
 github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaDcA=
 github.com/zenazn/goji v0.9.0/go.mod h1:7S9M489iMyHBNxwZnk9/EHS098H4/F6TATF2mIxtB1Q=
@@ -2832,7 +2874,6 @@ go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
 go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
-go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
 go.opentelemetry.io/contrib v0.20.0/go.mod h1:G/EtFaa6qaN7+LxqfIAT3GiZa7Wv5DTBUzl5H4LY0Kc=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.20.0/go.mod h1:oVGt1LRbBOBq1A5BQLlUg9UaU/54aiHw8cgjV3aWZ/E=
@@ -2840,13 +2881,13 @@ go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.2
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.28.0/go.mod h1:vEhqr0m4eTc+DWxfsXoXue2GBgV2uUwVznkGIHW/e5w=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.35.0/go.mod h1:h8TWwRAhQpOd0aM5nYsRD8+flnkj+526GEIVlarH7eY=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.40.0/go.mod h1:UMklln0+MRhZC4e3PwmN3pCtq4DyIadWw4yikh6bNrw=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.47.0 h1:UNQQKPfTDe1J81ViolILjTKPr9WetKW6uei2hFgJmFs=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.47.0/go.mod h1:r9vWsPS/3AQItv3OSlEJ/E4mbrhUbbw18meOjArPtKQ=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.54.0 h1:r6I7RJCN86bpD/FQwedZ0vSixDpwuWREjW9oRMsmqDc=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.54.0/go.mod h1:B9yO6b04uB80CzjedvewuqDhxJxi11s7/GtiGa8bAjI=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.20.0/go.mod h1:2AboqHi0CiIZU0qwhtUfCYD1GeUzvvIXWNkhDt7ZMG4=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.32.0/go.mod h1:5eCOqeGphOyz6TsY3ZDNjE33SM/TFAK3RGuCL2naTgY=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.35.0/go.mod h1:9NiG9I2aHTKkcxqCILhjtyNA1QEiCjdBACv4IvrFQ+c=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0 h1:sv9kVfal0MK0wBMCOGr+HeJm9v803BkJxGrk2au7j08=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0/go.mod h1:SK2UL73Zy1quvRPonmOmRDiWk1KBV3LyIeeIxcEApWw=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0 h1:TT4fX+nBOA/+LUkobKGW1ydGcn+G3vRw9+g5HwCphpk=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0/go.mod h1:L7UH0GbB0p47T4Rri3uHjbpCFYrVrwc1I25QhNPiGK8=
 go.opentelemetry.io/otel v0.20.0/go.mod h1:Y3ugLH2oa81t5QO+Lty+zXf8zC9L26ax4Nzoxm/dooo=
 go.opentelemetry.io/otel v1.0.1/go.mod h1:OPEOD4jIT2SlZPMmwT6FqZz2C0ZNdQqiWcoK6M0SNFU=
 go.opentelemetry.io/otel v1.3.0/go.mod h1:PWIKzi6JCp7sM0k9yZ43VX+T345uNbAkDKwHVjb2PTs=
@@ -2854,8 +2895,8 @@ go.opentelemetry.io/otel v1.7.0/go.mod h1:5BdUoMIz5WEs0vt0CUEMtSSaTSHBBVwrhnz7+n
 go.opentelemetry.io/otel v1.8.0/go.mod h1:2pkj+iMj0o03Y+cW6/m8Y4WkRdYN3AvCXCnzRMp9yvM=
 go.opentelemetry.io/otel v1.10.0/go.mod h1:NbvWjCthWHKBEUMpf0/v8ZRZlni86PpGFEMA9pnQSnQ=
 go.opentelemetry.io/otel v1.14.0/go.mod h1:o4buv+dJzx8rohcUeRmWUZhqupFvzWis188WlggnNeU=
-go.opentelemetry.io/otel v1.24.0 h1:0LAOdjNmQeSTzGBzduGe/rU4tZhMwL5rWgtp9Ku5Jfo=
-go.opentelemetry.io/otel v1.24.0/go.mod h1:W7b9Ozg4nkF5tWI5zsXkaKKDjdVjpD4oAt9Qi/MArHo=
+go.opentelemetry.io/otel v1.32.0 h1:WnBN+Xjcteh0zdk01SVqV55d/m62NJLJdIyb4y/WO5U=
+go.opentelemetry.io/otel v1.32.0/go.mod h1:00DCVSB0RQcnzlwyTfqtxSm+DRr9hpYrHjNGiBHVQIg=
 go.opentelemetry.io/otel/exporters/otlp v0.20.0 h1:PTNgq9MRmQqqJY0REVbZFvwkYOA85vbdQU/nVfxDyqg=
 go.opentelemetry.io/otel/exporters/otlp v0.20.0/go.mod h1:YIieizyaN77rtLJra0buKiNBOm9XQfkPEKBeuhoMwAM=
 go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.3.0/go.mod h1:VpP4/RMn8bv8gNo9uK7/IMY4mtWLELsS+JIP0inH0h4=
@@ -2867,8 +2908,8 @@ go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.3.0/go.mod h1:hO1KLR7jcKaDD
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.7.0/go.mod h1:ceUgdyfNv4h4gLxHR0WNfDiiVmZFodZhZSbOLhpxqXE=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.10.0/go.mod h1:Krqnjl22jUJ0HgMzw5eveuCvFDXY4nSYb4F8t5gdrag=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.14.0/go.mod h1:HrbCVv40OOLTABmOn1ZWty6CHXkU8DK/Urc43tHug70=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0 h1:Mne5On7VWdx7omSrSSZvM4Kw7cS7NQkOOmLcgscI51U=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0/go.mod h1:IPtUMKL4O3tH5y+iXVyAXqpAwMuzC1IrxVS81rummfE=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.24.0 h1:t6wl9SPayj+c7lEIFgm4ooDBZVb01IhLB4InpomhRw8=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.24.0/go.mod h1:iSDOcsnSA5INXzZtwaBPrKp/lWu/V14Dd+llD0oI2EA=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.0.1/go.mod h1:xOvWoTOrQjxjW61xtOmD/WKGRYb/P4NzRo3bs65U6Rk=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.3.0/go.mod h1:keUU7UfnwWTWpJ+FWnyqmogPa82nuU5VUANFq49hlMY=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.7.0/go.mod h1:E+/KKhwOSw8yoPxSSuUHG6vKppkvhN+S1Jc7Nib3k3o=
@@ -2876,14 +2917,14 @@ go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.10.0/go.mod h
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.14.0/go.mod h1:5w41DY6S9gZrbjuq6Y+753e96WfPha5IcsOSZTtullM=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.3.0/go.mod h1:QNX1aly8ehqqX1LEa6YniTU7VY9I6R3X/oPxhGdTceE=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.14.0/go.mod h1:+N7zNjIJv4K+DeX67XXET0P+eIciESgaFDBqh+ZJFS4=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.22.0 h1:FyjCyI9jVEfqhUh2MoSkmolPjfh5fp2hnV0b0irxH4Q=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.22.0/go.mod h1:hYwym2nDEeZfG/motx0p7L7J1N1vyzIThemQsb4g2qY=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.30.0 h1:umZgi92IyxfXd/l4kaDhnKgY8rnN/cZcF1LKc6I8OQ8=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.30.0/go.mod h1:4lVs6obhSVRb1EW5FhOuBTyiQhtRtAnnva9vD3yRfq8=
 go.opentelemetry.io/otel/metric v0.20.0/go.mod h1:598I5tYlH1vzBjn+BTuhzTCSb/9debfNp6R3s7Pr1eU=
 go.opentelemetry.io/otel/metric v0.30.0/go.mod h1:/ShZ7+TS4dHzDFmfi1kSXMhMVubNoP0oIaBp70J6UXU=
 go.opentelemetry.io/otel/metric v0.31.0/go.mod h1:ohmwj9KTSIeBnDBm/ZwH2PSZxZzoOaG2xZeekTRzL5A=
 go.opentelemetry.io/otel/metric v0.37.0/go.mod h1:DmdaHfGt54iV6UKxsV9slj2bBRJcKC1B1uvDLIioc1s=
-go.opentelemetry.io/otel/metric v1.24.0 h1:6EhoGWWK28x1fbpA4tYTOWBkPefTDQnb8WSGXlc88kI=
-go.opentelemetry.io/otel/metric v1.24.0/go.mod h1:VYhLe1rFfxuTXLgj4CBiyz+9WYBA8pNGJgDcSFRKBco=
+go.opentelemetry.io/otel/metric v1.32.0 h1:xV2umtmNcThh2/a/aCP+h64Xx5wsj8qqnkYZktzNa0M=
+go.opentelemetry.io/otel/metric v1.32.0/go.mod h1:jH7CIbbK6SH2V2wE16W05BHCtIDzauciCRLoc/SyMv8=
 go.opentelemetry.io/otel/oteltest v0.20.0/go.mod h1:L7bgKf9ZB7qCwT9Up7i9/pn0PWIa9FqQ2IQ8LoxiGnw=
 go.opentelemetry.io/otel/sdk v0.20.0/go.mod h1:g/IcepuwNsoiX5Byy2nNV0ySUF1em498m7hBWC279Yc=
 go.opentelemetry.io/otel/sdk v1.0.1/go.mod h1:HrdXne+BiwsOHYYkBE5ysIcv2bvdZstxzmCQhxTcZkI=
@@ -2891,10 +2932,12 @@ go.opentelemetry.io/otel/sdk v1.3.0/go.mod h1:rIo4suHNhQwBIPg9axF8V9CA72Wz2mKF1t
 go.opentelemetry.io/otel/sdk v1.7.0/go.mod h1:uTEOTwaqIVuTGiJN7ii13Ibp75wJmYUDe374q6cZwUU=
 go.opentelemetry.io/otel/sdk v1.10.0/go.mod h1:vO06iKzD5baltJz1zarxMCNHFpUlUiOy4s65ECtn6kE=
 go.opentelemetry.io/otel/sdk v1.14.0/go.mod h1:bwIC5TjrNG6QDCHNWvW4HLHtUQ4I+VQDsnjhvyZCALM=
-go.opentelemetry.io/otel/sdk v1.22.0 h1:6coWHw9xw7EfClIC/+O31R8IY3/+EiRFHevmHafB2Gw=
-go.opentelemetry.io/otel/sdk v1.22.0/go.mod h1:iu7luyVGYovrRpe2fmj3CVKouQNdTOkxtLzPvPz1DOc=
+go.opentelemetry.io/otel/sdk v1.32.0 h1:RNxepc9vK59A8XsgZQouW8ue8Gkb4jpWtJm9ge5lEG4=
+go.opentelemetry.io/otel/sdk v1.32.0/go.mod h1:LqgegDBjKMmb2GC6/PrTnteJG39I8/vJCAP9LlJXEjU=
 go.opentelemetry.io/otel/sdk/export/metric v0.20.0/go.mod h1:h7RBNMsDJ5pmI1zExLi+bJK+Dr8NQCh0qGhm1KDnNlE=
 go.opentelemetry.io/otel/sdk/metric v0.20.0/go.mod h1:knxiS8Xd4E/N+ZqKmUPf3gTTZ4/0TjTXukfxjzSTpHE=
+go.opentelemetry.io/otel/sdk/metric v1.32.0 h1:rZvFnvmvawYb0alrYkjraqJq0Z4ZUJAiyYCU9snn1CU=
+go.opentelemetry.io/otel/sdk/metric v1.32.0/go.mod h1:PWeZlq0zt9YkYAp3gjKZ0eicRYvOh1Gd+X99x6GHpCQ=
 go.opentelemetry.io/otel/trace v0.20.0/go.mod h1:6GjCW8zgDjwGHGa6GkyeB8+/5vjT16gUEi0Nf1iBdgw=
 go.opentelemetry.io/otel/trace v1.0.1/go.mod h1:5g4i4fKLaX2BQpSBsxw8YYcgKpMMSW3x7ZTuYBr3sUk=
 go.opentelemetry.io/otel/trace v1.3.0/go.mod h1:c/VDhno8888bvQYmbYLqe41/Ldmr/KKunbvWM4/fEjk=
@@ -2902,16 +2945,16 @@ go.opentelemetry.io/otel/trace v1.7.0/go.mod h1:fzLSB9nqR2eXzxPXb2JW9IKE+ScyXA48
 go.opentelemetry.io/otel/trace v1.8.0/go.mod h1:0Bt3PXY8w+3pheS3hQUt+wow8b1ojPaTBoTCh2zIFI4=
 go.opentelemetry.io/otel/trace v1.10.0/go.mod h1:Sij3YYczqAdz+EhmGhE6TpTxUO5/F/AzrK+kxfGqySM=
 go.opentelemetry.io/otel/trace v1.14.0/go.mod h1:8avnQLK+CG77yNLUae4ea2JDQ6iT+gozhnZjy/rw9G8=
-go.opentelemetry.io/otel/trace v1.24.0 h1:CsKnnL4dUAr/0llH9FKuc698G04IrpWV0MQA/Y1YELI=
-go.opentelemetry.io/otel/trace v1.24.0/go.mod h1:HPc3Xr/cOApsBI154IU0OI0HJexz+aw5uPdbs3UCjNU=
+go.opentelemetry.io/otel/trace v1.32.0 h1:WIC9mYrXf8TmY/EXuULKc8hR17vE+Hjv2cssQDe03fM=
+go.opentelemetry.io/otel/trace v1.32.0/go.mod h1:+i4rkvCraA+tG6AzwloGaCtkx53Fa+L+V8e9a7YvhT8=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
 go.opentelemetry.io/proto/otlp v0.9.0/go.mod h1:1vKfU9rv61e9EVGthD1zNvUbiwPcimSsOPU9brfSHJg=
 go.opentelemetry.io/proto/otlp v0.11.0/go.mod h1:QpEjXPrNQzrFDZgoTo49dgHR9RYRSrg3NAKnUGl9YpQ=
 go.opentelemetry.io/proto/otlp v0.15.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
 go.opentelemetry.io/proto/otlp v0.16.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
 go.opentelemetry.io/proto/otlp v0.19.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
-go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lIVU/I=
-go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM=
+go.opentelemetry.io/proto/otlp v1.1.0 h1:2Di21piLrCqJ3U3eXGCTPHE9R8Nh+0uglSnOyxikMeI=
+go.opentelemetry.io/proto/otlp v1.1.0/go.mod h1:GpBHCBWiqvVLDqmHZsoMM3C5ySeKTC7ej/RNTae6MdY=
 go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.5.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
@@ -2973,7 +3016,6 @@ golang.org/x/crypto v0.0.0-20220427172511-eb4f295cb31f/go.mod h1:IxCIyHEi3zRg3s0
 golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw=
-golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
 golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
 golang.org/x/crypto v0.9.0/go.mod h1:yrmDGqONDYtNj3tH8X9dzUun2m2lzPa9ngI6/RUPGR0=
@@ -2985,8 +3027,10 @@ golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf
 golang.org/x/crypto v0.15.0/go.mod h1:4ChreQoLWfG3xLDer1WdlH5NdlQ3+mwnQq1YTKY+72g=
 golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
-golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
-golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
+golang.org/x/crypto v0.20.0/go.mod h1:Xwo95rrVNIoSMx9wa1JroENMToLWn3RNVrTBpLHgZPQ=
+golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
+golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
+golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
 golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -3002,8 +3046,8 @@ golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
 golang.org/x/exp v0.0.0-20220827204233-334a2380cb91/go.mod h1:cyybsKvd6eL0RnXn6p/Grxp8F5bW7iYuBgsNCOHpMYE=
-golang.org/x/exp v0.0.0-20240222234643-814bf88cf225 h1:LfspQV/FYTatPTr/3HzIcmiUFH7PGP+OQ6mgDYo3yuQ=
-golang.org/x/exp v0.0.0-20240222234643-814bf88cf225/go.mod h1:CxmFvTBINI24O/j8iY7H1xHzx2i4OsyguNBmN/uPtqc=
+golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842 h1:vr/HnozRka3pE4EsMEg1lgkXJkTFJCVUX+S/ZT6wYzM=
+golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842/go.mod h1:XtvwrStGgqGPLc4cjQfWqZHG1YFdYs6swckp8vpsjnc=
 golang.org/x/image v0.0.0-20180708004352-c73c2afc3b81/go.mod h1:ux5Hcp/YLpHSI86hEcLt0YII63i6oz57MZXIpbrjZUs=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
@@ -3050,8 +3094,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.9.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.11.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.17.0 h1:zY54UmvipHiNd+pm+m0x9KhZ9hl1/7QNMyxXbc6ICqA=
-golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.22.0 h1:D4nJWe9zXqHOmWqj4VMOJhvzj7bEZg4wEYa759z1pH4=
+golang.org/x/mod v0.22.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
 golang.org/x/net v0.0.0-20180530234432-1e491301e022/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -3144,8 +3188,10 @@ golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
 golang.org/x/net v0.16.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
 golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
 golang.org/x/net v0.18.0/go.mod h1:/czyP5RqHAH4odGYxBJ1qz0+CE5WZ+2j1YgoEo8F2jQ=
-golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
-golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
+golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
+golang.org/x/net v0.22.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
+golang.org/x/net v0.37.0 h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c=
+golang.org/x/net v0.37.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -3181,8 +3227,8 @@ golang.org/x/oauth2 v0.10.0/go.mod h1:kTpgurOux7LqtuxjuyZa4Gj2gdezIt/jQtGnNFfypQ
 golang.org/x/oauth2 v0.11.0/go.mod h1:LdF7O/8bLR/qWK9DrpXmbHLTouvRHK0SgJl0GmDBchk=
 golang.org/x/oauth2 v0.13.0/go.mod h1:/JMhi4ZRXAf4HG9LiNmxvk+45+96RUlVThiH8FzNBn0=
 golang.org/x/oauth2 v0.14.0/go.mod h1:lAtNWgaWfL4cm7j2OV8TxGi9Qb7ECORx8DktCY74OwM=
-golang.org/x/oauth2 v0.18.0 h1:09qnuIAgzdx1XplqJvW6CQqMCtGZykZWcXzPMPUusvI=
-golang.org/x/oauth2 v0.18.0/go.mod h1:Wf7knwG0MPoWIMMBgFlEaSUDaKskp0dCfrlJRJXbBi8=
+golang.org/x/oauth2 v0.25.0 h1:CY4y7XT9v0cRI9oupztF8AgiIu99L/ksR/Xp/6jrZ70=
+golang.org/x/oauth2 v0.25.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -3203,8 +3249,8 @@ golang.org/x/sync v0.2.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.4.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
-golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
+golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -3364,8 +3410,9 @@ golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.14.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
-golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
+golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
@@ -3387,8 +3434,9 @@ golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
 golang.org/x/term v0.14.0/go.mod h1:TySc+nGkYR6qt8km8wUhuFRTVSMIX3XPR58y2lC8vww=
 golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
-golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q=
-golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
+golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58=
+golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y=
+golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -3410,8 +3458,8 @@ golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
-golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
+golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
+golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -3424,8 +3472,8 @@ golang.org/x/time v0.0.0-20220210224613-90d013bbcef8/go.mod h1:tRJNPiyCQ0inRvYxb
 golang.org/x/time v0.0.0-20220922220347-f3bd1da661af/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.1.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
-golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
+golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180525024113-a5b4c53f6e8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -3515,8 +3563,8 @@ golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s=
 golang.org/x/tools v0.8.0/go.mod h1:JxBZ99ISMI5ViVkT1tr6tdNmXeTrcpVSD3vZ1RsRdN4=
 golang.org/x/tools v0.9.1/go.mod h1:owI94Op576fPu3cIGQeHs3joujW/2Oc6MtlxbF5dfNc=
 golang.org/x/tools v0.10.0/go.mod h1:UJwyiVBsOA2uwvK/e5OY3GTpDUJriEd+/YlqAwLPmyM=
-golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d h1:vU5i/LfpvrRCpgM/VPfJLg5KjxD3E+hfT1SH+d9zLwg=
-golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
+golang.org/x/tools v0.29.0 h1:Xx0h3TtM9rzQpQuR4dKLrdglAmCEN5Oi+P74JdhdzXE=
+golang.org/x/tools v0.29.0/go.mod h1:KMQVMRsVxU6nHCFXrBPhDB8XncLNLM0lIy/F14RP588=
 golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -3602,8 +3650,8 @@ google.golang.org/api v0.128.0/go.mod h1:Y611qgqaE92On/7g65MQgxYul3c0rEB894kniWL
 google.golang.org/api v0.134.0/go.mod h1:sjRL3UnjTx5UqNQS9EWr9N8p7xbHpy1k0XGRLCf3Spk=
 google.golang.org/api v0.139.0/go.mod h1:CVagp6Eekz9CjGZ718Z+sloknzkDJE7Vc1Ckj9+viBk=
 google.golang.org/api v0.149.0/go.mod h1:Mwn1B7JTXrzXtnvmzQE2BD6bYZQ8DShKZDZbeN9I7qI=
-google.golang.org/api v0.163.0 h1:4BBDpPaSH+H28NhnX+WwjXxbRLQ7TWuEKp4BQyEjxvk=
-google.golang.org/api v0.163.0/go.mod h1:6SulDkfoBIg4NFmCuZ39XeeAgSHCPecfSUuDyYlAHs0=
+google.golang.org/api v0.219.0 h1:nnKIvxKs/06jWawp2liznTBnMRQBEPpGo7I+oEypTX0=
+google.golang.org/api v0.219.0/go.mod h1:K6OmjGm+NtLrIkHxv1U3a0qIf/0JOvAHd5O/6AoyKYE=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -3773,8 +3821,8 @@ google.golang.org/genproto v0.0.0-20231012201019-e917dd12ba7a/go.mod h1:EMfReVxb
 google.golang.org/genproto v0.0.0-20231016165738-49dd2c1f3d0b/go.mod h1:CgAqfJo+Xmu0GwA0411Ht3OU3OntXwsGmrmjI8ioGXI=
 google.golang.org/genproto v0.0.0-20231030173426-d783a09b4405/go.mod h1:3WDQMjmJk36UQhjQ89emUzb1mdaHcPeeAh4SCBKznB4=
 google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17/go.mod h1:J7XzRzVy1+IPwWHZUzoD0IccYZIrXILAQpc+Qy9CMhY=
-google.golang.org/genproto v0.0.0-20240125205218-1f4bbc51befe h1:USL2DhxfgRchafRvt/wYyyQNzwgL7ZiURcozOE/Pkvo=
-google.golang.org/genproto v0.0.0-20240125205218-1f4bbc51befe/go.mod h1:cc8bqMqtv9gMOr0zHg2Vzff5ULhhL2IXP4sbcn32Dro=
+google.golang.org/genproto v0.0.0-20241118233622-e639e219e697 h1:ToEetK57OidYuqD4Q5w+vfEnPvPpuTwedCNVohYJfNk=
+google.golang.org/genproto v0.0.0-20241118233622-e639e219e697/go.mod h1:JJrvXBWRZaFMxBufik1a4RpFw4HhgVtBBWQeQgUj2cc=
 google.golang.org/genproto/googleapis/api v0.0.0-20230525234020-1aefcd67740a/go.mod h1:ts19tUU+Z0ZShN1y3aPyq2+O3d5FUNNgT6FtOzmrNn8=
 google.golang.org/genproto/googleapis/api v0.0.0-20230525234035-dd9d682886f9/go.mod h1:vHYtlOoi6TsQ3Uk2yxR7NI5z8uoV+3pZtR4jmHIkRig=
 google.golang.org/genproto/googleapis/api v0.0.0-20230526203410-71b5a4ffd15e/go.mod h1:vHYtlOoi6TsQ3Uk2yxR7NI5z8uoV+3pZtR4jmHIkRig=
@@ -3792,8 +3840,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20231012201019-e917dd12ba7a/go.
 google.golang.org/genproto/googleapis/api v0.0.0-20231016165738-49dd2c1f3d0b/go.mod h1:IBQ646DjkDkvUIsVq/cc03FUFQ9wbZu7yE396YcL870=
 google.golang.org/genproto/googleapis/api v0.0.0-20231030173426-d783a09b4405/go.mod h1:oT32Z4o8Zv2xPQTg0pbVaPr0MPOH6f14RgXt7zfIpwg=
 google.golang.org/genproto/googleapis/api v0.0.0-20231106174013-bbf56f31fb17/go.mod h1:0xJLfVdJqpAPl8tDg1ujOCGzx6LFLttXT5NhllGOXY4=
-google.golang.org/genproto/googleapis/api v0.0.0-20240125205218-1f4bbc51befe h1:0poefMBYvYbs7g5UkjS6HcxBPaTRAmznle9jnxYoAI8=
-google.golang.org/genproto/googleapis/api v0.0.0-20240125205218-1f4bbc51befe/go.mod h1:4jWUdICTdgc3Ibxmr8nAJiiLHwQBY0UI0XZcEMaFKaA=
+google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576 h1:CkkIfIt50+lT6NHAVoRYEyAvQGFM7xEwXUUywFvEb3Q=
+google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576/go.mod h1:1R3kvZ1dtP3+4p4d3G8uJ8rFk/fWlScl38vanWACI08=
 google.golang.org/genproto/googleapis/bytestream v0.0.0-20230530153820-e85fd2cbaebc/go.mod h1:ylj+BE99M198VPbBh6A8d9n3w8fChvyLK3wwBOjXBFA=
 google.golang.org/genproto/googleapis/bytestream v0.0.0-20230720185612-659f7aaaa771/go.mod h1:3QoBVwTHkXbY1oRGzlhwhOykfcATQN43LJ6iT8Wy8kE=
 google.golang.org/genproto/googleapis/bytestream v0.0.0-20230807174057-1744710a1577/go.mod h1:NjCQG/D8JandXxM57PZbAJL1DCNL6EypA0vPPwfsc7c=
@@ -3816,8 +3864,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20231012201019-e917dd12ba7a/go.
 google.golang.org/genproto/googleapis/rpc v0.0.0-20231016165738-49dd2c1f3d0b/go.mod h1:swOH3j0KzcDDgGUWr+SNpyTen5YrXjS3eyPzFYKc6lc=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20231030173426-d783a09b4405/go.mod h1:67X1fPuzjcrkymZzZV1vvkFeTn2Rvc6lYF9MYFGCcwE=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20231106174013-bbf56f31fb17/go.mod h1:oQ5rr10WTTMvP4A36n8JpR1OrO1BEiV4f78CneXZxkA=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240125205218-1f4bbc51befe h1:bQnxqljG/wqi4NTXu2+DJ3n7APcEA882QZ1JvhQAq9o=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240125205218-1f4bbc51befe/go.mod h1:PAREbraiVEVGVdTZsVWjSbbTtSyGbAgIIvni8a8CD5s=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250124145028-65684f501c47 h1:91mG8dNTpkC0uChJUQ9zCiRqx3GEEFOWaRZ0mI6Oj2I=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250124145028-65684f501c47/go.mod h1:+2Yz8+CLJbIfL9z73EW45avw8Lmge3xVElCP9zEKi50=
 google.golang.org/grpc v0.0.0-20160317175043-d3ddb4469d5a/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.8.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
@@ -3874,8 +3922,8 @@ google.golang.org/grpc v1.58.2/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSs
 google.golang.org/grpc v1.58.3/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSsCJk0=
 google.golang.org/grpc v1.59.0/go.mod h1:aUPDwccQo6OTjy7Hct4AfBPD1GptF4fyUjIkQ9YtF98=
 google.golang.org/grpc v1.61.0/go.mod h1:VUbo7IFqmF1QtCAstipjG0GIoq49KvMe9+h1jFLBNJs=
-google.golang.org/grpc v1.61.1 h1:kLAiWrZs7YeDM6MumDe7m3y4aM6wacLzM1Y/wiLP9XY=
-google.golang.org/grpc v1.61.1/go.mod h1:VUbo7IFqmF1QtCAstipjG0GIoq49KvMe9+h1jFLBNJs=
+google.golang.org/grpc v1.70.0 h1:pWFv03aZoHzlRKHWicjsZytKAiYCtNS0dHbXnIdq7jQ=
+google.golang.org/grpc v1.70.0/go.mod h1:ofIJqVKDXx/JiXrwr2IG4/zwdH9txy3IlF40RmcJSQw=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
@@ -3896,8 +3944,8 @@ google.golang.org/protobuf v1.28.2-0.20230222093303-bc1253ad3743/go.mod h1:HV8QO
 google.golang.org/protobuf v1.29.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.34.1 h1:9ddQBjfCyZPOHPUiPxpYESBLc+T8P3E+Vo4IbKZgFWg=
-google.golang.org/protobuf v1.34.1/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+google.golang.org/protobuf v1.36.4 h1:6A3ZDJHn/eNqc1i+IdefRzy/9PokBTPvcqMySR7NNIM=
+google.golang.org/protobuf v1.36.4/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/airbrake/gobrake.v2 v2.0.9/go.mod h1:/h5ZAUhDkGaJfjzjKLSjv6zCL6O0LLBxU4K+aSYdM/U=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -4019,8 +4067,8 @@ k8s.io/utils v0.0.0-20210930125809-cb0fa318a74b/go.mod h1:jPW/WVKK9YHAvNhRxK0md/
 k8s.io/utils v0.0.0-20220728103510-ee6ede2d64ed/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
 k8s.io/utils v0.0.0-20221107191617-1a15be271d1d/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 k8s.io/utils v0.0.0-20230220204549-a5ecb0141aa5/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-k8s.io/utils v0.0.0-20240102154912-e7106e64919e h1:eQ/4ljkx21sObifjzXwlPKpdGLrCfRziVtos3ofG/sQ=
-k8s.io/utils v0.0.0-20240102154912-e7106e64919e/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+k8s.io/utils v0.0.0-20230726121419-3b25d923346b h1:sgn3ZU783SCgtaSJjpcVVlRqd6GSnlTLKgpAAttJvpI=
+k8s.io/utils v0.0.0-20230726121419-3b25d923346b/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 lukechampine.com/uint128 v1.1.1/go.mod h1:c4eWIwlEGaxC/+H1VguhU4PHXNWDCDMUlWdIWl2j1gk=
 lukechampine.com/uint128 v1.2.0/go.mod h1:c4eWIwlEGaxC/+H1VguhU4PHXNWDCDMUlWdIWl2j1gk=
 modernc.org/cc/v3 v3.36.0/go.mod h1:NFUHyPn4ekoC/JHeZFfZurN6ixxawE1BnVonP/oahEI=
diff --git a/internal/consts/consts.go b/internal/consts/consts.go
index b5075386..29120da2 100644
--- a/internal/consts/consts.go
+++ b/internal/consts/consts.go
@@ -41,6 +41,7 @@ const (
 	FieldNamespaceID                   = "namespace_id"
 	FieldNamespacePath                 = "namespace_path"
 	FieldPathFQ                        = "path_fq"
+	FieldPathsFQ                       = "paths_fq"
 	FieldData                          = "data"
 	FieldDisableRead                   = "disable_read"
 	FieldName                          = "name"
@@ -436,7 +437,6 @@ const (
 	FieldAllowedResponseHeaders        = "allowed_response_headers"
 	FieldDelegatedAuthAccessors        = "delegated_auth_accessors"
 	FieldPluginVersion                 = "plugin_version"
-	FieldUseMSGraphAPI                 = "use_microsoft_graph_api"
 	FieldEnabled                       = "enabled"
 	FieldDefaultMount                  = "default_mount"
 	FieldDefaultPathPolicy             = "default_path_policy"
@@ -522,12 +522,30 @@ const (
 	FieldAcmeAccountSafetyBuffer              = "acme_account_safety_buffer"
 	FieldPauseDuration                        = "pause_duration"
 	FieldRevocationQueueSafetyBuffer          = "revocation_queue_safety_buffer"
+	FieldCreatedTime                          = "created_time"
+	FieldDeletionTime                         = "deletion_time"
+	FieldDestroyed                            = "destroyed"
+	FieldDeleteAllVersions                    = "delete_all_versions"
+
+	/*
+		ephemeral resource constants and write-only attributes
+	*/
+
+	FieldMountID = "mount_id"
+
+	FieldPasswordWO           = "password_wo"
+	FieldPasswordWOVersion    = "password_wo_version"
+	FieldCredentialsWO        = "credentials_wo"
+	FieldCredentialsWOVersion = "credentials_wo_version"
+	FieldDataJSONWO           = "data_json_wo"
+	FieldDataJSONWOVersion    = "data_json_wo_version"
 
 	/*
 		common environment variables
 	*/
 	EnvVarVaultNamespaceImport = "TERRAFORM_VAULT_NAMESPACE_IMPORT"
-	EnvVarSkipChildToken       = "TERRAFORM_VAULT_SKIP_CHILD_TOKEN"
+	// EnvVarSkipChildToken to allow user from creating child tokens
+	EnvVarSkipChildToken = "TERRAFORM_VAULT_SKIP_CHILD_TOKEN"
 	// EnvVarUsername to get the username for the userpass auth method
 	EnvVarUsername = "TERRAFORM_VAULT_USERNAME"
 	// EnvVarPassword to get the password for the userpass auth method
diff --git a/internal/framework/base/base.go b/internal/framework/base/base.go
new file mode 100644
index 00000000..74617f33
--- /dev/null
+++ b/internal/framework/base/base.go
@@ -0,0 +1,94 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package base
+
+import (
+	"context"
+	"fmt"
+	"github.com/hashicorp/terraform-plugin-framework/ephemeral"
+	"os"
+
+	"github.com/hashicorp/terraform-plugin-framework/datasource"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
+	"github.com/hashicorp/terraform-provider-vault/internal/consts"
+	"github.com/hashicorp/terraform-provider-vault/internal/provider"
+)
+
+type withMeta struct {
+	meta *provider.ProviderMeta
+}
+
+func (w *withMeta) Meta() *provider.ProviderMeta {
+	return w.meta
+}
+
+// ResourceWithConfigure is a structure to be embedded within a Resource that
+// implements the ResourceWithConfigure interface.
+type ResourceWithConfigure struct {
+	withMeta
+}
+
+// Configure enables provider-level data or clients to be set in the
+// provider-defined Resource type.
+func (r *ResourceWithConfigure) Configure(_ context.Context, request resource.ConfigureRequest, response *resource.ConfigureResponse) {
+	if v, ok := request.ProviderData.(*provider.ProviderMeta); ok {
+		r.meta = v
+	}
+}
+
+// WithImportByID is intended to be embedded in resources which import state
+// via the "id" attribute.
+//
+// https://developer.hashicorp.com/terraform/plugin/framework/resources/import.
+//
+// This will ensure the Vault namespace is written to state if it is set in the
+// environment.
+// https://registry.terraform.io/providers/hashicorp/vault/latest/docs#namespace-support
+type WithImportByID struct{}
+
+func (w *WithImportByID) ImportState(ctx context.Context, request resource.ImportStateRequest, response *resource.ImportStateResponse) {
+	resource.ImportStatePassthroughID(ctx, path.Root(consts.FieldID), request, response)
+
+	ns := os.Getenv(consts.EnvVarVaultNamespaceImport)
+	if ns != "" {
+		tflog.Info(
+			ctx,
+			fmt.Sprintf("Environment variable %s set, attempting TF state import", consts.EnvVarVaultNamespaceImport),
+			map[string]any{consts.FieldNamespace: ns},
+		)
+		response.Diagnostics.Append(
+			response.State.SetAttribute(ctx, path.Root(consts.FieldNamespace), ns)...,
+		)
+	}
+}
+
+// DataSourceWithConfigure is a structure to be embedded within a DataSource
+// that implements the DataSourceWithConfigure interface.
+type DataSourceWithConfigure struct {
+	withMeta
+}
+
+// Configure enables provider-level data or clients to be set in the
+// provider-defined DataSource type.
+func (d *DataSourceWithConfigure) Configure(_ context.Context, request datasource.ConfigureRequest, response *datasource.ConfigureResponse) {
+	if v, ok := request.ProviderData.(*provider.ProviderMeta); ok {
+		d.meta = v
+	}
+}
+
+// EphemeralResourceWithConfigure is a structure to be embedded within an Ephemeral Resource that
+// implements the EphemeralResource with Configure interface.
+type EphemeralResourceWithConfigure struct {
+	withMeta
+}
+
+// Configure enables provider-level data or clients to be set in the
+// provider-defined DataSource type.
+func (r *EphemeralResourceWithConfigure) Configure(_ context.Context, request ephemeral.ConfigureRequest, response *ephemeral.ConfigureResponse) {
+	if v, ok := request.ProviderData.(*provider.ProviderMeta); ok {
+		r.meta = v
+	}
+}
diff --git a/internal/framework/base/schema.go b/internal/framework/base/schema.go
new file mode 100644
index 00000000..ae24b556
--- /dev/null
+++ b/internal/framework/base/schema.go
@@ -0,0 +1,162 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package base
+
+import (
+	"fmt"
+
+	ephemeralschema "github.com/hashicorp/terraform-plugin-framework/ephemeral/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-provider-vault/internal/consts"
+	"github.com/hashicorp/terraform-provider-vault/internal/framework/validators"
+)
+
+// BaseModel describes common fields for all Terraform resource data models
+//
+// This struct should be embedded into all Terraform Plugin Framework Resources and Data Sources.
+type BaseModel struct {
+	Namespace types.String `tfsdk:"namespace"`
+}
+
+// BaseModelLegacy describes common fields for all Terraform resource
+// data models that have been migrated from SDKv2 to the TF Plugin Framework.
+//
+// This struct should be embedded into all SDKv2 Resources and Data Sources.
+type BaseModelLegacy struct {
+	BaseModel
+
+	ID types.String `tfsdk:"id"`
+}
+
+// BaseModelEphemeral describes common fields for all Ephemeral resources.
+//
+// This struct should be embedded into all Ephemeral Resources.
+type BaseModelEphemeral struct {
+	BaseModel
+
+	// In certain cases, ephemeral resources need to defer provisioning
+	// till after certain resources have been created in the Apply step.
+	// However, if each input parameter is already known to the Ephemeral
+	// resource at Plan time, TF will attempt to open and read the ephemeral
+	// resource regardless. For example, if an ephemeral resource depends on a mount
+	// and a name parameter, both of which are known at Plan, then TF will try to read
+	// the Ephemeral secret even if the mount and name have not yet been created.
+	//
+	// In order to defer provisioning of the ephemeral resource, we have it depend on a
+	// computed attribute MountID for a mount resource, thereby forcing it to defer provisioning.
+	// In the TFVP, we know that each Ephemeral resource will definitely have a mount parameter.
+	// Adding in MountID enables Ephemeral resource to defer their provisioning if this attribute is set.
+	// This attribute does not do anything, and only exists to maintain a proper dependency graph.
+	MountID types.String `tfsdk:"mount_id"`
+}
+
+// MustAddBaseSchema adds the schema fields that are required for all net new
+// resources and data sources built with the TF Plugin Framework.
+//
+// This should be called from a resources or data source's Schema() method.
+func MustAddBaseSchema(s *schema.Schema) {
+	mustAddSchema(s, baseSchema)
+}
+
+// MustAddBaseEphemeralSchema adds the schema fields that are required for all net new
+// resources and data sources built with the TF Plugin Framework.
+//
+// This should be called from a resources or data source's Schema() method.
+func MustAddBaseEphemeralSchema(s *ephemeralschema.Schema) {
+	mustAddEphemeralSchema(s, baseEphemeralSchema)
+}
+
+// MustAddLegacyBaseSchema adds the schema fields that are required for
+// resources and data sources that have been migrated from SDKv2 to the
+// Terraform Plugin Framework.
+//
+// This should be called from a resources or data source's Schema() method.
+func MustAddLegacyBaseSchema(s *schema.Schema) {
+	mustAddSchema(s, baseSchema)
+	mustAddSchema(s, legacyBaseSchema)
+}
+
+func legacyBaseSchema() map[string]schema.Attribute {
+	return map[string]schema.Attribute{
+		// Add an 'id' field to the base schema because
+		//   1. The id field was implicitly added in the SDKv2, so we must
+		//      explicitly add it for existing resources, otherwise its a
+		//      breaking change for practitioners.
+		//   2. The id field is required for acceptance testing with the SDKv2
+		//      package.
+		// See:
+		//   https://developer.hashicorp.com/terraform/plugin/framework/acctests#no-id-found-in-attributes
+		//   https://github.com/hashicorp/terraform-plugin-framework/issues/896
+		consts.FieldID: schema.StringAttribute{
+			Computed: true,
+			PlanModifiers: []planmodifier.String{
+				stringplanmodifier.UseStateForUnknown(),
+			},
+		},
+	}
+}
+
+type schemaFunc func() map[string]schema.Attribute
+
+type ephemeralSchemaFunc func() map[string]ephemeralschema.Attribute
+
+func baseSchema() map[string]schema.Attribute {
+	return map[string]schema.Attribute{
+		consts.FieldNamespace: schema.StringAttribute{
+			Optional: true,
+			PlanModifiers: []planmodifier.String{
+				stringplanmodifier.RequiresReplace(),
+			},
+			MarkdownDescription: "Target namespace. (requires Enterprise)",
+			Validators: []validator.String{
+				validators.PathValidator(),
+			},
+		},
+	}
+}
+
+func baseEphemeralSchema() map[string]ephemeralschema.Attribute {
+	return map[string]ephemeralschema.Attribute{
+		consts.FieldNamespace: ephemeralschema.StringAttribute{
+			Optional:            true,
+			MarkdownDescription: "Target namespace. (requires Enterprise)",
+			Validators: []validator.String{
+				validators.PathValidator(),
+			},
+		},
+		consts.FieldMountID: ephemeralschema.StringAttribute{
+			Optional: true,
+			MarkdownDescription: "Terraform ID of the mount resource. Used to defer the provisioning " +
+				"of the ephemeral resource till the apply stage.",
+		},
+	}
+}
+
+func mustAddSchema(s *schema.Schema, schemaFuncs ...schemaFunc) {
+	for _, f := range schemaFuncs {
+		for k, v := range f() {
+			if _, ok := s.Attributes[k]; ok {
+				panic(fmt.Sprintf("cannot add schema field %q, already exists in the Schema map", k))
+			}
+
+			s.Attributes[k] = v
+		}
+	}
+}
+
+func mustAddEphemeralSchema(s *ephemeralschema.Schema, schemaFuncs ...ephemeralSchemaFunc) {
+	for _, f := range schemaFuncs {
+		for k, v := range f() {
+			if _, ok := s.Attributes[k]; ok {
+				panic(fmt.Sprintf("cannot add schema field %q, already exists in the Schema map", k))
+			}
+
+			s.Attributes[k] = v
+		}
+	}
+}
diff --git a/internal/framework/client/client.go b/internal/framework/client/client.go
new file mode 100644
index 00000000..ea9b6562
--- /dev/null
+++ b/internal/framework/client/client.go
@@ -0,0 +1,42 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package client
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	"github.com/hashicorp/terraform-plugin-log/tflog"
+	"github.com/hashicorp/terraform-provider-vault/internal/consts"
+	"github.com/hashicorp/terraform-provider-vault/internal/provider"
+	"github.com/hashicorp/vault/api"
+)
+
+func GetClient(ctx context.Context, meta interface{}, namespace string) (*api.Client, error) {
+	var p *provider.ProviderMeta
+
+	switch v := meta.(type) {
+	case *provider.ProviderMeta:
+		p = v
+	default:
+		return nil, fmt.Errorf("meta argument must be a %T, not %T", p, meta)
+	}
+
+	ns := namespace
+	if namespace == "" {
+		// in order to import namespaced resources the user must provide
+		// the namespace from an environment variable.
+		ns = os.Getenv(consts.EnvVarVaultNamespaceImport)
+		if ns != "" {
+			tflog.Debug(ctx, fmt.Sprintf("Value for %q set from environment", consts.FieldNamespace))
+		}
+	}
+
+	if ns != "" {
+		return p.GetNSClient(ns)
+	}
+
+	return p.GetClient()
+}
diff --git a/internal/framework/errutil/util.go b/internal/framework/errutil/util.go
new file mode 100644
index 00000000..d6e49837
--- /dev/null
+++ b/internal/framework/errutil/util.go
@@ -0,0 +1,43 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package errutil
+
+const (
+	unexpectedErr = "An unexpected error occurred while attempting to read the resource. " +
+		"Please retry the operation or report this issue to the provider developers.\n\n"
+)
+
+func ClientConfigureErr(err error) (string, string) {
+	return "Error Configuring Resource Client", err.Error()
+}
+
+func VaultCreateErr(err error) (string, string) {
+	return "Unable to Create Resource",
+		unexpectedErr +
+			"HTTP Error: " + err.Error()
+}
+
+func VaultReadErr(err error) (string, string) {
+	return "Unable to Read Resource from Vault",
+		unexpectedErr +
+			"HTTP Error: " + err.Error()
+}
+
+func VaultUpdateErr(err error) (string, string) {
+	return "Unable to Update Resource",
+		unexpectedErr +
+			"HTTP Error: " + err.Error()
+}
+
+func VaultDeleteErr(err error) (string, string) {
+	return "Unable to Delete Resource",
+		unexpectedErr +
+			"HTTP Error: " + err.Error()
+}
+
+func VaultReadResponseNil() (string, string) {
+	return "Unable to Read Resource from Vault",
+		unexpectedErr +
+			"Vault response was nil"
+}
diff --git a/internal/framework/model/model.go b/internal/framework/model/model.go
new file mode 100644
index 00000000..a67f9c88
--- /dev/null
+++ b/internal/framework/model/model.go
@@ -0,0 +1,30 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package model
+
+import (
+	"encoding/json"
+	"fmt"
+)
+
+// ToAPIModel is helper to translate Vault response data to its respective
+// Vault API data model
+func ToAPIModel(data, model any) error {
+	jsonData, err := json.Marshal(data)
+	if err != nil {
+		return fmt.Errorf(
+			"An unexpected error occurred while attempting to marshal the Vault response.\n\n" +
+				"Error: " + err.Error(),
+		)
+	}
+
+	err = json.Unmarshal(jsonData, &model)
+	if err != nil {
+		return fmt.Errorf(
+			"An unexpected error occurred while attempting to unmarshal the data.\n\n" +
+				"Error: " + err.Error(),
+		)
+	}
+	return nil
+}
diff --git a/internal/framework/validators/README.md b/internal/framework/validators/README.md
new file mode 100644
index 00000000..4b0a8290
--- /dev/null
+++ b/internal/framework/validators/README.md
@@ -0,0 +1,3 @@
+# Terraform Plugin Framework Validators
+
+This package contains custom Terraform Plugin Framework [validators](https://developer.hashicorp.com/terraform/plugin/framework/validation).
diff --git a/internal/framework/validators/file_exists.go b/internal/framework/validators/file_exists.go
new file mode 100644
index 00000000..ea16b2b0
--- /dev/null
+++ b/internal/framework/validators/file_exists.go
@@ -0,0 +1,62 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package validators
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+	"github.com/mitchellh/go-homedir"
+)
+
+var _ validator.String = fileExists{}
+
+// fileExists validates that a given token is a valid initialization token
+type fileExists struct{}
+
+// Description describes the validation in plain text formatting.
+func (v fileExists) Description(_ context.Context) string {
+	return "value must be a valid path to an existing file"
+}
+
+// MarkdownDescription describes the validation in Markdown formatting.
+func (v fileExists) MarkdownDescription(ctx context.Context) string {
+	return v.Description(ctx)
+}
+
+// ValidateString performs the validation.
+func (v fileExists) ValidateString(ctx context.Context, request validator.StringRequest, response *validator.StringResponse) {
+	if request.ConfigValue.IsNull() || request.ConfigValue.IsUnknown() {
+		return
+	}
+
+	value := request.ConfigValue.ValueString()
+	if value == "" {
+		response.Diagnostics.AddError("invalid file", "value cannot be empty")
+		return
+	}
+
+	filename, err := homedir.Expand(value)
+	if err != nil {
+		response.Diagnostics.AddError("invalid file", err.Error())
+		return
+	}
+
+	st, err := os.Stat(filename)
+	if err != nil {
+		response.Diagnostics.AddError("invalid file", fmt.Sprintf("failed to stat path %q, err=%s", filename, err))
+		return
+	}
+
+	if st.IsDir() {
+		response.Diagnostics.AddError("invalid file", fmt.Sprintf("path %q is not a file", filename))
+		return
+	}
+}
+
+func FileExistsValidator() validator.String {
+	return fileExists{}
+}
diff --git a/internal/framework/validators/gcp.go b/internal/framework/validators/gcp.go
new file mode 100644
index 00000000..710d01ff
--- /dev/null
+++ b/internal/framework/validators/gcp.go
@@ -0,0 +1,49 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package validators
+
+import (
+	"context"
+	"os"
+
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+	googleoauth "golang.org/x/oauth2/google"
+)
+
+// Credentials Validator
+var _ validator.String = credentialsValidator{}
+
+// credentialsValidator validates that a string Attribute's is valid JSON credentials.
+type credentialsValidator struct{}
+
+// Description describes the validation in plain text formatting.
+func (v credentialsValidator) Description(_ context.Context) string {
+	return "value must be a path to valid JSON credentials or valid, raw, JSON credentials"
+}
+
+// MarkdownDescription describes the validation in Markdown formatting.
+func (v credentialsValidator) MarkdownDescription(ctx context.Context) string {
+	return v.Description(ctx)
+}
+
+// ValidateString performs the validation.
+func (v credentialsValidator) ValidateString(ctx context.Context, request validator.StringRequest, response *validator.StringResponse) {
+	if request.ConfigValue.IsNull() || request.ConfigValue.IsUnknown() {
+		return
+	}
+
+	value := request.ConfigValue.ValueString()
+
+	// if this is a path and we can stat it, assume it's ok
+	if _, err := os.Stat(value); err == nil {
+		return
+	}
+	if _, err := googleoauth.CredentialsFromJSON(context.Background(), []byte(value)); err != nil {
+		response.Diagnostics.AddError("JSON credentials are not valid", err.Error())
+	}
+}
+
+func GCPCredentialsValidator() validator.String {
+	return credentialsValidator{}
+}
diff --git a/internal/framework/validators/kerberos.go b/internal/framework/validators/kerberos.go
new file mode 100644
index 00000000..820e857b
--- /dev/null
+++ b/internal/framework/validators/kerberos.go
@@ -0,0 +1,62 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package validators
+
+import (
+	"context"
+	"encoding/base64"
+	"fmt"
+
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+	"github.com/jcmturner/gokrb5/v8/spnego"
+)
+
+var _ validator.String = krbNegToken{}
+
+// krbNegToken validates that a given token is a valid initialization token
+type krbNegToken struct{}
+
+// Description describes the validation in plain text formatting.
+func (v krbNegToken) Description(_ context.Context) string {
+	return "value must be a valid initialization token"
+}
+
+// MarkdownDescription describes the validation in Markdown formatting.
+func (v krbNegToken) MarkdownDescription(ctx context.Context) string {
+	return v.Description(ctx)
+}
+
+// ValidateString performs the validation.
+func (v krbNegToken) ValidateString(ctx context.Context, request validator.StringRequest, response *validator.StringResponse) {
+	if request.ConfigValue.IsNull() || request.ConfigValue.IsUnknown() {
+		return
+	}
+
+	value := request.ConfigValue.ValueString()
+	if value == "" {
+		response.Diagnostics.AddError("invalid token", "value cannot be empty")
+		return
+	}
+
+	b, err := base64.StdEncoding.DecodeString(value)
+	if err != nil {
+		response.Diagnostics.AddError("invalid token", "value cannot be empty")
+		return
+	}
+
+	isNeg, _, err := spnego.UnmarshalNegToken(b)
+	if err != nil {
+		response.Diagnostics.AddError("invalid token", fmt.Sprintf("failed to unmarshal token, err=%s", err))
+		return
+	}
+
+	if !isNeg {
+		response.Diagnostics.AddError("invalid token", "not an initialization token")
+		return
+	}
+}
+
+func KRBNegTokenValidator() validator.String {
+	return krbNegToken{}
+}
diff --git a/internal/framework/validators/path.go b/internal/framework/validators/path.go
new file mode 100644
index 00000000..68baa0ba
--- /dev/null
+++ b/internal/framework/validators/path.go
@@ -0,0 +1,48 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package validators
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+	"github.com/hashicorp/terraform-provider-vault/internal/provider"
+)
+
+var _ validator.String = pathValidator{}
+
+// pathValidator  validates that a given path is a valid Vault path format
+type pathValidator struct{}
+
+// Description describes the validation in plain text formatting.
+func (v pathValidator) Description(_ context.Context) string {
+	return "value must be a valid Vault path format"
+}
+
+// MarkdownDescription describes the validation in Markdown formatting.
+func (v pathValidator) MarkdownDescription(ctx context.Context) string {
+	return v.Description(ctx)
+}
+
+// ValidateString performs the validation.
+func (v pathValidator) ValidateString(ctx context.Context, request validator.StringRequest, response *validator.StringResponse) {
+	if request.ConfigValue.IsNull() || request.ConfigValue.IsUnknown() {
+		return
+	}
+
+	value := request.ConfigValue.ValueString()
+	if value == "" {
+		response.Diagnostics.AddError("invalid Vault path", "value cannot be empty")
+		return
+	}
+
+	if provider.RegexpPath.MatchString(value) {
+		response.Diagnostics.AddError("invalid Vault path", fmt.Sprintf("value %s contains leading/trailing \"/\"", value))
+	}
+}
+
+func PathValidator() validator.String {
+	return pathValidator{}
+}
diff --git a/internal/framework/validators/uri.go b/internal/framework/validators/uri.go
new file mode 100644
index 00000000..6b312826
--- /dev/null
+++ b/internal/framework/validators/uri.go
@@ -0,0 +1,77 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package validators
+
+import (
+	"context"
+	"fmt"
+	"net/url"
+	"strings"
+
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+)
+
+var _ validator.String = uriValidator{}
+
+// uriValidator validates that the raw url is a valid request URI, and
+// optionally contains supported scheme(s).
+type uriValidator struct {
+	schemes []string
+}
+
+// Description describes the validation in plain text formatting.
+func (v uriValidator) Description(_ context.Context) string {
+	return "Invalid URI"
+}
+
+// MarkdownDescription describes the validation in Markdown formatting.
+func (v uriValidator) MarkdownDescription(ctx context.Context) string {
+	return v.Description(ctx)
+}
+
+// ValidateString performs the validation.
+func (v uriValidator) ValidateString(ctx context.Context, request validator.StringRequest, response *validator.StringResponse) {
+	if request.ConfigValue.IsNull() || request.ConfigValue.IsUnknown() {
+		return
+	}
+
+	value := request.ConfigValue.ValueString()
+	if value == "" {
+		response.Diagnostics.AddError(v.Description(ctx), "value cannot be empty")
+		return
+	}
+
+	u, err := url.ParseRequestURI(value)
+	if err != nil {
+		response.Diagnostics.AddError(v.Description(ctx), fmt.Sprintf("Failed to parse URL, err=%s", err))
+		return
+	}
+
+	if len(v.schemes) == 0 {
+		return
+	}
+
+	for _, scheme := range v.schemes {
+		if scheme == u.Scheme {
+			return
+		}
+	}
+
+	response.Diagnostics.AddError(
+		v.Description(ctx),
+		fmt.Sprintf(
+			"Unsupported scheme %q. Valid schemes are: %s",
+			u.Scheme,
+			strings.Join(v.schemes, ", "),
+		),
+	)
+}
+
+// URIValidator validates that the raw url is a valid request URI, and
+// optionally contains supported scheme(s).
+func URIValidator(schemes []string) validator.String {
+	return uriValidator{
+		schemes: schemes,
+	}
+}
diff --git a/internal/provider/auth.go b/internal/provider/auth.go
index 31e5214c..c885df66 100644
--- a/internal/provider/auth.go
+++ b/internal/provider/auth.go
@@ -6,6 +6,7 @@ package provider
 import (
 	"errors"
 	"fmt"
+	"os"
 	"sync"
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -18,7 +19,7 @@ import (
 type (
 	loginSchemaFunc   func(string) *schema.Schema
 	getSchemaResource func(string) *schema.Resource
-	validateFunc      func(data *schema.ResourceData) error
+	validateFunc      func(data *schema.ResourceData, params map[string]interface{}) error
 	authLoginFunc     func(*schema.ResourceData) (AuthLogin, error)
 )
 
@@ -138,7 +139,7 @@ func (l *AuthLoginCommon) Init(d *schema.ResourceData, authField string, validat
 	}
 
 	for _, vf := range validators {
-		if err := vf(d); err != nil {
+		if err := vf(d, params); err != nil {
 			return err
 		}
 	}
@@ -270,11 +271,46 @@ func (l *AuthLoginCommon) init(d *schema.ResourceData) (string, map[string]inter
 	return path, params, nil
 }
 
-func (l *AuthLoginCommon) checkRequiredFields(d *schema.ResourceData, required ...string) error {
+type authDefault struct {
+	field string
+
+	// envVars will override defaultVal.
+	// If there are multiple entries in the slice, we use the first value we
+	// find that is set in the environment.
+	envVars []string
+	// defaultVal is the fallback if an env var is not set
+	defaultVal string
+}
+
+type authDefaults []authDefault
+
+func (l *AuthLoginCommon) setDefaultFields(d *schema.ResourceData, defaults authDefaults, params map[string]interface{}) error {
+	for _, f := range defaults {
+		if _, ok := l.getOk(d, f.field); !ok {
+			// if field is unset in the config, check env
+			params[f.field] = f.defaultVal
+			for _, envVar := range f.envVars {
+				val := os.Getenv(envVar)
+				if val != "" {
+					params[f.field] = val
+					// found a value, no need to check other options
+					break
+				}
+			}
+		}
+	}
+
+	return nil
+}
+
+func (l *AuthLoginCommon) checkRequiredFields(d *schema.ResourceData, params map[string]interface{}, required ...string) error {
 	var missing []string
 	for _, f := range required {
-		if _, ok := l.getOk(d, f); !ok {
-			missing = append(missing, f)
+		if data, ok := l.getOk(d, f); !ok {
+			// if the field was unset in the config
+			if params[f] == data {
+				missing = append(missing, f)
+			}
 		}
 	}
 
diff --git a/internal/provider/auth_aws.go b/internal/provider/auth_aws.go
index d8047fd2..b148460c 100644
--- a/internal/provider/auth_aws.go
+++ b/internal/provider/auth_aws.go
@@ -15,6 +15,19 @@ import (
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 )
 
+const (
+	envVarAWSAccessKeyID           = "AWS_ACCESS_KEY_ID"
+	envVarAWSSecretAccessKey       = "AWS_SECRET_ACCESS_KEY"
+	envVarAWSSessionToken          = "AWS_SESSION_TOKEN"
+	envVarAWSProfile               = "AWS_PROFILE"
+	envVarAWSSharedCredentialsFile = "AWS_SHARED_CREDENTIALS_FILE"
+	envVarAWSWebIdentityTokenFile  = "AWS_WEB_IDENTITY_TOKEN_FILE"
+	envVarAWSRoleARN               = "AWS_ROLE_ARN"
+	envVarAWSRoleSessionName       = "AWS_ROLE_SESSION_NAME"
+	envVarAWSRegion                = "AWS_REGION"
+	envVarAWSDefaultRegion         = "AWS_DEFAULT_REGION"
+)
+
 func init() {
 	field := consts.FieldAuthLoginAWS
 	if err := globalAuthLoginRegistry.Register(field,
@@ -49,39 +62,33 @@ func GetAWSLoginSchemaResource(authField string) *schema.Resource {
 				Type:        schema.TypeString,
 				Optional:    true,
 				Description: `The AWS access key ID.`,
-				DefaultFunc: schema.EnvDefaultFunc("AWS_ACCESS_KEY_ID", nil),
 			},
 			consts.FieldAWSSecretAccessKey: {
 				Type:         schema.TypeString,
 				Optional:     true,
 				Description:  `The AWS secret access key.`,
-				DefaultFunc:  schema.EnvDefaultFunc("AWS_SECRET_ACCESS_KEY", nil),
 				RequiredWith: []string{fmt.Sprintf("%s.0.%s", authField, consts.FieldAWSAccessKeyID)},
 			},
 			consts.FieldAWSSessionToken: {
 				Type:        schema.TypeString,
 				Optional:    true,
 				Description: `The AWS session token.`,
-				DefaultFunc: schema.EnvDefaultFunc("AWS_SESSION_TOKEN", nil),
 			},
 			consts.FieldAWSProfile: {
 				Type:        schema.TypeString,
 				Optional:    true,
 				Description: `The name of the AWS profile.`,
-				DefaultFunc: schema.EnvDefaultFunc("AWS_PROFILE", nil),
 			},
 			consts.FieldAWSSharedCredentialsFile: {
 				Type:        schema.TypeString,
 				Optional:    true,
 				Description: `Path to the AWS shared credentials file.`,
-				DefaultFunc: schema.EnvDefaultFunc("AWS_SHARED_CREDENTIALS_FILE", nil),
 			},
 			consts.FieldAWSWebIdentityTokenFile: {
 				Type:     schema.TypeString,
 				Optional: true,
 				Description: `Path to the file containing an OAuth 2.0 access token or OpenID ` +
 					`Connect ID token.`,
-				DefaultFunc: schema.EnvDefaultFunc("AWS_WEB_IDENTITY_TOKEN_FILE", nil),
 			},
 			// STS assume role fields
 			consts.FieldAWSRoleARN: {
@@ -89,26 +96,17 @@ func GetAWSLoginSchemaResource(authField string) *schema.Resource {
 				Optional: true,
 				Description: `The ARN of the AWS Role to assume.` +
 					`Used during STS AssumeRole`,
-				DefaultFunc: schema.EnvDefaultFunc("AWS_ROLE_ARN", nil),
 			},
 			consts.FieldAWSRoleSessionName: {
 				Type:     schema.TypeString,
 				Optional: true,
 				Description: `Specifies the name to attach to the AWS role session. ` +
 					`Used during STS AssumeRole`,
-				DefaultFunc: schema.EnvDefaultFunc("AWS_ROLE_SESSION_NAME", nil),
 			},
 			consts.FieldAWSRegion: {
 				Type:        schema.TypeString,
 				Optional:    true,
 				Description: `The AWS region.`,
-				DefaultFunc: schema.MultiEnvDefaultFunc(
-					[]string{
-						"AWS_REGION",
-						"AWS_DEFAULT_REGION",
-					},
-					nil,
-				),
 			},
 			consts.FieldAWSSTSEndpoint: {
 				Type:             schema.TypeString,
@@ -140,9 +138,13 @@ type AuthLoginAWS struct {
 }
 
 func (l *AuthLoginAWS) Init(d *schema.ResourceData, authField string) (AuthLogin, error) {
+	defaults := l.getDefaults()
 	if err := l.AuthLoginCommon.Init(d, authField,
-		func(data *schema.ResourceData) error {
-			return l.checkRequiredFields(d, consts.FieldRole)
+		func(data *schema.ResourceData, params map[string]interface{}) error {
+			return l.setDefaultFields(d, defaults, params)
+		},
+		func(data *schema.ResourceData, params map[string]interface{}) error {
+			return l.checkRequiredFields(d, params, consts.FieldRole)
 		},
 	); err != nil {
 		return nil, err
@@ -193,6 +195,58 @@ func (l *AuthLoginAWS) Login(client *api.Client) (*api.Secret, error) {
 	return l.login(client, l.LoginPath(), params)
 }
 
+func (l *AuthLoginAWS) getDefaults() authDefaults {
+	defaults := authDefaults{
+		{
+			field:      consts.FieldAWSAccessKeyID,
+			envVars:    []string{envVarAWSAccessKeyID},
+			defaultVal: "",
+		},
+		{
+			field:      consts.FieldAWSSecretAccessKey,
+			envVars:    []string{envVarAWSSecretAccessKey},
+			defaultVal: "",
+		},
+		{
+			field:      consts.FieldAWSSessionToken,
+			envVars:    []string{envVarAWSSessionToken},
+			defaultVal: "",
+		},
+		{
+			field:      consts.FieldAWSProfile,
+			envVars:    []string{envVarAWSProfile},
+			defaultVal: "",
+		},
+		{
+			field:      consts.FieldAWSSharedCredentialsFile,
+			envVars:    []string{envVarAWSSharedCredentialsFile},
+			defaultVal: "",
+		},
+		{
+			field:      consts.FieldAWSWebIdentityTokenFile,
+			envVars:    []string{envVarAWSWebIdentityTokenFile},
+			defaultVal: "",
+		},
+		{
+			field:      consts.FieldAWSRoleARN,
+			envVars:    []string{envVarAWSRoleARN},
+			defaultVal: "",
+		},
+		{
+			field:      consts.FieldAWSRoleSessionName,
+			envVars:    []string{envVarAWSRoleSessionName},
+			defaultVal: "",
+		},
+		{
+			field:      consts.FieldAWSRegion,
+			envVars:    []string{envVarAWSRegion, envVarAWSDefaultRegion},
+			defaultVal: "",
+		},
+	}
+
+	return defaults
+}
+
 func (l *AuthLoginAWS) getLoginData(logger hclog.Logger) (map[string]interface{}, error) {
 	config, err := l.getCredentialsConfig(logger)
 	if err != nil {
diff --git a/internal/provider/auth_azure.go b/internal/provider/auth_azure.go
index ba99d37b..aa867b59 100644
--- a/internal/provider/auth_azure.go
+++ b/internal/provider/auth_azure.go
@@ -46,7 +46,6 @@ func GetAzureLoginSchemaResource(authField string) *schema.Resource {
 				Optional: true,
 				Description: "A signed JSON Web Token. If not specified on will be " +
 					"created automatically",
-				DefaultFunc: schema.EnvDefaultFunc(consts.EnvVarAzureAuthJWT, nil),
 			},
 			consts.FieldRole: {
 				Type:        schema.TypeString,
@@ -94,7 +93,6 @@ func GetAzureLoginSchemaResource(authField string) *schema.Resource {
 			consts.FieldScope: {
 				Type:          schema.TypeString,
 				Optional:      true,
-				Default:       defaultAzureScope,
 				Description:   "The scopes to include in the token request.",
 				ConflictsWith: []string{fmt.Sprintf("%s.0.%s", authField, consts.FieldJWT)},
 			},
@@ -122,12 +120,30 @@ func (l *AuthLoginAzure) LoginPath() string {
 }
 
 func (l *AuthLoginAzure) Init(d *schema.ResourceData, authField string) (AuthLogin, error) {
+	defaults := authDefaults{
+		{
+			field:      consts.FieldJWT,
+			envVars:    []string{consts.EnvVarAzureAuthJWT},
+			defaultVal: "",
+		},
+		{
+			field:      consts.FieldScope,
+			envVars:    []string{""},
+			defaultVal: defaultAzureScope,
+		},
+	}
 	if err := l.AuthLoginCommon.Init(d, authField,
-		func(data *schema.ResourceData) error {
-			err := l.checkRequiredFields(d, l.requiredParams()...)
+		func(data *schema.ResourceData, params map[string]interface{}) error {
+			err := l.setDefaultFields(d, defaults, params)
+			if err != nil {
+				return err
+			}
+
+			err = l.checkRequiredFields(d, params, l.requiredParams()...)
 			if err != nil {
 				return err
 			}
+
 			return l.checkFieldsOneOf(d, consts.FieldVMName, consts.FieldVMSSName)
 		},
 	); err != nil {
diff --git a/internal/provider/auth_cert.go b/internal/provider/auth_cert.go
index e1332e44..cfe0bb97 100644
--- a/internal/provider/auth_cert.go
+++ b/internal/provider/auth_cert.go
@@ -79,8 +79,8 @@ func (l *AuthLoginCert) LoginPath() string {
 
 func (l *AuthLoginCert) Init(d *schema.ResourceData, authField string) (AuthLogin, error) {
 	if err := l.AuthLoginCommon.Init(d, authField,
-		func(data *schema.ResourceData) error {
-			return l.checkRequiredFields(d, consts.FieldCertFile, consts.FieldKeyFile)
+		func(data *schema.ResourceData, params map[string]interface{}) error {
+			return l.checkRequiredFields(d, params, consts.FieldCertFile, consts.FieldKeyFile)
 		},
 	); err != nil {
 		return nil, err
diff --git a/internal/provider/auth_gcp.go b/internal/provider/auth_gcp.go
index 716bf17c..397ce653 100644
--- a/internal/provider/auth_gcp.go
+++ b/internal/provider/auth_gcp.go
@@ -58,7 +58,6 @@ func GetGCPLoginSchemaResource(authField string) *schema.Resource {
 				Type:          schema.TypeString,
 				Optional:      true,
 				Description:   "A signed JSON Web Token.",
-				DefaultFunc:   schema.EnvDefaultFunc(consts.EnvVarGCPAuthJWT, nil),
 				ConflictsWith: []string{fmt.Sprintf("%s.0.%s", authField, consts.FieldCredentials)},
 			},
 			consts.FieldCredentials: {
@@ -66,7 +65,6 @@ func GetGCPLoginSchemaResource(authField string) *schema.Resource {
 				Optional:      true,
 				ValidateFunc:  validateCredentials,
 				Description:   "Path to the Google Cloud credentials file.",
-				DefaultFunc:   schema.EnvDefaultFunc(consts.EnvVarGoogleApplicationCreds, nil),
 				ConflictsWith: []string{fmt.Sprintf("%s.0.%s", authField, consts.FieldJWT)},
 			},
 			consts.FieldServiceAccount: {
@@ -89,7 +87,26 @@ type AuthLoginGCP struct {
 }
 
 func (l *AuthLoginGCP) Init(d *schema.ResourceData, authField string) (AuthLogin, error) {
-	if err := l.AuthLoginCommon.Init(d, authField); err != nil {
+	defaults := authDefaults{
+		{
+			field:      consts.FieldJWT,
+			envVars:    []string{consts.EnvVarGCPAuthJWT},
+			defaultVal: "",
+		},
+		{
+			field:      consts.FieldCredentials,
+			envVars:    []string{consts.EnvVarGoogleApplicationCreds},
+			defaultVal: "",
+		},
+	}
+	if err := l.AuthLoginCommon.Init(d, authField,
+		func(data *schema.ResourceData, params map[string]interface{}) error {
+			return l.setDefaultFields(d, defaults, params)
+		},
+		func(data *schema.ResourceData, params map[string]interface{}) error {
+			return l.checkRequiredFields(d, params, consts.FieldRole)
+		},
+	); err != nil {
 		return nil, err
 	}
 	return l, nil
diff --git a/internal/provider/auth_jwt.go b/internal/provider/auth_jwt.go
index bfa74aab..2e080df6 100644
--- a/internal/provider/auth_jwt.go
+++ b/internal/provider/auth_jwt.go
@@ -42,10 +42,10 @@ func GetJWTLoginSchemaResource(authField string) *schema.Resource {
 				Description: "Name of the login role.",
 			},
 			consts.FieldJWT: {
-				Type:        schema.TypeString,
-				Required:    true,
+				Type: schema.TypeString,
+				// can be set via an env var
+				Optional:    true,
 				Description: "A signed JSON Web Token.",
-				DefaultFunc: schema.EnvDefaultFunc(consts.EnvVarVaultAuthJWT, nil),
 			},
 		},
 	}, authField, consts.MountTypeJWT)
@@ -71,9 +71,20 @@ func (l *AuthLoginJWT) LoginPath() string {
 }
 
 func (l *AuthLoginJWT) Init(d *schema.ResourceData, authField string) (AuthLogin, error) {
+	defaults := authDefaults{
+		{
+			field:      consts.FieldJWT,
+			envVars:    []string{consts.EnvVarVaultAuthJWT},
+			defaultVal: "",
+		},
+	}
+
 	if err := l.AuthLoginCommon.Init(d, authField,
-		func(data *schema.ResourceData) error {
-			return l.checkRequiredFields(d, consts.FieldRole, consts.FieldJWT)
+		func(data *schema.ResourceData, params map[string]interface{}) error {
+			return l.setDefaultFields(d, defaults, params)
+		},
+		func(data *schema.ResourceData, params map[string]interface{}) error {
+			return l.checkRequiredFields(d, params, consts.FieldRole, consts.FieldJWT)
 		},
 	); err != nil {
 		return nil, err
diff --git a/internal/provider/auth_kerberos.go b/internal/provider/auth_kerberos.go
index 9c57bd90..a0851906 100644
--- a/internal/provider/auth_kerberos.go
+++ b/internal/provider/auth_kerberos.go
@@ -45,7 +45,6 @@ func GetKerberosLoginSchemaResource(authField string) *schema.Resource {
 			consts.FieldToken: {
 				Type:         schema.TypeString,
 				Optional:     true,
-				DefaultFunc:  schema.EnvDefaultFunc(consts.EnvVarKrbSPNEGOToken, nil),
 				Description:  "Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO) token",
 				ValidateFunc: validateKRBNegToken,
 			},
@@ -71,7 +70,6 @@ func GetKerberosLoginSchemaResource(authField string) *schema.Resource {
 				Type:          schema.TypeString,
 				Optional:      true,
 				Description:   "A valid Kerberos configuration file e.g. /etc/krb5.conf.",
-				DefaultFunc:   schema.EnvDefaultFunc(consts.EnvVarKRB5Conf, nil),
 				ValidateFunc:  validateFileExists,
 				ConflictsWith: conflicts,
 			},
@@ -79,21 +77,18 @@ func GetKerberosLoginSchemaResource(authField string) *schema.Resource {
 				Type:          schema.TypeString,
 				Optional:      true,
 				Description:   "The Kerberos keytab file containing the entry of the login entity.",
-				DefaultFunc:   schema.EnvDefaultFunc(consts.EnvVarKRBKeytab, nil),
 				ValidateFunc:  validateFileExists,
 				ConflictsWith: conflicts,
 			},
 			consts.FieldDisableFastNegotiation: {
 				Type:          schema.TypeBool,
 				Optional:      true,
-				Default:       false,
 				ConflictsWith: conflicts,
 				Description:   "Disable the Kerberos FAST negotiation.",
 			},
 			consts.FieldRemoveInstanceName: {
 				Type:          schema.TypeBool,
 				Optional:      true,
-				Default:       false,
 				ConflictsWith: conflicts,
 				Description:   "Strip the host from the username found in the keytab.",
 			},
@@ -125,16 +120,31 @@ func (l *AuthLoginKerberos) LoginPath() string {
 }
 
 func (l *AuthLoginKerberos) Init(d *schema.ResourceData, authField string) (AuthLogin, error) {
+	defaults := authDefaults{
+		{
+			field:      consts.FieldToken,
+			envVars:    []string{consts.EnvVarKrbSPNEGOToken},
+			defaultVal: "",
+		},
+		{
+			field:      consts.FieldKRB5ConfPath,
+			envVars:    []string{consts.EnvVarKRB5Conf},
+			defaultVal: "",
+		},
+		{
+			field:      consts.FieldKeytabPath,
+			envVars:    []string{consts.EnvVarKRBKeytab},
+			defaultVal: "",
+		},
+	}
+
 	if err := l.AuthLoginCommon.Init(d, authField,
-		func(data *schema.ResourceData) error {
+		func(data *schema.ResourceData, params map[string]interface{}) error {
+			return l.setDefaultFields(d, defaults, params)
+		},
+		func(data *schema.ResourceData, params map[string]interface{}) error {
 			if _, ok := l.getOk(d, consts.FieldToken); !ok {
-				return l.checkRequiredFields(d,
-					consts.FieldUsername,
-					consts.FieldService,
-					consts.FieldRealm,
-					consts.FieldKeytabPath,
-					consts.FieldKRB5ConfPath,
-				)
+				return l.checkRequiredFields(d, params, consts.FieldUsername, consts.FieldService, consts.FieldRealm, consts.FieldKeytabPath, consts.FieldKRB5ConfPath)
 			}
 			return nil
 		},
diff --git a/internal/provider/auth_oci.go b/internal/provider/auth_oci.go
index eb61faa9..057a6171 100644
--- a/internal/provider/auth_oci.go
+++ b/internal/provider/auth_oci.go
@@ -85,8 +85,8 @@ func (l *AuthLoginOCI) LoginPath() string {
 
 func (l *AuthLoginOCI) Init(d *schema.ResourceData, authField string) (AuthLogin, error) {
 	if err := l.AuthLoginCommon.Init(d, authField,
-		func(data *schema.ResourceData) error {
-			return l.checkRequiredFields(d, consts.FieldRole, consts.FieldAuthType)
+		func(data *schema.ResourceData, params map[string]interface{}) error {
+			return l.checkRequiredFields(d, params, consts.FieldRole, consts.FieldAuthType)
 		},
 	); err != nil {
 		return nil, err
diff --git a/internal/provider/auth_oidc.go b/internal/provider/auth_oidc.go
index d7df69b5..d92f6c46 100644
--- a/internal/provider/auth_oidc.go
+++ b/internal/provider/auth_oidc.go
@@ -86,8 +86,8 @@ func (l *AuthLoginOIDC) LoginPath() string {
 
 func (l *AuthLoginOIDC) Init(d *schema.ResourceData, authField string) (AuthLogin, error) {
 	if err := l.AuthLoginCommon.Init(d, authField,
-		func(data *schema.ResourceData) error {
-			return l.checkRequiredFields(d, consts.FieldRole)
+		func(data *schema.ResourceData, params map[string]interface{}) error {
+			return l.checkRequiredFields(d, params, consts.FieldRole)
 		},
 	); err != nil {
 		return nil, err
diff --git a/internal/provider/auth_radius.go b/internal/provider/auth_radius.go
index 3b6b514e..bf4effa6 100644
--- a/internal/provider/auth_radius.go
+++ b/internal/provider/auth_radius.go
@@ -39,14 +39,14 @@ func GetRadiusLoginSchemaResource(authField string) *schema.Resource {
 			consts.FieldUsername: {
 				Type:        schema.TypeString,
 				Description: "The Radius username.",
-				Required:    true,
-				DefaultFunc: schema.EnvDefaultFunc(consts.EnvVarRadiusUsername, nil),
+				// can be set via an env var
+				Optional: true,
 			},
 			consts.FieldPassword: {
-				Type:        schema.TypeString,
-				Required:    true,
+				Type: schema.TypeString,
+				// can be set via an env var
+				Optional:    true,
 				Description: "The Radius password for username.",
-				DefaultFunc: schema.EnvDefaultFunc(consts.EnvVarRadiusPassword, nil),
 			},
 		},
 	}, authField, consts.MountTypeRadius)
@@ -72,9 +72,24 @@ func (l *AuthLoginRadius) LoginPath() string {
 }
 
 func (l *AuthLoginRadius) Init(d *schema.ResourceData, authField string) (AuthLogin, error) {
+	defaults := authDefaults{
+		{
+			field:      consts.FieldUsername,
+			envVars:    []string{consts.EnvVarRadiusUsername},
+			defaultVal: "",
+		},
+		{
+			field:      consts.FieldPassword,
+			envVars:    []string{consts.EnvVarRadiusPassword},
+			defaultVal: "",
+		},
+	}
 	if err := l.AuthLoginCommon.Init(d, authField,
-		func(data *schema.ResourceData) error {
-			return l.checkRequiredFields(d, consts.FieldUsername, consts.FieldPassword)
+		func(data *schema.ResourceData, params map[string]interface{}) error {
+			return l.setDefaultFields(d, defaults, params)
+		},
+		func(data *schema.ResourceData, params map[string]interface{}) error {
+			return l.checkRequiredFields(d, params, consts.FieldUsername, consts.FieldPassword)
 		},
 	); err != nil {
 		return nil, err
diff --git a/internal/provider/auth_token_file.go b/internal/provider/auth_token_file.go
index 4c7a6ba0..592c58a4 100644
--- a/internal/provider/auth_token_file.go
+++ b/internal/provider/auth_token_file.go
@@ -41,9 +41,9 @@ func GetTokenFileSchemaResource(authField string) *schema.Resource {
 	return mustAddLoginSchema(&schema.Resource{
 		Schema: map[string]*schema.Schema{
 			consts.FieldFilename: {
-				Type:        schema.TypeString,
-				Required:    true,
-				DefaultFunc: schema.EnvDefaultFunc(consts.EnvVarTokenFilename, nil),
+				Type: schema.TypeString,
+				// can be set via an env var
+				Optional: true,
 				Description: "The name of a file containing a single " +
 					"line that is a valid Vault token",
 			},
@@ -72,9 +72,19 @@ func (l *AuthLoginTokenFile) Init(d *schema.ResourceData,
 ) (AuthLogin, error) {
 	l.mount = consts.MountTypeNone
 
+	defaults := authDefaults{
+		{
+			field:      consts.FieldFilename,
+			envVars:    []string{consts.EnvVarTokenFilename},
+			defaultVal: "",
+		},
+	}
 	if err := l.AuthLoginCommon.Init(d, authField,
-		func(data *schema.ResourceData) error {
-			return l.checkRequiredFields(d, consts.FieldFilename)
+		func(data *schema.ResourceData, params map[string]interface{}) error {
+			return l.setDefaultFields(d, defaults, params)
+		},
+		func(data *schema.ResourceData, params map[string]interface{}) error {
+			return l.checkRequiredFields(d, params, consts.FieldFilename)
 		},
 	); err != nil {
 		return nil, err
diff --git a/internal/provider/auth_userpass.go b/internal/provider/auth_userpass.go
index c7c82e42..d4e31523 100644
--- a/internal/provider/auth_userpass.go
+++ b/internal/provider/auth_userpass.go
@@ -40,22 +40,20 @@ func GetUserpassLoginSchemaResource(authField string) *schema.Resource {
 	return mustAddLoginSchema(&schema.Resource{
 		Schema: map[string]*schema.Schema{
 			consts.FieldUsername: {
-				Type:        schema.TypeString,
-				Required:    true,
+				Type: schema.TypeString,
+				// can be set via an env var
+				Optional:    true,
 				Description: "Login with username",
-				DefaultFunc: schema.EnvDefaultFunc(consts.EnvVarUsername, nil),
 			},
 			consts.FieldPassword: {
 				Type:        schema.TypeString,
 				Optional:    true,
 				Description: "Login with password",
-				DefaultFunc: schema.EnvDefaultFunc(consts.EnvVarPassword, nil),
 			},
 			consts.FieldPasswordFile: {
 				Type:        schema.TypeString,
 				Optional:    true,
 				Description: "Login with password from a file",
-				DefaultFunc: schema.EnvDefaultFunc(consts.EnvVarPasswordFile, nil),
 				// unfortunately the SDK does support conflicting relative fields
 				// within a list type. As long as the top level schema does not change
 				// we should be good to hard code fully qualified path like so.
@@ -77,9 +75,30 @@ type AuthLoginUserpass struct {
 }
 
 func (l *AuthLoginUserpass) Init(d *schema.ResourceData, authField string) (AuthLogin, error) {
+	defaults := authDefaults{
+		{
+			field:      consts.FieldUsername,
+			envVars:    []string{consts.EnvVarUsername},
+			defaultVal: "",
+		},
+		{
+			field:      consts.FieldPassword,
+			envVars:    []string{consts.EnvVarPassword},
+			defaultVal: "",
+		},
+		{
+			field:      consts.FieldPasswordFile,
+			envVars:    []string{consts.EnvVarPasswordFile},
+			defaultVal: "",
+		},
+	}
+
 	if err := l.AuthLoginCommon.Init(d, authField,
-		func(data *schema.ResourceData) error {
-			return l.checkRequiredFields(d, consts.FieldUsername)
+		func(data *schema.ResourceData, params map[string]interface{}) error {
+			return l.setDefaultFields(d, defaults, params)
+		},
+		func(data *schema.ResourceData, params map[string]interface{}) error {
+			return l.checkRequiredFields(d, params, consts.FieldUsername)
 		},
 	); err != nil {
 		return nil, err
diff --git a/internal/provider/fwprovider/auth.go b/internal/provider/fwprovider/auth.go
new file mode 100644
index 00000000..f2b7c37e
--- /dev/null
+++ b/internal/provider/fwprovider/auth.go
@@ -0,0 +1,64 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package fwprovider
+
+import (
+	"fmt"
+
+	"github.com/hashicorp/terraform-plugin-framework-validators/boolvalidator"
+	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/provider/schema"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+	"github.com/hashicorp/terraform-provider-vault/internal/consts"
+	"github.com/hashicorp/terraform-provider-vault/internal/framework/validators"
+)
+
+func mustAddLoginSchema(s *schema.ListNestedBlock, defaultMount string) schema.Block {
+	m := map[string]schema.Attribute{
+		consts.FieldNamespace: schema.StringAttribute{
+			Optional: true,
+			Description: fmt.Sprintf(
+				"The authentication engine's namespace. Conflicts with %s",
+				consts.FieldUseRootNamespace,
+			),
+			Validators: []validator.String{
+				stringvalidator.ConflictsWith(
+					path.MatchRelative().AtParent().AtName(consts.FieldUseRootNamespace),
+				),
+			},
+		},
+		consts.FieldUseRootNamespace: schema.BoolAttribute{
+			Optional: true,
+			Description: fmt.Sprintf(
+				"Authenticate to the root Vault namespace. Conflicts with %s",
+				consts.FieldNamespace,
+			),
+			Validators: []validator.Bool{
+				boolvalidator.ConflictsWith(
+					path.MatchRelative().AtParent().AtName(consts.FieldUseRootNamespace),
+				),
+			},
+		},
+	}
+	if defaultMount != consts.MountTypeNone {
+		m[consts.FieldMount] = &schema.StringAttribute{
+			Optional:    true,
+			Description: "The path where the authentication engine is mounted.",
+			Validators: []validator.String{
+				validators.PathValidator(),
+			},
+		}
+	}
+
+	for k, v := range m {
+		if _, ok := s.NestedObject.Attributes[k]; ok {
+			panic(fmt.Sprintf("cannot add schema field %q,  already exists in the Schema map", k))
+		}
+
+		s.NestedObject.Attributes[k] = v
+	}
+
+	return s
+}
diff --git a/internal/provider/fwprovider/auth_aws.go b/internal/provider/fwprovider/auth_aws.go
new file mode 100644
index 00000000..ce80e0ce
--- /dev/null
+++ b/internal/provider/fwprovider/auth_aws.go
@@ -0,0 +1,85 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package fwprovider
+
+import (
+	"github.com/hashicorp/terraform-plugin-framework/provider/schema"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+
+	"github.com/hashicorp/terraform-provider-vault/internal/consts"
+	"github.com/hashicorp/terraform-provider-vault/internal/framework/validators"
+)
+
+func AuthLoginAWSSchema() schema.Block {
+	return mustAddLoginSchema(&schema.ListNestedBlock{
+		Description: "Login to vault using the AWS method",
+		NestedObject: schema.NestedBlockObject{
+			Attributes: map[string]schema.Attribute{
+				consts.FieldRole: schema.StringAttribute{
+					Required:    true,
+					Description: `The Vault role to use when logging into Vault.`,
+				},
+				// static credential fields
+				consts.FieldAWSAccessKeyID: schema.StringAttribute{
+					Optional:    true,
+					Description: `The AWS access key ID.`,
+				},
+				consts.FieldAWSSecretAccessKey: schema.StringAttribute{
+					Optional:    true,
+					Description: `The AWS secret access key.`,
+				},
+				consts.FieldAWSSessionToken: schema.StringAttribute{
+					Optional:    true,
+					Description: `The AWS session token.`,
+				},
+				consts.FieldAWSProfile: schema.StringAttribute{
+					Optional:    true,
+					Description: `The name of the AWS profile.`,
+				},
+				consts.FieldAWSSharedCredentialsFile: schema.StringAttribute{
+					Optional:    true,
+					Description: `Path to the AWS shared credentials file.`,
+				},
+				consts.FieldAWSWebIdentityTokenFile: schema.StringAttribute{
+					Optional: true,
+					Description: `Path to the file containing an OAuth 2.0 access token or OpenID ` +
+						`Connect ID token.`,
+				},
+				// STS assume role fields
+				consts.FieldAWSRoleARN: schema.StringAttribute{
+					Optional: true,
+					Description: `The ARN of the AWS Role to assume.` +
+						`Used during STS AssumeRole`,
+				},
+				consts.FieldAWSRoleSessionName: schema.StringAttribute{
+					Optional: true,
+					Description: `Specifies the name to attach to the AWS role session. ` +
+						`Used during STS AssumeRole`,
+				},
+				consts.FieldAWSRegion: schema.StringAttribute{
+					Optional:    true,
+					Description: `The AWS region.`,
+				},
+				consts.FieldAWSSTSEndpoint: schema.StringAttribute{
+					Optional:    true,
+					Description: `The STS endpoint URL.`,
+					Validators: []validator.String{
+						validators.URIValidator([]string{"http", "https"}),
+					},
+				},
+				consts.FieldAWSIAMEndpoint: schema.StringAttribute{
+					Optional:    true,
+					Description: `The IAM endpoint URL.`,
+					Validators: []validator.String{
+						validators.URIValidator([]string{"http", "https"}),
+					},
+				},
+				consts.FieldHeaderValue: schema.StringAttribute{
+					Optional:    true,
+					Description: `The Vault header value to include in the STS signing request.`,
+				},
+			},
+		},
+	}, consts.MountTypeAWS)
+}
diff --git a/internal/provider/fwprovider/auth_azure.go b/internal/provider/fwprovider/auth_azure.go
new file mode 100644
index 00000000..cb1b6e7b
--- /dev/null
+++ b/internal/provider/fwprovider/auth_azure.go
@@ -0,0 +1,85 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package fwprovider
+
+import (
+	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/provider/schema"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+
+	"github.com/hashicorp/terraform-provider-vault/internal/consts"
+)
+
+func AuthLoginAzureSchema() schema.Block {
+	return mustAddLoginSchema(&schema.ListNestedBlock{
+		Description: "Login to vault using the azure method",
+		NestedObject: schema.NestedBlockObject{
+			Attributes: map[string]schema.Attribute{
+				consts.FieldJWT: schema.StringAttribute{
+					Optional: true,
+					Description: "A signed JSON Web Token. If not specified on will be " +
+						"created automatically",
+				},
+				consts.FieldRole: schema.StringAttribute{
+					Required:    true,
+					Description: "Name of the login role.",
+				},
+				consts.FieldSubscriptionID: schema.StringAttribute{
+					Required: true,
+					Description: "The subscription ID for the machine that generated the MSI token. " +
+						"This information can be obtained through instance metadata.",
+				},
+				consts.FieldResourceGroupName: schema.StringAttribute{
+					Required: true,
+					Description: "The resource group for the machine that generated the MSI token. " +
+						"This information can be obtained through instance metadata.",
+				},
+				consts.FieldVMName: schema.StringAttribute{
+					Optional: true,
+					Description: "The virtual machine name for the machine that generated the MSI token. " +
+						"This information can be obtained through instance metadata.",
+				},
+				consts.FieldVMSSName: schema.StringAttribute{
+					Optional: true,
+					Description: "The virtual machine scale set name for the machine that generated " +
+						"the MSI token. This information can be obtained through instance metadata.",
+					Validators: []validator.String{
+						stringvalidator.ConflictsWith(
+							path.MatchRelative().AtName(consts.FieldVMName),
+						),
+					},
+				},
+				consts.FieldTenantID: schema.StringAttribute{
+					Optional: true,
+					Description: "Provides the tenant ID to use in a multi-tenant " +
+						"authentication scenario.",
+					Validators: []validator.String{
+						stringvalidator.ConflictsWith(
+							path.MatchRelative().AtName(consts.FieldJWT),
+						),
+					},
+				},
+				consts.FieldClientID: schema.StringAttribute{
+					Optional:    true,
+					Description: "The identity's client ID.",
+					Validators: []validator.String{
+						stringvalidator.ConflictsWith(
+							path.MatchRelative().AtName(consts.FieldJWT),
+						),
+					},
+				},
+				consts.FieldScope: schema.StringAttribute{
+					Optional:    true,
+					Description: "The scopes to include in the token request.",
+					Validators: []validator.String{
+						stringvalidator.ConflictsWith(
+							path.MatchRelative().AtName(consts.FieldJWT),
+						),
+					},
+				},
+			},
+		},
+	}, consts.MountTypeAzure)
+}
diff --git a/internal/provider/fwprovider/auth_cert.go b/internal/provider/fwprovider/auth_cert.go
new file mode 100644
index 00000000..1cf514cc
--- /dev/null
+++ b/internal/provider/fwprovider/auth_cert.go
@@ -0,0 +1,32 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package fwprovider
+
+import (
+	"github.com/hashicorp/terraform-plugin-framework/provider/schema"
+
+	"github.com/hashicorp/terraform-provider-vault/internal/consts"
+)
+
+func AuthLoginCertSchema() schema.Block {
+	return mustAddLoginSchema(&schema.ListNestedBlock{
+		Description: "Login to vault using the cert method",
+		NestedObject: schema.NestedBlockObject{
+			Attributes: map[string]schema.Attribute{
+				consts.FieldName: schema.StringAttribute{
+					Optional:    true,
+					Description: "Name of the certificate's role",
+				},
+				consts.FieldCertFile: schema.StringAttribute{
+					Required:    true,
+					Description: "Path to a file containing the client certificate.",
+				},
+				consts.FieldKeyFile: schema.StringAttribute{
+					Required:    true,
+					Description: "Path to a file containing the private key that the certificate was issued for.",
+				},
+			},
+		},
+	}, consts.MountTypeCert)
+}
diff --git a/internal/provider/fwprovider/auth_gcp.go b/internal/provider/fwprovider/auth_gcp.go
new file mode 100644
index 00000000..76485bf8
--- /dev/null
+++ b/internal/provider/fwprovider/auth_gcp.go
@@ -0,0 +1,57 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package fwprovider
+
+import (
+	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/provider/schema"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+
+	"github.com/hashicorp/terraform-provider-vault/internal/consts"
+	"github.com/hashicorp/terraform-provider-vault/internal/framework/validators"
+)
+
+func AuthLoginGCPSchema() schema.Block {
+	return mustAddLoginSchema(&schema.ListNestedBlock{
+		Description: "Login to vault using the gcp method",
+		NestedObject: schema.NestedBlockObject{
+			Attributes: map[string]schema.Attribute{
+				consts.FieldRole: schema.StringAttribute{
+					Required:    true,
+					Description: "Name of the login role.",
+				},
+				consts.FieldJWT: schema.StringAttribute{
+					Optional:    true,
+					Description: "A signed JSON Web Token.",
+					Validators: []validator.String{
+						stringvalidator.ConflictsWith(
+							path.MatchRelative().AtName(consts.FieldCredentials),
+						),
+					},
+				},
+				consts.FieldCredentials: schema.StringAttribute{
+					Optional:    true,
+					Description: "Path to the Google Cloud credentials file.",
+					Validators: []validator.String{
+						stringvalidator.ConflictsWith(
+							path.MatchRelative().AtName(consts.FieldJWT),
+						),
+						stringvalidator.LengthAtLeast(1),
+						validators.GCPCredentialsValidator(),
+					},
+				},
+				consts.FieldServiceAccount: schema.StringAttribute{
+					Optional:    true,
+					Description: "IAM service account.",
+					Validators: []validator.String{
+						stringvalidator.ConflictsWith(
+							path.MatchRelative().AtName(consts.FieldJWT),
+						),
+					},
+				},
+			},
+		},
+	}, consts.MountTypeGCP)
+}
diff --git a/internal/provider/fwprovider/auth_generic.go b/internal/provider/fwprovider/auth_generic.go
new file mode 100644
index 00000000..7f91240b
--- /dev/null
+++ b/internal/provider/fwprovider/auth_generic.go
@@ -0,0 +1,32 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package fwprovider
+
+import (
+	"github.com/hashicorp/terraform-plugin-framework/provider/schema"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+
+	"github.com/hashicorp/terraform-provider-vault/internal/consts"
+)
+
+func AuthLoginGenericSchema() schema.Block {
+	return mustAddLoginSchema(&schema.ListNestedBlock{
+		Description: "Login to vault with an existing auth method using auth/<mount>/login",
+		NestedObject: schema.NestedBlockObject{
+			Attributes: map[string]schema.Attribute{
+				consts.FieldPath: schema.StringAttribute{
+					Required: true,
+				},
+				consts.FieldParameters: schema.MapAttribute{
+					Optional:    true,
+					ElementType: types.StringType,
+					Sensitive:   true,
+				},
+				consts.FieldMethod: schema.StringAttribute{
+					Optional: true,
+				},
+			},
+		},
+	}, consts.MountTypeNone)
+}
diff --git a/internal/provider/fwprovider/auth_jwt.go b/internal/provider/fwprovider/auth_jwt.go
new file mode 100644
index 00000000..5fa2b418
--- /dev/null
+++ b/internal/provider/fwprovider/auth_jwt.go
@@ -0,0 +1,29 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package fwprovider
+
+import (
+	"github.com/hashicorp/terraform-plugin-framework/provider/schema"
+
+	"github.com/hashicorp/terraform-provider-vault/internal/consts"
+)
+
+func AuthLoginJWTSchema() schema.Block {
+	return mustAddLoginSchema(&schema.ListNestedBlock{
+		Description: "Login to vault using the jwt method",
+		NestedObject: schema.NestedBlockObject{
+			Attributes: map[string]schema.Attribute{
+				consts.FieldRole: schema.StringAttribute{
+					Required:    true,
+					Description: "Name of the login role.",
+				},
+				consts.FieldJWT: schema.StringAttribute{
+					// can be set via an env var
+					Optional:    true,
+					Description: "A signed JSON Web Token.",
+				},
+			},
+		},
+	}, consts.MountTypeJWT)
+}
diff --git a/internal/provider/fwprovider/auth_kerberos.go b/internal/provider/fwprovider/auth_kerberos.go
new file mode 100644
index 00000000..a4ff6ad0
--- /dev/null
+++ b/internal/provider/fwprovider/auth_kerberos.go
@@ -0,0 +1,97 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package fwprovider
+
+import (
+	"github.com/hashicorp/terraform-plugin-framework-validators/boolvalidator"
+	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/provider/schema"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+
+	"github.com/hashicorp/terraform-provider-vault/internal/consts"
+	"github.com/hashicorp/terraform-provider-vault/internal/framework/validators"
+)
+
+func AuthLoginKerberosSchema() schema.Block {
+	return mustAddLoginSchema(&schema.ListNestedBlock{
+		Description: "Login to vault using the kerberos method",
+		NestedObject: schema.NestedBlockObject{
+			Attributes: map[string]schema.Attribute{
+				consts.FieldToken: schema.StringAttribute{
+					Optional:    true,
+					Description: "Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO) token",
+					Validators: []validator.String{
+						validators.KRBNegTokenValidator(),
+					},
+				},
+				consts.FieldUsername: schema.StringAttribute{
+					Optional:    true,
+					Description: "The username to login into Kerberos with.",
+					Validators: []validator.String{
+						stringvalidator.ConflictsWith(
+							path.MatchRelative().AtName(consts.FieldToken),
+						),
+					},
+				},
+				consts.FieldService: schema.StringAttribute{
+					Optional:    true,
+					Description: "The service principle name.",
+					Validators: []validator.String{
+						stringvalidator.ConflictsWith(
+							path.MatchRelative().AtName(consts.FieldToken),
+						),
+					},
+				},
+				consts.FieldRealm: schema.StringAttribute{
+					Optional:    true,
+					Description: "The Kerberos server's authoritative authentication domain",
+					Validators: []validator.String{
+						stringvalidator.ConflictsWith(
+							path.MatchRelative().AtName(consts.FieldToken),
+						),
+					},
+				},
+				consts.FieldKRB5ConfPath: schema.StringAttribute{
+					Optional:    true,
+					Description: "A valid Kerberos configuration file e.g. /etc/krb5.conf.",
+					Validators: []validator.String{
+						validators.FileExistsValidator(),
+						stringvalidator.ConflictsWith(
+							path.MatchRelative().AtName(consts.FieldToken),
+						),
+					},
+				},
+				consts.FieldKeytabPath: schema.StringAttribute{
+					Optional:    true,
+					Description: "The Kerberos keytab file containing the entry of the login entity.",
+					Validators: []validator.String{
+						validators.FileExistsValidator(),
+						stringvalidator.ConflictsWith(
+							path.MatchRelative().AtName(consts.FieldToken),
+						),
+					},
+				},
+				consts.FieldDisableFastNegotiation: schema.BoolAttribute{
+					Optional: true,
+					Validators: []validator.Bool{
+						boolvalidator.ConflictsWith(
+							path.MatchRelative().AtName(consts.FieldToken),
+						),
+					},
+					Description: "Disable the Kerberos FAST negotiation.",
+				},
+				consts.FieldRemoveInstanceName: schema.BoolAttribute{
+					Optional: true,
+					Validators: []validator.Bool{
+						boolvalidator.ConflictsWith(
+							path.MatchRelative().AtName(consts.FieldToken),
+						),
+					},
+					Description: "Strip the host from the username found in the keytab.",
+				},
+			},
+		},
+	}, consts.MountTypeKerberos)
+}
diff --git a/internal/provider/fwprovider/auth_oci.go b/internal/provider/fwprovider/auth_oci.go
new file mode 100644
index 00000000..de1bbe21
--- /dev/null
+++ b/internal/provider/fwprovider/auth_oci.go
@@ -0,0 +1,38 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package fwprovider
+
+import (
+	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
+	"github.com/hashicorp/terraform-plugin-framework/provider/schema"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+
+	"github.com/hashicorp/terraform-provider-vault/internal/consts"
+)
+
+const (
+	ociAuthTypeInstance = "instance"
+	ociAuthTypeAPIKeys  = "apikey"
+)
+
+func AuthLoginOCISchema() schema.Block {
+	return mustAddLoginSchema(&schema.ListNestedBlock{
+		Description: "Login to vault using the OCI method",
+		NestedObject: schema.NestedBlockObject{
+			Attributes: map[string]schema.Attribute{
+				consts.FieldRole: schema.StringAttribute{
+					Required:    true,
+					Description: "Name of the login role.",
+				},
+				consts.FieldAuthType: schema.StringAttribute{
+					Required:    true,
+					Description: "Authentication type to use when getting OCI credentials.",
+					Validators: []validator.String{
+						stringvalidator.OneOf([]string{ociAuthTypeInstance, ociAuthTypeAPIKeys}...),
+					},
+				},
+			},
+		},
+	}, consts.MountTypeOCI)
+}
diff --git a/internal/provider/fwprovider/auth_oidc.go b/internal/provider/fwprovider/auth_oidc.go
new file mode 100644
index 00000000..9c9413d9
--- /dev/null
+++ b/internal/provider/fwprovider/auth_oidc.go
@@ -0,0 +1,41 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package fwprovider
+
+import (
+	"github.com/hashicorp/terraform-plugin-framework/provider/schema"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+
+	"github.com/hashicorp/terraform-provider-vault/internal/consts"
+	"github.com/hashicorp/terraform-provider-vault/internal/framework/validators"
+)
+
+func AuthLoginOIDCSchema() schema.Block {
+	return mustAddLoginSchema(&schema.ListNestedBlock{
+		Description: "Login to vault using the oidc method",
+		NestedObject: schema.NestedBlockObject{
+			Attributes: map[string]schema.Attribute{
+				consts.FieldRole: schema.StringAttribute{
+					Required:    true,
+					Description: "Name of the login role.",
+				},
+
+				consts.FieldCallbackListenerAddress: schema.StringAttribute{
+					Optional:    true,
+					Description: "The callback listener's address. Must be a valid URI without the path.",
+					Validators: []validator.String{
+						validators.URIValidator([]string{"tcp"}),
+					},
+				},
+				consts.FieldCallbackAddress: schema.StringAttribute{
+					Optional:    true,
+					Description: "The callback address. Must be a valid URI without the path.",
+					Validators: []validator.String{
+						validators.URIValidator([]string{"http", "https"}),
+					},
+				},
+			},
+		},
+	}, consts.MountTypeOIDC)
+}
diff --git a/internal/provider/fwprovider/auth_radius.go b/internal/provider/fwprovider/auth_radius.go
new file mode 100644
index 00000000..83de6aaf
--- /dev/null
+++ b/internal/provider/fwprovider/auth_radius.go
@@ -0,0 +1,30 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package fwprovider
+
+import (
+	"github.com/hashicorp/terraform-plugin-framework/provider/schema"
+
+	"github.com/hashicorp/terraform-provider-vault/internal/consts"
+)
+
+func AuthLoginRadiusSchema() schema.Block {
+	return mustAddLoginSchema(&schema.ListNestedBlock{
+		Description: "Login to vault using the radius method",
+		NestedObject: schema.NestedBlockObject{
+			Attributes: map[string]schema.Attribute{
+				consts.FieldUsername: schema.StringAttribute{
+					Description: "The Radius username.",
+					// can be set via an env var
+					Optional: true,
+				},
+				consts.FieldPassword: schema.StringAttribute{
+					// can be set via an env var
+					Optional:    true,
+					Description: "The Radius password for username.",
+				},
+			},
+		},
+	}, consts.MountTypeRadius)
+}
diff --git a/internal/provider/fwprovider/auth_token_file.go b/internal/provider/fwprovider/auth_token_file.go
new file mode 100644
index 00000000..d5d447f9
--- /dev/null
+++ b/internal/provider/fwprovider/auth_token_file.go
@@ -0,0 +1,25 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package fwprovider
+
+import (
+	"github.com/hashicorp/terraform-plugin-framework/provider/schema"
+	"github.com/hashicorp/terraform-provider-vault/internal/consts"
+)
+
+func AuthLoginTokenFileSchema() schema.Block {
+	return mustAddLoginSchema(&schema.ListNestedBlock{
+		Description: "Login to vault using ",
+		NestedObject: schema.NestedBlockObject{
+			Attributes: map[string]schema.Attribute{
+				consts.FieldFilename: schema.StringAttribute{
+					// can be set via an env var
+					Optional: true,
+					Description: "The name of a file containing a single " +
+						"line that is a valid Vault token",
+				},
+			},
+		},
+	}, consts.MountTypeNone)
+}
diff --git a/internal/provider/fwprovider/auth_userpass.go b/internal/provider/fwprovider/auth_userpass.go
new file mode 100644
index 00000000..2815c9f4
--- /dev/null
+++ b/internal/provider/fwprovider/auth_userpass.go
@@ -0,0 +1,41 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package fwprovider
+
+import (
+	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/provider/schema"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+
+	"github.com/hashicorp/terraform-provider-vault/internal/consts"
+)
+
+func AuthLoginUserpassSchema() schema.Block {
+	return mustAddLoginSchema(&schema.ListNestedBlock{
+		Description: "Login to vault using the userpass method",
+		NestedObject: schema.NestedBlockObject{
+			Attributes: map[string]schema.Attribute{
+				consts.FieldUsername: schema.StringAttribute{
+					// can be set via an env var
+					Optional:    true,
+					Description: "Login with username",
+				},
+				consts.FieldPassword: schema.StringAttribute{
+					Optional:    true,
+					Description: "Login with password",
+				},
+				consts.FieldPasswordFile: schema.StringAttribute{
+					Optional:    true,
+					Description: "Login with password from a file",
+					Validators: []validator.String{
+						stringvalidator.ConflictsWith(
+							path.MatchRelative().AtName(consts.FieldPassword),
+						),
+					},
+				},
+			},
+		},
+	}, consts.MountTypeUserpass)
+}
diff --git a/internal/provider/fwprovider/provider.go b/internal/provider/fwprovider/provider.go
new file mode 100644
index 00000000..8bc4b9b4
--- /dev/null
+++ b/internal/provider/fwprovider/provider.go
@@ -0,0 +1,245 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package fwprovider
+
+import (
+	"context"
+	"fmt"
+	"github.com/hashicorp/terraform-plugin-framework-validators/listvalidator"
+	"github.com/hashicorp/terraform-plugin-framework/ephemeral"
+	ephemeralsecrets "github.com/hashicorp/terraform-provider-vault/internal/vault/secrets/ephemeral"
+	"regexp"
+
+	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
+	"github.com/hashicorp/terraform-plugin-framework/datasource"
+	"github.com/hashicorp/terraform-plugin-framework/provider"
+	"github.com/hashicorp/terraform-plugin-framework/provider/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+
+	"github.com/hashicorp/terraform-provider-vault/internal/consts"
+	sdkv2provider "github.com/hashicorp/terraform-provider-vault/internal/provider"
+	"github.com/hashicorp/terraform-provider-vault/internal/vault/sys"
+)
+
+var _ provider.ProviderWithEphemeralResources = &fwprovider{}
+
+// Ensure the implementation satisfies the provider.Provider interface
+var _ provider.Provider = &fwprovider{}
+
+// New returns a new, initialized Terraform Plugin Framework-style provider instance.
+//
+// The provider instance is fully configured once the `Configure` method has been called.
+func New(primary interface{ Meta() interface{} }) provider.Provider {
+	return &fwprovider{
+		Primary: primary,
+	}
+}
+
+// Provider implements the terraform-plugin-framework's provider.Provider
+// interface
+//
+// See: https://developer.hashicorp.com/terraform/plugin/framework
+type fwprovider struct {
+	Primary interface{ Meta() interface{} }
+}
+
+// Metadata returns the metadata for the provider, such as a type name and
+// version data.
+func (p *fwprovider) Metadata(ctx context.Context, req provider.MetadataRequest, resp *provider.MetadataResponse) {
+	resp.TypeName = "vault"
+	// TODO: inject provider version during build time
+	// resp.Version = "0.0.0-dev"
+}
+
+// Schema returns the schema for this provider's configuration.
+//
+// Schema is called during validate, plan and apply.
+func (p *fwprovider) Schema(ctx context.Context, req provider.SchemaRequest, resp *provider.SchemaResponse) {
+	// This schema must match exactly to the SDKv2 provider's schema
+	resp.Schema = schema.Schema{
+		Attributes: map[string]schema.Attribute{
+			// Not `Required` but must be set via config or env. Otherwise we
+			// return an error.
+			consts.FieldAddress: schema.StringAttribute{
+				Optional:    true,
+				Description: "URL of the root of the target Vault server.",
+			},
+			"add_address_to_env": schema.StringAttribute{
+				Optional:    true,
+				Description: "If true, adds the value of the `address` argument to the Terraform process environment.",
+			},
+			// Not `Required` but must be set via config, env, or token helper.
+			// Otherwise we return an error.
+			"token": schema.StringAttribute{
+				Optional:    true,
+				Description: "Token to use to authenticate to Vault.",
+			},
+			"token_name": schema.StringAttribute{
+				Optional:    true,
+				Description: "Token name to use for creating the Vault child token.",
+			},
+			"skip_child_token": schema.BoolAttribute{
+				Optional: true,
+
+				// Setting to true will cause max_lease_ttl_seconds and token_name to be ignored (not used).
+				// Note that this is strongly discouraged due to the potential of exposing sensitive secret data.
+				Description: "Set this to true to prevent the creation of ephemeral child token used by this provider.",
+			},
+			consts.FieldCACertFile: schema.StringAttribute{
+				Optional:    true,
+				Description: "Path to a CA certificate file to validate the server's certificate.",
+			},
+			consts.FieldCACertDir: schema.StringAttribute{
+				Optional:    true,
+				Description: "Path to directory containing CA certificate files to validate the server's certificate.",
+			},
+			consts.FieldSkipTLSVerify: schema.BoolAttribute{
+				Optional:    true,
+				Description: "Set this to true only if the target Vault server is an insecure development instance.",
+			},
+			consts.FieldTLSServerName: schema.StringAttribute{
+				Optional:    true,
+				Description: "Name to use as the SNI host when connecting via TLS.",
+			},
+			"max_lease_ttl_seconds": schema.Int64Attribute{
+				Optional:    true,
+				Description: "Maximum TTL for secret leases requested by this provider.",
+			},
+			"max_retries": schema.Int64Attribute{
+				Optional:    true,
+				Description: "Maximum number of retries when a 5xx error code is encountered.",
+			},
+			"max_retries_ccc": schema.Int64Attribute{
+				Optional:    true,
+				Description: "Maximum number of retries for Client Controlled Consistency related operations",
+			},
+			consts.FieldNamespace: schema.StringAttribute{
+				Optional:    true,
+				Description: "The namespace to use. Available only for Vault Enterprise.",
+			},
+			consts.FieldSkipGetVaultVersion: schema.BoolAttribute{
+				Optional:    true,
+				Description: "Skip the dynamic fetching of the Vault server version.",
+			},
+			consts.FieldVaultVersionOverride: schema.StringAttribute{
+				Optional: true,
+				Description: "Override the Vault server version, " +
+					"which is normally determined dynamically from the target Vault server",
+				Validators: []validator.String{
+					// https://semver.org/#is-there-a-suggested-regular-expression-regex-to-check-a-semver-string
+					stringvalidator.RegexMatches(
+						regexp.MustCompile(`^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$`),
+						"must be a valid semantic version",
+					),
+				},
+			},
+			consts.FieldSetNamespaceFromToken: schema.BoolAttribute{
+				Optional: true,
+				Description: "In the case where the Vault token is for a specific namespace " +
+					"and the provider namespace is not configured, use the token namespace " +
+					"as the root namespace for all resources.",
+			},
+		},
+		Blocks: map[string]schema.Block{
+			"headers": schema.ListNestedBlock{
+				Description: "The headers to send with each Vault request.",
+				NestedObject: schema.NestedBlockObject{
+					Attributes: map[string]schema.Attribute{
+						"name": schema.StringAttribute{
+							Required:    true,
+							Sensitive:   true,
+							Description: "The header name",
+						},
+						"value": schema.StringAttribute{
+							Required:    true,
+							Sensitive:   true,
+							Description: "The header value",
+						},
+					},
+				},
+			},
+			consts.FieldClientAuth: schema.ListNestedBlock{
+				Description: "Client authentication credentials.",
+				NestedObject: schema.NestedBlockObject{
+					Attributes: map[string]schema.Attribute{
+						consts.FieldCertFile: schema.StringAttribute{
+							Required:    true,
+							Description: "Path to a file containing the client certificate.",
+						},
+						consts.FieldKeyFile: schema.StringAttribute{
+							Required:    true,
+							Description: "Path to a file containing the private key that the certificate was issued for.",
+						},
+					},
+				},
+				Validators: []validator.List{
+					listvalidator.SizeAtMost(1),
+				},
+			},
+			consts.FieldAuthLoginAWS:       AuthLoginAWSSchema(),
+			consts.FieldAuthLoginAzure:     AuthLoginAzureSchema(),
+			consts.FieldAuthLoginCert:      AuthLoginCertSchema(),
+			consts.FieldAuthLoginGCP:       AuthLoginGCPSchema(),
+			consts.FieldAuthLoginGeneric:   AuthLoginGenericSchema(),
+			consts.FieldAuthLoginJWT:       AuthLoginJWTSchema(),
+			consts.FieldAuthLoginKerberos:  AuthLoginKerberosSchema(),
+			consts.FieldAuthLoginOCI:       AuthLoginOCISchema(),
+			consts.FieldAuthLoginOIDC:      AuthLoginOIDCSchema(),
+			consts.FieldAuthLoginRadius:    AuthLoginRadiusSchema(),
+			consts.FieldAuthLoginTokenFile: AuthLoginTokenFileSchema(),
+			consts.FieldAuthLoginUserpass:  AuthLoginUserpassSchema(),
+		},
+	}
+}
+
+// Configure handles the configuration of any provider-level data or clients.
+// These configuration values may be from the practitioner Terraform
+// configuration, environment variables, or other means such as reading
+// vendor-specific configuration files.
+//
+// Configure is called during plan and apply.
+func (p *fwprovider) Configure(ctx context.Context, req provider.ConfigureRequest, resp *provider.ConfigureResponse) {
+	// Provider's parsed configuration (its instance state) is available
+	// through the primary provider's Meta() method.
+	v, ok := p.Primary.Meta().(*sdkv2provider.ProviderMeta)
+	if !ok {
+		resp.Diagnostics.AddError(
+			"Unexpected Resource Configure Type",
+			fmt.Sprintf("Expected *provider.ProviderMeta, got: %T. Please report this issue to the provider developers.", p.Primary.Meta()),
+		)
+		return
+	}
+	resp.DataSourceData = v
+	resp.ResourceData = v
+	resp.EphemeralResourceData = v
+}
+
+// Resources returns a slice of functions to instantiate each Resource
+// implementation.
+//
+// The resource type name is determined by the Resource implementing
+// the Metadata method. All resources must have unique names.
+func (p *fwprovider) Resources(ctx context.Context) []func() resource.Resource {
+	return []func() resource.Resource{
+		sys.NewPasswordPolicyResource,
+	}
+}
+
+func (p *fwprovider) EphemeralResources(_ context.Context) []func() ephemeral.EphemeralResource {
+	return []func() ephemeral.EphemeralResource{
+		ephemeralsecrets.NewKVV2EphemeralSecretResource,
+		ephemeralsecrets.NewDBEphemeralSecretResource,
+	}
+
+}
+
+// DataSources returns a slice of functions to instantiate each DataSource
+// implementation.
+//
+// The data source type name is determined by the DataSource implementing
+// the Metadata method. All data sources must have unique names.
+func (p *fwprovider) DataSources(ctx context.Context) []func() datasource.DataSource {
+	return []func() datasource.DataSource{}
+}
diff --git a/internal/provider/meta.go b/internal/provider/meta.go
index dbd8e590..f0b592dc 100644
--- a/internal/provider/meta.go
+++ b/internal/provider/meta.go
@@ -9,6 +9,7 @@ import (
 	"log"
 	"net/http"
 	"os"
+	"strconv"
 	"strings"
 	"sync"
 	"time"
@@ -19,6 +20,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/logging"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	terraformplugintesting "github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/vault/api"
 	config "github.com/hashicorp/vault/api/cliconfig"
 	"k8s.io/utils/pointer"
@@ -189,27 +191,26 @@ func (p *ProviderMeta) setClient() error {
 
 	d := p.resourceData
 	clientConfig := api.DefaultConfig()
-	addr := d.Get(consts.FieldAddress).(string)
-	if addr != "" {
-		clientConfig.Address = addr
+
+	addr := GetResourceDataStr(d, consts.FieldAddress, api.EnvVaultAddress, "")
+	if addr == "" {
+		return fmt.Errorf("failed to configure Vault address")
 	}
+	clientConfig.Address = addr
+
 	clientConfig.CloneTLSConfig = true
 
 	tlsConfig := &api.TLSConfig{
-		CACert:        d.Get(consts.FieldCACertFile).(string),
-		CAPath:        d.Get(consts.FieldCACertDir).(string),
-		Insecure:      d.Get(consts.FieldSkipTLSVerify).(bool),
-		TLSServerName: d.Get(consts.FieldTLSServerName).(string),
+		CACert:        GetResourceDataStr(d, consts.FieldCACertFile, api.EnvVaultCACert, ""),
+		CAPath:        GetResourceDataStr(d, consts.FieldCACertDir, api.EnvVaultCAPath, ""),
+		Insecure:      GetResourceDataBool(d, consts.FieldSkipTLSVerify, "VAULT_SKIP_VERIFY", false),
+		TLSServerName: GetResourceDataStr(d, consts.FieldTLSServerName, api.EnvVaultTLSServerName, ""),
 	}
 
 	if _, ok := d.GetOk(consts.FieldClientAuth); ok {
 		prefix := fmt.Sprintf("%s.0.", consts.FieldClientAuth)
-		if v, ok := d.GetOk(prefix + consts.FieldCertFile); ok {
-			tlsConfig.ClientCert = v.(string)
-		}
-		if v, ok := d.GetOk(prefix + consts.FieldKeyFile); ok {
-			tlsConfig.ClientKey = v.(string)
-		}
+		tlsConfig.ClientCert = GetResourceDataStr(d, prefix+consts.FieldCertFile, api.EnvVaultClientCert, "")
+		tlsConfig.ClientKey = GetResourceDataStr(d, prefix+consts.FieldKeyFile, api.EnvVaultClientKey, "")
 	}
 
 	err := clientConfig.ConfigureTLS(tlsConfig)
@@ -256,12 +257,12 @@ func (p *ProviderMeta) setClient() error {
 	}
 	client.SetHeaders(parsedHeaders)
 
-	client.SetMaxRetries(d.Get("max_retries").(int))
+	client.SetMaxRetries(GetResourceDataInt(d, "max_retries", "VAULT_MAX_RETRIES", DefaultMaxHTTPRetries))
 
-	MaxHTTPRetriesCCC = d.Get("max_retries_ccc").(int)
+	MaxHTTPRetriesCCC = GetResourceDataInt(d, "max_retries_ccc", "VAULT_MAX_RETRIES_CCC", DefaultMaxHTTPRetriesCCC)
 
 	// Set the namespace to the requested namespace, if provided
-	namespace := d.Get(consts.FieldNamespace).(string)
+	namespace := GetResourceDataStr(d, consts.FieldNamespace, "VAULT_NAMESPACE", "")
 
 	authLogin, err := GetAuthLogin(d)
 	if err != nil {
@@ -330,7 +331,8 @@ func (p *ProviderMeta) setClient() error {
 		tokenNamespace = strings.Trim(v.(string), "/")
 	}
 
-	if !d.Get(consts.FieldSkipChildToken).(bool) {
+	skipChildToken := GetResourceDataBool(d, consts.FieldSkipChildToken, consts.EnvVarSkipChildToken, false)
+	if !skipChildToken {
 		// a child token is always created in the namespace of the parent token.
 		token, err = createChildToken(d, client, tokenNamespace)
 		if err != nil {
@@ -353,7 +355,8 @@ func (p *ProviderMeta) setClient() error {
 		namespace = tokenNamespace
 		// set the namespace on the provider to ensure that all child
 		// namespace paths are properly honoured.
-		if v, ok := d.Get(consts.FieldSetNamespaceFromToken).(bool); ok && v {
+		setTokenFromNamespace := GetResourceDataBool(d, consts.FieldSetNamespaceFromToken, "VAULT_SET_NAMESPACE_FROM_TOKEN", true)
+		if setTokenFromNamespace {
 			if err := d.Set(consts.FieldNamespace, namespace); err != nil {
 				return err
 			}
@@ -375,6 +378,7 @@ func (p *ProviderMeta) setVaultVersion() error {
 	}
 
 	d := p.resourceData
+	skipGetVaultVersion := GetResourceDataBool(d, consts.FieldSkipGetVaultVersion, "", false)
 	var vaultVersion *version.Version
 	if v, ok := d.GetOk(consts.FieldVaultVersionOverride); ok {
 		ver, err := version.NewVersion(v.(string))
@@ -383,7 +387,7 @@ func (p *ProviderMeta) setVaultVersion() error {
 				consts.FieldVaultVersionOverride, err)
 		}
 		vaultVersion = ver
-	} else if !d.Get(consts.FieldSkipGetVaultVersion).(bool) {
+	} else if !skipGetVaultVersion {
 		// Set the Vault version to *ProviderMeta object
 		client, err := p.getClient()
 		if err != nil {
@@ -472,6 +476,12 @@ func GetClient(i interface{}, meta interface{}) (*api.Client, error) {
 		}
 	case *terraform.InstanceState:
 		ns = v.Attributes[consts.FieldNamespace]
+
+	// Allows tests that use new terraform-plugin-testing
+	// to successfully get a client. Only used in tests
+	// TODO unify the GetClient implementations between providers and directly pass in namespace
+	case *terraformplugintesting.InstanceState:
+		ns = v.Attributes[consts.FieldNamespace]
 	default:
 		return nil, fmt.Errorf("GetClient() called with unsupported type %T", v)
 	}
@@ -559,10 +569,7 @@ func getVaultVersion(client *api.Client) (*version.Version, error) {
 }
 
 func createChildToken(d *schema.ResourceData, c *api.Client, namespace string) (string, error) {
-	tokenName := d.Get("token_name").(string)
-	if tokenName == "" {
-		tokenName = "terraform"
-	}
+	tokenName := GetResourceDataStr(d, "token_name", "VAULT_TOKEN_NAME", "terraform")
 
 	// the clone is only used to auth to Vault
 	clone, err := c.Clone()
@@ -586,10 +593,11 @@ func createChildToken(d *schema.ResourceData, c *api.Client, namespace string) (
 	// Caution is still required with state files since not all secrets
 	// can explicitly be revoked, and this limited scope won't apply to
 	// any secrets that are *written* by Terraform to Vault.
+	ttl := GetResourceDataInt(d, consts.FieldMaxLeaseTTL, "TERRAFORM_VAULT_MAX_TTL", 1200)
 	childTokenLease, err := clone.Auth().Token().Create(&api.TokenCreateRequest{
 		DisplayName:    tokenName,
-		TTL:            fmt.Sprintf("%ds", d.Get("max_lease_ttl_seconds").(int)),
-		ExplicitMaxTTL: fmt.Sprintf("%ds", d.Get("max_lease_ttl_seconds").(int)),
+		TTL:            fmt.Sprintf("%ds", ttl),
+		ExplicitMaxTTL: fmt.Sprintf("%ds", ttl),
 		Renewable:      pointer.Bool(false),
 	})
 	if err != nil {
@@ -604,9 +612,93 @@ func createChildToken(d *schema.ResourceData, c *api.Client, namespace string) (
 	return childToken, nil
 }
 
+// GetResourceDataStr returns the value for a given ResourceData field
+// If the value is the zero value, then it checks the environment variable. If
+// the environment variable is empty, the default dv is returned
+func GetResourceDataStr(d *schema.ResourceData, field, env, dv string) string {
+	if s := d.Get(field).(string); s != "" {
+		return s
+	}
+
+	if env != "" {
+		if s := os.Getenv(env); s != "" {
+			return s
+		}
+	}
+
+	// return default
+	return dv
+}
+
+// GetResourceDataInt returns the value for a given ResourceData field
+// If the value is the zero value, then it checks the environment variable. If
+// the environment variable is empty, the default dv is returned
+func GetResourceDataInt(d *schema.ResourceData, field, env string, dv int) int {
+	if v := d.Get(field).(int); v != 0 {
+		return v
+	}
+	if env != "" {
+		if s := os.Getenv(env); s != "" {
+			ret, err := strconv.Atoi(s)
+			if err == nil {
+				return ret
+			}
+			// swallow the error and return the default because that is the
+			// behavior we had when using SDKv2's schema.EnvDefaultFunc
+		}
+	}
+	// return default
+	return dv
+}
+
+// GetResourceDataBool returns the value for a given ResourceData field
+// If the value is the zero value, then it checks the environment variable. If
+// the environment variable is empty, the default dv is returned
+func GetResourceDataBool(d *schema.ResourceData, field, env string, dv bool) bool {
+	// since Get does not tell us if the value is false or unset,
+	// we only return this value if it is non-nil, else we return the default
+
+	rawConfig := d.GetRawConfig()
+
+	// Note: the following block is only encountered when setting up the testProvider
+	// RawConfig will only be available during a terraform plan/apply execution
+	// this value will be nil during PreChecks and Destroy operations in tests
+	// the testProvider in those cases is set up using default values
+	if rawConfig.IsNull() {
+		return dv
+	}
+
+	// If RawConfig exists, continue reading values from resource data
+	rawVal := rawConfig.GetAttr(field)
+
+	// We don't care about the underlying value, just detecting if the config value is null (unset) or not.
+	if rawVal.IsNull() {
+		// The value is null (unset) in config, do our defaulting logic
+
+		if env != "" {
+			if s := os.Getenv(env); s != "" {
+				ret, err := strconv.ParseBool(s)
+				if err == nil {
+					return ret
+				}
+				// swallow the error and return the default because that is the
+				// behavior we had when using SDKv2's schema.EnvDefaultFunc
+			}
+		}
+
+		// return default if value not in environment
+		return dv
+	}
+
+	// If the value is set in config, return using d.Get
+	return d.Get(field).(bool)
+}
+
 func GetToken(d *schema.ResourceData) (string, error) {
 	if token := d.Get("token").(string); token != "" {
 		return token, nil
+	} else if token = os.Getenv(api.EnvVaultToken); token != "" {
+		return token, nil
 	}
 
 	if addAddr := d.Get("add_address_to_env").(string); addAddr == "true" {
diff --git a/internal/provider/provider.go b/internal/provider/provider.go
index 0fd0f2c4..f511a0c4 100644
--- a/internal/provider/provider.go
+++ b/internal/provider/provider.go
@@ -13,7 +13,6 @@ import (
 	"github.com/hashicorp/go-version"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/vault/api"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 )
@@ -65,36 +64,36 @@ func NewProvider(
 	}
 
 	r := &schema.Provider{
+		// This schema must match exactly the fwprovider (Terraform Plugin Framework) schema.
+		// Notably the attributes can have no Default values.
 		Schema: map[string]*schema.Schema{
+			// Not `Required` but must be set via config or env. Otherwise we
+			// return an error.
 			consts.FieldAddress: {
 				Type:        schema.TypeString,
-				Required:    true,
-				DefaultFunc: schema.EnvDefaultFunc(api.EnvVaultAddress, nil),
+				Optional:    true,
 				Description: "URL of the root of the target Vault server.",
 			},
 			"add_address_to_env": {
 				Type:        schema.TypeString,
 				Optional:    true,
-				Default:     false,
 				Description: "If true, adds the value of the `address` argument to the Terraform process environment.",
 			},
+			// Not `Required` but must be set via config, env, or token helper.
+			// Otherwise we return an error.
 			"token": {
 				Type:        schema.TypeString,
-				Required:    true,
-				DefaultFunc: schema.EnvDefaultFunc(api.EnvVaultToken, ""),
+				Optional:    true,
 				Description: "Token to use to authenticate to Vault.",
 			},
 			"token_name": {
 				Type:        schema.TypeString,
 				Optional:    true,
-				DefaultFunc: schema.EnvDefaultFunc("VAULT_TOKEN_NAME", ""),
 				Description: "Token name to use for creating the Vault child token.",
 			},
 			"skip_child_token": {
-				Type:        schema.TypeBool,
-				Optional:    true,
-				DefaultFunc: schema.EnvDefaultFunc("TERRAFORM_VAULT_SKIP_CHILD_TOKEN", false),
-
+				Type:     schema.TypeBool,
+				Optional: true,
 				// Setting to true will cause max_lease_ttl_seconds and token_name to be ignored (not used).
 				// Note that this is strongly discouraged due to the potential of exposing sensitive secret data.
 				Description: "Set this to true to prevent the creation of ephemeral child token used by this provider.",
@@ -102,102 +101,59 @@ func NewProvider(
 			consts.FieldCACertFile: {
 				Type:        schema.TypeString,
 				Optional:    true,
-				DefaultFunc: schema.EnvDefaultFunc(api.EnvVaultCACert, ""),
 				Description: "Path to a CA certificate file to validate the server's certificate.",
 			},
 			consts.FieldCACertDir: {
 				Type:        schema.TypeString,
 				Optional:    true,
-				DefaultFunc: schema.EnvDefaultFunc(api.EnvVaultCAPath, ""),
 				Description: "Path to directory containing CA certificate files to validate the server's certificate.",
 			},
-			consts.FieldClientAuth: {
-				Type:        schema.TypeList,
-				Optional:    true,
-				Description: "Client authentication credentials.",
-				MaxItems:    1,
-				Deprecated:  fmt.Sprintf("Use %s instead", consts.FieldAuthLoginCert),
-				Elem: &schema.Resource{
-					Schema: map[string]*schema.Schema{
-						consts.FieldCertFile: {
-							Type:        schema.TypeString,
-							Required:    true,
-							DefaultFunc: schema.EnvDefaultFunc(api.EnvVaultClientCert, ""),
-							Description: "Path to a file containing the client certificate.",
-						},
-						consts.FieldKeyFile: {
-							Type:        schema.TypeString,
-							Required:    true,
-							DefaultFunc: schema.EnvDefaultFunc(api.EnvVaultClientKey, ""),
-							Description: "Path to a file containing the private key that the certificate was issued for.",
-						},
-					},
-				},
-			},
 			consts.FieldSkipTLSVerify: {
 				Type:        schema.TypeBool,
 				Optional:    true,
-				DefaultFunc: schema.EnvDefaultFunc("VAULT_SKIP_VERIFY", false),
 				Description: "Set this to true only if the target Vault server is an insecure development instance.",
 			},
 			consts.FieldTLSServerName: {
 				Type:        schema.TypeString,
 				Optional:    true,
-				DefaultFunc: schema.EnvDefaultFunc(api.EnvVaultTLSServerName, ""),
 				Description: "Name to use as the SNI host when connecting via TLS.",
 			},
 			"max_lease_ttl_seconds": {
-				Type:     schema.TypeInt,
-				Optional: true,
-
-				// Default is 20min, which is intended to be enough time for
-				// a reasonable Terraform run can complete but not
-				// significantly longer, so that any leases are revoked shortly
-				// after Terraform has finished running.
-				DefaultFunc: schema.EnvDefaultFunc("TERRAFORM_VAULT_MAX_TTL", 1200),
+				Type:        schema.TypeInt,
+				Optional:    true,
 				Description: "Maximum TTL for secret leases requested by this provider.",
 			},
 			"max_retries": {
 				Type:        schema.TypeInt,
 				Optional:    true,
-				DefaultFunc: schema.EnvDefaultFunc("VAULT_MAX_RETRIES", DefaultMaxHTTPRetries),
 				Description: "Maximum number of retries when a 5xx error code is encountered.",
 			},
 			"max_retries_ccc": {
 				Type:        schema.TypeInt,
 				Optional:    true,
-				DefaultFunc: schema.EnvDefaultFunc("VAULT_MAX_RETRIES_CCC", DefaultMaxHTTPRetriesCCC),
 				Description: "Maximum number of retries for Client Controlled Consistency related operations",
 			},
 			consts.FieldNamespace: {
 				Type:        schema.TypeString,
 				Optional:    true,
-				DefaultFunc: schema.EnvDefaultFunc("VAULT_NAMESPACE", ""),
 				Description: "The namespace to use. Available only for Vault Enterprise.",
 			},
-			consts.FieldSetNamespaceFromToken: {
-				Type:     schema.TypeBool,
-				Optional: true,
-				Default:  true,
-				Description: "In the case where the Vault token is for a specific namespace " +
-					"and the provider namespace is not configured, use the token namespace " +
-					"as the root namespace for all resources.",
-			},
 			"headers": {
 				Type:        schema.TypeList,
 				Optional:    true,
-				Sensitive:   true,
 				Description: "The headers to send with each Vault request.",
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
 						"name": {
 							Type:        schema.TypeString,
 							Required:    true,
+							Sensitive:   true,
 							Description: "The header name",
 						},
 						"value": {
 							Type:        schema.TypeString,
 							Required:    true,
+							Sensitive:   true,
 							Description: "The header value",
 						},
 					},
@@ -206,7 +162,6 @@ func NewProvider(
 			consts.FieldSkipGetVaultVersion: {
 				Type:        schema.TypeBool,
 				Optional:    true,
-				Default:     false,
 				Description: "Skip the dynamic fetching of the Vault server version.",
 			},
 			consts.FieldVaultVersionOverride: {
@@ -216,6 +171,33 @@ func NewProvider(
 					"which is normally determined dynamically from the target Vault server",
 				ValidateDiagFunc: ValidateDiagSemVer,
 			},
+			consts.FieldSetNamespaceFromToken: {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Description: "In the case where the Vault token is for a specific namespace " +
+					"and the provider namespace is not configured, use the token namespace " +
+					"as the root namespace for all resources.",
+			},
+			consts.FieldClientAuth: {
+				Type:        schema.TypeList,
+				Optional:    true,
+				Description: "Client authentication credentials.",
+				MaxItems:    1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						consts.FieldCertFile: {
+							Type:        schema.TypeString,
+							Required:    true,
+							Description: "Path to a file containing the client certificate.",
+						},
+						consts.FieldKeyFile: {
+							Type:        schema.TypeString,
+							Required:    true,
+							Description: "Path to a file containing the private key that the certificate was issued for.",
+						},
+					},
+				},
+			},
 		},
 		ConfigureFunc:  NewProviderMeta,
 		DataSourcesMap: dataSourcesMap,
@@ -224,6 +206,11 @@ func NewProvider(
 
 	MustAddAuthLoginSchema(r.Schema)
 
+	// Set the provider Meta (instance data) here.
+	// It will be overwritten by the result of the call to ConfigureFunc,
+	// but can be used pre-configuration by other (non-primary) provider servers.
+	r.SetMeta(&ProviderMeta{})
+
 	return r
 }
 
diff --git a/internal/provider/validators.go b/internal/provider/validators.go
index 15e23212..98656243 100644
--- a/internal/provider/validators.go
+++ b/internal/provider/validators.go
@@ -22,7 +22,7 @@ import (
 var (
 	regexpPathLeading  = regexp.MustCompile(fmt.Sprintf(`^%s`, consts.PathDelim))
 	regexpPathTrailing = regexp.MustCompile(fmt.Sprintf(`%s$`, consts.PathDelim))
-	regexpPath         = regexp.MustCompile(fmt.Sprintf(`%s|%s`, regexpPathLeading, regexpPathTrailing))
+	RegexpPath         = regexp.MustCompile(fmt.Sprintf(`%s|%s`, regexpPathLeading, regexpPathTrailing))
 	regexpUUID         = regexp.MustCompile("^[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}$")
 )
 
@@ -63,7 +63,7 @@ func ValidateNoTrailingSlash(i interface{}, k string) ([]string, []error) {
 
 func ValidateNoLeadingTrailingSlashes(i interface{}, k string) ([]string, []error) {
 	var errs []error
-	if err := validatePath(regexpPath, i, k); err != nil {
+	if err := validatePath(RegexpPath, i, k); err != nil {
 		errs = append(errs, err)
 	}
 
@@ -71,7 +71,7 @@ func ValidateNoLeadingTrailingSlashes(i interface{}, k string) ([]string, []erro
 }
 
 func ValidateDiagPath(i interface{}, path cty.Path) diag.Diagnostics {
-	return validateDiagPath(regexpPath, i, path)
+	return validateDiagPath(RegexpPath, i, path)
 }
 
 func validateDiagPath(r *regexp.Regexp, i interface{}, path cty.Path) diag.Diagnostics {
diff --git a/internal/vault/auth/README.md b/internal/vault/auth/README.md
new file mode 100644
index 00000000..114721f6
--- /dev/null
+++ b/internal/vault/auth/README.md
@@ -0,0 +1,3 @@
+# Vault Auth Methods
+
+This package contains Vault [auth method API](https://developer.hashicorp.com/vault/api-docs/auth) resources and datasources.
diff --git a/internal/vault/secrets/README.md b/internal/vault/secrets/README.md
new file mode 100644
index 00000000..07163441
--- /dev/null
+++ b/internal/vault/secrets/README.md
@@ -0,0 +1,3 @@
+# Vault Secrets Engine
+
+This package contains Vault [secrets engine API](https://developer.hashicorp.com/vault/api-docs/secret) resources and datasources.
diff --git a/internal/vault/secrets/ephemeral/database_secret.go b/internal/vault/secrets/ephemeral/database_secret.go
new file mode 100644
index 00000000..9bccc411
--- /dev/null
+++ b/internal/vault/secrets/ephemeral/database_secret.go
@@ -0,0 +1,135 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package ephemeralsecrets
+
+import (
+	"context"
+	"fmt"
+	"github.com/hashicorp/terraform-plugin-framework/ephemeral"
+	"github.com/hashicorp/terraform-plugin-framework/ephemeral/schema"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-provider-vault/internal/consts"
+	"github.com/hashicorp/terraform-provider-vault/internal/framework/base"
+	"github.com/hashicorp/terraform-provider-vault/internal/framework/client"
+	"github.com/hashicorp/terraform-provider-vault/internal/framework/errutil"
+	"github.com/hashicorp/terraform-provider-vault/internal/framework/model"
+)
+
+// Ensure the implementation satisfies the resource.ResourceWithConfigure interface
+var _ ephemeral.EphemeralResource = &DBEphemeralSecretResource{}
+
+// NewDBEphemeralSecretResource returns the implementation for this resource to be
+// imported by the Terraform Plugin Framework provider
+var NewDBEphemeralSecretResource = func() ephemeral.EphemeralResource {
+	return &DBEphemeralSecretResource{}
+}
+
+// DBEphemeralSecretResource implements the methods that define this resource
+type DBEphemeralSecretResource struct {
+	base.EphemeralResourceWithConfigure
+}
+
+// DBEphemeralSecretModel describes the Terraform resource data model to match the
+// resource schema.
+type DBEphemeralSecretModel struct {
+	// common fields to all ephemeral resources
+	base.BaseModelEphemeral
+
+	// fields specific to this resource
+	Mount    types.String `tfsdk:"mount"`
+	Name     types.String `tfsdk:"name"`
+	Username types.String `tfsdk:"username"`
+	Password types.String `tfsdk:"password"`
+}
+
+// DBEphemeralSecretAPIModel describes the Vault API data model.
+type DBEphemeralSecretAPIModel struct {
+	Username string `json:"username" mapstructure:"username"`
+	Password string `json:"password" mapstructure:"password"`
+}
+
+// Schema defines this resource's schema which is the data that is available in
+// the resource's configuration, plan, and state
+//
+// https://developer.hashicorp.com/terraform/plugin/framework/resources#schema-method
+func (r *DBEphemeralSecretResource) Schema(_ context.Context, _ ephemeral.SchemaRequest, resp *ephemeral.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		Attributes: map[string]schema.Attribute{
+			consts.FieldMount: schema.StringAttribute{
+				MarkdownDescription: "Mount path for the DB engine in Vault.",
+				Required:            true,
+			},
+			consts.FieldName: schema.StringAttribute{
+				MarkdownDescription: " Specifies the name of the role to create credentials against.",
+				Required:            true,
+			},
+			consts.FieldUsername: schema.StringAttribute{
+				MarkdownDescription: "Username for the newly created DB user.",
+				Computed:            true,
+			},
+			consts.FieldPassword: schema.StringAttribute{
+				MarkdownDescription: "Password for the newly created DB user.",
+				Computed:            true,
+			},
+		},
+		MarkdownDescription: "Provides an ephemeral resource to read a DB Secret from Vault.",
+	}
+
+	base.MustAddBaseEphemeralSchema(&resp.Schema)
+}
+
+// Metadata sets the full name for this resource
+func (r *DBEphemeralSecretResource) Metadata(ctx context.Context, req ephemeral.MetadataRequest, resp *ephemeral.MetadataResponse) {
+	resp.TypeName = req.ProviderTypeName + "_database_secret"
+}
+
+func (r *DBEphemeralSecretResource) Open(ctx context.Context, req ephemeral.OpenRequest, resp *ephemeral.OpenResponse) {
+	var data DBEphemeralSecretModel
+	// Read Terraform prior state data into the model
+	resp.Diagnostics.Append(req.Config.Get(ctx, &data)...)
+
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	c, err := client.GetClient(ctx, r.Meta(), data.Namespace.ValueString())
+	if err != nil {
+		resp.Diagnostics.AddError(errutil.ClientConfigureErr(err))
+		return
+	}
+
+	path := r.path(data.Mount.ValueString(), data.Name.ValueString())
+
+	secretResp, err := c.Logical().ReadWithContext(ctx, path)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			errutil.VaultReadErr(err),
+		)
+
+		return
+	}
+	if secretResp == nil {
+		resp.Diagnostics.AddError(
+			errutil.VaultReadResponseNil(),
+		)
+
+		return
+	}
+
+	var readResp DBEphemeralSecretAPIModel
+	err = model.ToAPIModel(secretResp.Data, &readResp)
+	if err != nil {
+		resp.Diagnostics.AddError("Unable to translate Vault response data", err.Error())
+		return
+	}
+
+	data.Username = types.StringValue(readResp.Username)
+	data.Password = types.StringValue(readResp.Password)
+
+	resp.Diagnostics.Append(resp.Result.Set(ctx, &data)...)
+}
+
+func (r *DBEphemeralSecretResource) path(mount, roleName string) string {
+	return fmt.Sprintf("/%s/creds/%s", mount, roleName)
+}
diff --git a/internal/vault/secrets/ephemeral/kv_secret_v2.go b/internal/vault/secrets/ephemeral/kv_secret_v2.go
new file mode 100644
index 00000000..5028786c
--- /dev/null
+++ b/internal/vault/secrets/ephemeral/kv_secret_v2.go
@@ -0,0 +1,200 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package ephemeralsecrets
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"github.com/hashicorp/terraform-plugin-framework/ephemeral"
+	"github.com/hashicorp/terraform-plugin-framework/ephemeral/schema"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-provider-vault/internal/consts"
+	"github.com/hashicorp/terraform-provider-vault/internal/framework/base"
+	"github.com/hashicorp/terraform-provider-vault/internal/framework/client"
+	"github.com/hashicorp/terraform-provider-vault/internal/framework/errutil"
+	"github.com/hashicorp/terraform-provider-vault/internal/framework/model"
+	"github.com/hashicorp/vault/api"
+	"strconv"
+)
+
+// Ensure the implementation satisfies the resource.ResourceWithConfigure interface
+var _ ephemeral.EphemeralResource = &KVV2EphemeralSecretResource{}
+
+// NewKVV2EphemeralSecretResource returns the implementation for this resource to be
+// imported by the Terraform Plugin Framework provider
+var NewKVV2EphemeralSecretResource = func() ephemeral.EphemeralResource {
+	return &KVV2EphemeralSecretResource{}
+}
+
+// KVV2EphemeralSecretResource implements the methods that define this resource
+type KVV2EphemeralSecretResource struct {
+	base.EphemeralResourceWithConfigure
+}
+
+// KVV2EphemeralSecretModel describes the Terraform resource data model to match the
+// resource schema.
+type KVV2EphemeralSecretModel struct {
+	// common fields to all ephemeral resources
+	base.BaseModelEphemeral
+
+	// fields specific to this resource
+	Mount          types.String `tfsdk:"mount"`
+	Name           types.String `tfsdk:"name"`
+	Version        types.Int32  `tfsdk:"version"`
+	DataJSON       types.String `tfsdk:"data_json"`
+	Data           types.Map    `tfsdk:"data"`
+	CustomMetadata types.Map    `tfsdk:"custom_metadata"`
+	CreatedTime    types.String `tfsdk:"created_time"`
+	DeletionTime   types.String `tfsdk:"deletion_time"`
+	Destroyed      types.Bool   `tfsdk:"destroyed"`
+}
+
+// KVV2EphemeralSecretAPIModel describes the Vault API data model.
+type KVV2EphemeralSecretAPIModel struct {
+	Data     map[string]interface{} `json:"data" mapstructure:"data"`
+	Metadata Metadata               `json:"metadata" mapstructure:"metadata"`
+}
+
+type Metadata struct {
+	CustomMetadata map[string]interface{} `json:"custom_metadata" mapstructure:"custom_metadata"`
+	CreatedTime    string                 `json:"created_time" mapstructure:"created_time"`
+	DeletionTime   string                 `json:"deletion_time" mapstructure:"deletion_time"`
+	Destroyed      bool                   `json:"destroyed" mapstructure:"destroyed"`
+}
+
+// Schema defines this resource's schema which is the data that is available in
+// the resource's configuration, plan, and state
+//
+// https://developer.hashicorp.com/terraform/plugin/framework/resources#schema-method
+func (r *KVV2EphemeralSecretResource) Schema(_ context.Context, _ ephemeral.SchemaRequest, resp *ephemeral.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		Attributes: map[string]schema.Attribute{
+			consts.FieldMount: schema.StringAttribute{
+				MarkdownDescription: "Mount path for the KVV2 engine in Vault.",
+				Required:            true,
+			},
+			consts.FieldName: schema.StringAttribute{
+				MarkdownDescription: "Full name of the secret.",
+				Required:            true,
+			},
+			consts.FieldVersion: schema.Int32Attribute{
+				Optional:            true,
+				MarkdownDescription: "Version of the secret to retrieve.",
+			},
+			consts.FieldDataJSON: schema.StringAttribute{
+				MarkdownDescription: "JSON-encoded secret data read from Vault.",
+				Computed:            true,
+			},
+			consts.FieldData: schema.MapAttribute{
+				MarkdownDescription: "Map of strings read from Vault.",
+				ElementType:         types.StringType,
+				Computed:            true,
+			},
+			consts.FieldCreatedTime: schema.StringAttribute{
+				MarkdownDescription: "Time at which the secret was created.",
+				Computed:            true,
+			},
+			consts.FieldDeletionTime: schema.StringAttribute{
+				MarkdownDescription: "Deletion time for the secret.",
+				Computed:            true,
+			},
+			consts.FieldDestroyed: schema.BoolAttribute{
+				MarkdownDescription: "Indicates whether the secret has been destroyed.",
+				Computed:            true,
+			},
+			consts.FieldCustomMetadata: schema.MapAttribute{
+				MarkdownDescription: "Custom metadata for the secret.",
+				ElementType:         types.StringType,
+				Computed:            true,
+			},
+		},
+		MarkdownDescription: "Provides an ephemeral resource to read a KVV2 Secret from Vault.",
+	}
+
+	base.MustAddBaseEphemeralSchema(&resp.Schema)
+}
+
+// Metadata sets the full name for this resource
+func (r *KVV2EphemeralSecretResource) Metadata(ctx context.Context, req ephemeral.MetadataRequest, resp *ephemeral.MetadataResponse) {
+	resp.TypeName = req.ProviderTypeName + "_kv_secret_v2"
+}
+
+func (r *KVV2EphemeralSecretResource) Open(ctx context.Context, req ephemeral.OpenRequest, resp *ephemeral.OpenResponse) {
+	var data KVV2EphemeralSecretModel
+	// Read Terraform prior state data into the model
+	resp.Diagnostics.Append(req.Config.Get(ctx, &data)...)
+
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	c, err := client.GetClient(ctx, r.Meta(), data.Namespace.ValueString())
+	if err != nil {
+		resp.Diagnostics.AddError(errutil.ClientConfigureErr(err))
+		return
+	}
+
+	// read the name from the id field to support the import command
+	path := r.path(data.Mount.ValueString(), data.Name.ValueString())
+
+	var secretResp *api.Secret
+	if !data.Version.IsNull() {
+		v := data.Version.ValueInt32()
+
+		d := map[string][]string{
+			"version": {strconv.Itoa(int(v))},
+		}
+		secretResp, err = c.Logical().ReadWithDataWithContext(ctx, path, d)
+	} else {
+		secretResp, err = c.Logical().ReadWithContext(ctx, path)
+	}
+
+	if err != nil {
+		resp.Diagnostics.AddError(
+			errutil.VaultReadErr(err),
+		)
+
+		return
+	}
+	if secretResp == nil {
+		resp.Diagnostics.AddError(
+			errutil.VaultReadResponseNil(),
+		)
+
+		return
+	}
+
+	var readResp KVV2EphemeralSecretAPIModel
+	err = model.ToAPIModel(secretResp.Data, &readResp)
+	if err != nil {
+		resp.Diagnostics.AddError("Unable to translate Vault response data", err.Error())
+		return
+	}
+
+	data.CreatedTime = types.StringValue(readResp.Metadata.CreatedTime)
+	data.DeletionTime = types.StringValue(readResp.Metadata.DeletionTime)
+	data.Destroyed = types.BoolValue(readResp.Metadata.Destroyed)
+
+	secretData, diag := types.MapValueFrom(ctx, types.StringType, readResp.Data)
+	resp.Diagnostics.Append(diag...)
+	data.Data = secretData
+
+	jsonData, err := json.Marshal(data.Data)
+	if err != nil {
+		resp.Diagnostics.AddError("Error marshalling data to JSON", err.Error())
+	}
+
+	data.DataJSON = types.StringValue(string(jsonData))
+
+	secretCustomMetadata, diag := types.MapValueFrom(ctx, types.StringType, readResp.Metadata.CustomMetadata)
+	resp.Diagnostics.Append(diag...)
+	data.CustomMetadata = secretCustomMetadata
+
+	resp.Diagnostics.Append(resp.Result.Set(ctx, &data)...)
+}
+
+func (r *KVV2EphemeralSecretResource) path(mount, name string) string {
+	return fmt.Sprintf("%s/data/%s", mount, name)
+}
diff --git a/internal/vault/sys/README.md b/internal/vault/sys/README.md
new file mode 100644
index 00000000..c77c76b6
--- /dev/null
+++ b/internal/vault/sys/README.md
@@ -0,0 +1,3 @@
+# Vault System Backend
+
+This package contains Vault [system backend API](https://developer.hashicorp.com/vault/api-docs/system) resources and datasources.
diff --git a/internal/vault/sys/password_policy.go b/internal/vault/sys/password_policy.go
new file mode 100644
index 00000000..5a3235e3
--- /dev/null
+++ b/internal/vault/sys/password_policy.go
@@ -0,0 +1,255 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package sys
+
+import (
+	"context"
+	"fmt"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-provider-vault/internal/framework/base"
+	"github.com/hashicorp/terraform-provider-vault/internal/framework/client"
+	"github.com/hashicorp/terraform-provider-vault/internal/framework/errutil"
+	"github.com/hashicorp/terraform-provider-vault/internal/framework/model"
+)
+
+// Ensure the implementation satisfies the resource.ResourceWithConfigure interface
+var _ resource.ResourceWithConfigure = &PasswordPolicyResource{}
+
+// NewPasswordPolicyResource returns the implementation for this resource to be
+// imported by the Terraform Plugin Framework provider
+func NewPasswordPolicyResource() resource.Resource {
+	return &PasswordPolicyResource{}
+}
+
+// PasswordPolicyResource implements the methods that define this resource
+type PasswordPolicyResource struct {
+	base.ResourceWithConfigure
+	base.WithImportByID
+}
+
+// PasswordPolicyModel describes the Terraform resource data model to match the
+// resource schema.
+type PasswordPolicyModel struct {
+	// common fields to all migrated resources
+	base.BaseModelLegacy
+
+	// fields specific to this resource
+	Name   types.String `tfsdk:"name"`
+	Policy types.String `tfsdk:"policy"`
+}
+
+// PasswordPolicyAPIModel describes the Vault API data model.
+type PasswordPolicyAPIModel struct {
+	Policy string `json:"policy" mapstructure:"policy"`
+}
+
+// Metadata defines the resource name as it would appear in Terraform configurations
+//
+// https://developer.hashicorp.com/terraform/plugin/framework/resources#metadata-method
+func (r *PasswordPolicyResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
+	resp.TypeName = req.ProviderTypeName + "_password_policy"
+}
+
+// Schema defines this resource's schema which is the data that is available in
+// the resource's configuration, plan, and state
+//
+// https://developer.hashicorp.com/terraform/plugin/framework/resources#schema-method
+func (r *PasswordPolicyResource) Schema(ctx context.Context, req resource.SchemaRequest, resp *resource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		Attributes: map[string]schema.Attribute{
+			"name": schema.StringAttribute{
+				MarkdownDescription: "Name of the password policy.",
+				Required:            true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.RequiresReplace(),
+				},
+			},
+			"policy": schema.StringAttribute{
+				Required:            true,
+				MarkdownDescription: "The password policy document",
+			},
+		},
+		MarkdownDescription: "Provides a resource to manage Password Policies.",
+	}
+
+	base.MustAddLegacyBaseSchema(&resp.Schema)
+}
+
+// Create is called during the terraform apply command.
+//
+// https://developer.hashicorp.com/terraform/plugin/framework/resources/create
+func (r *PasswordPolicyResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
+	var data PasswordPolicyModel
+
+	// Read Terraform plan data into the model
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &data)...)
+
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	client, err := client.GetClient(ctx, r.Meta(), data.Namespace.ValueString())
+	if err != nil {
+		resp.Diagnostics.AddError(errutil.ClientConfigureErr(err))
+		return
+	}
+
+	vaultRequest := map[string]interface{}{
+		"policy": data.Policy.ValueString(),
+	}
+	path := r.path(data.Name.ValueString())
+	// vault returns a nil response on success
+	_, err = client.Logical().WriteWithContext(ctx, path, vaultRequest)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			errutil.VaultCreateErr(err),
+		)
+
+		return
+	}
+
+	// write the ID to state which is required for backwards compatibility
+	data.ID = types.StringValue(data.Name.ValueString())
+
+	// Save data into Terraform state
+	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+}
+
+// Read is called during the terraform apply, terraform plan, and terraform
+// refresh commands.
+//
+// https://developer.hashicorp.com/terraform/plugin/framework/resources/read
+func (r *PasswordPolicyResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
+	var data PasswordPolicyModel
+	// Read Terraform prior state data into the model
+	resp.Diagnostics.Append(req.State.Get(ctx, &data)...)
+
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	client, err := client.GetClient(ctx, r.Meta(), data.Namespace.ValueString())
+	if err != nil {
+		resp.Diagnostics.AddError(errutil.ClientConfigureErr(err))
+		return
+	}
+
+	// read the name from the id field to support the import command
+	name := data.ID.ValueString()
+	path := r.path(name)
+	policyResp, err := client.Logical().ReadWithContext(ctx, path)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			errutil.VaultReadErr(err),
+		)
+
+		return
+	}
+	if policyResp == nil {
+		resp.Diagnostics.AddError(
+			errutil.VaultReadResponseNil(),
+		)
+
+		return
+	}
+
+	var readResp PasswordPolicyAPIModel
+	err = model.ToAPIModel(policyResp.Data, &readResp)
+	if err != nil {
+		resp.Diagnostics.AddError("Unable to translate Vault response data", err.Error())
+		return
+	}
+
+	data.Policy = types.StringValue(readResp.Policy)
+
+	// write the name to state to support the import command
+	data.Name = types.StringValue(name)
+
+	// write the ID to state which is required for backwards compatibility
+	data.ID = types.StringValue(name)
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+}
+
+// Update is called during the terraform apply command
+//
+// https://developer.hashicorp.com/terraform/plugin/framework/resources/update
+func (r *PasswordPolicyResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
+	var data PasswordPolicyModel
+
+	// Read Terraform plan data into the model
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &data)...)
+
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	client, err := client.GetClient(ctx, r.Meta(), data.Namespace.ValueString())
+	if err != nil {
+		resp.Diagnostics.AddError(errutil.ClientConfigureErr(err))
+		return
+	}
+
+	vaultRequest := map[string]interface{}{
+		"policy": data.Policy.ValueString(),
+	}
+	path := r.path(data.Name.ValueString())
+	// vault returns a nil response on success
+	_, err = client.Logical().WriteWithContext(ctx, path, vaultRequest)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			errutil.VaultUpdateErr(err),
+		)
+
+		return
+	}
+
+	// write the ID to state which is required for backwards compatibility
+	data.ID = types.StringValue(data.Name.ValueString())
+
+	// Save data into Terraform state
+	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+}
+
+// Delete is called during the terraform apply command
+//
+// https://developer.hashicorp.com/terraform/plugin/framework/resources/delete
+func (r *PasswordPolicyResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
+	var data PasswordPolicyModel
+
+	// Read Terraform state data into the model
+	resp.Diagnostics.Append(req.State.Get(ctx, &data)...)
+
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	client, err := client.GetClient(ctx, r.Meta(), data.Namespace.ValueString())
+	if err != nil {
+		resp.Diagnostics.AddError(errutil.ClientConfigureErr(err))
+		return
+	}
+
+	path := r.path(data.Name.ValueString())
+
+	_, err = client.Logical().DeleteWithContext(ctx, path)
+	if err != nil {
+		resp.Diagnostics.AddError(
+			errutil.VaultDeleteErr(err),
+		)
+
+		return
+	}
+
+	// If the logic reaches here, it implicitly succeeded and will remove
+	// the resource from state if there are no other errors.
+}
+
+func (r *PasswordPolicyResource) path(name string) string {
+	return fmt.Sprintf("/sys/policies/password/%s", name)
+}
diff --git a/main.go b/main.go
index 608091e2..32242051 100644
--- a/main.go
+++ b/main.go
@@ -4,33 +4,40 @@
 package main
 
 import (
+	"context"
 	"flag"
 	"log"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/plugin"
-
-	"github.com/hashicorp/terraform-provider-vault/schema"
+	"github.com/hashicorp/terraform-plugin-go/tfprotov5/tf5server"
 	"github.com/hashicorp/terraform-provider-vault/vault"
 )
 
 func main() {
-	p := schema.NewProvider(vault.Provider())
-	serveOpts := &plugin.ServeOpts{
-		ProviderFunc: p.SchemaProvider,
+	serverFactory, _, err := vault.ProtoV5ProviderServerFactory(context.Background())
+	if err != nil {
+		log.Fatal(err)
 	}
 
+	var serveOpts []tf5server.ServeOpt
+
 	var debug bool
 	flag.BoolVar(&debug, "debug", false, "set to true to run the provider with support for debuggers like delve")
 	flag.Parse()
-
 	if debug {
-		serveOpts.Debug = debug
-		serveOpts.ProviderAddr = "hashicorp/vault"
+		serveOpts = append(serveOpts, tf5server.WithManagedDebug())
 	}
 
-	// fix duplicate timestamp and incorrect level messages
+	// fix duplicate timestamp and incorrect level messages for legacy sdk v2
 	// https://developer.hashicorp.com/terraform/plugin/log/writing#legacy-log-troubleshooting
 	log.SetFlags(log.Flags() &^ (log.Ldate | log.Ltime))
 
-	plugin.Serve(serveOpts)
+	err = tf5server.Serve(
+		"registry.terraform.io/hashicorp/vault",
+		serverFactory,
+		serveOpts...,
+	)
+
+	if err != nil {
+		log.Fatal(err)
+	}
 }
diff --git a/schema/provider.go b/schema/provider.go
index b976c86d..db8af8f2 100644
--- a/schema/provider.go
+++ b/schema/provider.go
@@ -4,6 +4,7 @@
 package schema
 
 import (
+	"github.com/hashicorp/terraform-plugin-go/tfprotov5"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 )
 
@@ -28,3 +29,11 @@ func (p *Provider) RegisterResource(name string, resource *schema.Resource) {
 func (p *Provider) SchemaProvider() *schema.Provider {
 	return p.provider
 }
+
+func (p *Provider) GRPCProvider() tfprotov5.ProviderServer {
+	return p.provider.GRPCProvider()
+}
+
+func (p *Provider) Meta() interface{} {
+	return p.provider.Meta()
+}
diff --git a/vault/data_source_aws_access_credentials.go b/vault/data_source_aws_access_credentials.go
index c191fcfb..d390c094 100644
--- a/vault/data_source_aws_access_credentials.go
+++ b/vault/data_source_aws_access_credentials.go
@@ -15,7 +15,7 @@ import (
 	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/aws/aws-sdk-go/service/sts"
 	"github.com/hashicorp/go-cleanhttp"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/retry"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
@@ -216,15 +216,15 @@ func awsAccessCredentialsDataSourceRead(d *schema.ResourceData, meta interface{}
 	sequentialSuccesses := 0
 
 	// validateCreds is a retry function, which will be retried until it succeeds.
-	validateCreds := func() *resource.RetryError {
+	validateCreds := func() *retry.RetryError {
 		log.Printf("[DEBUG] Checking if AWS creds %q are valid", secret.LeaseID)
 		if _, err := iamconn.GetUser(nil); err != nil && isAWSAuthError(err) {
 			sequentialSuccesses = 0
 			log.Printf("[DEBUG] AWS auth error checking if creds %q are valid, is retryable", secret.LeaseID)
-			return resource.RetryableError(err)
+			return retry.RetryableError(err)
 		} else if err != nil {
 			log.Printf("[DEBUG] Error checking if creds %q are valid: %s", secret.LeaseID, err)
-			return resource.NonRetryableError(err)
+			return retry.NonRetryableError(err)
 		}
 		sequentialSuccesses++
 		log.Printf("[DEBUG] Checked if AWS creds %q are valid", secret.LeaseID)
@@ -236,7 +236,7 @@ func awsAccessCredentialsDataSourceRead(d *schema.ResourceData, meta interface{}
 		if time.Since(start) > sequentialSuccessTimeLimit {
 			return fmt.Errorf("unable to get %d sequential successes within %.f seconds", sequentialSuccessesRequired, sequentialSuccessTimeLimit.Seconds())
 		}
-		if err := resource.Retry(retryTimeOut, validateCreds); err != nil {
+		if err := retry.Retry(retryTimeOut, validateCreds); err != nil {
 			return fmt.Errorf("error checking if credentials are valid: %s", err)
 		}
 	}
diff --git a/vault/data_source_azure_access_credentials.go b/vault/data_source_azure_access_credentials.go
index 5f0846ac..2dee40f3 100644
--- a/vault/data_source_azure_access_credentials.go
+++ b/vault/data_source_azure_access_credentials.go
@@ -224,12 +224,6 @@ func azureAccessCredentialsDataSourceRead(ctx context.Context, d *schema.Resourc
 		return diag.Errorf("tenant_id cannot be empty when validate_creds is true")
 	}
 
-	creds, err := azidentity.NewClientSecretCredential(
-		tenantID, clientID, clientSecret, &azidentity.ClientSecretCredentialOptions{})
-	if err != nil {
-		return diag.FromErr(e)
-	}
-
 	var environment string
 	if v, ok := d.GetOk("environment"); ok {
 		environment = v.(string)
@@ -248,15 +242,6 @@ func azureAccessCredentialsDataSourceRead(ctx context.Context, d *schema.Resourc
 		return diag.FromErr(err)
 	}
 
-	providerClient, err := armresources.NewProvidersClient(subscriptionID, creds,
-		&arm.ClientOptions{
-			ClientOptions: policy.ClientOptions{
-				Cloud: cloudConfig,
-			},
-		})
-	if err != nil {
-		return diag.Errorf("failed to create providers client: %s", err)
-	}
 	delay := time.Duration(d.Get("num_seconds_between_tests").(int)) * time.Second
 	maxValidationSeconds := d.Get("max_cred_validation_seconds").(int)
 	endTime := time.Now().Add(time.Duration(maxValidationSeconds) * time.Second)
@@ -264,6 +249,21 @@ func azureAccessCredentialsDataSourceRead(ctx context.Context, d *schema.Resourc
 	var successCount int
 	// begin validate_creds retry loop
 	for {
+		creds, err := azidentity.NewClientSecretCredential(
+			tenantID, clientID, clientSecret, &azidentity.ClientSecretCredentialOptions{})
+		if err != nil {
+			return diag.Errorf("failed to create new credential during retry: %s", err)
+		}
+
+		providerClient, err := armresources.NewProvidersClient(subscriptionID, creds, &arm.ClientOptions{
+			ClientOptions: policy.ClientOptions{
+				Cloud: cloudConfig,
+			},
+		})
+		if err != nil {
+			return diag.Errorf("failed to create new provider client during retry: %s", err)
+		}
+
 		pager := providerClient.NewListPager(&armresources.ProvidersClientListOptions{
 			Expand: pointerutil.StringPtr("metadata"),
 		})
diff --git a/vault/data_source_kv_secret_v2.go b/vault/data_source_kv_secret_v2.go
index ae3b554e..8a564557 100644
--- a/vault/data_source_kv_secret_v2.go
+++ b/vault/data_source_kv_secret_v2.go
@@ -19,7 +19,8 @@ import (
 
 func kvSecretV2DataSource() *schema.Resource {
 	return &schema.Resource{
-		ReadContext: provider.ReadContextWrapper(kvSecretV2DataSourceRead),
+		ReadContext:        provider.ReadContextWrapper(kvSecretV2DataSourceRead),
+		DeprecationMessage: "Deprecated. Please use new Ephemeral KVV2 Secret resource `vault_kv_secret_v2` instead",
 
 		Schema: map[string]*schema.Schema{
 			consts.FieldMount: {
diff --git a/vault/data_source_namespaces.go b/vault/data_source_namespaces.go
index d46404bb..25d3806c 100644
--- a/vault/data_source_namespaces.go
+++ b/vault/data_source_namespaces.go
@@ -6,6 +6,7 @@ package vault
 import (
 	"context"
 	"log"
+	"strings"
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -21,35 +22,88 @@ func namespacesDataSource() *schema.Resource {
 		ReadContext: provider.ReadContextWrapper(namespacesDataSourceRead),
 
 		Schema: map[string]*schema.Schema{
+			"recursive": {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				Default:     false,
+				Description: "True to fetch all child namespaces.",
+			},
 			consts.FieldPaths: {
 				Type:        schema.TypeSet,
 				Computed:    true,
 				Description: "Namespace paths.",
 				Elem:        &schema.Schema{Type: schema.TypeString},
 			},
+			consts.FieldPathsFQ: {
+				Type:        schema.TypeSet,
+				Computed:    true,
+				Description: "The fully qualified namespace paths.",
+				Elem:        &schema.Schema{Type: schema.TypeString},
+			},
 		},
 	}
 }
 
-func namespacesDataSourceRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	client, e := provider.GetClient(d, meta)
-	if e != nil {
-		return diag.FromErr(e)
-	}
+func namespacesReadNamespacePaths(ctx context.Context, client *api.Client, namespace string, recursive bool) ([]string, diag.Diagnostics) {
+	var allNamespaces []string
 
-	log.Printf("[DEBUG] Reading namespaces from Vault")
+	client.SetNamespace(namespace)
 
 	resp, err := client.Logical().ListWithContext(ctx, consts.SysNamespaceRoot)
 	if err != nil {
-		return diag.Errorf("error reading namespaces from Vault: %s", err)
+		return nil, diag.Errorf("error reading namespaces from Vault: %v", err)
 	}
-	if err := d.Set(consts.FieldPaths, flattenPaths(resp)); err != nil {
-		return diag.Errorf("error setting %q to state: %s", consts.FieldPaths, err)
+
+	prefix := ""
+	if namespace != "" {
+		prefix = namespace + "/"
 	}
 
-	id := mountutil.NormalizeMountPath(client.Namespace())
+	for _, ns := range flattenPaths(resp) {
+		allNamespaces = append(allNamespaces, prefix+ns)
+
+		if recursive {
+			subNamespaces, diags := namespacesReadNamespacePaths(ctx, client, prefix+ns, true)
+			if diags.HasError() {
+				return nil, diags
+			}
+			allNamespaces = append(allNamespaces, subNamespaces...)
+		}
+	}
+
+	return allNamespaces, nil
+}
+
+func namespacesDataSourceRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	client, err := provider.GetClient(d, meta)
+	if err != nil {
+		return diag.FromErr(err)
+	}
+
+	namespace := client.Namespace()
+	id := mountutil.NormalizeMountPath(namespace)
 	d.SetId(id)
 
+	log.Printf("[DEBUG] Reading namespaces from Vault")
+
+	absolutePaths, diags := namespacesReadNamespacePaths(ctx, client, namespace, d.Get("recursive").(bool))
+	if diags.HasError() {
+		return diags
+	}
+
+	if err := d.Set(consts.FieldPathsFQ, absolutePaths); err != nil {
+		return diag.Errorf("error setting %q to state: %v", consts.FieldPathsFQ, err)
+	}
+
+	var relativePaths []string
+	for _, absolutePath := range absolutePaths {
+		relativePaths = append(relativePaths, strings.TrimPrefix(absolutePath, namespace+"/"))
+	}
+
+	if err := d.Set(consts.FieldPaths, relativePaths); err != nil {
+		return diag.Errorf("error setting %q to state: %v", consts.FieldPaths, err)
+	}
+
 	return nil
 }
 
diff --git a/vault/data_source_policy_document.go b/vault/data_source_policy_document.go
index 664c566c..5a96cda2 100644
--- a/vault/data_source_policy_document.go
+++ b/vault/data_source_policy_document.go
@@ -22,14 +22,32 @@ type Policy struct {
 }
 
 type PolicyRule struct {
-	Path               string
-	Description        string
-	MinWrappingTTL     string
-	MaxWrappingTTL     string
-	Capabilities       []string
+	// Path in Vault that the rule applies to.
+	Path string
+
+	// Description is an optional annotation for the rule.
+	Description string
+
+	// MinWrappingTTL is the minimum allowed TTL for the wrapped response.
+	MinWrappingTTL string
+
+	// MaxWrappingTTL is the maximum allowed TTL for the wrapped response.
+	MaxWrappingTTL string
+
+	// Capabilities is the list of allowed operations on the specified path.
+	Capabilities []string
+
+	// RequiredParameters is a list of parameters that must be specified.
 	RequiredParameters []string
-	AllowedParameters  map[string][]string
-	DeniedParameters   map[string][]string
+
+	// SubscribeEventTypes is a list of event types to subscribe to when using `subscribe` capability.
+	SubscribeEventTypes []string
+
+	// AllowedParameters defines a whitelist of keys and values that are permitted on the given path.
+	AllowedParameters map[string][]string
+
+	// DeniedParameters defines a blacklist of keys and values that are denied on the given path.
+	DeniedParameters map[string][]string
 }
 
 var allowedCapabilities = []string{
@@ -56,28 +74,33 @@ func policyDocumentDataSource() *schema.Resource {
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
 						consts.FieldPath: {
-							Type:     schema.TypeString,
-							Required: true,
+							Type:        schema.TypeString,
+							Required:    true,
+							Description: "A path in Vault that this rule applies to.",
 						},
 
 						"description": {
-							Type:     schema.TypeString,
-							Optional: true,
+							Type:        schema.TypeString,
+							Optional:    true,
+							Description: "Description of the rule.",
 						},
 
 						"min_wrapping_ttl": {
-							Type:     schema.TypeString,
-							Optional: true,
+							Type:        schema.TypeString,
+							Optional:    true,
+							Description: "The minimum allowed TTL that clients can specify for a wrapped response.",
 						},
 
 						"max_wrapping_ttl": {
-							Type:     schema.TypeString,
-							Optional: true,
+							Type:        schema.TypeString,
+							Optional:    true,
+							Description: "The maximum allowed TTL that clients can specify for a wrapped response.",
 						},
 
 						"capabilities": {
-							Type:     schema.TypeList,
-							Required: true,
+							Type:        schema.TypeList,
+							Required:    true,
+							Description: "A list of capabilities to apply to the specified path.",
 							Elem: &schema.Schema{
 								Type:         schema.TypeString,
 								ValidateFunc: capabilityValidation,
@@ -85,26 +108,39 @@ func policyDocumentDataSource() *schema.Resource {
 						},
 
 						"required_parameters": {
-							Type:     schema.TypeList,
-							Optional: true,
+							Type:        schema.TypeList,
+							Optional:    true,
+							Description: "A list of parameters that must be specified.",
+							Elem: &schema.Schema{
+								Type: schema.TypeString,
+							},
+						},
+
+						"subscribe_event_types": {
+							Type:        schema.TypeList,
+							Optional:    true,
+							Description: "A list of event types to subscribe to when using `subscribe` capability",
 							Elem: &schema.Schema{
 								Type: schema.TypeString,
 							},
 						},
 
 						"allowed_parameter": {
-							Type:     schema.TypeList,
-							Optional: true,
+							Type:        schema.TypeList,
+							Optional:    true,
+							Description: "Whitelists a list of keys and values that are permitted on the given path.",
 							Elem: &schema.Resource{
 								Schema: map[string]*schema.Schema{
 									"key": {
-										Type:     schema.TypeString,
-										Required: true,
+										Type:        schema.TypeString,
+										Required:    true,
+										Description: "Name of permitted key.",
 									},
 
 									"value": {
-										Type:     schema.TypeList,
-										Required: true,
+										Type:        schema.TypeList,
+										Required:    true,
+										Description: "A list of values what are permitted by policy rule.",
 										Elem: &schema.Schema{
 											Type: schema.TypeString,
 										},
@@ -114,18 +150,21 @@ func policyDocumentDataSource() *schema.Resource {
 						},
 
 						"denied_parameter": {
-							Type:     schema.TypeList,
-							Optional: true,
+							Type:        schema.TypeList,
+							Optional:    true,
+							Description: "Blacklists a list of parameter and values.",
 							Elem: &schema.Resource{
 								Schema: map[string]*schema.Schema{
 									"key": {
-										Type:     schema.TypeString,
-										Required: true,
+										Type:        schema.TypeString,
+										Required:    true,
+										Description: "Name of denied key.",
 									},
 
 									"value": {
-										Type:     schema.TypeList,
-										Required: true,
+										Type:        schema.TypeList,
+										Required:    true,
+										Description: "A list of values what are denied by policy rule.",
 										Elem: &schema.Schema{
 											Type: schema.TypeString,
 										},
@@ -138,8 +177,9 @@ func policyDocumentDataSource() *schema.Resource {
 			},
 
 			"hcl": {
-				Type:     schema.TypeString,
-				Computed: true, Elem: &schema.Schema{
+				Type:        schema.TypeString,
+				Description: "The above arguments serialized as a standard Vault HCL policy document.",
+				Computed:    true, Elem: &schema.Schema{
 					Type: schema.TypeString,
 				},
 			},
@@ -156,34 +196,64 @@ func policyDocumentDataSourceRead(d *schema.ResourceData, meta interface{}) erro
 
 		for i, ruleI := range rawRuleIntfs {
 			rawRule := ruleI.(map[string]interface{})
-			rule := &PolicyRule{
-				Path:           rawRule["path"].(string),
-				Description:    rawRule["description"].(string),
-				MinWrappingTTL: rawRule["min_wrapping_ttl"].(string),
-				MaxWrappingTTL: rawRule["max_wrapping_ttl"].(string),
+			rule := &PolicyRule{}
+
+			pathVal, ok := rawRule[consts.FieldPath].(string)
+			if !ok || pathVal == "" {
+				return fmt.Errorf("missing or invalid field: %s", consts.FieldPath)
+			}
+			rule.Path = pathVal
+
+			optionalFields := map[string]*string{
+				"description":      &rule.Description,
+				"min_wrapping_ttl": &rule.MinWrappingTTL,
+				"max_wrapping_ttl": &rule.MaxWrappingTTL,
+			}
+			for k, v := range optionalFields {
+				if value, ok := rawRule[k].(string); ok {
+					*v = value
+				}
+			}
+
+			capVal, ok := rawRule["capabilities"]
+			if !ok {
+				return fmt.Errorf("missing field: capabilities")
+			}
+			capList, ok := capVal.([]interface{})
+			if !ok {
+				return fmt.Errorf("invalid capabilities list, expected a list of strings")
 			}
+			rule.Capabilities = policyDecodeConfigListOfStrings(capList)
 
-			if capabilityIntfs := rawRule["capabilities"].([]interface{}); len(capabilityIntfs) > 0 {
-				rule.Capabilities = policyDecodeConfigListOfStrings(capabilityIntfs)
+			if reqParamVal, ok := rawRule["required_parameters"]; ok {
+				if reqParamIntfs, ok := reqParamVal.([]interface{}); ok && len(reqParamIntfs) > 0 {
+					rule.RequiredParameters = policyDecodeConfigListOfStrings(reqParamIntfs)
+				}
 			}
 
-			if reqParamIntfs := rawRule["required_parameters"].([]interface{}); len(reqParamIntfs) > 0 {
-				rule.RequiredParameters = policyDecodeConfigListOfStrings(reqParamIntfs)
+			if subEventVal, ok := rawRule["subscribe_event_types"]; ok {
+				if subEventTypesIntfs, ok := subEventVal.([]interface{}); ok && len(subEventTypesIntfs) > 0 {
+					rule.SubscribeEventTypes = policyDecodeConfigListOfStrings(subEventTypesIntfs)
+				}
 			}
 
-			if allowedParamIntfs := rawRule["allowed_parameter"].([]interface{}); len(allowedParamIntfs) > 0 {
-				var err error
-				rule.AllowedParameters, err = policyDecodeConfigListOfMapsOfListToString(allowedParamIntfs)
-				if err != nil {
-					return fmt.Errorf("error reading argument allowed_parameter: %s", err)
+			if allowVal, ok := rawRule["allowed_parameter"]; ok {
+				if allowedParamIntfs, ok := allowVal.([]interface{}); ok && len(allowedParamIntfs) > 0 {
+					var err error
+					rule.AllowedParameters, err = policyDecodeConfigListOfMapsOfListToString(allowedParamIntfs)
+					if err != nil {
+						return fmt.Errorf("error reading argument allowed_parameter: %s", err)
+					}
 				}
 			}
 
-			if deniedParamIntfs := rawRule["denied_parameter"].([]interface{}); len(deniedParamIntfs) > 0 {
-				var err error
-				rule.DeniedParameters, err = policyDecodeConfigListOfMapsOfListToString(deniedParamIntfs)
-				if err != nil {
-					return fmt.Errorf("error reading argument denied_parameter: %s", err)
+			if deniedVal, ok := rawRule["denied_parameter"]; ok {
+				if deniedParamIntfs, ok := deniedVal.([]interface{}); ok && len(deniedParamIntfs) > 0 {
+					var err error
+					rule.DeniedParameters, err = policyDecodeConfigListOfMapsOfListToString(deniedParamIntfs)
+					if err != nil {
+						return fmt.Errorf("error reading argument denied_parameter: %s", err)
+					}
 				}
 			}
 
@@ -272,15 +342,19 @@ func policyRenderPolicyRule(rule *PolicyRule) string {
 		renderedRule = fmt.Sprintf("# %s\n%s", rule.Description, renderedRule)
 	}
 
-	if rule.RequiredParameters != nil {
+	if len(rule.RequiredParameters) > 0 {
 		renderedRule = fmt.Sprintf("%s  required_parameters = %s\n", renderedRule, policyRenderListOfStrings(rule.RequiredParameters))
 	}
 
-	if rule.AllowedParameters != nil {
+	if len(rule.SubscribeEventTypes) > 0 {
+		renderedRule = fmt.Sprintf("%s  subscribe_event_types = %s\n", renderedRule, policyRenderListOfStrings(rule.SubscribeEventTypes))
+	}
+
+	if len(rule.AllowedParameters) > 0 {
 		renderedRule = fmt.Sprintf("%s  allowed_parameters = %s\n", renderedRule, policyRenderListOfMapsOfListToString(rule.AllowedParameters))
 	}
 
-	if rule.DeniedParameters != nil {
+	if len(rule.DeniedParameters) > 0 {
 		renderedRule = fmt.Sprintf("%s  denied_parameters = %s\n", renderedRule, policyRenderListOfMapsOfListToString(rule.DeniedParameters))
 	}
 
diff --git a/vault/password_policy.go b/vault/password_policy.go
deleted file mode 100644
index b42612d6..00000000
--- a/vault/password_policy.go
+++ /dev/null
@@ -1,122 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
-package vault
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"log"
-
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/vault/api"
-
-	"github.com/hashicorp/terraform-provider-vault/internal/provider"
-)
-
-func readPasswordPolicy(client *api.Client, name string) (map[string]interface{}, error) {
-	r := client.NewRequest("GET", fmt.Sprintf("/v1/sys/policies/password/%s", name))
-
-	ctx, cancelFunc := context.WithCancel(context.Background())
-	defer cancelFunc()
-	resp, err := client.RawRequestWithContext(ctx, r)
-	if resp != nil {
-		defer resp.Body.Close()
-		if resp.StatusCode == 404 {
-			return nil, nil
-		}
-	}
-	if err != nil {
-		return nil, err
-	}
-
-	secret, err := api.ParseSecret(resp.Body)
-	if err != nil {
-		return nil, err
-	}
-	if secret == nil || secret.Data == nil {
-		return nil, errors.New("data from server response is empty")
-	}
-	return secret.Data, nil
-}
-
-func passwordPolicyDelete(d *schema.ResourceData, meta interface{}) error {
-	client, e := provider.GetClient(d, meta)
-	if e != nil {
-		return e
-	}
-
-	name := d.Id()
-
-	log.Printf("[DEBUG] Deleting %s password policy from Vault", name)
-
-	r := client.NewRequest("DELETE", fmt.Sprintf("/v1/sys/policies/password/%s", name))
-
-	ctx, cancelFunc := context.WithCancel(context.Background())
-	defer cancelFunc()
-	resp, err := client.RawRequestWithContext(ctx, r)
-	if err == nil {
-		defer resp.Body.Close()
-	}
-
-	return err
-}
-
-func passwordPolicyRead(attributes []string, d *schema.ResourceData, meta interface{}) error {
-	client, e := provider.GetClient(d, meta)
-	if e != nil {
-		return e
-	}
-
-	name := d.Id()
-
-	policy, err := readPasswordPolicy(client, name)
-	if err != nil {
-		return fmt.Errorf("error reading from Vault: %s", err)
-	}
-
-	for _, value := range attributes {
-		d.Set(value, policy[value])
-	}
-	d.Set("name", name)
-
-	return nil
-}
-
-func passwordPolicyWrite(attributes []string, d *schema.ResourceData, meta interface{}) error {
-	client, e := provider.GetClient(d, meta)
-	if e != nil {
-		return e
-	}
-
-	name := d.Get("name").(string)
-
-	log.Printf("[DEBUG] Writing %s password policy to Vault", name)
-
-	body := map[string]interface{}{}
-	for _, value := range attributes {
-		body[value] = d.Get(value)
-	}
-
-	r := client.NewRequest("PUT", fmt.Sprintf("/v1/sys/policies/password/%s", name))
-	if err := r.SetJSONBody(body); err != nil {
-		return err
-	}
-
-	ctx, cancelFunc := context.WithCancel(context.Background())
-	defer cancelFunc()
-	resp, err := client.RawRequestWithContext(ctx, r)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-
-	if err != nil {
-		return fmt.Errorf("error writing to Vault: %s", err)
-	}
-
-	d.SetId(name)
-
-	return passwordPolicyRead(attributes, d, meta)
-}
diff --git a/vault/provider.go b/vault/provider.go
index 1ce69620..4cc3fec1 100644
--- a/vault/provider.go
+++ b/vault/provider.go
@@ -587,10 +587,6 @@ var (
 			Resource:      UpdateSchemaResource(rabbitMQSecretBackendRoleResource()),
 			PathInventory: []string{"/rabbitmq/roles/{name}"},
 		},
-		"vault_password_policy": {
-			Resource:      UpdateSchemaResource(passwordPolicyResource()),
-			PathInventory: []string{"/sys/policy/password/{name}"},
-		},
 		"vault_pki_secret_backend_cert": {
 			Resource:      UpdateSchemaResource(pkiSecretBackendCertResource()),
 			PathInventory: []string{"/pki/issue/{role}"},
diff --git a/vault/provider_factory.go b/vault/provider_factory.go
new file mode 100644
index 00000000..e25467aa
--- /dev/null
+++ b/vault/provider_factory.go
@@ -0,0 +1,32 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package vault
+
+import (
+	"context"
+
+	"github.com/hashicorp/terraform-plugin-framework/providerserver"
+	"github.com/hashicorp/terraform-plugin-go/tfprotov5"
+	"github.com/hashicorp/terraform-plugin-mux/tf5muxserver"
+	"github.com/hashicorp/terraform-provider-vault/internal/provider/fwprovider"
+	"github.com/hashicorp/terraform-provider-vault/schema"
+)
+
+// ProtoV5ProviderServerFactory returns a muxed terraform-plugin-go protocol v5 provider factory function.
+// This factory function is suitable for use with the terraform-plugin-go Serve function.
+// The primary (Plugin SDK) provider server is also returned (useful for testing).
+func ProtoV5ProviderServerFactory(ctx context.Context) (func() tfprotov5.ProviderServer, *schema.Provider, error) {
+	primary := schema.NewProvider(Provider())
+	servers := []func() tfprotov5.ProviderServer{
+		primary.GRPCProvider,
+		providerserver.NewProtocol5(fwprovider.New(primary)),
+	}
+
+	muxServer, err := tf5muxserver.NewMuxServer(ctx, servers...)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return muxServer.ProviderServer, primary, nil
+}
diff --git a/vault/resource_aws_auth_backend_role.go b/vault/resource_aws_auth_backend_role.go
index 333e94c3..60a20f1e 100644
--- a/vault/resource_aws_auth_backend_role.go
+++ b/vault/resource_aws_auth_backend_role.go
@@ -14,6 +14,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
+	"github.com/hashicorp/terraform-provider-vault/util"
 )
 
 var (
@@ -297,7 +298,9 @@ func awsAuthBackendRoleCreate(ctx context.Context, d *schema.ResourceData, meta
 		}
 	}
 	d.SetId(path)
-	if _, err := client.Logical().Write(path, data); err != nil {
+
+	// Retry to account for eventual consistency errors for IAM
+	if _, err := util.RetryWrite(client, path, data, util.DefaultRequestOpts()); err != nil {
 		d.SetId("")
 		return diag.Errorf("error writing AWS auth backend role %q: %s", path, err)
 	}
@@ -506,8 +509,8 @@ func awsAuthBackendRoleUpdate(ctx context.Context, d *schema.ResourceData, meta
 		}
 	}
 
-	_, err := client.Logical().Write(path, data)
-	if err != nil {
+	// Retry to account for eventual consistency errors for IAM
+	if _, err := util.RetryWrite(client, path, data, util.DefaultRequestOpts()); err != nil {
 		return diag.Errorf("error updating AWS auth backend role %q: %s", path, err)
 	}
 	log.Printf("[DEBUG] Updated AWS auth backend role %q", path)
diff --git a/vault/resource_azure_secret_backend.go b/vault/resource_azure_secret_backend.go
index ee7143ae..2e4b4491 100644
--- a/vault/resource_azure_secret_backend.go
+++ b/vault/resource_azure_secret_backend.go
@@ -53,13 +53,6 @@ func azureSecretBackendResource() *schema.Resource {
 				Optional:    true,
 				Description: "Human-friendly description of the mount for the backend.",
 			},
-			consts.FieldUseMSGraphAPI: {
-				Deprecated:  "This field is not supported in Vault-1.12+ and is the default behavior. This field will be removed in future version of the provider.",
-				Type:        schema.TypeBool,
-				Optional:    true,
-				Computed:    true,
-				Description: "Use the Microsoft Graph API. Should be set to true on vault-1.10+",
-			},
 			consts.FieldSubscriptionID: {
 				Type:        schema.TypeString,
 				ForceNew:    true,
@@ -196,15 +189,6 @@ func azureSecretBackendRead(ctx context.Context, d *schema.ResourceData, meta in
 		}
 	}
 
-	skipMSGraphAPI := provider.IsAPISupported(meta, provider.VaultVersion112)
-	if !skipMSGraphAPI {
-		if v, ok := resp.Data[consts.FieldUseMSGraphAPI]; ok {
-			if err := d.Set(consts.FieldUseMSGraphAPI, v); err != nil {
-				return diag.FromErr(err)
-			}
-		}
-	}
-
 	if v, ok := resp.Data[consts.FieldEnvironment]; ok && v.(string) != "" {
 		if err := d.Set(consts.FieldEnvironment, v); err != nil {
 			return diag.FromErr(err)
@@ -315,18 +299,6 @@ func azureSecretBackendRequestData(d *schema.ResourceData, meta interface{}) map
 		consts.FieldSubscriptionID,
 	}
 
-	skipMSGraphAPI := provider.IsAPISupported(meta, provider.VaultVersion112)
-
-	if _, ok := d.GetOk(consts.FieldUseMSGraphAPI); ok {
-		if skipMSGraphAPI {
-			log.Printf("ignoring this field because Vault version is greater than 1.12")
-		}
-	}
-
-	if !skipMSGraphAPI {
-		fields = append(fields, consts.FieldUseMSGraphAPI)
-	}
-
 	data := make(map[string]interface{})
 	for _, k := range fields {
 		if d.IsNewResource() {
diff --git a/vault/resource_azure_secret_backend_role.go b/vault/resource_azure_secret_backend_role.go
index 249af97d..11d89bb9 100644
--- a/vault/resource_azure_secret_backend_role.go
+++ b/vault/resource_azure_secret_backend_role.go
@@ -120,6 +120,11 @@ func azureSecretBackendRoleResource() *schema.Resource {
 				Optional:    true,
 				Description: "Human-friendly description of the mount for the backend.",
 			},
+			consts.FieldExplicitMaxTTL: {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Description: "Specifies the explicit maximum lifetime of the lease and service principal.",
+			},
 			consts.FieldSignInAudience: {
 				Type:        schema.TypeString,
 				Optional:    true,
@@ -183,6 +188,13 @@ func azureSecretBackendRoleUpdateFields(_ context.Context, d *schema.ResourceDat
 		}
 	}
 
+	useAPIVer118 := provider.IsAPISupported(meta, provider.VaultVersion118)
+	if useAPIVer118 {
+		if v, ok := d.GetOk(consts.FieldExplicitMaxTTL); ok && v != "" {
+			data[consts.FieldExplicitMaxTTL] = v
+		}
+	}
+
 	useAPIVer116 := provider.IsAPISupported(meta, provider.VaultVersion116)
 	if useAPIVer116 {
 		if v, ok := d.GetOk(consts.FieldSignInAudience); ok && v != "" {
@@ -267,6 +279,13 @@ func azureSecretBackendRoleRead(_ context.Context, d *schema.ResourceData, meta
 		}
 	}
 
+	useAPIVer118 := provider.IsAPISupported(meta, provider.VaultVersion118)
+	if useAPIVer118 {
+		if err := d.Set(consts.FieldExplicitMaxTTL, resp.Data[consts.FieldExplicitMaxTTL]); err != nil {
+			return diag.FromErr(err)
+		}
+	}
+
 	useAPIVer116 := provider.IsAPISupported(meta, provider.VaultVersion116)
 	if useAPIVer116 {
 		if err := d.Set(consts.FieldSignInAudience, resp.Data[consts.FieldSignInAudience]); err != nil {
diff --git a/vault/resource_database_secret_backend_connection.go b/vault/resource_database_secret_backend_connection.go
index af0c05e9..b88e2fdf 100644
--- a/vault/resource_database_secret_backend_connection.go
+++ b/vault/resource_database_secret_backend_connection.go
@@ -8,6 +8,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"github.com/hashicorp/go-cty/cty"
 	"log"
 	"regexp"
 	"sort"
@@ -43,6 +44,9 @@ var (
 	databaseSecretBackendConnectionBackendFromPathRegex = regexp.MustCompile("^(.+)/config/.+$")
 	databaseSecretBackendConnectionNameFromPathRegex    = regexp.MustCompile("^.+/config/(.+$)")
 
+	// regex to extract engine name and index from prefixes such as "postgresql.5"
+	databaseEngineNameAndIndexFromPrefixRegex = regexp.MustCompile("^(.+)\\.([0-9]+)\\.$")
+
 	dbEngineCassandra = &dbEngine{
 		name:              "cassandra",
 		defaultPluginName: "cassandra" + dbPluginSuffix,
@@ -763,6 +767,17 @@ func connectionStringResource(config *connectionStringConfig) *schema.Resource {
 			Description: "The root credential password used in the connection URL",
 			Sensitive:   true,
 		}
+		res.Schema[consts.FieldPasswordWO] = &schema.Schema{
+			Type:        schema.TypeString,
+			Optional:    true,
+			Description: "Write-only field for the root credential password used in the connection URL",
+			WriteOnly:   true,
+		}
+		res.Schema[consts.FieldPasswordWOVersion] = &schema.Schema{
+			Type:        schema.TypeInt,
+			Optional:    true,
+			Description: "Version counter for root credential password write-only field",
+		}
 	}
 
 	if config.isCloud {
@@ -1497,6 +1512,11 @@ func getConnectionDetailsFromResponseWithUserPass(d *schema.ResourceData, prefix
 		result["password"] = v.(string)
 	}
 
+	// ensure password_wo_version is updated in state
+	if v, ok := d.GetOk(prefix + consts.FieldPasswordWOVersion); ok {
+		result[consts.FieldPasswordWOVersion] = v.(int)
+	}
+
 	return result
 }
 
@@ -1786,9 +1806,30 @@ func setDatabaseConnectionDataWithUserPass(d *schema.ResourceData, prefix string
 	// the old password in the update request would break the connection config. Thus we only send it,
 	// if it actually changed to still support updating it for non-rotated cases.
 	passwordKey := prefix + consts.FieldPassword
-	if v, ok := d.GetOk(passwordKey); ok {
-		if d.IsNewResource() || d.HasChange(passwordKey) {
+	passwordWriteOnlyVersionKey := prefix + consts.FieldPasswordWOVersion
+	if d.IsNewResource() || d.HasChange(passwordKey) || d.HasChange(passwordWriteOnlyVersionKey) {
+		if v, ok := d.GetOk(passwordKey); ok && v != nil {
+			log.Printf("[DEBUG] using persisted password; please use new write-only attributes `password_wo` " +
+				"and `password_wo_version` for security")
 			data[consts.FieldPassword] = v.(string)
+		} else if d.HasChange(passwordWriteOnlyVersionKey) {
+			engineName, engineIdx, err := databaseEngineNameAndIndexFromPrefix(prefix)
+			if err != nil {
+				// this should not happen, since we control how the prefix is created
+				panic(fmt.Sprintf("[ERROR] invalid prefix %q for database connection: %s", prefix, err))
+			}
+
+			idx, err := strconv.Atoi(engineIdx)
+			if err != nil {
+				// this should not happen, since we control how the index has been set
+				panic(fmt.Sprintf("[ERROR] unable to convert string index to integer: %s", err))
+			}
+
+			// construct path to use GetRawConfig
+			path := cty.GetAttrPath(engineName).IndexInt(idx).GetAttr(consts.FieldPasswordWO)
+			if pwWo, _ := d.GetRawConfigAt(path); !pwWo.IsNull() {
+				data[consts.FieldPassword] = pwWo.AsString()
+			}
 		}
 	}
 }
@@ -2207,3 +2248,14 @@ func databaseSecretBackendConnectionBackendFromPath(path string) (string, error)
 	}
 	return res[1], nil
 }
+
+func databaseEngineNameAndIndexFromPrefix(prefix string) (string, string, error) {
+	if !databaseEngineNameAndIndexFromPrefixRegex.MatchString(prefix) {
+		return "", "", fmt.Errorf("no matches found")
+	}
+	res := databaseEngineNameAndIndexFromPrefixRegex.FindStringSubmatch(prefix)
+	if len(res) != 3 {
+		return "", "", fmt.Errorf("unexpected number of matches (%d) for name", len(res))
+	}
+	return res[1], res[2], nil
+}
diff --git a/vault/resource_gcp_secret_backend.go b/vault/resource_gcp_secret_backend.go
index a3bf48c7..e40bce3f 100644
--- a/vault/resource_gcp_secret_backend.go
+++ b/vault/resource_gcp_secret_backend.go
@@ -6,6 +6,7 @@ package vault
 import (
 	"context"
 	"fmt"
+	"github.com/hashicorp/go-cty/cty"
 	"log"
 	"strings"
 
@@ -49,16 +50,27 @@ func gcpSecretBackendResource(name string) *schema.Resource {
 				},
 			},
 			consts.FieldCredentials: {
-				Type:        schema.TypeString,
-				Optional:    true,
-				Description: "JSON-encoded credentials to use to connect to GCP",
-				Sensitive:   true,
-				// We rebuild the attached JSON string to a simple singleline
-				// string. This makes terraform not want to change when an extra
-				// space is included in the JSON string. It is also necesarry
-				// when disable_read is false for comparing values.
-				StateFunc:    NormalizeDataJSONFunc(name),
-				ValidateFunc: ValidateDataJSONFunc(name),
+				Type:          schema.TypeString,
+				Optional:      true,
+				Description:   "JSON-encoded credentials to use to connect to GCP",
+				Sensitive:     true,
+				StateFunc:     NormalizeDataJSONFunc(name),
+				ValidateFunc:  ValidateDataJSONFunc(name),
+				ConflictsWith: []string{consts.FieldCredentialsWO},
+			},
+			consts.FieldCredentialsWO: {
+				Type:          schema.TypeString,
+				Optional:      true,
+				Description:   "Write-only JSON-encoded credentials to use to connect to GCP",
+				Sensitive:     true,
+				WriteOnly:     true,
+				ConflictsWith: []string{consts.FieldCredentials},
+			},
+			consts.FieldCredentialsWOVersion: {
+				Type:         schema.TypeInt,
+				Optional:     true,
+				Description:  "Version counter for write-only JSON-encoded credentials",
+				RequiredWith: []string{consts.FieldCredentialsWO},
 			},
 			consts.FieldDescription: {
 				Type:        schema.TypeString,
@@ -164,9 +176,7 @@ func gcpSecretBackendCreate(ctx context.Context, d *schema.ResourceData, meta in
 	log.Printf("[DEBUG] Writing GCP configuration to %q", configPath)
 
 	data := map[string]interface{}{}
-	fields := []string{
-		consts.FieldCredentials,
-	}
+	fields := []string{}
 
 	if useAPIVer117Ent {
 		fields = append(fields,
@@ -187,6 +197,17 @@ func gcpSecretBackendCreate(ctx context.Context, d *schema.ResourceData, meta in
 		}
 	}
 
+	var credentials string
+	if v, ok := d.GetOk(consts.FieldCredentials); ok {
+		credentials = v.(string)
+	} else if credWo, _ := d.GetRawConfigAt(cty.GetAttrPath(consts.FieldCredentialsWO)); !credWo.IsNull() {
+		credentials = credWo.AsString()
+	}
+
+	if credentials != "" {
+		data[consts.FieldCredentials] = credentials
+	}
+
 	if _, err := client.Logical().WriteWithContext(ctx, configPath, data); err != nil {
 		return diag.Errorf("error writing GCP configuration for %q: %s", path, err)
 	}
@@ -306,8 +327,18 @@ func gcpSecretBackendUpdate(ctx context.Context, d *schema.ResourceData, meta in
 
 	data := make(map[string]interface{})
 
-	if d.HasChange(consts.FieldCredentials) {
-		data[consts.FieldCredentials] = d.Get(consts.FieldCredentials)
+	var credentials string
+	if v, ok := d.GetOk(consts.FieldCredentials); ok {
+		credentials = v.(string)
+	} else if d.HasChange(consts.FieldCredentialsWOVersion) {
+		credWo, _ := d.GetRawConfigAt(cty.GetAttrPath(consts.FieldCredentialsWO))
+		if !credWo.IsNull() {
+			credentials = credWo.AsString()
+		}
+	}
+
+	if credentials != "" {
+		data[consts.FieldCredentials] = credentials
 	}
 
 	if useAPIVer117Ent {
diff --git a/vault/resource_kv_secret.go b/vault/resource_kv_secret.go
index 0f68e342..7cd7f0f7 100644
--- a/vault/resource_kv_secret.go
+++ b/vault/resource_kv_secret.go
@@ -100,8 +100,6 @@ func kvSecretRead(_ context.Context, d *schema.ResourceData, meta interface{}) d
 		return nil
 	}
 
-	log.Printf("[DEBUG] secret: %#v", secret)
-
 	data := secret.Data
 	jsonData, err := json.Marshal(data)
 	if err != nil {
diff --git a/vault/resource_kv_secret_v2.go b/vault/resource_kv_secret_v2.go
index 37605f67..62676ef3 100644
--- a/vault/resource_kv_secret_v2.go
+++ b/vault/resource_kv_secret_v2.go
@@ -7,6 +7,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"github.com/hashicorp/go-cty/cty"
 	"log"
 	"regexp"
 	"time"
@@ -103,20 +104,35 @@ func kvSecretV2Resource(name string) *schema.Resource {
 			// possible, rather than forcing e.g. all values to be strings.
 			consts.FieldDataJSON: {
 				Type:        schema.TypeString,
-				Required:    true,
+				Optional:    true,
 				Description: "JSON-encoded secret data to write.",
 				// We rebuild the attached JSON string to a simple single-line
 				// string. These make Terraform not want to change when an extra
 				// space is included in the JSON string. It is also necessary
 				// when disable_read is false for comparing values.
-				StateFunc:    NormalizeDataJSONFunc(name),
-				ValidateFunc: ValidateDataJSONFunc(name),
-				Sensitive:    true,
+				StateFunc:     NormalizeDataJSONFunc(name),
+				ValidateFunc:  ValidateDataJSONFunc(name),
+				Sensitive:     true,
+				ConflictsWith: []string{consts.FieldDataJSONWO},
+			},
+			consts.FieldDataJSONWO: {
+				Type:          schema.TypeString,
+				Optional:      true,
+				Description:   "Write-Only JSON-encoded secret data to write.",
+				WriteOnly:     true,
+				ConflictsWith: []string{consts.FieldDataJSON},
+			},
+			consts.FieldDataJSONWOVersion: {
+				Type:         schema.TypeInt,
+				Optional:     true,
+				Description:  "Version counter for write-only secret data.",
+				RequiredWith: []string{consts.FieldDataJSONWO},
 			},
 
 			consts.FieldData: {
 				Type:        schema.TypeMap,
 				Computed:    true,
+				Deprecated:  "Deprecated. Will no longer be set on a read.",
 				Description: "Map of strings read from Vault.",
 				Sensitive:   true,
 			},
@@ -201,8 +217,17 @@ func kvSecretV2Write(ctx context.Context, d *schema.ResourceData, meta interface
 
 	path := getKVV2Path(mount, name, consts.FieldData)
 
+	var buf []byte
+	if v, ok := d.GetOk(consts.FieldDataJSON); ok {
+		buf = []byte(v.(string))
+	} else if d.IsNewResource() || d.HasChange(consts.FieldDataJSONWOVersion) {
+		p := cty.GetAttrPath(consts.FieldDataJSONWO)
+		woVal, _ := d.GetRawConfigAt(p)
+		buf = []byte(woVal.AsString())
+	}
+
 	var secretData map[string]interface{}
-	err := json.Unmarshal([]byte(d.Get(consts.FieldDataJSON).(string)), &secretData)
+	err := json.Unmarshal(buf, &secretData)
 	if err != nil {
 		return diag.Errorf("data_json %#v syntax error: %s", d.Get(consts.FieldDataJSON), err)
 	}
@@ -237,8 +262,6 @@ func kvSecretV2Write(ctx context.Context, d *schema.ResourceData, meta interface
 }
 
 func kvSecretV2Read(_ context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	shouldRead := !d.Get(consts.FieldDisableRead).(bool)
-
 	path := d.Id()
 	if path == "" {
 		return nil
@@ -266,6 +289,8 @@ func kvSecretV2Read(_ context.Context, d *schema.ResourceData, meta interface{})
 		return diag.FromErr(err)
 	}
 
+	shouldRead := !d.Get(consts.FieldDisableRead).(bool)
+
 	if shouldRead {
 
 		client, e := provider.GetClient(d, meta)
@@ -284,22 +309,10 @@ func kvSecretV2Read(_ context.Context, d *schema.ResourceData, meta interface{})
 			return nil
 		}
 
-		log.Printf("[DEBUG] secret: %#v", secret)
-
-		data := secret.Data["data"]
-		jsonData, err := json.Marshal(data)
-		if err != nil {
-			return diag.Errorf("error marshaling JSON for %q: %s", path, err)
-		}
-
-		if err := d.Set(consts.FieldDataJSON, string(jsonData)); err != nil {
+		// set data to empty map to support migrating from pre-ephemeral schema
+		if err := d.Set(consts.FieldData, map[string]interface{}{}); err != nil {
 			return diag.FromErr(err)
 		}
-		if v, ok := data.(map[string]interface{}); ok {
-			if err := d.Set(consts.FieldData, serializeDataMapToString(v)); err != nil {
-				return diag.FromErr(err)
-			}
-		}
 
 		if metadata, ok := secret.Data["metadata"]; ok {
 			if v, ok := metadata.(map[string]interface{}); ok {
diff --git a/vault/resource_okta_auth_backend.go b/vault/resource_okta_auth_backend.go
index 697f5e78..05e08089 100644
--- a/vault/resource_okta_auth_backend.go
+++ b/vault/resource_okta_auth_backend.go
@@ -84,28 +84,6 @@ func oktaAuthBackendResource() *schema.Resource {
 			Description: "When true, requests by Okta for a MFA check will be bypassed. This also disallows certain status checks on the account, such as whether the password is expired.",
 		},
 
-		consts.FieldTTL: {
-			Type:         schema.TypeString,
-			Required:     false,
-			Optional:     true,
-			Default:      "0",
-			Description:  "Duration after which authentication will be expired",
-			ValidateFunc: validateOktaTTL,
-			StateFunc:    normalizeOktaTTL,
-			Deprecated:   "Deprecated. Please use `token_ttl` instead.",
-		},
-
-		consts.FieldMaxTTL: {
-			Type:         schema.TypeString,
-			Required:     false,
-			Optional:     true,
-			Description:  "Maximum duration after which authentication will be expired",
-			Default:      "0",
-			ValidateFunc: validateOktaTTL,
-			StateFunc:    normalizeOktaTTL,
-			Deprecated:   "Deprecated. Please use `token_max_ttl` instead.",
-		},
-
 		fieldGroup: {
 			Type:       schema.TypeSet,
 			Required:   false,
diff --git a/vault/resource_password_policy.go b/vault/resource_password_policy.go
deleted file mode 100644
index ead6839b..00000000
--- a/vault/resource_password_policy.go
+++ /dev/null
@@ -1,52 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
-package vault
-
-import (
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-
-	"github.com/hashicorp/terraform-provider-vault/internal/provider"
-)
-
-var passwordPolicyAttributes = []string{"policy"}
-
-func passwordPolicyResource() *schema.Resource {
-	return &schema.Resource{
-		Create: resourcePasswordPolicyWrite,
-		Update: resourcePasswordPolicyWrite,
-		Delete: resourcePasswordPolicyDelete,
-		Read:   provider.ReadWrapper(resourcePasswordPolicyRead),
-
-		Importer: &schema.ResourceImporter{
-			State: schema.ImportStatePassthrough,
-		},
-
-		Schema: map[string]*schema.Schema{
-			"name": {
-				Type:        schema.TypeString,
-				Required:    true,
-				ForceNew:    true,
-				Description: "Name of the password policy.",
-			},
-
-			"policy": {
-				Type:        schema.TypeString,
-				Required:    true,
-				Description: "The password policy document",
-			},
-		},
-	}
-}
-
-func resourcePasswordPolicyWrite(d *schema.ResourceData, meta interface{}) error {
-	return passwordPolicyWrite(passwordPolicyAttributes, d, meta)
-}
-
-func resourcePasswordPolicyDelete(d *schema.ResourceData, meta interface{}) error {
-	return passwordPolicyDelete(d, meta)
-}
-
-func resourcePasswordPolicyRead(d *schema.ResourceData, meta interface{}) error {
-	return passwordPolicyRead(passwordPolicyAttributes, d, meta)
-}
diff --git a/vault/resource_pki_secret_backend_root_sign_intermediate.go b/vault/resource_pki_secret_backend_root_sign_intermediate.go
index dd1de5c4..a2575f95 100644
--- a/vault/resource_pki_secret_backend_root_sign_intermediate.go
+++ b/vault/resource_pki_secret_backend_root_sign_intermediate.go
@@ -115,6 +115,15 @@ func pkiSecretBackendRootSignIntermediateResource() *schema.Resource {
 				ForceNew:    true,
 				Default:     -1,
 			},
+			consts.FieldKeyUsage: {
+				Type:        schema.TypeList,
+				Optional:    true,
+				Description: `Specify the key usages to be added to the existing set of key usages ("CRL", "CertSign") on the generated certificate.`,
+				ForceNew:    true,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
 			consts.FieldExcludeCNFromSans: {
 				Type:        schema.TypeBool,
 				Optional:    true,
@@ -361,6 +370,7 @@ func pkiSecretBackendRootSignIntermediateCreate(ctx context.Context, d *schema.R
 		consts.FieldURISans,
 		consts.FieldOtherSans,
 		consts.FieldPermittedDNSDomains,
+		consts.FieldKeyUsage,
 	}
 
 	// Whether name constraints fields (other than permitted_dns_domains), are supproted,
diff --git a/website/docs/d/namespaces.html.md b/website/docs/d/namespaces.html.md
index e7835b90..153bf315 100644
--- a/website/docs/d/namespaces.html.md
+++ b/website/docs/d/namespaces.html.md
@@ -3,26 +3,34 @@ layout: "vault"
 page_title: "Vault: vault_namespaces data source"
 sidebar_current: "docs-vault-datasource-namespaces"
 description: |-
-  Fetches a list of all direct child namespaces in Vault
+  List of all child namespaces in Vault
 ---
 
 # vault\_namespace
 
-Lists all direct child [Namespaces](https://developer.hashicorp.com/vault/docs/enterprise/namespaces) in Vault.
+Lists all child [Namespaces](https://developer.hashicorp.com/vault/docs/enterprise/namespaces) in Vault.
 
 **Note** this feature is available only with Vault Enterprise.
 
 ## Example Usage
 
-### Child namespaces
+### Direct child namespaces
 
 ```hcl
 data "vault_namespaces" "children" {}
 ```
 
-### Nested namespace
+### All child namespaces
 
-To fetch the details of nested namespaces:
+```hcl
+data "vault_namespaces" "children" {
+  recursive = true
+}
+```
+
+### Child namespace details
+
+To fetch the details of child namespaces:
 
 ```hcl
 data "vault_namespaces" "children" {
@@ -43,9 +51,11 @@ The following arguments are supported:
 * `namespace` - (Optional) The namespace to provision the resource in.
   The value should not contain leading or trailing forward slashes.
   The `namespace` is always relative to the provider's configured [namespace](/docs/providers/vault#namespace).
+* `recursive` - (Optional) If `true`, it will returns all child namespaces of the given namespace. Defaults to `false`, which returns only direct child namespaces.
 
 ## Attributes Reference
 
 In addition to the above arguments, the following attributes are exported:
 
-* `paths` - Set of the paths of direct child namespaces.
+* `paths` - Set of the paths of child namespaces.
+* `paths_fq` - Set of the fully qualified paths of child namespaces.
diff --git a/website/docs/d/policy_document.md b/website/docs/d/policy_document.md
index 8c44cc2f..3745bb0f 100644
--- a/website/docs/d/policy_document.md
+++ b/website/docs/d/policy_document.md
@@ -39,6 +39,8 @@ Each document configuration may have one or more `rule` blocks, which each accep
 
 * `required_parameters` - (Optional) A list of parameters that must be specified.
 
+* `subscribe_event_types` - (Optional) A list of event types to subscribe to when using `subscribe` capability.
+
 * `allowed_parameter` - (Optional) Whitelists a list of keys and values that are permitted on the given path. See [Parameters](#Parameters) below.
 
 * `denied_parameter` - (Optional) Blacklists a list of parameter and values. Any values specified here take precedence over `allowed_parameter`. See [Parameters](#Parameters) below.
diff --git a/website/docs/ephemeral-resources/database_secret.html.md b/website/docs/ephemeral-resources/database_secret.html.md
new file mode 100644
index 00000000..a45d0ebd
--- /dev/null
+++ b/website/docs/ephemeral-resources/database_secret.html.md
@@ -0,0 +1,73 @@
+---
+layout: "vault"
+page_title: "Vault: ephemeral vault_database_secret resource"
+sidebar_current: "docs-vault-ephemeral-database-secret"
+description: |-
+  Read an ephemeral dynamic secret from the Vault Database Secrets engine 
+
+---
+
+# vault\_database\_secret
+
+Reads an ephemeral dynamic secret from the Vault Database Secrets engine that is not stored in the remote TF state.
+For more information, please refer to [the Vault documentation](https://developer.hashicorp.com/vault/docs/secrets/databases)
+for the DB Secrets engine.
+
+## Example Usage
+
+```hcl
+resource "vault_mount" "db" {
+  path = "postgres"
+  type = "database"
+}
+
+resource "vault_database_secret_backend_connection" "postgres" {
+  backend       = vault_mount.db.path
+  name          = "postrgres-db"
+  allowed_roles = ["*"]
+
+  postgresql {
+    connection_url = "postgresql://{{username}}:{{password}}@localhost:5432/postgres"
+    password_authentication = ""
+    username = "postgres"
+    password_wo = "pgx-root-password"
+    password_wo_version = 1
+  }
+}
+
+resource "vault_database_secret_backend_role" "role" {
+  backend             = vault_mount.db.path
+  name                = "pgx-role"
+  db_name             = vault_database_secret_backend_connection.postgres.name
+  creation_statements = [
+    "CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';",
+    "GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";"
+  ]
+}
+
+ephemeral "vault_database_secret" "db_user_credentials" {
+  mount = vault_mount.db.path
+  name = vault_database_secret_backend_role.role.name
+  mount_id = vault_mount.db.id
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `mount` - (Required) Mount path for the DB engine in Vault without trailing or leading slashes.
+
+* `mount_id` - (Optional) If value is set, will defer provisioning the ephemeral resource until
+  `terraform apply`. For more details, please refer to the official documentation around
+  [using ephemeral resources in the Vault Provider](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_ephemeral_resources).
+
+* `name` - (Required) Name of the database role without trailing or leading slashes.
+
+## Attributes Reference
+
+The following attributes are exported in addition to the arguments listed above:
+
+* `username` - Username for the newly created DB user.
+
+* `password` - Password for the newly created DB user.
diff --git a/website/docs/ephemeral-resources/kv_secret_v2.html.md b/website/docs/ephemeral-resources/kv_secret_v2.html.md
new file mode 100644
index 00000000..9b0160dc
--- /dev/null
+++ b/website/docs/ephemeral-resources/kv_secret_v2.html.md
@@ -0,0 +1,92 @@
+---
+layout: "vault"
+page_title: "Vault: ephemeral vault_kv_secret_v2 resource"
+sidebar_current: "docs-vault-ephemeral-kv-secret-v2"
+description: |-
+  Read an ephemeral KVV2 secret from Vault 
+
+---
+
+# vault\_kv\_secret\_v2
+
+Reads an ephemeral KVV2 secret from Vault that is not stored in the remote TF state. For more information, please
+refer to [the Vault documentation](https://www.vaultproject.io/docs/secrets/kv/kv-v2) for the KVV2 engine.
+
+## Example Usage
+
+```hcl
+resource "vault_mount" "kvv2" {
+  path        = "my-kvv2"
+  type        = "kv"
+  options     = { version = "2" }
+}
+
+resource "vault_kv_secret_v2" "db_root" {
+  mount                      = vault_mount.kvv2.path
+  name                       = "pgx-root"
+  data_json_wo                  = jsonencode(
+    {
+      password       = "root-user-password"
+    }
+  )
+  data_json_wo_version = 1
+}
+
+ephemeral "vault_kv_secret_v2" "db_secret" {
+  mount = vault_mount.kvv2.path
+  mount_id = vault_mount.kvv2.id
+  name = vault_kv_secret_v2.db_root.name
+}
+
+resource "vault_database_secret_backend_connection" "postgres" {
+  backend       = vault_mount.db.path
+  name          = "postrgres-db"
+  allowed_roles = ["*"]
+
+  postgresql {
+    connection_url = "postgresql://{{username}}:{{password}}@localhost:5432/postgres"
+    password_authentication = ""
+    username = "postgres"
+    password_wo = tostring(ephemeral.vault_kv_secret_v2.db_secret.data.password)
+    password_wo_version = 1
+  }
+}
+```
+
+## Argument Reference
+
+The following arguments are supported:
+
+* `mount` - (Required) Mount path for the KVV2 engine in Vault without trailing or leading slashes.
+
+* `mount_id` - (Optional) If value is set, will defer provisioning the ephemeral resource until
+  `terraform apply`. For more details, please refer to the official documentation around
+  [using ephemeral resources in the Vault Provider](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_ephemeral_resources).
+
+* `name` - (Required) Full name of the secret without trailing or leading slashes. For a nested
+  secret, the name is the nested path excluding the mount and data prefix. For example, for a
+  secret at 'kvv2/data/foo/bar/baz', the name is 'foo/bar/baz'.
+
+* `version` (Optional) Version of the secret to retrieve.
+
+## Attributes Reference
+
+The following attributes are exported in addition to the arguments listed above:
+
+* `data` - A mapping whose keys are the top-level data keys returned from
+  Vault and whose values are the corresponding values. This map can only
+  represent string data, so any non-string values returned from Vault are
+  serialized as JSON.
+
+* `data_json` - JSON-encoded string that that is
+  read as the secret data at the given path.
+
+* `created_time` - Time at which secret was created.
+
+* `custom_metadata` - Custom metadata for the secret.
+
+* `deletion_time` - Deletion time for the secret.
+
+* `destroyed` - Indicates whether the secret has been destroyed.
+
+* `custom_metadata` - Custom metadata for the secret.
\ No newline at end of file
diff --git a/website/docs/guides/using_ephemeral_resources.html.markdown b/website/docs/guides/using_ephemeral_resources.html.markdown
new file mode 100644
index 00000000..e3b2b96f
--- /dev/null
+++ b/website/docs/guides/using_ephemeral_resources.html.markdown
@@ -0,0 +1,179 @@
+---
+layout: "vault"
+page_title: "Use ephemeral resources in the Terraform Vault Provider"
+sidebar_current: "docs-use-ephemeral-resources-in-the-vault-provider"
+description: |-
+  Use ephemeral resources in the Terraform Vault Provider
+
+---
+
+# Ephemeral Resources in the Vault provider
+
+Ephemeral resources are Terraform resources that are essentially temporary. They allow users to access
+and use data in their configurations without that data being stored in Terraform state.
+
+Ephemeral resources are available in Terraform v1.10 and later. For more information, see the 
+[official HashiCorp documentation for Ephemeral Resources](https://developer.hashicorp.com/terraform/language/resources/ephemeral).
+
+To mark the launch of the ephemeral resources feature, the Vault provider has added two ephemeral resources:
+- [`vault_kv_secret_v2`](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/ephemeral-resources/kv_secret_v2)
+- [`vault_database_secret`](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/ephemeral-resources/database_secret)
+
+`vault_kv_secret_v2` is based on an existing data sources already in the provider. Going forward
+you may wish to update your configurations to use these ephemeral versions, as they will allow you
+to avoid storing credentials and secret values in your Terraform state.
+
+## Use the Vault provider's new ephemeral resources
+
+Ephemeral resources are a source of ephemeral data, and they can be referenced in your
+configuration just like the attributes of resources and data sources. However, a field that
+references an ephemeral resource must be capable of handling ephemeral data. Due to this, resources
+in the Vault provider will need to be updated so they include write-only attributes that are
+capable of using ephemeral data while not storing those values in the resource's state.
+
+For the launch of ephemeral resources in `5.X`, three write-only parameters have been added to the Vault provider,
+with more to be added in upcoming releases. Please refer to the [using write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes)
+page for more details on using the parameters. Apart from these, ephemeral resources can also be used
+to pass values into provider configuration blocks and write-only attributes for other providers, since
+provider blocks are already capable of receiving ephemeral values.
+
+The following sections show two examples from the new ephemeral resources' documentation pages, which demonstrate
+how to use and test out the ephemeral resources in their current form.
+
+
+### Opt to defer provisioning an ephemeral resource until `terraform apply` using the `mount_id` parameter
+
+The [documentation](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/ephemeral-resources/kv_secret_v2)
+for the `vault_kv_secret_v2` ephemeral resource has a simple example that you can use to view how ephemeral resources
+in the Vault provider can always choose to defer provisioning until `terraform apply` using the `mount_id` parameter.
+The value for `mount_id` should be the set to the ID of the `vault_mount` resource being referenced:
+
+```hcl
+resource "vault_mount" "kvv2" {
+  path        = "my-kvv2"
+  type        = "kv"
+  options     = { version = "2" }
+}
+
+resource "vault_kv_secret_v2" "db_root" {
+  mount                      = vault_mount.kvv2.path
+  name                       = "pgx-root"
+  data_json_wo                  = jsonencode(
+    {
+      password       = "root-user-password"
+    }
+  )
+  data_json_wo_version = 1
+}
+
+ephemeral "vault_kv_secret_v2" "db_secret" {
+  mount = vault_mount.kvv2.path
+  name = vault_kv_secret_v2.db_root.name
+  mount_id = vault_mount.kvv2.id
+}
+```
+
+During `terraform plan`, the ephemeral resource depends on the unknown value `mount_id`, which will
+be known only after `vault_mount` has been created. Hence, you will see that the ephemeral resource
+is deferred until the apply step:
+
+```
+ephemeral.vault_kv_secret_v2.db_secret: Configuration unknown, deferring...
+
+Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
+  + create
+
+Terraform will perform the following actions:
+
+  # vault_kv_secret_v2.db_root will be created
+  + resource "vault_kv_secret_v2" "db_root" {
+      + data_json_wo         = (write-only attribute)
+      + data_json_wo_version = 1
+    ...
+```
+
+During `terrform apply` you will see the ephemeral resource is the final resource to be evaluated, because
+it depends on the two other resources, and the ephemeral resource is not reflected in the statistics
+about how many resources were created during the apply action:
+
+```
+vault_mount.kvv2: Creating...
+vault_mount.kvv2: Creation complete after 0s [id=my-kvv2]
+vault_kv_secret_v2.db_root: Creating...
+vault_kv_secret_v2.db_root: Creation complete after 0s [id=my-kvv2/data/pgx-user]
+ephemeral.vault_kv_secret_v2.db_secret: Opening...
+ephemeral.vault_kv_secret_v2.db_secret: Opening complete after 0s
+ephemeral.vault_kv_secret_v2.db_secret: Closing...
+ephemeral.vault_kv_secret_v2.db_secret: Closing complete after 0s
+
+Apply complete! Resources: 2 added, 0 changed, 0 destroyed
+```
+
+If you run the example using a local Vault server you can also inspect the state, where you will
+see that the ephemeral resource is not represented.
+
+Note that `mount_id` is only used to defer the provisioning of the ephemeral resource. 
+If the provisioning of the resource does not need to be deferred to the apply stage, `mount_id` may
+be omitted from the configuration:
+
+```hcl
+ephemeral "vault_kv_secret_v2" "db_secret" {
+  mount = vault_mount.kvv2.path
+  name = vault_kv_secret_v2.db_root.name
+}
+```
+
+
+### Use ephemeral resources to securely configure secrets and databases in the Vault provider
+
+The new ephemeral resources may be used to securely obtain secret/credential data from Vault
+in order to configure other resources or providers:
+
+```hcl
+provider "vault" {
+}
+
+# Securely obtain an already provisioned secret from Vault
+ephemeral "vault_kv_secret_v2" "db_secret" {
+  mount = "my-kvv2"
+  name = "pgx-root"
+}
+
+# Enable database secrets engine
+resource "vault_mount" "db" {
+  path = "postgres"
+  type = "database"
+}
+
+# Configure a secure Postgres connection using ephemeral resource and write-only attributes
+resource "vault_database_secret_backend_connection" "postgres" {
+  backend       = vault_mount.db.path
+  name          = "postrgres-db"
+  allowed_roles = ["pgx-role"]
+
+  postgresql {
+    connection_url = "postgresql://{{username}}:{{password}}@localhost:5432/postgres"
+    username = "postgres"
+    password_wo = tostring(ephemeral.vault_kv_secret_v2.db_secret.data.password)
+    password_wo_version = 1
+  }
+}
+
+# Create a role to generate Postgres DB credentials
+resource "vault_database_secret_backend_role" "role" {
+  backend             = vault_mount.db.path
+  name                = "pgx-role"
+  db_name             = vault_database_secret_backend_connection.postgres.name
+  creation_statements = [
+    "CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';",
+    "GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";"
+  ]
+}
+
+# Securely obtain database credentials using ephemeral resource
+ephemeral "vault_db_secret" "db_user_credentials" {
+  mount = vault_mount.db.path
+  name = vault_database_secret_backend_role.role.name
+  mount_id = vault_mount.db.id
+}
+```
\ No newline at end of file
diff --git a/website/docs/guides/using_write_only_attributes.html.markdown b/website/docs/guides/using_write_only_attributes.html.markdown
new file mode 100644
index 00000000..c6d3ec4e
--- /dev/null
+++ b/website/docs/guides/using_write_only_attributes.html.markdown
@@ -0,0 +1,152 @@
+---
+layout: "vault"
+page_title: "Use write-only attributes in the Terraform Vault Provider"
+sidebar_current: "docs-use-write-only-attributes-in-the-vault-provider"
+description: |-
+  Use write-only attributes in the Terraform Vault Provider
+
+---
+
+# Write-only attributes in the Vault provider
+
+
+The Vault provider has introduced new write-only attributes (supported from Terraform `v1.11+`) for a more secure way to manage data.
+The new `WriteOnly` attribute accepts values from configuration and will not be stored in plan or state
+providing an additional layer of security and control over data access.
+
+For more information, see the [official HashiCorp documentation for Write-only Attributes](https://developer.hashicorp.com/terraform/plugin/sdkv2/resources/write-only-arguments).
+
+To mark the launch of the feature in `5.X`, the Vault provider has added the following write-only attributes:
+- [`vault_kv_secret_v2: data_json_wo`](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/resources/kv_secret_v2#data_json_wo-1)
+- [`vault_database_secret_backend_connection_: password_wo`](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/resources/database_secret_backend_connection#password_wo-1)
+- [`vault_gcp_secret_backend: credentials_wo`](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/resources/gcp_secret_backend#credentials_wo-1)
+
+These were chosen due to them being marked as sensitive already in the provider. Although sensitive attributes
+do not appear in `terraform plan`, they are still stored in the Terraform state. Write-only attributes
+allow users to access and use data in their configurations without that data being stored in Terraform state.
+
+Going forward  you may wish to update your configurations to use these write-only attributes, as they will allow
+you to avoid storing credentials and secret values in your Terraform state.
+
+## Use the Vault provider's new write-only attributes
+
+The following sections show how to use the new write-only attributes in the Vault provider.
+
+### Applying a write-only attribute
+
+The following example shows how to apply a write-only attribute. All write-only attributes are marked
+with the `wo` suffix and can not be used with the attribute that it's mirroring.
+For example, `data_json_wo` can not be used with `data_json`. A write-only parameter must always
+be supplied with the attribute's version parameter, marked with the `wo_version` suffix:
+
+```hcl
+resource "vault_mount" "kvv2" {
+  path        = "my-kvv2"
+  type        = "kv"
+  options     = { version = "2" }
+}
+
+resource "vault_kv_secret_v2" "db_root" {
+  mount                      = vault_mount.kvv2.path
+  name                       = "pgx-root"
+  data_json_wo                  = jsonencode(
+    {
+      password       = "root-user-password"
+    }
+  )
+  data_json_wo_version = 1
+}
+```
+
+During `terraform plan` you will see that the write-only attribute is marked appropriately:
+
+```
+  # vault_kv_secret_v2.db_root will be created
+  + resource "vault_kv_secret_v2" "db_root" {
+      + data                 = (sensitive value)
+      + data_json_wo         = (write-only attribute)
+      + data_json_wo_version = 1
+      + delete_all_versions  = false
+      + disable_read         = false
+      + id                   = (known after apply)
+      + metadata             = (known after apply)
+      + mount                = "my-kvv2"
+      + name                 = "pgx-user"
+      + path                 = (known after apply)
+    }
+
+```
+
+Upon `terrform apply` you will see in `terraform.tfstate` that the write-only attribute from the configuration is not reflected in the state:
+
+```
+    ...
+    "mode": "managed",
+    "type": "vault_kv_secret_v2",
+    "name": "db_root",
+    "provider": "provider[\"registry.terraform.io/hashicorp/vault\"]",
+    "instances": [
+    {
+    "schema_version": 0,
+    "attributes": {
+    "cas": null,
+    "custom_metadata": [
+        {
+            "cas_required": false,
+            "data": {},
+            "delete_version_after": 0,
+            "max_versions": 0
+        }
+    ],
+    "data": {},
+    "data_json": null,
+    "data_json_wo": null,
+    "data_json_wo_version": 1,
+    "delete_all_versions": false,
+    "disable_read": false,
+    "id": "my-kvv2/data/pgx-user",
+    ...
+    }
+```
+
+Any value that is set for a write-only attribute is nulled out before the RPC response is sent to Terraform.
+
+### Updating write-only attributes
+
+Since write-only attributes are not stored in the Terraform state, they cannot be updated by just changing the value in the configuration due to the attribute being nulled out.
+
+In order to update a write-only attribute we must change the write-only attribute's version.
+
+```hcl
+resource "vault_kv_secret_v2" "db_root" {
+  mount                      = vault_mount.kvv2.path
+  name                       = "pgx-root"
+  data_json_wo                  = jsonencode(
+    {
+      password       = "root-user-password-updated" // updated secret data
+    }
+  )
+  data_json_wo_version = 2 // updated data version
+}
+```
+
+A `terraform apply` of this configuration will allow you to update the write-only attribute despite the new value not being shown in the plan.
+
+```
+Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
+  ~ update in-place
+
+Terraform will perform the following actions:
+
+  # vault_kv_secret_v2.db_root will be updated in-place
+  ~ resource "vault_kv_secret_v2" "db_root" {
+      ~ data_json_wo_version = 1 -> 2
+        id                   = "my-kvv2/data/pgx-root"
+        name                 = "pgx-root"
+        # (7 unchanged attributes hidden)
+
+        # (1 unchanged block hidden)
+    }
+
+Plan: 0 to add, 1 to change, 0 to destroy.
+```
\ No newline at end of file
diff --git a/website/docs/guides/version_5_upgrade.html.markdown b/website/docs/guides/version_5_upgrade.html.markdown
new file mode 100644
index 00000000..cc9d66b0
--- /dev/null
+++ b/website/docs/guides/version_5_upgrade.html.markdown
@@ -0,0 +1,166 @@
+---
+layout: "vault"
+page_title: "Terraform Vault Provider 5.X Upgrade Guide"
+sidebar_current: "docs-vault-provider-version-5-upgrade"
+description: |-
+  Terraform Vault Provider 5.X Upgrade Guide
+
+---
+
+# Terraform Vault Provider 5.X Upgrade Guide
+
+Version `5.X` of the Vault provider for Terraform is a major release and
+includes some changes that you will need to consider when upgrading. This guide
+is intended to help with that process and focuses only on the changes necessary
+to upgrade from version `4.X` to `5.X`.
+
+Most of the changes outlined in this guide have been previously marked as
+deprecated in the Terraform `plan`/`apply` output throughout previous provider
+releases, up to and including 4.8.0. These changes, such as deprecation notices,
+can always be found in the [CHANGELOG](https://github.com/hashicorp/terraform-provider-vault/blob/master/CHANGELOG.md).
+
+-> If you are upgrading from `1.9.x`. Please follow the
+[2.0.0 Upgrade Guide](./version_2_upgrade.html) before proceeding any further.
+
+-> If you are upgrading from `2.24.X`. Please follow the
+[3.0.0 Upgrade Guide](./version_3_upgrade.html) before proceeding any further.
+
+-> If you are upgrading from `3.25.X`. Please follow the
+[4.0.0 Upgrade Guide](./version_4_upgrade.html) before proceeding any further.
+
+## Why version 5.X?
+
+We introduced version `5.X` in order to multiplex the provider
+to use the [Terraform Plugin Framework](https://developer.hashicorp.com/terraform/plugin/framework),
+upgrade to Terraform `1.11.x`, and support Ephemeral Resources and Write-Only attributes.
+The change was deemed significant enough to warrant the major version bump.
+In addition to the aforementioned Framework upgrade, previously deprecated fields have been removed.
+
+While you may see some small changes in your configurations as a result of
+these changes, we don't expect you'll need to make any major refactorings.
+
+## What Vault server versions are supported in version 5.X?
+
+The Vault provider will be dropping Vault version support for Vault <= `1.14.x`.
+This means that going forward only Vault server version `1.15.x` and greater will be officially
+tested against.
+
+## Which Terraform versions are supported?
+
+In order to support Ephemeral resources and Write-Only attributes, Terraform versions `1.11.x `
+and greater are fully supported.
+
+Please see the [Terraform Upgrade Guide](https://developer.hashicorp.com/terraform/language/upgrade-guides)
+for more info about upgrading Terraform.
+
+## I accidentally upgraded to 5.X, how do I downgrade to 4.X?
+
+If you've inadvertently upgraded to `5.X`, first see the
+[Provider Version Configuration Guide](#provider-version-configuration) to lock
+your provider version; if you've constrained the provider to a lower version
+such as shown in the previous version example in that guide, Terraform will pull
+in a `4.X` series release on `terraform init`.
+
+If you've only run `terraform init` or `terraform plan`, your state will not
+have been modified and downgrading your provider is sufficient.
+
+If you've run `terraform refresh` or `terraform apply`, Terraform may have made
+state changes in the meantime.
+
+- If you're using a *local* state, `terraform refresh` with a downgraded
+  provider is likely sufficient to revert your state.
+- If you're using a *remote* state backend
+    - That does not support versioning, see the local state instructions above
+    - That supports *versioning* you can revert the Terraform state file to a previous
+      version by hand. If you do so and Terraform created resources as part of a
+      `terraform apply`, you'll need to either `terraform import` them or delete
+      them by hand.
+
+## Upgrade Topics
+
+<!-- TOC depthFrom:2 depthTo:2 -->
+
+- [Provider Version Configuration](#provider-version-configuration)
+- [Provider: `address`](#provider-address)
+- [Provider: `token`](#provider-token)
+- [Resource: `vault_kv_secret_v2`](#resource-vault_kv_secret_v2)
+- [Deprecated Field Removals](#deprecated-field-removals)
+    - [Okta Auth Backend](#okta-auth-backend)
+        - [`ttl`](#okta-secret-backend)
+        - [`max_ttl`](#okta-secret-backend)
+
+<!-- /TOC -->
+
+## Provider Version Configuration
+
+-> Before upgrading to version `5.X`, it is recommended to upgrade to the most
+recent version of the provider (`4.8.0`) and ensure that your environment
+successfully runs [`terraform plan`](https://developer.hashicorp.com/terraform/cli/commands/plan)
+without unexpected changes or deprecation notices.
+
+It is recommended to use [version constraints](https://developer.hashicorp.com/terraform/language/providers/configuration#provider-versions)
+when configuring Terraform providers. If you are following that recommendation,
+update the version constraints in your Terraform configuration and run
+[`terraform init`](https://developer.hashicorp.com/terraform/cli/commands/init) to download
+the new version.
+
+If you aren't using version constraints, you can use `terraform init -upgrade`
+in order to upgrade your provider to the latest released version.
+
+For example, given this previous configuration:
+
+```hcl
+provider "vault" {
+  # ... other configuration ...
+
+  version = "~> 4.8.0"
+}
+```
+
+An updated configuration:
+
+```hcl
+provider "vault" {
+  # ... other configuration ...
+
+  version = "~> 5.0.0"
+}
+```
+
+## Provider: `address`
+This field will no longer be requested via input if unset, but the provider will still error
+if it is not set in the config or via the environment variable `VAULT_ADDR`.
+
+## Provider: `token`
+This field will no longer be requested via input if unset, but the provider will still error
+if it is not set in the config or via the environment variable `VAULT_TOKEN`.
+
+
+## Resource: `vault_kv_secret_v2`
+
+*BREAKING CHANGE*
+With the addition of an ephemeral resource and write-only attributes for KVV2, this resource will maintain the 
+KVV2 engine in Vault as the source of truth, and will no longer store/track the secret data in the Terraform state.
+
+This resource will still store metadata and other parameters on the secret, but not the secret itself:
+* `data` - This computed attribute has been deprecated, and will no longer be set to the TF state. Please use the
+  new ephemeral resource `vault_kv_secret_v2` to read the secret back from Vault to reference in other resources.
+
+* `data_json` - Drifts in this value outside of Terraform will no longer be read from Vault and tracked in the TF state. 
+  It is also recommended to switch to using the new write-only attributes `data_json_wo` and `data_json_wo_version` to avoid 
+  leaking the secret data to the TF state.
+
+
+## Deprecated Field Removals
+
+The following deprecated fields have been removed:
+
+### Okta Auth Backend
+
+* `ttl` - removed from the `vault_okta_auth_backend` resource.
+
+* `max_ttl` - removed from the `vault_okta_auth_backend` resource.
+
+### Azure Secret Backend
+
+* `use_microsoft_graph_api` - removed from the `vault_azure_secret_backend` resource.
diff --git a/website/docs/index.html.markdown b/website/docs/index.html.markdown
index e5d70f9d..1e5e632c 100644
--- a/website/docs/index.html.markdown
+++ b/website/docs/index.html.markdown
@@ -9,7 +9,7 @@ description: |-
 # Vault Provider
 
 The Vault provider allows Terraform to read from, write to, and configure
-[HashiCorp Vault](https://vaultproject.io/).
+[HashiCorp Vault](https://developer.hashicorp.com/vault).
 
 ~> **Important** Interacting with Vault from Terraform causes any secrets
 that you read and write to be persisted in both Terraform's state file
@@ -158,12 +158,6 @@ variables in order to keep credential information out of the configuration.
   a limited child token using auth/token/create in order to enforce a short
   TTL and limit exposure. *[See usage details below.](#generic)*
 
-* `client_auth` - (Optional) A configuration block, described below, that
-  provides credentials used by Terraform to authenticate with the Vault
-  server. At present there is little reason to set this, because Terraform
-  does not support the TLS certificate authentication mechanism.
-  *Deprecated, use `auth_login_cert` instead.
-
 * `skip_tls_verify` - (Optional) Set this to `true` to disable verification
   of the Vault server's TLS certificate. This is strongly discouraged except
   in prototype or development environments, since it exposes the possibility
@@ -212,10 +206,6 @@ variables in order to keep credential information out of the configuration.
 
 * `use_root_namespace` - (Optional) Authenticate to the root Vault namespace. Conflicts with `namespace`.
 
-* `set_namespace_from_token` -(Optional) Defaults to `true`. In the case where the Vault token is
-  for a specific namespace and the provider namespace is not configured, use the token namespace
-  as the root namespace for all resources.
-
 * `skip_get_vault_version` - (Optional) Skip the dynamic fetching of the Vault server version. 
   Set to `true` when the */sys/seal-status* API endpoint is not available. See [vault_version_override](#vault_version_override)
   for related info
@@ -232,14 +222,6 @@ only ever use this option in the case where the server version cannot be dynamic
 to be sent along with all requests to the Vault server.  This block can be specified
 multiple times.
 
-The `client_auth` configuration block accepts the following arguments:
-
-* `cert_file` - (Required) Path to a file on local disk that contains the
-  PEM-encoded certificate to present to the server.
-
-* `key_file` - (Required) Path to a file on local disk that contains the
-  PEM-encoded private key for which the authentication certificate was issued.
-
 The `headers` configuration block accepts the following arguments:
 
 * `name` - (Required) The name of the header.
@@ -741,9 +723,9 @@ provider "vault" {
 The Vault provider supports managing [Namespaces][namespaces] (a feature of
 Vault Enterprise), as well as creating resources in those namespaces by
 utilizing [Provider Aliasing][aliasing]. The `namespace` option in the [provider
-block][provider-block] enables the management of  resources in the specified
-namespace. 
-In addition, all resources and data sources support specifying their own `namespace`. 
+block](#provider-arguments) enables the management of resources in the specified
+namespace.
+In addition, all resources and data sources support specifying their own `namespace`.
 All resource's `namespace` will be made relative to the `provider`'s configured namespace.
 
 ### Importing namespaced resources
@@ -966,11 +948,19 @@ default
 vault_team_policy
 ```
 
-## Tutorials 
+### Token namespaces
+
+In the case where the Vault token is for a specific namespace and the provider
+namespace is not configured, the provider will use the token namespace as the
+root namespace for all resources. This behavior can be disabled by setting the
+`VAULT_SET_NAMESPACE_FROM_TOKEN ` environment variable to "false". The only
+accepted values are "true" and "false".
+
+
+## Tutorials
 
 Refer to the [Codify Management of Vault Enterprise Using Terraform](https://learn.hashicorp.com/tutorials/vault/codify-mgmt-enterprise) tutorial for additional examples using Vault namespaces.
 
 
-[namespaces]: https://www.vaultproject.io/docs/enterprise/namespaces#vault-enterprise-namespaces
-[aliasing]: https://www.terraform.io/docs/configuration/providers.html#alias-multiple-provider-configurations
-[provider-block]: /docs#provider-arguments
+[namespaces]: https://developer.hashicorp.com/vault/docs/enterprise/namespaces#vault-enterprise-namespaces
+[aliasing]: https://developer.hashicorp.com/terraform/language/providers/configuration#alias-multiple-provider-configurations
diff --git a/website/docs/r/azure_secret_backend.html.md b/website/docs/r/azure_secret_backend.html.md
index ebb511bb..9dc3ee02 100644
--- a/website/docs/r/azure_secret_backend.html.md
+++ b/website/docs/r/azure_secret_backend.html.md
@@ -23,7 +23,7 @@ for more details.
 See [use_microsoft_graph_api ](https://www.vaultproject.io/api-docs/secret/azure#use_microsoft_graph_api)
 for more information. The example below demonstrates how to do this. 
 
-## Example Usage: *vault-1.9 and above*
+## Example Usage:
 
 You can setup the Azure secrets engine with Workload Identity Federation (WIF) for a secret-less configuration:
 ```hcl
@@ -40,7 +40,6 @@ resource "vault_azure_secret_backend" "azure" {
 
 ```hcl
 resource "vault_azure_secret_backend" "azure" {
-  use_microsoft_graph_api = true
   subscription_id         = "11111111-2222-3333-4444-111111111111"
   tenant_id               = "11111111-2222-3333-4444-222222222222"
   client_id               = "11111111-2222-3333-4444-333333333333"
@@ -51,19 +50,6 @@ resource "vault_azure_secret_backend" "azure" {
 }
 ```
 
-## Example Usage: *vault-1.8 and below*
-
-```hcl
-resource "vault_azure_secret_backend" "azure" {
-  use_microsoft_graph_api = false
-  subscription_id         = "11111111-2222-3333-4444-111111111111"
-  tenant_id               = "11111111-2222-3333-4444-222222222222"
-  client_id               = "11111111-2222-3333-4444-333333333333"
-  client_secret           = "12345678901234567890"
-  environment             = "AzurePublicCloud"
-}
-```
-
 ## Argument Reference
 
 The following arguments are supported:
@@ -75,10 +61,6 @@ The following arguments are supported:
 
 - `subscription_id` (`string: <required>`) - The subscription id for the Azure Active Directory.
 
-- `use_microsoft_graph_api` (`bool: <optional>`) - Indicates whether the secrets engine should use 
-  the Microsoft Graph API. This parameter has been deprecated and will be ignored in `vault-1.12+`. 
-  For more information, please refer to the [Vault docs](https://developer.hashicorp.com/vault/api-docs/secret/azure#use_microsoft_graph_api)
-
 - `tenant_id` (`string: <required>`) - The tenant id for the Azure Active Directory.
 
 - `client_id` (`string:""`) - The OAuth2 client id to connect to Azure.
diff --git a/website/docs/r/azure_secret_backend_role.html.md b/website/docs/r/azure_secret_backend_role.html.md
index 493cca17..75e2ff6c 100644
--- a/website/docs/r/azure_secret_backend_role.html.md
+++ b/website/docs/r/azure_secret_backend_role.html.md
@@ -73,6 +73,7 @@ The following arguments are supported:
   Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
 * `max_ttl` – (Optional) Specifies the maximum TTL for service principals generated using this role. Accepts time
   suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
+* `explicit_max_ttl` - (Optional) Specifies the explicit maximum lifetime of the lease and service principal generated using this role. If not set or set to 0, will use the system default (10 years). Requires Vault 1.18+.
 * `sign_in_audience` - (Optional) Specifies the security principal types that are allowed to sign in to the application.
   Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount. Requires Vault 1.16+.
 * `tags` - (Optional) - A list of Azure tags to attach to an application. Requires Vault 1.16+.
diff --git a/website/docs/r/database_secret_backend_connection.md b/website/docs/r/database_secret_backend_connection.md
index f52d12c5..97fcf30e 100644
--- a/website/docs/r/database_secret_backend_connection.md
+++ b/website/docs/r/database_secret_backend_connection.md
@@ -141,6 +141,8 @@ Exactly one of the nested blocks of configuration options must be supplied.
 * `skip_verification` - (Optional) Skip permissions checks when a connection to Cassandra is first created.
   These checks ensure that Vault is able to create roles, but can be resource intensive in clusters with many roles.
 
+* `password_wo_version` - (Optional)  The version of the `password_wo`. For more info see [updating write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes.html#updating-write-only-attributes).
+
 ### Couchbase Configuration Options
 
 * `hosts` - (Required) A set of Couchbase URIs to connect to. Must use `couchbases://` scheme if `tls` is `true`.
@@ -160,6 +162,8 @@ Exactly one of the nested blocks of configuration options must be supplied.
 
 * `username_template` - (Optional) Template describing how dynamic usernames are generated.
 
+* `password_wo_version` - (Optional)  The version of the `password_wo`. For more info see [updating write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes.html#updating-write-only-attributes).
+
 ### InfluxDB Configuration Options
 
 * `host` - (Required) The host to connect to.
@@ -186,6 +190,8 @@ Exactly one of the nested blocks of configuration options must be supplied.
 * `connect_timeout` - (Optional) The number of seconds to use as a connection
   timeout.
 
+* `password_wo_version` - (Optional)  The version of the `password_wo`. For more info see [updating write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes.html#updating-write-only-attributes).
+
 ### Redis Configuration Options
 
 * `host` - (Required) The host to connect to.
@@ -214,6 +220,8 @@ Exactly one of the nested blocks of configuration options must be supplied.
 
 * `region` - (Optional) The region where the ElastiCache cluster is hosted. If omitted Vault tries to infer from the environment instead.
 
+* `password_wo_version` - (Optional)  The version of the `password_wo`. For more info see [updating write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes.html#updating-write-only-attributes).
+
 ### MongoDB Configuration Options
 
 * `connection_url` - (Required) A URL containing connection information. See
@@ -229,6 +237,8 @@ Exactly one of the nested blocks of configuration options must be supplied.
 See the [Vault
   docs](https://www.vaultproject.io/docs/concepts/username-templating)
 
+* `password_wo_version` - (Optional)  The version of the `password_wo`. For more info see [updating write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes.html#updating-write-only-attributes).
+
 ### MongoDB Atlas Configuration Options
 
 * `public_key` - (Required) The Public Programmatic API Key used to authenticate with the MongoDB Atlas API.
@@ -259,6 +269,8 @@ See the [Vault
 
 * `disable_escaping` - (Optional) Disable special character escaping in username and password.
 
+* `password_wo_version` - (Optional)  The version of the `password_wo`. For more info see [updating write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes.html#updating-write-only-attributes).
+
 ### MSSQL Configuration Options
 
 * `connection_url` - (Required) A URL containing connection information. See
@@ -290,6 +302,8 @@ See the [Vault
   See the [Vault
   docs](https://www.vaultproject.io/api/secret/databases/mssql#contained_db)
 
+* `password_wo_version` - (Optional)  The version of the `password_wo`. For more info see [updating write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes.html#updating-write-only-attributes).
+
 ### MySQL Configuration Options
 
 * `connection_url` - (Required) A URL containing connection information. See
@@ -322,6 +336,8 @@ See the [Vault
 See the [Vault
   docs](https://www.vaultproject.io/docs/concepts/username-templating)
 
+* `password_wo_version` - (Optional)  The version of the `password_wo`. For more info see [updating write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes.html#updating-write-only-attributes).
+
 ### PostgreSQL Configuration Options
 
 * `connection_url` - (Required) A URL containing connection information. See
@@ -369,6 +385,8 @@ See the [Vault
 See the [Vault
   docs](https://www.vaultproject.io/docs/concepts/username-templating)
 
+* `password_wo_version` - (Optional)  The version of the `password_wo`. For more info see [updating write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes.html#updating-write-only-attributes).
+
 ### Oracle Configuration Options
 
 * `connection_url` - (Required) A URL containing connection information. See
@@ -397,6 +415,8 @@ See the [Vault
 
 * `disconnect_sessions` - (Optional) Enable the built-in session disconnect mechanism.
 
+* `password_wo_version` - (Optional)  The version of the `password_wo`. For more info see [updating write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes.html#updating-write-only-attributes).
+
 ### Elasticsearch Configuration Options
 
 * `url` - (Required) The URL for Elasticsearch's API. https requires certificate
@@ -420,6 +440,8 @@ See the [Vault
 
 * `username_template` - (Optional) For Vault v1.7+. The template to use for username generation. See [Vault docs](https://www.vaultproject.io/docs/concepts/username-templating) for more details.
 
+* `password_wo_version` - (Optional)  The version of the `password_wo`. For more info see [updating write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes.html#updating-write-only-attributes).
+
 ### Snowflake Configuration Options
 
 * `connection_url` - (Required) A URL containing connection information. See
@@ -442,6 +464,8 @@ See the [Vault
 
 * `username_template` - (Optional) - [Template](https://www.vaultproject.io/docs/concepts/username-templating) describing how dynamic usernames are generated.
 
+* `password_wo_version` - (Optional)  The version of the `password_wo`. For more info see [updating write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes.html#updating-write-only-attributes).
+
 ### Redshift Configuration Options
 
 * `connection_url` - (Required) Specifies the Redshift DSN. See
@@ -465,6 +489,15 @@ See the [Vault
 
 * `username_template` - (Optional) - [Template](https://www.vaultproject.io/docs/concepts/username-templating) describing how dynamic usernames are generated.
 
+* `password_wo_version` - (Optional)  The version of the `password_wo`. For more info see [updating write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes.html#updating-write-only-attributes).
+
+## Ephemeral Attributes Reference
+
+The following write-only attributes are supported for all DBs that support username/password:
+
+* `password_wo` - (Optional) The password for the user. Can be updated.
+  **Note**: This property is write-only and will not be read from the API.
+
 ## Attributes Reference
 
 No additional attributes are exported by this resource.
diff --git a/website/docs/r/database_secrets_mount.md b/website/docs/r/database_secrets_mount.md
index c3275ebf..667f01f4 100644
--- a/website/docs/r/database_secrets_mount.md
+++ b/website/docs/r/database_secrets_mount.md
@@ -211,6 +211,8 @@ Supported list of database secrets engines that can be configured:
 * `connect_timeout` - (Optional) The number of seconds to use as a connection
   timeout.
 
+* `password_wo_version` - (Optional)  The version of the `password_wo`. For more info see [updating write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes.html#updating-write-only-attributes).
+
 ### Couchbase Configuration Options
 
 * `hosts` - (Required) A set of Couchbase URIs to connect to. Must use `couchbases://` scheme if `tls` is `true`.
@@ -229,6 +231,8 @@ Supported list of database secrets engines that can be configured:
 * `bucket_name` - (Optional) Required for Couchbase versions prior to 6.5.0. This is only used to verify vault's connection to the server.
 
 * `username_template` - (Optional) Template describing how dynamic usernames are generated.
+
+* `password_wo_version` - (Optional)  The version of the `password_wo`. For more info see [updating write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes.html#updating-write-only-attributes).
  
 ### Elasticsearch Configuration Options
 
@@ -254,6 +258,8 @@ Supported list of database secrets engines that can be configured:
 * `username_template` - (Optional) For Vault v1.7+. The template to use for username generation.  
   See [Vault docs](https://www.vaultproject.io/docs/concepts/username-templating) for more details.
 
+* `password_wo_version` - (Optional)  The version of the `password_wo`. For more info see [updating write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes.html#updating-write-only-attributes).
+
 ### InfluxDB Configuration Options
 
 * `host` - (Required) The host to connect to.
@@ -280,6 +286,8 @@ Supported list of database secrets engines that can be configured:
 * `connect_timeout` - (Optional) The number of seconds to use as a connection
   timeout.
 
+* `password_wo_version` - (Optional)  The version of the `password_wo`. For more info see [updating write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes.html#updating-write-only-attributes).
+
 ### MongoDB Configuration Options
 
 * `connection_url` - (Required) A URL containing connection information.  
@@ -292,6 +300,8 @@ Supported list of database secrets engines that can be configured:
 * `username_template` - (Optional) For Vault v1.7+. The template to use for username generation.  
   See [Vault docs](https://www.vaultproject.io/docs/concepts/username-templating)
 
+* `password_wo_version` - (Optional)  The version of the `password_wo`. For more info see [updating write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes.html#updating-write-only-attributes).
+
 ### MongoDB Atlas Configuration Options
 
 * `public_key` - (Required) The Public Programmatic API Key used to authenticate with the MongoDB Atlas API.
@@ -320,6 +330,8 @@ Supported list of database secrets engines that can be configured:
 
 * `disable_escaping` - (Optional) Disable special character escaping in username and password.
 
+* `password_wo_version` - (Optional)  The version of the `password_wo`. For more info see [updating write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes.html#updating-write-only-attributes).
+
 ### MSSQL Configuration Options
 
 * `connection_url` - (Required) A URL containing connection information.  
@@ -347,6 +359,8 @@ Supported list of database secrets engines that can be configured:
   Contained Database, e.g. AzureSQL.  
   See [Vault docs](https://www.vaultproject.io/api/secret/databases/mssql#contained_db)
 
+* `password_wo_version` - (Optional)  The version of the `password_wo`. For more info see [updating write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes.html#updating-write-only-attributes).
+
 ### MySQL Configuration Options
 
 * `connection_url` - (Required) A URL containing connection information.  
@@ -372,6 +386,8 @@ Supported list of database secrets engines that can be configured:
 * `username_template` - (Optional) For Vault v1.7+. The template to use for username generation.  
    See [Vault docs](https://www.vaultproject.io/docs/concepts/username-templating)
 
+* `password_wo_version` - (Optional)  The version of the `password_wo`. For more info see [updating write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes.html#updating-write-only-attributes).
+
 ### Oracle Configuration Options
 
 * `connection_url` - (Required) A URL containing connection information.  
@@ -393,6 +409,8 @@ Supported list of database secrets engines that can be configured:
 * `username_template` - (Optional) For Vault v1.7+. The template to use for username generation.  
   See [Vault docs](https://www.vaultproject.io/docs/concepts/username-templating)
 
+* `password_wo_version` - (Optional)  The version of the `password_wo`. For more info see [updating write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes.html#updating-write-only-attributes).
+
 ### PostgreSQL Configuration Options
 
 * `connection_url` - (Required) A URL containing connection information.  
@@ -416,6 +434,8 @@ Supported list of database secrets engines that can be configured:
 * `username_template` - (Optional) For Vault v1.7+. The template to use for username generation.
   See [Vault docs](https://www.vaultproject.io/docs/concepts/username-templating)
 
+* `password_wo_version` - (Optional)  The version of the `password_wo`. For more info see [updating write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes.html#updating-write-only-attributes).
+
 ### Redis Configuration Options
 
 * `host` - (Required) The host to connect to.
@@ -434,6 +454,8 @@ Supported list of database secrets engines that can be configured:
 
 * `ca_cert` - (Optional) The contents of a PEM-encoded CA cert file to use to verify the Redis server's identity.
 
+* `password_wo_version` - (Optional)  The version of the `password_wo`. For more info see [updating write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes.html#updating-write-only-attributes).
+
 ### Redis ElastiCache Configuration Options
 
 * `url` - (Required) The configuration endpoint for the ElastiCache cluster to connect to.
@@ -447,6 +469,8 @@ Supported list of database secrets engines that can be configured:
 * `region` - (Optional) The AWS region where the ElastiCache cluster is hosted.
   If omitted the plugin tries to infer the region from the environment.
 
+* `password_wo_version` - (Optional)  The version of the `password_wo`. For more info see [updating write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes.html#updating-write-only-attributes).
+
 ### AWS Redshift Configuration Options
 
 * `connection_url` - (Required) Specifies the Redshift DSN. 
@@ -468,6 +492,7 @@ Supported list of database secrets engines that can be configured:
 
 * `username_template` - (Optional) - [Template](https://www.vaultproject.io/docs/concepts/username-templating) describing how dynamic usernames are generated.
 
+* `password_wo_version` - (Optional)  The version of the `password_wo`. For more info see [updating write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes.html#updating-write-only-attributes).
 
 ### Snowflake Configuration Options
 
@@ -489,6 +514,15 @@ Supported list of database secrets engines that can be configured:
 
 * `username_template` - (Optional) - [Template](https://www.vaultproject.io/docs/concepts/username-templating) describing how dynamic usernames are generated.
 
+* `password_wo_version` - (Optional)  The version of the `password_wo`. For more info see [updating write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes.html#updating-write-only-attributes).
+
+## Ephemeral Attributes Reference
+
+The following write-only attributes are supported for all DBs that support username/password:
+
+* `password_wo` - (Optional) The password for the user. Can be updated.
+  **Note**: This property is write-only and will not be read from the API.
+
 ## Attributes Reference
 
 * `engine_count` - The total number of database secrets engines configured.
diff --git a/website/docs/r/gcp_secret_backend.html.md b/website/docs/r/gcp_secret_backend.html.md
index 2ee44531..695934bf 100644
--- a/website/docs/r/gcp_secret_backend.html.md
+++ b/website/docs/r/gcp_secret_backend.html.md
@@ -99,6 +99,15 @@ for credentials issued by this backend. Defaults to '0'.
 * `disable_automated_rotation` - (Optional) Cancels all upcoming rotations of the root credential until unset. Requires Vault Enterprise 1.19+.
   *Available only for Vault Enterprise*.
 
+* `credentials_wo_version` - (Optional)  The version of the `credentials_wo`. For more info see [updating write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes.html#updating-write-only-attributes).
+
+## Ephemeral Attributes Reference
+
+The following write-only attributes are supported:
+
+* `credentials_wo` - (Optional) The GCP service account credentials in JSON format. Can be updated.
+  **Note**: This property is write-only and will not be read from the API.
+
 ## Attributes Reference
 
 In addition to the arguments above, the following attributes are exported:
diff --git a/website/docs/r/kv_secret_v2.html.md b/website/docs/r/kv_secret_v2.html.md
index b5310911..507acca6 100644
--- a/website/docs/r/kv_secret_v2.html.md
+++ b/website/docs/r/kv_secret_v2.html.md
@@ -80,6 +80,8 @@ The following arguments are supported:
   KV secret. Refer to the
   [Configuration Options](#custom-metadata-configuration-options) for more info.
 
+* `data_json_wo_version` - (Optional) The version of the `data_json_wo`. For more info see [updating write-only attributes](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/guides/using_write_only_attributes.html#updating-write-only-attributes).
+
 ## Required Vault Capabilities
 
 Use of this resource requires the `create` or `update` capability
@@ -99,16 +101,23 @@ and the `read` capability for drift detection (by default).
 
 * `data` - (Optional) A string to string map describing the secret.
 
+## Ephemeral Attributes Reference
+
+The following write-only attributes are supported:
+
+* `data_json_wo` - (Optional) JSON-encoded secret data to write to Vault. Can be updated.
+  **Note**: This property is write-only and will not be read from the API.
+
 ## Attributes Reference
 
 The following attributes are exported in addition to the above:
 
 * `path` - Full path where the KV-V2 secret will be written.
 
-* `data` - A mapping whose keys are the top-level data keys returned from
-Vault and whose values are the corresponding values. This map can only
-represent string data, so any non-string values returned from Vault are
-serialized as JSON.
+* `data` - **Deprecated. Please use new ephemeral resource `vault_kv_secret_v2` to read back
+  secret data from Vault**. A mapping whose keys are the top-level data keys returned from
+  Vault and whose values are the corresponding values. This map can only represent string data,
+  so any non-string values returned from Vault are serialized as JSON.
 
 * `metadata` - Metadata associated with this secret read from Vault.
 
diff --git a/website/docs/r/okta_auth_backend.html.md b/website/docs/r/okta_auth_backend.html.md
index fee0805f..8fd7e056 100644
--- a/website/docs/r/okta_auth_backend.html.md
+++ b/website/docs/r/okta_auth_backend.html.md
@@ -56,12 +56,6 @@ If this is not supplied only locally configured groups will be enabled.
 
 * `bypass_okta_mfa` - (Optional) When true, requests by Okta for a MFA check will be bypassed. This also disallows certain status checks on the account, such as whether the password is expired.
 
-* `ttl` - (Optional) Duration after which authentication will be expired.
-[See the documentation for info on valid duration formats](https://golang.org/pkg/time/#ParseDuration).
-
-* `max_ttl` - (Optional) Maximum duration after which authentication will be expired
-[See the documentation for info on valid duration formats](https://golang.org/pkg/time/#ParseDuration).
-
 * `group` - (Optional) Associate Okta groups with policies within Vault.
 [See below for more details](#okta-group). 
 
diff --git a/website/docs/r/pki_secret_backend_root_sign_intermediate.html.md b/website/docs/r/pki_secret_backend_root_sign_intermediate.html.md
index c6661e66..7791479d 100644
--- a/website/docs/r/pki_secret_backend_root_sign_intermediate.html.md
+++ b/website/docs/r/pki_secret_backend_root_sign_intermediate.html.md
@@ -53,6 +53,8 @@ The following arguments are supported:
 
 * `max_path_length` - (Optional) The maximum path length to encode in the generated certificate
 
+* `key_usage` - (Optional) Specify the key usages to be added to the existing set of key usages ("CRL", "CertSign") on the generated certificate.
+
 * `exclude_cn_from_sans` - (Optional) Flag to exclude CN from SANs
 
 * `use_csr_values` - (Optional) Preserve CSR values
@@ -89,6 +91,10 @@ The following arguments are supported:
 
 * `signature_bits` - (Optional) The number of bits to use in the signature algorithm
 
+* `skid` - (Optional) Value for the Subject Key Identifier field (see https://tools.ietf.org/html/rfc5280#section-4.2.1.2). Specified as a string in hex format.
+
+* `use_pss` - (Optional) Specifies whether or not to use PSS signatures over PKCS#1v1.5 signatures when a RSA-type issuer is used. Ignored for ECDSA/Ed25519 issuers.
+
 * `revoke` - If set to `true`, the certificate will be revoked on resource destruction.
 
 * `issuer_ref` - (Optional) Specifies the default issuer of this request. May
@@ -100,6 +106,8 @@ The following arguments are supported:
 The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ. Supports the Y10K end date 
 for IEEE 802.1AR-2018 standard devices, 9999-12-31T23:59:59Z.
 
+* `not_before_duration` - (Optional) Specifies the [duration](https://developer.hashicorp.com/vault/docs/concepts/duration-format) by which to backdate the NotBefore property.
+
 ## Attributes Reference
 
 In addition to the fields above, the following attributes are exported:
diff --git a/website/vault.erb b/website/vault.erb
index 24dbb770..ed1a96b1 100644
--- a/website/vault.erb
+++ b/website/vault.erb
@@ -22,6 +22,18 @@
                     <a href="/docs/providers/vault/guides/version_4_upgrade.html">4.0.0 Upgrade Guide</a>
                 </li>
 
+                <li<%= sidebar_current("docs-vault-provider-version-5-upgrade") %>>
+                    <a href="/docs/providers/vault/guides/version_5_upgrade.html">5.0.0 Upgrade Guide</a>
+                </li>
+
+                <li<%= sidebar_current("docs-use-ephemeral-resources-in-the-vault-provider") %>>
+                    <a href="/docs/providers/vault/guides/using_ephemeral_resources.html">Use ephemeral resources in the Vault provider</a>
+                </li>
+
+                <li<%= sidebar_current("docs-use-write-only-attributes-in-the-vault-provider") %>>
+                    <a href="/docs/providers/vault/guides/using_write_only_attributes.html">Use write-only attributes in the Vault provider</a>
+                </li>
+
                 <li<%= sidebar_current("docs-vault-pki-multi-issuer-upgrade") %>>
                     <a href="/docs/providers/vault/guides/pki_multi_issuer_upgrade.html">PKI Multi-Issuer Upgrade Guide</a>
                 </li>
@@ -164,6 +176,20 @@
                     </ul>
                 </li>
 
+                <li<%= sidebar_current("docs-vault-ephemeral") %>>
+                    <a href="#">Ephemeral Resources</a>
+                    <ul class="nav nav-visible">
+
+                        <li<%= sidebar_current("docs-vault-ephemeral-kv-secret-v2") %>>
+                            <a href="/docs/providers/vault/ephemeral-resources/kv_secret_v2.html">vault_kv_secret_v2</a>
+                        </li>
+                        <li<%= sidebar_current("docs-vault-ephemeral-database-secret") %>>
+                            <a href="/docs/providers/vault/ephemeral-resources/database_secret.html">vault_database_secret</a>
+                        </li>
+
+                    </ul>
+                </li>
+
                 <li<%= sidebar_current("docs-vault-resource") %>>
                     <a href="#">Resources</a>
                     <ul class="nav nav-visible">



Test patch:
diff --git a/internal/framework/validators/file_exists_test.go b/internal/framework/validators/file_exists_test.go
new file mode 100644
index 00000000..434ff03c
--- /dev/null
+++ b/internal/framework/validators/file_exists_test.go
@@ -0,0 +1,68 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package validators
+
+import (
+	"context"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+)
+
+const testFilePath = "./testdata/fake_account.json"
+
+func TestFrameworkProvider_FileExistsValidator(t *testing.T) {
+	cases := map[string]struct {
+		configValue        func(t *testing.T) types.String
+		expectedErrorCount int
+	}{
+		"file-is-valid": {
+			configValue: func(t *testing.T) types.String {
+				return types.StringValue(testFilePath) // Path to a test fixture
+			},
+		},
+		"non-existant-file-is-not-valid": {
+			configValue: func(t *testing.T) types.String {
+				return types.StringValue("./this/path/doesnt/exist.json") // Doesn't exist
+			},
+			expectedErrorCount: 1,
+		},
+		"empty-string-is-not-valid": {
+			configValue: func(t *testing.T) types.String {
+				return types.StringValue("")
+			},
+			expectedErrorCount: 1,
+		},
+		"unconfigured-is-valid": {
+			configValue: func(t *testing.T) types.String {
+				return types.StringNull()
+			},
+		},
+	}
+
+	for tn, tc := range cases {
+		t.Run(tn, func(t *testing.T) {
+			// Arrange
+			req := validator.StringRequest{
+				ConfigValue: tc.configValue(t),
+			}
+
+			resp := validator.StringResponse{
+				Diagnostics: diag.Diagnostics{},
+			}
+
+			f := FileExistsValidator()
+
+			// Act
+			f.ValidateString(context.Background(), req, &resp)
+
+			// Assert
+			if resp.Diagnostics.ErrorsCount() != tc.expectedErrorCount {
+				t.Errorf("Expected %d errors, got %d", tc.expectedErrorCount, resp.Diagnostics.ErrorsCount())
+			}
+		})
+	}
+}
diff --git a/internal/framework/validators/gcp_test.go b/internal/framework/validators/gcp_test.go
new file mode 100644
index 00000000..9eee65db
--- /dev/null
+++ b/internal/framework/validators/gcp_test.go
@@ -0,0 +1,79 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package validators
+
+import (
+	"context"
+	"io/ioutil"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+)
+
+const testFakeCredentialsPath = "./testdata/fake_account.json"
+
+func TestFrameworkProvider_CredentialsValidator(t *testing.T) {
+	cases := map[string]struct {
+		configValue        func(t *testing.T) types.String
+		expectedErrorCount int
+	}{
+		"configuring credentials as a path to a credentials JSON file is valid": {
+			configValue: func(t *testing.T) types.String {
+				return types.StringValue(testFakeCredentialsPath) // Path to a test fixture
+			},
+		},
+		"configuring credentials as a path to a non-existant file is NOT valid": {
+			configValue: func(t *testing.T) types.String {
+				return types.StringValue("./this/path/doesnt/exist.json") // Doesn't exist
+			},
+			expectedErrorCount: 1,
+		},
+		"configuring credentials as a credentials JSON string is valid": {
+			configValue: func(t *testing.T) types.String {
+				contents, err := ioutil.ReadFile(testFakeCredentialsPath)
+				if err != nil {
+					t.Fatalf("Unexpected error: %s", err)
+				}
+				stringContents := string(contents)
+				return types.StringValue(stringContents)
+			},
+		},
+		"configuring credentials as an empty string is not valid": {
+			configValue: func(t *testing.T) types.String {
+				return types.StringValue("")
+			},
+			expectedErrorCount: 1,
+		},
+		"leaving credentials unconfigured is valid": {
+			configValue: func(t *testing.T) types.String {
+				return types.StringNull()
+			},
+		},
+	}
+
+	for tn, tc := range cases {
+		t.Run(tn, func(t *testing.T) {
+			// Arrange
+			req := validator.StringRequest{
+				ConfigValue: tc.configValue(t),
+			}
+
+			resp := validator.StringResponse{
+				Diagnostics: diag.Diagnostics{},
+			}
+
+			cv := GCPCredentialsValidator()
+
+			// Act
+			cv.ValidateString(context.Background(), req, &resp)
+
+			// Assert
+			if resp.Diagnostics.ErrorsCount() != tc.expectedErrorCount {
+				t.Errorf("Expected %d errors, got %d", tc.expectedErrorCount, resp.Diagnostics.ErrorsCount())
+			}
+		})
+	}
+}
diff --git a/internal/framework/validators/kerberos_test.go b/internal/framework/validators/kerberos_test.go
new file mode 100644
index 00000000..6668b12a
--- /dev/null
+++ b/internal/framework/validators/kerberos_test.go
@@ -0,0 +1,75 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package validators
+
+import (
+	"context"
+	"encoding/base64"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+)
+
+const (
+	// base64 encoded SPNEGO request token
+	testNegTokenInit = "oIICqjCCAqagJzAlBgkqhkiG9xIBAgIGBSsFAQUCBgkqhkiC9xIBAgIGBisGAQUCBaKCAnkEggJ1YIICcQYJKoZIhvcSAQICAQBuggJgMIICXKADAgEFoQMCAQ6iBwMFAAAAAACjggFwYYIBbDCCAWigAwIBBaENGwtURVNULkdPS1JCNaIjMCGgAwIBA6EaMBgbBEhUVFAbEGhvc3QudGVzdC5nb2tyYjWjggErMIIBJ6ADAgESoQMCAQKiggEZBIIBFdS9iQq8RW9E4uei6BEb1nZ6vwMmbfzal8Ypry7ORQpa4fFF5KTRvCyEjmamxrMdl0CyawPNvSVwv88SbpCt9fXrzp4oP/UIbaR7EpsU/Aqr1NHfnB88crgMxhTfwoeDRQsse3dJZR9DK0eqov8VjABmt1fz+wDde09j1oJ2x2Nz7N0/GcZuvEOoHld/PCY7h4NW9X6NbE7M1Ye4FTjnA5LPfnP8Eqb3xTeolKe7VWbIOsTWl1eqMgpR2NaQAXrr+VKt0Yia38Mwew5s2Mm1fPhYn75SgArLZGHCVHPUn6ob3OuLzj9h2yP5zWoJ1a3OtBHhxFRrMLMzMeVw/WvFCqQDVX519IjnWXUOoDiqtkVGZ9m2T0GkgdIwgc+gAwIBEqKBxwSBxNZ7oq5M9dkXyqsdhjYFJJMg6QSCVjZi7ZJAilQ7atXt64+TdekGCiBUkd8IL9Kl/sk9+3b0EBK7YMriDwetu3ehqlbwUh824eoQ3J+3YpArJU3XZk0LzG91HyAD5BmQrxtDMNEEd7+tY4ufC3BKyAzEdzH47I2AF2K62IhLjekK2x2+f8ew/6/Tj7Xri2VHzuMNiYcygc5jrXAEKhNHixp8K93g8iOs5i27hOLQbxBw9CZfZuBUREkzXi/MTQruW/gcWZk="
+	// base64 encoded response token
+	testNegTokenResp = "oRQwEqADCgEAoQsGCSqGSIb3EgECAg=="
+)
+
+func TestFrameworkProvider_KRBNegTokenValidator(t *testing.T) {
+	cases := map[string]struct {
+		configValue        func(t *testing.T) types.String
+		expectedErrorCount int
+	}{
+		"basic": {
+			configValue: func(t *testing.T) types.String {
+				return types.StringValue(testNegTokenInit)
+			},
+		},
+		"error-b64-decoding": {
+			configValue: func(t *testing.T) types.String {
+				return types.StringValue("Negotiation foo")
+			},
+			expectedErrorCount: 1,
+		},
+		"error-unmarshal": {
+			configValue: func(t *testing.T) types.String {
+				return types.StringValue(base64.StdEncoding.EncodeToString([]byte(testNegTokenInit)))
+			},
+			expectedErrorCount: 1,
+		},
+		"error-not-init-token": {
+			configValue: func(t *testing.T) types.String {
+				return types.StringValue(testNegTokenResp)
+			},
+			expectedErrorCount: 1,
+		},
+	}
+
+	for tn, tc := range cases {
+		t.Run(tn, func(t *testing.T) {
+			// Arrange
+			req := validator.StringRequest{
+				ConfigValue: tc.configValue(t),
+			}
+
+			resp := validator.StringResponse{
+				Diagnostics: diag.Diagnostics{},
+			}
+
+			k := KRBNegTokenValidator()
+
+			// Act
+			k.ValidateString(context.Background(), req, &resp)
+
+			// Assert
+			if resp.Diagnostics.ErrorsCount() != tc.expectedErrorCount {
+				t.Errorf("Expected %d errors, got %d", tc.expectedErrorCount, resp.Diagnostics.ErrorsCount())
+			}
+		})
+	}
+}
diff --git a/internal/framework/validators/path_test.go b/internal/framework/validators/path_test.go
new file mode 100644
index 00000000..7d1f3b8e
--- /dev/null
+++ b/internal/framework/validators/path_test.go
@@ -0,0 +1,72 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package validators
+
+import (
+	"context"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+)
+
+func TestFrameworkProvider_PathValidator(t *testing.T) {
+	cases := map[string]struct {
+		configValue        func(t *testing.T) types.String
+		expectedErrorCount int
+	}{
+		"valid": {
+			configValue: func(t *testing.T) types.String {
+				return types.StringValue("foo")
+			},
+		},
+		"valid-nested": {
+			configValue: func(t *testing.T) types.String {
+				return types.StringValue("foo/bar")
+			},
+		},
+		"invalid-leading": {
+			configValue: func(t *testing.T) types.String {
+				return types.StringValue("/foo")
+			},
+			expectedErrorCount: 1,
+		},
+		"invalid-trailing": {
+			configValue: func(t *testing.T) types.String {
+				return types.StringValue("foo/")
+			},
+			expectedErrorCount: 1,
+		},
+		"invalid-both": {
+			configValue: func(t *testing.T) types.String {
+				return types.StringValue("/foo/")
+			},
+			expectedErrorCount: 1,
+		},
+	}
+
+	for tn, tc := range cases {
+		t.Run(tn, func(t *testing.T) {
+			// Arrange
+			req := validator.StringRequest{
+				ConfigValue: tc.configValue(t),
+			}
+
+			resp := validator.StringResponse{
+				Diagnostics: diag.Diagnostics{},
+			}
+
+			cv := PathValidator()
+
+			// Act
+			cv.ValidateString(context.Background(), req, &resp)
+
+			// Assert
+			if resp.Diagnostics.ErrorsCount() != tc.expectedErrorCount {
+				t.Errorf("Expected %d errors, got %d: %s", tc.expectedErrorCount, resp.Diagnostics.ErrorsCount(), resp.Diagnostics.Errors())
+			}
+		})
+	}
+}
diff --git a/internal/framework/validators/testdata/fake_account.json b/internal/framework/validators/testdata/fake_account.json
new file mode 100644
index 00000000..f3362d6d
--- /dev/null
+++ b/internal/framework/validators/testdata/fake_account.json
@@ -0,0 +1,7 @@
+{
+    "private_key_id": "foo",
+    "private_key": "bar",
+    "client_email": "foo@bar.com",
+    "client_id": "id@foo.com",
+    "type": "service_account"
+}
diff --git a/internal/framework/validators/uri_test.go b/internal/framework/validators/uri_test.go
new file mode 100644
index 00000000..e1a634e6
--- /dev/null
+++ b/internal/framework/validators/uri_test.go
@@ -0,0 +1,65 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package validators
+
+import (
+	"context"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+)
+
+func TestFrameworkProvider_URIValidator(t *testing.T) {
+	cases := map[string]struct {
+		configValue        func(t *testing.T) types.String
+		schemes            []string
+		expectedErrorCount int
+	}{
+		"basic": {
+			configValue: func(t *testing.T) types.String {
+				return types.StringValue("http://foo.baz:8080/qux")
+			},
+			schemes: []string{"http"},
+		},
+		"invalid-scheme": {
+			configValue: func(t *testing.T) types.String {
+				return types.StringValue("https://foo.baz:8080/qux")
+			},
+			schemes:            []string{"http", "tcp"},
+			expectedErrorCount: 1,
+		},
+		"invalid-url": {
+			configValue: func(t *testing.T) types.String {
+				return types.StringValue("foo.bar")
+			},
+			schemes:            []string{"http", "tcp"},
+			expectedErrorCount: 1,
+		},
+	}
+
+	for tn, tc := range cases {
+		t.Run(tn, func(t *testing.T) {
+			// Arrange
+			req := validator.StringRequest{
+				ConfigValue: tc.configValue(t),
+			}
+
+			resp := validator.StringResponse{
+				Diagnostics: diag.Diagnostics{},
+			}
+
+			cv := URIValidator(tc.schemes)
+
+			// Act
+			cv.ValidateString(context.Background(), req, &resp)
+
+			// Assert
+			if resp.Diagnostics.ErrorsCount() != tc.expectedErrorCount {
+				t.Errorf("Expected %d errors, got %d: %s", tc.expectedErrorCount, resp.Diagnostics.ErrorsCount(), resp.Diagnostics.Errors())
+			}
+		})
+	}
+}
diff --git a/internal/identity/group/testhelpers.go b/internal/identity/group/testhelpers.go
index 5a3f88b8..ed385a9f 100644
--- a/internal/identity/group/testhelpers.go
+++ b/internal/identity/group/testhelpers.go
@@ -7,8 +7,8 @@ import (
 	"fmt"
 	"strconv"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 )
diff --git a/internal/provider/auth_azure_test.go b/internal/provider/auth_azure_test.go
index dba384b3..24172cf9 100644
--- a/internal/provider/auth_azure_test.go
+++ b/internal/provider/auth_azure_test.go
@@ -257,6 +257,7 @@ func TestAuthLoginAzure_Login(t *testing.T) {
 					initialized: true,
 				},
 			},
+			token: "foo",
 			handler: &testLoginHandler{
 				handlerFunc: handlerFunc,
 			},
diff --git a/internal/provider/auth_cert_test.go b/internal/provider/auth_cert_test.go
index a60958e1..55d19e0b 100644
--- a/internal/provider/auth_cert_test.go
+++ b/internal/provider/auth_cert_test.go
@@ -190,6 +190,22 @@ func TestAuthLoginCert_LoginPath(t *testing.T) {
 }
 
 func TestAuthLoginCert_Login(t *testing.T) {
+	// Since Auth Cert login clones the Vault client,
+	// this test will fail if VAULT_TOKEN environment variable is set
+
+	env := "VAULT_TOKEN"
+	originalValue, exists := os.LookupEnv(env)
+
+	t.Setenv(env, "") // Unset the environment variable
+
+	t.Cleanup(func() {
+		if exists {
+			t.Setenv(env, originalValue) // Restore original value
+		} else {
+			os.Unsetenv(env) // Unset if it didn't exist initially
+		}
+	})
+
 	handlerFunc := func(t *testLoginHandler, w http.ResponseWriter, req *http.Request) {
 		role := "default"
 		if t.params != nil {
@@ -261,8 +277,9 @@ func TestAuthLoginCert_Login(t *testing.T) {
 					},
 				},
 			},
-			tls:     true,
-			wantErr: false,
+			tls:        true,
+			wantErr:    false,
+			cloneToken: true,
 		},
 		{
 			name: "named-role",
@@ -296,8 +313,9 @@ func TestAuthLoginCert_Login(t *testing.T) {
 					},
 				},
 			},
-			tls:     true,
-			wantErr: false,
+			tls:        true,
+			wantErr:    false,
+			cloneToken: true,
 		},
 		{
 			name: "error-vault-token-set",
@@ -317,9 +335,10 @@ func TestAuthLoginCert_Login(t *testing.T) {
 			handler: &testLoginHandler{
 				handlerFunc: handlerFunc,
 			},
-			token:     "foo",
-			wantErr:   true,
-			expectErr: errors.New("vault login client has a token set"),
+			token:      "foo",
+			cloneToken: true,
+			wantErr:    true,
+			expectErr:  errors.New("vault login client has a token set"),
 		},
 		{
 			name: "error-uninitialized",
diff --git a/internal/provider/auth_gcp_test.go b/internal/provider/auth_gcp_test.go
index 0de961e1..e0fdb1fd 100644
--- a/internal/provider/auth_gcp_test.go
+++ b/internal/provider/auth_gcp_test.go
@@ -204,6 +204,9 @@ func TestAuthLoginGCP_Login(t *testing.T) {
 			token:     "foo",
 			wantErr:   true,
 			expectErr: errors.New("vault login client has a token set"),
+			skipFunc: func(t *testing.T) {
+				testutil.SkipTestEnvUnset(t, consts.EnvVarGoogleApplicationCreds, envVarGCPServiceAccount)
+			},
 		},
 		{
 			name: "no-jwt",
diff --git a/internal/provider/auth_jwt_test.go b/internal/provider/auth_jwt_test.go
index 7a4c302c..af5a5fd8 100644
--- a/internal/provider/auth_jwt_test.go
+++ b/internal/provider/auth_jwt_test.go
@@ -39,6 +39,29 @@ func TestAuthLoginJWT_Init(t *testing.T) {
 			},
 			wantErr: false,
 		},
+		{
+			name:      "basic-with-env",
+			authField: consts.FieldAuthLoginJWT,
+			raw: map[string]interface{}{
+				consts.FieldAuthLoginJWT: []interface{}{
+					map[string]interface{}{
+						consts.FieldNamespace: "ns1",
+						consts.FieldRole:      "alice",
+					},
+				},
+			},
+			envVars: map[string]string{
+				consts.EnvVarVaultAuthJWT: "jwt1",
+			},
+			expectParams: map[string]interface{}{
+				consts.FieldNamespace:        "ns1",
+				consts.FieldUseRootNamespace: false,
+				consts.FieldMount:            consts.MountTypeJWT,
+				consts.FieldRole:             "alice",
+				consts.FieldJWT:              "jwt1",
+			},
+			wantErr: false,
+		},
 		{
 			name:         "error-missing-resource",
 			authField:    consts.FieldAuthLoginJWT,
diff --git a/internal/provider/auth_oci_test.go b/internal/provider/auth_oci_test.go
index f8bafd3c..55814ca4 100644
--- a/internal/provider/auth_oci_test.go
+++ b/internal/provider/auth_oci_test.go
@@ -207,6 +207,9 @@ func TestAuthLoginOCI_Login(t *testing.T) {
 			token:     "foo",
 			wantErr:   true,
 			expectErr: errors.New("vault login client has a token set"),
+			skipFunc: func(t *testing.T) {
+				testutil.SkipTestEnvUnset(t, envVarTFAccOCIAuth)
+			},
 		},
 		{
 			name: "error-uninitialized",
diff --git a/internal/provider/auth_oidc_test.go b/internal/provider/auth_oidc_test.go
index cc106922..35ec424c 100644
--- a/internal/provider/auth_oidc_test.go
+++ b/internal/provider/auth_oidc_test.go
@@ -5,7 +5,6 @@ package provider
 
 import (
 	"encoding/json"
-	"errors"
 	"fmt"
 	"net/http"
 	"reflect"
@@ -231,25 +230,6 @@ func TestAuthLoginOIDC_Login(t *testing.T) {
 	}
 
 	tests := []authLoginTest{
-		{
-			name: "error-vault-token-set",
-			authLogin: &AuthLoginOIDC{
-				AuthLoginCommon{
-					authField: "baz",
-					mount:     "foo",
-					params: map[string]interface{}{
-						consts.FieldRole: "bob",
-					},
-					initialized: true,
-				},
-			},
-			handler: &testLoginHandler{
-				handlerFunc: handlerFunc,
-			},
-			token:     "foo",
-			wantErr:   true,
-			expectErr: errors.New("vault login client has a token set"),
-		},
 		{
 			name: "error-uninitialized",
 			authLogin: &AuthLoginOIDC{
diff --git a/internal/provider/auth_radius_test.go b/internal/provider/auth_radius_test.go
index cf66714a..94d2290f 100644
--- a/internal/provider/auth_radius_test.go
+++ b/internal/provider/auth_radius_test.go
@@ -39,6 +39,29 @@ func TestAuthLoginRadius_Init(t *testing.T) {
 			},
 			wantErr: false,
 		},
+		{
+			name:      "basic-with-env",
+			authField: consts.FieldAuthLoginRadius,
+			raw: map[string]interface{}{
+				consts.FieldAuthLoginRadius: []interface{}{
+					map[string]interface{}{
+						consts.FieldNamespace: "ns1",
+					},
+				},
+			},
+			envVars: map[string]string{
+				consts.EnvVarRadiusUsername: "alice",
+				consts.EnvVarRadiusPassword: "password1",
+			},
+			expectParams: map[string]interface{}{
+				consts.FieldNamespace:        "ns1",
+				consts.FieldUseRootNamespace: false,
+				consts.FieldMount:            consts.MountTypeRadius,
+				consts.FieldUsername:         "alice",
+				consts.FieldPassword:         "password1",
+			},
+			wantErr: false,
+		},
 		{
 			name:         "error-missing-resource",
 			authField:    consts.FieldAuthLoginRadius,
diff --git a/internal/provider/auth_test.go b/internal/provider/auth_test.go
index fd5315a0..b99ace48 100644
--- a/internal/provider/auth_test.go
+++ b/internal/provider/auth_test.go
@@ -8,6 +8,7 @@ import (
 	"io"
 	"net"
 	"net/http"
+	"os"
 	"reflect"
 	"testing"
 
@@ -37,6 +38,7 @@ type authLoginTest struct {
 	tls                bool
 	preLoginFunc       func(t *testing.T)
 	token              string
+	cloneToken         bool
 }
 
 type authLoginInitTest struct {
@@ -117,6 +119,10 @@ func testAuthLogin(t *testing.T, tt authLoginTest) {
 	}
 	defer ln.Close()
 
+	if tt.cloneToken {
+		config.CloneToken = tt.cloneToken
+	}
+
 	c, err := api.NewClient(config)
 	if err != nil {
 		t.Fatal(err)
@@ -316,3 +322,195 @@ func TestAuthLoginCommon_Namespace(t *testing.T) {
 		})
 	}
 }
+
+func TestAuthLoginCommon_setDefaultFields(t *testing.T) {
+	tests := []struct {
+		name         string
+		params       map[string]interface{}
+		expectParams map[string]interface{}
+		setEnv       map[string]string
+		defaults     authDefaults
+	}{
+		{
+			name: "default-unset-and-env-unset",
+			params: map[string]interface{}{
+				"foo": "",
+			},
+			defaults: authDefaults{
+				{
+					field:      "foo",
+					envVars:    []string{"TEST_TERRAFORM_VAULT_PROVIDER_FOO"},
+					defaultVal: "",
+				},
+			},
+			expectParams: map[string]interface{}{
+				"foo": "",
+			},
+		},
+		{
+			name: "default-set-and-env-unset",
+			params: map[string]interface{}{
+				"foo": "",
+			},
+			defaults: authDefaults{
+				{
+					field:      "foo",
+					envVars:    []string{"TEST_TERRAFORM_VAULT_PROVIDER_FOO"},
+					defaultVal: "bar",
+				},
+			},
+			expectParams: map[string]interface{}{
+				"foo": "bar",
+			},
+		},
+		{
+			name: "default-set-and-env-set",
+			params: map[string]interface{}{
+				"foo": "",
+			},
+			defaults: authDefaults{
+				{
+					field:      "foo",
+					envVars:    []string{"TEST_TERRAFORM_VAULT_PROVIDER_FOO"},
+					defaultVal: "bar",
+				},
+			},
+			// env vars should override authDefault.defaultVal
+			setEnv: map[string]string{
+				"TEST_TERRAFORM_VAULT_PROVIDER_FOO": "baz",
+			},
+			expectParams: map[string]interface{}{
+				"foo": "baz",
+			},
+		},
+		{
+			name: "default-unset-and-env-set",
+			params: map[string]interface{}{
+				"foo": "",
+			},
+			defaults: authDefaults{
+				{
+					field:      "foo",
+					envVars:    []string{"TEST_TERRAFORM_VAULT_PROVIDER_FOO"},
+					defaultVal: "",
+				},
+			},
+			// env vars should override authDefault.defaultVal
+			setEnv: map[string]string{
+				"TEST_TERRAFORM_VAULT_PROVIDER_FOO": "baz",
+			},
+			expectParams: map[string]interface{}{
+				"foo": "baz",
+			},
+		},
+		{
+			name: "multiple-params-default-set-and-env-set",
+			params: map[string]interface{}{
+				"foo": "",
+				"dog": "",
+			},
+			defaults: authDefaults{
+				{
+					field:      "foo",
+					envVars:    []string{"TEST_TERRAFORM_VAULT_PROVIDER_FOO"},
+					defaultVal: "bar",
+				},
+				{
+					field:      "dog",
+					envVars:    []string{"TEST_TERRAFORM_VAULT_PROVIDER_DOG"},
+					defaultVal: "bark",
+				},
+			},
+			// env vars should override authDefault.defaultVal
+			setEnv: map[string]string{
+				"TEST_TERRAFORM_VAULT_PROVIDER_FOO": "baz",
+				"TEST_TERRAFORM_VAULT_PROVIDER_DOG": "woof",
+			},
+			expectParams: map[string]interface{}{
+				"foo": "baz",
+				"dog": "woof",
+			},
+		},
+		{
+			name: "multiple-params-mixed-set-and-unset",
+			params: map[string]interface{}{
+				"foo": "",
+				"dog": "",
+			},
+			defaults: authDefaults{
+				{
+					field:      "foo",
+					envVars:    []string{"TEST_TERRAFORM_VAULT_PROVIDER_FOO"},
+					defaultVal: "bar",
+				},
+				{
+					field:      "dog",
+					envVars:    []string{"TEST_TERRAFORM_VAULT_PROVIDER_DOG"},
+					defaultVal: "bark",
+				},
+			},
+			// env vars should override authDefault.defaultVal
+			setEnv: map[string]string{
+				"TEST_TERRAFORM_VAULT_PROVIDER_FOO": "baz",
+			},
+			expectParams: map[string]interface{}{
+				"foo": "baz",
+				"dog": "bark",
+			},
+		},
+		{
+			name: "multiple-env",
+			params: map[string]interface{}{
+				"foo": "",
+			},
+			defaults: authDefaults{
+				{
+					field:      "foo",
+					envVars:    []string{"TEST_TERRAFORM_VAULT_PROVIDER_FOO", "TEST_TERRAFORM_VAULT_PROVIDER_QUX"},
+					defaultVal: "",
+				},
+			},
+			setEnv: map[string]string{
+				"TEST_TERRAFORM_VAULT_PROVIDER_QUX": "qux",
+			},
+			expectParams: map[string]interface{}{
+				"foo": "qux",
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.setEnv != nil {
+				for k, v := range tt.setEnv {
+					t.Setenv(k, v)
+					t.Cleanup(func() {
+						err := os.Unsetenv(k)
+						if err != nil {
+							t.Fatalf("could not unset env, err: %v", err)
+						}
+					},
+					)
+				}
+			}
+			l := &AuthLoginCommon{
+				params:      tt.params,
+				initialized: true,
+			}
+
+			rootProvider := NewProvider(nil, nil)
+			pr := &schema.Resource{
+				Schema: rootProvider.Schema,
+			}
+			d := pr.TestResourceData()
+
+			err := l.setDefaultFields(d, tt.defaults, tt.params)
+			if err != nil {
+				t.Errorf("setDefaultFields() err: %v", err)
+			}
+
+			if !reflect.DeepEqual(tt.expectParams, l.Params()) {
+				t.Errorf("setDefaultFields() expected params %#v, actual %#v", tt.expectParams, l.Params())
+			}
+		})
+	}
+}
diff --git a/internal/provider/auth_token_file_test.go b/internal/provider/auth_token_file_test.go
index 944eed7b..81b3f915 100644
--- a/internal/provider/auth_token_file_test.go
+++ b/internal/provider/auth_token_file_test.go
@@ -5,7 +5,6 @@ package provider
 
 import (
 	"encoding/json"
-	"errors"
 	"fmt"
 	"net/http"
 	"os"
@@ -49,9 +48,7 @@ func TestAuthLoginTokenFile_Init(t *testing.T) {
 				consts.EnvVarTokenFilename: "/tmp/vault-token",
 			},
 			expectParams: map[string]interface{}{
-				consts.FieldNamespace:        "",
-				consts.FieldUseRootNamespace: false,
-				consts.FieldFilename:         "/tmp/vault-token",
+				consts.FieldFilename: "/tmp/vault-token",
 			},
 			wantErr: false,
 		},
@@ -147,38 +144,6 @@ func TestAuthLoginTokenFile_Login(t *testing.T) {
 			},
 			wantErr: false,
 		},
-		{
-			name: "error-vault-token-set",
-			authLogin: &AuthLoginTokenFile{
-				AuthLoginCommon{
-					authField: "baz",
-					mount:     consts.MountTypeNone,
-					params: map[string]interface{}{
-						consts.FieldFilename: path.Join(tempDir, "basic"),
-					},
-					initialized: true,
-				},
-			},
-			handler: &testLoginHandler{
-				handlerFunc: handlerFunc,
-			},
-			preLoginFunc: func(t *testing.T) {
-				t.Helper()
-
-				filename := path.Join(tempDir, "basic")
-				t.Cleanup(func() {
-					if err := os.Remove(filename); err != nil {
-						t.Error(err)
-					}
-				})
-				if err := os.WriteFile(filename, []byte("qux\n"), 0o600); err != nil {
-					t.Fatal(err)
-				}
-			},
-			token:     "foo",
-			wantErr:   true,
-			expectErr: errors.New("vault login client has a token set"),
-		},
 		{
 			name: "error-invalid-file-mode",
 			authLogin: &AuthLoginTokenFile{
diff --git a/internal/provider/meta_test.go b/internal/provider/meta_test.go
index 983fa381..1545505c 100644
--- a/internal/provider/meta_test.go
+++ b/internal/provider/meta_test.go
@@ -6,19 +6,15 @@ package provider
 import (
 	"errors"
 	"fmt"
-	"os"
-	"reflect"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/cenkalti/backoff/v4"
 	"github.com/hashicorp/go-version"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/vault/api"
 	vault_consts "github.com/hashicorp/vault/sdk/helper/consts"
+	"os"
+	"reflect"
+	"sync"
+	"testing"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -530,497 +526,3 @@ func TestIsEnterpriseSupported(t *testing.T) {
 		})
 	}
 }
-
-func TestNewProviderMeta(t *testing.T) {
-	testutil.SkipTestAcc(t)
-	testutil.SkipTestAccEnt(t)
-	testutil.TestAccPreCheck(t)
-
-	nsPrefix := acctest.RandomWithPrefix("ns")
-
-	defaultUser := "alice"
-	defaultPassword := "f00bazB1ff"
-
-	rootProvider := NewProvider(nil, nil)
-	pr := &schema.Resource{
-		Schema: rootProvider.Schema,
-	}
-
-	tests := []struct {
-		name                      string
-		d                         *schema.ResourceData
-		data                      map[string]interface{}
-		wantNamespace             string
-		tokenNamespace            string
-		authLoginNamespace        string
-		wantErr                   bool
-		checkSetSetTokenNamespace bool
-		wantNamespaceFromToken    string
-	}{
-		{
-			name:    "invalid-nil-ResourceData",
-			d:       nil,
-			wantErr: true,
-		},
-		{
-			// expect provider namespace set.
-			name: "with-provider-ns-only",
-			d:    pr.TestResourceData(),
-			data: map[string]interface{}{
-				consts.FieldNamespace:           nsPrefix + "prov",
-				consts.FieldSkipGetVaultVersion: true,
-			},
-			wantNamespace: nsPrefix + "prov",
-			wantErr:       false,
-		},
-		{
-			// expect token namespace set
-			name: "with-token-ns-only",
-			d:    pr.TestResourceData(),
-			data: map[string]interface{}{
-				consts.FieldSkipGetVaultVersion: true,
-				consts.FieldSkipChildToken:      true,
-			},
-			tokenNamespace: nsPrefix + "token-ns-only",
-			wantNamespace:  nsPrefix + "token-ns-only",
-			wantErr:        false,
-		},
-		{
-			// expect provider namespace set.
-			name: "with-provider-ns-and-token-ns",
-			d:    pr.TestResourceData(),
-			data: map[string]interface{}{
-				consts.FieldNamespace:           nsPrefix + "prov-and-token",
-				consts.FieldSkipGetVaultVersion: true,
-				consts.FieldSkipChildToken:      true,
-			},
-			tokenNamespace: nsPrefix + "token-ns",
-			wantNamespace:  nsPrefix + "prov-and-token",
-			wantErr:        false,
-		},
-		{
-			// expect auth_login namespace set.
-			name: "with-auth-login-and-ns",
-			d:    pr.TestResourceData(),
-			data: map[string]interface{}{
-				consts.FieldSkipGetVaultVersion: true,
-				consts.FieldSkipChildToken:      true,
-				consts.FieldAuthLoginUserpass: []map[string]interface{}{
-					{
-						consts.FieldNamespace: nsPrefix + "auth-ns",
-						consts.FieldMount:     consts.MountTypeUserpass,
-						consts.FieldUsername:  defaultUser,
-						consts.FieldPassword:  defaultPassword,
-					},
-				},
-			},
-			authLoginNamespace: nsPrefix + "auth-ns",
-			wantNamespace:      nsPrefix + "auth-ns",
-			wantErr:            false,
-		},
-		{
-			// expect provider namespace set.
-			name: "with-provider-ns-and-auth-login-with-ns",
-			d:    pr.TestResourceData(),
-			data: map[string]interface{}{
-				consts.FieldNamespace:           nsPrefix + "prov-ns-prov-ns",
-				consts.FieldSkipGetVaultVersion: true,
-				consts.FieldSkipChildToken:      true,
-				consts.FieldAuthLoginUserpass: []map[string]interface{}{
-					{
-						consts.FieldNamespace: nsPrefix + "auth-ns-auth-ns",
-						consts.FieldMount:     consts.MountTypeUserpass,
-						consts.FieldUsername:  defaultUser,
-						consts.FieldPassword:  defaultPassword,
-					},
-				},
-			},
-			authLoginNamespace: nsPrefix + "auth-ns-auth-ns",
-			wantNamespace:      nsPrefix + "prov-ns-prov-ns",
-			wantErr:            false,
-		},
-		{
-			// expect token based namespace to be ignored.
-			name: "set-namespace-from-token-false",
-			d:    pr.TestResourceData(),
-			data: map[string]interface{}{
-				consts.FieldSkipGetVaultVersion:   true,
-				consts.FieldSetNamespaceFromToken: false,
-				consts.FieldSkipChildToken:        true,
-			},
-			tokenNamespace:            nsPrefix + "set-ns-from-token-auth-false-ignored",
-			wantNamespace:             nsPrefix + "set-ns-from-token-auth-false-ignored",
-			checkSetSetTokenNamespace: true,
-			wantNamespaceFromToken:    "",
-			wantErr:                   false,
-		},
-		{
-			// expect token based namespace to be ignored.
-			name: "set-namespace-from-token-true",
-			d:    pr.TestResourceData(),
-			data: map[string]interface{}{
-				consts.FieldSkipGetVaultVersion:   true,
-				consts.FieldSetNamespaceFromToken: true,
-				consts.FieldSkipChildToken:        true,
-				consts.FieldAuthLoginUserpass: []map[string]interface{}{
-					{
-						consts.FieldNamespace: nsPrefix + "set-ns-from-token-auth-true",
-						consts.FieldMount:     consts.MountTypeUserpass,
-						consts.FieldUsername:  defaultUser,
-						consts.FieldPassword:  defaultPassword,
-					},
-				},
-			},
-			authLoginNamespace:        nsPrefix + "set-ns-from-token-auth-true",
-			wantNamespace:             nsPrefix + "set-ns-from-token-auth-true",
-			checkSetSetTokenNamespace: true,
-			wantNamespaceFromToken:    nsPrefix + "set-ns-from-token-auth-true",
-			wantErr:                   false,
-		},
-	}
-
-	createNamespace := func(t *testing.T, client *api.Client, ns string) {
-		t.Helper()
-		t.Cleanup(func() {
-			err := backoff.Retry(func() error {
-				_, err := client.Logical().Delete(consts.SysNamespaceRoot + ns)
-				return err
-			}, backoff.WithMaxRetries(backoff.NewConstantBackOff(time.Microsecond*500), 10))
-			if err != nil {
-				t.Fatalf("failed to delete namespace %q, err=%s", ns, err)
-			}
-		})
-		if _, err := client.Logical().Write(
-			consts.SysNamespaceRoot+ns, nil); err != nil {
-			t.Fatalf("failed to create namespace, err=%s", err)
-		}
-	}
-
-	config := api.DefaultConfig()
-	config.CloneToken = true
-	client, err := api.NewClient(config)
-	if err != nil {
-		t.Fatalf("failed to create Vault client, err=%s", err)
-	}
-
-	for _, tt := range tests {
-		tt := tt
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-			if tt.authLoginNamespace != "" {
-				createNamespace(t, client, tt.authLoginNamespace)
-				options := &api.EnableAuthOptions{
-					Type:        consts.MountTypeUserpass,
-					Description: "test auth_userpass",
-					Local:       true,
-				}
-
-				clone, err := client.Clone()
-				if err != nil {
-					t.Fatalf("failed to clone Vault client, err=%s", err)
-				}
-
-				clone.SetNamespace(tt.authLoginNamespace)
-				if err := clone.Sys().EnableAuthWithOptions(consts.MountTypeUserpass, options); err != nil {
-					t.Fatalf("failed to enable auth, err=%s", err)
-				}
-
-				if _, err := clone.Logical().Write("auth/userpass/users/alice",
-					map[string]interface{}{
-						consts.FieldPassword:      defaultPassword,
-						consts.FieldTokenPolicies: []string{"admin", "default"},
-					}); err != nil {
-					t.Fatalf("failed to create user, err=%s", err)
-				}
-			}
-
-			if tt.tokenNamespace != "" {
-				if tt.data == nil {
-					t.Fatal("test data cannot be nil when tokenNamespace set")
-				}
-
-				createNamespace(t, client, tt.tokenNamespace)
-				clone, err := client.Clone()
-				if err != nil {
-					t.Fatalf("failed to clone Vault client, err=%s", err)
-				}
-
-				// in order not to trigger the min TTL warning we can add some time to the min.
-				tokenTTL := TokenTTLMinRecommended + time.Second*10
-				clone.SetNamespace(tt.tokenNamespace)
-				resp, err := clone.Auth().Token().Create(&api.TokenCreateRequest{
-					TTL: tokenTTL.String(),
-				})
-				if err != nil {
-					t.Fatalf("failed to create Vault token, err=%s", err)
-				}
-				tt.data[consts.FieldToken] = resp.Auth.ClientToken
-			}
-
-			for k, v := range tt.data {
-				if err := tt.d.Set(k, v); err != nil {
-					t.Fatalf("failed to set resource data, key=%s, value=%#v", k, v)
-				}
-			}
-
-			got, err := NewProviderMeta(tt.d)
-			if (err != nil) != tt.wantErr {
-				t.Errorf("NewProviderMeta() error = %v, wantErr %v", err, tt.wantErr)
-				return
-			}
-
-			if err != nil {
-				if got != nil {
-					t.Errorf("NewProviderMeta() got = %v, want nil", got)
-				}
-				return
-			}
-
-			p, ok := got.(*ProviderMeta)
-			if !ok {
-				t.Fatalf("invalid type got %T, expected %T", got, &ProviderMeta{})
-			}
-
-			client, err := p.GetClient()
-			if err != nil {
-				t.Fatalf("got unexpected error %s", err)
-			}
-
-			if !reflect.DeepEqual(client.Namespace(), tt.wantNamespace) {
-				t.Errorf("NewProviderMeta() got ns = %v, want ns %v", p.client.Namespace(), tt.wantNamespace)
-			}
-
-			if tt.checkSetSetTokenNamespace && tt.wantNamespaceFromToken != tt.d.Get(consts.FieldNamespace).(string) {
-				t.Errorf("NewProviderMeta() got ns = %q, want ns %q", tt.d.Get(consts.FieldNamespace).(string), tt.wantNamespaceFromToken)
-			}
-
-			if client.Token() == "" {
-				t.Errorf("NewProviderMeta() got empty Client token")
-			}
-		})
-	}
-}
-
-func TestNewProviderMeta_Cert(t *testing.T) {
-	testutil.SkipTestAcc(t)
-	testutil.SkipTestAccEnt(t)
-	testutil.TestAccPreCheck(t)
-
-	nsPrefix := acctest.RandomWithPrefix("ns")
-
-	defaultUser := "alice"
-	defaultPassword := "f00bazB1ff"
-
-	rootProvider := NewProvider(nil, nil)
-	pr := &schema.Resource{
-		Schema: rootProvider.Schema,
-	}
-
-	tests := []struct {
-		name               string
-		d                  *schema.ResourceData
-		data               map[string]interface{}
-		wantNamespace      string
-		tokenNamespace     string
-		authLoginNamespace string
-		wantErr            bool
-	}{
-		{
-			name:    "invalid-nil-ResourceData",
-			d:       nil,
-			wantErr: true,
-		},
-		{
-			// expect provider namespace set.
-			name: "with-provider-ns-only",
-			d:    pr.TestResourceData(),
-			data: map[string]interface{}{
-				consts.FieldNamespace:           nsPrefix + "prov",
-				consts.FieldSkipGetVaultVersion: true,
-			},
-			wantNamespace: nsPrefix + "prov",
-			wantErr:       false,
-		},
-		{
-			// expect token namespace set
-			name: "with-token-ns-only",
-			d:    pr.TestResourceData(),
-			data: map[string]interface{}{
-				consts.FieldSkipGetVaultVersion: true,
-				consts.FieldSkipChildToken:      true,
-			},
-			tokenNamespace: nsPrefix + "token-ns-only",
-			wantNamespace:  nsPrefix + "token-ns-only",
-			wantErr:        false,
-		},
-		{
-			// expect provider namespace set.
-			name: "with-provider-ns-and-token-ns",
-			d:    pr.TestResourceData(),
-			data: map[string]interface{}{
-				consts.FieldNamespace:           nsPrefix + "prov-and-token",
-				consts.FieldSkipGetVaultVersion: true,
-				consts.FieldSkipChildToken:      true,
-			},
-			tokenNamespace: nsPrefix + "token-ns",
-			wantNamespace:  nsPrefix + "prov-and-token",
-			wantErr:        false,
-		},
-		{
-			// expect auth_login namespace set.
-			name: "with-auth-login-and-ns",
-			d:    pr.TestResourceData(),
-			data: map[string]interface{}{
-				consts.FieldSkipGetVaultVersion: true,
-				consts.FieldSkipChildToken:      true,
-				consts.FieldAuthLoginUserpass: []map[string]interface{}{
-					{
-						consts.FieldNamespace: nsPrefix + "auth-ns",
-						consts.FieldMount:     consts.MountTypeUserpass,
-						consts.FieldUsername:  defaultUser,
-						consts.FieldPassword:  defaultPassword,
-					},
-				},
-			},
-			authLoginNamespace: nsPrefix + "auth-ns",
-			wantNamespace:      nsPrefix + "auth-ns",
-			wantErr:            false,
-		},
-		{
-			// expect provider namespace set.
-			name: "with-provider-ns-and-auth-login-with-ns",
-			d:    pr.TestResourceData(),
-			data: map[string]interface{}{
-				consts.FieldNamespace:           nsPrefix + "prov-ns-auth-ns",
-				consts.FieldSkipGetVaultVersion: true,
-				consts.FieldSkipChildToken:      true,
-				consts.FieldAuthLoginUserpass: []map[string]interface{}{
-					{
-						consts.FieldNamespace: nsPrefix + "auth-ns-prov-ns",
-						consts.FieldMount:     consts.MountTypeUserpass,
-						consts.FieldUsername:  defaultUser,
-						consts.FieldPassword:  defaultPassword,
-					},
-				},
-			},
-			authLoginNamespace: nsPrefix + "auth-ns-prov-ns",
-			wantNamespace:      nsPrefix + "prov-ns-auth-ns",
-			wantErr:            false,
-		},
-	}
-
-	createNamespace := func(t *testing.T, client *api.Client, ns string) {
-		t.Helper()
-		t.Cleanup(func() {
-			err := backoff.Retry(func() error {
-				_, err := client.Logical().Delete(consts.SysNamespaceRoot + ns)
-				return err
-			}, backoff.WithMaxRetries(backoff.NewConstantBackOff(time.Microsecond*500), 10))
-			if err != nil {
-				t.Fatalf("failed to delete namespace %q, err=%s", ns, err)
-			}
-		})
-		if _, err := client.Logical().Write(
-			consts.SysNamespaceRoot+ns, nil); err != nil {
-			t.Fatalf("failed to create namespace, err=%s", err)
-		}
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			config := api.DefaultConfig()
-			config.CloneToken = true
-			client, err := api.NewClient(config)
-			if err != nil {
-				t.Fatalf("failed to create Vault client, err=%s", err)
-			}
-
-			if tt.authLoginNamespace != "" {
-				createNamespace(t, client, tt.authLoginNamespace)
-				options := &api.EnableAuthOptions{
-					Type:        consts.MountTypeUserpass,
-					Description: "test auth_userpass",
-					Local:       true,
-				}
-
-				clone, err := client.Clone()
-				if err != nil {
-					t.Fatalf("failed to clone Vault client, err=%s", err)
-				}
-
-				clone.SetNamespace(tt.authLoginNamespace)
-				if err := clone.Sys().EnableAuthWithOptions(consts.MountTypeUserpass, options); err != nil {
-					t.Fatalf("failed to enable auth, err=%s", err)
-				}
-
-				if _, err := clone.Logical().Write("auth/userpass/users/alice",
-					map[string]interface{}{
-						consts.FieldPassword:      defaultPassword,
-						consts.FieldTokenPolicies: []string{"admin", "default"},
-					}); err != nil {
-					t.Fatalf("failed to create user, err=%s", err)
-				}
-			}
-
-			if tt.tokenNamespace != "" {
-				if tt.data == nil {
-					t.Fatal("test data cannot be nil when tokenNamespace set")
-				}
-
-				createNamespace(t, client, tt.tokenNamespace)
-				clone, err := client.Clone()
-				if err != nil {
-					t.Fatalf("failed to clone Vault client, err=%s", err)
-				}
-
-				// in order not to trigger the min TTL warning we can add some time to the min.
-				tokenTTL := TokenTTLMinRecommended + time.Second*10
-				clone.SetNamespace(tt.tokenNamespace)
-				resp, err := clone.Auth().Token().Create(&api.TokenCreateRequest{
-					TTL: tokenTTL.String(),
-				})
-				if err != nil {
-					t.Fatalf("failed to create Vault token, err=%s", err)
-				}
-				tt.data[consts.FieldToken] = resp.Auth.ClientToken
-			}
-
-			for k, v := range tt.data {
-				if err := tt.d.Set(k, v); err != nil {
-					t.Fatalf("failed to set resource data, key=%s, value=%#v", k, v)
-				}
-			}
-
-			got, err := NewProviderMeta(tt.d)
-			if (err != nil) != tt.wantErr {
-				t.Errorf("NewProviderMeta() error = %v, wantErr %v", err, tt.wantErr)
-				return
-			}
-
-			if err != nil {
-				if got != nil {
-					t.Errorf("NewProviderMeta() got = %v, want nil", got)
-				}
-				return
-			}
-
-			p, ok := got.(*ProviderMeta)
-			if !ok {
-				t.Fatalf("invalid type got %T, expected %T", got, &ProviderMeta{})
-			}
-
-			pClient, err := p.GetClient()
-			if err != nil {
-				t.Fatalf("got unexpected error %s", err)
-			}
-
-			if !reflect.DeepEqual(pClient.Namespace(), tt.wantNamespace) {
-				t.Errorf("NewProviderMeta() got ns = %v, want ns %v", p.client.Namespace(), tt.wantNamespace)
-			}
-
-			if client.Token() == "" {
-				t.Errorf("NewProviderMeta() got empty Client token")
-			}
-		})
-	}
-}
diff --git a/internal/providertest/providertest.go b/internal/providertest/providertest.go
new file mode 100644
index 00000000..ddbe236c
--- /dev/null
+++ b/internal/providertest/providertest.go
@@ -0,0 +1,43 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package providertest
+
+import (
+	"context"
+
+	"github.com/hashicorp/terraform-plugin-go/tfprotov5"
+	"github.com/hashicorp/terraform-provider-vault/vault"
+)
+
+// ProtoV5ProviderFactories is a static map containing only the main provider instance
+var (
+	ProtoV5ProviderFactories map[string]func() (tfprotov5.ProviderServer, error) = protoV5ProviderFactoriesInit(context.Background(), "vault")
+)
+
+// testAccProtoV5ProviderFactories will return a map of provider servers
+// suitable for use as a resource.TestStep.ProtoV5ProviderFactories.
+//
+// When multiplexing providers, the schema and configuration handling must
+// exactly match between all underlying providers of the mux server. Mismatched
+// schemas will result in a runtime error.
+// see: https://developer.hashicorp.com/terraform/plugin/framework/migrating/mux
+//
+// Any tests that use this function will serve as a smoketest to verify the
+// provider schemas match 1-1 so that we may catch runtime errors.
+func protoV5ProviderFactoriesInit(ctx context.Context, providerNames ...string) map[string]func() (tfprotov5.ProviderServer, error) {
+	factories := make(map[string]func() (tfprotov5.ProviderServer, error), len(providerNames))
+
+	for _, name := range providerNames {
+		factories[name] = func() (tfprotov5.ProviderServer, error) {
+			providerServerFactory, _, err := vault.ProtoV5ProviderServerFactory(ctx)
+			if err != nil {
+				return nil, err
+			}
+
+			return providerServerFactory(), nil
+		}
+	}
+
+	return factories
+}
diff --git a/internal/vault/secrets/ephemeral/database_secret_test.go b/internal/vault/secrets/ephemeral/database_secret_test.go
new file mode 100644
index 00000000..e81ef982
--- /dev/null
+++ b/internal/vault/secrets/ephemeral/database_secret_test.go
@@ -0,0 +1,99 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package ephemeralsecrets_test
+
+import (
+	"fmt"
+	"github.com/hashicorp/terraform-plugin-go/tfprotov6"
+	"github.com/hashicorp/terraform-plugin-testing/echoprovider"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/knownvalue"
+	"github.com/hashicorp/terraform-plugin-testing/statecheck"
+	"github.com/hashicorp/terraform-plugin-testing/tfjsonpath"
+	"github.com/hashicorp/terraform-provider-vault/internal/providertest"
+	"github.com/hashicorp/terraform-provider-vault/testutil"
+	"regexp"
+	"testing"
+)
+
+// TestAccDBSecret confirms that a dynamic DB Secret
+// can be read from Vault for a created DB Role
+//
+// Uses the Echo Provider to test values set in ephemeral resources
+// see documentation here for more details:
+// https://developer.hashicorp.com/terraform/plugin/testing/acceptance-tests/ephemeral-resources#using-echo-provider-in-acceptance-tests
+func TestAccDBSecret(t *testing.T) {
+	testutil.SkipTestAcc(t)
+	mount := acctest.RandomWithPrefix("postgres")
+	dbName := acctest.RandomWithPrefix("db")
+	roleName := acctest.RandomWithPrefix("role")
+
+	values := testutil.SkipTestEnvUnset(t, "POSTGRES_URL")
+	connURL := values[0]
+
+	// catch-all regex to ensure all usernames and passwords are set to some value
+	expectedUsernameRegex, err := regexp.Compile("^vault-(.+)-(\\w{20})$")
+	expectedPasswordRegex, err := regexp.Compile("^\\S+$")
+	if err != nil {
+		t.Fatal(err)
+	}
+	templ := `{{ printf \"vault-%s-%s\" (.DisplayName) (random 20) }}`
+
+	resource.UnitTest(t, resource.TestCase{
+		PreCheck: func() { testutil.TestAccPreCheck(t) },
+		// Include the provider we want to test
+		ProtoV5ProviderFactories: providertest.ProtoV5ProviderFactories,
+		// Include `echo` as a v6 provider from `terraform-plugin-testing`
+		ProtoV6ProviderFactories: map[string]func() (tfprotov6.ProviderServer, error){
+			"echo": echoprovider.NewProviderServer(),
+		},
+		Steps: []resource.TestStep{
+			{
+				Config: testDBSecretConfig(mount, dbName, roleName, connURL, templ),
+				ConfigStateChecks: []statecheck.StateCheck{
+					statecheck.ExpectKnownValue("echo.test_db", tfjsonpath.New("data").AtMapKey("username"), knownvalue.StringRegexp(expectedUsernameRegex)),
+					statecheck.ExpectKnownValue("echo.test_db", tfjsonpath.New("data").AtMapKey("password"), knownvalue.StringRegexp(expectedPasswordRegex)),
+				},
+			},
+		},
+	})
+}
+
+func testDBSecretConfig(mount, dbName, roleName, connUrl, templ string) string {
+	return fmt.Sprintf(`
+resource "vault_database_secrets_mount" "test" {
+  path = "%s"
+
+  postgresql {
+    name              = "%s"
+    connection_url    = "%s"
+    allowed_roles     = ["*"]
+    username_template = "%s"
+  }
+}
+
+resource "vault_database_secret_backend_role" "role" {
+  backend             = vault_database_secrets_mount.test.path
+  name                = "%s"
+  db_name             = vault_database_secrets_mount.test.postgresql.0.name
+  creation_statements = [
+    "CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';",
+    "GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";"
+  ]
+}
+
+ephemeral "vault_database_secret" "db_secret" {
+	mount    = vault_database_secrets_mount.test.path
+	mount_id = vault_database_secrets_mount.test.id
+	name     = vault_database_secret_backend_role.role.name
+}
+
+provider "echo" {
+	data = ephemeral.vault_database_secret.db_secret
+}
+
+resource "echo" "test_db" {}
+`, mount, dbName, connUrl, templ, roleName)
+}
diff --git a/internal/vault/secrets/ephemeral/kv_secret_v2_test.go b/internal/vault/secrets/ephemeral/kv_secret_v2_test.go
new file mode 100644
index 00000000..fa7dfc20
--- /dev/null
+++ b/internal/vault/secrets/ephemeral/kv_secret_v2_test.go
@@ -0,0 +1,81 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package ephemeralsecrets_test
+
+import (
+	"fmt"
+	"github.com/hashicorp/terraform-plugin-go/tfprotov6"
+	"github.com/hashicorp/terraform-plugin-testing/echoprovider"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/knownvalue"
+	"github.com/hashicorp/terraform-plugin-testing/statecheck"
+	"github.com/hashicorp/terraform-plugin-testing/tfjsonpath"
+	"github.com/hashicorp/terraform-provider-vault/internal/providertest"
+	"github.com/hashicorp/terraform-provider-vault/testutil"
+	"testing"
+)
+
+// TestAccKVV2Secret confirms that a secret written to
+// a KV-V2 store in Vault is correctly read into the ephemeral resource
+//
+// Uses the Echo Provider to test values set in ephemeral resources
+// see documentation here for more details:
+// https://developer.hashicorp.com/terraform/plugin/testing/acceptance-tests/ephemeral-resources#using-echo-provider-in-acceptance-tests
+func TestAccKVV2Secret(t *testing.T) {
+	testutil.SkipTestAcc(t)
+
+	mount := acctest.RandomWithPrefix("kvv2-mount")
+	name := acctest.RandomWithPrefix("secret")
+	resource.UnitTest(t, resource.TestCase{
+		PreCheck: func() { testutil.TestAccPreCheck(t) },
+		// Include the provider we want to test
+		ProtoV5ProviderFactories: providertest.ProtoV5ProviderFactories,
+		// Include `echo` as a v6 provider from `terraform-plugin-testing`
+		ProtoV6ProviderFactories: map[string]func() (tfprotov6.ProviderServer, error){
+			"echo": echoprovider.NewProviderServer(),
+		},
+		Steps: []resource.TestStep{
+			{
+				Config: testKVV2SecretConfig(mount, name),
+				ConfigStateChecks: []statecheck.StateCheck{
+					statecheck.ExpectKnownValue("echo.test_krb", tfjsonpath.New("data").AtMapKey("password"), knownvalue.StringExact("password1")),
+				},
+			},
+		},
+	})
+}
+
+func testKVV2SecretConfig(mount, name string) string {
+	return fmt.Sprintf(`
+resource "vault_mount" "kvv2" {
+  path        = "%s"
+  type        = "kv"
+  options     = { version = "2" }
+}
+
+resource "vault_kv_secret_v2" "secret" {
+  mount                      = vault_mount.kvv2.path
+  name                       = "%s"
+  data_json_wo                  = jsonencode(
+    {
+      password       = "password1"
+    }
+  )
+  data_json_wo_version = 0
+}
+
+ephemeral "vault_kv_secret_v2" "db_secret" {
+	mount    = vault_mount.kvv2.path
+	mount_id = vault_mount.kvv2.id
+	name     = vault_kv_secret_v2.secret.name
+}
+
+provider "echo" {
+	data = ephemeral.vault_kv_secret_v2.db_secret.data
+}
+
+resource "echo" "test_krb" {}
+`, mount, name)
+}
diff --git a/internal/vault/sys/password_policy_test.go b/internal/vault/sys/password_policy_test.go
new file mode 100644
index 00000000..37443bcd
--- /dev/null
+++ b/internal/vault/sys/password_policy_test.go
@@ -0,0 +1,152 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package sys_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-provider-vault/internal/providertest"
+	"github.com/hashicorp/terraform-provider-vault/testutil"
+)
+
+func TestAccPasswordPolicy(t *testing.T) {
+	policyName := acctest.RandomWithPrefix("test-policy")
+	resourceName := "vault_password_policy.test"
+	testPolicy := "length = 20\nrule \"charset\" {\n  charset = \"abcde\"\n}\n"
+	testPolicyUpdated := "length = 20\nrule \"charset\" {\n  charset = \"abcde\"\n}\nrule \"charset\" {\n  charset = \"1234567890\"\nmin-chars = 1\n}\n"
+	updatedConfig := testAccPasswordPolicyConfig(policyName, testPolicyUpdated)
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: providertest.ProtoV5ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPasswordPolicyConfig(policyName, testPolicy),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "name", policyName),
+					resource.TestCheckResourceAttrSet(resourceName, "policy"),
+				),
+			},
+			{
+				Config: updatedConfig,
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "name", policyName),
+					resource.TestCheckResourceAttrSet(resourceName, "policy"),
+				),
+			},
+			testutil.GetImportTestStep(resourceName, false, nil),
+		},
+	})
+}
+
+func TestAccPasswordPolicyNS(t *testing.T) {
+	ns := acctest.RandomWithPrefix("ns")
+	policyName := acctest.RandomWithPrefix("test-policy")
+	resourceName := "vault_password_policy.test"
+	testPolicy := "length = 20\nrule \"charset\" {\n  charset = \"abcde\"\n}\n"
+	testPolicyUpdated := "length = 20\nrule \"charset\" {\n  charset = \"abcde\"\n}\nrule \"charset\" {\n  charset = \"1234567890\"\nmin-chars = 1\n}\n"
+	updatedConfig := testAccPasswordPolicyConfigNS(ns, policyName, testPolicyUpdated)
+
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			testutil.TestAccPreCheck(t)
+			testutil.TestEntPreCheck(t)
+		},
+		ProtoV5ProviderFactories: providertest.ProtoV5ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPasswordPolicyConfigNS(ns, policyName, testPolicy),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "namespace", ns),
+					resource.TestCheckResourceAttr(resourceName, "name", policyName),
+					resource.TestCheckResourceAttrSet(resourceName, "policy"),
+				),
+			},
+			{
+				Config: updatedConfig,
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "namespace", ns),
+					resource.TestCheckResourceAttr(resourceName, "name", policyName),
+					resource.TestCheckResourceAttrSet(resourceName, "policy"),
+				),
+			},
+			testutil.GetImportTestStepNS(t, ns, resourceName, updatedConfig),
+			testutil.GetImportTestStepNSCleanup(t, updatedConfig),
+		},
+	})
+}
+
+func TestAccPasswordPolicy_Muxing(t *testing.T) {
+	policyName := acctest.RandomWithPrefix("test-policy")
+	policyNameUpdated := acctest.RandomWithPrefix("test-policy-updated")
+	resourceName := "vault_password_policy.test"
+	testPolicy := "length = 20\nrule \"charset\" {\n  charset = \"abcde\"\n}\n"
+	testPolicyUpdated := "length = 20\nrule \"charset\" {\n  charset = \"abcde\"\n}\nrule \"charset\" {\n  charset = \"1234567890\"\nmin-chars = 1\n}\n"
+	updatedConfig := testAccPasswordPolicyConfig(policyNameUpdated, testPolicyUpdated)
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			testutil.TestAccPreCheck(t)
+			testutil.TestEntPreCheck(t)
+		},
+		Steps: []resource.TestStep{
+			{
+				ExternalProviders: map[string]resource.ExternalProvider{
+					"vault": {
+						// 4.8.0 is not multiplexed
+						VersionConstraint: "4.8.0",
+						Source:            "hashicorp/vault",
+					},
+				},
+				Config: testAccPasswordPolicyConfig(policyName, testPolicy),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "name", policyName),
+					resource.TestCheckResourceAttrSet(resourceName, "policy"),
+				),
+			},
+			// upgrade to new Muxed TFVP, ensure plan is seamless
+			{
+				ProtoV5ProviderFactories: providertest.ProtoV5ProviderFactories,
+				Config:                   testAccPasswordPolicyConfig(policyName, testPolicy),
+				PlanOnly:                 true,
+			},
+			// update name to ensure resource can get recreated on name updates
+			{
+				ProtoV5ProviderFactories: providertest.ProtoV5ProviderFactories,
+				Config:                   updatedConfig,
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "name", policyNameUpdated),
+					resource.TestCheckResourceAttrSet(resourceName, "policy"),
+				),
+			},
+		},
+	})
+}
+
+func testAccPasswordPolicyConfig(policyName, policy string) string {
+	return fmt.Sprintf(`
+resource "vault_password_policy" "test" {
+  name = "%s"
+  policy = <<EOT
+%s
+EOT
+}`, policyName, policy)
+}
+
+func testAccPasswordPolicyConfigNS(ns, policyName, policy string) string {
+	return fmt.Sprintf(`
+resource "vault_namespace" "ns1" {
+    path = "%s"
+}
+
+resource "vault_password_policy" "test" {
+  namespace = vault_namespace.ns1.path
+  name = "%s"
+  policy = <<EOT
+%s
+EOT
+}`, ns, policyName, policy)
+}
diff --git a/testutil/testutil.go b/testutil/testutil.go
index cfe789a1..18bec050 100644
--- a/testutil/testutil.go
+++ b/testutil/testutil.go
@@ -32,8 +32,8 @@ import (
 
 	"github.com/coreos/pkg/multierror"
 	"github.com/hashicorp/go-retryablehttp"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/vault/api"
 	"github.com/mitchellh/go-homedir"
 
@@ -151,6 +151,23 @@ func GetTestAzureConf(t *testing.T) *AzureTestConf {
 	}
 }
 
+func GetTestAzureConfForGroups(t *testing.T) *AzureTestConf {
+	t.Helper()
+
+	v := SkipTestEnvUnset(t,
+		"AZURE_SUBSCRIPTION_ID",
+		"AZURE_TENANT_ID",
+		"AZURE_CLIENT_ID",
+		"AZURE_CLIENT_SECRET")
+
+	return &AzureTestConf{
+		SubscriptionID: v[0],
+		TenantID:       v[1],
+		ClientID:       v[2],
+		ClientSecret:   v[3],
+	}
+}
+
 func GetTestAzureConfExistingSP(t *testing.T) *AzureTestConf {
 	v := SkipTestEnvUnset(t,
 		"AZURE_SUBSCRIPTION_ID",
@@ -788,6 +805,44 @@ func CheckJSONData(resourceName, attr, expected string) resource.TestCheckFunc {
 	}
 }
 
+// GetImportTestStepNS returns an import TestStep for namespace and resource name.
+//
+// NOTE: Should be called with GetImportTestStepNSCleanup
+//
+// Optionally include field names that should be ignored during the import
+// verification, typically ignore fields should only be provided for values
+// that are not returned from the provisioning API.
+func GetImportTestStepNS(t *testing.T, namespace, resourceName, config string, ignoreFields ...string) resource.TestStep {
+	return resource.TestStep{
+		// Two steps are needed when testing import because the
+		// tf-plugin-sdk does not allow specifying environment variables.
+		// It is possible that this will cause issues if we ever want to
+		// support parallel tests.
+		PreConfig: func() {
+			t.Setenv(consts.EnvVarVaultNamespaceImport, namespace)
+		},
+		ImportState:             true,
+		ImportStateVerify:       true,
+		ImportStateVerifyIgnore: ignoreFields,
+		ResourceName:            resourceName,
+	}
+}
+
+// GetImportTestStepNSCleanup return a cleanup TestStep for namespace and
+// resource name to unset env vars.
+//
+// NOTE: Should be called after GetImportTestStepNS
+func GetImportTestStepNSCleanup(t *testing.T, config string) resource.TestStep {
+	return resource.TestStep{
+		// needed for the import step above
+		Config: config,
+		PreConfig: func() {
+			os.Unsetenv(consts.EnvVarVaultNamespaceImport)
+		},
+		PlanOnly: true,
+	}
+}
+
 // GetImportTestStep for resource name. If a custom ImportStateCheck function is not desired, pass
 // a nil value. Optionally include field names that should be ignored during the import
 // verification, typically ignore fields should only be provided for values that are not returned
diff --git a/testutil/testutil_test.go b/testutil/testutil_test.go
index 63caff17..195bb6b9 100644
--- a/testutil/testutil_test.go
+++ b/testutil/testutil_test.go
@@ -7,7 +7,7 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/vault/api"
 )
 
diff --git a/vault/data_identity_entity_test.go b/vault/data_identity_entity_test.go
index 76fa8fa0..9c22d047 100644
--- a/vault/data_identity_entity_test.go
+++ b/vault/data_identity_entity_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/identity/entity"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -22,8 +23,8 @@ func TestDataSourceIdentityEntityName(t *testing.T) {
 
 	resourceName := "data.vault_identity_entity.entity"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testDataSourceIdentityEntity_configName(entity),
@@ -44,8 +45,8 @@ func TestDataSourceIdentityEntityAlias(t *testing.T) {
 
 	resourceName := "data.vault_identity_entity.entity"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testDataSourceIdentityEntity_configAlias(entity),
diff --git a/vault/data_identity_group_test.go b/vault/data_identity_group_test.go
index 1db24166..446aca51 100644
--- a/vault/data_identity_group_test.go
+++ b/vault/data_identity_group_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/identity/group"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -20,8 +21,8 @@ func TestDataSourceIdentityGroupName(t *testing.T) {
 	group := acctest.RandomWithPrefix("test-group")
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testDataSourceIdentityGroup_configName(group),
@@ -41,8 +42,8 @@ func TestDataSourceIdentityGroupAlias(t *testing.T) {
 	group := acctest.RandomWithPrefix("test-group")
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testDataSourceIdentityGroup_configAlias(group),
diff --git a/vault/data_identity_oidc_client_creds_test.go b/vault/data_identity_oidc_client_creds_test.go
index 421dc8d1..645e9827 100644
--- a/vault/data_identity_oidc_client_creds_test.go
+++ b/vault/data_identity_oidc_client_creds_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 )
@@ -19,8 +20,8 @@ func TestDataSourceIdentityOIDCClientCreds(t *testing.T) {
 
 	resourceName := "data.vault_identity_oidc_client_creds.creds"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testDataSourceIdentityOIDCClientCreds_config(name, ""),
diff --git a/vault/data_identity_oidc_openid_config_test.go b/vault/data_identity_oidc_openid_config_test.go
index c0c8da98..0de6e2b5 100644
--- a/vault/data_identity_oidc_openid_config_test.go
+++ b/vault/data_identity_oidc_openid_config_test.go
@@ -4,14 +4,15 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"net/url"
 	"os"
 	"strings"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/vault/api"
 
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -65,7 +66,7 @@ func TestDataSourceIdentityOIDCOpenIDConfig(t *testing.T) {
 	}
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config: testDataSourceIdentityOIDCOpenIDConfig_config(keyName, clientName, providerName, u.Host),
diff --git a/vault/data_identity_oidc_public_keys_test.go b/vault/data_identity_oidc_public_keys_test.go
index 42985a0e..b661299d 100644
--- a/vault/data_identity_oidc_public_keys_test.go
+++ b/vault/data_identity_oidc_public_keys_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 )
@@ -20,8 +21,8 @@ func TestDataSourceIdentityOIDCPublicKeys(t *testing.T) {
 	providerName := acctest.RandomWithPrefix("test-provider")
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testDataSourceIdentityOIDCPublicKeys_config(keyName, clientName, providerName),
diff --git a/vault/data_source_ad_credentials_test.go b/vault/data_source_ad_credentials_test.go
index 217882b9..52269b6a 100644
--- a/vault/data_source_ad_credentials_test.go
+++ b/vault/data_source_ad_credentials_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 )
@@ -18,8 +19,8 @@ func TestAccDataSourceADAccessCredentials_basic(t *testing.T) {
 	bindDN, bindPass, url := testutil.GetTestADCreds(t)
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDataSourceADAccessCredentialsConfig(backend, bindDN, bindPass, url, "bob", "Bob", 60),
diff --git a/vault/data_source_approle_auth_backend_role_id_test.go b/vault/data_source_approle_auth_backend_role_id_test.go
index 4e995cdd..914251ce 100644
--- a/vault/data_source_approle_auth_backend_role_id_test.go
+++ b/vault/data_source_approle_auth_backend_role_id_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 )
@@ -18,9 +19,9 @@ func TestAccAppRoleAuthBackendRoleID_basic(t *testing.T) {
 	role := acctest.RandomWithPrefix("test-role")
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAppRoleAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAppRoleAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAppRoleAuthBackendRoleConfig_basic(backend, role),
@@ -54,9 +55,9 @@ func TestAccAppRoleAuthBackendRoleID_customID(t *testing.T) {
 	roleID := acctest.RandomWithPrefix("test-role-id")
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAppRoleAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAppRoleAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAppRoleAuthBackendRoleConfig_full(backend, role, roleID),
diff --git a/vault/data_source_auth_backend_test.go b/vault/data_source_auth_backend_test.go
index a05cde72..0b8b1bb7 100644
--- a/vault/data_source_auth_backend_test.go
+++ b/vault/data_source_auth_backend_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	r "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	r "github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 )
@@ -17,8 +18,8 @@ import (
 func TestDataSourceAuthBackend(t *testing.T) {
 	path := acctest.RandomWithPrefix("foo")
 	r.Test(t, r.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []r.TestStep{
 			{
 				Config: testDataSourceAuthBackendBasic_config,
diff --git a/vault/data_source_auth_backends_test.go b/vault/data_source_auth_backends_test.go
index 48048651..34a8abb6 100644
--- a/vault/data_source_auth_backends_test.go
+++ b/vault/data_source_auth_backends_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 )
@@ -19,8 +20,8 @@ func TestDataSourceAuthBackends(t *testing.T) {
 	ds := "data.vault_auth_backends.test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testDataSourceAuthBackendsBasic,
diff --git a/vault/data_source_aws_access_credentials_test.go b/vault/data_source_aws_access_credentials_test.go
index e357bb53..7f21a4de 100644
--- a/vault/data_source_aws_access_credentials_test.go
+++ b/vault/data_source_aws_access_credentials_test.go
@@ -4,6 +4,7 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"log"
 	"testing"
@@ -14,9 +15,9 @@ import (
 	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/aws/aws-sdk-go/service/sts"
 	"github.com/hashicorp/go-cleanhttp"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -28,8 +29,8 @@ func TestAccDataSourceAWSAccessCredentials_basic(t *testing.T) {
 	region := testutil.GetTestAWSRegion(t)
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDataSourceAWSAccessCredentialsConfig_basic(mountPath, accessKey, secretKey, region),
@@ -110,8 +111,8 @@ func TestAccDataSourceAWSAccessCredentials_sts(t *testing.T) {
 	for name, test := range tests {
 		t.Run(name, func(t *testing.T) {
 			resource.Test(t, resource.TestCase{
-				ProviderFactories: providerFactories,
-				PreCheck:          func() { testutil.TestAccPreCheck(t) },
+				ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+				PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 				Steps: []resource.TestStep{
 					{
 						Config: test.config,
@@ -137,8 +138,8 @@ func TestAccDataSourceAWSAccessCredentials_sts_ttl(t *testing.T) {
 	ttl := "18m"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDataSourceAWSAccessCredentialsConfig_sts_basic(mountPath, accessKey, secretKey, region),
diff --git a/vault/data_source_aws_static_credentials_test.go b/vault/data_source_aws_static_credentials_test.go
index b435cc85..3b053c8b 100644
--- a/vault/data_source_aws_static_credentials_test.go
+++ b/vault/data_source_aws_static_credentials_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -26,7 +27,7 @@ func TestAccDataSourceAWSStaticCredentials(t *testing.T) {
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion114)
 
 		},
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config: testAWSStaticDataSourceConfig(mount, a, s, username),
diff --git a/vault/data_source_azure_access_credentials_test.go b/vault/data_source_azure_access_credentials_test.go
index a1fe2450..558aebc8 100644
--- a/vault/data_source_azure_access_credentials_test.go
+++ b/vault/data_source_azure_access_credentials_test.go
@@ -4,22 +4,24 @@
 package vault
 
 import (
+	"context"
 	"fmt"
+	"os"
 	"reflect"
 	"strconv"
 	"strings"
 	"testing"
 
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/cloud"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 )
 
 // TestAccDataSourceAzureAccessCredentials_basic tests the creation of dynamic
-// service principals
-func TestAccDataSourceAzureAccessCredentials_basic(t *testing.T) {
+// service principals using azure_roles
+func TestAccDataSourceAzureAccessCredentialsAzureRoles_basic(t *testing.T) {
 	// This test takes a while because it's testing a loop that
 	// retries real credentials until they're eventually consistent.
 	if testing.Short() {
@@ -28,11 +30,11 @@ func TestAccDataSourceAzureAccessCredentials_basic(t *testing.T) {
 	mountPath := acctest.RandomWithPrefix("tf-test-azure")
 	conf := testutil.GetTestAzureConf(t)
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
-				Config: testAccDataSourceAzureAccessCredentialsConfigBasic(mountPath, conf, 20),
+				Config: testAccDataSourceAzureAccessCredentialsConfigBasicAzureRoles(mountPath, conf, 20),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttrSet("data.vault_azure_access_credentials.test", "client_id"),
 					resource.TestCheckResourceAttrSet("data.vault_azure_access_credentials.test", "client_secret"),
@@ -43,7 +45,40 @@ func TestAccDataSourceAzureAccessCredentials_basic(t *testing.T) {
 	})
 }
 
-// TestAccDataSourceAzureAccessCredentials_basic tests the credential
+// TestAccDataSourceAzureAccessCredentialsAzureGroups_basic tests the creation of dynamic
+// service principals using azure_groups
+// Requires AZURE_GROUP_NAME to be set to a group that the service principal will be assigned to
+func TestAccDataSourceAzureAccessCredentialsAzureGroups_basic(t *testing.T) {
+	// This test takes a while because it's testing a loop that
+	// retries real credentials until they're eventually consistent.
+	if testing.Short() {
+		t.SkipNow()
+	}
+
+	groupName := os.Getenv("AZURE_GROUP_NAME")
+	if groupName == "" {
+		t.Skip("AZURE_GROUP_NAME must be set to run this test")
+	}
+
+	mountPath := acctest.RandomWithPrefix("tf-test-azure")
+	conf := testutil.GetTestAzureConfForGroups(t)
+	resource.Test(t, resource.TestCase{
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDataSourceAzureAccessCredentialsConfigBasicAzureGroups(mountPath, conf, groupName, 20),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrSet("data.vault_azure_access_credentials.test", "client_id"),
+					resource.TestCheckResourceAttrSet("data.vault_azure_access_credentials.test", "client_secret"),
+					resource.TestCheckResourceAttrSet("data.vault_azure_access_credentials.test", "lease_id"),
+				),
+			},
+		},
+	})
+}
+
+// TestAccDataSourceAzureAccessCredentials_ExistingSP tests the credential
 // generation for existing service principals
 func TestAccDataSourceAzureAccessCredentials_ExistingSP(t *testing.T) {
 	// This test takes a while because it's testing a loop that
@@ -54,8 +89,8 @@ func TestAccDataSourceAzureAccessCredentials_ExistingSP(t *testing.T) {
 	mountPath := acctest.RandomWithPrefix("tf-test-azure")
 	conf := testutil.GetTestAzureConfExistingSP(t)
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDataSourceAzureAccessCredentialsConfig_existingSP(mountPath, conf, 60),
@@ -105,7 +140,7 @@ data "vault_azure_access_credentials" "test" {
 	return parsed
 }
 
-func testAccDataSourceAzureAccessCredentialsConfigBasic(mountPath string, conf *testutil.AzureTestConf, maxSecs int) string {
+func testAccDataSourceAzureAccessCredentialsConfigBasicAzureRoles(mountPath string, conf *testutil.AzureTestConf, maxSecs int) string {
 	template := `
 resource "vault_azure_secret_backend" "test" {
 	path = "{{mountPath}}"
@@ -144,6 +179,45 @@ data "vault_azure_access_credentials" "test" {
 	return parsed
 }
 
+func testAccDataSourceAzureAccessCredentialsConfigBasicAzureGroups(mountPath string, conf *testutil.AzureTestConf, groupName string, maxSecs int) string {
+	template := `
+resource "vault_azure_secret_backend" "test" {
+	path = "{{mountPath}}"
+	subscription_id = "{{subscriptionID}}"
+	tenant_id = "{{tenantID}}"
+	client_id = "{{clientID}}"
+	client_secret = "{{clientSecret}}"
+}
+
+resource "vault_azure_secret_backend_role" "test" {
+	backend = vault_azure_secret_backend.test.path
+	role = "my-role"
+	azure_groups {
+		group_name = "{{groupName}}"
+	}
+	ttl = 300
+	max_ttl = 600
+}
+
+data "vault_azure_access_credentials" "test" {
+    backend = vault_azure_secret_backend.test.path
+    role = vault_azure_secret_backend_role.test.role
+    validate_creds = true
+	num_sequential_successes = 1
+	num_seconds_between_tests = 30
+	max_cred_validation_seconds = {{maxCredValidationSeconds}}
+}`
+
+	parsed := strings.Replace(template, "{{mountPath}}", mountPath, -1)
+	parsed = strings.Replace(parsed, "{{subscriptionID}}", conf.SubscriptionID, -1)
+	parsed = strings.Replace(parsed, "{{tenantID}}", conf.TenantID, -1)
+	parsed = strings.Replace(parsed, "{{clientID}}", conf.ClientID, -1)
+	parsed = strings.Replace(parsed, "{{clientSecret}}", conf.ClientSecret, -1)
+	parsed = strings.Replace(parsed, "{{groupName}}", groupName, -1)
+	parsed = strings.Replace(parsed, "{{maxCredValidationSeconds}}", strconv.Itoa(maxSecs), -1)
+	return parsed
+}
+
 func Test_getAzureCloudConfigFromName(t *testing.T) {
 	t.Parallel()
 
diff --git a/vault/data_source_gcp_auth_backend_role_test.go b/vault/data_source_gcp_auth_backend_role_test.go
index 5c79f418..30d6b24d 100644
--- a/vault/data_source_gcp_auth_backend_role_test.go
+++ b/vault/data_source_gcp_auth_backend_role_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"regexp"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 )
@@ -21,9 +22,9 @@ func TestAccGCPAuthBackendRoleDataSource_basic(t *testing.T) {
 	projectId := acctest.RandomWithPrefix("tf-test-gcp-project-id")
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testGCPAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testGCPAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testGCPAuthBackendRoleConfig_basic(backend, name, serviceAccount, projectId),
@@ -66,9 +67,9 @@ func TestAccGCPAuthBackendRoleDataSource_gce(t *testing.T) {
 
 	resourceName := "vault_gcp_auth_backend_role.test"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testGCPAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testGCPAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testGCPAuthBackendRoleConfig_gce(backend, name, projectId),
@@ -96,8 +97,8 @@ func TestAccGCPAuthBackendRoleDataSource_none(t *testing.T) {
 	name := acctest.RandomWithPrefix("tf-test-gcp-role")
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccGCPAuthBackendRoleDataSourceConfig(backend, name),
diff --git a/vault/data_source_generic_secret_test.go b/vault/data_source_generic_secret_test.go
index bbdcfdc6..0169e1bf 100644
--- a/vault/data_source_generic_secret_test.go
+++ b/vault/data_source_generic_secret_test.go
@@ -4,21 +4,22 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 	"time"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 )
 
 func TestDataSourceGenericSecret(t *testing.T) {
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testDataSourceGenericSecret_config,
@@ -32,8 +33,8 @@ func TestDataSourceGenericSecret_v2(t *testing.T) {
 	mount := acctest.RandomWithPrefix("tf-acctest-kv/")
 	path := acctest.RandomWithPrefix("foo")
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testDataSourceV2Secret_config(mount, path),
diff --git a/vault/data_source_kubernetes_auth_backend_config_test.go b/vault/data_source_kubernetes_auth_backend_config_test.go
index d02bba9e..36485066 100644
--- a/vault/data_source_kubernetes_auth_backend_config_test.go
+++ b/vault/data_source_kubernetes_auth_backend_config_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"strconv"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -21,9 +22,9 @@ func TestAccKubernetesAuthBackendConfigDataSource_basic(t *testing.T) {
 	jwt := kubernetesJWT
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckKubernetesAuthBackendConfigDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckKubernetesAuthBackendConfigDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccKubernetesAuthBackendConfigConfig_basic(backend, jwt, kubernetesCAcert),
@@ -66,9 +67,9 @@ func TestAccKubernetesAuthBackendConfigDataSource_full(t *testing.T) {
 	useAnnotationsAsAliasMetadata := true
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckKubernetesAuthBackendConfigDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckKubernetesAuthBackendConfigDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccKubernetesAuthBackendConfigConfig_full(backend, kubernetesCAcert, jwt, issuer,
diff --git a/vault/data_source_kubernetes_auth_backend_role_test.go b/vault/data_source_kubernetes_auth_backend_role_test.go
index 7019775b..2de48e6c 100644
--- a/vault/data_source_kubernetes_auth_backend_role_test.go
+++ b/vault/data_source_kubernetes_auth_backend_role_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"strconv"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 )
@@ -20,9 +21,9 @@ func TestAccKubernetesAuthBackendRoleDataSource_basic(t *testing.T) {
 	ttl := 3600
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckKubernetesAuthBackendConfigDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckKubernetesAuthBackendConfigDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccKubernetesAuthBackendRoleDataSourceConfig_basic(backend, role, "", ttl),
@@ -95,9 +96,9 @@ func TestAccKubernetesAuthBackendRoleDataSource_full(t *testing.T) {
 	audience := "vault"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckKubernetesAuthBackendConfigDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckKubernetesAuthBackendConfigDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccKubernetesAuthBackendRoleDataSourceConfig_full(
diff --git a/vault/data_source_kubernetes_credentials_test.go b/vault/data_source_kubernetes_credentials_test.go
index 38015279..6f77ce66 100644
--- a/vault/data_source_kubernetes_credentials_test.go
+++ b/vault/data_source_kubernetes_credentials_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -22,7 +23,7 @@ func TestAccKubernetesSecretCredentialsDataSource(t *testing.T) {
 	name := acctest.RandomWithPrefix("tf-test-role")
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 		},
diff --git a/vault/data_source_kv_secret_test.go b/vault/data_source_kv_secret_test.go
index 042445ef..25fae153 100644
--- a/vault/data_source_kv_secret_test.go
+++ b/vault/data_source_kv_secret_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -23,8 +24,8 @@ func TestDataSourceKVSecret(t *testing.T) {
 
 	resourceName := "data.vault_kv_secret.test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testDataSourceKVSecretConfig(mount, name),
diff --git a/vault/data_source_kv_secret_v2_test.go b/vault/data_source_kv_secret_v2_test.go
index 094416a8..e1a6f2bd 100644
--- a/vault/data_source_kv_secret_v2_test.go
+++ b/vault/data_source_kv_secret_v2_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/vault/api"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
@@ -25,8 +26,8 @@ func TestDataSourceKVV2Secret(t *testing.T) {
 
 	resourceName := "data.vault_kv_secret_v2.test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testDataSourceKVV2SecretConfig(mount, name),
@@ -67,8 +68,8 @@ func TestDataSourceKVV2Secret_deletedSecret(t *testing.T) {
 	name := acctest.RandomWithPrefix("foo")
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				PreConfig: func() {
diff --git a/vault/data_source_kv_secrets_list_test.go b/vault/data_source_kv_secrets_list_test.go
index 577fb1f0..4fdfca49 100644
--- a/vault/data_source_kv_secrets_list_test.go
+++ b/vault/data_source_kv_secrets_list_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -23,8 +24,8 @@ func TestDataSourceKVSecretList(t *testing.T) {
 	datasourceName := "data.vault_kv_secrets_list.test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testDataSourceKVSecretListConfig(mount, s1, s2, false),
diff --git a/vault/data_source_kv_secrets_list_v2_test.go b/vault/data_source_kv_secrets_list_v2_test.go
index 5c98d9e0..b155dc13 100644
--- a/vault/data_source_kv_secrets_list_v2_test.go
+++ b/vault/data_source_kv_secrets_list_v2_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -24,8 +25,8 @@ func TestDataSourceKVSecretListV2(t *testing.T) {
 	datasource2 := "data.vault_kv_secrets_list_v2.test_internal"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testDataSourceKVV2SecretListConfig(mount, s1, s2),
diff --git a/vault/data_source_kv_subkeys_v2_test.go b/vault/data_source_kv_subkeys_v2_test.go
index 28e7fa1e..bb7f6a6b 100644
--- a/vault/data_source_kv_subkeys_v2_test.go
+++ b/vault/data_source_kv_subkeys_v2_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -23,8 +24,8 @@ func TestDataSourceKVSubkeys(t *testing.T) {
 	expectedSubkeys := `{"baz":{"riff":null},"foo":null,"zip":null}`
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testDataSourceKVSubkeysConfig(mount, secretPath),
diff --git a/vault/data_source_ldap_dynamic_role_credentials_test.go b/vault/data_source_ldap_dynamic_role_credentials_test.go
index f762f600..d346b0e3 100644
--- a/vault/data_source_ldap_dynamic_role_credentials_test.go
+++ b/vault/data_source_ldap_dynamic_role_credentials_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -20,7 +21,7 @@ func TestAccDataSourceLDAPDynamicRoleCredentials(t *testing.T) {
 	bindDN, bindPass, url := testutil.GetTestLDAPCreds(t)
 	dataName := "data.vault_ldap_dynamic_credentials.creds"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion112)
diff --git a/vault/data_source_ldap_static_role_credentials_test.go b/vault/data_source_ldap_static_role_credentials_test.go
index 261da5f5..3dcc3041 100644
--- a/vault/data_source_ldap_static_role_credentials_test.go
+++ b/vault/data_source_ldap_static_role_credentials_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -21,7 +22,7 @@ func TestAccDataSourceLDAPStaticRoleCredentials(t *testing.T) {
 	username := "alice"
 	dataName := "data.vault_ldap_static_credentials.creds"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion112)
diff --git a/vault/data_source_namespace_test.go b/vault/data_source_namespace_test.go
index 69c7cbdd..88bf6980 100644
--- a/vault/data_source_namespace_test.go
+++ b/vault/data_source_namespace_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -23,9 +24,9 @@ func TestAccDataSourceNamespace(t *testing.T) {
 	pathChild := acctest.RandomWithPrefix("tf-child")
 
 	resource.Test(t, resource.TestCase{
-		Providers:    testProviders,
-		PreCheck:     func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy: testNamespaceDestroy(path),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testNamespaceDestroy(path),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDataSourceNamespaceConfig_nested(path, pathChild),
@@ -43,7 +44,7 @@ func TestAccDataSourceNamespace(t *testing.T) {
 	})
 
 	resource.Test(t, resource.TestCase{
-		Providers: testProviders,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion112)
@@ -63,9 +64,9 @@ func TestAccDataSourceNamespace(t *testing.T) {
 	})
 
 	resource.Test(t, resource.TestCase{
-		Providers:    testProviders,
-		PreCheck:     func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy: testNamespaceDestroy(path),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testNamespaceDestroy(path),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDataSourceNamespaceConfig_current(path),
diff --git a/vault/data_source_namespaces_test.go b/vault/data_source_namespaces_test.go
index f5de723a..6c07b837 100644
--- a/vault/data_source_namespaces_test.go
+++ b/vault/data_source_namespaces_test.go
@@ -4,37 +4,87 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 )
 
 func TestAccDataSourceNamespaces(t *testing.T) {
+	// TODO test is flaky and passes ~80% of the time in CI
+	t.Skip("skipping, because it's flaky in CI")
 	testutil.SkipTestAccEnt(t)
 
 	ns := acctest.RandomWithPrefix("tf-ns")
 	resourceName := "data.vault_namespaces"
 
 	resource.Test(t, resource.TestCase{
-		Providers: testProviders,
-		PreCheck:  func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDataSourceNamespacesConfig(ns, 3),
 				Check: resource.ComposeAggregateTestCheckFunc(
-					resource.TestCheckResourceAttr(resourceName+".test", consts.FieldPaths+".#", "3"),
-					resource.TestCheckTypeSetElemAttr(resourceName+".test", consts.FieldPaths+".*", "test-0"),
-					resource.TestCheckTypeSetElemAttr(resourceName+".test", consts.FieldPaths+".*", "test-1"),
-					resource.TestCheckTypeSetElemAttr(resourceName+".test", consts.FieldPaths+".*", "test-2"),
-					resource.TestCheckResourceAttr(resourceName+".test", consts.FieldNamespace, ns),
-					// test nested which will not have any namespaces under it
-					resource.TestCheckResourceAttr(resourceName+".nested", consts.FieldPaths+".#", "0"),
-					resource.TestCheckResourceAttr(resourceName+".nested", consts.FieldNamespace, ns+"/test-0/nested"),
+					resource.TestCheckResourceAttr(resourceName+".test_root", "recursive", "false"),
+					resource.TestCheckTypeSetElemAttr(resourceName+".test_root", consts.FieldPaths+".*", ns),
+					resource.TestCheckTypeSetElemAttr(resourceName+".test_root", consts.FieldPathsFQ+".*", ns),
+
+					resource.TestCheckResourceAttr(resourceName+".test_level0", "recursive", "false"),
+					resource.TestCheckResourceAttr(resourceName+".test_level0", consts.FieldNamespace, ns),
+					resource.TestCheckResourceAttr(resourceName+".test_level0", consts.FieldPaths+".#", "3"),
+					resource.TestCheckTypeSetElemAttr(resourceName+".test_level0", consts.FieldPaths+".*", "level1-ns-0"),
+					resource.TestCheckTypeSetElemAttr(resourceName+".test_level0", consts.FieldPaths+".*", "level1-ns-1"),
+					resource.TestCheckTypeSetElemAttr(resourceName+".test_level0", consts.FieldPaths+".*", "level1-ns-2"),
+					resource.TestCheckResourceAttr(resourceName+".test_level0", consts.FieldPathsFQ+".#", "3"),
+					resource.TestCheckTypeSetElemAttr(resourceName+".test_level0", consts.FieldPathsFQ+".*", ns+"/level1-ns-0"),
+					resource.TestCheckTypeSetElemAttr(resourceName+".test_level0", consts.FieldPathsFQ+".*", ns+"/level1-ns-1"),
+					resource.TestCheckTypeSetElemAttr(resourceName+".test_level0", consts.FieldPathsFQ+".*", ns+"/level1-ns-2"),
+
+					resource.TestCheckResourceAttr(resourceName+".test_level1", "recursive", "false"),
+					resource.TestCheckResourceAttr(resourceName+".test_level1", consts.FieldNamespace, ns+"/level1-ns-0"),
+					resource.TestCheckResourceAttr(resourceName+".test_level1", consts.FieldPaths+".#", "1"),
+					resource.TestCheckTypeSetElemAttr(resourceName+".test_level1", consts.FieldPaths+".*", "level2-ns-0"),
+					resource.TestCheckResourceAttr(resourceName+".test_level1", consts.FieldPathsFQ+".#", "1"),
+					resource.TestCheckTypeSetElemAttr(resourceName+".test_level1", consts.FieldPathsFQ+".*", ns+"/level1-ns-0/level2-ns-0"),
+
+					resource.TestCheckResourceAttr(resourceName+".test_level2", "recursive", "false"),
+					resource.TestCheckResourceAttr(resourceName+".test_level2", consts.FieldNamespace, ns+"/level1-ns-0/level2-ns-0"),
+					resource.TestCheckResourceAttr(resourceName+".test_level2", consts.FieldPaths+".#", "0"),
+					resource.TestCheckResourceAttr(resourceName+".test_level2", consts.FieldPathsFQ+".#", "0"),
+
+					resource.TestCheckResourceAttr(resourceName+".test_root_recursive", "recursive", "true"),
+					resource.TestCheckTypeSetElemAttr(resourceName+".test_root_recursive", consts.FieldPaths+".*", ns+"/level1-ns-0/level2-ns-0"),
+					resource.TestCheckTypeSetElemAttr(resourceName+".test_root_recursive", consts.FieldPathsFQ+".*", ns+"/level1-ns-0/level2-ns-0"),
+
+					resource.TestCheckResourceAttr(resourceName+".test_level0_recursive", "recursive", "true"),
+					resource.TestCheckResourceAttr(resourceName+".test_level0_recursive", consts.FieldNamespace, ns),
+					resource.TestCheckResourceAttr(resourceName+".test_level0_recursive", consts.FieldPaths+".#", "4"),
+					resource.TestCheckTypeSetElemAttr(resourceName+".test_level0_recursive", consts.FieldPaths+".*", "level1-ns-0"),
+					resource.TestCheckTypeSetElemAttr(resourceName+".test_level0_recursive", consts.FieldPaths+".*", "level1-ns-0/level2-ns-0"),
+					resource.TestCheckTypeSetElemAttr(resourceName+".test_level0_recursive", consts.FieldPaths+".*", "level1-ns-1"),
+					resource.TestCheckTypeSetElemAttr(resourceName+".test_level0_recursive", consts.FieldPaths+".*", "level1-ns-2"),
+					resource.TestCheckResourceAttr(resourceName+".test_level0_recursive", consts.FieldPathsFQ+".#", "4"),
+					resource.TestCheckTypeSetElemAttr(resourceName+".test_level0_recursive", consts.FieldPathsFQ+".*", ns+"/level1-ns-0"),
+					resource.TestCheckTypeSetElemAttr(resourceName+".test_level0_recursive", consts.FieldPathsFQ+".*", ns+"/level1-ns-0/level2-ns-0"),
+					resource.TestCheckTypeSetElemAttr(resourceName+".test_level0_recursive", consts.FieldPathsFQ+".*", ns+"/level1-ns-1"),
+					resource.TestCheckTypeSetElemAttr(resourceName+".test_level0_recursive", consts.FieldPathsFQ+".*", ns+"/level1-ns-2"),
+
+					resource.TestCheckResourceAttr(resourceName+".test_level1_recursive", "recursive", "true"),
+					resource.TestCheckResourceAttr(resourceName+".test_level1_recursive", consts.FieldNamespace, ns+"/level1-ns-0"),
+					resource.TestCheckResourceAttr(resourceName+".test_level1_recursive", consts.FieldPaths+".#", "1"),
+					resource.TestCheckTypeSetElemAttr(resourceName+".test_level1_recursive", consts.FieldPaths+".*", "level2-ns-0"),
+					resource.TestCheckResourceAttr(resourceName+".test_level1_recursive", consts.FieldPathsFQ+".#", "1"),
+					resource.TestCheckTypeSetElemAttr(resourceName+".test_level1_recursive", consts.FieldPathsFQ+".*", ns+"/level1-ns-0/level2-ns-0"),
+
+					resource.TestCheckResourceAttr(resourceName+".test_level2_recursive", "recursive", "true"),
+					resource.TestCheckResourceAttr(resourceName+".test_level2_recursive", consts.FieldNamespace, ns+"/level1-ns-0/level2-ns-0"),
+					resource.TestCheckResourceAttr(resourceName+".test_level2_recursive", consts.FieldPaths+".#", "0"),
+					resource.TestCheckResourceAttr(resourceName+".test_level2_recursive", consts.FieldPathsFQ+".#", "0"),
 				),
 			},
 		},
@@ -43,29 +93,62 @@ func TestAccDataSourceNamespaces(t *testing.T) {
 
 func testAccDataSourceNamespacesConfig(ns string, count int) string {
 	config := fmt.Sprintf(`
-resource "vault_namespace" "parent" {
+resource "vault_namespace" "level0" {
   path = %q
 }
 
-resource "vault_namespace" "test" {
+resource "vault_namespace" "level1" {
   count     = %d
-  namespace = vault_namespace.parent.path
-  path      = "test-${count.index}"
+  namespace = vault_namespace.level0.path_fq
+  path      = "level1-ns-${count.index}"
+}
+
+# this will create a namespace with the path "level0-ns/level1-ns-0/level2-ns-0"
+resource "vault_namespace" "level2" {
+  namespace = vault_namespace.level1[0].path_fq
+  path      = "level2-ns-0"
+}
+
+data "vault_namespaces" "test_root" {
+  depends_on = [vault_namespace.level0, vault_namespace.level1, vault_namespace.level2]
+}
+
+data "vault_namespaces" "test_level0" {
+  namespace  = vault_namespace.level0.path_fq
+  depends_on = [vault_namespace.level1, vault_namespace.level2]
+}
+
+data "vault_namespaces" "test_level1" {
+  namespace  = vault_namespace.level1[0].path_fq
+  depends_on = [vault_namespace.level1, vault_namespace.level2]
+}
+
+data "vault_namespaces" "test_level2" {
+  namespace  = vault_namespace.level2.path_fq
+  depends_on = [vault_namespace.level1, vault_namespace.level2]
+}
+
+data "vault_namespaces" "test_root_recursive" {
+  recursive  = true
+  depends_on = [vault_namespace.level0, vault_namespace.level1, vault_namespace.level2]
 }
 
-# this will create a namespace with the path "test/test-0/nested"
-resource "vault_namespace" "nested" {
-  namespace = vault_namespace.test[0].path_fq
-  path      = "nested"
+data "vault_namespaces" "test_level0_recursive" {
+  namespace  = vault_namespace.level0.path_fq
+  recursive  = true
+  depends_on = [vault_namespace.level1, vault_namespace.level2]
 }
 
-data "vault_namespaces" "test" {
-	namespace  = vault_namespace.parent.path
-	depends_on = [vault_namespace.test]
+data "vault_namespaces" "test_level1_recursive" {
+  namespace  = vault_namespace.level1[0].path_fq
+  recursive  = true
+  depends_on = [vault_namespace.level1, vault_namespace.level2]
 }
 
-data "vault_namespaces" "nested" {
-	namespace  = vault_namespace.nested.path_fq
+data "vault_namespaces" "test_level2_recursive" {
+  namespace  = vault_namespace.level2.path_fq
+  recursive  = true
+  depends_on = [vault_namespace.level1, vault_namespace.level2]
 }
 	`, ns, count)
 
diff --git a/vault/data_source_nomad_credentials_test.go b/vault/data_source_nomad_credentials_test.go
index c0e804dc..be661205 100644
--- a/vault/data_source_nomad_credentials_test.go
+++ b/vault/data_source_nomad_credentials_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 )
@@ -18,8 +19,8 @@ func TestAccDataSourceNomadAccessCredentialsClientBasic(t *testing.T) {
 	address, token := testutil.GetTestNomadCreds(t)
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDataSourceNomadAccessCredentialsConfig(backend, address, token, "test"),
@@ -37,8 +38,8 @@ func TestAccDataSourceNomadAccessCredentialsManagementBasic(t *testing.T) {
 	address, token := testutil.GetTestNomadCreds(t)
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDataSourceNomadAccessCredentialsManagementConfig(backend, address, token, "test"),
diff --git a/vault/data_source_pki_secret_backend_cert_metadata_test.go b/vault/data_source_pki_secret_backend_cert_metadata_test.go
index 55c0f3b7..26c655f3 100644
--- a/vault/data_source_pki_secret_backend_cert_metadata_test.go
+++ b/vault/data_source_pki_secret_backend_cert_metadata_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -69,7 +70,7 @@ func TestAccDataSourcePKISecretCertMetadata(t *testing.T) {
 
 	dataName := "data.vault_pki_secret_backend_cert_metadata.test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			testutil.TestEntPreCheck(t)
diff --git a/vault/data_source_pki_secret_backend_config_cmpv2_test.go b/vault/data_source_pki_secret_backend_config_cmpv2_test.go
index eb2092f6..da0aafb7 100644
--- a/vault/data_source_pki_secret_backend_config_cmpv2_test.go
+++ b/vault/data_source_pki_secret_backend_config_cmpv2_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -18,7 +19,7 @@ func TestAccDataSourcePKISecretConfigCMPV2(t *testing.T) {
 	backend := acctest.RandomWithPrefix("tf-test-pki-backend")
 	dataName := "data.vault_pki_secret_backend_config_cmpv2.test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			testutil.TestEntPreCheck(t)
diff --git a/vault/data_source_pki_secret_backend_config_est_test.go b/vault/data_source_pki_secret_backend_config_est_test.go
index 7de7f72a..2700e3b4 100644
--- a/vault/data_source_pki_secret_backend_config_est_test.go
+++ b/vault/data_source_pki_secret_backend_config_est_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -18,7 +19,7 @@ func TestAccDataSourcePKISecretConfigEst(t *testing.T) {
 	backend := acctest.RandomWithPrefix("tf-test-pki-backend")
 	dataName := "data.vault_pki_secret_backend_config_est.test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			testutil.TestEntPreCheck(t)
diff --git a/vault/data_source_pki_secret_backend_issuer_test.go b/vault/data_source_pki_secret_backend_issuer_test.go
index 96316906..8b5b00cc 100644
--- a/vault/data_source_pki_secret_backend_issuer_test.go
+++ b/vault/data_source_pki_secret_backend_issuer_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -20,7 +21,7 @@ func TestAccDataSourcePKISecretIssuer(t *testing.T) {
 	issuerName := acctest.RandomWithPrefix("tf-test-pki-issuer")
 	dataName := "data.vault_pki_secret_backend_issuer.test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion111)
@@ -45,7 +46,7 @@ func TestAccDataSourcePKISecretIssuer_verify_disable_fields(t *testing.T) {
 	issuerName := acctest.RandomWithPrefix("tf-test-pki-issuer")
 	dataName := "data.vault_pki_secret_backend_issuer.test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion119)
diff --git a/vault/data_source_pki_secret_backend_issuers_test.go b/vault/data_source_pki_secret_backend_issuers_test.go
index 67102104..2e6128f5 100644
--- a/vault/data_source_pki_secret_backend_issuers_test.go
+++ b/vault/data_source_pki_secret_backend_issuers_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -20,7 +21,7 @@ func TestAccDataSourcePKISecretIssuers(t *testing.T) {
 	issuerName := acctest.RandomWithPrefix("tf-test-pki-issuer")
 	dataName := "data.vault_pki_secret_backend_issuers.test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion111)
diff --git a/vault/data_source_pki_secret_backend_key_test.go b/vault/data_source_pki_secret_backend_key_test.go
index bc738c88..49911976 100644
--- a/vault/data_source_pki_secret_backend_key_test.go
+++ b/vault/data_source_pki_secret_backend_key_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -20,7 +21,7 @@ func TestAccDataSourcePKISecretKey(t *testing.T) {
 	keyName := acctest.RandomWithPrefix("tf-test-pki-key")
 	dataName := "data.vault_pki_secret_backend_key.test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion111)
diff --git a/vault/data_source_pki_secret_backend_keys_test.go b/vault/data_source_pki_secret_backend_keys_test.go
index 8de1a261..73f8b6fa 100644
--- a/vault/data_source_pki_secret_backend_keys_test.go
+++ b/vault/data_source_pki_secret_backend_keys_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -20,7 +21,7 @@ func TestAccDataSourcePKISecretKeys(t *testing.T) {
 	keyName := acctest.RandomWithPrefix("tf-test-pki-key")
 	dataName := "data.vault_pki_secret_backend_keys.test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion111)
diff --git a/vault/data_source_policy_document_test.go b/vault/data_source_policy_document_test.go
index 59065da2..d5b6042c 100644
--- a/vault/data_source_policy_document_test.go
+++ b/vault/data_source_policy_document_test.go
@@ -4,19 +4,20 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 )
 
 func TestDataSourcePolicyDocument(t *testing.T) {
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testDataSourcePolicyDocument_config,
@@ -29,10 +30,11 @@ func TestDataSourcePolicyDocument(t *testing.T) {
 var testDataSourcePolicyDocument_config = `
 data "vault_policy_document" "test" {
   rule {
-    path                = "secret/test1/*"
-    capabilities        = ["create", "read", "update", "delete", "list", "patch"]
-    description         = "test rule 1"
-    required_parameters = ["test_param1"]
+    path                  = "secret/test1/*"
+    capabilities          = ["create", "read", "update", "delete", "list", "patch"]
+    description           = "test rule 1"
+    required_parameters   = ["test_param1"]
+    subscribe_event_types = ["test_events1"]
 
     allowed_parameter {
       key   = "spam"
@@ -58,10 +60,11 @@ data "vault_policy_document" "test" {
   }
 
   rule {
-    path                = "secret/test2/*"
-    capabilities        = ["read", "list"]
-    description         = "test rule 2"
-    required_parameters = ["test_param2"]
+    path                  = "secret/test2/*"
+    capabilities          = ["read", "list"]
+    description           = "test rule 2"
+    required_parameters   = ["test_param2"]
+    subscribe_event_types = ["test_events2", "test_events3"]
 
     allowed_parameter {
       key   = "all"
@@ -85,6 +88,11 @@ data "vault_policy_document" "test" {
     path                = "secret/test3/"
     capabilities        = ["read", "list"]
   }
+
+ rule {
+    path                = "secret/test4/"
+    capabilities        = []
+  }
 }
 `
 
@@ -92,6 +100,7 @@ var testResultPolicyHCLDocument = `# test rule 1
 path "secret/test1/*" {
   capabilities = ["create", "read", "update", "delete", "list", "patch"]
   required_parameters = ["test_param1"]
+  subscribe_event_types = ["test_events1"]
   allowed_parameters = {
     "eggs" = ["foo", "bar"]
     "spam" = ["eggs"]
@@ -107,6 +116,7 @@ path "secret/test1/*" {
 path "secret/test2/*" {
   capabilities = ["read", "list"]
   required_parameters = ["test_param2"]
+  subscribe_event_types = ["test_events2", "test_events3"]
   allowed_parameters = {
     "all" = []
   }
@@ -120,6 +130,10 @@ path "secret/test2/*" {
 path "secret/test3/" {
   capabilities = ["read", "list"]
 }
+
+path "secret/test4/" {
+  capabilities = []
+}
 `
 
 func testDataSourcePolicyDocument_check(s *terraform.State) error {
diff --git a/vault/data_source_raft_autopilot_state_test.go b/vault/data_source_raft_autopilot_state_test.go
index a1507988..319ec52c 100644
--- a/vault/data_source_raft_autopilot_state_test.go
+++ b/vault/data_source_raft_autopilot_state_test.go
@@ -4,9 +4,10 @@
 package vault
 
 import (
+	"context"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -18,7 +19,7 @@ import (
 func TestAccDataSourceRaftAutoPilotState(t *testing.T) {
 	ds := "data.vault_raft_autopilot_state.test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.SkipTestEnvSet(t, "SKIP_RAFT_TESTS")
 			testutil.TestEntPreCheck(t)
diff --git a/vault/data_source_ssh_secret_backend_sign_test.go b/vault/data_source_ssh_secret_backend_sign_test.go
index c857cd9f..4ccd41fd 100644
--- a/vault/data_source_ssh_secret_backend_sign_test.go
+++ b/vault/data_source_ssh_secret_backend_sign_test.go
@@ -4,10 +4,11 @@
 package vault
 
 import (
+	"context"
 	"errors"
 	"fmt"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 	"golang.org/x/crypto/ssh"
 	"testing"
@@ -15,8 +16,8 @@ import (
 
 func TestDataSourceSSHSecretBackendSign(t *testing.T) {
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testDataSourceSSHSecretBackendSign_config,
diff --git a/vault/data_source_transform_decode_test.go b/vault/data_source_transform_decode_test.go
index ca25fbd6..d21b373a 100644
--- a/vault/data_source_transform_decode_test.go
+++ b/vault/data_source_transform_decode_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 )
@@ -16,8 +17,8 @@ import (
 func TestAccDecodeBasic(t *testing.T) {
 	path := acctest.RandomWithPrefix("transform")
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestEntPreCheck(t) },
-		ProviderFactories: providerFactories,
+		PreCheck:                 func() { testutil.TestEntPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config: transformDecode_basicConfig(path),
@@ -63,8 +64,8 @@ data "vault_transform_decode" "test" {
 func TestAccDecodeBatch(t *testing.T) {
 	path := acctest.RandomWithPrefix("transform")
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestEntPreCheck(t) },
-		ProviderFactories: providerFactories,
+		PreCheck:                 func() { testutil.TestEntPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config: transformDecode_batchConfig(path),
diff --git a/vault/data_source_transform_encode_test.go b/vault/data_source_transform_encode_test.go
index 923533d5..964e4a57 100644
--- a/vault/data_source_transform_encode_test.go
+++ b/vault/data_source_transform_encode_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 )
@@ -16,8 +17,8 @@ import (
 func TestAccEncodeBasic(t *testing.T) {
 	path := acctest.RandomWithPrefix("transform")
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestEntPreCheck(t) },
-		ProviderFactories: providerFactories,
+		PreCheck:                 func() { testutil.TestEntPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config: transformEncode_basicConfig(path),
@@ -63,8 +64,8 @@ data "vault_transform_encode" "test" {
 func TestAccEncodeBatch(t *testing.T) {
 	path := acctest.RandomWithPrefix("transform")
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestEntPreCheck(t) },
-		ProviderFactories: providerFactories,
+		PreCheck:                 func() { testutil.TestEntPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config: transformEncodeRole_batchConfig(path),
diff --git a/vault/data_source_transit_decrypt_test.go b/vault/data_source_transit_decrypt_test.go
index 6a6dc7bb..6ab66605 100644
--- a/vault/data_source_transit_decrypt_test.go
+++ b/vault/data_source_transit_decrypt_test.go
@@ -4,19 +4,20 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 )
 
 func TestDataSourceTransitDecrypt(t *testing.T) {
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testDataSourceTransitDecrypt_config,
diff --git a/vault/data_source_transit_encrypt_test.go b/vault/data_source_transit_encrypt_test.go
index 449f0c48..90f755c3 100644
--- a/vault/data_source_transit_encrypt_test.go
+++ b/vault/data_source_transit_encrypt_test.go
@@ -4,19 +4,20 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 )
 
 func TestDataSourceTransitEncrypt(t *testing.T) {
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testDataSourceTransitEncrypt_config,
diff --git a/vault/data_source_transit_sign_test.go b/vault/data_source_transit_sign_test.go
index 653740ab..089cd8db 100644
--- a/vault/data_source_transit_sign_test.go
+++ b/vault/data_source_transit_sign_test.go
@@ -4,10 +4,11 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 )
@@ -30,8 +31,8 @@ var signInputConfig = "input = \"aGVsbG8gd29ybGQuCg==\""
 func TestDataSourceTransitSign(t *testing.T) {
 	resourceName := "data.vault_transit_sign.test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: signVerifyConfig("ecdsa-p256", "", signBlock(signInputConfig)),
diff --git a/vault/data_source_transit_verify_test.go b/vault/data_source_transit_verify_test.go
index f1a0f463..71644516 100644
--- a/vault/data_source_transit_verify_test.go
+++ b/vault/data_source_transit_verify_test.go
@@ -4,10 +4,11 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 )
@@ -34,8 +35,8 @@ signature = data.vault_transit_sign.test.signature
 func TestDataSourceTransitVerify(t *testing.T) {
 	resourceName := "data.vault_transit_sign.test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: signVerifyConfig("ecdsa-p256", "", verifyTestConfig(signInputConfig, verifyInputConfig)),
diff --git a/vault/import_auth_backend_test.go b/vault/import_auth_backend_test.go
index 68cfc2f0..750d66fd 100644
--- a/vault/import_auth_backend_test.go
+++ b/vault/import_auth_backend_test.go
@@ -4,10 +4,11 @@
 package vault
 
 import (
+	"context"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -16,9 +17,9 @@ import (
 func TestAccAuthBackend_importBasic(t *testing.T) {
 	path := "github-" + acctest.RandString(10)
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAuthBackendDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAuthBackendDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testResourceAuth_initialConfig(path),
diff --git a/vault/import_generic_secret_test.go b/vault/import_generic_secret_test.go
index f86d4736..0adf3774 100644
--- a/vault/import_generic_secret_test.go
+++ b/vault/import_generic_secret_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 )
@@ -18,8 +19,8 @@ func TestAccGenericSecret_importBasic(t *testing.T) {
 	name := acctest.RandomWithPrefix("test")
 	path := fmt.Sprintf("%s/%s", mount, name)
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config: testResourceGenericSecret_initialConfig(mount, name),
@@ -46,8 +47,8 @@ func TestAccGenericSecret_importBasicNS(t *testing.T) {
 	path := fmt.Sprintf("%s/%s", mount, name)
 	resourceName := "vault_generic_secret.test"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestEntPreCheck(t) },
-		ProviderFactories: providerFactories,
+		PreCheck:                 func() { testutil.TestEntPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config: testResourceGenericSecret_initialConfigNS(ns, mount, name),
diff --git a/vault/import_mount_test.go b/vault/import_mount_test.go
index 02647001..ed26951a 100644
--- a/vault/import_mount_test.go
+++ b/vault/import_mount_test.go
@@ -4,10 +4,11 @@
 package vault
 
 import (
+	"context"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 )
@@ -20,8 +21,8 @@ func TestAccMount_importBasic(t *testing.T) {
 		version:   "1",
 	}
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config: testResourceMount_initialConfig(cfg),
diff --git a/vault/import_policy_test.go b/vault/import_policy_test.go
index 917f2f4d..44d7a253 100644
--- a/vault/import_policy_test.go
+++ b/vault/import_policy_test.go
@@ -4,10 +4,11 @@
 package vault
 
 import (
+	"context"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 )
@@ -15,8 +16,8 @@ import (
 func TestAccPolicy_importBasic(t *testing.T) {
 	name := "test-" + acctest.RandString(10)
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config: testResourcePolicy_initialConfig(name),
diff --git a/vault/provider_test.go b/vault/provider_test.go
index 10725c30..20106cb0 100644
--- a/vault/provider_test.go
+++ b/vault/provider_test.go
@@ -4,17 +4,20 @@
 package vault
 
 import (
+	"context"
 	"fmt"
+	"github.com/hashicorp/terraform-plugin-testing/plancheck"
 	"io/ioutil"
 	"os"
 	"path"
 	"sync"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-go/tfprotov5"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/vault/api"
 	"github.com/mitchellh/go-homedir"
 
@@ -60,8 +63,9 @@ func TestProvider(t *testing.T) {
 }
 
 var (
-	testProvider  *schema.Provider
-	testProviders map[string]*schema.Provider
+	testProvider *schema.Provider
+
+	testProviderMutex sync.Mutex
 )
 
 func init() {
@@ -77,46 +81,114 @@ func initTestProvider() {
 			}
 
 			if testProvider == nil {
-				testProvider = Provider()
-				testProviders = map[string]*schema.Provider{
-					providerName: testProvider,
-				}
-				rs := &schema.Resource{
-					Schema: testProvider.Schema,
+				_, p, err := ProtoV5ProviderServerFactory(context.Background())
+				if err != nil {
+					panic(err)
 				}
 
-				m, err := testProvider.ConfigureFunc(rs.TestResourceData())
+				// no need to lock here since sync.Once performs a lock
+				testProvider = p.SchemaProvider()
+				rootProviderResource := &schema.Resource{
+					Schema: p.SchemaProvider().Schema,
+				}
+				rootProviderData := rootProviderResource.TestResourceData()
+				m, err := provider.NewProviderMeta(rootProviderData)
 				if err != nil {
 					panic(err)
 				}
+
 				testProvider.SetMeta(m)
 			}
 		},
 	)
 }
 
-var providerFactories = map[string]func() (*schema.Provider, error){
-	providerName: func() (*schema.Provider, error) {
-		initTestProvider()
-		return testProvider, nil
-	},
-}
-
 // A basic token helper script.
 const tokenHelperScript = `#!/usr/bin/env bash
 echo "helper-token"
 `
 
-func TestAccAuthLoginProviderConfigure(t *testing.T) {
-	rootProvider := Provider()
+// testAccProtoV5ProviderFactories will return a map of provider servers
+// suitable for use as a resource.TestStep.ProtoV5ProviderFactories.
+//
+// When multiplexing providers, the schema and configuration handling must
+// exactly match between all underlying providers of the mux server. Mismatched
+// schemas will result in a runtime error.
+// see: https://developer.hashicorp.com/terraform/plugin/framework/migrating/mux
+//
+// Any tests that use this function will serve as a smoketest to verify the
+// provider schemas match 1-1 so that we may catch runtime errors.
+func testAccProtoV5ProviderFactories(ctx context.Context, t *testing.T) map[string]func() (tfprotov5.ProviderServer, error) {
+	providerServerFactory, p, err := ProtoV5ProviderServerFactory(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	providerServer := providerServerFactory()
+
+	testProviderMutex.Lock()
+	testProvider = p.SchemaProvider()
 	rootProviderResource := &schema.Resource{
-		Schema: rootProvider.Schema,
+		Schema: p.SchemaProvider().Schema,
+	}
+	rootProviderData := rootProviderResource.TestResourceData()
+	m, err := provider.NewProviderMeta(rootProviderData)
+	if err != nil {
+		panic(err)
+	}
+
+	testProvider.SetMeta(m)
+	testProviderMutex.Unlock()
+
+	return map[string]func() (tfprotov5.ProviderServer, error){
+		providerName: func() (tfprotov5.ProviderServer, error) {
+			return providerServer, nil
+		},
 	}
+}
+
+// TestAccMuxServer uses ExternalProviders (vault) to generate a state file
+// with a previous version of the provider and then verify that there are no
+// planned changes after migrating to the Framework.
+//
+// As of TFVP v4.8.0, the resources used in this test are not implemented with
+// the new Terraform Plugin Framework. However, this will act as a smoketest to
+// verify the provider schemas match 1-1.
+//
+// Additionally, when migrating a resource this test can be used as a pattern
+// to follow to verify that switching from SDKv2 to the Framework has not
+// affected your provider's behavior.
+func TestAccMuxServer(t *testing.T) {
 	resource.Test(t, resource.TestCase{
-		PreCheck: func() { testutil.TestAccPreCheck(t) },
-		Providers: map[string]*schema.Provider{
-			"vault": rootProvider,
+		Steps: []resource.TestStep{
+			{
+				ExternalProviders: map[string]resource.ExternalProvider{
+					"vault": {
+						// 4.8.0 is not multiplexed
+						VersionConstraint: "4.8.0",
+						Source:            "hashicorp/vault",
+					},
+				},
+				Config: testResourceApproleConfig_basic(),
+				Check:  testResourceApproleLoginCheckAttrs(t),
+			},
+			{
+				ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+				Config:                   testResourceApproleConfig_basic(),
+				ConfigPlanChecks: resource.ConfigPlanChecks{
+					PreApply: []plancheck.PlanCheck{
+						plancheck.ExpectEmptyPlan(),
+					},
+				},
+			},
 		},
+	})
+}
+
+func TestAccAuthLoginProviderConfigure(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config: testResourceApproleConfig_basic(),
@@ -125,6 +197,9 @@ func TestAccAuthLoginProviderConfigure(t *testing.T) {
 		},
 	})
 
+	rootProviderResource := &schema.Resource{
+		Schema: testProvider.Schema,
+	}
 	rootProviderData := rootProviderResource.TestResourceData()
 	if _, err := provider.NewProviderMeta(rootProviderData); err != nil {
 		t.Fatal(err)
@@ -132,14 +207,9 @@ func TestAccAuthLoginProviderConfigure(t *testing.T) {
 }
 
 func TestTokenReadProviderConfigureWithHeaders(t *testing.T) {
-	rootProvider := Provider()
-
-	rootProviderResource := &schema.Resource{
-		Schema: rootProvider.Schema,
-	}
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config: testHeaderConfig("auth", "123"),
@@ -148,6 +218,9 @@ func TestTokenReadProviderConfigureWithHeaders(t *testing.T) {
 		},
 	})
 
+	rootProviderResource := &schema.Resource{
+		Schema: testProvider.Schema,
+	}
 	rootProviderData := rootProviderResource.TestResourceData()
 	if _, err := provider.NewProviderMeta(rootProviderData); err != nil {
 		t.Fatal(err)
@@ -366,6 +439,7 @@ func TestAccProviderToken(t *testing.T) {
 		t.Fatal(err)
 	}
 	origTokenBytes, err := ioutil.ReadFile(tokenFilePath)
+
 	if err == nil {
 		// There is an existing token file. Ensure it is restored after this test.
 		info, err := os.Stat(tokenFilePath)
@@ -403,15 +477,12 @@ func TestAccProviderToken(t *testing.T) {
 		name          string
 		fileToken     bool
 		helperToken   bool
+		envToken      bool
 		schemaToken   bool
 		expectedToken string
 	}
 
 	tests := []testcase{
-		{
-			name:          "None",
-			expectedToken: "",
-		},
 		{
 			// The p will read the token file "~/.vault-token".
 			name:          "File",
@@ -425,12 +496,21 @@ func TestAccProviderToken(t *testing.T) {
 			helperToken:   true,
 			expectedToken: "helper-token",
 		},
+		{
+			// A VAULT_TOKEN env var or hardcoded token overrides all else.
+			name:          "Env",
+			fileToken:     true,
+			helperToken:   true,
+			envToken:      true,
+			expectedToken: os.Getenv("VAULT_TOKEN"),
+		},
 		{
 			// A VAULT_TOKEN env var or hardcoded token overrides all else.
 			name:          "Schema",
 			fileToken:     true,
 			helperToken:   true,
 			schemaToken:   true,
+			envToken:      true,
 			expectedToken: "schema-token",
 		},
 	}
@@ -458,6 +538,18 @@ func TestAccProviderToken(t *testing.T) {
 			}
 
 			d := providerResource.TestResourceData()
+			// Set up the env token.
+			if tc.envToken {
+				d.Set("token", os.Getenv("VAULT_TOKEN"))
+			} else {
+				// unset vault token env because it takes precedence over helper and file
+				resetConfigPathEnv, err := tempUnsetenv("VAULT_TOKEN")
+				defer failIfErr(t, resetConfigPathEnv)
+				if err != nil {
+					t.Fatal(err)
+				}
+			}
+
 			// Set up the schema token.
 			if tc.schemaToken {
 				d.Set("token", "schema-token")
@@ -531,8 +623,8 @@ func TestAccTokenName(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.WantTokenName, func(t *testing.T) {
 			resource.Test(t, resource.TestCase{
-				ProviderFactories: providerFactories,
-				PreCheck:          func() { testutil.TestAccPreCheck(t) },
+				ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+				PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 				Steps: []resource.TestStep{
 					{
 						PreConfig: func() {
@@ -558,8 +650,6 @@ func TestAccTokenName(t *testing.T) {
 }
 
 func TestAccChildToken(t *testing.T) {
-	defer os.Unsetenv(consts.EnvVarSkipChildToken)
-
 	checkTokenUsed := func(expectChildToken bool) resource.TestCheckFunc {
 		if expectChildToken {
 			// If the default child token was created, we expect the token
@@ -573,78 +663,33 @@ func TestAccChildToken(t *testing.T) {
 	}
 
 	tests := map[string]struct {
-		skipChildTokenEnv    string
-		useChildTokenEnv     bool
 		skipChildTokenSchema string
 		useChildTokenSchema  bool
 		expectChildToken     bool
 	}{
-		"tc1": {
+		"skip_child_token unset in config": {
 			useChildTokenSchema: false,
-			useChildTokenEnv:    false,
 			expectChildToken:    true,
 		},
-		"tc2": {
-			skipChildTokenEnv: "",
-			useChildTokenEnv:  true,
-			expectChildToken:  true,
-		},
-		"tc3": {
-			skipChildTokenEnv: "true",
-			useChildTokenEnv:  true,
-			expectChildToken:  false,
-		},
-		"tc4": {
-			skipChildTokenEnv: "false",
-			useChildTokenEnv:  true,
-			expectChildToken:  true,
-		},
-		"tc5": {
+		"skip_child_token true in config": {
 			skipChildTokenSchema: "true",
 			useChildTokenSchema:  true,
 			expectChildToken:     false,
 		},
-		"tc6": {
-			skipChildTokenSchema: "false",
-			useChildTokenSchema:  true,
-			expectChildToken:     true,
-		},
-		"tc7": {
-			skipChildTokenEnv:    "true",
-			useChildTokenEnv:     true,
+		"skip_child_token false in config": {
 			skipChildTokenSchema: "false",
 			useChildTokenSchema:  true,
 			expectChildToken:     true,
 		},
-		"tc8": {
-			skipChildTokenEnv:    "false",
-			useChildTokenEnv:     true,
-			skipChildTokenSchema: "true",
-			useChildTokenSchema:  true,
-			expectChildToken:     false,
-		},
 	}
 
 	for name, test := range tests {
 		t.Run(name, func(t *testing.T) {
 			resource.Test(t, resource.TestCase{
-				ProviderFactories: providerFactories,
-				PreCheck:          func() { testutil.TestAccPreCheck(t) },
+				ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+				PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 				Steps: []resource.TestStep{
 					{
-						PreConfig: func() {
-							if test.useChildTokenEnv {
-								err := os.Setenv(consts.EnvVarSkipChildToken, test.skipChildTokenEnv)
-								if err != nil {
-									t.Fatal(err)
-								}
-							} else {
-								err := os.Unsetenv(consts.EnvVarSkipChildToken)
-								if err != nil {
-									t.Fatal(err)
-								}
-							}
-						},
 						Config: testProviderConfig(test.useChildTokenSchema,
 							consts.FieldSkipChildToken+` = `+test.skipChildTokenSchema,
 						),
@@ -782,6 +827,15 @@ func TestAccProviderVaultAddrEnv(t *testing.T) {
 				if err != nil {
 					t.Fatal(err)
 				}
+
+				// unset vault token env because add_address_to_env will only
+				// be set if the token is unset in the config and the
+				// VAULT_ADDR env variable
+				reset, err := tempUnsetenv(api.EnvVaultToken)
+				defer failIfErr(t, reset)
+				if err != nil {
+					t.Fatal(err)
+				}
 			}
 
 			cleanup := setupTestTokenHelper(t, echoBackTokenHelperScript)
diff --git a/vault/resource_ad_secret_backend_test.go b/vault/resource_ad_secret_backend_test.go
index 86ce15a1..b8f7329a 100644
--- a/vault/resource_ad_secret_backend_test.go
+++ b/vault/resource_ad_secret_backend_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -21,7 +22,7 @@ func TestADSecretBackend(t *testing.T) {
 	resourceType := "vault_ad_secret_backend"
 	resourceName := resourceType + ".test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories:         providerFactories,
+		ProtoV5ProviderFactories:  testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck:                  func() { testutil.TestAccPreCheck(t) },
 		PreventPostDestroyRefresh: true,
 		CheckDestroy:              testCheckMountDestroyed(resourceType, consts.MountTypeAD, consts.FieldBackend),
@@ -67,8 +68,8 @@ func TestADSecretBackend_remount(t *testing.T) {
 	bindDN, bindPass, url := testutil.GetTestADCreds(t)
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testADSecretBackend_initialConfig(backend, bindDN, bindPass, url),
diff --git a/vault/resource_ad_secret_library_test.go b/vault/resource_ad_secret_library_test.go
index 1ee85c1f..6fbd4f9b 100644
--- a/vault/resource_ad_secret_library_test.go
+++ b/vault/resource_ad_secret_library_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -20,9 +21,9 @@ func TestAccADSecretBackendLibrary_basic(t *testing.T) {
 	bindDN, bindPass, url := testutil.GetTestADCreds(t)
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccADSecretBackendLibraryCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccADSecretBackendLibraryCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testADSecretBackendLibraryConfig(backend, bindDN, bindPass, url, "qa", `"Bob","Mary"`, 60, 120, false),
@@ -54,9 +55,9 @@ func TestAccADSecretBackendLibrary_import(t *testing.T) {
 	bindDN, bindPass, url := testutil.GetTestADCreds(t)
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccADSecretBackendRoleCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccADSecretBackendRoleCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testADSecretBackendLibraryConfig(backend, bindDN, bindPass, url, "qa", `"Bob","Mary"`, 60, 120, false),
diff --git a/vault/resource_ad_secret_roles_test.go b/vault/resource_ad_secret_roles_test.go
index edac6296..ea168c5c 100644
--- a/vault/resource_ad_secret_roles_test.go
+++ b/vault/resource_ad_secret_roles_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -20,9 +21,9 @@ func TestAccADSecretBackendRole_basic(t *testing.T) {
 	bindDN, bindPass, url := testutil.GetTestADCreds(t)
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccADSecretBackendRoleCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccADSecretBackendRoleCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testADSecretBackendRoleConfig(backend, bindDN, bindPass, url, "bob", "Bob", 60),
@@ -54,9 +55,9 @@ func TestAccADSecretBackendRole_import(t *testing.T) {
 	ttl := 60
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccADSecretBackendRoleCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccADSecretBackendRoleCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testADSecretBackendRoleConfig(backend, bindDN, bindPass, url, role, serviceAccountName, ttl),
diff --git a/vault/resource_alicloud_auth_backend_role_test.go b/vault/resource_alicloud_auth_backend_role_test.go
index 0d1fe682..21adbd69 100644
--- a/vault/resource_alicloud_auth_backend_role_test.go
+++ b/vault/resource_alicloud_auth_backend_role_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -21,9 +22,9 @@ func TestAlicloudAuthBackendRole_basic(t *testing.T) {
 	arn := acctest.RandomWithPrefix("acs:ram:123456:tf:role/")
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAlicloudAuthBackedRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAlicloudAuthBackedRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAlicloudAuthBackedRoleConfig_basic(backend, name, arn),
diff --git a/vault/resource_approle_auth_backend_login_test.go b/vault/resource_approle_auth_backend_login_test.go
index 126b0e21..945a87ed 100644
--- a/vault/resource_approle_auth_backend_login_test.go
+++ b/vault/resource_approle_auth_backend_login_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -19,8 +20,8 @@ func TestAccAppRoleAuthBackendLogin_basic(t *testing.T) {
 	role := acctest.RandomWithPrefix("test-role")
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAppRoleAuthBackendLoginConfig_basic(backend, role),
diff --git a/vault/resource_approle_auth_backend_role_secret_id_test.go b/vault/resource_approle_auth_backend_role_secret_id_test.go
index 6d390bb7..a31192b4 100644
--- a/vault/resource_approle_auth_backend_role_secret_id_test.go
+++ b/vault/resource_approle_auth_backend_role_secret_id_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"regexp"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	helper "github.com/hashicorp/vault/sdk/helper/consts"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
@@ -25,9 +26,9 @@ func TestAccAppRoleAuthBackendRoleSecretID_basic(t *testing.T) {
 	role := acctest.RandomWithPrefix("test-role")
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAppRoleAuthBackendRoleSecretIDDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAppRoleAuthBackendRoleSecretIDDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAppRoleAuthBackendRoleSecretIDConfig_basic(backend, role),
@@ -59,9 +60,9 @@ func TestAccAppRoleAuthBackendRoleSecretID_wrapped(t *testing.T) {
 	withWrappedAccessor := false
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAppRoleAuthBackendRoleSecretIDDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAppRoleAuthBackendRoleSecretIDDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAppRoleAuthBackendRoleSecretIDConfig_wrapped(backend, role, withWrappedAccessor),
@@ -82,9 +83,9 @@ func TestAccAppRoleAuthBackendRoleSecretID_wrapped_withWrappedAccessor(t *testin
 	withWrappedAccessor := true
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAppRoleAuthBackendRoleSecretIDDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAppRoleAuthBackendRoleSecretIDDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAppRoleAuthBackendRoleSecretIDConfig_wrapped(backend, role, withWrappedAccessor),
@@ -108,8 +109,8 @@ func TestAccAppRoleAuthBackendRoleSecretID_wrapped_namespace(t *testing.T) {
 
 	namespacePath := acctest.RandomWithPrefix("test-namespace")
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestEntPreCheck(t) },
-		ProviderFactories: providerFactories,
+		PreCheck:                 func() { testutil.TestEntPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		CheckDestroy: func(s *terraform.State) error {
 			if err := testAccCheckAppRoleAuthBackendRoleSecretIDDestroy(s); err != nil {
 				return err
@@ -142,8 +143,8 @@ func TestAccAppRoleAuthBackendRoleSecretID_wrapped_namespace_withWrappedAccessor
 
 	namespacePath := acctest.RandomWithPrefix("test-namespace")
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestEntPreCheck(t) },
-		ProviderFactories: providerFactories,
+		PreCheck:                 func() { testutil.TestEntPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		CheckDestroy: func(s *terraform.State) error {
 			if err := testAccCheckAppRoleAuthBackendRoleSecretIDDestroy(s); err != nil {
 				return err
@@ -177,9 +178,9 @@ func TestAccAppRoleAuthBackendRoleSecretID_full(t *testing.T) {
 	secretID := acctest.RandomWithPrefix("test-role-id")
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAppRoleAuthBackendRoleSecretIDDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAppRoleAuthBackendRoleSecretIDDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAppRoleAuthBackendRoleSecretIDConfig_full(backend, role, secretID),
diff --git a/vault/resource_approle_auth_backend_role_test.go b/vault/resource_approle_auth_backend_role_test.go
index be2fbe0c..a32c4fac 100644
--- a/vault/resource_approle_auth_backend_role_test.go
+++ b/vault/resource_approle_auth_backend_role_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -21,9 +22,9 @@ func TestAccAppRoleAuthBackendRole_import(t *testing.T) {
 	roleID := acctest.RandomWithPrefix("test-role-id")
 	resourcePath := "vault_approle_auth_backend_role.role"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAppRoleAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAppRoleAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAppRoleAuthBackendRoleConfig_full(backend, role, roleID),
@@ -65,9 +66,9 @@ func TestAccAppRoleAuthBackendRole_basic(t *testing.T) {
 	role := acctest.RandomWithPrefix("test-role")
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAppRoleAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAppRoleAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAppRoleAuthBackendRoleConfig_basic(backend, role),
@@ -107,9 +108,9 @@ func TestAccAppRoleAuthBackendRole_update(t *testing.T) {
 	role := acctest.RandomWithPrefix("test-role")
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAppRoleAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAppRoleAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAppRoleAuthBackendRoleConfig_basic(backend, role),
@@ -180,9 +181,9 @@ func TestAccAppRoleAuthBackendRole_full(t *testing.T) {
 	resourcePath := "vault_approle_auth_backend_role.role"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAppRoleAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAppRoleAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAppRoleAuthBackendRoleConfig_full(backend, role, roleID),
@@ -217,9 +218,9 @@ func TestAccAppRoleAuthBackendRole_fullUpdate(t *testing.T) {
 	newRoleID := acctest.RandomWithPrefix("test-role-id")
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAppRoleAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAppRoleAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAppRoleAuthBackendRoleConfig_full(backend, role, roleID),
diff --git a/vault/resource_audit_request_header_test.go b/vault/resource_audit_request_header_test.go
index 5334807a..c947b652 100644
--- a/vault/resource_audit_request_header_test.go
+++ b/vault/resource_audit_request_header_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/vault/api"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -20,9 +21,9 @@ func TestAuditRequestHeader(t *testing.T) {
 	name := acctest.RandomWithPrefix("tf-test")
 	newName := acctest.RandomWithPrefix("tf-test-new")
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAuditRequestHeaderCheckDestroy(name, newName),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAuditRequestHeaderCheckDestroy(name, newName),
 		Steps: []resource.TestStep{
 			{
 				Config: testAuditRequestHeader_Config(name, false),
diff --git a/vault/resource_audit_test.go b/vault/resource_audit_test.go
index 10662c80..e1fd2a1c 100644
--- a/vault/resource_audit_test.go
+++ b/vault/resource_audit_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/vault/api"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -19,8 +20,8 @@ import (
 func TestResourceAudit(t *testing.T) {
 	path := "example-" + acctest.RandString(10)
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testResourceAudit_initialConfig(path),
diff --git a/vault/resource_auth_backend_test.go b/vault/resource_auth_backend_test.go
index fe035c06..2242bdf0 100644
--- a/vault/resource_auth_backend_test.go
+++ b/vault/resource_auth_backend_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"regexp"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/vault/api"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
@@ -23,8 +24,8 @@ func TestResourceAuth(t *testing.T) {
 
 	resourceName := "vault_auth_backend.test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testResourceAuth_initialConfig(path + consts.PathDelim),
@@ -63,8 +64,8 @@ func TestAuthBackend_remount(t *testing.T) {
 	resourceName := "vault_auth_backend.test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testResourceAuth_initialConfig(path),
@@ -210,8 +211,8 @@ func TestResourceAuthTune(t *testing.T) {
 	resName := "vault_auth_backend.test"
 	var resAuthFirst api.AuthMount
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testResourceAuthTune_initialConfig(backend),
diff --git a/vault/resource_aws_auth_backend_cert_test.go b/vault/resource_aws_auth_backend_cert_test.go
index adf1fa61..a501136b 100644
--- a/vault/resource_aws_auth_backend_cert_test.go
+++ b/vault/resource_aws_auth_backend_cert_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"encoding/base64"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -24,9 +25,9 @@ func TestAccAWSAuthBackendCert_import(t *testing.T) {
 	backend := acctest.RandomWithPrefix("aws")
 	name := acctest.RandomWithPrefix("test-cert")
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAWSAuthBackendCertDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAWSAuthBackendCertDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAWSAuthBackendCertConfig_basic(backend, name),
@@ -45,9 +46,9 @@ func TestAccAWSAuthBackendCert_basic(t *testing.T) {
 	backend := acctest.RandomWithPrefix("aws")
 	name := acctest.RandomWithPrefix("test-cert")
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAWSAuthBackendCertDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAWSAuthBackendCertDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAWSAuthBackendCertConfig_basic(backend, name),
diff --git a/vault/resource_aws_auth_backend_client_test.go b/vault/resource_aws_auth_backend_client_test.go
index 365f4829..d34d4301 100644
--- a/vault/resource_aws_auth_backend_client_test.go
+++ b/vault/resource_aws_auth_backend_client_test.go
@@ -4,14 +4,15 @@
 package vault
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"regexp"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -21,9 +22,9 @@ import (
 func TestAccAWSAuthBackendClient_import(t *testing.T) {
 	backend := acctest.RandomWithPrefix("aws")
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAWSAuthBackendClientDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAWSAuthBackendClientDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAWSAuthBackendClientConfig_basic(backend),
@@ -42,9 +43,9 @@ func TestAccAWSAuthBackendClient_import(t *testing.T) {
 func TestAccAWSAuthBackendClient_basic(t *testing.T) {
 	backend := acctest.RandomWithPrefix("aws")
 	resource.ParallelTest(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccCheckAWSAuthBackendClientDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccCheckAWSAuthBackendClientDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAWSAuthBackendClientConfig_basic(backend),
@@ -61,9 +62,9 @@ func TestAccAWSAuthBackendClient_basic(t *testing.T) {
 func TestAccAWSAuthBackendClient_nested(t *testing.T) {
 	backend := acctest.RandomWithPrefix("aws") + "/nested"
 	resource.ParallelTest(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccCheckAWSAuthBackendClientDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccCheckAWSAuthBackendClientDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAWSAuthBackendClientConfig_basic(backend),
@@ -80,9 +81,9 @@ func TestAccAWSAuthBackendClient_nested(t *testing.T) {
 func TestAccAWSAuthBackendClient_withoutSecretKey(t *testing.T) {
 	backend := acctest.RandomWithPrefix("aws")
 	resource.ParallelTest(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccCheckAWSAuthBackendClientDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccCheckAWSAuthBackendClientDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAWSAuthBackendClientConfig_basicWithoutSecretKey(backend),
@@ -108,7 +109,7 @@ func TestAccAWSAuthBackend_wif(t *testing.T) {
 	backend := acctest.RandomWithPrefix("aws")
 	resourceName := "vault_aws_auth_backend_client.client"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion117)
@@ -141,9 +142,9 @@ func TestAccAWSAuthBackend_wif(t *testing.T) {
 func TestAccAWSAuthBackendClientStsRegionNoEndpoint(t *testing.T) {
 	backend := acctest.RandomWithPrefix("aws")
 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAWSAuthBackendClientDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAWSAuthBackendClientDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccAWSAuthBackendClientConfigSTSRegionNoEndpoint(backend),
@@ -160,8 +161,8 @@ func TestAccAWSAuthBackendClientStsRegionFromClient(t *testing.T) {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion115)
 		},
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAWSAuthBackendClientDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAWSAuthBackendClientDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAWSAuthBackendClientConfigSTSRegionFromClient(backend, false),
@@ -190,7 +191,7 @@ func TestAccAWSAuthBackendClient_automatedRotation(t *testing.T) {
 	resourceType := "vault_aws_auth_backend_client"
 	resourceName := resourceType + ".test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion119)
diff --git a/vault/resource_aws_auth_backend_config_identity_test.go b/vault/resource_aws_auth_backend_config_identity_test.go
index b7986b8a..284aab7f 100644
--- a/vault/resource_aws_auth_backend_config_identity_test.go
+++ b/vault/resource_aws_auth_backend_config_identity_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -19,9 +20,9 @@ func TestAccAwsAuthBackendConfigIdentity(t *testing.T) {
 	backend := acctest.RandomWithPrefix("aws")
 	resourceName := "vault_aws_auth_backend_config_identity.config"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAwsAuthBackendConfigIdentityDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAwsAuthBackendConfigIdentityDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAwsAuthBackendConfigIdentity_basic(backend),
diff --git a/vault/resource_aws_auth_backend_identity_whitelist_test.go b/vault/resource_aws_auth_backend_identity_whitelist_test.go
index 7e476d91..fd49e58f 100644
--- a/vault/resource_aws_auth_backend_identity_whitelist_test.go
+++ b/vault/resource_aws_auth_backend_identity_whitelist_test.go
@@ -4,14 +4,15 @@
 package vault
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"strconv"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -20,9 +21,9 @@ import (
 func TestAccAWSAuthBackendIdentityWhitelist_import(t *testing.T) {
 	backend := acctest.RandomWithPrefix("aws")
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAWSAuthBackendIdentityWhitelistDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAWSAuthBackendIdentityWhitelistDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAWSAuthBackendIdentityWhitelistConfig_basic(backend),
@@ -40,9 +41,9 @@ func TestAccAWSAuthBackendIdentityWhitelist_import(t *testing.T) {
 func TestAccAWSAuthBackendIdentityWhitelist_basic(t *testing.T) {
 	backend := acctest.RandomWithPrefix("aws")
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAWSAuthBackendIdentityWhitelistDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAWSAuthBackendIdentityWhitelistDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAWSAuthBackendIdentityWhitelistConfig_basic(backend),
diff --git a/vault/resource_aws_auth_backend_login_test.go b/vault/resource_aws_auth_backend_login_test.go
index 466567c5..53a3a6bf 100644
--- a/vault/resource_aws_auth_backend_login_test.go
+++ b/vault/resource_aws_auth_backend_login_test.go
@@ -4,6 +4,7 @@
 package vault
 
 import (
+	"context"
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
@@ -14,8 +15,8 @@ import (
 	"github.com/aws/aws-sdk-go/aws/ec2metadata"
 	"github.com/aws/aws-sdk-go/aws/session"
 	"github.com/aws/aws-sdk-go/service/sts"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 )
@@ -49,8 +50,8 @@ func TestAccAWSAuthBackendLogin_iamIdentity(t *testing.T) {
 	reqHeaders := base64.StdEncoding.EncodeToString(loginDataHeaders)
 	reqBody := base64.StdEncoding.EncodeToString(loginDataBody)
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDataSourceAWSAuthBackendLoginConfig_iamIdentity(mountPath, accessKey, secretKey, reqMethod, reqURL, reqHeaders, reqBody, roleName, *testIdentity.Arn),
@@ -99,8 +100,8 @@ func TestAccAWSAuthBackendLogin_pkcs7(t *testing.T) {
 	pkcs7 = strings.Replace(pkcs7, "\n", "", -1)
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDataSourceAWSAuthBackendLoginConfig_pkcs7(mountPath, accessKey, secretKey, roleName, ami, account, arn, pkcs7),
@@ -155,8 +156,8 @@ func TestAccAWSAuthBackendLogin_ec2Identity(t *testing.T) {
 	sig = strings.Replace(sig, "\n", "", -1)
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDataSourceAWSAuthBackendLoginConfig_ec2Identity(mountPath, accessKey, secretKey, roleName, ami, account, arn, identity, sig),
diff --git a/vault/resource_aws_auth_backend_role_tag_test.go b/vault/resource_aws_auth_backend_role_tag_test.go
index 99e4cdd1..be198b7c 100644
--- a/vault/resource_aws_auth_backend_role_tag_test.go
+++ b/vault/resource_aws_auth_backend_role_tag_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 )
@@ -17,8 +18,8 @@ func TestAccAWSAuthBackendRoleTag_basic(t *testing.T) {
 	backend := acctest.RandomWithPrefix("tf-test-aws")
 	role := acctest.RandomWithPrefix("tf-test-aws")
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAWSAuthBackendRoleTagConfig_basic(backend, role),
diff --git a/vault/resource_aws_auth_backend_role_test.go b/vault/resource_aws_auth_backend_role_test.go
index 25ec913c..db6c2665 100644
--- a/vault/resource_aws_auth_backend_role_test.go
+++ b/vault/resource_aws_auth_backend_role_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -21,9 +22,9 @@ func TestAccAWSAuthBackendRole_importInferred(t *testing.T) {
 
 	resourceName := "vault_aws_auth_backend_role.role"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAWSAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAWSAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAWSAuthBackendRoleConfig_inferred(backend, role),
@@ -50,9 +51,9 @@ func TestAccAWSAuthBackendRole_importEC2(t *testing.T) {
 
 	resourceName := "vault_aws_auth_backend_role.role"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAWSAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAWSAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAWSAuthBackendRoleConfig_ec2(backend, role),
@@ -73,9 +74,9 @@ func TestAccAWSAuthBackendRole_importIAM(t *testing.T) {
 
 	resourceName := "vault_aws_auth_backend_role.role"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAWSAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAWSAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAWSAuthBackendRoleConfig_iam(backend, role),
@@ -96,9 +97,9 @@ func TestAccAWSAuthBackendRole_inferred(t *testing.T) {
 
 	resourceName := "vault_aws_auth_backend_role.role"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAWSAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAWSAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAWSAuthBackendRoleConfig_inferred(backend, role),
@@ -114,9 +115,9 @@ func TestAccAWSAuthBackendRole_ec2(t *testing.T) {
 
 	resourceName := "vault_aws_auth_backend_role.role"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAWSAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAWSAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAWSAuthBackendRoleConfig_ec2(backend, role),
@@ -132,9 +133,9 @@ func TestAccAWSAuthBackendRole_iam(t *testing.T) {
 
 	resourceName := "vault_aws_auth_backend_role.role"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAWSAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAWSAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAWSAuthBackendRoleConfig_iam(backend, role),
@@ -150,9 +151,9 @@ func TestAccAWSAuthBackendRole_iam_resolve_aws_unique_ids(t *testing.T) {
 
 	resourceName := "vault_aws_auth_backend_role.role"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAWSAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAWSAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAWSAuthBackendRoleConfig_iam_resolve_aws_unique_ids(backend, role),
@@ -168,9 +169,9 @@ func TestAccAWSAuthBackendRole_iamUpdate(t *testing.T) {
 
 	resourceName := "vault_aws_auth_backend_role.role"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAWSAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAWSAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAWSAuthBackendRoleConfig_iam(backend, role),
diff --git a/vault/resource_aws_auth_backend_roletag_blacklist_test.go b/vault/resource_aws_auth_backend_roletag_blacklist_test.go
index 68c49ef8..b13691a4 100644
--- a/vault/resource_aws_auth_backend_roletag_blacklist_test.go
+++ b/vault/resource_aws_auth_backend_roletag_blacklist_test.go
@@ -4,14 +4,15 @@
 package vault
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"strconv"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -20,9 +21,9 @@ import (
 func TestAccAWSAuthBackendRoleTagBlacklist_import(t *testing.T) {
 	backend := acctest.RandomWithPrefix("aws")
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAWSAuthBackendRoleTagBlacklistDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAWSAuthBackendRoleTagBlacklistDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAWSAuthBackendRoleTagBlacklistConfig_basic(backend),
@@ -40,9 +41,9 @@ func TestAccAWSAuthBackendRoleTagBlacklist_import(t *testing.T) {
 func TestAccAWSAuthBackendRoleTagBlacklist_basic(t *testing.T) {
 	backend := acctest.RandomWithPrefix("aws")
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAWSAuthBackendRoleTagBlacklistDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAWSAuthBackendRoleTagBlacklistDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAWSAuthBackendRoleTagBlacklistConfig_basic(backend),
@@ -55,9 +56,9 @@ func TestAccAWSAuthBackendRoleTagBlacklist_basic(t *testing.T) {
 func TestAccAWSAuthBackendRoleTagBlacklist_updated(t *testing.T) {
 	backend := acctest.RandomWithPrefix("aws")
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAWSAuthBackendRoleTagBlacklistDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAWSAuthBackendRoleTagBlacklistDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAWSAuthBackendRoleTagBlacklistConfig_basic(backend),
diff --git a/vault/resource_aws_auth_backend_sts_role_test.go b/vault/resource_aws_auth_backend_sts_role_test.go
index 80d24142..7ab708a1 100644
--- a/vault/resource_aws_auth_backend_sts_role_test.go
+++ b/vault/resource_aws_auth_backend_sts_role_test.go
@@ -4,14 +4,15 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"strconv"
 	"strings"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -31,8 +32,8 @@ func TestAccAWSAuthBackendSTSRole_withExternalID(t *testing.T) {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion117)
 		},
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAWSAuthBackendSTSRoleDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAWSAuthBackendSTSRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAWSAuthBackendSTSRoleConfig(backend, accountID, arn, externalID),
@@ -68,9 +69,9 @@ func TestAccAWSAuthBackendSTSRole_basic(t *testing.T) {
 	arn := acctest.RandomWithPrefix("arn:aws:iam::" + accountID + ":role/test-role")
 	updatedArn := acctest.RandomWithPrefix("arn:aws:iam::" + accountID + ":role/test-role")
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAWSAuthBackendSTSRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAWSAuthBackendSTSRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAWSAuthBackendSTSRoleConfig(backend, accountID, arn, ""),
diff --git a/vault/resource_aws_secret_backend_role_test.go b/vault/resource_aws_secret_backend_role_test.go
index 75a1bb4d..3664de93 100644
--- a/vault/resource_aws_secret_backend_role_test.go
+++ b/vault/resource_aws_secret_backend_role_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"strings"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -34,9 +35,9 @@ func TestAccAWSSecretBackendRole_basic(t *testing.T) {
 	name := acctest.RandomWithPrefix("tf-test-aws")
 	accessKey, secretKey := testutil.GetTestAWSCreds(t)
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccAWSSecretBackendRoleCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccAWSSecretBackendRoleCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAWSSecretBackendRoleConfigBasic(name, backend, accessKey, secretKey),
@@ -59,9 +60,9 @@ func TestAccAWSSecretBackendRole_import(t *testing.T) {
 	name := acctest.RandomWithPrefix("tf-test-aws")
 	accessKey, secretKey := testutil.GetTestAWSCreds(t)
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccAWSSecretBackendRoleCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccAWSSecretBackendRoleCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAWSSecretBackendRoleConfigBasic(name, backend, accessKey, secretKey),
@@ -101,9 +102,9 @@ func TestAccAWSSecretBackendRole_nested(t *testing.T) {
 	name := acctest.RandomWithPrefix("tf-test-aws")
 	accessKey, secretKey := testutil.GetTestAWSCreds(t)
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccAWSSecretBackendRoleCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccAWSSecretBackendRoleCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAWSSecretBackendRoleConfigBasic(name, backend, accessKey, secretKey),
diff --git a/vault/resource_aws_secret_backend_static_role_test.go b/vault/resource_aws_secret_backend_static_role_test.go
index c6cc0183..ddd506a6 100644
--- a/vault/resource_aws_secret_backend_static_role_test.go
+++ b/vault/resource_aws_secret_backend_static_role_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 )
@@ -25,7 +26,7 @@ func TestAccAWSSecretBackendStaticRole(t *testing.T) {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion114)
 		},
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config: testAWSStaticResourceConfig(mount, a, s, username),
@@ -51,7 +52,7 @@ func TestAccAWSSecretBackendStaticAssumeRole(t *testing.T) {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion119)
 		},
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config: testAWSStaticAssumeResourceConfig(mount, a, s, username),
diff --git a/vault/resource_aws_secret_backend_test.go b/vault/resource_aws_secret_backend_test.go
index 4a4f81c9..ed961e91 100644
--- a/vault/resource_aws_secret_backend_test.go
+++ b/vault/resource_aws_secret_backend_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"regexp"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -22,9 +23,9 @@ func TestAccAWSSecretBackend_basic(t *testing.T) {
 	resourceName := resourceType + ".test"
 	accessKey, secretKey := testutil.GetTestAWSCreds(t)
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeAWS, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeAWS, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAWSSecretBackendConfig_basic(path, accessKey, secretKey),
@@ -83,9 +84,9 @@ func TestAccAWSSecretBackend_fallback(t *testing.T) {
 	resourceName := resourceType + ".test"
 	accessKey, secretKey := testutil.GetTestAWSCreds(t)
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeAWS, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeAWS, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAWSSecretBackendConfig_fallback(path, accessKey, secretKey),
@@ -127,7 +128,7 @@ func TestAccAWSSecretBackend_wif(t *testing.T) {
 	resourceType := "vault_aws_secret_backend"
 	resourceName := resourceType + ".test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion116)
@@ -164,7 +165,7 @@ func TestAccAWSSecretBackend_automatedRotation(t *testing.T) {
 	resourceType := "vault_aws_secret_backend"
 	resourceName := resourceType + ".test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion119)
@@ -220,9 +221,9 @@ func TestAccAWSSecretBackend_usernameTempl(t *testing.T) {
 	templ := fmt.Sprintf(`{{ printf \"vault-%%s-%%s-%%s\" (printf \"%%s-%%s\" (.DisplayName) (.PolicyName) | truncate 42) (unix_time) (random 20) | truncate 64 }}`)
 	expectedTempl := fmt.Sprintf(`{{ printf "vault-%%s-%%s-%%s" (printf "%%s-%%s" (.DisplayName) (.PolicyName) | truncate 42) (unix_time) (random 20) | truncate 64 }}`)
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeAWS, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeAWS, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAWSSecretBackendConfig_userTemplate(path, accessKey, secretKey, templ),
@@ -242,8 +243,8 @@ func TestAccAWSSecretBackend_remount(t *testing.T) {
 	resourceName := "vault_aws_secret_backend.test"
 	accessKey, secretKey := testutil.GetTestAWSCreds(t)
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAWSSecretBackendConfig_basic(path, accessKey, secretKey),
diff --git a/vault/resource_azure_auth_backend_config_test.go b/vault/resource_azure_auth_backend_config_test.go
index 0e7cc8c9..75c68d8e 100644
--- a/vault/resource_azure_auth_backend_config_test.go
+++ b/vault/resource_azure_auth_backend_config_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"regexp"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -19,9 +20,9 @@ import (
 func TestAccAzureAuthBackendConfig_import(t *testing.T) {
 	backend := acctest.RandomWithPrefix("azure/foo/bar")
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckAzureAuthBackendConfigDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckAzureAuthBackendConfigDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAzureAuthBackendConfig_basic(backend),
@@ -40,9 +41,9 @@ func TestAccAzureAuthBackendConfig_import(t *testing.T) {
 func TestAccAzureAuthBackendConfig_basic(t *testing.T) {
 	backend := acctest.RandomWithPrefix("azure")
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccCheckAzureAuthBackendConfigDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccCheckAzureAuthBackendConfigDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAzureAuthBackendConfig_basic(backend),
@@ -63,7 +64,7 @@ func TestAccAzureAuthBackend_wif(t *testing.T) {
 	resourceType := "vault_azure_auth_backend_config"
 	resourceName := resourceType + ".config"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion117)
@@ -103,7 +104,7 @@ func TestAccAzureAuthBackendConfig_automatedRotation(t *testing.T) {
 	resourceName := resourceType + ".config"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion119)
diff --git a/vault/resource_azure_auth_backend_role_test.go b/vault/resource_azure_auth_backend_role_test.go
index 8467a8a0..9ee1571d 100644
--- a/vault/resource_azure_auth_backend_role_test.go
+++ b/vault/resource_azure_auth_backend_role_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"strings"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -22,9 +23,9 @@ func TestAzureAuthBackendRole_basic(t *testing.T) {
 
 	resourceName := "vault_azure_auth_backend_role.test"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAzureAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAzureAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAzureAuthBackendRoleConfig_basic(backend, name),
@@ -40,9 +41,9 @@ func TestAzureAuthBackendRole(t *testing.T) {
 
 	resourceName := "vault_azure_auth_backend_role.test"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAzureAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAzureAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAzureAuthBackendRoleConfig(backend, name),
diff --git a/vault/resource_azure_secret_backend_role_test.go b/vault/resource_azure_secret_backend_role_test.go
index f8093e97..dbdd2290 100644
--- a/vault/resource_azure_secret_backend_role_test.go
+++ b/vault/resource_azure_secret_backend_role_test.go
@@ -4,14 +4,15 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"os"
 	"strings"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -54,7 +55,7 @@ func TestAzureSecretBackendRole_AzureRoles(t *testing.T) {
 	}
 
 	isVaultVersion116 := provider.IsAPISupported(testProvider.Meta(), provider.VaultVersion116)
-	if !isVaultVersion116 {
+	if isVaultVersion116 {
 		azureRoleInitialCheckFuncs = append(azureRoleInitialCheckFuncs,
 			resource.TestCheckResourceAttr(resourceName+".test_azure_roles", "sign_in_audience", "AzureADMyOrg"),
 			resource.TestCheckResourceAttr(resourceName+".test_azure_roles", "tags.#", "1"),
@@ -66,8 +67,16 @@ func TestAzureSecretBackendRole_AzureRoles(t *testing.T) {
 			resource.TestCheckResourceAttr(resourceName+".test_azure_roles", "tags.1", "project:vault_testing"))
 	}
 
+	isVaultVersion118 := provider.IsAPISupported(testProvider.Meta(), provider.VaultVersion118)
+	if isVaultVersion118 {
+		azureRoleInitialCheckFuncs = append(azureRoleInitialCheckFuncs,
+			resource.TestCheckResourceAttr(resourceName+".test_azure_roles", "explicit_max_ttl", "0"))
+		azureRoleUpdatedCheckFuncs = append(azureRoleUpdatedCheckFuncs,
+			resource.TestCheckResourceAttr(resourceName+".test_azure_roles", "explicit_max_ttl", "2592000"))
+	}
+
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 		},
@@ -116,7 +125,7 @@ func TestAzureSecretBackendRole_AzureGroups(t *testing.T) {
 	path := acctest.RandomWithPrefix("tf-test-azure")
 	role := acctest.RandomWithPrefix("tf-test-azure-role")
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 		},
@@ -208,7 +217,8 @@ resource "vault_azure_secret_backend_role" "test_azure_roles" {
  role             = "%[6]s-azure-roles"
  ttl              = 300
  max_ttl          = 600
- description	   = "Test for Vault Provider"
+ explicit_max_ttl = 0
+ description	  = "Test for Vault Provider"
  sign_in_audience = "AzureADMyOrg"
  tags             = ["team:engineering"]
 
@@ -259,6 +269,7 @@ resource "vault_azure_secret_backend_role" "test_azure_roles" {
   role        	   = "%[6]s-azure-roles"
   ttl        	   = 600
   max_ttl    	   = 900
+  explicit_max_ttl = 2592000
   description 	   = "Test for Vault Provider"
   sign_in_audience = "AzureADMultipleOrgs"
   tags       	   = ["environment:development","project:vault_testing"]
@@ -306,11 +317,14 @@ resource "vault_azure_secret_backend" "azure" {
 }
 
 resource "vault_azure_secret_backend_role" "test_azure_roles" {
-  backend     = vault_azure_secret_backend.azure.path
-  role        = "%[6]s-azure-roles"
-  ttl         = 300
-  max_ttl     = 600
-  description = "Test for Vault Provider"
+  backend          = vault_azure_secret_backend.azure.path
+  role             = "%[6]s-azure-roles"
+  ttl              = 300
+  max_ttl          = 600
+  explicit_max_ttl = 0
+  description      = "Test for Vault Provider"
+  sign_in_audience = "AzureADMultipleOrgs"
+  tags       	   = ["environment:development","project:vault_testing"]
 
   azure_roles {
     role_name = "Reader"
diff --git a/vault/resource_azure_secret_backend_test.go b/vault/resource_azure_secret_backend_test.go
index 603b858b..8613ba50 100644
--- a/vault/resource_azure_secret_backend_test.go
+++ b/vault/resource_azure_secret_backend_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"regexp"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -26,7 +27,7 @@ func TestAzureSecretBackend(t *testing.T) {
 	resourceName := resourceType + ".test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 		},
@@ -40,7 +41,7 @@ func TestAzureSecretBackend(t *testing.T) {
 				Config: testAzureSecretBackend_updated(path),
 				Check:  getAzureBackendChecks(resourceName, path, true),
 			},
-			// Clear out previous test step that uses use_microsoft_graph_api
+			// Clear out previous test step
 			// allows for a cleaner import test
 			{
 				Config: testAzureSecretBackend_initialConfig(updatedPath),
@@ -80,26 +81,7 @@ func getAzureBackendChecks(resourceName, path string, isUpdate bool) resource.Te
 	}
 
 	return func(state *terraform.State) error {
-		var checks []resource.TestCheckFunc
-		meta := testProvider.Meta().(*provider.ProviderMeta)
-		var extras []resource.TestCheckFunc
-		// only check use_microsoft_graph_api if Vault version is
-		// < 1.12.0
-		if !meta.IsAPISupported(provider.VaultVersion112) {
-			if !isUpdate {
-				extras = []resource.TestCheckFunc{
-					resource.TestCheckResourceAttr(resourceName, consts.FieldUseMSGraphAPI, "false"),
-				}
-			} else {
-				extras = []resource.TestCheckFunc{
-					resource.TestCheckResourceAttr(resourceName, consts.FieldUseMSGraphAPI, "true"),
-				}
-			}
-			checks = append(baseChecks, extras...)
-		} else {
-			checks = baseChecks
-		}
-		return resource.ComposeAggregateTestCheckFunc(checks...)(state)
+		return resource.ComposeAggregateTestCheckFunc(baseChecks...)(state)
 	}
 }
 
@@ -112,7 +94,7 @@ func TestAccAzureSecretBackend_wif(t *testing.T) {
 	resourceType := "vault_azure_secret_backend"
 	resourceName := resourceType + ".test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion117)
@@ -173,7 +155,7 @@ func TestAzureSecretBackend_remount(t *testing.T) {
 	}
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 		},
@@ -199,7 +181,7 @@ func TestAccAzureSecretBackendConfig_automatedRotation(t *testing.T) {
 	resourceName := resourceType + ".test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion119)
@@ -282,7 +264,6 @@ resource "vault_azure_secret_backend" "test" {
   client_secret           = "098765432109876543214"
   environment             = "AzurePublicCloud"
   disable_remount         = true
-  use_microsoft_graph_api = true
 }`, path)
 }
 
diff --git a/vault/resource_cert_auth_backend_role_test.go b/vault/resource_cert_auth_backend_role_test.go
index 2d214ea7..f648fc9d 100644
--- a/vault/resource_cert_auth_backend_role_test.go
+++ b/vault/resource_cert_auth_backend_role_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"strings"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -84,9 +85,9 @@ func TestCertAuthBackend(t *testing.T) {
 
 	resourceName := "vault_cert_auth_backend_role.test"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testCertAuthBackendDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testCertAuthBackendDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testCertAuthBackendConfig_basic(backend, name, testCertificate, allowedNames, allowedOrgUnits),
@@ -130,8 +131,8 @@ func TestCertAuthBackend_OCSP(t *testing.T) {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion113)
 		},
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testCertAuthBackendDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testCertAuthBackendDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testCertAuthBackendConfig_OCSP_default(backend, name),
diff --git a/vault/resource_config_ui_custom_message_test.go b/vault/resource_config_ui_custom_message_test.go
index eb3823c6..cd03614a 100644
--- a/vault/resource_config_ui_custom_message_test.go
+++ b/vault/resource_config_ui_custom_message_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"encoding/base64"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -50,7 +51,7 @@ func TestAccConfigUICustomMessage(t *testing.T) {
 	resourceName := "vault_config_ui_custom_message.test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion116)
diff --git a/vault/resource_consul_secret_backend_role_test.go b/vault/resource_consul_secret_backend_role_test.go
index 475be4b2..1fb0b3e9 100644
--- a/vault/resource_consul_secret_backend_role_test.go
+++ b/vault/resource_consul_secret_backend_role_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"regexp"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -71,7 +72,7 @@ func TestConsulSecretBackendRole(t *testing.T) {
 		resource.TestCheckTypeSetElemAttr(resourceName, "node_identities.*", "client-0:dc1"))
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion111)
@@ -123,9 +124,9 @@ func TestConsulSecretBackendRole(t *testing.T) {
 		resource.TestCheckResourceAttr(resourceName, "consul_policies.#", "0"))
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccConsulSecretBackendRoleCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccConsulSecretBackendRoleCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testConsulSecretBackendRole_initialConfig(path, name, token, true, false),
@@ -179,7 +180,7 @@ func TestConsulSecretBackendRole_Legacy(t *testing.T) {
 		resource.TestCheckResourceAttr(resourceName, "policies.1", "far"))
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionGTE(t, testProvider.Meta(), provider.VaultVersion111)
@@ -229,9 +230,9 @@ func TestConsulSecretBackendRole_Legacy(t *testing.T) {
 		resource.TestCheckTypeSetElemAttr(resourceName, "consul_policies.*", "bar"))
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccConsulSecretBackendRoleCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccConsulSecretBackendRoleCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testConsulSecretBackendRole_initialConfig(path, name, token, false, true),
diff --git a/vault/resource_consul_secret_backend_test.go b/vault/resource_consul_secret_backend_test.go
index d871de0a..8a402bd4 100644
--- a/vault/resource_consul_secret_backend_test.go
+++ b/vault/resource_consul_secret_backend_test.go
@@ -4,14 +4,15 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"regexp"
 	"strings"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/vault/api"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
@@ -32,9 +33,9 @@ func TestConsulSecretBackend(t *testing.T) {
 	token := "026a0c16-87cd-4c2d-b3f3-fb539f592b7e"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeConsul, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeConsul, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testConsulSecretBackend_initialConfig(path, token),
@@ -144,7 +145,7 @@ func TestConsulSecretBackend_Bootstrap(t *testing.T) {
 	consulAddr := consulConfig.Address()
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion111)
@@ -212,9 +213,9 @@ func TestConsulSecretBackend_remount(t *testing.T) {
 	store := &testMountStore{}
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeConsul, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeConsul, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testConsulSecretBackend_initialConfig(path, token),
diff --git a/vault/resource_database_secret_backend_connection_test.go b/vault/resource_database_secret_backend_connection_test.go
index 272922ad..eb451a85 100644
--- a/vault/resource_database_secret_backend_connection_test.go
+++ b/vault/resource_database_secret_backend_connection_test.go
@@ -4,10 +4,12 @@
 package vault
 
 import (
+	"context"
 	"database/sql"
 	"encoding/base64"
 	"errors"
 	"fmt"
+	"github.com/hashicorp/terraform-plugin-testing/plancheck"
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"io/ioutil"
 	"log"
@@ -20,10 +22,10 @@ import (
 	"testing"
 
 	_ "github.com/denisenkom/go-mssqldb"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/sdk/database/helper/dbutil"
 
@@ -50,9 +52,9 @@ func TestAccDatabaseSecretBackendConnection_postgresql_import(t *testing.T) {
 
 	userTempl := "{{.DisplayName}}"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccDatabaseSecretBackendConnectionCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccDatabaseSecretBackendConnectionCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDatabaseSecretBackendConnectionConfig_import(name, backend, connURL, userTempl),
@@ -93,9 +95,9 @@ func TestAccDatabaseSecretBackendConnection_cassandra(t *testing.T) {
 	pluginName := dbEngineCassandra.DefaultPluginName()
 	name := acctest.RandomWithPrefix("db")
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccDatabaseSecretBackendConnectionCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccDatabaseSecretBackendConnectionCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDatabaseSecretBackendConnectionConfig_cassandra(name, backend, host, username, password, "5"),
@@ -137,9 +139,9 @@ func TestAccDatabaseSecretBackendConnection_cassandraProtocol(t *testing.T) {
 	pluginName := dbEngineCassandra.DefaultPluginName()
 	name := acctest.RandomWithPrefix("db")
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccDatabaseSecretBackendConnectionCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccDatabaseSecretBackendConnectionCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDatabaseSecretBackendConnectionConfig_cassandraProtocol(name, backend, host, username, password),
@@ -219,9 +221,9 @@ func TestAccDatabaseSecretBackendConnection_couchbase(t *testing.T) {
 	}
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccDatabaseSecretBackendConnectionCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccDatabaseSecretBackendConnectionCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDatabaseSecretBackendConnectionConfig_couchbase(
@@ -280,9 +282,9 @@ func TestAccDatabaseSecretBackendConnection_influxdb(t *testing.T) {
 	name := acctest.RandomWithPrefix("db")
 	resourceName := testDefaultDatabaseSecretBackendResource
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccDatabaseSecretBackendConnectionCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccDatabaseSecretBackendConnectionCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDatabaseSecretBackendConnectionConfig_influxdb(name, backend, host, port, username, password),
@@ -323,9 +325,9 @@ func TestAccDatabaseSecretBackendConnection_mongodbatlas(t *testing.T) {
 	pluginName := dbEngineMongoDBAtlas.DefaultPluginName()
 	name := acctest.RandomWithPrefix("db")
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccDatabaseSecretBackendConnectionCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccDatabaseSecretBackendConnectionCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDatabaseSecretBackendConnectionConfig_mongodbatlas(name, backend, publicKey, privateKey, projectID),
@@ -356,9 +358,9 @@ func TestAccDatabaseSecretBackendConnection_mongodb(t *testing.T) {
 	pluginName := dbEngineMongoDB.DefaultPluginName()
 	name := acctest.RandomWithPrefix("db")
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccDatabaseSecretBackendConnectionCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccDatabaseSecretBackendConnectionCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDatabaseSecretBackendConnectionConfig_mongodb(name, backend, connURL),
@@ -393,9 +395,9 @@ func TestAccDatabaseSecretBackendConnection_mssql(t *testing.T) {
 
 	username := parsedURL.User.Username()
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccDatabaseSecretBackendConnectionCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccDatabaseSecretBackendConnectionCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDatabaseSecretBackendConnectionConfig_mssql(name, backend, pluginName, parsedURL, false),
@@ -452,7 +454,7 @@ func TestAccDatabaseSecretBackendConnection_mysql_cloud(t *testing.T) {
 	backend := acctest.RandomWithPrefix("tf-test-db")
 	name := acctest.RandomWithPrefix("db")
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion115)
@@ -496,9 +498,9 @@ func TestAccDatabaseSecretBackendConnection_mysql(t *testing.T) {
 	backend := acctest.RandomWithPrefix("tf-test-db")
 	name := acctest.RandomWithPrefix("db")
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccDatabaseSecretBackendConnectionCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccDatabaseSecretBackendConnectionCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDatabaseSecretBackendConnectionConfig_mysql(name, backend, connURL, username, password),
@@ -591,9 +593,9 @@ func TestAccDatabaseSecretBackendConnectionUpdate_mysql(t *testing.T) {
 	pluginName := dbEngineMySQL.DefaultPluginName()
 	name := acctest.RandomWithPrefix("db")
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccDatabaseSecretBackendConnectionCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccDatabaseSecretBackendConnectionCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDatabaseSecretBackendConnectionConfigUpdate_mysql(name, backend, connURL, username, password, 0),
@@ -662,9 +664,9 @@ func TestAccDatabaseSecretBackendConnectionTemplatedUpdateExcludePassword_mysql(
 	})
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccDatabaseSecretBackendConnectionCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccDatabaseSecretBackendConnectionCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDatabaseSecretBackendConnectionConfigTemplated_mysql(name, backend, testConnURL, username, password, 0),
@@ -732,9 +734,9 @@ func TestAccDatabaseSecretBackendConnection_mysql_tls(t *testing.T) {
 	name := acctest.RandomWithPrefix("db")
 	password := acctest.RandomWithPrefix("password")
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccDatabaseSecretBackendConnectionCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccDatabaseSecretBackendConnectionCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDatabaseSecretBackendConnectionConfig_mysql_tls(name, backend, connURL, password, tlsCA, tlsCertificateKey),
@@ -799,9 +801,9 @@ func TestAccDatabaseSecretBackendConnection_postgresql(t *testing.T) {
 	name := acctest.RandomWithPrefix("db")
 	userTempl := "{{.DisplayName}}"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccDatabaseSecretBackendConnectionCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccDatabaseSecretBackendConnectionCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDatabaseSecretBackendConnectionConfig_postgresql(name, backend, userTempl, username, password, maxOpenConnections, maxIdleConnections, maxConnLifetime, parsedURL),
@@ -852,7 +854,7 @@ func TestAccDatabaseSecretBackendConnection_postgresql_tls(t *testing.T) {
 	name := acctest.RandomWithPrefix("db")
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion118)
@@ -880,7 +882,7 @@ func TestAccDatabaseSecretBackendConnection_postgresql_rootlessConfig(t *testing
 	name := acctest.RandomWithPrefix("db")
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion118)
@@ -906,7 +908,7 @@ func TestAccDatabaseSecretBackendConnection_postgresql_cloud(t *testing.T) {
 	backend := acctest.RandomWithPrefix("tf-test-db")
 	name := acctest.RandomWithPrefix("db")
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion115)
@@ -949,7 +951,7 @@ func TestAccDatabaseSecretBackendConnection_postgresql_automatedRootRotation(t *
 	resourceName := "vault_database_secret_backend_connection.test"
 	name := acctest.RandomWithPrefix("db")
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion119)
@@ -997,6 +999,63 @@ func TestAccDatabaseSecretBackendConnection_postgresql_automatedRootRotation(t *
 	})
 }
 
+// TestAccDatabaseSecretBackendConnection_postgresql_writeOnly ensures
+// write-only attribute `password_wo` works as expected
+//
+// The test creates users in a Postgres DB
+// To run locally you will need to set the following env vars:
+//   - POSTGRES_URL_TEST
+//   - POSTGRES_URL_ROOTLESS
+//
+// See .github/workflows/build.yml for details.
+func TestAccDatabaseSecretBackendConnection_postgresql_password_wo(t *testing.T) {
+	MaybeSkipDBTests(t, dbEnginePostgres)
+
+	connURLTestRoot := testutil.SkipTestEnvUnset(t, "POSTGRES_URL_TEST")[0]
+	connURLTemplated := testutil.SkipTestEnvUnset(t, "POSTGRES_URL_ROOTLESS")[0]
+	username1 := acctest.RandomWithPrefix("user1")
+	username2 := acctest.RandomWithPrefix("user2")
+	dbName := acctest.RandomWithPrefix("db")
+	// create database users
+	testutil.CreateTestPGUser(t, connURLTestRoot, username1, "testpassword", testRoleStaticCreate)
+	testutil.CreateTestPGUser(t, connURLTestRoot, username2, "testpassword1", testRoleStaticCreate)
+	mount := acctest.RandomWithPrefix("tf-test-db")
+	pluginName := dbEnginePostgres.DefaultPluginName()
+	resource.Test(t, resource.TestCase{
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccDatabaseSecretBackendConnectionCheckDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDatabaseSecretBackendConnectionConfig_postgresql_writeOnly(dbName, mount, connURLTemplated, username1, "testpassword", 1),
+				Check: testComposeCheckFuncCommonDatabaseSecretBackend(dbName, mount, pluginName,
+					resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "allowed_roles.#", "1"),
+					resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "allowed_roles.0", "*"),
+					resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "postgresql.0.connection_url", connURLTemplated),
+					resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "postgresql.0.username", username1),
+					resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "postgresql.0.password_wo_version", "1"),
+				),
+			},
+			{
+				Config: testAccDatabaseSecretBackendConnectionConfig_postgresql_writeOnly(dbName, mount, connURLTemplated, username2, "testpassword1", 2),
+				ConfigPlanChecks: resource.ConfigPlanChecks{
+					PreApply: []plancheck.PlanCheck{
+						plancheck.ExpectResourceAction(testDefaultDatabaseSecretBackendResource, plancheck.ResourceActionUpdate),
+					},
+				},
+				// successful connection to new username guarantees that password_wo was also updated
+				Check: testComposeCheckFuncCommonDatabaseSecretBackend(dbName, mount, pluginName,
+					resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "allowed_roles.#", "1"),
+					resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "allowed_roles.0", "*"),
+					resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "postgresql.0.connection_url", connURLTemplated),
+					resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "postgresql.0.username", username2),
+					resource.TestCheckResourceAttr(testDefaultDatabaseSecretBackendResource, "postgresql.0.password_wo_version", "2"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccDatabaseSecretBackendConnection_elasticsearch(t *testing.T) {
 	MaybeSkipDBTests(t, dbEngineElasticSearch)
 
@@ -1011,9 +1070,9 @@ func TestAccDatabaseSecretBackendConnection_elasticsearch(t *testing.T) {
 	name := acctest.RandomWithPrefix("db")
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccDatabaseSecretBackendConnectionCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccDatabaseSecretBackendConnectionCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDatabaseSecretBackendConnectionConfig_elasticsearch(name, backend, connURL, username, password),
@@ -1092,9 +1151,9 @@ func TestAccDatabaseSecretBackendConnection_snowflake(t *testing.T) {
 
 	config := testAccDatabaseSecretBackendConnectionConfig_snowflake(name, backend, connURL, username, password, userTempl)
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccDatabaseSecretBackendConnectionCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccDatabaseSecretBackendConnectionCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: config,
@@ -1127,9 +1186,9 @@ func TestAccDatabaseSecretBackendConnection_redis(t *testing.T) {
 	name := acctest.RandomWithPrefix("db")
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccDatabaseSecretBackendConnectionCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccDatabaseSecretBackendConnectionCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDatabaseSecretBackendConnectionConfig_redis(name, backend, host, port, username, password, "*"),
@@ -1186,9 +1245,9 @@ func TestAccDatabaseSecretBackendConnection_redisElastiCache(t *testing.T) {
 	pluginName := dbEngineRedisElastiCache.DefaultPluginName()
 	name := acctest.RandomWithPrefix("db")
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccDatabaseSecretBackendConnectionCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccDatabaseSecretBackendConnectionCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDatabaseSecretBackendConnectionConfig_redis_elasticache(name, backend, url),
@@ -1220,9 +1279,9 @@ func TestAccDatabaseSecretBackendConnection_redshift(t *testing.T) {
 	pluginName := dbEngineRedshift.DefaultPluginName()
 	name := acctest.RandomWithPrefix("db")
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccDatabaseSecretBackendConnectionCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccDatabaseSecretBackendConnectionCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDatabaseSecretBackendConnectionConfig_redshift(name, backend, url, false),
@@ -1262,6 +1321,60 @@ func TestAccDatabaseSecretBackendConnection_redshift(t *testing.T) {
 	})
 }
 
+func TestDatabaseEngineNameAndIndexFromPrefix(t *testing.T) {
+
+	testcases := []struct {
+		name         string
+		prefix       string
+		expectedName string
+		expectedIdx  string
+		wantErr      bool
+		expectedErr  string
+	}{
+		{
+			name:         "simple",
+			prefix:       "postgresql.0.",
+			wantErr:      false,
+			expectedName: "postgresql",
+			expectedIdx:  "0",
+		},
+		{
+			name:         "complex",
+			prefix:       "custom_mssql_db_us-west-2_v2.1.5.",
+			wantErr:      false,
+			expectedName: "custom_mssql_db_us-west-2_v2.1",
+			expectedIdx:  "5",
+		},
+		{
+			name:        "invalid",
+			prefix:      "invalid-prefix",
+			wantErr:     true,
+			expectedErr: "no matches found",
+		},
+	}
+
+	for _, tc := range testcases {
+		t.Run(tc.name, func(t *testing.T) {
+			name, idx, err := databaseEngineNameAndIndexFromPrefix(tc.prefix)
+			if tc.wantErr && (err == nil) {
+				t.Fatalf("wanted error %v, got nil", tc.wantErr)
+			}
+
+			if tc.wantErr && (err.Error() != tc.expectedErr) {
+				t.Fatalf("got error %v, wantErr %v", err, tc.wantErr)
+			}
+
+			if name != tc.expectedName {
+				t.Fatalf("got %s, want %s", name, tc.expectedName)
+			}
+
+			if idx != tc.expectedIdx {
+				t.Fatalf("got %s, want %s", idx, tc.expectedIdx)
+			}
+		})
+	}
+}
+
 func TestAccDatabaseSecretBackendConnection_invalid_plugin(t *testing.T) {
 	name := acctest.RandomWithPrefix("tf-test-db")
 	pluginName := name + "-plugin"
@@ -1280,8 +1393,8 @@ resource "vault_database_secret_backend_connection" "test" {
   }
 }`, name, name, pluginName)
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: config,
@@ -1949,6 +2062,28 @@ resource "vault_database_secret_backend_connection" "test" {
 `, path, name, period, schedule, window, disable, connURL)
 }
 
+func testAccDatabaseSecretBackendConnectionConfig_postgresql_writeOnly(name, path, connUrl, username, password string, version int) string {
+	return fmt.Sprintf(`
+resource "vault_mount" "db" {
+  path = "%s"
+  type = "database"
+}
+
+resource "vault_database_secret_backend_connection" "test" {
+  backend = vault_mount.db.path
+  name = "%s"
+  allowed_roles = ["*"]
+
+  postgresql {
+      connection_url          = "%s"
+      username                = "%s"
+      password_wo             = "%s"
+      password_wo_version     = %d
+  }
+}
+`, path, name, connUrl, username, password, version)
+}
+
 func testAccDatabaseSecretBackendConnectionConfig_snowflake(name, path, url, username, password, userTempl string) string {
 	return fmt.Sprintf(`
 resource "vault_mount" "db" {
diff --git a/vault/resource_database_secret_backend_role_test.go b/vault/resource_database_secret_backend_role_test.go
index 36675985..fa12c19a 100644
--- a/vault/resource_database_secret_backend_role_test.go
+++ b/vault/resource_database_secret_backend_role_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"os"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -26,9 +27,9 @@ func TestAccDatabaseSecretBackendRole_basic(t *testing.T) {
 	dbName := acctest.RandomWithPrefix("db")
 	resourceName := "vault_database_secret_backend_role.test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccDatabaseSecretBackendRoleCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccDatabaseSecretBackendRoleCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDatabaseSecretBackendRoleConfig_basic(name, dbName, backend, connURL),
@@ -85,9 +86,9 @@ func TestAccDatabaseSecretBackendRole_ClientCertificate(t *testing.T) {
 	resourceName := "vault_database_secret_backend_role.test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccDatabaseSecretBackendRoleCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccDatabaseSecretBackendRoleCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDatabaseSecretBackendRoleConfig_ClientCertificate(name, dbName, backend, privateKey, publicKey, projectID,
diff --git a/vault/resource_database_secret_backend_static_role_test.go b/vault/resource_database_secret_backend_static_role_test.go
index 5b54b95e..1acd6e09 100644
--- a/vault/resource_database_secret_backend_static_role_test.go
+++ b/vault/resource_database_secret_backend_static_role_test.go
@@ -14,9 +14,9 @@ import (
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 
 	_ "github.com/go-sql-driver/mysql"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -36,9 +36,9 @@ func TestAccDatabaseSecretBackendStaticRole_import(t *testing.T) {
 	}
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccDatabaseSecretBackendStaticRoleCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccDatabaseSecretBackendStaticRoleCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDatabaseSecretBackendStaticRoleConfig_rotationPeriod(name, username, dbName, backend, connURL),
@@ -73,9 +73,9 @@ func TestAccDatabaseSecretBackendStaticRole_credentialType(t *testing.T) {
 	}
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccDatabaseSecretBackendStaticRoleCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccDatabaseSecretBackendStaticRoleCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDatabaseSecretBackendStaticRoleConfig_credentialType(name, username, dbName, backend, connURL),
@@ -105,9 +105,9 @@ func TestAccDatabaseSecretBackendStaticRole_credentialConfig(t *testing.T) {
 	}
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccDatabaseSecretBackendStaticRoleCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccDatabaseSecretBackendStaticRoleCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDatabaseSecretBackendStaticRoleConfig_credentialConfig(name, username, dbName, backend, connURL),
@@ -147,9 +147,9 @@ func TestAccDatabaseSecretBackendStaticRole_rotationPeriod(t *testing.T) {
 	}
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccDatabaseSecretBackendStaticRoleCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccDatabaseSecretBackendStaticRoleCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDatabaseSecretBackendStaticRoleConfig_rotationPeriod(name, username, dbName, backend, connURL),
@@ -192,7 +192,7 @@ func TestAccDatabaseSecretBackendStaticRole_rotationSchedule(t *testing.T) {
 	}
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion115)
@@ -248,7 +248,7 @@ func TestAccDatabaseSecretBackendStaticRole_Rootless(t *testing.T) {
 	testutil.CreateTestPGUser(t, connURLTestRoot, username, "testpassword", testRoleStaticCreate)
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion118)
@@ -304,7 +304,7 @@ func TestAccDatabaseSecretBackendStaticRole_SkipImportRotation(t *testing.T) {
 	testutil.CreateTestPGUser(t, connURLTestRoot, staticUsername, "testpassword", testRoleStaticCreate)
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion118)
diff --git a/vault/resource_database_secrets_mount_test.go b/vault/resource_database_secrets_mount_test.go
index 569422ab..159228e4 100644
--- a/vault/resource_database_secrets_mount_test.go
+++ b/vault/resource_database_secrets_mount_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"net/url"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -44,9 +45,9 @@ func TestAccDatabaseSecretsMount_mssql(t *testing.T) {
 
 	username := parsedURL.User.Username()
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeDatabase, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeDatabase, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDatabaseSecretsMount_mssql(name, backend, pluginName, parsedURL),
@@ -146,9 +147,9 @@ func TestAccDatabaseSecretsMount_mssql_multi(t *testing.T) {
 	resourceName := resourceType + ".db"
 	username := parsedURL.User.Username()
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeDatabase, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeDatabase, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccDatabaseSecretsMount_mssql_dual(name, name2, backend, pluginName, parsedURL, parsedURL2),
@@ -245,7 +246,7 @@ func TestAccDatabaseSecretsMount_postgresql_automatedRootRotation(t *testing.T)
 	resourceName := "vault_database_secrets_mount.test"
 	name := acctest.RandomWithPrefix("db")
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion119)
diff --git a/vault/resource_egp_policy_test.go b/vault/resource_egp_policy_test.go
index 35f81ba8..e147f068 100644
--- a/vault/resource_egp_policy_test.go
+++ b/vault/resource_egp_policy_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -18,9 +19,9 @@ import (
 func TestAccEndpointGoverningPolicy(t *testing.T) {
 	policyName := acctest.RandomWithPrefix("test-policy")
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestEntPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccEndpointGoverningPolicyCheckDestroy,
+		PreCheck:                 func() { testutil.TestEntPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccEndpointGoverningPolicyCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccEndpointGoverningPolicy(policyName, "test/*", "soft-mandatory"),
diff --git a/vault/resource_gcp_auth_backend_role_test.go b/vault/resource_gcp_auth_backend_role_test.go
index 7e78c91a..fe97c3a4 100644
--- a/vault/resource_gcp_auth_backend_role_test.go
+++ b/vault/resource_gcp_auth_backend_role_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"strings"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/vault/api"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -78,9 +79,9 @@ func testGCPAuthBackendRole_basic(t *testing.T, backend string) {
 
 	resourceName := "vault_gcp_auth_backend_role.test"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testGCPAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testGCPAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testGCPAuthBackendRoleConfig_basic(backend, name, serviceAccount, projectId),
@@ -116,9 +117,9 @@ func TestGCPAuthBackendRole_gce(t *testing.T) {
 
 	resourceName := "vault_gcp_auth_backend_role.test"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testGCPAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testGCPAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testGCPAuthBackendRoleConfig_gce(backend, name, projectId),
diff --git a/vault/resource_gcp_auth_backend_test.go b/vault/resource_gcp_auth_backend_test.go
index 1fb32629..df66b06a 100644
--- a/vault/resource_gcp_auth_backend_test.go
+++ b/vault/resource_gcp_auth_backend_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"regexp"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/vault/api"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
@@ -44,9 +45,9 @@ func TestGCPAuthBackend_basic(t *testing.T) {
 	updatedDescription := "GCP Auth Mount updated"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testGCPAuthBackendDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testGCPAuthBackendDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testGCPAuthBackendConfig_basic(path, gcpJSONCredentials, description),
@@ -165,8 +166,8 @@ func TestGCPAuthBackend_WIF(t *testing.T) {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion117)
 		},
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testGCPAuthBackendDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testGCPAuthBackendDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testGCPAuthBackend_WIFConfig_basic(path),
@@ -203,9 +204,9 @@ func TestGCPAuthBackend_import(t *testing.T) {
 	description := "GCP Auth Mount"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testGCPAuthBackendDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testGCPAuthBackendDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testGCPAuthBackendConfig_basic(path, gcpJSONCredentials, description),
@@ -232,8 +233,8 @@ func TestGCPAuthBackend_remount(t *testing.T) {
 	description := "GCP Auth Mount"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testGCPAuthBackendConfig_basic(path, gcpJSONCredentials, description),
@@ -300,7 +301,7 @@ func TestAccGCPAuthBackendClient_automatedRotation(t *testing.T) {
 	resourceType := "vault_gcp_auth_backend"
 	resourceName := resourceType + ".test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion119)
diff --git a/vault/resource_gcp_secret_backend_test.go b/vault/resource_gcp_secret_backend_test.go
index 394844b0..a5042d45 100644
--- a/vault/resource_gcp_secret_backend_test.go
+++ b/vault/resource_gcp_secret_backend_test.go
@@ -4,12 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
+	"github.com/hashicorp/terraform-plugin-testing/plancheck"
 	"regexp"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -23,9 +25,9 @@ func TestGCPSecretBackend(t *testing.T) {
 	resourceName := resourceType + ".test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeGCP, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeGCP, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testGCPSecretBackend_initialConfig(path),
@@ -78,9 +80,9 @@ func TestGCPSecretBackend_remount(t *testing.T) {
 	resourceName := resourceType + ".test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeGCP, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeGCP, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testGCPSecretBackend_initialConfig(path),
@@ -117,7 +119,7 @@ func TestAccGCPSecretBackend_automatedRotation(t *testing.T) {
 	resourceType := "vault_gcp_secret_backend"
 	resourceName := resourceType + ".test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion119)
@@ -165,6 +167,52 @@ func TestAccGCPSecretBackend_automatedRotation(t *testing.T) {
 	})
 }
 
+// TestAccKVSecretV2_data_json_wo ensures write-only attribute
+// `credentials_wo` works as expected
+//
+// Since we cannot read the credentials value back from Vault
+// there is no way of actually confirming that it is updated.
+// Hence, we ensure that the `credentials_wo_version` parameter
+// gets updated appropriately.
+func TestGCPSecretBackend_credentials_wo(t *testing.T) {
+	path := acctest.RandomWithPrefix("tf-test-gcp")
+
+	resourceType := "vault_gcp_secret_backend"
+	resourceName := resourceType + ".test"
+
+	resource.Test(t, resource.TestCase{
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeGCP, consts.FieldPath),
+		Steps: []resource.TestStep{
+			{
+				Config: testGCPSecretBackend_credentialsWO(path, "test", 1),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "path", path),
+					resource.TestCheckResourceAttr(resourceName, "credentials_wo_version", "1"),
+				),
+			},
+			{
+				Config: testGCPSecretBackend_credentialsWO(path, "test-updated", 2),
+				ConfigPlanChecks: resource.ConfigPlanChecks{
+					PreApply: []plancheck.PlanCheck{
+						plancheck.ExpectResourceAction(resourceName, plancheck.ResourceActionUpdate),
+					},
+				},
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "path", path),
+					resource.TestCheckResourceAttr(resourceName, "credentials_wo_version", "2"),
+				),
+			},
+			testutil.GetImportTestStep(resourceName, false, nil,
+				consts.FieldDisableRemount,
+				consts.FieldCredentialsWO,
+				consts.FieldCredentialsWOVersion,
+			),
+		},
+	})
+}
+
 func testGCPSecretBackend_initialConfig(path string) string {
 	return fmt.Sprintf(`
 resource "vault_gcp_secret_backend" "test" {
@@ -215,3 +263,16 @@ resource "vault_gcp_secret_backend" "test" {
   disable_automated_rotation = %t
 }`, path, period, schedule, window, disable)
 }
+
+func testGCPSecretBackend_credentialsWO(path, value string, version int) string {
+	return fmt.Sprintf(`
+resource "vault_gcp_secret_backend" "test" {
+  path = "%s"
+  credentials_wo = <<EOF
+{
+  "hello": "%s"
+}
+EOF
+  credentials_wo_version = %d
+}`, path, value, version)
+}
diff --git a/vault/resource_gcp_secret_impersonated_account_test.go b/vault/resource_gcp_secret_impersonated_account_test.go
index 0aff24bd..226c17d9 100644
--- a/vault/resource_gcp_secret_impersonated_account_test.go
+++ b/vault/resource_gcp_secret_impersonated_account_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"golang.org/x/oauth2/google"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
@@ -34,7 +35,7 @@ func TestGCPSecretImpersonatedAccount(t *testing.T) {
 
 	resourceName := "vault_gcp_secret_impersonated_account.test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion113)
diff --git a/vault/resource_gcp_secret_roleset_test.go b/vault/resource_gcp_secret_roleset_test.go
index 9b18e03f..28394bfe 100644
--- a/vault/resource_gcp_secret_roleset_test.go
+++ b/vault/resource_gcp_secret_roleset_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/vault/api"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
@@ -33,9 +34,9 @@ func TestGCPSecretRoleset(t *testing.T) {
 	resourceNameBackend := "vault_gcp_secret_backend.test"
 	resourceName := "vault_gcp_secret_roleset.test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testGCPSecretRolesetDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testGCPSecretRolesetDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testGCPSecretRolesetConfig(backend, roleset, credentials, project, initialRole),
diff --git a/vault/resource_gcp_secret_static_account_test.go b/vault/resource_gcp_secret_static_account_test.go
index c7c3699a..7607e6f5 100644
--- a/vault/resource_gcp_secret_static_account_test.go
+++ b/vault/resource_gcp_secret_static_account_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"golang.org/x/oauth2/google"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
@@ -47,9 +48,9 @@ func TestGCPSecretStaticAccount(t *testing.T) {
 	resourceNameBackend := "vault_gcp_secret_backend.test"
 	resourceName := "vault_gcp_secret_static_account.test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testGCPSecretStaticAccountDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testGCPSecretStaticAccountDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: noBindings,
diff --git a/vault/resource_generic_endpoint_test.go b/vault/resource_generic_endpoint_test.go
index 3ba56825..eeae09ab 100644
--- a/vault/resource_generic_endpoint_test.go
+++ b/vault/resource_generic_endpoint_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/vault/api"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
@@ -27,9 +28,9 @@ func TestResourceGenericEndpoint(t *testing.T) {
 		"vault_generic_endpoint.u1_entity",
 	}
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testResourceGenericEndpoint_destroyCheck(resourceNames, path),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testResourceGenericEndpoint_destroyCheck(resourceNames, path),
 		Steps: []resource.TestStep{
 			{
 				Config: testResourceGenericEndpoint_initialConfig(path),
diff --git a/vault/resource_generic_secret_test.go b/vault/resource_generic_secret_test.go
index a7cf4454..ef76cec7 100644
--- a/vault/resource_generic_secret_test.go
+++ b/vault/resource_generic_secret_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"os"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/vault/api"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
@@ -24,8 +25,8 @@ func TestResourceGenericSecret(t *testing.T) {
 	path := fmt.Sprintf("%s/%s", mount, name)
 	resourceName := "vault_generic_secret.test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testResourceGenericSecret_initialConfig(mount, name),
@@ -51,8 +52,8 @@ func TestResourceGenericSecretNS(t *testing.T) {
 	resourceName := "vault_generic_secret.test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestEntPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestEntPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testResourceGenericSecret_initialConfigNS(ns, mount, name),
@@ -100,8 +101,8 @@ func TestResourceGenericSecret_deleted(t *testing.T) {
 	name := acctest.RandomWithPrefix("test")
 	path := fmt.Sprintf("%s/%s", mount, name)
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testResourceGenericSecret_initialConfig(mount, name),
@@ -136,9 +137,9 @@ func TestResourceGenericSecret_deleteAllVersions(t *testing.T) {
 	resourceName := "vault_generic_secret.test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAllVersionDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAllVersionDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testResourceGenericSecret_initialConfig_v2(path, false),
diff --git a/vault/resource_github_auth_backend_test.go b/vault/resource_github_auth_backend_test.go
index 0ba01b30..adee759f 100644
--- a/vault/resource_github_auth_backend_test.go
+++ b/vault/resource_github_auth_backend_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"strconv"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/vault/api"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
@@ -33,9 +34,9 @@ func TestAccGithubAuthBackend_basic(t *testing.T) {
 	var resAuth api.AuthMount
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeGitHub, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeGitHub, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccGithubAuthBackendConfig_basic(path, testGHOrg),
@@ -84,9 +85,9 @@ func TestAccGithubAuthBackend_ns(t *testing.T) {
 	var resAuth api.AuthMount
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestEntPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeGitHub, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestEntPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeGitHub, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccGithubAuthBackendConfig_ns(ns, path, testGHOrg),
@@ -137,9 +138,9 @@ func TestAccGithubAuthBackend_tuning(t *testing.T) {
 	var resAuth api.AuthMount
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeGitHub, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeGitHub, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccGithubAuthBackendConfig_tuning(backend),
@@ -210,9 +211,9 @@ func TestAccGithubAuthBackend_description(t *testing.T) {
 	resourceName := resourceType + ".test"
 	var resAuth api.AuthMount
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeGitHub, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeGitHub, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccGithubAuthBackendConfig_description(path, testGHOrg, "Github Auth Mount"),
@@ -250,9 +251,9 @@ func TestAccGithubAuthBackend_importTuning(t *testing.T) {
 	resourceName := resourceType + ".test"
 	var resAuth api.AuthMount
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeGitHub, consts.FieldPath),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeGitHub, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccGithubAuthBackendConfig_tuning(path),
@@ -278,9 +279,9 @@ func TestGithubAuthBackend_remount(t *testing.T) {
 	var resAuth api.AuthMount
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeGitHub, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeGitHub, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccGithubAuthBackendConfig_basic(path, testGHOrg),
diff --git a/vault/resource_github_team_test.go b/vault/resource_github_team_test.go
index 1eae2b42..506364dc 100644
--- a/vault/resource_github_team_test.go
+++ b/vault/resource_github_team_test.go
@@ -4,15 +4,16 @@
 package vault
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"log"
 	"regexp"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -23,9 +24,9 @@ func TestAccGithubTeam_basic(t *testing.T) {
 	resName := "vault_github_team.team"
 	team := "my-team-slugified"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccGithubTeamCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccGithubTeamCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccGithubTeamConfig_basic(backend, team, []string{"admin", "security"}),
@@ -55,9 +56,9 @@ func TestAccGithubTeam_teamConfigError(t *testing.T) {
 	backend := acctest.RandomWithPrefix("github")
 	team := "Team With Spaces"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccGithubTeamCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccGithubTeamCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccGithubTeamConfig_basic(backend, team, []string{}),
@@ -72,8 +73,8 @@ func TestAccGithubTeam_importBasic(t *testing.T) {
 	resName := "vault_github_team.team"
 	team := "import-team"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccGithubTeamConfig_basic(backend, team, []string{"admin", "developer"}),
diff --git a/vault/resource_github_user_test.go b/vault/resource_github_user_test.go
index 74f07e97..7b366c23 100644
--- a/vault/resource_github_user_test.go
+++ b/vault/resource_github_user_test.go
@@ -4,14 +4,15 @@
 package vault
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"log"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -22,9 +23,9 @@ func TestAccGithubUser_basic(t *testing.T) {
 	resName := "vault_github_user.user"
 	user := "john_doe"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccGithubUserCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccGithubUserCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccGithubUserConfig_basic(backend, user, []string{"admin", "security"}),
@@ -55,8 +56,8 @@ func TestAccGithubUser_importBasic(t *testing.T) {
 	resName := "vault_github_user.user"
 	user := "import"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccGithubUserConfig_basic(backend, user, []string{"security", "admin"}),
diff --git a/vault/resource_identity_entity_alias_test.go b/vault/resource_identity_entity_alias_test.go
index cf56836b..51ce1d5f 100644
--- a/vault/resource_identity_entity_alias_test.go
+++ b/vault/resource_identity_entity_alias_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"regexp"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/identity/entity"
@@ -26,9 +27,9 @@ func TestAccIdentityEntityAlias(t *testing.T) {
 	nameGithubA := "vault_auth_backend.githubA"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckIdentityEntityAliasDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckIdentityEntityAliasDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityEntityAliasConfig(entity, false, false),
@@ -124,9 +125,9 @@ resource "vault_identity_entity_alias" "test2" {
 	entityResource1 := "vault_identity_entity.test1"
 	entityResource2 := "vault_identity_entity.test2"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckIdentityEntityAliasDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckIdentityEntityAliasDestroy,
 		Steps: []resource.TestStep{
 			{
 				// test the case where the apply operation would produce two new aliases having the same name
@@ -239,9 +240,9 @@ func TestAccIdentityEntityAlias_Update(t *testing.T) {
 	nameGithubB := "vault_auth_backend.githubB"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckIdentityEntityAliasDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckIdentityEntityAliasDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityEntityAliasConfig(entity, false, false),
@@ -297,9 +298,9 @@ func TestAccIdentityEntityAlias_Metadata(t *testing.T) {
 	// TODO add back empty custom_metadata update tests
 	// once bug in Vault is resolved
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckIdentityEntityAliasDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckIdentityEntityAliasDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityEntityAliasMetadataConfig(entity, false),
diff --git a/vault/resource_identity_entity_policies_test.go b/vault/resource_identity_entity_policies_test.go
index 63811437..9751220a 100644
--- a/vault/resource_identity_entity_policies_test.go
+++ b/vault/resource_identity_entity_policies_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"strconv"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/identity/entity"
 	"github.com/hashicorp/terraform-provider-vault/internal/identity/group"
@@ -22,9 +23,9 @@ import (
 func TestAccIdentityEntityPoliciesExclusive(t *testing.T) {
 	entity := acctest.RandomWithPrefix("test-entity")
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckidentityEntityPoliciesDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckidentityEntityPoliciesDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityEntityPoliciesConfigExclusive(entity),
@@ -46,9 +47,9 @@ func TestAccIdentityEntityPoliciesExclusive(t *testing.T) {
 func TestAccIdentityEntityPoliciesNonExclusive(t *testing.T) {
 	entity := acctest.RandomWithPrefix("test-entity")
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckidentityEntityPoliciesDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckidentityEntityPoliciesDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityEntityPoliciesConfigNonExclusive(entity),
diff --git a/vault/resource_identity_entity_test.go b/vault/resource_identity_entity_test.go
index 3ed42487..653dd4ab 100644
--- a/vault/resource_identity_entity_test.go
+++ b/vault/resource_identity_entity_test.go
@@ -4,6 +4,7 @@
 package vault
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"net/http"
@@ -11,9 +12,9 @@ import (
 	"testing"
 	"time"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/vault/api"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/identity/entity"
@@ -27,9 +28,9 @@ func TestAccIdentityEntity(t *testing.T) {
 
 	resourceName := "vault_identity_entity.entity"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckIdentityEntityDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckIdentityEntityDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityEntityConfig(entity),
@@ -44,9 +45,9 @@ func TestAccIdentityEntityUpdate(t *testing.T) {
 
 	resourceName := "vault_identity_entity.entity"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckIdentityEntityDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckIdentityEntityDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityEntityConfig(entity),
@@ -73,9 +74,9 @@ func TestAccIdentityEntityUpdateRemoveValues(t *testing.T) {
 
 	resourceName := "vault_identity_entity.entity"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckIdentityEntityDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckIdentityEntityDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityEntityConfig(entity),
@@ -103,9 +104,9 @@ func TestAccIdentityEntityUpdateRemovePolicies(t *testing.T) {
 
 	resourceName := "vault_identity_entity.entity"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckIdentityEntityDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckIdentityEntityDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityEntityConfig(entity),
diff --git a/vault/resource_identity_group_alias_test.go b/vault/resource_identity_group_alias_test.go
index 8a2017b0..0c019dda 100644
--- a/vault/resource_identity_group_alias_test.go
+++ b/vault/resource_identity_group_alias_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -24,9 +25,9 @@ func TestAccIdentityGroupAlias(t *testing.T) {
 	nameGithubA := "vault_auth_backend.githubA"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckIdentityGroupAliasDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckIdentityGroupAliasDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityGroupAliasConfig(group),
@@ -52,9 +53,9 @@ func TestAccIdentityGroupAliasUpdate(t *testing.T) {
 	aliasB := acctest.RandomWithPrefix("B-")
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckIdentityGroupAliasDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckIdentityGroupAliasDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityGroupAliasConfigUpdate(suffix, aliasA, nameGithubA, nameGroupA),
diff --git a/vault/resource_identity_group_member_entity_ids_test.go b/vault/resource_identity_group_member_entity_ids_test.go
index 3e026a9f..84438393 100644
--- a/vault/resource_identity_group_member_entity_ids_test.go
+++ b/vault/resource_identity_group_member_entity_ids_test.go
@@ -4,14 +4,15 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"strconv"
 	"strings"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/identity/group"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -24,9 +25,9 @@ func TestAccIdentityGroupMemberEntityIdsExclusiveEmpty(t *testing.T) {
 
 	resourceName := "vault_identity_group_member_entity_ids.member_entity_ids"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckidentityGroupMemberEntityIdsDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckidentityGroupMemberEntityIdsDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityGroupMemberEntityIdsConfigExclusiveEmpty(),
@@ -55,9 +56,9 @@ func TestAccIdentityGroupMemberEntityIdsExclusive(t *testing.T) {
 	testEntity := acctest.RandomWithPrefix("test-entity")
 	resourceName := "vault_identity_group_member_entity_ids.member_entity_ids"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckidentityGroupMemberEntityIdsDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckidentityGroupMemberEntityIdsDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityGroupMemberEntityIdsConfigExclusive(devEntity),
@@ -84,9 +85,9 @@ func TestAccIdentityGroupMemberEntityIdsNonExclusiveEmpty(t *testing.T) {
 	resourceNameDev := "vault_identity_group_member_entity_ids.dev"
 	resourceNameTest := "vault_identity_group_member_entity_ids.test"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckidentityGroupMemberEntityIdsDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckidentityGroupMemberEntityIdsDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityGroupMemberEntityIdsConfigNonExclusiveEmpty(devEntity),
@@ -141,9 +142,9 @@ func TestAccIdentityGroupMemberEntityIdsNonExclusive(t *testing.T) {
 	resourceNameDev := "vault_identity_group_member_entity_ids.dev"
 	resourceNameTest := "vault_identity_group_member_entity_ids.test"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckidentityGroupMemberEntityIdsDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckidentityGroupMemberEntityIdsDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityGroupMemberEntityIdsConfigNonExclusive(entity1, entity2),
@@ -210,9 +211,9 @@ func TestAccIdentityGroupMemberEntityIdsDynamic(t *testing.T) {
 	groupName := acctest.RandomWithPrefix("group")
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckidentityGroupMemberEntityIdsDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckidentityGroupMemberEntityIdsDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityGMEIDynamic(groupName, true, tests...),
diff --git a/vault/resource_identity_group_member_group_ids_test.go b/vault/resource_identity_group_member_group_ids_test.go
index 6aa55376..ff8d2811 100644
--- a/vault/resource_identity_group_member_group_ids_test.go
+++ b/vault/resource_identity_group_member_group_ids_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/identity/group"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -27,8 +28,8 @@ func TestAccIdentityGroupMemberGroupIdsNonExclusive(t *testing.T) {
 	resourceNameDev := "vault_identity_group_member_group_ids.dev"
 	resourceNameTest := "vault_identity_group_member_group_ids.test"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityGroupMemberGroupIdsConfigNonExclusive(group1, group2),
diff --git a/vault/resource_identity_group_policies_test.go b/vault/resource_identity_group_policies_test.go
index 299fa152..ee9a1f87 100644
--- a/vault/resource_identity_group_policies_test.go
+++ b/vault/resource_identity_group_policies_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"strconv"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/identity/group"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -22,9 +23,9 @@ func TestAccIdentityGroupPoliciesExclusive(t *testing.T) {
 	group := acctest.RandomWithPrefix("test-group")
 	resourceName := "vault_identity_group_policies.policies"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckidentityGroupPoliciesDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckidentityGroupPoliciesDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityGroupPoliciesConfigExclusive(group),
@@ -49,9 +50,9 @@ func TestAccIdentityGroupPoliciesNonExclusive(t *testing.T) {
 	resourceNameTest := "vault_identity_group_policies.test"
 	resourceNameGroup := "vault_identity_group.group"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckidentityGroupPoliciesDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckidentityGroupPoliciesDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityGroupPoliciesConfigNonExclusive(group),
diff --git a/vault/resource_identity_group_test.go b/vault/resource_identity_group_test.go
index 6ed8e7ff..363d1442 100644
--- a/vault/resource_identity_group_test.go
+++ b/vault/resource_identity_group_test.go
@@ -4,6 +4,7 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"reflect"
 	"regexp"
@@ -11,9 +12,9 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/identity/group"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -25,9 +26,9 @@ func TestAccIdentityGroup(t *testing.T) {
 
 	resourceName := "vault_identity_group.group"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckIdentityGroupDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckIdentityGroupDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityGroupConfig(group),
@@ -43,9 +44,9 @@ func TestAccIdentityGroupUpdate(t *testing.T) {
 
 	resourceName := "vault_identity_group.group"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckIdentityGroupDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckIdentityGroupDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityGroupConfig(group),
@@ -110,9 +111,9 @@ func TestAccIdentityGroupExternal(t *testing.T) {
 
 	resourceName := "vault_identity_group.group"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckIdentityGroupDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckIdentityGroupDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityGroupConfig(group),
@@ -142,9 +143,9 @@ resource "vault_identity_group" "test_upper" {
 `, group, strings.ToUpper(group[0:1])+group[1:])
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckIdentityGroupDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckIdentityGroupDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: config,
diff --git a/vault/resource_identity_mfa_duo_test.go b/vault/resource_identity_mfa_duo_test.go
index 8cfc7e50..f027d408 100644
--- a/vault/resource_identity_mfa_duo_test.go
+++ b/vault/resource_identity_mfa_duo_test.go
@@ -4,10 +4,11 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/identity/mfa"
@@ -30,8 +31,8 @@ func TestIdentityMFADuo(t *testing.T) {
 
 	importTestStep := testutil.GetImportTestStep(resourceName, false, nil, consts.FieldIntegrationKey, consts.FieldSecretKey)
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config: fmt.Sprintf(`
diff --git a/vault/resource_identity_mfa_login_enforcement_test.go b/vault/resource_identity_mfa_login_enforcement_test.go
index 39cc3b30..ceb81d9d 100644
--- a/vault/resource_identity_mfa_login_enforcement_test.go
+++ b/vault/resource_identity_mfa_login_enforcement_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/identity/mfa"
@@ -30,8 +31,8 @@ func TestIdentityMFALoginEnforcement(t *testing.T) {
 
 	importTestStep := testutil.GetImportTestStep(resourceName, false, nil, consts.FieldIntegrationKey, consts.FieldSecretKey)
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config: getTestMFAEnforcementConfig(name),
diff --git a/vault/resource_identity_mfa_okta_test.go b/vault/resource_identity_mfa_okta_test.go
index 3d88d99a..3b8908eb 100644
--- a/vault/resource_identity_mfa_okta_test.go
+++ b/vault/resource_identity_mfa_okta_test.go
@@ -4,10 +4,11 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/identity/mfa"
@@ -34,8 +35,8 @@ func TestIdentityMFAOKTA(t *testing.T) {
 		consts.FieldPrimaryEmail,
 	)
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config: fmt.Sprintf(`
diff --git a/vault/resource_identity_mfa_pingid_test.go b/vault/resource_identity_mfa_pingid_test.go
index 9f161c5a..f33f0df9 100644
--- a/vault/resource_identity_mfa_pingid_test.go
+++ b/vault/resource_identity_mfa_pingid_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"encoding/base64"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/identity/mfa"
@@ -45,8 +46,8 @@ authenticator_url=https://authenticator.pingone.com/pingid/ppm
 
 	importTestStep := testutil.GetImportTestStep(resourceName, false, nil, consts.FieldSettingsFileBase64)
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config: fmt.Sprintf(`
diff --git a/vault/resource_identity_mfa_totp_test.go b/vault/resource_identity_mfa_totp_test.go
index f02c3437..d2cf8e32 100644
--- a/vault/resource_identity_mfa_totp_test.go
+++ b/vault/resource_identity_mfa_totp_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"regexp"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/identity/mfa"
@@ -29,8 +30,8 @@ func TestIdentityMFATOTP(t *testing.T) {
 
 	importTestStep := testutil.GetImportTestStep(resourceName, false, nil)
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config: fmt.Sprintf(`
@@ -109,7 +110,7 @@ resource "%s" "test" {
   algorithm               = "SHA5120"
 }
 `, mfa.ResourceNameTOTP),
-				ExpectError: regexp.MustCompile(`Error running pre-apply refresh.*`),
+				ExpectError: regexp.MustCompile(`Error: Unsupported value.*`),
 			},
 			{
 				Config: fmt.Sprintf(`
diff --git a/vault/resource_identity_oidc_assignment_test.go b/vault/resource_identity_oidc_assignment_test.go
index 697c1512..f6a191e8 100644
--- a/vault/resource_identity_oidc_assignment_test.go
+++ b/vault/resource_identity_oidc_assignment_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -20,9 +21,9 @@ func TestAccIdentityOIDCAssignment(t *testing.T) {
 	resourceName := "vault_identity_oidc_assignment.test"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckOIDCAssignmentDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckOIDCAssignmentDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityOIDCAssignmentConfig_empty(name),
diff --git a/vault/resource_identity_oidc_client_test.go b/vault/resource_identity_oidc_client_test.go
index 22529e76..982c9082 100644
--- a/vault/resource_identity_oidc_client_test.go
+++ b/vault/resource_identity_oidc_client_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -24,9 +25,9 @@ func TestAccIdentityOIDCClient(t *testing.T) {
 	resourceName := "vault_identity_oidc_client.client"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckOIDCClientDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckOIDCClientDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityOIDCClientConfig_basic(keyName, assignmentName, clientName),
diff --git a/vault/resource_identity_oidc_key_allowed_client_id_test.go b/vault/resource_identity_oidc_key_allowed_client_id_test.go
index 9ac76041..8f9da4a8 100644
--- a/vault/resource_identity_oidc_key_allowed_client_id_test.go
+++ b/vault/resource_identity_oidc_key_allowed_client_id_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -20,9 +21,9 @@ func TestAccIdentityOidcKeyAllowedClientId(t *testing.T) {
 	name := acctest.RandomWithPrefix("test-role")
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckIdentityOidcKeyAllowedClientIdDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckIdentityOidcKeyAllowedClientIdDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityOidcKeyAllowedClientIdConfig(name),
diff --git a/vault/resource_identity_oidc_key_test.go b/vault/resource_identity_oidc_key_test.go
index fae6d514..54421e16 100644
--- a/vault/resource_identity_oidc_key_test.go
+++ b/vault/resource_identity_oidc_key_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"regexp"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -21,9 +22,9 @@ func TestAccIdentityOidcKey(t *testing.T) {
 
 	resourceName := "vault_identity_oidc_key.key"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckIdentityOidcKeyDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckIdentityOidcKeyDestroy,
 		Steps: []resource.TestStep{
 			{
 				// Test a create failure
@@ -55,9 +56,9 @@ func TestAccIdentityOidcKeyUpdate(t *testing.T) {
 
 	resourceName := "vault_identity_oidc_key.key"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckIdentityOidcKeyDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckIdentityOidcKeyDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityOidcKeyConfig(key),
diff --git a/vault/resource_identity_oidc_provider_test.go b/vault/resource_identity_oidc_provider_test.go
index 2615e62f..3cf02dd2 100644
--- a/vault/resource_identity_oidc_provider_test.go
+++ b/vault/resource_identity_oidc_provider_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -25,9 +26,9 @@ func TestAccIdentityOIDCProvider(t *testing.T) {
 	resourceName := "vault_identity_oidc_provider.test"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckOIDCProviderDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckOIDCProviderDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityOIDCProviderConfig(keyName, assignmentName, clientName, scopeName, providerName),
diff --git a/vault/resource_identity_oidc_role_test.go b/vault/resource_identity_oidc_role_test.go
index 72e50d57..8227f597 100644
--- a/vault/resource_identity_oidc_role_test.go
+++ b/vault/resource_identity_oidc_role_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -24,9 +25,9 @@ func TestAccIdentityOidcRole(t *testing.T) {
 
 	resourceName := "vault_identity_oidc_role.role"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckIdentityOidcRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckIdentityOidcRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityOidcRoleConfig(name),
@@ -53,9 +54,9 @@ func TestAccIdentityOidcRoleWithClientId(t *testing.T) {
 
 	resourceName := "vault_identity_oidc_role.role"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckIdentityOidcRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckIdentityOidcRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityOidcRoleWithClientIdConfig(name, clientId),
@@ -84,9 +85,9 @@ func TestAccIdentityOidcRoleUpdate(t *testing.T) {
 
 	resourceName := "vault_identity_oidc_role.role"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckIdentityOidcRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckIdentityOidcRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityOidcRoleWithClientIdConfig(name, clientId),
diff --git a/vault/resource_identity_oidc_scope_test.go b/vault/resource_identity_oidc_scope_test.go
index a3d91db6..a9db7b9d 100644
--- a/vault/resource_identity_oidc_scope_test.go
+++ b/vault/resource_identity_oidc_scope_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -25,9 +26,9 @@ func TestAccIdentityOIDCScope(t *testing.T) {
 	resourceName := "vault_identity_oidc_scope.test"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckOIDCScopeDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckOIDCScopeDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityOIDCScopeConfig_basic(name),
diff --git a/vault/resource_identity_oidc_test.go b/vault/resource_identity_oidc_test.go
index 46158a16..8914ee48 100644
--- a/vault/resource_identity_oidc_test.go
+++ b/vault/resource_identity_oidc_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -20,9 +21,9 @@ func TestAccIdentityOidc(t *testing.T) {
 
 	const resourceName = "vault_identity_oidc.server"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckIdentityOidcDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckIdentityOidcDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccIdentityOidcConfig(issuer),
diff --git a/vault/resource_jwt_auth_backend_role_test.go b/vault/resource_jwt_auth_backend_role_test.go
index b07ed241..d98661da 100644
--- a/vault/resource_jwt_auth_backend_role_test.go
+++ b/vault/resource_jwt_auth_backend_role_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -22,9 +23,9 @@ func TestAccJWTAuthBackendRole_import(t *testing.T) {
 	backend := acctest.RandomWithPrefix("jwt")
 	role := acctest.RandomWithPrefix("test-role")
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckJWTAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckJWTAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccJWTAuthBackendRoleConfig_full(backend, role),
@@ -96,9 +97,9 @@ func TestAccJWTAuthBackendRole_basic(t *testing.T) {
 	backend := acctest.RandomWithPrefix("jwt")
 	role := acctest.RandomWithPrefix("test-role")
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckJWTAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckJWTAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccJWTAuthBackendRoleConfig_basic(backend, role),
@@ -141,9 +142,9 @@ func TestAccJWTAuthBackendRole_update(t *testing.T) {
 	role := acctest.RandomWithPrefix("test-role")
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckJWTAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckJWTAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccJWTAuthBackendRoleConfig_basic(backend, role),
@@ -216,9 +217,9 @@ func TestAccJWTAuthBackendRole_full(t *testing.T) {
 	backend := acctest.RandomWithPrefix("jwt")
 	role := acctest.RandomWithPrefix("test-role")
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckJWTAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckJWTAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccJWTAuthBackendRoleConfig_full(backend, role),
@@ -282,9 +283,9 @@ func TestAccJWTAuthBackendRoleOIDC_full(t *testing.T) {
 	backend := acctest.RandomWithPrefix("oidc")
 	role := acctest.RandomWithPrefix("test-role")
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckJWTAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckJWTAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccJWTAuthBackendRoleConfigOIDC_full(backend, role),
@@ -357,9 +358,9 @@ func TestAccJWTAuthBackendRoleOIDC_disableParsing(t *testing.T) {
 	role := acctest.RandomWithPrefix("test-role")
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckJWTAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckJWTAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccJWTAuthBackendRoleConfigOIDC_disableParsing(backend, role),
@@ -445,9 +446,9 @@ func TestAccJWTAuthBackendRole_fullUpdate(t *testing.T) {
 	}
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckJWTAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckJWTAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccJWTAuthBackendRoleConfig_full(backend, role),
diff --git a/vault/resource_jwt_auth_backend_test.go b/vault/resource_jwt_auth_backend_test.go
index 04c8a767..8b6b693f 100644
--- a/vault/resource_jwt_auth_backend_test.go
+++ b/vault/resource_jwt_auth_backend_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"regexp"
 	"strings"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -89,10 +90,10 @@ func TestAccJWTAuthBackend(t *testing.T) {
 	t.Run("basic", func(t *testing.T) {
 		t.Parallel()
 		resource.Test(t, resource.TestCase{
-			PreCheck:          func() { testutil.TestAccPreCheck(t) },
-			ProviderFactories: providerFactories,
-			CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeJWT, consts.FieldPath),
-			Steps:             getSteps(path, ""),
+			PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+			ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+			CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeJWT, consts.FieldPath),
+			Steps:                    getSteps(path, ""),
 		})
 	},
 	)
@@ -102,10 +103,10 @@ func TestAccJWTAuthBackend(t *testing.T) {
 		ns := acctest.RandomWithPrefix("ns")
 		path := acctest.RandomWithPrefix("jwt")
 		resource.Test(t, resource.TestCase{
-			PreCheck:          func() { testutil.TestEntPreCheck(t) },
-			ProviderFactories: providerFactories,
-			CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeJWT, consts.FieldPath),
-			Steps:             getSteps(path, ns),
+			PreCheck:                 func() { testutil.TestEntPreCheck(t) },
+			ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+			CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeJWT, consts.FieldPath),
+			Steps:                    getSteps(path, ns),
 		})
 	},
 	)
@@ -143,10 +144,10 @@ func TestAccJWTAuthBackendProviderConfig(t *testing.T) {
 	t.Run("basic", func(t *testing.T) {
 		t.Parallel()
 		resource.Test(t, resource.TestCase{
-			PreCheck:          func() { testutil.TestAccPreCheck(t) },
-			ProviderFactories: providerFactories,
-			CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeJWT, consts.FieldPath),
-			Steps:             getSteps(path, ""),
+			PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+			ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+			CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeJWT, consts.FieldPath),
+			Steps:                    getSteps(path, ""),
 		})
 	},
 	)
@@ -156,10 +157,10 @@ func TestAccJWTAuthBackendProviderConfig(t *testing.T) {
 		ns := acctest.RandomWithPrefix("ns")
 		path := acctest.RandomWithPrefix("jwt")
 		resource.Test(t, resource.TestCase{
-			PreCheck:          func() { testutil.TestEntPreCheck(t) },
-			ProviderFactories: providerFactories,
-			CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeJWT, consts.FieldPath),
-			Steps:             getSteps(path, ns),
+			PreCheck:                 func() { testutil.TestEntPreCheck(t) },
+			ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+			CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeJWT, consts.FieldPath),
+			Steps:                    getSteps(path, ns),
 		})
 	},
 	)
@@ -202,10 +203,10 @@ func TestAccJWTAuthBackend_OIDC(t *testing.T) {
 		t.Parallel()
 		path := acctest.RandomWithPrefix("oidc")
 		resource.Test(t, resource.TestCase{
-			PreCheck:          func() { testutil.TestAccPreCheck(t) },
-			ProviderFactories: providerFactories,
-			CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeJWT, consts.FieldPath),
-			Steps:             getSteps(path, ""),
+			PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+			ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+			CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeJWT, consts.FieldPath),
+			Steps:                    getSteps(path, ""),
 		})
 	},
 	)
@@ -215,10 +216,10 @@ func TestAccJWTAuthBackend_OIDC(t *testing.T) {
 		ns := acctest.RandomWithPrefix("ns")
 		path := acctest.RandomWithPrefix("oidc")
 		resource.Test(t, resource.TestCase{
-			PreCheck:          func() { testutil.TestEntPreCheck(t) },
-			ProviderFactories: providerFactories,
-			CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeJWT, consts.FieldPath),
-			Steps:             getSteps(path, ns),
+			PreCheck:                 func() { testutil.TestEntPreCheck(t) },
+			ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+			CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeJWT, consts.FieldPath),
+			Steps:                    getSteps(path, ns),
 		})
 	},
 	)
@@ -229,8 +230,8 @@ func TestAccJWTAuthBackend_invalid(t *testing.T) {
 	path := acctest.RandomWithPrefix("jwt")
 	invalidPath := path + consts.PathDelim
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config:  testAccJWTAuthBackendConfig(invalidPath, "", false),
@@ -263,8 +264,8 @@ func TestJWTAuthBackend_remount(t *testing.T) {
 	resourceName := "vault_jwt_auth_backend.jwt"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testAccJWTAuthBackendConfig(path, "", false),
@@ -415,8 +416,8 @@ func TestAccJWTAuthBackend_missingMandatory(t *testing.T) {
 	t.Parallel()
 	path := acctest.RandomWithPrefix("jwt")
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config: fmt.Sprintf(`resource "vault_jwt_auth_backend" "bad" {
@@ -549,8 +550,8 @@ func TestAccJWTAuthBackendProviderConfigConversionInt(t *testing.T) {
 func TestAccJWTAuthBackendProviderConfig_negative(t *testing.T) {
 	t.Skip(true)
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config: fmt.Sprintf(`resource "vault_jwt_auth_backend" "oidc" {
diff --git a/vault/resource_kmip_secret_backend_test.go b/vault/resource_kmip_secret_backend_test.go
index 7130eacd..8f2dfcac 100644
--- a/vault/resource_kmip_secret_backend_test.go
+++ b/vault/resource_kmip_secret_backend_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -33,9 +34,9 @@ func TestAccKMIPSecretBackend_basic(t *testing.T) {
 	}
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestEntPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeKMIP, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestEntPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeKMIP, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testKMIPSecretBackend_initialConfig(path, addr1),
@@ -97,9 +98,9 @@ func TestAccKMIPSecretBackend_remount(t *testing.T) {
 	}
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestEntPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeKMIP, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestEntPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeKMIP, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testKMIPSecretBackend_initialConfig(path, addr1),
diff --git a/vault/resource_kmip_secret_role_test.go b/vault/resource_kmip_secret_role_test.go
index 50f8fd68..3128c086 100644
--- a/vault/resource_kmip_secret_role_test.go
+++ b/vault/resource_kmip_secret_role_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -33,9 +34,9 @@ func TestAccKMIPSecretRole_basic(t *testing.T) {
 	addr1 := lns[0].Addr().String()
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestEntPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeKMIP, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestEntPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeKMIP, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testKMIPSecretRole_initialConfig(path, addr1),
@@ -108,9 +109,9 @@ func TestAccKMIPSecretRole_remount(t *testing.T) {
 	resourceType := "vault_kmip_secret_role"
 	resourceName := resourceType + ".test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestEntPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeKMIP, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestEntPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeKMIP, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testKMIPSecretRole_initialConfig(path, addr1),
diff --git a/vault/resource_kmip_secret_scope_test.go b/vault/resource_kmip_secret_scope_test.go
index c88346e0..e51d5efa 100644
--- a/vault/resource_kmip_secret_scope_test.go
+++ b/vault/resource_kmip_secret_scope_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -33,9 +34,9 @@ func TestAccKMIPSecretScope_remount(t *testing.T) {
 
 	addr1 := lns[0].Addr().String()
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestEntPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeKMIP, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestEntPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeKMIP, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testKMIPSecretScope_initialConfig(path, addr1),
diff --git a/vault/resource_kubernetes_auth_backend_config_test.go b/vault/resource_kubernetes_auth_backend_config_test.go
index 46585f2b..55ec13b4 100644
--- a/vault/resource_kubernetes_auth_backend_config_test.go
+++ b/vault/resource_kubernetes_auth_backend_config_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"strconv"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -76,9 +77,9 @@ func TestAccKubernetesAuthBackendConfig_import(t *testing.T) {
 	issuer := "kubernetes/serviceaccount"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckKubernetesAuthBackendConfigDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckKubernetesAuthBackendConfigDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccKubernetesAuthBackendConfigConfig_full(backend, kubernetesCAcert, jwt, issuer,
@@ -140,9 +141,9 @@ func TestAccKubernetesAuthBackendConfig_basic(t *testing.T) {
 	jwt := kubernetesJWT
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckKubernetesAuthBackendConfigDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckKubernetesAuthBackendConfigDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccKubernetesAuthBackendConfigConfig_basic(backend, jwt, kubernetesCAcert),
@@ -189,9 +190,9 @@ func TestAccKubernetesAuthBackendConfig_update(t *testing.T) {
 	newJWT := kubernetesAnotherJWT
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckKubernetesAuthBackendConfigDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckKubernetesAuthBackendConfigDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccKubernetesAuthBackendConfigConfig_basic(backend, oldJWT, kubernetesCAcert),
@@ -230,9 +231,9 @@ func TestAccKubernetesAuthBackendConfig_full(t *testing.T) {
 	testResource := "vault_kubernetes_auth_backend_config.config"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckKubernetesAuthBackendConfigDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckKubernetesAuthBackendConfigDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccKubernetesAuthBackendConfigConfig_full(backend, kubernetesCAcert, jwt, issuer,
@@ -271,9 +272,9 @@ func TestAccKubernetesAuthBackendConfig_fullUpdate(t *testing.T) {
 	newIssuer := "api"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckKubernetesAuthBackendConfigDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckKubernetesAuthBackendConfigDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccKubernetesAuthBackendConfigConfig_full(backend, kubernetesCAcert, oldJWT, oldIssuer,
@@ -363,8 +364,8 @@ func TestAccKubernetesAuthBackendConfig_localCA(t *testing.T) {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionGTE(t, testProvider.Meta(), vaultVersion193)
 		},
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckKubernetesAuthBackendConfigDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckKubernetesAuthBackendConfigDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccKubernetesAuthBackendConfigConfig_basic(backend, jwt, ""),
@@ -507,8 +508,8 @@ func TestAccKubernetesAuthBackendConfig_fullInK8sCluster(t *testing.T) {
 			testutil.SkipTestEnvSet(t, envVarTFAccK8sSkipInCluster)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), vaultVersion193)
 		},
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckKubernetesAuthBackendConfigDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckKubernetesAuthBackendConfigDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccKubernetesAuthBackendConfigConfig_full(backend, "", oldJWT, oldIssuer,
diff --git a/vault/resource_kubernetes_auth_backend_role_test.go b/vault/resource_kubernetes_auth_backend_role_test.go
index 910619aa..71ce832a 100644
--- a/vault/resource_kubernetes_auth_backend_role_test.go
+++ b/vault/resource_kubernetes_auth_backend_role_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"strconv"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -24,9 +25,9 @@ func TestAccKubernetesAuthBackendRole_import(t *testing.T) {
 	audience := "vault"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckKubernetesAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckKubernetesAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccKubernetesAuthBackendRoleConfig_full(backend, role, "", ttl, maxTTL, audience),
@@ -78,9 +79,9 @@ func TestAccKubernetesAuthBackendRole_basic(t *testing.T) {
 	ttl := 3600
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckKubernetesAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckKubernetesAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccKubernetesAuthBackendRoleConfig_basic(backend, role, "", ttl),
@@ -122,9 +123,9 @@ func TestAccKubernetesAuthBackendRole_update(t *testing.T) {
 	newTTL := oldTTL * 2
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckKubernetesAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckKubernetesAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccKubernetesAuthBackendRoleConfig_basic(backend, role, "serviceaccount_uid", oldTTL),
@@ -196,9 +197,9 @@ func TestAccKubernetesAuthBackendRole_full(t *testing.T) {
 	audience := "vault"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckKubernetesAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckKubernetesAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccKubernetesAuthBackendRoleConfig_full(backend, role, "", ttl, maxTTL, audience),
@@ -250,9 +251,9 @@ func TestAccKubernetesAuthBackendRole_fullUpdate(t *testing.T) {
 	newAudience := "new-vault"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckKubernetesAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckKubernetesAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccKubernetesAuthBackendRoleConfig_full(backend, role, "", oldTTL, oldMaxTTL, oldAudience),
diff --git a/vault/resource_kubernetes_secret_backend_role_test.go b/vault/resource_kubernetes_secret_backend_role_test.go
index 412e1613..310e7319 100644
--- a/vault/resource_kubernetes_secret_backend_role_test.go
+++ b/vault/resource_kubernetes_secret_backend_role_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -24,9 +25,9 @@ func TestAccKubernetesSecretBackendRole(t *testing.T) {
 	name := acctest.RandomWithPrefix("tf-test-role")
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccKubernetesSecretBackendRoleCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccKubernetesSecretBackendRoleCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testKubernetesSecretBackendRole_initialConfig(backend, name),
diff --git a/vault/resource_kubernetes_secret_backend_test.go b/vault/resource_kubernetes_secret_backend_test.go
index 3267b43e..e0afc856 100644
--- a/vault/resource_kubernetes_secret_backend_test.go
+++ b/vault/resource_kubernetes_secret_backend_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -21,9 +22,9 @@ func TestAccKubernetesSecretBackend(t *testing.T) {
 	resourceType := "vault_kubernetes_secret_backend"
 	resourceName := resourceType + ".test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeKubernetes, ""),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeKubernetes, ""),
 		Steps: []resource.TestStep{
 			{
 				Config: testKubernetesSecretBackend_initialConfig(path),
diff --git a/vault/resource_kv_secret_backend_v2_test.go b/vault/resource_kv_secret_backend_v2_test.go
index 22f66c7b..6d969116 100644
--- a/vault/resource_kv_secret_backend_v2_test.go
+++ b/vault/resource_kv_secret_backend_v2_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -20,8 +21,8 @@ func TestAccKVSecretBackendV2(t *testing.T) {
 	mount := acctest.RandomWithPrefix("tf-kvv2")
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testKVSecretBackendV2Config(mount, false),
diff --git a/vault/resource_kv_secret_test.go b/vault/resource_kv_secret_test.go
index 065d14e2..8f88439d 100644
--- a/vault/resource_kv_secret_test.go
+++ b/vault/resource_kv_secret_test.go
@@ -4,15 +4,16 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -25,8 +26,8 @@ func TestAccKVSecret(t *testing.T) {
 	name := acctest.RandomWithPrefix("tf-secret")
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testKVSecretConfig_basic(mount, name),
@@ -70,8 +71,8 @@ func TestAccKVSecret_UpdateOutsideTerraform(t *testing.T) {
 	name := acctest.RandomWithPrefix("tf-secret")
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testKVSecretConfig_basic(mount, name),
diff --git a/vault/resource_kv_secret_v2_test.go b/vault/resource_kv_secret_v2_test.go
index 74dd80e0..7faba051 100644
--- a/vault/resource_kv_secret_v2_test.go
+++ b/vault/resource_kv_secret_v2_test.go
@@ -4,12 +4,15 @@
 package vault
 
 import (
+	"context"
 	"fmt"
+	"github.com/hashicorp/terraform-plugin-testing/plancheck"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"reflect"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/vault/api"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
@@ -77,8 +80,8 @@ func TestAccKVSecretV2(t *testing.T) {
 	customMetadata := `{"extra":"cheese","pizza":"please"}`
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testKVSecretV2Config_initial(mount, name),
@@ -87,9 +90,6 @@ func TestAccKVSecretV2(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, consts.FieldName, name),
 					resource.TestCheckResourceAttr(resourceName, consts.FieldPath, fmt.Sprintf("%s/data/%s", mount, name)),
 					resource.TestCheckResourceAttr(resourceName, "delete_all_versions", "true"),
-					resource.TestCheckResourceAttr(resourceName, "data.zip", "zap"),
-					resource.TestCheckResourceAttr(resourceName, "data.foo", "bar"),
-					resource.TestCheckResourceAttr(resourceName, "data.flag", "false"),
 					resource.TestCheckResourceAttr(resourceName, "custom_metadata.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "custom_metadata.0.cas_required", "false"),
 					resource.TestCheckResourceAttr(resourceName, "custom_metadata.0.data.%", "0"),
@@ -109,9 +109,6 @@ func TestAccKVSecretV2(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, consts.FieldName, name),
 					resource.TestCheckResourceAttr(resourceName, consts.FieldPath, fmt.Sprintf("%s/data/%s", mount, name)),
 					resource.TestCheckResourceAttr(resourceName, "delete_all_versions", "true"),
-					resource.TestCheckResourceAttr(resourceName, "data.zip", "zoop"),
-					resource.TestCheckResourceAttr(resourceName, "data.foo", "baz"),
-					resource.TestCheckResourceAttr(resourceName, "data.flag", "false"),
 					resource.TestCheckResourceAttr(resourceName, "custom_metadata.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "custom_metadata.0.cas_required", "false"),
 					resource.TestCheckResourceAttr(resourceName, "custom_metadata.0.data.%", "2"),
@@ -142,9 +139,6 @@ func TestAccKVSecretV2(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, consts.FieldName, updatedName),
 					resource.TestCheckResourceAttr(resourceName, consts.FieldPath, fmt.Sprintf("%s/data/%s", updatedMount, updatedName)),
 					resource.TestCheckResourceAttr(resourceName, "delete_all_versions", "true"),
-					resource.TestCheckResourceAttr(resourceName, "data.zip", "zap"),
-					resource.TestCheckResourceAttr(resourceName, "data.foo", "bar"),
-					resource.TestCheckResourceAttr(resourceName, "data.flag", "false"),
 					resource.TestCheckResourceAttr(resourceName, "custom_metadata.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "custom_metadata.0.cas_required", "false"),
 					resource.TestCheckResourceAttr(resourceName, "custom_metadata.0.data.%", "0"),
@@ -172,8 +166,8 @@ func TestAccKVSecretV2_DisableRead(t *testing.T) {
 	name := acctest.RandomWithPrefix("tf-secret")
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				PreConfig: func() {
@@ -215,56 +209,109 @@ func TestAccKVSecretV2_DisableRead(t *testing.T) {
 	})
 }
 
-// Fadia u have added this
-func TestAccKVSecretV2_UpdateOutsideTerraform(t *testing.T) {
+// TestAccKVSecretV2_data_json_wo ensures write-only attribute
+// `data_json_wo` works as expected
+func TestAccKVSecretV2_data_json_wo(t *testing.T) {
+	t.Parallel()
+
 	resourceName := "vault_kv_secret_v2.test"
 	mount := acctest.RandomWithPrefix("tf-kv")
 	name := acctest.RandomWithPrefix("foo")
-
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
-				Config: testKVSecretV2Config_initial(mount, name),
+				Config: testKVSecretV2Config_data_json_wo(mount, name, 1),
 				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttr(resourceName, consts.FieldMount, mount),
-					resource.TestCheckResourceAttr(resourceName, consts.FieldName, name),
-					resource.TestCheckResourceAttr(resourceName, consts.FieldPath, fmt.Sprintf("%s/data/%s", mount, name)),
-					resource.TestCheckResourceAttr(resourceName, "delete_all_versions", "true"),
-					resource.TestCheckResourceAttr(resourceName, "data.zip", "zap"),
-					resource.TestCheckResourceAttr(resourceName, "data.foo", "bar"),
-					resource.TestCheckResourceAttr(resourceName, "data.flag", "false"),
-					resource.TestCheckResourceAttr(resourceName, "metadata.version", "1"),
+					assertKVDataEquals(mount, name, map[string]interface{}{
+						"zip": "zoop",
+						"foo": "baz",
+					}),
+					resource.TestCheckResourceAttr(resourceName, consts.FieldDataJSONWOVersion, "1"),
 				),
 			},
 			{
-				PreConfig: func() {
-					client := testProvider.Meta().(*provider.ProviderMeta).MustGetClient()
+				// Update data
+				Config: testKVSecretV2Config_data_json_wo_updated(mount, name, 2),
+				ConfigPlanChecks: resource.ConfigPlanChecks{
+					PreApply: []plancheck.PlanCheck{
+						plancheck.ExpectResourceAction(resourceName, plancheck.ResourceActionUpdate),
+					},
+				},
+				Check: resource.ComposeTestCheckFunc(
+					assertKVDataEquals(mount, name, map[string]interface{}{
+						"zip": "zap",
+						"foo": "bar",
+					}),
+					resource.TestCheckResourceAttr(resourceName, consts.FieldDataJSONWOVersion, "2"),
+				),
+			},
+			testutil.GetImportTestStep(resourceName, false, nil, consts.FieldDataJSONWO, consts.FieldDataJSONWOVersion,
+				consts.FieldDisableRead, consts.FieldDeleteAllVersions),
+		},
+	})
+}
 
-					// Simulate external change using Vault CLI
-					path := fmt.Sprintf("%s/data/%s", mount, name)
-					_, err := client.Logical().Write(path, map[string]interface{}{"data": map[string]interface{}{"testkey3": "testvalue3"}})
-					if err != nil {
-						t.Fatalf(fmt.Sprintf("error simulating external change; err=%s", err))
-					}
+// TestAccKVSecretV2_WriteOnlyMigration confirms migrating from legacy
+// non-muxed Provider implementation to new write-only attribute implementation
+// works as expected
+func TestAccKVSecretV2_WriteOnlyMigration(t *testing.T) {
+	t.Parallel()
 
+	resourceName := "vault_kv_secret_v2.test"
+	mount := acctest.RandomWithPrefix("tf-kv")
+	name := acctest.RandomWithPrefix("foo")
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			testutil.TestAccPreCheck(t)
+		},
+		Steps: []resource.TestStep{
+			{
+				ExternalProviders: map[string]resource.ExternalProvider{
+					"vault": {
+						// 4.8.0 is not multiplexed
+						VersionConstraint: "4.8.0",
+						Source:            "hashicorp/vault",
+					},
 				},
-
 				Config: testKVSecretV2Config_initial(mount, name),
-
 				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "name", name),
+					// can still read sensitive data in state
+					resource.TestCheckResourceAttr(resourceName, "data.%", "3"),
 					resource.TestCheckResourceAttr(resourceName, "data.zip", "zap"),
 					resource.TestCheckResourceAttr(resourceName, "data.foo", "bar"),
 					resource.TestCheckResourceAttr(resourceName, "data.flag", "false"),
-					resource.TestCheckResourceAttr(resourceName, "data_json", "{\"flag\":false,\"foo\":\"bar\",\"zip\":\"zap\"}"),
-					//we check that the provider updated vault to match the the terraform config therefor creating a new version the secret.
-					resource.TestCheckResourceAttr(resourceName, "metadata.version", "3"),
+				),
+			},
+			// upgrade to new Muxed TFVP with write-only attributes, ensure plan is seamless
+			{
+				ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+				Config:                   testKVSecretV2Config_initial(mount, name),
+				PlanOnly:                 true,
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "name", name),
+					// sensitive data will no longer be set to state
+					// data_json is still being used, so it will still be in state
+					resource.TestCheckResourceAttr(resourceName, "data.%", "0"),
+					resource.TestCheckResourceAttrSet(resourceName, "data_json"),
+				),
+			},
+			// update config to use write-only attributes
+			{
+				ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+				Config:                   testKVSecretV2Config_data_json_wo(mount, name, 1),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "name", name),
+					// sensitive data will no longer be set to state
+					// data_json is no longer being used, so it will not be in state
+					resource.TestCheckResourceAttr(resourceName, "data.%", "0"),
+					resource.TestCheckResourceAttr(resourceName, "data_json", ""),
 				),
 			},
 		},
-	},
-	)
+	})
 }
 
 func readKVData(t *testing.T, mount, name string) {
@@ -290,6 +337,30 @@ func readKVData(t *testing.T, mount, name string) {
 
 }
 
+func assertKVDataEquals(mount, name string, expected map[string]interface{}) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		client := testProvider.Meta().(*provider.ProviderMeta).MustGetClient()
+
+		// Read data at path
+		path := fmt.Sprintf("%s/data/%s", mount, name)
+		resp, err := client.Logical().Read(path)
+		if err != nil {
+			return fmt.Errorf("error reading from Vault; err=%s", err)
+		}
+
+		if resp == nil {
+			return fmt.Errorf("empty response")
+		}
+		if len(resp.Data) == 0 {
+			return fmt.Errorf("kvv2 secret data should not be empty")
+		}
+		if !reflect.DeepEqual(resp.Data["data"], expected) {
+			return fmt.Errorf("kvv2 secret data does not match got: %#+v, want: %#+v", resp.Data["data"], expected)
+		}
+		return nil
+	}
+}
+
 func writeKVData(t *testing.T, mount, name string) {
 	t.Helper()
 	client := testProvider.Meta().(*provider.ProviderMeta).MustGetClient()
@@ -384,3 +455,47 @@ resource "vault_kv_secret_v2" "test" {
 
 	return ret
 }
+
+func testKVSecretV2Config_data_json_wo(mount, name string, version int) string {
+	ret := fmt.Sprintf(`
+%s
+
+`, kvV2MountConfig(mount))
+
+	ret += fmt.Sprintf(`
+resource "vault_kv_secret_v2" "test" {
+  mount               = vault_mount.kvv2.path
+  name                = "%s"
+  data_json_wo = jsonencode(
+    {
+      zip  = "zoop",
+      foo  = "baz",
+    }
+  )
+  data_json_wo_version = %d
+}`, name, version)
+
+	return ret
+}
+
+func testKVSecretV2Config_data_json_wo_updated(mount, name string, version int) string {
+	ret := fmt.Sprintf(`
+%s
+
+`, kvV2MountConfig(mount))
+
+	ret += fmt.Sprintf(`
+resource "vault_kv_secret_v2" "test" {
+  mount               = vault_mount.kvv2.path
+  name                = "%s"
+  data_json_wo = jsonencode(
+    {
+      zip  = "zap",
+      foo  = "bar",
+    }
+  )
+  data_json_wo_version = %d
+}`, name, version)
+
+	return ret
+}
diff --git a/vault/resource_ldap_auth_backend_group_test.go b/vault/resource_ldap_auth_backend_group_test.go
index 2ab7c432..190d056a 100644
--- a/vault/resource_ldap_auth_backend_group_test.go
+++ b/vault/resource_ldap_auth_backend_group_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"strings"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -29,9 +30,9 @@ func TestLDAPAuthBackendGroup_import(t *testing.T) {
 
 	resourceName := "vault_ldap_auth_backend_group.test"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testLDAPAuthBackendGroupDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testLDAPAuthBackendGroupDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testLDAPAuthBackendGroupConfig_basic(backend, groupname, policies),
@@ -58,9 +59,9 @@ func TestLDAPAuthBackendGroup_basic(t *testing.T) {
 
 	resourceName := "vault_ldap_auth_backend_group.test"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testLDAPAuthBackendGroupDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testLDAPAuthBackendGroupDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testLDAPAuthBackendGroupConfig_basic(backend, groupname, policies),
diff --git a/vault/resource_ldap_auth_backend_test.go b/vault/resource_ldap_auth_backend_test.go
index 27dab668..4ea743cd 100644
--- a/vault/resource_ldap_auth_backend_test.go
+++ b/vault/resource_ldap_auth_backend_test.go
@@ -4,14 +4,15 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"strings"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -23,9 +24,9 @@ func TestLDAPAuthBackend_basic(t *testing.T) {
 
 	resourceName := "vault_ldap_auth_backend.test"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testLDAPAuthBackendDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testLDAPAuthBackendDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testLDAPAuthBackendConfig_basic(path, "true", "true"),
@@ -58,9 +59,9 @@ func TestLDAPAuthBackend_tls(t *testing.T) {
 
 	resourceName := "vault_ldap_auth_backend.test"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testLDAPAuthBackendDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testLDAPAuthBackendDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testLDAPAuthBackendConfig_tls(path, "true", "true"),
@@ -96,8 +97,8 @@ func TestLDAPAuthBackend_remount(t *testing.T) {
 	resourceName := "vault_ldap_auth_backend.test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testLDAPAuthBackendConfig_basic(path, "true", "true"),
@@ -126,7 +127,7 @@ func TestLDAPAuthBackend_automatedRotation(t *testing.T) {
 	resourceName := "vault_ldap_auth_backend.test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion119)
diff --git a/vault/resource_ldap_auth_backend_user_test.go b/vault/resource_ldap_auth_backend_user_test.go
index d2186c1e..1d36a82e 100644
--- a/vault/resource_ldap_auth_backend_user_test.go
+++ b/vault/resource_ldap_auth_backend_user_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"strings"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -34,9 +35,9 @@ func TestLDAPAuthBackendUser_basic(t *testing.T) {
 
 	resourceName := "vault_ldap_auth_backend_user.test"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testLDAPAuthBackendUserDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testLDAPAuthBackendUserDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testLDAPAuthBackendUserConfig_basic(backend, username, policies, groups),
@@ -63,9 +64,9 @@ func TestLDAPAuthBackendUser_noGroups(t *testing.T) {
 
 	resourceName := "vault_ldap_auth_backend_user.test"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testLDAPAuthBackendUserDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testLDAPAuthBackendUserDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testLDAPAuthBackendUserConfig_basic(backend, username, policies, groups),
@@ -94,9 +95,9 @@ func TestLDAPAuthBackendUser_oneGroup(t *testing.T) {
 
 	resourceName := "vault_ldap_auth_backend_user.test"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testLDAPAuthBackendUserDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testLDAPAuthBackendUserDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testLDAPAuthBackendUserConfig_basic(backend, username, policies, groups),
diff --git a/vault/resource_ldap_secret_backend_dynamic_role_test.go b/vault/resource_ldap_secret_backend_dynamic_role_test.go
index 4482ce97..d20657a5 100644
--- a/vault/resource_ldap_secret_backend_dynamic_role_test.go
+++ b/vault/resource_ldap_secret_backend_dynamic_role_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -34,7 +35,7 @@ func TestAccLDAPSecretBackendDynamicRole(t *testing.T) {
 	resourceName := resourceType + ".role"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion112)
diff --git a/vault/resource_ldap_secret_backend_library_set_test.go b/vault/resource_ldap_secret_backend_library_set_test.go
index 9939d01d..162802f6 100644
--- a/vault/resource_ldap_secret_backend_library_set_test.go
+++ b/vault/resource_ldap_secret_backend_library_set_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -21,7 +22,7 @@ func TestAccLDAPSecretBackendLibrarySet(t *testing.T) {
 	resourceName := resourceType + ".set"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion112)
diff --git a/vault/resource_ldap_secret_backend_static_role_test.go b/vault/resource_ldap_secret_backend_static_role_test.go
index c966b48d..6768c03f 100644
--- a/vault/resource_ldap_secret_backend_static_role_test.go
+++ b/vault/resource_ldap_secret_backend_static_role_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -28,7 +29,7 @@ func TestAccLDAPSecretBackendStaticRole(t *testing.T) {
 		updatedRotationPeriod = "120"
 	)
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion112)
diff --git a/vault/resource_ldap_secret_backend_test.go b/vault/resource_ldap_secret_backend_test.go
index 01214b3a..55105ae3 100644
--- a/vault/resource_ldap_secret_backend_test.go
+++ b/vault/resource_ldap_secret_backend_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -38,7 +39,7 @@ func TestLDAPSecretBackend(t *testing.T) {
 		updatedUserDN         = "CN=Users,DC=corp,DC=hashicorp,DC=com"
 	)
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion112)
@@ -114,7 +115,7 @@ func TestLDAPSecretBackend_SchemaAD(t *testing.T) {
 		url = testutil.SkipTestEnvUnset(t, "AD_URL")[0]
 	)
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion112)
@@ -194,7 +195,7 @@ func TestLDAPSecretBackend_automatedRotation(t *testing.T) {
 		resourceName        = resourceType + ".test"
 	)
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion119)
diff --git a/vault/resource_managed_keys_test.go b/vault/resource_managed_keys_test.go
index 1f3a765b..2b6ddfd2 100644
--- a/vault/resource_managed_keys_test.go
+++ b/vault/resource_managed_keys_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"regexp"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -24,8 +25,8 @@ func TestManagedKeys(t *testing.T) {
 	resourceName := "vault_managed_keys.test"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestEntPreCheck(t) },
-		ProviderFactories: providerFactories,
+		PreCheck:                 func() { testutil.TestEntPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				PreConfig: func() {
@@ -179,8 +180,8 @@ func TestManagedKeysPKCS(t *testing.T) {
 	library, slot, pin := testutil.GetTestPKCSCreds(t)
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestEntPreCheck(t) },
-		ProviderFactories: providerFactories,
+		PreCheck:                 func() { testutil.TestEntPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config: testManagedKeysConfig_pkcs(name, library, slot, pin),
diff --git a/vault/resource_mfa_duo_test.go b/vault/resource_mfa_duo_test.go
index 12463f25..232b0ca1 100644
--- a/vault/resource_mfa_duo_test.go
+++ b/vault/resource_mfa_duo_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 )
@@ -19,8 +20,8 @@ func TestMFADuoBasic(t *testing.T) {
 	resourceName := "vault_mfa_duo.test"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestEntPreCheck(t) },
-		ProviderFactories: providerFactories,
+		PreCheck:                 func() { testutil.TestEntPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config: testMFADuoConfig(mfaDuoPath),
diff --git a/vault/resource_mfa_okta_test.go b/vault/resource_mfa_okta_test.go
index 89c201fa..92011a7b 100644
--- a/vault/resource_mfa_okta_test.go
+++ b/vault/resource_mfa_okta_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 )
@@ -18,8 +19,8 @@ func TestMFAOktaBasic(t *testing.T) {
 	resourceName := "vault_mfa_okta.test"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestEntPreCheck(t) },
-		ProviderFactories: providerFactories,
+		PreCheck:                 func() { testutil.TestEntPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config: testMFAOktaConfig(path),
diff --git a/vault/resource_mfa_pingid_test.go b/vault/resource_mfa_pingid_test.go
index 9c69f25f..28f03ab2 100644
--- a/vault/resource_mfa_pingid_test.go
+++ b/vault/resource_mfa_pingid_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -21,8 +22,8 @@ func TestMFAPingIDBasic(t *testing.T) {
 	resourceName := "vault_mfa_pingid.test"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestEntPreCheck(t) },
-		ProviderFactories: providerFactories,
+		PreCheck:                 func() { testutil.TestEntPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config: testMFAPingIDConfig(path, settingsFile),
diff --git a/vault/resource_mfa_totp_test.go b/vault/resource_mfa_totp_test.go
index 9932a2b9..c5eba8d3 100644
--- a/vault/resource_mfa_totp_test.go
+++ b/vault/resource_mfa_totp_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -21,8 +22,8 @@ func TestMFATOTPBasic(t *testing.T) {
 
 	var id string
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestEntPreCheck(t) },
-		ProviderFactories: providerFactories,
+		PreCheck:                 func() { testutil.TestEntPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		Steps: []resource.TestStep{
 			{
 				Config: testMFATOTPConfig(path, 20),
diff --git a/vault/resource_mongodbatlas_secret_backend_test.go b/vault/resource_mongodbatlas_secret_backend_test.go
index 661a2435..62b9e506 100644
--- a/vault/resource_mongodbatlas_secret_backend_test.go
+++ b/vault/resource_mongodbatlas_secret_backend_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 )
@@ -23,9 +24,9 @@ func TestAccMongoDBAtlasSecretBackend_basic(t *testing.T) {
 	updatedPublicKey := "klpruxce"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeMongoDBAtlas, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeMongoDBAtlas, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccMongoDBAtlasSecretBackendConfig_basic(mount, privateKey, publicKey),
diff --git a/vault/resource_mongodbatlas_secret_role_test.go b/vault/resource_mongodbatlas_secret_role_test.go
index edbebb1d..41143ac8 100644
--- a/vault/resource_mongodbatlas_secret_role_test.go
+++ b/vault/resource_mongodbatlas_secret_role_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -37,9 +38,9 @@ func TestAccMongoDBAtlasSecretRole_basic(t *testing.T) {
 	updatedMaxTtl := "120"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeMongoDBAtlas, consts.FieldMount),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeMongoDBAtlas, consts.FieldMount),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccMongoDBAtlasSecretBackendRole_initial(mount, name),
diff --git a/vault/resource_mount_test.go b/vault/resource_mount_test.go
index 4b2a4e69..f1ed5f8d 100644
--- a/vault/resource_mount_test.go
+++ b/vault/resource_mount_test.go
@@ -4,14 +4,15 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"reflect"
 	"strings"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/vault/api"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -29,8 +30,8 @@ type testMountConfig struct {
 func TestZeroTTLDoesNotCauseUpdate(t *testing.T) {
 	path := acctest.RandomWithPrefix("example")
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: fmt.Sprintf(`
@@ -69,8 +70,8 @@ func TestResourceMount(t *testing.T) {
 		description: "updated",
 	}
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testResourceMount_initialConfig(cfg),
@@ -93,8 +94,8 @@ func TestResourceMount(t *testing.T) {
 func TestResourceMount_Local(t *testing.T) {
 	path := "example-" + acctest.RandString(10)
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testResourceMount_InitialConfigLocalMount(path),
@@ -113,8 +114,8 @@ func TestResourceMount_Local(t *testing.T) {
 func TestResourceMount_SealWrap(t *testing.T) {
 	path := "example-" + acctest.RandString(10)
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testResourceMount_InitialConfigSealWrap(path),
@@ -138,8 +139,8 @@ func TestResourceMount_AuditNonHMACRequestKeys(t *testing.T) {
 	expectReqKeysUpdate := []string{"test3request", "test4request"}
 	expectRespKeysUpdate := []string{"test3response", "test4response"}
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testResourceMount_AuditNonHMACRequestKeysConfig(path, expectReqKeysNew, expectRespKeysNew),
@@ -189,8 +190,8 @@ func TestResourceMount_KVV2(t *testing.T) {
 		description: "Example mount for testing",
 	}
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: kvv2Cfg,
@@ -209,8 +210,8 @@ func TestResourceMount_KVV2(t *testing.T) {
 func TestResourceMount_ExternalEntropyAccess(t *testing.T) {
 	path := acctest.RandomWithPrefix("example")
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testResourceMount_InitialConfigExternalEntropyAccess(path),
@@ -241,7 +242,7 @@ func TestResourceMount_IDTokenKey(t *testing.T) {
 
 	resourceName := "vault_mount.test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion116)
@@ -304,8 +305,8 @@ func TestResourceMountMangedKeys(t *testing.T) {
 	resourceName := "vault_mount.test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestEntPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestEntPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testResourceMount_managedKeysConfig(keyName, path, false),
diff --git a/vault/resource_namespace_test.go b/vault/resource_namespace_test.go
index ba71980f..a3fd4a8b 100644
--- a/vault/resource_namespace_test.go
+++ b/vault/resource_namespace_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"regexp"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -44,9 +45,9 @@ func TestAccNamespace(t *testing.T) {
 	}
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestEntPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testNamespaceDestroy(namespacePath),
+		PreCheck:                 func() { testutil.TestEntPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testNamespaceDestroy(namespacePath),
 		Steps: []resource.TestStep{
 			{
 				Config: testNestedNamespaces(namespacePath, 3),
diff --git a/vault/resource_nomad_secret_backend_test.go b/vault/resource_nomad_secret_backend_test.go
index b306e050..5a6f4257 100644
--- a/vault/resource_nomad_secret_backend_test.go
+++ b/vault/resource_nomad_secret_backend_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -22,7 +23,7 @@ func TestAccNomadSecretBackend(t *testing.T) {
 	resourceType := "vault_nomad_secret_backend"
 	resourceName := resourceType + ".test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories:         providerFactories,
+		ProtoV5ProviderFactories:  testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck:                  func() { testutil.TestAccPreCheck(t) },
 		PreventPostDestroyRefresh: true,
 		CheckDestroy:              testCheckMountDestroyed(resourceType, consts.MountTypeNomad, consts.FieldBackend),
@@ -75,8 +76,8 @@ func TestNomadSecretBackend_remount(t *testing.T) {
 	address, token := testutil.GetTestNomadCreds(t)
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testNomadSecretBackendConfig(backend, address, token, 60, 30, 3600, 7200),
diff --git a/vault/resource_nomad_secret_role_test.go b/vault/resource_nomad_secret_role_test.go
index 54206de7..8e551b84 100644
--- a/vault/resource_nomad_secret_role_test.go
+++ b/vault/resource_nomad_secret_role_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -20,9 +21,9 @@ func TestAccNomadSecretBackendRoleClientBasic(t *testing.T) {
 	address, token := testutil.GetTestNomadCreds(t)
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccNomadSecretBackendRoleCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccNomadSecretBackendRoleCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testNomadSecretBackendRoleClientConfig(backend, address, token, "bob", "readonly", true),
@@ -43,9 +44,9 @@ func TestAccNomadSecretBackendRoleManagementBasic(t *testing.T) {
 	address, token := testutil.GetTestNomadCreds(t)
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccNomadSecretBackendRoleCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccNomadSecretBackendRoleCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testNomadSecretBackendRoleManagementConfig(backend, address, token, "bob", false),
@@ -65,9 +66,9 @@ func TestAccNomadSecretBackendRoleImport(t *testing.T) {
 	address, token := testutil.GetTestNomadCreds(t)
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccADSecretBackendRoleCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccADSecretBackendRoleCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testNomadSecretBackendRoleClientConfig(backend, address, token, "bob", "readonly", true),
diff --git a/vault/resource_okta_auth_backend_group_test.go b/vault/resource_okta_auth_backend_group_test.go
index e8a62a5e..8e2b7340 100644
--- a/vault/resource_okta_auth_backend_group_test.go
+++ b/vault/resource_okta_auth_backend_group_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"strconv"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -24,9 +25,9 @@ func TestAccOktaAuthBackendGroup_basic(t *testing.T) {
 	resourceName := "vault_okta_auth_backend_group.test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccOktaAuthBackendGroup_Destroyed(path, "foo"),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccOktaAuthBackendGroup_Destroyed(path, "foo"),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOktaAuthGroupConfig_basic(path, organization),
@@ -56,9 +57,9 @@ func TestAccOktaAuthBackendGroup_specialChar(t *testing.T) {
 	resourceName := "vault_okta_auth_backend_group.test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccOktaAuthBackendGroup_Destroyed(path, "foo/bar"),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccOktaAuthBackendGroup_Destroyed(path, "foo/bar"),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOktaAuthGroupConfig_specialChar(path, organization),
diff --git a/vault/resource_okta_auth_backend_test.go b/vault/resource_okta_auth_backend_test.go
index 90e11681..6c96d4b1 100644
--- a/vault/resource_okta_auth_backend_test.go
+++ b/vault/resource_okta_auth_backend_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -22,9 +23,9 @@ func TestAccOktaAuthBackend_basic(t *testing.T) {
 	resourceName := resourceType + ".test"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeOkta, consts.FieldPath),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeOkta, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOktaAuthConfig_basic(path, organization),
@@ -72,9 +73,9 @@ func TestAccOktaAuthBackend_import(t *testing.T) {
 	resourceName := resourceType + ".test"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeOkta, consts.FieldPath),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeOkta, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOktaAuthConfig_basic(path, organization),
@@ -98,8 +99,7 @@ func TestAccOktaAuthBackend_import(t *testing.T) {
 			testutil.GetImportTestStep(resourceName, false, nil,
 				"token",
 				"disable_remount",
-				"ttl",
-				"max_ttl"),
+			),
 			{
 				Config: testAccOktaAuthConfig_updated(path, organization),
 				Check: resource.ComposeTestCheckFunc(
@@ -118,8 +118,7 @@ func TestAccOktaAuthBackend_import(t *testing.T) {
 			testutil.GetImportTestStep(resourceName, false, nil,
 				"token",
 				"disable_remount",
-				"ttl",
-				"max_ttl"),
+			),
 		},
 	})
 }
@@ -132,9 +131,9 @@ func TestAccOktaAuthBackend_groups_optional(t *testing.T) {
 	resourceName := resourceType + ".test"
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeOkta, consts.FieldPath),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeOkta, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOktaAuthConfig_groups_optional(path, organization),
@@ -159,8 +158,8 @@ func TestAccOktaAuthBackend_remount(t *testing.T) {
 	resourceName := "vault_okta_auth_backend.test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOktaAuthConfig_basic(path, organization),
@@ -185,8 +184,7 @@ func TestAccOktaAuthBackend_remount(t *testing.T) {
 			testutil.GetImportTestStep(resourceName, false, nil,
 				"token",
 				"disable_remount",
-				"ttl",
-				"max_ttl"),
+			),
 		},
 	})
 }
@@ -198,8 +196,8 @@ func TestAccOktaAuthBackend_TokenFields(t *testing.T) {
 	resourceName := "vault_okta_auth_backend.test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOktaAuthConfig_tokenFields(path, organization),
@@ -216,8 +214,7 @@ func TestAccOktaAuthBackend_TokenFields(t *testing.T) {
 			testutil.GetImportTestStep(resourceName, false, nil,
 				"token",
 				"disable_remount",
-				"ttl",
-				"max_ttl"),
+			),
 		},
 	})
 }
diff --git a/vault/resource_okta_auth_backend_user_test.go b/vault/resource_okta_auth_backend_user_test.go
index 6d2e10ec..c448d094 100644
--- a/vault/resource_okta_auth_backend_user_test.go
+++ b/vault/resource_okta_auth_backend_user_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"strconv"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -24,9 +25,9 @@ func TestAccOktaAuthBackendUser(t *testing.T) {
 	resourceName := "vault_okta_auth_backend_user.test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccOktaAuthBackendUser_Destroyed(path, "user_test"),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccOktaAuthBackendUser_Destroyed(path, "user_test"),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccOktaAuthUserConfig(path, organization),
diff --git a/vault/resource_password_policy_test.go b/vault/resource_password_policy_test.go
deleted file mode 100644
index d1a22c6b..00000000
--- a/vault/resource_password_policy_test.go
+++ /dev/null
@@ -1,98 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
-package vault
-
-import (
-	"fmt"
-	"testing"
-
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
-
-	"github.com/hashicorp/terraform-provider-vault/internal/provider"
-	"github.com/hashicorp/terraform-provider-vault/testutil"
-)
-
-func TestAccPasswordPolicy(t *testing.T) {
-	policyName := acctest.RandomWithPrefix("test-policy")
-	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccPasswordPolicyCheckDestroy,
-		Steps: []resource.TestStep{
-			{
-				Config: testAccPasswordPolicy(policyName, "length = 20\nrule \"charset\" {\n  charset = \"abcde\"\n}\n"),
-				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttr("vault_password_policy.test", "name", policyName),
-					resource.TestCheckResourceAttrSet("vault_password_policy.test", "policy"),
-				),
-			},
-			{
-				Config: testAccPasswordPolicy(policyName, "length = 20\nrule \"charset\" {\n  charset = \"abcde\"\n}\nrule \"charset\" {\n  charset = \"1234567890\"\nmin-chars = 1\n}\n"),
-				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttr("vault_password_policy.test", "name", policyName),
-					resource.TestCheckResourceAttrSet("vault_password_policy.test", "policy"),
-				),
-			},
-		},
-	})
-}
-
-func TestAccPasswordPolicy_import(t *testing.T) {
-	policyName := acctest.RandomWithPrefix("test-policy")
-
-	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccPasswordPolicyCheckDestroy,
-		Steps: []resource.TestStep{
-			{
-				Config: testAccPasswordPolicy(policyName, "length = 20\nrule \"charset\" {\n  charset = \"abcde\"\n}\n"),
-				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttr("vault_password_policy.test", "name", policyName),
-					resource.TestCheckResourceAttrSet("vault_password_policy.test", "policy"),
-				),
-			},
-			{
-				ResourceName:      "vault_password_policy.test",
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
-		},
-	})
-}
-
-func testAccPasswordPolicyCheckDestroy(s *terraform.State) error {
-	for _, rs := range s.RootModule().Resources {
-		if rs.Type != "vault_password_policy" {
-			continue
-		}
-
-		client, e := provider.GetClient(rs.Primary, testProvider.Meta())
-		if e != nil {
-			return e
-		}
-
-		name := rs.Primary.Attributes["name"]
-		data, err := client.Logical().Read(fmt.Sprintf("sys/policies/password/%s", name))
-		if err != nil {
-			return err
-		}
-		if data != nil {
-			return fmt.Errorf("Password policy %s still exists", name)
-		}
-	}
-	return nil
-}
-
-func testAccPasswordPolicy(policyName string, policy string) string {
-	return fmt.Sprintf(`
-resource "vault_password_policy" "test" {
-  name = "%s"
-   policy = <<EOT
-%s
-EOT
-}`, policyName, policy)
-}
diff --git a/vault/resource_pki_secret_backend_acme_eab_test.go b/vault/resource_pki_secret_backend_acme_eab_test.go
index 0b6f7df9..0dcda345 100644
--- a/vault/resource_pki_secret_backend_acme_eab_test.go
+++ b/vault/resource_pki_secret_backend_acme_eab_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -22,7 +23,7 @@ func TestAccPKISecretBackendAcmeEab(t *testing.T) {
 	resourceBackend := resourceType + ".test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion114)
diff --git a/vault/resource_pki_secret_backend_cert_test.go b/vault/resource_pki_secret_backend_cert_test.go
index 0cfec65b..d6ca5e7d 100644
--- a/vault/resource_pki_secret_backend_cert_test.go
+++ b/vault/resource_pki_secret_backend_cert_test.go
@@ -4,6 +4,7 @@
 package vault
 
 import (
+	"context"
 	"crypto/x509"
 	"encoding/pem"
 	"fmt"
@@ -15,9 +16,9 @@ import (
 	"time"
 
 	"github.com/hashicorp/go-cleanhttp"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -52,9 +53,9 @@ func TestPkiSecretBackendCert_basic(t *testing.T) {
 	}
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testPkiSecretBackendCertConfig_basic(rootPath, intermediatePath, "", true, false, false),
@@ -238,9 +239,9 @@ func TestPkiSecretBackendCert_renew(t *testing.T) {
 	}
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testPkiSecretBackendCertConfig_renew(path),
diff --git a/vault/resource_pki_secret_backend_config_acme_test.go b/vault/resource_pki_secret_backend_config_acme_test.go
index 3f860edd..e91b860a 100644
--- a/vault/resource_pki_secret_backend_config_acme_test.go
+++ b/vault/resource_pki_secret_backend_config_acme_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -21,7 +22,7 @@ func TestPkiSecretBackendConfigACME_basic(t *testing.T) {
 	resourceName := resourceType + ".test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion114)
@@ -73,7 +74,7 @@ func TestPkiSecretBackendConfigACME_basic(t *testing.T) {
 	})
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion117)
diff --git a/vault/resource_pki_secret_backend_config_auto_tidy_test.go b/vault/resource_pki_secret_backend_config_auto_tidy_test.go
index 6351dab7..0275b627 100644
--- a/vault/resource_pki_secret_backend_config_auto_tidy_test.go
+++ b/vault/resource_pki_secret_backend_config_auto_tidy_test.go
@@ -4,16 +4,17 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"github.com/hashicorp/go-version"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/stretchr/testify/require"
 	"regexp"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -100,9 +101,9 @@ func TestAccPKISecretBackendConfigAutoTidy_basic(t *testing.T) {
 		return nil
 	}
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypePKI, consts.FieldBackend),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypePKI, consts.FieldBackend),
 		Steps: []resource.TestStep{
 			{
 				Config:      testAccPKISecretBackendConfigAutoTidy_basic(backend, `enabled = true`),
@@ -319,7 +320,7 @@ func TestAccPKISecretBackendConfigAutoTidy_ent(t *testing.T) {
 	}
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			testutil.TestEntPreCheck(t)
diff --git a/vault/resource_pki_secret_backend_config_ca_test.go b/vault/resource_pki_secret_backend_config_ca_test.go
index 80cd097c..5be56229 100644
--- a/vault/resource_pki_secret_backend_config_ca_test.go
+++ b/vault/resource_pki_secret_backend_config_ca_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"strconv"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -21,9 +22,9 @@ func TestPkiSecretBackendConfigCA_basic(t *testing.T) {
 	resourceName := "vault_pki_secret_backend_config_ca.test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testPkiSecretBackendConfigCAConfig_basic(path),
diff --git a/vault/resource_pki_secret_backend_config_cluster_test.go b/vault/resource_pki_secret_backend_config_cluster_test.go
index 85f00409..004292dc 100644
--- a/vault/resource_pki_secret_backend_config_cluster_test.go
+++ b/vault/resource_pki_secret_backend_config_cluster_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -24,7 +25,7 @@ func TestPkiSecretBackendConfigCluster_basic(t *testing.T) {
 	clusterAiaPath := "http://127.0.0.1:8200/v1/pki"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion113)
diff --git a/vault/resource_pki_secret_backend_config_cmpv2_test.go b/vault/resource_pki_secret_backend_config_cmpv2_test.go
index 018db936..6f816229 100644
--- a/vault/resource_pki_secret_backend_config_cmpv2_test.go
+++ b/vault/resource_pki_secret_backend_config_cmpv2_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -24,7 +25,7 @@ func TestAccPKISecretBackendConfigCMPV2_Empty(t *testing.T) {
 	dataName := "data.vault_pki_secret_backend_config_cmpv2.test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			testutil.TestEntPreCheck(t)
@@ -67,7 +68,7 @@ func TestAccPKISecretBackendConfigCMPV2_AllFields_Pre1185(t *testing.T) {
 	dataName := "data.vault_pki_secret_backend_config_cmpv2.test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			testutil.TestEntPreCheck(t)
@@ -118,7 +119,7 @@ func TestAccPKISecretBackendConfigCMPV2_AllFields(t *testing.T) {
 	dataName := "data.vault_pki_secret_backend_config_cmpv2.test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			testutil.TestEntPreCheck(t)
diff --git a/vault/resource_pki_secret_backend_config_est_test.go b/vault/resource_pki_secret_backend_config_est_test.go
index af6c25e8..93e7478f 100644
--- a/vault/resource_pki_secret_backend_config_est_test.go
+++ b/vault/resource_pki_secret_backend_config_est_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -24,7 +25,7 @@ func TestAccPKISecretBackendConfigEst_Empty(t *testing.T) {
 	dataName := "data.vault_pki_secret_backend_config_est.test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			testutil.TestEntPreCheck(t)
@@ -74,7 +75,7 @@ func TestAccPKISecretBackendConfigEst_AllFields(t *testing.T) {
 	dataName := "data.vault_pki_secret_backend_config_est.test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			testutil.TestEntPreCheck(t)
diff --git a/vault/resource_pki_secret_backend_config_issuers_test.go b/vault/resource_pki_secret_backend_config_issuers_test.go
index 2c4915d2..61f54629 100644
--- a/vault/resource_pki_secret_backend_config_issuers_test.go
+++ b/vault/resource_pki_secret_backend_config_issuers_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -23,7 +24,7 @@ func TestAccPKISecretBackendConfigIssuers_basic(t *testing.T) {
 	resourceName := resourceType + ".test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion111)
diff --git a/vault/resource_pki_secret_backend_config_urls_test.go b/vault/resource_pki_secret_backend_config_urls_test.go
index e406e765..05c37513 100644
--- a/vault/resource_pki_secret_backend_config_urls_test.go
+++ b/vault/resource_pki_secret_backend_config_urls_test.go
@@ -4,15 +4,16 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"strconv"
 	"strings"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -62,9 +63,9 @@ func TestPkiSecretBackendConfigUrls_basic(t *testing.T) {
 	}
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				// Test that reading from an unconfigured mount succeeds
diff --git a/vault/resource_pki_secret_backend_crl_config_test.go b/vault/resource_pki_secret_backend_crl_config_test.go
index 1abc0596..6c1aef63 100644
--- a/vault/resource_pki_secret_backend_crl_config_test.go
+++ b/vault/resource_pki_secret_backend_crl_config_test.go
@@ -4,14 +4,15 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"os"
 	"strconv"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -162,10 +163,10 @@ func setupCRLConfigTest(t *testing.T, preCheck func(), ignoreImportFields ...str
 		testutil.GetImportTestStep(resourceName, false, nil, ignoreImportFields...),
 	}
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          preCheck,
-		CheckDestroy:      testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
-		Steps:             steps,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 preCheck,
+		CheckDestroy:             testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
+		Steps:                    steps,
 	})
 }
 
diff --git a/vault/resource_pki_secret_backend_intermediate_cert_request_test.go b/vault/resource_pki_secret_backend_intermediate_cert_request_test.go
index 27f91784..451c46f6 100644
--- a/vault/resource_pki_secret_backend_intermediate_cert_request_test.go
+++ b/vault/resource_pki_secret_backend_intermediate_cert_request_test.go
@@ -4,15 +4,16 @@
 package vault
 
 import (
+	"context"
 	"crypto/x509"
 	"encoding/pem"
 	"fmt"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"strconv"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -32,9 +33,9 @@ func TestPkiSecretBackendIntermediateCertRequest_basic(t *testing.T) {
 	}
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testPkiSecretBackendIntermediateCertRequestConfig_basic(path, false),
@@ -58,9 +59,9 @@ func TestPkiSecretBackendIntermediateCertRequest_managedKeys(t *testing.T) {
 
 	resourceName := "vault_pki_secret_backend_intermediate_cert_request.test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testPkiSecretBackendIntermediateCertRequestConfig_managedKeys(path, keyName, accessKey, secretKey),
@@ -92,9 +93,9 @@ func TestPkiSecretBackendIntermediateCertRequest_signature_bits(t *testing.T) {
 	}
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testPkiSecretBackendIntermediateCertRequestConfig_signature_bits(path, ""),
@@ -172,9 +173,9 @@ func TestPkiSecretBackendIntermediateCertRequest_key_usage(t *testing.T) {
 	}
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testPkiSecretBackendIntermediateCertRequestConfig_key_usage(path, ""),
@@ -214,9 +215,9 @@ func TestPkiSecretBackendIntermediateCertRequest_serial_number(t *testing.T) {
 	}
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testPkiSecretBackendIntermediateCertRequestConfig_serial_number(path, ""),
@@ -264,7 +265,7 @@ func TestPkiSecretBackendIntermediateCertificate_multiIssuer(t *testing.T) {
 	)
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion111)
diff --git a/vault/resource_pki_secret_backend_intermediate_set_signed_test.go b/vault/resource_pki_secret_backend_intermediate_set_signed_test.go
index 704c0dab..58f8faa0 100644
--- a/vault/resource_pki_secret_backend_intermediate_set_signed_test.go
+++ b/vault/resource_pki_secret_backend_intermediate_set_signed_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"strconv"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -22,9 +23,9 @@ func TestPkiSecretBackendIntermediateSetSigned_basic(t *testing.T) {
 
 	resourceName := "vault_pki_secret_backend_intermediate_set_signed.test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testPkiSecretBackendIntermediateSetSignedConfig_basic(rootPath, intermediatePath),
@@ -42,7 +43,7 @@ func TestPkiSecretBackendIntermediateSetSigned_multiIssuers(t *testing.T) {
 
 	resourceName := "vault_pki_secret_backend_intermediate_set_signed.test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion111)
diff --git a/vault/resource_pki_secret_backend_issuer_test.go b/vault/resource_pki_secret_backend_issuer_test.go
index ca6de772..c7c9d87d 100644
--- a/vault/resource_pki_secret_backend_issuer_test.go
+++ b/vault/resource_pki_secret_backend_issuer_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"regexp"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -24,7 +25,7 @@ func TestAccPKISecretBackendIssuer_basic(t *testing.T) {
 	issuerName := acctest.RandomWithPrefix("tf-pki-issuer")
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion111)
@@ -98,7 +99,7 @@ func TestAccPKISecretBackendIssuer_verify_disable_fields(t *testing.T) {
 		consts.FieldDisableNameConstraintChecks)
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion119)
diff --git a/vault/resource_pki_secret_backend_key_test.go b/vault/resource_pki_secret_backend_key_test.go
index 6220d9a0..463e79cc 100644
--- a/vault/resource_pki_secret_backend_key_test.go
+++ b/vault/resource_pki_secret_backend_key_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -31,7 +32,7 @@ func TestAccPKISecretBackendKey_basic(t *testing.T) {
 	store := &testPKIKeyStore{}
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion111)
diff --git a/vault/resource_pki_secret_backend_role_test.go b/vault/resource_pki_secret_backend_role_test.go
index bfec9357..e44669e3 100644
--- a/vault/resource_pki_secret_backend_role_test.go
+++ b/vault/resource_pki_secret_backend_role_test.go
@@ -4,14 +4,15 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"regexp"
 	"testing"
 	"time"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 )
@@ -80,9 +81,9 @@ func TestPkiSecretBackendRole_policy_identifier(t *testing.T) {
 		resource.TestCheckResourceAttr(resourceName, "not_before_duration", "45m"),
 	}
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testPkiSecretBackendRoleCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testPkiSecretBackendRoleCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testPkiSecretBackendRoleConfig_basic(name, backend, 3600, 7200, testLegacyPolicyIdentifiers),
@@ -117,9 +118,9 @@ func TestPkiSecretBackendRole_policy_identifier(t *testing.T) {
 	})
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testPkiSecretBackendRoleCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testPkiSecretBackendRoleCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config:      testPkiSecretBackendRoleConfig_basic(name, backend, 3600, 7200, combinedPolicyIdentifiers),
@@ -189,9 +190,9 @@ func TestPkiSecretBackendRole_basic(t *testing.T) {
 		resource.TestCheckTypeSetElemAttr(resourceName, "cn_validations.*", "hostname"),
 	}
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testPkiSecretBackendRoleCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testPkiSecretBackendRoleCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testPkiSecretBackendRoleConfig_basic(name, backend, 3600, 7200, testLegacyPolicyIdentifiers),
diff --git a/vault/resource_pki_secret_backend_root_cert_test.go b/vault/resource_pki_secret_backend_root_cert_test.go
index 523532df..2578de20 100644
--- a/vault/resource_pki_secret_backend_root_cert_test.go
+++ b/vault/resource_pki_secret_backend_root_cert_test.go
@@ -4,19 +4,20 @@
 package vault
 
 import (
+	"context"
 	"crypto/x509"
 	"encoding/pem"
 	"errors"
 	"fmt"
 	"github.com/go-test/deep"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"reflect"
 	"strconv"
 	"testing"
 	"time"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -189,7 +190,7 @@ func testPkiSecretBackendRootCertificate(t *testing.T, path string, config strin
 	store := &testPKICertStore{}
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			if preCheck != nil {
@@ -294,7 +295,7 @@ func TestPkiSecretBackendRootCertificate_multiIssuer(t *testing.T) {
 	)
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion111)
@@ -337,7 +338,7 @@ func TestAccPKISecretBackendRootCert_multipleRootCerts(t *testing.T) {
 	resourceNextIssuer := resourceType + ".next"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion111)
@@ -376,9 +377,9 @@ func TestPkiSecretBackendRootCertificate_managedKeys(t *testing.T) {
 	}
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testPkiSecretBackendRootCertificateConfig_managedKeys(path, managedKeyName, accessKey, secretKey),
diff --git a/vault/resource_pki_secret_backend_root_sign_intermediate_test.go b/vault/resource_pki_secret_backend_root_sign_intermediate_test.go
index ea72e9a3..2bd6d24e 100644
--- a/vault/resource_pki_secret_backend_root_sign_intermediate_test.go
+++ b/vault/resource_pki_secret_backend_root_sign_intermediate_test.go
@@ -5,6 +5,7 @@ package vault
 
 import (
 	"bytes"
+	"context"
 	"crypto/x509"
 	"encoding/base64"
 	"encoding/pem"
@@ -17,10 +18,10 @@ import (
 
 	"github.com/hashicorp/go-version"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/vault/api"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
@@ -135,9 +136,9 @@ func TestPkiSecretBackendRootSignIntermediate_basic_default(t *testing.T) {
 	checks := testCheckPKISecretRootSignIntermediate(resourceName, rootPath, commonName, format, "", x509.SHA256WithRSA, false)
 	store := &testPKICertStore{}
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testPkiSecretBackendRootSignIntermediateConfig_basic(rootPath, intermediatePath, false),
@@ -203,6 +204,25 @@ func TestPkiSecretBackendRootSignIntermediate_basic_default(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, consts.FieldUsePSS, "true"),
 				),
 			},
+			{
+				SkipFunc: skip(provider.VaultVersion118),
+				Config: testPkiSecretBackendRootSignIntermediateConfig_basic(rootPath, intermediatePath, false,
+					`key_usage = ["CertSign", "DigitalSignature"]`),
+				Check: resource.ComposeTestCheckFunc(
+					checks,
+					resource.TestCheckResourceAttr(resourceName, consts.FieldKeyUsage+".#", "2"),
+					resource.TestCheckResourceAttr(resourceName, consts.FieldKeyUsage+".0", "CertSign"),
+					resource.TestCheckResourceAttr(resourceName, consts.FieldKeyUsage+".1", "DigitalSignature"),
+					testPKICert(resourceName, func(cert *x509.Certificate) error {
+						if 0 == cert.KeyUsage&x509.KeyUsageCertSign {
+							return fmt.Errorf("KeyUsage expected %b, got %b",
+								x509.KeyUsageKeyAgreement|x509.KeyUsageCertSign,
+								cert.KeyUsage)
+						}
+						return nil
+					}),
+				),
+			},
 		},
 	})
 }
@@ -213,9 +233,9 @@ func TestPkiSecretBackendRootSignIntermediate_basic_pem(t *testing.T) {
 	commonName := "SubOrg Intermediate CA"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testPkiSecretBackendRootSignIntermediateConfig_basic(rootPath, intermediatePath, false, `format = "pem"`),
@@ -231,9 +251,9 @@ func TestPkiSecretBackendRootSignIntermediate_basic_der(t *testing.T) {
 	commonName := "SubOrg Intermediate CA"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testPkiSecretBackendRootSignIntermediateConfig_basic(rootPath, intermediatePath, false, `format = "der"`),
@@ -249,9 +269,9 @@ func TestPkiSecretBackendRootSignIntermediate_basic_pem_bundle(t *testing.T) {
 	commonName := "SubOrg Intermediate CA"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testPkiSecretBackendRootSignIntermediateConfig_basic(rootPath, intermediatePath, false, `format = "pem_bundle"`),
@@ -272,9 +292,9 @@ func TestPkiSecretBackendRootSignIntermediate_not_after(t *testing.T) {
 	notAfterTime := time.Now().Add(5 * time.Hour)
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testPkiSecretBackendRootSignIntermediateConfig_basic(rootPath, intermediatePath, false, `format = "der"`, notAfter(notAfterTime)),
@@ -291,7 +311,7 @@ func TestPkiSecretBackendRootSignIntermediate_name_constraints_pem_bundle(t *tes
 	commonName := "SubOrg Intermediate CA"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion119)
@@ -313,7 +333,7 @@ func TestPkiSecretBackendRootSignIntermediate_signature_bits(t *testing.T) {
 	commonName := "SubOrg Intermediate CA"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 		},
@@ -348,9 +368,9 @@ func TestPkiSecretBackendRootSignIntermediate_basic_pem_bundle_multiple_intermed
 	commonName := "SubOrg Intermediate 2 CA"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testPkiSecretBackendRootSignIntermediateConfig_multiple_inter(rootPath, intermediate1Path, intermediate2Path, format),
diff --git a/vault/resource_pki_secret_backend_sign_test.go b/vault/resource_pki_secret_backend_sign_test.go
index af9f64a5..7530b66e 100644
--- a/vault/resource_pki_secret_backend_sign_test.go
+++ b/vault/resource_pki_secret_backend_sign_test.go
@@ -4,6 +4,7 @@
 package vault
 
 import (
+	"context"
 	"crypto/x509"
 	"encoding/pem"
 	"fmt"
@@ -12,9 +13,9 @@ import (
 	"testing"
 	"time"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -29,9 +30,9 @@ func TestPkiSecretBackendSign_basic(t *testing.T) {
 
 	resourceName := "vault_pki_secret_backend_sign.test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testPkiSecretBackendSignConfig_basic(rootPath, intermediatePath, ""),
@@ -182,9 +183,9 @@ func TestPkiSecretBackendSign_renew(t *testing.T) {
 		testValidateCSR(resourceName),
 	}
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed("vault_mount", consts.MountTypePKI, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testPkiSecretBackendSignConfig_renew(path, ""),
diff --git a/vault/resource_plugin_pinned_version_test.go b/vault/resource_plugin_pinned_version_test.go
index 83ed8506..ea50585d 100644
--- a/vault/resource_plugin_pinned_version_test.go
+++ b/vault/resource_plugin_pinned_version_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"os"
 	"strings"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -28,7 +29,7 @@ func TestPluginPinnedVersion(t *testing.T) {
 	resourceName := "vault_plugin_pinned_version.test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			testutil.SkipTestEnvUnset(t, envPluginCommand)
diff --git a/vault/resource_plugin_test.go b/vault/resource_plugin_test.go
index 6080f439..dc808d65 100644
--- a/vault/resource_plugin_test.go
+++ b/vault/resource_plugin_test.go
@@ -4,15 +4,16 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"os"
 	"strconv"
 	"strings"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -42,7 +43,7 @@ func TestPlugin(t *testing.T) {
 	cmd := os.Getenv(envPluginCommand)
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			testutil.SkipTestEnvUnset(t, envPluginCommand)
diff --git a/vault/resource_policy_test.go b/vault/resource_policy_test.go
index 78f1c60c..f0fa080b 100644
--- a/vault/resource_policy_test.go
+++ b/vault/resource_policy_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -18,8 +19,8 @@ import (
 func TestResourcePolicy(t *testing.T) {
 	name := acctest.RandomWithPrefix("test-")
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testResourcePolicy_initialConfig(name),
diff --git a/vault/resource_quota_lease_count_test.go b/vault/resource_quota_lease_count_test.go
index b00477eb..f2486748 100644
--- a/vault/resource_quota_lease_count_test.go
+++ b/vault/resource_quota_lease_count_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -24,9 +25,9 @@ func TestQuotaLeaseCount(t *testing.T) {
 	resourceName := "vault_quota_lease_count.foobar"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestEntPreCheck(t) },
-		CheckDestroy:      testQuotaLeaseCountCheckDestroy([]string{leaseCount, newLeaseCount}),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestEntPreCheck(t) },
+		CheckDestroy:             testQuotaLeaseCountCheckDestroy([]string{leaseCount, newLeaseCount}),
 		Steps: []resource.TestStep{
 			{
 				Config: testQuotaLeaseCountConfig(ns, name, "", leaseCount),
@@ -63,7 +64,7 @@ func TestQuotaLeaseCountRoot(t *testing.T) {
 	resourceName := "vault_quota_lease_count.foobar"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionGTE(t, testProvider.Meta(), provider.VaultVersion116)
@@ -92,7 +93,7 @@ func TestQuotaLeaseCountWithRole(t *testing.T) {
 	resourceName := "vault_quota_lease_count.foobar"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion112)
@@ -134,7 +135,7 @@ func TestQuotaLeaseCountInheritable(t *testing.T) {
 	resourceName := "vault_quota_lease_count.foobar"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion115)
@@ -192,7 +193,7 @@ func TestQuotaLeaseCountWithRoleInheritable(t *testing.T) {
 	resourceName := "vault_quota_lease_count.foobar"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion115)
diff --git a/vault/resource_quota_rate_limit_test.go b/vault/resource_quota_rate_limit_test.go
index ed5fc1d4..cd32eb57 100644
--- a/vault/resource_quota_rate_limit_test.go
+++ b/vault/resource_quota_rate_limit_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"strings"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -30,9 +31,9 @@ func TestQuotaRateLimit(t *testing.T) {
 	rateLimit := randomQuotaRateString()
 	newRateLimit := randomQuotaRateString()
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testQuotaRateLimitCheckDestroy([]string{rateLimit, newRateLimit}),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testQuotaRateLimitCheckDestroy([]string{rateLimit, newRateLimit}),
 		Steps: []resource.TestStep{
 			{
 				Config: testQuotaRateLimitConfig(name, "", rateLimit, 1, 0),
@@ -77,7 +78,7 @@ func TestQuotaRateLimitWithRole(t *testing.T) {
 	resourceName := "vault_quota_rate_limit.foobar"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion112)
@@ -122,7 +123,7 @@ func TestQuotaRateLimitInheritable(t *testing.T) {
 	resourceName := "vault_quota_rate_limit.foobar"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion115)
@@ -175,7 +176,7 @@ func TestQuotaRateLimitWithNamespaceInheritable(t *testing.T) {
 	resourceName := "vault_quota_rate_limit.foobar"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion115)
diff --git a/vault/resource_rabbitmq_secret_backend_role_test.go b/vault/resource_rabbitmq_secret_backend_role_test.go
index 8d658bf0..f8868da5 100644
--- a/vault/resource_rabbitmq_secret_backend_role_test.go
+++ b/vault/resource_rabbitmq_secret_backend_role_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -27,9 +28,9 @@ func TestAccRabbitMQSecretBackendRole_basic(t *testing.T) {
 	resourceName := "vault_rabbitmq_secret_backend_role.test"
 	connectionUri, username, password := testutil.GetTestRMQCreds(t)
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccRabbitMQSecretBackendRoleCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccRabbitMQSecretBackendRoleCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccRabbitMQSecretBackendRoleConfig_basic(name, backend, connectionUri, username, password),
@@ -70,9 +71,9 @@ func TestAccRabbitMQSecretBackendRole_nested(t *testing.T) {
 	resourceName := "vault_rabbitmq_secret_backend_role.test"
 	connectionUri, username, password := testutil.GetTestRMQCreds(t)
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccRabbitMQSecretBackendRoleCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccRabbitMQSecretBackendRoleCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccRabbitMQSecretBackendRoleConfig_basic(name, backend, connectionUri, username, password),
@@ -113,9 +114,9 @@ func TestAccRabbitMQSecretBackendRole_topic(t *testing.T) {
 	resourceName := "vault_rabbitmq_secret_backend_role.test"
 	connectionUri, username, password := testutil.GetTestRMQCreds(t)
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccRabbitMQSecretBackendRoleCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccRabbitMQSecretBackendRoleCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccRabbitMQSecretBackendRoleConfig_topics(name, backend, connectionUri, username, password),
diff --git a/vault/resource_rabbitmq_secret_backend_test.go b/vault/resource_rabbitmq_secret_backend_test.go
index b1384e8d..24cd94a9 100644
--- a/vault/resource_rabbitmq_secret_backend_test.go
+++ b/vault/resource_rabbitmq_secret_backend_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -20,9 +21,9 @@ func TestAccRabbitMQSecretBackend_basic(t *testing.T) {
 	resourceType := "vault_rabbitmq_secret_backend"
 	resourceName := resourceType + ".test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeRabbitMQ, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeRabbitMQ, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccRabbitMQSecretBackendConfig_basic(path, connectionUri, username, password),
@@ -65,9 +66,9 @@ func TestAccRabbitMQSecretBackend_template(t *testing.T) {
 	resourceType := "vault_rabbitmq_secret_backend"
 	resourceName := resourceType + ".test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeRabbitMQ, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeRabbitMQ, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccRabbitMQSecretBackendTemplateConfig(path, connectionUri, username, password, path, path),
@@ -99,8 +100,8 @@ func TestRabbitMQSecretBackend_remount(t *testing.T) {
 	connectionUri, username, password := testutil.GetTestRMQCreds(t)
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testAccRabbitMQSecretBackendConfig_basic(path, connectionUri, username, password),
diff --git a/vault/resource_raft_autopilot_test.go b/vault/resource_raft_autopilot_test.go
index 3710bae9..e1bc0d28 100644
--- a/vault/resource_raft_autopilot_test.go
+++ b/vault/resource_raft_autopilot_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"strconv"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -19,7 +20,7 @@ func TestAccRaftAutopilotConfig_basic(t *testing.T) {
 	resourceName := "vault_raft_autopilot.test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestEntPreCheck(t)
 			testutil.SkipTestEnvSet(t, "SKIP_RAFT_TESTS")
diff --git a/vault/resource_raft_snapshot_agent_config_test.go b/vault/resource_raft_snapshot_agent_config_test.go
index d10107a7..4d54581c 100644
--- a/vault/resource_raft_snapshot_agent_config_test.go
+++ b/vault/resource_raft_snapshot_agent_config_test.go
@@ -4,21 +4,22 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 )
 
 func TestAccRaftSnapshotAgentConfig_basic(t *testing.T) {
 	name := acctest.RandomWithPrefix("tf-test-raft-snapshot")
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.SkipTestEnvSet(t, "SKIP_RAFT_TESTS")
 			testutil.TestEntPreCheck(t)
@@ -105,8 +106,8 @@ func TestAccRaftSnapshotAgentConfig_import(t *testing.T) {
 			testutil.SkipTestEnvSet(t, "SKIP_RAFT_TESTS")
 			testutil.TestEntPreCheck(t)
 		},
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccRaftSnapshotAgentConfigCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccRaftSnapshotAgentConfigCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccRaftSnapshotAgentConfig_basic(name),
diff --git a/vault/resource_rgp_policy_test.go b/vault/resource_rgp_policy_test.go
index b44e9375..34cd0027 100644
--- a/vault/resource_rgp_policy_test.go
+++ b/vault/resource_rgp_policy_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -18,9 +19,9 @@ import (
 func TestAccRoleGoverningPolicy(t *testing.T) {
 	policyName := acctest.RandomWithPrefix("test-policy")
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestEntPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccRoleGoverningPolicyCheckDestroy,
+		PreCheck:                 func() { testutil.TestEntPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccRoleGoverningPolicyCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccRoleGoverningPolicy(policyName, "soft-mandatory"),
diff --git a/vault/resource_saml_auth_backend_role_test.go b/vault/resource_saml_auth_backend_role_test.go
index 91eb644f..6bbf1ea5 100644
--- a/vault/resource_saml_auth_backend_role_test.go
+++ b/vault/resource_saml_auth_backend_role_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -27,8 +28,8 @@ func TestAccSAMLAuthBackendRole_basic(t *testing.T) {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion115)
 		},
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeSAML, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeSAML, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccSAMLAuthBackendRoleConfig_basic(path, name),
diff --git a/vault/resource_saml_auth_backend_test.go b/vault/resource_saml_auth_backend_test.go
index 44895e45..0b8ad484 100644
--- a/vault/resource_saml_auth_backend_test.go
+++ b/vault/resource_saml_auth_backend_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -25,8 +26,8 @@ func TestAccSAMLAuthBackend_basic(t *testing.T) {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion115)
 		},
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeSAML, consts.FieldPath),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeSAML, consts.FieldPath),
 		Steps: []resource.TestStep{
 			{
 				Config: testAccSAMLAuthBackendConfig_basic(path),
diff --git a/vault/resource_secrets_sync_association_test.go b/vault/resource_secrets_sync_association_test.go
index 05341285..4b3d9099 100644
--- a/vault/resource_secrets_sync_association_test.go
+++ b/vault/resource_secrets_sync_association_test.go
@@ -3,11 +3,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -32,7 +33,7 @@ func TestSecretsSyncAssociation_gh(t *testing.T) {
 	repoName := values[2]
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion115)
diff --git a/vault/resource_secrets_sync_aws_destination_test.go b/vault/resource_secrets_sync_aws_destination_test.go
index 83b5a376..e47e9713 100644
--- a/vault/resource_secrets_sync_aws_destination_test.go
+++ b/vault/resource_secrets_sync_aws_destination_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -28,7 +29,7 @@ func TestAWSSecretsSyncDestination(t *testing.T) {
 	accessKey, secretKey := testutil.GetTestAWSCreds(t)
 	region := testutil.GetTestAWSRegion(t)
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion116)
diff --git a/vault/resource_secrets_sync_azure_destination_test.go b/vault/resource_secrets_sync_azure_destination_test.go
index c15c8879..21767f32 100644
--- a/vault/resource_secrets_sync_azure_destination_test.go
+++ b/vault/resource_secrets_sync_azure_destination_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -32,7 +33,7 @@ func TestAzureSecretsSyncDestination(t *testing.T) {
 	tenantID := values[3]
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion115)
diff --git a/vault/resource_secrets_sync_config_test.go b/vault/resource_secrets_sync_config_test.go
index c80ed4e5..c7018d08 100644
--- a/vault/resource_secrets_sync_config_test.go
+++ b/vault/resource_secrets_sync_config_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"regexp"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
 )
@@ -18,7 +19,7 @@ func TestSecretsSyncConfig(t *testing.T) {
 	resourceName := "vault_secrets_sync_config.test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestEntPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion116)
@@ -48,7 +49,7 @@ func TestSecretsSyncConfig(t *testing.T) {
 	})
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion115)
diff --git a/vault/resource_secrets_sync_gcp_destination_test.go b/vault/resource_secrets_sync_gcp_destination_test.go
index ff7639eb..814c51c7 100644
--- a/vault/resource_secrets_sync_gcp_destination_test.go
+++ b/vault/resource_secrets_sync_gcp_destination_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -23,7 +24,7 @@ func TestGCPSecretsSyncDestination(t *testing.T) {
 	credentials, _ := testutil.GetTestGCPCreds(t)
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion116)
diff --git a/vault/resource_secrets_sync_gh_destination_test.go b/vault/resource_secrets_sync_gh_destination_test.go
index a4efcc95..c4cebe24 100644
--- a/vault/resource_secrets_sync_gh_destination_test.go
+++ b/vault/resource_secrets_sync_gh_destination_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -33,7 +34,7 @@ func TestGithubSecretsSyncDestination(t *testing.T) {
 	repoName := values[2]
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion116)
diff --git a/vault/resource_secrets_sync_github_apps_test.go b/vault/resource_secrets_sync_github_apps_test.go
index 9e33273b..e7cf67f1 100644
--- a/vault/resource_secrets_sync_github_apps_test.go
+++ b/vault/resource_secrets_sync_github_apps_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -29,7 +30,7 @@ func TestGithubAppsSecretsSync(t *testing.T) {
 	appID := values[1]
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion116)
diff --git a/vault/resource_secrets_sync_vercel_destination_test.go b/vault/resource_secrets_sync_vercel_destination_test.go
index 47ebd74d..fcab3dcb 100644
--- a/vault/resource_secrets_sync_vercel_destination_test.go
+++ b/vault/resource_secrets_sync_vercel_destination_test.go
@@ -4,11 +4,12 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -27,7 +28,7 @@ func TestVercelSecretsSyncDestination(t *testing.T) {
 	accessToken := values[0]
 	projectID := values[1]
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion116)
diff --git a/vault/resource_ssh_secret_backend_ca_test.go b/vault/resource_ssh_secret_backend_ca_test.go
index 462eeeb6..e5aa6a29 100644
--- a/vault/resource_ssh_secret_backend_ca_test.go
+++ b/vault/resource_ssh_secret_backend_ca_test.go
@@ -4,12 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
+	"github.com/hashicorp/terraform-plugin-testing/plancheck"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -19,9 +21,9 @@ func TestAccSSHSecretBackendCA_basic(t *testing.T) {
 	backend := "ssh-" + acctest.RandString(10)
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccCheckSSHSecretBackendCADestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccCheckSSHSecretBackendCADestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccSSHSecretBackendCAConfigGenerated(backend),
@@ -35,9 +37,9 @@ func TestAccSSHSecretBackendCA_provided(t *testing.T) {
 	backend := "ssh-" + acctest.RandString(10)
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccCheckSSHSecretBackendCADestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccCheckSSHSecretBackendCADestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccSSHSecretBackendCAConfigProvided(backend),
@@ -50,8 +52,8 @@ func TestAccSSHSecretBackendCA_provided(t *testing.T) {
 func TestAccSSHSecretBackend_import(t *testing.T) {
 	backend := "ssh-" + acctest.RandString(10)
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
 		Steps: []resource.TestStep{
 			{
 				Config: testAccSSHSecretBackendCAConfigGenerated(backend),
@@ -87,9 +89,13 @@ func TestAccSSHSecretBackendCA_Upgrade_key_type(t *testing.T) {
 				Check:  testAccSSHSecretBackendCACheck(backend),
 			},
 			{
-				ProviderFactories: providerFactories,
-				Config:            testAccSSHSecretBackendCAConfigGenerated(backend),
-				PlanOnly:          true,
+				ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+				Config:                   testAccSSHSecretBackendCAConfigGenerated(backend),
+				ConfigPlanChecks: resource.ConfigPlanChecks{
+					PreApply: []plancheck.PlanCheck{
+						plancheck.ExpectEmptyPlan(),
+					},
+				},
 			},
 		},
 	})
diff --git a/vault/resource_ssh_secret_backend_role_test.go b/vault/resource_ssh_secret_backend_role_test.go
index 30bdbe79..4afd3d8f 100644
--- a/vault/resource_ssh_secret_backend_role_test.go
+++ b/vault/resource_ssh_secret_backend_role_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"strings"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -123,7 +124,7 @@ func TestAccSSHSecretBackendRole(t *testing.T) {
 	}
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 		},
@@ -136,9 +137,9 @@ func TestAccSSHSecretBackendRoleOTP_basic(t *testing.T) {
 	backend := acctest.RandomWithPrefix("tf-test/ssh")
 	name := acctest.RandomWithPrefix("tf-test-role")
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testAccSSHSecretBackendRoleCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testAccSSHSecretBackendRoleCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccSSHSecretBackendRoleOTPConfig_basic(name, backend),
@@ -160,7 +161,7 @@ func TestAccSSHSecretBackendRole_template(t *testing.T) {
 	resourceName := "vault_ssh_secret_backend_role.test_role"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion112)
diff --git a/vault/resource_terraform_cloud_secret_backend_test.go b/vault/resource_terraform_cloud_secret_backend_test.go
index 479fb116..799a76b3 100644
--- a/vault/resource_terraform_cloud_secret_backend_test.go
+++ b/vault/resource_terraform_cloud_secret_backend_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"os"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -23,9 +24,9 @@ func TestTerraformCloudSecretBackend(t *testing.T) {
 	resourceName := resourceType + ".test"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeTerraform, consts.FieldBackend),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeTerraform, consts.FieldBackend),
 		Steps: []resource.TestStep{
 			{
 				Config: testTerraformCloudSecretBackend_initialConfig(backend, token),
@@ -64,9 +65,9 @@ func TestTerraformCloudSecretBackend_remount(t *testing.T) {
 	token := "randomized-token-12392183123"
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testCheckMountDestroyed(resourceType, consts.MountTypeTerraform, consts.FieldBackend),
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testCheckMountDestroyed(resourceType, consts.MountTypeTerraform, consts.FieldBackend),
 		Steps: []resource.TestStep{
 			{
 				Config: testTerraformCloudSecretBackend_initialConfig(backend, token),
diff --git a/vault/resource_terraform_cloud_secret_creds_test.go b/vault/resource_terraform_cloud_secret_creds_test.go
index 04d4c9de..ace7ae13 100644
--- a/vault/resource_terraform_cloud_secret_creds_test.go
+++ b/vault/resource_terraform_cloud_secret_creds_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -23,7 +24,7 @@ func TestAccResourceTerraformCloudSecretCredsOrganizationBasic(t *testing.T) {
 	token, organization := vals[0], vals[1]
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 		},
@@ -48,7 +49,7 @@ func TestAccResourceTerraformCloudSecretCredsTeamBasic(t *testing.T) {
 	token, organization, teamID := vals[0], vals[1], vals[2]
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 		},
@@ -74,7 +75,7 @@ func TestAccResourceTerraformCloudSecretCredsUserBasic(t *testing.T) {
 	token, userID := vals[0], vals[1]
 
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 		},
diff --git a/vault/resource_terraform_cloud_secret_role_test.go b/vault/resource_terraform_cloud_secret_role_test.go
index 695264ad..806450a1 100644
--- a/vault/resource_terraform_cloud_secret_role_test.go
+++ b/vault/resource_terraform_cloud_secret_role_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -22,7 +23,7 @@ func TestTerraformCloudSecretRole(t *testing.T) {
 	vals := testutil.SkipTestEnvUnset(t, "TEST_TF_TOKEN", "TEST_TF_TEAM_ID", "TEST_TF_USER_ID")
 	token, teamID, userID := vals[0], vals[1], vals[2]
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 		},
diff --git a/vault/resource_token_auth_backend_role_test.go b/vault/resource_token_auth_backend_role_test.go
index a73594f3..943d9e24 100644
--- a/vault/resource_token_auth_backend_role_test.go
+++ b/vault/resource_token_auth_backend_role_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -20,9 +21,9 @@ func TestAccTokenAuthBackendRole(t *testing.T) {
 
 	resourceName := "vault_token_auth_backend_role.role"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckTokenAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckTokenAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccTokenAuthBackendRoleConfig(role),
@@ -43,9 +44,9 @@ func TestAccTokenAuthBackendRoleUpdate(t *testing.T) {
 
 	resourceName := "vault_token_auth_backend_role.role"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccCheckTokenAuthBackendRoleDestroy,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccCheckTokenAuthBackendRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccTokenAuthBackendRoleConfig(role),
diff --git a/vault/resource_token_test.go b/vault/resource_token_test.go
index 3326dc2a..8f987f81 100644
--- a/vault/resource_token_test.go
+++ b/vault/resource_token_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"strconv"
 	"testing"
 	"time"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
@@ -39,9 +40,9 @@ func testResourceTokenCheckDestroy(s *terraform.State) error {
 func TestResourceToken_basic(t *testing.T) {
 	resourceName := "vault_token.test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testResourceTokenCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testResourceTokenCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testResourceTokenConfig_basic(),
@@ -60,9 +61,9 @@ func TestResourceToken_basic(t *testing.T) {
 func TestResourceToken_import(t *testing.T) {
 	resourceName := "vault_token.test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testResourceTokenCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testResourceTokenCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testResourceTokenConfig_basic(),
@@ -103,9 +104,9 @@ resource "vault_token" "test" {
 func TestResourceToken_full(t *testing.T) {
 	resourceName := "vault_token.test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testResourceTokenCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testResourceTokenCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testResourceTokenConfig_full(),
@@ -157,9 +158,9 @@ resource "vault_token" "test" {
 
 func TestResourceToken_lookup(t *testing.T) {
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testResourceTokenCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testResourceTokenCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testResourceTokenConfig_lookup(),
@@ -190,9 +191,9 @@ resource "vault_token" "test" {
 func TestResourceToken_expire(t *testing.T) {
 	t.Skip("skipping, because it's flaky in CI and there's a long time.Sleep call")
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testResourceTokenCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testResourceTokenCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testResourceTokenConfig_expire(),
@@ -262,9 +263,9 @@ func TestResourceToken_renew(t *testing.T) {
 		resource.TestCheckResourceAttr(resourceName, consts.FieldPolicies+".0", "test"),
 	}
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testResourceTokenCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testResourceTokenCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testResourceTokenConfig_renew(true),
diff --git a/vault/resource_transform_alphabet_test.go b/vault/resource_transform_alphabet_test.go
index 9bea64c7..a9a0968d 100644
--- a/vault/resource_transform_alphabet_test.go
+++ b/vault/resource_transform_alphabet_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -19,9 +20,9 @@ func TestAccTransformAlphabet(t *testing.T) {
 	path := acctest.RandomWithPrefix("transform")
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestEntPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testTransformAlphabetDestroy,
+		PreCheck:                 func() { testutil.TestEntPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testTransformAlphabetDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testTransformAlphabet_basicConfig(path, "numerics", "0123456789"),
diff --git a/vault/resource_transform_role_test.go b/vault/resource_transform_role_test.go
index 96d40cb8..bba2288d 100644
--- a/vault/resource_transform_role_test.go
+++ b/vault/resource_transform_role_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -20,9 +21,9 @@ func TestAccTransformRole(t *testing.T) {
 	role := acctest.RandomWithPrefix("test-role")
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestEntPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testTransformRoleDestroy,
+		PreCheck:                 func() { testutil.TestEntPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testTransformRoleDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testTransformRole_basicConfig(path, role, "ccn-fpe"),
diff --git a/vault/resource_transform_template_test.go b/vault/resource_transform_template_test.go
index cd10beed..696747c9 100644
--- a/vault/resource_transform_template_test.go
+++ b/vault/resource_transform_template_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -19,9 +20,9 @@ func TestAccTransformTemplate(t *testing.T) {
 	path := acctest.RandomWithPrefix("transform")
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestEntPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testTransformTemplateDestroy,
+		PreCheck:                 func() { testutil.TestEntPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testTransformTemplateDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testTransformTemplate_basicConfig(path, "regex",
diff --git a/vault/resource_transform_transformation_test.go b/vault/resource_transform_transformation_test.go
index 4ea60219..015dcf3f 100644
--- a/vault/resource_transform_transformation_test.go
+++ b/vault/resource_transform_transformation_test.go
@@ -4,12 +4,13 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -20,9 +21,9 @@ func TestAccTransformTransformation(t *testing.T) {
 
 	resourceName := "vault_transform_transformation.test"
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestEntPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      transformTransformationDestroy,
+		PreCheck:                 func() { testutil.TestEntPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             transformTransformationDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: transformTransformation_basicConfig(path, "ccn-fpe", "fpe", "ccn", "internal", "payments", "*"),
diff --git a/vault/resource_transit_cache_config_test.go b/vault/resource_transit_cache_config_test.go
index 071a43e5..2956ae58 100644
--- a/vault/resource_transit_cache_config_test.go
+++ b/vault/resource_transit_cache_config_test.go
@@ -4,15 +4,16 @@
 package vault
 
 import (
+	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"strconv"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -22,9 +23,9 @@ func TestAccTransitCacheConfig(t *testing.T) {
 	name := acctest.RandomWithPrefix("test-cache-config")
 
 	resource.Test(t, resource.TestCase{
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		ProviderFactories: providerFactories,
-		CheckDestroy:      testAccTransitCacheConfigCheckDestroyed,
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		CheckDestroy:             testAccTransitCacheConfigCheckDestroyed,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccTransitCacheConfig(name, 600),
diff --git a/vault/resource_transit_secret_backend_key_test.go b/vault/resource_transit_secret_backend_key_test.go
index f61485fa..0fb63371 100644
--- a/vault/resource_transit_secret_backend_key_test.go
+++ b/vault/resource_transit_secret_backend_key_test.go
@@ -4,13 +4,14 @@
 package vault
 
 import (
+	"context"
 	"fmt"
 	"regexp"
 	"testing"
 
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/testutil"
@@ -21,9 +22,9 @@ func TestTransitSecretBackendKey_basic(t *testing.T) {
 	name := acctest.RandomWithPrefix("key")
 	resourceName := "vault_transit_secret_backend_key.test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testTransitSecretBackendKeyCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testTransitSecretBackendKeyCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testTransitSecretBackendKeyConfig_basic(name, backend),
@@ -90,9 +91,9 @@ func TestTransitSecretBackendKey_rsa4096(t *testing.T) {
 	name := acctest.RandomWithPrefix("key")
 	resourceName := "vault_transit_secret_backend_key.test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
-		PreCheck:          func() { testutil.TestAccPreCheck(t) },
-		CheckDestroy:      testTransitSecretBackendKeyCheckDestroy,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		CheckDestroy:             testTransitSecretBackendKeyCheckDestroy,
 		Steps: []resource.TestStep{
 			{
 				Config: testTransitSecretBackendKeyConfig_rsa4096(name, backend),
@@ -151,7 +152,7 @@ func TestTransitSecretBackendKey_hmac(t *testing.T) {
 	name := acctest.RandomWithPrefix("key")
 	resourceName := "vault_transit_secret_backend_key.test"
 	resource.Test(t, resource.TestCase{
-		ProviderFactories: providerFactories,
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(context.Background(), t),
 		PreCheck: func() {
 			testutil.TestAccPreCheck(t)
 			SkipIfAPIVersionLT(t, testProvider.Meta(), provider.VaultVersion112)
diff --git a/vault/testhelpers_test.go b/vault/testhelpers_test.go
index 38c34ab8..f3488bf7 100644
--- a/vault/testhelpers_test.go
+++ b/vault/testhelpers_test.go
@@ -9,8 +9,8 @@ import (
 	"testing"
 
 	"github.com/hashicorp/go-version"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
-	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"