🐹 Bump github.com/hashicorp/terraform-plugin-testing (#47)

Bumps the minor-patch group with 1 update: [github.com/hashicorp/terraform-plugin-testing](https://github.com/hashicorp/terraform-plugin-testing).


Updates `github.com/hashicorp/terraform-plugin-testing` from 1.10.0 to 1.11.0
- [Release notes](https://github.com/hashicorp/terraform-plugin-testing/releases)
- [Changelog](https://github.com/hashicorp/terraform-plugin-testing/blob/main/CHANGELOG.md)
- [Commits](https://github.com/hashicorp/terraform-plugin-testing/compare/v1.10.0...v1.11.0)

---
updated-dependencies:
- dependency-name: github.com/hashicorp/terraform-plugin-testing
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.env.example

@@ -0,0 +1,8 @@
+TF_ACC=1
+BINARYLANE_API_TOKEN=
+
+# Uncomment to enable debug logging (will dump request bodies)
+# TF_LOG=DEBUG
+
+# Uncomment to disable the Go cache when testing, useful for flaky tests
+# GOCACHE=off

.github/dependabot.yml

@@ -1,10 +1,30 @@
 version: 2
 updates:
   - package-ecosystem: 'github-actions'
+    commit-message:
+      prefix: '🐈 '
     directory: '/'
     schedule:
       interval: 'weekly'
+      day: 'friday'
+      time: '06:00'
+      timezone: 'Australia/Perth'
+    groups:
+      minor-patch:
+        update-types:
+          - 'minor'
+          - 'patch'
   - package-ecosystem: 'gomod'
+    commit-message:
+      prefix: '🐹 '
     directory: '/'
     schedule:
       interval: 'weekly'
+      day: 'friday'
+      time: '06:00'
+      timezone: 'Australia/Perth'
+    groups:
+      minor-patch:
+        update-types:
+          - 'minor'
+          - 'patch'

.github/workflows/release.yml

@@ -6,7 +6,7 @@ name: Release
 on:
   push:
     tags:
-      - "v*"
+      - 'v*'
 
 # Releases need permissions to read and write the repository contents.
 # GitHub considers creating releases and uploading assets as writing contents.
@@ -14,7 +14,13 @@ permissions:
   contents: write
 
 jobs:
+  test:
+    uses: ./.github/workflows/test.yml
+    secrets:
+      BINARYLANE_API_TOKEN: ${{ secrets.BINARYLANE_API_TOKEN }}
+
   goreleaser:
+    needs: test
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
@@ -23,16 +29,16 @@ jobs:
           fetch-depth: 0
       - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
         with:
-          go-version-file: "go.mod"
+          go-version-file: 'go.mod'
           cache: true
       - name: Import GPG key
-        uses: crazy-max/ghaction-import-gpg@01dd5d3ca463c7f10f7f4f7b4f177225ac661ee4 # v6.1.0
+        uses: crazy-max/ghaction-import-gpg@cb9bde2e2525e640591a934b1fd28eef1dcaf5e5 # v6.2.0
         id: import_gpg
         with:
           gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
           passphrase: ${{ secrets.PASSPHRASE }}
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@286f3b13b1b49da4ac219696163fb8c1c93e1200 # v6.0.0
+        uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0
         with:
           args: release --clean
         env:

.github/workflows/test.yaml

@@ -1,39 +0,0 @@
-name: Terraform Provider Tests
-
-on:
-  pull_request:
-    paths:
-      - '.github/workflows/test.yaml'
-      - '**.go'
-
-permissions:
-  # Permission for checking out code
-  contents: read
-
-jobs:
-  acceptance:
-    name: Acceptance Tests
-    runs-on: ubuntu-latest
-    environment: test
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v4
-        with:
-          go-version-file: 'go.mod'
-      - uses: hashicorp/setup-terraform@v2
-        with:
-          terraform_version: '1.5.*'
-          terraform_wrapper: false
-      - run: go test -v -cover ./...
-        env:
-          TF_ACC: '1'
-          BINARYLANE_API_TOKEN: ${{ secrets.BINARYLANE_API_TOKEN }}
-  # unit:
-  #   name: Unit Tests
-  #   runs-on: ubuntu-latest
-  #   steps:
-  #     - uses: actions/checkout@v3
-  #     - uses: actions/setup-go@v4
-  #       with:
-  #         go-version-file: 'go.mod'
-  #     - run: go test -v -cover ./...

.github/workflows/test.yml

@@ -0,0 +1,61 @@
+name: Terraform Provider Tests
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/test.yml'
+      - '**.go'
+  workflow_call:
+    secrets:
+      BINARYLANE_API_TOKEN:
+        required: true
+
+permissions:
+  # Permission for checking out code
+  contents: read
+
+jobs:
+  acceptance:
+    name: Acceptance Tests
+    runs-on: ubuntu-latest
+    environment: test
+    concurrency:
+      group: test
+      cancel-in-progress: true # would be nice if GH offered cancel-pending instead, https://github.com/orgs/community/discussions/63136
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: 'go.mod'
+      - uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: '1.5.*'
+          terraform_wrapper: false
+      - name: Check if generated files are up to date
+        run: |
+          go generate
+          git diff --color --exit-code --ignore-matching-lines='//'
+          if [ $? -ne 0 ]; then
+            echo "generated files are not up to date, please run 'go generate' and commit the changes" >&2
+            exit 1
+          fi
+      - name: Run tests
+        run: go test -v -cover ./internal/provider/...
+        env:
+          TF_ACC: '1'
+          BINARYLANE_API_TOKEN: ${{ secrets.BINARYLANE_API_TOKEN }}
+      - name: Run sweepers
+        if: failure()
+        run: go test -v  ./internal/provider/... -sweep=all
+        env:
+          TF_ACC: '1'
+          BINARYLANE_API_TOKEN: ${{ secrets.BINARYLANE_API_TOKEN }}
+  # unit:
+  #   name: Unit Tests
+  #   runs-on: ubuntu-latest
+  #   steps:
+  #     - uses: actions/checkout@v4
+  #     - uses: actions/setup-go@v5
+  #       with:
+  #         go-version-file: 'go.mod'
+  #     - run: go test -v -cover ./...

.vscode/settings.json

@@ -0,0 +1,3 @@
+{
+  "go.testEnvFile": "${workspaceFolder}/.env",
+}

CONTRIBUTING.md

@@ -35,7 +35,16 @@ terraform apply
 
 
 ```sh
-TF_DEBUG=1 BINARYLANE_API_TOKEN=********* TF_ACC=1 go test -v ./...
+cp .env.example .env
+# Add your API token to .env
+eval export $(cat .env)
+go test -v ./internal/provider/...
+```
+
+To run Sweepers:
+
+```sh
+go test -v  ./internal/provider/... -sweep=all
 ```
 
 ### Update modules

README.md

@@ -1,12 +1,13 @@
 # terraform-provider-binarylane
 
-See the examples in the [examples directory](./examples/basic/README.md).
+See the [documentation on the Terraform Registry](https://registry.terraform.io/providers/oscarhermoso/binarylane/latest), or see [examples in the `examples` directory](./examples/README.md).
 
 ```terraform
 resource "binarylane_server" "example" {
-  region = "per"
-  image  = "ubuntu-24.04"
-  size   = "std-min"
+  region            = "per"
+  image             = "ubuntu-24.04"
+  size              = "std-min"
+  public_ipv4_count = 1
 }
 ```
 
@@ -44,7 +45,7 @@ Images:
 
 ```sh
 curl -X GET "https://api.binarylane.com.au/v2/images?type=distribution&&page=1&per_page=200" \
-  -H "Authorization: Bearer **********" > tmp/images.json
+  -H "Authorization: Bearer $BINARYLANE_API_TOKEN" > tmp/images.json
 
 jq '[ .images[] | .slug ] | sort' tmp/images.json
 ```
@@ -81,7 +82,7 @@ Regions:
 
 ```sh
 curl -X GET "https://api.binarylane.com.au/v2/regions" \
-  -H "Authorization: Bearer **********"" > tmp/regions.json
+  -H "Authorization: Bearer $BINARYLANE_API_TOKEN" > tmp/regions.json
 
 jq '[ .regions[] | .slug ] | sort' tmp/regions.json
 ```
@@ -103,7 +104,7 @@ jq '[ .regions[] | .slug ] | sort' tmp/regions.json
 
 ```sh
 curl -X GET "https://api.binarylane.com.au/v2/sizes" \
-  -H "Authorization: Bearer **********"" > tmp/sizes.json
+  -H "Authorization: Bearer $BINARYLANE_API_TOKEN" > tmp/sizes.json
 
 jq '[ .sizes[] | .slug ] | sort' tmp/sizes.json
 ```

docs/data-sources/ssh_key.md

@@ -22,5 +22,6 @@ description: |-
 ### Read-Only
 
 - `default` (Boolean) Optional: If true this will be added to all new server installations (if we support SSH Key injection for the server's operating system).
+- `fingerprint` (String) The fingerprint of the SSH key.
 - `name` (String) A name to help you identify the key.
 - `public_key` (String) The public key in OpenSSH "authorized_keys" format.

docs/resources/load_balancer.md

@@ -25,6 +25,7 @@ description: |-
 - `health_check` (Attributes) The rules that determine which servers are considered 'healthy' and in the server pool for the load balancer. Leave this null to accept appropriate defaults based on the forwarding_rules. (see [below for nested schema](#nestedatt--health_check))
 - `region` (String) Leave null to create an anycast load balancer.
 - `server_ids` (List of Number) A list of server IDs to assign to this load balancer.
+- `timeouts` (Attributes) (see [below for nested schema](#nestedatt--timeouts))
 
 ### Read-Only
 
@@ -45,3 +46,11 @@ Optional:
 
 - `path` (String) Leave null to accept the default '/' path.
 - `protocol` (String) Leave null to accept the default HTTP protocol.
+
+
+<a id="nestedatt--timeouts"></a>
+### Nested Schema for `timeouts`
+
+Optional:
+
+- `create` (String) A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).

docs/resources/server.md

@@ -18,6 +18,7 @@ Provides a Binary Lane Server resource. This can be used to create and delete se
 ### Required
 
 - `image` (String) The slug of the selected operating system.
+- `public_ipv4_count` (Number) The number of public IPv4 addresses to assign to the server. If this is not provided, the server will be created with the default number of public IPv4 addresses.
 - `region` (String) The slug of the selected region.
 - `size` (String) The slug of the selected size.
 
@@ -27,15 +28,24 @@ Provides a Binary Lane Server resource. This can be used to create and delete se
 - `name` (String) The hostname of your server, such as vps01.yourcompany.com. If not provided, the server will be created with a random name.
 - `password` (String, Sensitive) If this is provided the specified or default remote user's account password will be set to this value. Only valid if the server supports password change actions. If omitted and the server supports password change actions a random password will be generated and emailed to the account email address.
 - `port_blocking` (Boolean) Port blocking of outgoing connections for email, SSH and Remote Desktop (TCP ports 22, 25, and 3389) is enabled by default for all new servers. If this is false port blocking will be disabled. Disabling port blocking is only available to reviewed accounts.
-- `public_ipv4_count` (Number) The number of public IPv4 addresses to assign to the server. If this is not provided, the server will be created with the default number of public IPv4 addresses.
+- `source_and_destination_check` (Boolean) This attribute can only be set if your server also has a `vpc_id` attribute set. When enabled (which is `true` by default), your server will only be able to send or receive packets that are directly addressed to one of the IP addresses associated with the Cloud Server. Generally, this is desirable behaviour because it prevents IP conflicts and other hard-to-diagnose networking faults due to incorrect network configuration. When `source_and_destination_check` is `false`, your Cloud Server will be able to send and receive packets addressed to any server. This is typically used when you want to use your Cloud Server as a VPN endpoint, a NAT server to provide internet access, or IP forwarding.
 - `ssh_keys` (List of Number) This is a list of SSH key ids. If this is null or not provided, any SSH keys that have been marked as default will be deployed (assuming the operating system supports SSH Keys). Submit an empty list to disable deployment of default keys.
+- `timeouts` (Attributes) (see [below for nested schema](#nestedatt--timeouts))
 - `user_data` (String) If provided this will be used to initialise the new server. This must be left null if the Image does not support UserData, see DistributionInfo.Features for more information.
 - `vpc_id` (Number) Leave null to use default (public) network for the selected region.
-- `wait_for_create` (Number) The number of seconds to wait for the server to be created, after which, a timeout error will be reported. If `wait_seconds` is left empty or set to 0, Terraform will succeed without waiting for the server creation to complete.
 
 ### Read-Only
 
 - `id` (Number) The ID of the server to fetch.
+- `password_change_supported` (Boolean) If this is true then the `password` attribute can be changed with Terraform. If this is false then the `password` attribute can only be replaced with a null/empty value, which will clear the root/administrator password allowing the password to be changed via the web console.
 - `permalink` (String) A randomly generated two-word identifier assigned to servers in regions that support this feature
 - `private_ipv4_addresses` (List of String) The private IPv4 addresses assigned to the server.
 - `public_ipv4_addresses` (List of String) The public IPv4 addresses assigned to the server.
+
+<a id="nestedatt--timeouts"></a>
+### Nested Schema for `timeouts`
+
+Optional:
+
+- `create` (String) A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
+- `update` (String) A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).

docs/resources/ssh_key.md

@@ -24,3 +24,7 @@ description: |-
 
 - `default` (Boolean) Optional: If true this will be added to all new server installations (if we support SSH Key injection for the server's operating system).
 - `id` (Number) The ID or fingerprint of the SSH Key to fetch.
+
+### Read-Only
+
+- `fingerprint` (String) The fingerprint of the SSH key.

examples/basic/main.tf

@@ -11,10 +11,10 @@ provider "binarylane" {
 }
 
 resource "binarylane_server" "example" {
-  name   = "tf-example-basic"
-  region = "per" # or "syd", "mel", "bne", "sin"
-  image  = "ubuntu-24.04"
-  size   = "std-min" # 1 VPCU, 1 GB Memory,  20 GB NVME Storage, 1000 GB Data Transfer
-
+  name              = "tf-example-basic"
+  region            = "per" # or "syd", "mel", "bne", "sin"
+  image             = "ubuntu-24.04"
+  size              = "std-min" # 1 VPCU, 1 GB Memory,  20 GB NVME Storage, 1000 GB Data Transfer
+  public_ipv4_count = 1
   # Password will be generated automatically and mailed to the account holder
 }

examples/cloud-init/cloud-config.yml

@@ -1,10 +1,5 @@
 #cloud-config
 bootcmd:
-  # By default, the provider won't wait for the server installation to complete.
-  #
-  # If you want Terraform to wait until the server has fully provisioned, set
-  # the `wait_for_create` attribute on the `binarylane_server` resource.
-  #
   # If you have additional installation steps that need to be awaited, define
   # these in the `bootcmd` section and they will also be awaited.
   #

examples/cloud-init/main.tf

@@ -9,10 +9,10 @@ terraform {
 provider "binarylane" {}
 
 resource "binarylane_server" "example" {
-  name            = "tf-cloud-init-example"
-  region          = "per"
-  image           = "ubuntu-24.04"
-  size            = "std-min"
-  user_data       = file("./cloud-config.yml")
-  wait_for_create = 300 # 5 mins
+  name              = "tf-cloud-init-example"
+  region            = "per"
+  image             = "ubuntu-24.04"
+  size              = "std-min"
+  user_data         = file("./cloud-config.yml")
+  public_ipv4_count = 1
 }

examples/k3s/main.tf

@@ -53,7 +53,6 @@ resource "binarylane_server" "server" {
   vpc_id            = binarylane_vpc.example.id
   public_ipv4_count = 1
   user_data         = sensitive(data.cloudinit_config.server.rendered)
-  wait_for_create   = 60 # Must wait for the server to be ready before creating firewall rules
 }
 
 data "external" "kubeconfig" {
@@ -107,7 +106,6 @@ resource "binarylane_server" "agent" {
   vpc_id            = binarylane_vpc.example.id
   public_ipv4_count = 1
   user_data         = sensitive(data.cloudinit_config.agent.rendered)
-  wait_for_create   = 60 # Must wait for the server to be ready before creating firewall rules
 }
 
 # Virtual Private Cloud Routing
@@ -134,15 +132,14 @@ resource "binarylane_server_firewall_rules" "example" {
   server_id = each.value.id
 
   firewall_rules = [
-    # TODO: Due to a bug, this only works if you uncomment AFTER creating servers
-    # {
-    #   description           = "K3s supervisor and Kubernetes API Server"
-    #   protocol              = "tcp"
-    #   source_addresses      = ["0.0.0.0/0"]
-    #   destination_addresses = local.server_ips
-    #   destination_ports     = ["6443"]
-    #   action                = "accept"
-    # },
+    {
+      description           = "K3s supervisor and Kubernetes API Server"
+      protocol              = "tcp"
+      source_addresses      = ["0.0.0.0/0"]
+      destination_addresses = local.server_ips
+      destination_ports     = ["6443"]
+      action                = "accept"
+    },
     {
       description           = "Flannel VXLAN"
       protocol              = "udp"

examples/nix/main.tf

@@ -9,10 +9,10 @@ terraform {
 provider "binarylane" {}
 
 resource "binarylane_server" "example" {
-  name            = "tf-nix-example"
-  region          = "per"
-  image           = "debian-12"
-  size            = "std-min"
-  user_data       = file("./cloud-config.yml")
-  wait_for_create = 300 # 5 mins
+  name              = "tf-nix-example"
+  region            = "per"
+  image             = "debian-12"
+  size              = "std-min"
+  user_data         = file("./cloud-config.yml")
+  public_ipv4_count = 1
 }

examples/ssh/main.tf

@@ -28,11 +28,12 @@ resource "binarylane_ssh_key" "example" {
 }
 
 resource "binarylane_server" "example" {
-  name     = "tf-example-ssh"
-  region   = "per"
-  image    = "ubuntu-24.04"
-  size     = "std-min"
-  ssh_keys = [binarylane_ssh_key.example.id]
+  name              = "tf-example-ssh"
+  region            = "per"
+  image             = "ubuntu-24.04"
+  size              = "std-min"
+  ssh_keys          = [binarylane_ssh_key.example.id]
+  public_ipv4_count = 1
 
   # If you are using a global default SSH key, you need to explicitly wait for
   # it to be created before creating the server.

examples/vpc/main.tf

@@ -35,12 +35,13 @@ resource "binarylane_server" "db" {
 
 # VPN server
 resource "binarylane_server" "vpn" {
-  name              = "tf-example-vpc-vpn"
-  region            = "per"
-  image             = "ubuntu-24.04"
-  size              = "std-min"
-  vpc_id            = binarylane_vpc.example.id
-  public_ipv4_count = 1
+  name                         = "tf-example-vpc-vpn"
+  region                       = "per"
+  image                        = "ubuntu-24.04"
+  size                         = "std-min"
+  vpc_id                       = binarylane_vpc.example.id
+  public_ipv4_count            = 1
+  source_and_destination_check = false
 }
 
 resource "binarylane_vpc_route_entries" "example" {

generate.go

@@ -8,4 +8,4 @@ package main
 //go:generate mkdir -p internal/resources internal/data_sources
 //go:generate go run github.com/hashicorp/terraform-plugin-codegen-framework/cmd/tfplugingen-framework generate resources --input=./provider_code_spec.json --output=./internal/resources --package=resources
 //go:generate go run github.com/hashicorp/terraform-plugin-codegen-framework/cmd/tfplugingen-framework generate data-sources --input=./provider_code_spec.json --output=./internal/data_sources --package=data_sources
-//go:generate tfplugindocs generate
+//go:generate go run github.com/hashicorp/terraform-plugin-docs/cmd/tfplugindocs generate

go.mod

@@ -1,18 +1,19 @@
 module terraform-provider-binarylane
 
-go 1.22.3
+go 1.22.7
 
 require (
 	github.com/deepmap/oapi-codegen v1.16.3
-	github.com/hashicorp/terraform-plugin-codegen-framework v0.4.0
+	github.com/hashicorp/terraform-plugin-codegen-framework v0.4.1
 	github.com/hashicorp/terraform-plugin-codegen-openapi v0.3.0
-	github.com/hashicorp/terraform-plugin-docs v0.19.4
-	github.com/hashicorp/terraform-plugin-framework v1.11.0
-	github.com/hashicorp/terraform-plugin-framework-validators v0.13.0
-	github.com/hashicorp/terraform-plugin-go v0.23.0
+	github.com/hashicorp/terraform-plugin-docs v0.20.0
+	github.com/hashicorp/terraform-plugin-framework v1.13.0
+	github.com/hashicorp/terraform-plugin-framework-timeouts v0.4.1
+	github.com/hashicorp/terraform-plugin-framework-validators v0.15.0
+	github.com/hashicorp/terraform-plugin-go v0.25.0
 	github.com/hashicorp/terraform-plugin-log v0.9.0
-	github.com/hashicorp/terraform-plugin-testing v1.10.0
-	github.com/oapi-codegen/oapi-codegen/v2 v2.3.0
+	github.com/hashicorp/terraform-plugin-testing v1.11.0
+	github.com/oapi-codegen/oapi-codegen/v2 v2.4.1
 	github.com/oapi-codegen/runtime v1.1.1
 )
 
@@ -29,16 +30,16 @@ require (
 	github.com/armon/go-radix v1.0.0 // indirect
 	github.com/bahlo/generic-list-go v0.2.0 // indirect
 	github.com/bgentry/speakeasy v0.1.0 // indirect
-	github.com/bmatcuk/doublestar/v4 v4.6.1 // indirect
+	github.com/bmatcuk/doublestar/v4 v4.7.1 // indirect
 	github.com/buger/jsonparser v1.1.1 // indirect
 	github.com/cloudflare/circl v1.3.7 // indirect
 	github.com/dprotaso/go-yit v0.0.0-20220510233725-9ba8df137936 // indirect
-	github.com/fatih/color v1.17.0 // indirect
+	github.com/fatih/color v1.18.0 // indirect
 	github.com/frankban/quicktest v1.14.6 // indirect
 	github.com/fsnotify/fsnotify v1.5.4 // indirect
-	github.com/getkin/kin-openapi v0.124.0 // indirect
-	github.com/go-openapi/jsonpointer v0.20.2 // indirect
-	github.com/go-openapi/swag v0.22.8 // indirect
+	github.com/getkin/kin-openapi v0.127.0 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
@@ -49,23 +50,23 @@ require (
 	github.com/hashicorp/go-cty v1.4.1-0.20200414143053-d3edf31b6320 // indirect
 	github.com/hashicorp/go-hclog v1.6.3 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/hashicorp/go-plugin v1.6.1 // indirect
+	github.com/hashicorp/go-plugin v1.6.2 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
 	github.com/hashicorp/go-version v1.7.0 // indirect
-	github.com/hashicorp/hc-install v0.8.0 // indirect
-	github.com/hashicorp/hcl/v2 v2.21.0 // indirect
+	github.com/hashicorp/hc-install v0.9.0 // indirect
+	github.com/hashicorp/hcl/v2 v2.23.0 // indirect
 	github.com/hashicorp/logutils v1.0.0 // indirect
 	github.com/hashicorp/terraform-exec v0.21.0 // indirect
-	github.com/hashicorp/terraform-json v0.22.1 // indirect
-	github.com/hashicorp/terraform-plugin-codegen-spec v0.1.1 // indirect
-	github.com/hashicorp/terraform-plugin-sdk/v2 v2.34.0 // indirect
+	github.com/hashicorp/terraform-json v0.23.0 // indirect
+	github.com/hashicorp/terraform-plugin-codegen-spec v0.2.0 // indirect
+	github.com/hashicorp/terraform-plugin-sdk/v2 v2.35.0 // indirect
 	github.com/hashicorp/terraform-registry-address v0.2.3 // indirect
 	github.com/hashicorp/terraform-svchost v0.1.1 // indirect
-	github.com/hashicorp/yamux v0.1.1 // indirect
+	github.com/hashicorp/yamux v0.1.2 // indirect
 	github.com/huandu/xstrings v1.4.0 // indirect
 	github.com/imdario/mergo v0.3.16 // indirect
-	github.com/invopop/yaml v0.2.0 // indirect
+	github.com/invopop/yaml v0.3.1 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
@@ -84,6 +85,7 @@ require (
 	github.com/posener/complete v1.2.3 // indirect
 	github.com/rivo/uniseg v0.2.0 // indirect
 	github.com/shopspring/decimal v1.3.1 // indirect
+	github.com/speakeasy-api/openapi-overlay v0.9.0 // indirect
 	github.com/spf13/cast v1.5.1 // indirect
 	github.com/vmihailenco/msgpack v4.0.4+incompatible // indirect
 	github.com/vmihailenco/msgpack/v5 v5.4.1 // indirect
@@ -93,22 +95,22 @@ require (
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
-	github.com/yuin/goldmark v1.7.1 // indirect
+	github.com/yuin/goldmark v1.7.7 // indirect
 	github.com/yuin/goldmark-meta v1.1.0 // indirect
 	github.com/zclconf/go-cty v1.15.0 // indirect
 	go.abhg.dev/goldmark/frontmatter v0.2.0 // indirect
-	golang.org/x/crypto v0.27.0 // indirect
+	golang.org/x/crypto v0.29.0 // indirect
 	golang.org/x/exp v0.0.0-20240409090435-93d18d7e34b8 // indirect
-	golang.org/x/mod v0.19.0 // indirect
-	golang.org/x/net v0.29.0 // indirect
-	golang.org/x/sync v0.8.0 // indirect
-	golang.org/x/sys v0.25.0 // indirect
-	golang.org/x/text v0.18.0 // indirect
+	golang.org/x/mod v0.21.0 // indirect
+	golang.org/x/net v0.30.0 // indirect
+	golang.org/x/sync v0.9.0 // indirect
+	golang.org/x/sys v0.27.0 // indirect
+	golang.org/x/text v0.20.0 // indirect
 	golang.org/x/tools v0.22.0 // indirect
 	google.golang.org/appengine v1.6.8 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1 // indirect
-	google.golang.org/grpc v1.66.2 // indirect
-	google.golang.org/protobuf v1.34.2 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20241021214115-324edc3d5d38 // indirect
+	google.golang.org/grpc v1.67.1 // indirect
+	google.golang.org/protobuf v1.35.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -30,8 +30,8 @@ github.com/bahlo/generic-list-go v0.2.0/go.mod h1:2KvAjgMlE5NNynlg/5iLrrCCZ2+5xW
 github.com/bgentry/speakeasy v0.1.0 h1:ByYyxL9InA1OWqxJqqp2A5pYHUrCiAL6K3J+LKSsQkY=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
 github.com/bmatcuk/doublestar v1.1.1/go.mod h1:UD6OnuiIn0yFxxA2le/rnRU1G4RaI4UvFv1sNto9p6w=
-github.com/bmatcuk/doublestar/v4 v4.6.1 h1:FH9SifrbvJhnlQpztAx++wlkk70QBf0iBWDwNy7PA4I=
-github.com/bmatcuk/doublestar/v4 v4.6.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
+github.com/bmatcuk/doublestar/v4 v4.7.1 h1:fdDeAqgT47acgwd9bd9HxJRDmc9UAmPpc+2m0CXv75Q=
+github.com/bmatcuk/doublestar/v4 v4.7.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/bufbuild/protocompile v0.4.0 h1:LbFKd2XowZvQ/kajzguUp2DC9UEIQhIq77fZZlaQsNA=
 github.com/bufbuild/protocompile v0.4.0/go.mod h1:3v93+mbWn/v3xzN+31nwkJfrEpAUwp+BagBSZWx+TP8=
 github.com/buger/jsonparser v1.1.1 h1:2PnMjfWD7wBILjqQbt530v576A/cAbQvEW9gGIpYMUs=
@@ -55,26 +55,26 @@ github.com/dprotaso/go-yit v0.0.0-20220510233725-9ba8df137936/go.mod h1:ttYvX5ql
 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
 github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
-github.com/fatih/color v1.17.0 h1:GlRw1BRJxkpqUCBKzKOw098ed57fEsKeNjpTe3cSjK4=
-github.com/fatih/color v1.17.0/go.mod h1:YZ7TlrGPkiz6ku9fK3TLD/pl3CpsiFyu8N92HLgmosI=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
 github.com/fsnotify/fsnotify v1.5.4 h1:jRbGcIw6P2Meqdwuo0H1p6JVLbL5DHKAKlYndzMwVZI=
 github.com/fsnotify/fsnotify v1.5.4/go.mod h1:OVB6XrOHzAwXMpEM7uPOzcehqUV2UqJxmVXmkdnm1bU=
-github.com/getkin/kin-openapi v0.124.0 h1:VSFNMB9C9rTKBnQ/fpyDU8ytMTr4dWI9QovSKj9kz/M=
-github.com/getkin/kin-openapi v0.124.0/go.mod h1:wb1aSZA/iWmorQP9KTAS/phLj/t17B5jT7+fS8ed9NM=
+github.com/getkin/kin-openapi v0.127.0 h1:Mghqi3Dhryf3F8vR370nN67pAERW+3a95vomb3MAREY=
+github.com/getkin/kin-openapi v0.127.0/go.mod h1:OZrfXzUfGrNbsKj+xmFBx6E5c6yH3At/tAKSc2UszXM=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
 github.com/go-git/go-billy/v5 v5.5.0 h1:yEY4yhzCDuMGSv83oGxiBotRzhwhNr8VZyphhiu+mTU=
 github.com/go-git/go-billy/v5 v5.5.0/go.mod h1:hmexnoNsr2SJU1Ju67OaNz5ASJY3+sHgFRpCtpDCKow=
 github.com/go-git/go-git/v5 v5.12.0 h1:7Md+ndsjrzZxbddRDZjF14qK+NN56sy6wkqaVrjZtys=
 github.com/go-git/go-git/v5 v5.12.0/go.mod h1:FTM9VKtnI2m65hNI/TenDDDnUf2Q9FHnXYjuz9i5OEY=
-github.com/go-openapi/jsonpointer v0.20.2 h1:mQc3nmndL8ZBzStEo3JYF8wzmeWffDH4VbXz58sAx6Q=
-github.com/go-openapi/jsonpointer v0.20.2/go.mod h1:bHen+N0u1KEO3YlmqOjTT9Adn1RfD91Ar825/PuiRVs=
-github.com/go-openapi/swag v0.22.8 h1:/9RjDSQ0vbFR+NyjGMkFTsA1IA0fmhKSThmfGZjicbw=
-github.com/go-openapi/swag v0.22.8/go.mod h1:6QT22icPLEqAM/z/TChgb4WAveCHF92+2gF0CNjHpPI=
+github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
+github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
+github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
+github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
 github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
 github.com/go-test/deep v1.0.8 h1:TDsG77qcSprGbC6vTN8OuXp5g+J+b5Pcguhf7Zt61VM=
 github.com/go-test/deep v1.0.8/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
@@ -120,8 +120,8 @@ github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVH
 github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-plugin v1.6.1 h1:P7MR2UP6gNKGPp+y7EZw2kOiq4IR9WiqLvp0XOsVdwI=
-github.com/hashicorp/go-plugin v1.6.1/go.mod h1:XPHFku2tFo3o3QKFgSYo+cghcUhw1NA1hZyMK0PWAw0=
+github.com/hashicorp/go-plugin v1.6.2 h1:zdGAEd0V1lCaU0u+MxWQhtSDQmahpkwOun8U8EiRVog=
+github.com/hashicorp/go-plugin v1.6.2/go.mod h1:CkgLQ5CZqNmdL9U9JzM532t8ZiYQ35+pj3b1FD37R0Q=
 github.com/hashicorp/go-retryablehttp v0.7.7 h1:C8hUCYzor8PIfXHa4UrZkU4VvK8o9ISHxT2Q8+VepXU=
 github.com/hashicorp/go-retryablehttp v0.7.7/go.mod h1:pkQpWZeYWskR+D1tR2O5OcBFOxfA7DoAO6xtkuQnHTk=
 github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
@@ -129,42 +129,44 @@ github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/C
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-version v1.7.0 h1:5tqGy27NaOTB8yJKUZELlFAS/LTKJkrmONwQKeRZfjY=
 github.com/hashicorp/go-version v1.7.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
-github.com/hashicorp/hc-install v0.8.0 h1:LdpZeXkZYMQhoKPCecJHlKvUkQFixN/nvyR1CdfOLjI=
-github.com/hashicorp/hc-install v0.8.0/go.mod h1:+MwJYjDfCruSD/udvBmRB22Nlkwwkwf5sAB6uTIhSaU=
-github.com/hashicorp/hcl/v2 v2.21.0 h1:lve4q/o/2rqwYOgUg3y3V2YPyD1/zkCLGjIV74Jit14=
-github.com/hashicorp/hcl/v2 v2.21.0/go.mod h1:62ZYHrXgPoX8xBnzl8QzbWq4dyDsDtfCRgIq1rbJEvA=
+github.com/hashicorp/hc-install v0.9.0 h1:2dIk8LcvANwtv3QZLckxcjyF5w8KVtiMxu6G6eLhghE=
+github.com/hashicorp/hc-install v0.9.0/go.mod h1:+6vOP+mf3tuGgMApVYtmsnDoKWMDcFXeTxCACYZ8SFg=
+github.com/hashicorp/hcl/v2 v2.23.0 h1:Fphj1/gCylPxHutVSEOf2fBOh1VE4AuLV7+kbJf3qos=
+github.com/hashicorp/hcl/v2 v2.23.0/go.mod h1:62ZYHrXgPoX8xBnzl8QzbWq4dyDsDtfCRgIq1rbJEvA=
 github.com/hashicorp/logutils v1.0.0 h1:dLEQVugN8vlakKOUE3ihGLTZJRB4j+M2cdTm/ORI65Y=
 github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
 github.com/hashicorp/terraform-exec v0.21.0 h1:uNkLAe95ey5Uux6KJdua6+cv8asgILFVWkd/RG0D2XQ=
 github.com/hashicorp/terraform-exec v0.21.0/go.mod h1:1PPeMYou+KDUSSeRE9szMZ/oHf4fYUmB923Wzbq1ICg=
-github.com/hashicorp/terraform-json v0.22.1 h1:xft84GZR0QzjPVWs4lRUwvTcPnegqlyS7orfb5Ltvec=
-github.com/hashicorp/terraform-json v0.22.1/go.mod h1:JbWSQCLFSXFFhg42T7l9iJwdGXBYV8fmmD6o/ML4p3A=
-github.com/hashicorp/terraform-plugin-codegen-framework v0.4.0 h1:xB96Rakulnn7ZxikDj8glCyojKpTbW+SGm6QxipoNxU=
-github.com/hashicorp/terraform-plugin-codegen-framework v0.4.0/go.mod h1:nXlVjqHFBDr6EXnKTT9RCLmwnuTYj/3LE4ffkIdOtog=
+github.com/hashicorp/terraform-json v0.23.0 h1:sniCkExU4iKtTADReHzACkk8fnpQXrdD2xoR+lppBkI=
+github.com/hashicorp/terraform-json v0.23.0/go.mod h1:MHdXbBAbSg0GvzuWazEGKAn/cyNfIB7mN6y7KJN6y2c=
+github.com/hashicorp/terraform-plugin-codegen-framework v0.4.1 h1:eaI/3dsu2T5QAXbA+7N+B+UBj20GdtYnsRuYypKh3S4=
+github.com/hashicorp/terraform-plugin-codegen-framework v0.4.1/go.mod h1:kpYM23L7NtcfaQdWAN0QFkV/lU0w16qJ2ddAPCI4zAg=
 github.com/hashicorp/terraform-plugin-codegen-openapi v0.3.0 h1:IKpc337XKk50QyQPSxLrHwdqSo1E2XqCMxFkWsZcTvc=
 github.com/hashicorp/terraform-plugin-codegen-openapi v0.3.0/go.mod h1:tT6wl80h7nsMBw+1yZRgJXi+Ys85PUai11weDqysvp4=
-github.com/hashicorp/terraform-plugin-codegen-spec v0.1.1 h1:7djpLeqtz0x6w01W4hckWwINJUnfXn2zGr/EhSC8rek=
-github.com/hashicorp/terraform-plugin-codegen-spec v0.1.1/go.mod h1:PQn6bDD8UWoAVJoHXqFk2i/RmLbeQBjbiP38i+E+YIw=
-github.com/hashicorp/terraform-plugin-docs v0.19.4 h1:G3Bgo7J22OMtegIgn8Cd/CaSeyEljqjH3G39w28JK4c=
-github.com/hashicorp/terraform-plugin-docs v0.19.4/go.mod h1:4pLASsatTmRynVzsjEhbXZ6s7xBlUw/2Kt0zfrq8HxA=
-github.com/hashicorp/terraform-plugin-framework v1.11.0 h1:M7+9zBArexHFXDx/pKTxjE6n/2UCXY6b8FIq9ZYhwfE=
-github.com/hashicorp/terraform-plugin-framework v1.11.0/go.mod h1:qBXLDn69kM97NNVi/MQ9qgd1uWWsVftGSnygYG1tImM=
-github.com/hashicorp/terraform-plugin-framework-validators v0.13.0 h1:bxZfGo9DIUoLLtHMElsu+zwqI4IsMZQBRRy4iLzZJ8E=
-github.com/hashicorp/terraform-plugin-framework-validators v0.13.0/go.mod h1:wGeI02gEhj9nPANU62F2jCaHjXulejm/X+af4PdZaNo=
-github.com/hashicorp/terraform-plugin-go v0.23.0 h1:AALVuU1gD1kPb48aPQUjug9Ir/125t+AAurhqphJ2Co=
-github.com/hashicorp/terraform-plugin-go v0.23.0/go.mod h1:1E3Cr9h2vMlahWMbsSEcNrOCxovCZhOOIXjFHbjc/lQ=
+github.com/hashicorp/terraform-plugin-codegen-spec v0.2.0 h1:91dQG1A/DxP6vRz9GiytDTrZTXDbhHPvmpYnAyWA/Vw=
+github.com/hashicorp/terraform-plugin-codegen-spec v0.2.0/go.mod h1:fywrEKpordQypmAjz/HIfm2LuNVmyJ6KDe8XT9GdJxQ=
+github.com/hashicorp/terraform-plugin-docs v0.20.0 h1:ox7rm1FN0dVZaJBUzkVVh10R1r3+FeMQWL0QopQ9d7o=
+github.com/hashicorp/terraform-plugin-docs v0.20.0/go.mod h1:A/+4SVMdAkQYtIBtaxV0H7AU862TxVZk/hhKaMDQB6Y=
+github.com/hashicorp/terraform-plugin-framework v1.13.0 h1:8OTG4+oZUfKgnfTdPTJwZ532Bh2BobF4H+yBiYJ/scw=
+github.com/hashicorp/terraform-plugin-framework v1.13.0/go.mod h1:j64rwMGpgM3NYXTKuxrCnyubQb/4VKldEKlcG8cvmjU=
+github.com/hashicorp/terraform-plugin-framework-timeouts v0.4.1 h1:gm5b1kHgFFhaKFhm4h2TgvMUlNzFAtUqlcOWnWPm+9E=
+github.com/hashicorp/terraform-plugin-framework-timeouts v0.4.1/go.mod h1:MsjL1sQ9L7wGwzJ5RjcI6FzEMdyoBnw+XK8ZnOvQOLY=
+github.com/hashicorp/terraform-plugin-framework-validators v0.15.0 h1:RXMmu7JgpFjnI1a5QjMCBb11usrW2OtAG+iOTIj5c9Y=
+github.com/hashicorp/terraform-plugin-framework-validators v0.15.0/go.mod h1:Bh89/hNmqsEWug4/XWKYBwtnw3tbz5BAy1L1OgvbIaY=
+github.com/hashicorp/terraform-plugin-go v0.25.0 h1:oi13cx7xXA6QciMcpcFi/rwA974rdTxjqEhXJjbAyks=
+github.com/hashicorp/terraform-plugin-go v0.25.0/go.mod h1:+SYagMYadJP86Kvn+TGeV+ofr/R3g4/If0O5sO96MVw=
 github.com/hashicorp/terraform-plugin-log v0.9.0 h1:i7hOA+vdAItN1/7UrfBqBwvYPQ9TFvymaRGZED3FCV0=
 github.com/hashicorp/terraform-plugin-log v0.9.0/go.mod h1:rKL8egZQ/eXSyDqzLUuwUYLVdlYeamldAHSxjUFADow=
-github.com/hashicorp/terraform-plugin-sdk/v2 v2.34.0 h1:kJiWGx2kiQVo97Y5IOGR4EMcZ8DtMswHhUuFibsCQQE=
-github.com/hashicorp/terraform-plugin-sdk/v2 v2.34.0/go.mod h1:sl/UoabMc37HA6ICVMmGO+/0wofkVIRxf+BMb/dnoIg=
-github.com/hashicorp/terraform-plugin-testing v1.10.0 h1:2+tmRNhvnfE4Bs8rB6v58S/VpqzGC6RCh9Y8ujdn+aw=
-github.com/hashicorp/terraform-plugin-testing v1.10.0/go.mod h1:iWRW3+loP33WMch2P/TEyCxxct/ZEcCGMquSLSCVsrc=
+github.com/hashicorp/terraform-plugin-sdk/v2 v2.35.0 h1:wyKCCtn6pBBL46c1uIIBNUOWlNfYXfXpVo16iDyLp8Y=
+github.com/hashicorp/terraform-plugin-sdk/v2 v2.35.0/go.mod h1:B0Al8NyYVr8Mp/KLwssKXG1RqnTk7FySqSn4fRuLNgw=
+github.com/hashicorp/terraform-plugin-testing v1.11.0 h1:MeDT5W3YHbONJt2aPQyaBsgQeAIckwPX41EUHXEn29A=
+github.com/hashicorp/terraform-plugin-testing v1.11.0/go.mod h1:WNAHQ3DcgV/0J+B15WTE6hDvxcUdkPPpnB1FR3M910U=
 github.com/hashicorp/terraform-registry-address v0.2.3 h1:2TAiKJ1A3MAkZlH1YI/aTVcLZRu7JseiXNRHbOAyoTI=
 github.com/hashicorp/terraform-registry-address v0.2.3/go.mod h1:lFHA76T8jfQteVfT7caREqguFrW3c4MFSPhZB7HHgUM=
 github.com/hashicorp/terraform-svchost v0.1.1 h1:EZZimZ1GxdqFRinZ1tpJwVxxt49xc/S52uzrw4x0jKQ=
 github.com/hashicorp/terraform-svchost v0.1.1/go.mod h1:mNsjQfZyf/Jhz35v6/0LWcv26+X7JPS+buii2c9/ctc=
-github.com/hashicorp/yamux v0.1.1 h1:yrQxtgseBDrq9Y652vSRDvsKCJKOUD+GzTS4Y0Y8pvE=
-github.com/hashicorp/yamux v0.1.1/go.mod h1:CtWFDAQgb7dxtzFs4tWbplKIe2jSi3+5vKbgIO0SLnQ=
+github.com/hashicorp/yamux v0.1.2 h1:XtB8kyFOyHXYVFnwT5C3+Bdo8gArse7j2AQ0DA0Uey8=
+github.com/hashicorp/yamux v0.1.2/go.mod h1:C+zze2n6e/7wshOZep2A70/aQU6QBRWJO/G6FT1wIns=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/huandu/xstrings v1.3.3/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/huandu/xstrings v1.4.0 h1:D17IlohoQq4UcpqD7fDk80P7l+lwAmlFaBHgOipl2FU=
@@ -173,8 +175,8 @@ github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:
 github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
 github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4=
 github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
-github.com/invopop/yaml v0.2.0 h1:7zky/qH+O0DwAyoobXUqvVBwgBFRxKoQ/3FjcVpjTMY=
-github.com/invopop/yaml v0.2.0/go.mod h1:2XuRLgs/ouIrW3XNzuNj7J3Nvu/Dig5MXvbCEdiBN3Q=
+github.com/invopop/yaml v0.3.1 h1:f0+ZpmhfBSS4MhG+4HYseMdJhoeeopbSKbq5Rpeelso=
+github.com/invopop/yaml v0.3.1/go.mod h1:PMOp3nn4/12yEZUFfmOuNHJsZToEEOwoWsT+D81KkeA=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
 github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c=
@@ -221,8 +223,8 @@ github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwd
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
 github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
 github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
-github.com/oapi-codegen/oapi-codegen/v2 v2.3.0 h1:rICjNsHbPP1LttefanBPnwsSwl09SqhCO7Ee623qR84=
-github.com/oapi-codegen/oapi-codegen/v2 v2.3.0/go.mod h1:4k+cJeSq5ntkwlcpQSxLxICCxQzCL772o30PxdibRt4=
+github.com/oapi-codegen/oapi-codegen/v2 v2.4.1 h1:ykgG34472DWey7TSjd8vIfNykXgjOgYJZoQbKfEeY/Q=
+github.com/oapi-codegen/oapi-codegen/v2 v2.4.1/go.mod h1:N5+lY1tiTDV3V1BeHtOxeWXHoPVeApvsvjJqegfoaz8=
 github.com/oapi-codegen/runtime v1.1.1 h1:EXLHh0DXIJnWhdRPN2w4MXAzFyE4CskzhNLUmtpMYro=
 github.com/oapi-codegen/runtime v1.1.1/go.mod h1:SK9X900oXmPWilYR5/WKPzt3Kqxn/uS/+lbpREv+eCg=
 github.com/oklog/run v1.1.0 h1:GEenZ1cK0+q0+wsJew9qUg/DyD8k3JzYsZAi5gYi2mA=
@@ -254,8 +256,8 @@ github.com/posener/complete v1.2.3/go.mod h1:WZIdtGGp+qx0sLrYKtIRAruyNpv6hFCicSg
 github.com/rivo/uniseg v0.2.0 h1:S1pD9weZBuJdFmowNwbpi7BJ8TNftyUImj/0WQi72jY=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
-github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
-github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
+github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
+github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
 github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
 github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
@@ -264,6 +266,8 @@ github.com/shopspring/decimal v1.3.1 h1:2Usl1nmF/WZucqkFZhnfFYxxxu8LG21F6nPQBE5g
 github.com/shopspring/decimal v1.3.1/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
 github.com/skeema/knownhosts v1.2.2 h1:Iug2P4fLmDw9f41PB6thxUkNUkJzB5i+1/exaj40L3A=
 github.com/skeema/knownhosts v1.2.2/go.mod h1:xYbVRSPxqBZFrdmDyMmsOs+uX1UZC3nTN3ThzgDxUwo=
+github.com/speakeasy-api/openapi-overlay v0.9.0 h1:Wrz6NO02cNlLzx1fB093lBlYxSI54VRhy1aSutx0PQg=
+github.com/speakeasy-api/openapi-overlay v0.9.0/go.mod h1:f5FloQrHA7MsxYg9djzMD5h6dxrHjVVByWKh7an8TRc=
 github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
 github.com/spf13/cast v1.5.1 h1:R+kOtfhWQE6TVQzY+4D7wJLBgkdVasCEFxSUBYBYIlA=
 github.com/spf13/cast v1.5.1/go.mod h1:b9PdjNptOpzXr7Rq1q9gJML/2cdGQAo69NKzQ10KN48=
@@ -300,8 +304,8 @@ github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17
 github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/yuin/goldmark v1.7.1 h1:3bajkSilaCbjdKVsKdZjZCLBNPL9pYzrCakKaf4U49U=
-github.com/yuin/goldmark v1.7.1/go.mod h1:uzxRWxtg69N339t3louHJ7+O03ezfj6PlliRlaOzY1E=
+github.com/yuin/goldmark v1.7.7 h1:5m9rrB1sW3JUMToKFQfb+FGt1U7r57IHu5GrYrG2nqU=
+github.com/yuin/goldmark v1.7.7/go.mod h1:uzxRWxtg69N339t3louHJ7+O03ezfj6PlliRlaOzY1E=
 github.com/yuin/goldmark-meta v1.1.0 h1:pWw+JLHGZe8Rk0EGsMVssiNb/AaPMHfSRszZeUeiOUc=
 github.com/yuin/goldmark-meta v1.1.0/go.mod h1:U4spWENafuA7Zyg+Lj5RqK/MF+ovMYtBvXi1lBb2VP0=
 github.com/zclconf/go-cty v1.15.0 h1:tTCRWxsexYUmtt/wVxgDClUe+uQusuI443uL6e+5sXQ=
@@ -315,14 +319,14 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
-golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A=
-golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70=
+golang.org/x/crypto v0.29.0 h1:L5SG1JTTXupVV3n6sUqMTeWbjAyfPwoda2DLX8J8FrQ=
+golang.org/x/crypto v0.29.0/go.mod h1:+F4F4N5hv6v38hfeYwTdx20oUvLLc+QfrE9Ax9HtgRg=
 golang.org/x/exp v0.0.0-20240409090435-93d18d7e34b8 h1:ESSUROHIBHg7USnszlcdmjBEwdMj9VUvU+OPk4yl2mc=
 golang.org/x/exp v0.0.0-20240409090435-93d18d7e34b8/go.mod h1:/lliqkxwWAhPjf5oSOIJup2XcqJaw8RGS6k3TGEc7GI=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.19.0 h1:fEdghXQSo20giMthA7cd28ZC+jts4amQ3YMXiP5oMQ8=
-golang.org/x/mod v0.19.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.21.0 h1:vvrHzRwRfVKSiLrG+d4FMl/Qi4ukBCE6kZlTUkDYRT0=
+golang.org/x/mod v0.21.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -333,14 +337,14 @@ golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT
 golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
-golang.org/x/net v0.29.0 h1:5ORfpBpCs4HzDYoodCDBbwHzdR5UrLBZ3sOnUJmFoHo=
-golang.org/x/net v0.29.0/go.mod h1:gLkgy8jTGERgjzMic6DS9+SP0ajcu6Xu3Orq/SpETg0=
+golang.org/x/net v0.30.0 h1:AcW1SDZMkb8IpzCdQUaIq2sP4sZ4zw+55h6ynffypl4=
+golang.org/x/net v0.30.0/go.mod h1:2wGyMJ5iFasEhkwi13ChkO/t1ECNC4X4eBKkVFyYFlU=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
-golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.9.0 h1:fEo0HyrW1GIgZdpbhCRO0PkJajUS5H9IFUztCgEo2jQ=
+golang.org/x/sync v0.9.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -366,8 +370,8 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.25.0 h1:r+8e+loiHxRqhXVl6ML1nO3l1+oFoWbnlu2Ehimmi34=
-golang.org/x/sys v0.25.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.27.0 h1:wBqf8DvsY9Y/2P8gAfPDEYNuS30J4lPHJxXSb/nJZ+s=
+golang.org/x/sys v0.27.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
@@ -378,8 +382,8 @@ golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.18.0 h1:XvMDiNzPAl0jr17s6W9lcaIhGUfUORdGCNsuLmPG224=
-golang.org/x/text v0.18.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
+golang.org/x/text v0.20.0 h1:gK/Kv2otX8gz+wn7Rmb3vT96ZwuoxnQlY+HlJVj7Qug=
+golang.org/x/text v0.20.0/go.mod h1:D4IsuqiFMhST5bX19pQ9ikHC2GsaKyk/oF+pn3ducp4=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
@@ -393,10 +397,10 @@ golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8T
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
 google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1 h1:pPJltXNxVzT4pK9yD8vR9X75DaWYYmLGMsEvBfFQZzQ=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1/go.mod h1:UqMtugtsSgubUsoxbuAoiCXvqvErP7Gf0so0mK9tHxU=
-google.golang.org/grpc v1.66.2 h1:3QdXkuq3Bkh7w+ywLdLvM56cmGvQHUMZpiCzt6Rqaoo=
-google.golang.org/grpc v1.66.2/go.mod h1:s3/l6xSSCURdVfAnL+TqCNMyTDAGN6+lZeVxnZR128Y=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20241021214115-324edc3d5d38 h1:zciRKQ4kBpFgpfC5QQCVtnnNAcLIqweL7plyZRQHVpI=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20241021214115-324edc3d5d38/go.mod h1:GX3210XPVPUjJbTUbvwI8f2IpZDMZuPJWDzDuebbviI=
+google.golang.org/grpc v1.67.1 h1:zWnc1Vrcno+lHZCOofnIMvycFcc0QRGIzm9dhnDX68E=
+google.golang.org/grpc v1.67.1/go.mod h1:1gLDyUQU7CTLJI90u3nXZ9ekeghjeM7pTDZlqFNg2AA=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -405,8 +409,8 @@ google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzi
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg=
-google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
+google.golang.org/protobuf v1.35.1 h1:m3LfL6/Ca+fqnjnlqQXNpFPABW1UD7mjh8KO2mKFytA=
+google.golang.org/protobuf v1.35.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -425,6 +429,5 @@ gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20191026110619-0b21df46bc1d/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

internal/binarylane/client.go

@@ -0,0 +1,64 @@
+package binarylane
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httputil"
+	"os"
+
+	"github.com/deepmap/oapi-codegen/pkg/securityprovider"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
+)
+
+func NewClientWithDefaultConfig() (*ClientWithResponses, error) {
+	return NewClientWithConfig("", "")
+}
+
+func NewClientWithConfig(endpoint string, token string) (*ClientWithResponses, error) {
+	if endpoint == "" {
+		endpoint = os.Getenv("BINARYLANE_API_ENDPOINT")
+		if endpoint == "" {
+			endpoint = "https://api.binarylane.com.au/v2"
+		}
+	}
+
+	if token == "" {
+		token = os.Getenv("BINARYLANE_API_TOKEN")
+		if token == "" {
+			return nil, errors.New("missing or empty value for the Binary Lane API " +
+				"token. Set the `api_token` value in the configuration or use the " +
+				"BINARYLANE_API_TOKEN environment variable. If either is already set, " +
+				"ensure the value is not empty")
+		}
+	}
+
+	auth, err := securityprovider.NewSecurityProviderBearerToken(token)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create API client with supplied API token: %w", err)
+	}
+
+	if endpoint == "" {
+		endpoint = "https://api.binarylane.com.au/v2"
+	}
+
+	client, err := NewClientWithResponses(
+		endpoint,
+		WithRequestEditorFn(func(ctx context.Context, req *http.Request) error {
+			dump, err := httputil.DumpRequestOut(req, true)
+			if err != nil {
+				return err
+			}
+			tflog.Debug(ctx, fmt.Sprintf("%q\n", dump))
+			return nil
+		}),
+		WithRequestEditorFn(auth.Intercept), // include auth AFTER the request logger
+	)
+
+	if err != nil {
+		return nil, fmt.Errorf("failed to create Binary Lane API client: %w", err)
+	}
+
+	return client, nil
+}

internal/binarylane/client_gen.go

@@ -1,6 +1,6 @@
 // Package binarylane provides primitives to interact with the openapi HTTP API.
 //
-// Code generated by github.com/oapi-codegen/oapi-codegen/v2 version v2.3.0 DO NOT EDIT.
+// Code generated by github.com/oapi-codegen/oapi-codegen/v2 version v2.4.1 DO NOT EDIT.
 package binarylane
 
 import (

internal/binarylane/fetch-openapi.sh

@@ -12,6 +12,9 @@ cat <<<$(jq '.paths |= with_entries(.key |= sub("/v2/"; "/"))' $OPENAPI_FILE) >$
 # Terraform can't handle oneOf types, so we need to replace them with basic types
 cat <<<$(jq '.components.schemas.CreateServerRequest.properties.image |= del(.oneOf) + {type:"string"}' $OPENAPI_FILE) >$OPENAPI_FILE
 cat <<<$(jq '.components.schemas.CreateServerRequest.properties.ssh_keys.items |= del(.oneOf) + {type:"integer"}' $OPENAPI_FILE) >$OPENAPI_FILE
+cat <<<$(jq '.components.schemas.Rebuild.properties.image |= del(.oneOf) + {type:"string"}' $OPENAPI_FILE) >$OPENAPI_FILE
+cat <<<$(jq '.components.schemas.ImageOptions.properties.ssh_keys.items |= del(.oneOf) + {type:"integer"}' $OPENAPI_FILE) >$OPENAPI_FILE
+cat <<<$(jq '.components.schemas.ChangeImage.properties.image |= del(.oneOf) + {type:"string"}' $OPENAPI_FILE) >$OPENAPI_FILE
 cat <<<$(jq '.paths["/account/keys/{key_id}"].delete.parameters[0].schema |= del(.oneOf) + {type:"integer"}' $OPENAPI_FILE) >$OPENAPI_FILE
 cat <<<$(jq '.paths["/account/keys/{key_id}"].put.parameters[0].schema |= del(.oneOf) + {type:"integer"}' $OPENAPI_FILE) >$OPENAPI_FILE
 cat <<<$(jq '.paths["/account/keys/{key_id}"].get.parameters[0].schema |= del(.oneOf) + {type:"integer"}' $OPENAPI_FILE) >$OPENAPI_FILE
@@ -39,4 +42,5 @@ cat <<<$(jq '.components.schemas.AdvancedFirewallRule.properties.source_addresse
 ## Load Balancer
 cat <<<$(jq '.components.schemas.CreateLoadBalancerRequest.properties.forwarding_rules += {"x-oapi-codegen-extra-tags": {"tfsdk": "forwarding_rules"}}' $OPENAPI_FILE) >$OPENAPI_FILE
 cat <<<$(jq '.components.schemas.ForwardingRule.properties.entry_protocol += {"x-oapi-codegen-extra-tags": {"tfsdk": "entry_protocol"}}' $OPENAPI_FILE) >$OPENAPI_FILE
+cat <<<$(jq '.components.schemas.LoadBalancer.properties.health_check += {"x-oapi-codegen-extra-tags": {"tfsdk": "health_check"}}' $OPENAPI_FILE) >$OPENAPI_FILE
 cat <<<$(jq '.components.schemas.HealthCheckProtocol |= del(.enum)' $OPENAPI_FILE) >$OPENAPI_FILE

internal/binarylane/openapi.json

@@ -9514,17 +9514,10 @@
         "type": "object",
         "properties": {
           "image": {
-            "oneOf": [
-              {
-                "type": "integer"
-              },
-              {
-                "type": "string"
-              }
-            ],
             "description": "The slug or ID of the selected image. What type of image is permitted here varies based on the server action.",
             "nullable": true,
-            "example": 5
+            "example": 5,
+            "type": "string"
           },
           "options": {
             "allOf": [
@@ -11306,15 +11299,8 @@
           "ssh_keys": {
             "type": "array",
             "items": {
-              "oneOf": [
-                {
-                  "type": "integer"
-                },
-                {
-                  "type": "string"
-                }
-              ],
-              "example": 5
+              "example": 5,
+              "type": "integer"
             },
             "description": "This may be either the existing SSH Keys IDs or fingerprints.\nIf this is null or not provided any SSH keys that have been marked as default will be deployed (if the operating system supports SSH Keys).\nSubmit an empty array to disable deployment of default keys.",
             "nullable": true
@@ -11845,7 +11831,10 @@
               }
             ],
             "description": "The rules that determine which servers are considered 'healthy' and in the server pool for the load balancer.",
-            "readOnly": true
+            "readOnly": true,
+            "x-oapi-codegen-extra-tags": {
+              "tfsdk": "health_check"
+            }
           },
           "region": {
             "allOf": [
@@ -12488,17 +12477,10 @@
             "type": "string"
           },
           "image": {
-            "oneOf": [
-              {
-                "type": "integer"
-              },
-              {
-                "type": "string"
-              }
-            ],
             "description": "The Operating System ID or slug or Backup image ID to use as a base for the rebuild.",
             "nullable": true,
-            "example": 5
+            "example": 5,
+            "type": "string"
           },
           "options": {
             "allOf": [

internal/binarylane/types_gen.go

@@ -1,6 +1,6 @@
 // Package binarylane provides primitives to interact with the openapi HTTP API.
 //
-// Code generated by github.com/oapi-codegen/oapi-codegen/v2 version v2.3.0 DO NOT EDIT.
+// Code generated by github.com/oapi-codegen/oapi-codegen/v2 version v2.4.1 DO NOT EDIT.
 package binarylane
 
 import (
@@ -854,23 +854,12 @@ type ChangeBackupScheduleType string
 // ChangeImage defines model for ChangeImage.
 type ChangeImage struct {
 	// Image The slug or ID of the selected image. What type of image is permitted here varies based on the server action.
-	Image *ChangeImage_Image `json:"image"`
+	Image *string `json:"image"`
 
 	// Options Additional options for the server configuration after the image has been changed.
 	Options *ImageOptions `json:"options"`
 }
 
-// ChangeImageImage0 defines model for .
-type ChangeImageImage0 = int
-
-// ChangeImageImage1 defines model for .
-type ChangeImageImage1 = string
-
-// ChangeImage_Image The slug or ID of the selected image. What type of image is permitted here varies based on the server action.
-type ChangeImage_Image struct {
-	union json.RawMessage
-}
-
 // ChangeIpv6 Enable or Disable IPv6 for a Server
 type ChangeIpv6 struct {
 	// Enabled The desired enabled status of IPv6.
@@ -1662,23 +1651,12 @@ type ImageOptions struct {
 	// SshKeys This may be either the existing SSH Keys IDs or fingerprints.
 	// If this is null or not provided any SSH keys that have been marked as default will be deployed (if the operating system supports SSH Keys).
 	// Submit an empty array to disable deployment of default keys.
-	SshKeys *[]ImageOptions_SshKeys_Item `json:"ssh_keys"`
+	SshKeys *[]int `json:"ssh_keys"`
 
 	// UserData If provided this will be used to initialise the new server. This must be left null if the Image does not support UserData, see DistributionInfo.Features for more information.
 	UserData *string `json:"user_data"`
 }
 
-// ImageOptionsSshKeys0 defines model for .
-type ImageOptionsSshKeys0 = int
-
-// ImageOptionsSshKeys1 defines model for .
-type ImageOptionsSshKeys1 = string
-
-// ImageOptions_SshKeys_Item defines model for ImageOptions.ssh_keys.Item.
-type ImageOptions_SshKeys_Item struct {
-	union json.RawMessage
-}
-
 // ImageQueryType
 // | Value | Description |
 // | ----- | ----------- |
@@ -1860,7 +1838,7 @@ type LoadBalancer struct {
 	ForwardingRules *[]ForwardingRule `json:"forwarding_rules,omitempty"`
 
 	// HealthCheck The rules that determine which servers are considered 'healthy' and in the server pool for the load balancer.
-	HealthCheck *HealthCheck `json:"health_check,omitempty"`
+	HealthCheck *HealthCheck `json:"health_check,omitempty" tfsdk:"health_check"`
 
 	// Id The ID of the load balancer.
 	Id *int64 `json:"id,omitempty"`
@@ -2176,24 +2154,13 @@ type RebootType string
 // Rebuild Rebuild an Existing Server
 type Rebuild struct {
 	// Image The Operating System ID or slug or Backup image ID to use as a base for the rebuild.
-	Image *Rebuild_Image `json:"image"`
+	Image *string `json:"image"`
 
 	// Options Additional options. Leaving this entirely null or any of the properties included null will use the defaults from the existing server.
 	Options *ImageOptions `json:"options"`
 	Type    RebuildType   `json:"type"`
 }
 
-// RebuildImage0 defines model for .
-type RebuildImage0 = int
-
-// RebuildImage1 defines model for .
-type RebuildImage1 = string
-
-// Rebuild_Image The Operating System ID or slug or Backup image ID to use as a base for the rebuild.
-type Rebuild_Image struct {
-	union json.RawMessage
-}
-
 // RebuildType defines model for Rebuild.Type.
 type RebuildType string
 
@@ -3985,130 +3952,6 @@ func (a ValidationProblemDetails) MarshalJSON() ([]byte, error) {
 	return json.Marshal(object)
 }
 
-// AsChangeImageImage0 returns the union data inside the ChangeImage_Image as a ChangeImageImage0
-func (t ChangeImage_Image) AsChangeImageImage0() (ChangeImageImage0, error) {
-	var body ChangeImageImage0
-	err := json.Unmarshal(t.union, &body)
-	return body, err
-}
-
-// FromChangeImageImage0 overwrites any union data inside the ChangeImage_Image as the provided ChangeImageImage0
-func (t *ChangeImage_Image) FromChangeImageImage0(v ChangeImageImage0) error {
-	b, err := json.Marshal(v)
-	t.union = b
-	return err
-}
-
-// MergeChangeImageImage0 performs a merge with any union data inside the ChangeImage_Image, using the provided ChangeImageImage0
-func (t *ChangeImage_Image) MergeChangeImageImage0(v ChangeImageImage0) error {
-	b, err := json.Marshal(v)
-	if err != nil {
-		return err
-	}
-
-	merged, err := runtime.JSONMerge(t.union, b)
-	t.union = merged
-	return err
-}
-
-// AsChangeImageImage1 returns the union data inside the ChangeImage_Image as a ChangeImageImage1
-func (t ChangeImage_Image) AsChangeImageImage1() (ChangeImageImage1, error) {
-	var body ChangeImageImage1
-	err := json.Unmarshal(t.union, &body)
-	return body, err
-}
-
-// FromChangeImageImage1 overwrites any union data inside the ChangeImage_Image as the provided ChangeImageImage1
-func (t *ChangeImage_Image) FromChangeImageImage1(v ChangeImageImage1) error {
-	b, err := json.Marshal(v)
-	t.union = b
-	return err
-}
-
-// MergeChangeImageImage1 performs a merge with any union data inside the ChangeImage_Image, using the provided ChangeImageImage1
-func (t *ChangeImage_Image) MergeChangeImageImage1(v ChangeImageImage1) error {
-	b, err := json.Marshal(v)
-	if err != nil {
-		return err
-	}
-
-	merged, err := runtime.JSONMerge(t.union, b)
-	t.union = merged
-	return err
-}
-
-func (t ChangeImage_Image) MarshalJSON() ([]byte, error) {
-	b, err := t.union.MarshalJSON()
-	return b, err
-}
-
-func (t *ChangeImage_Image) UnmarshalJSON(b []byte) error {
-	err := t.union.UnmarshalJSON(b)
-	return err
-}
-
-// AsImageOptionsSshKeys0 returns the union data inside the ImageOptions_SshKeys_Item as a ImageOptionsSshKeys0
-func (t ImageOptions_SshKeys_Item) AsImageOptionsSshKeys0() (ImageOptionsSshKeys0, error) {
-	var body ImageOptionsSshKeys0
-	err := json.Unmarshal(t.union, &body)
-	return body, err
-}
-
-// FromImageOptionsSshKeys0 overwrites any union data inside the ImageOptions_SshKeys_Item as the provided ImageOptionsSshKeys0
-func (t *ImageOptions_SshKeys_Item) FromImageOptionsSshKeys0(v ImageOptionsSshKeys0) error {
-	b, err := json.Marshal(v)
-	t.union = b
-	return err
-}
-
-// MergeImageOptionsSshKeys0 performs a merge with any union data inside the ImageOptions_SshKeys_Item, using the provided ImageOptionsSshKeys0
-func (t *ImageOptions_SshKeys_Item) MergeImageOptionsSshKeys0(v ImageOptionsSshKeys0) error {
-	b, err := json.Marshal(v)
-	if err != nil {
-		return err
-	}
-
-	merged, err := runtime.JSONMerge(t.union, b)
-	t.union = merged
-	return err
-}
-
-// AsImageOptionsSshKeys1 returns the union data inside the ImageOptions_SshKeys_Item as a ImageOptionsSshKeys1
-func (t ImageOptions_SshKeys_Item) AsImageOptionsSshKeys1() (ImageOptionsSshKeys1, error) {
-	var body ImageOptionsSshKeys1
-	err := json.Unmarshal(t.union, &body)
-	return body, err
-}
-
-// FromImageOptionsSshKeys1 overwrites any union data inside the ImageOptions_SshKeys_Item as the provided ImageOptionsSshKeys1
-func (t *ImageOptions_SshKeys_Item) FromImageOptionsSshKeys1(v ImageOptionsSshKeys1) error {
-	b, err := json.Marshal(v)
-	t.union = b
-	return err
-}
-
-// MergeImageOptionsSshKeys1 performs a merge with any union data inside the ImageOptions_SshKeys_Item, using the provided ImageOptionsSshKeys1
-func (t *ImageOptions_SshKeys_Item) MergeImageOptionsSshKeys1(v ImageOptionsSshKeys1) error {
-	b, err := json.Marshal(v)
-	if err != nil {
-		return err
-	}
-
-	merged, err := runtime.JSONMerge(t.union, b)
-	t.union = merged
-	return err
-}
-
-func (t ImageOptions_SshKeys_Item) MarshalJSON() ([]byte, error) {
-	b, err := t.union.MarshalJSON()
-	return b, err
-}
-
-func (t *ImageOptions_SshKeys_Item) UnmarshalJSON(b []byte) error {
-	err := t.union.UnmarshalJSON(b)
-	return err
-}
-
 // AsNetworkNetmask0 returns the union data inside the Network_Netmask as a NetworkNetmask0
 func (t Network_Netmask) AsNetworkNetmask0() (NetworkNetmask0, error) {
 	var body NetworkNetmask0
@@ -4171,68 +4014,6 @@ func (t *Network_Netmask) UnmarshalJSON(b []byte) error {
 	return err
 }
 
-// AsRebuildImage0 returns the union data inside the Rebuild_Image as a RebuildImage0
-func (t Rebuild_Image) AsRebuildImage0() (RebuildImage0, error) {
-	var body RebuildImage0
-	err := json.Unmarshal(t.union, &body)
-	return body, err
-}
-
-// FromRebuildImage0 overwrites any union data inside the Rebuild_Image as the provided RebuildImage0
-func (t *Rebuild_Image) FromRebuildImage0(v RebuildImage0) error {
-	b, err := json.Marshal(v)
-	t.union = b
-	return err
-}
-
-// MergeRebuildImage0 performs a merge with any union data inside the Rebuild_Image, using the provided RebuildImage0
-func (t *Rebuild_Image) MergeRebuildImage0(v RebuildImage0) error {
-	b, err := json.Marshal(v)
-	if err != nil {
-		return err
-	}
-
-	merged, err := runtime.JSONMerge(t.union, b)
-	t.union = merged
-	return err
-}
-
-// AsRebuildImage1 returns the union data inside the Rebuild_Image as a RebuildImage1
-func (t Rebuild_Image) AsRebuildImage1() (RebuildImage1, error) {
-	var body RebuildImage1
-	err := json.Unmarshal(t.union, &body)
-	return body, err
-}
-
-// FromRebuildImage1 overwrites any union data inside the Rebuild_Image as the provided RebuildImage1
-func (t *Rebuild_Image) FromRebuildImage1(v RebuildImage1) error {
-	b, err := json.Marshal(v)
-	t.union = b
-	return err
-}
-
-// MergeRebuildImage1 performs a merge with any union data inside the Rebuild_Image, using the provided RebuildImage1
-func (t *Rebuild_Image) MergeRebuildImage1(v RebuildImage1) error {
-	b, err := json.Marshal(v)
-	if err != nil {
-		return err
-	}
-
-	merged, err := runtime.JSONMerge(t.union, b)
-	t.union = merged
-	return err
-}
-
-func (t Rebuild_Image) MarshalJSON() ([]byte, error) {
-	b, err := t.union.MarshalJSON()
-	return b, err
-}
-
-func (t *Rebuild_Image) UnmarshalJSON(b []byte) error {
-	err := t.union.UnmarshalJSON(b)
-	return err
-}
-
 // AsRestoreImage0 returns the union data inside the Restore_Image as a RestoreImage0
 func (t Restore_Image) AsRestoreImage0() (RestoreImage0, error) {
 	var body RestoreImage0

internal/provider/load_balancer_data_source.go

@@ -95,7 +95,7 @@ func (d *loadBalancerDataSource) Read(ctx context.Context, req datasource.ReadRe
 
 	diags := SetLoadBalancerModelState(ctx, &data.LoadBalancerModel, lbResp.JSON200.LoadBalancer)
 	resp.Diagnostics.Append(diags...)
-	if diags.HasError() {
+	if resp.Diagnostics.HasError() {
 		return
 	}
 

internal/provider/load_balancer_resource.go

@@ -7,7 +7,9 @@ import (
 	"strconv"
 	"terraform-provider-binarylane/internal/binarylane"
 	"terraform-provider-binarylane/internal/resources"
+	"time"
 
+	"github.com/hashicorp/terraform-plugin-framework-timeouts/resource/timeouts"
 	"github.com/hashicorp/terraform-plugin-framework/attr"
 	"github.com/hashicorp/terraform-plugin-framework/diag"
 	"github.com/hashicorp/terraform-plugin-framework/path"
@@ -36,6 +38,7 @@ type loadBalancerResource struct {
 
 type loadBalancerResourceModel struct {
 	resources.LoadBalancerModel
+	Timeouts timeouts.Value `tfsdk:"timeouts"`
 }
 
 func (r *loadBalancerResource) Metadata(ctx context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
@@ -85,6 +88,11 @@ func (r *loadBalancerResource) Schema(ctx context.Context, req resource.SchemaRe
 			stringplanmodifier.RequiresReplace(),
 		},
 	}
+
+	resp.Schema.Attributes["timeouts"] =
+		timeouts.Attributes(ctx, timeouts.Opts{
+			Create: true,
+		})
 }
 
 func (r *loadBalancerResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
@@ -136,23 +144,77 @@ func (r *loadBalancerResource) Create(ctx context.Context, req resource.CreateRe
 		)
 		return
 	}
-
 	if lbResp.StatusCode() != http.StatusOK {
-		tflog.Info(ctx, fmt.Sprintf("Attempted to create new load balancer: request=%+v", body))
 		resp.Diagnostics.AddError(
-			"Unexpected HTTP status code creating load balancer",
-			fmt.Sprintf("Received %s creating new load balancer: name=%s. Details: %s", lbResp.Status(), data.Name.ValueString(), lbResp.Body))
+			"Unexpected status code creating load balancer",
+			fmt.Sprintf("Received %s creating new load balancer: name=%s. Details: %s", lbResp.Status(), data.Name.ValueString(), lbResp.Body),
+		)
 		return
 	}
 
 	diags = SetLoadBalancerModelState(ctx, &data.LoadBalancerModel, lbResp.JSON200.LoadBalancer)
 	resp.Diagnostics.Append(diags...)
-	if diags.HasError() {
+	if resp.Diagnostics.HasError() {
 		return
 	}
 
 	// Save data into Terraform state
 	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+
+	// Wait for server to be ready
+	var createActionId int64
+	for _, action := range *lbResp.JSON200.Links.Actions {
+		if *action.Rel == "create_load_balancer" {
+			createActionId = *action.Id
+			break
+		}
+	}
+	if createActionId == 0 {
+		resp.Diagnostics.AddError(
+			"Unable to wait for load balancer to be created, links.actions with rel=create_load_balancer missing from response",
+			fmt.Sprintf("Received %s creating new load balancer: name=%s. Details: %s", lbResp.Status(), data.Name.ValueString(), lbResp.Body))
+		return
+	}
+
+	createTimeout, diags := data.Timeouts.Create(ctx, 20*time.Minute)
+	resp.Diagnostics.Append(diags...)
+	ctx, cancel := context.WithTimeout(ctx, createTimeout)
+	defer cancel()
+	var lastReadyResp *binarylane.GetActionsActionIdResponse
+
+retryLoop:
+	for {
+		select {
+		case <-ctx.Done():
+			if lastReadyResp == nil {
+				return
+			}
+			resp.Diagnostics.AddError(
+				"Timed out waiting for load balancer to be created",
+				fmt.Sprintf(
+					"Timed out waiting for load balancer %s to be created, last response was status=%s, body: %s",
+					data.Name.ValueString(),
+					lastReadyResp.Status(),
+					lastReadyResp.Body,
+				),
+			)
+			return
+		default:
+			readyResp, err := r.bc.client.GetActionsActionIdWithResponse(ctx, createActionId)
+			if err != nil {
+				resp.Diagnostics.AddError("Error waiting for load balancer to be created", err.Error())
+				return
+			}
+
+			if readyResp.StatusCode() == http.StatusOK && readyResp.JSON200.Action.CompletedAt != nil {
+				break retryLoop
+			}
+
+			lastReadyResp = readyResp
+			tflog.Debug(ctx, fmt.Sprintf("Waiting for load balancer to be created: name=%s, status=%s, details: %s", data.Name.ValueString(), readyResp.Status(), readyResp.Body))
+		}
+		time.Sleep(time.Second * 5)
+	}
 }
 
 func (r *loadBalancerResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
@@ -185,7 +247,7 @@ func (r *loadBalancerResource) Read(ctx context.Context, req resource.ReadReques
 
 	diags := SetLoadBalancerModelState(ctx, &data.LoadBalancerModel, lbResp.JSON200.LoadBalancer)
 	resp.Diagnostics.Append(diags...)
-	if diags.HasError() {
+	if resp.Diagnostics.HasError() {
 		return
 	}
 
@@ -249,7 +311,7 @@ func (r *loadBalancerResource) Update(ctx context.Context, req resource.UpdateRe
 
 	diags = SetLoadBalancerModelState(ctx, &data.LoadBalancerModel, lbResp.JSON200.LoadBalancer)
 	resp.Diagnostics.Append(diags...)
-	if diags.HasError() {
+	if resp.Diagnostics.HasError() {
 		return
 	}
 

internal/provider/load_balancer_resource_test.go

@@ -1,8 +1,14 @@
 package provider
 
 import (
+	"context"
 	"crypto/rand"
 	"encoding/base64"
+	"fmt"
+	"log"
+	"net/http"
+	"strings"
+	"terraform-provider-binarylane/internal/binarylane"
 	"testing"
 
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -18,32 +24,32 @@ func TestLoadBalancerResource(t *testing.T) {
 	}
 	password := base64.URLEncoding.EncodeToString(pw_bytes)
 
-	resource.Test(t, resource.TestCase{
+	resource.ParallelTest(t, resource.TestCase{
 		ProtoV6ProviderFactories: testAccProtoV6ProviderFactories,
 		Steps: []resource.TestStep{
 			// Create and Read testing
 			{
 				Config: providerConfig + `
 resource "binarylane_server" "test" {
-	count  = 2
-	name   = "tf-test-lb-server-${count.index}"
-  region = "per"
-  image  = "debian-12"
-  size   = "std-min"
-	password = "` + password + `"
-	wait_for_create = 60
+  count             = 2
+  name              = "tf-test-lb-server-${count.index}"
+  region            = "per"
+  image             = "debian-12"
+  size              = "std-min"
+  password          = "` + password + `"
+  public_ipv4_count = 1
 }
 
 resource "binarylane_load_balancer" "test" {
-	name   = "tf-test-lb"
-	server_ids = [binarylane_server.test.0.id, binarylane_server.test.1.id]
-	forwarding_rules = [{ entry_protocol = "http" }]
+  name             = "tf-test-lb"
+  server_ids       = [binarylane_server.test.0.id, binarylane_server.test.1.id]
+  forwarding_rules = [{ entry_protocol = "http" }]
 }
 
 data "binarylane_load_balancer" "test" {
   depends_on = [binarylane_load_balancer.test]
 
-	id = binarylane_load_balancer.test.id
+  id = binarylane_load_balancer.test.id
 }
 `,
 				Check: resource.ComposeAggregateTestCheckFunc(
@@ -84,3 +90,60 @@ data "binarylane_load_balancer" "test" {
 		},
 	})
 }
+
+func init() {
+	resource.AddTestSweepers("load_balancer", &resource.Sweeper{
+		Name:         "load_balancer",
+		Dependencies: []string{"server"},
+		F: func(_ string) error {
+			client, err := binarylane.NewClientWithDefaultConfig()
+
+			if err != nil {
+				return fmt.Errorf("Error creating Binary Lane API client: %w", err)
+			}
+
+			ctx := context.Background()
+
+			var page int32 = 1
+			perPage := int32(200)
+			var nextPage bool = true
+
+			for nextPage {
+				params := binarylane.GetLoadBalancersParams{
+					Page:    &page,
+					PerPage: &perPage,
+				}
+
+				listResp, err := client.GetLoadBalancersWithResponse(ctx, &params)
+				if err != nil {
+					return fmt.Errorf("Error getting load balancers for test sweep: %w", err)
+				}
+
+				if listResp.StatusCode() != http.StatusOK {
+					return fmt.Errorf("Unexpected status code getting load balancers for test sweep: %s", listResp.Body)
+				}
+
+				loadBalancers := *listResp.JSON200.LoadBalancers
+				for _, lb := range loadBalancers {
+					if strings.HasPrefix(*lb.Name, "tf-test-") {
+						deleteResp, err := client.DeleteLoadBalancersLoadBalancerIdWithResponse(ctx, *lb.Id)
+						if err != nil {
+							return fmt.Errorf("Error deleting load balancer %d for test sweep: %w", *lb.Id, err)
+						}
+						if deleteResp.StatusCode() != http.StatusNoContent {
+							return fmt.Errorf("Unexpected status %d deleting load balancer %d in test sweep: %s", deleteResp.StatusCode(), *lb.Id, deleteResp.Body)
+						}
+						log.Println("Deleted load balancer during test sweep:", *lb.Id)
+					}
+				}
+				if listResp.JSON200.Links == nil || listResp.JSON200.Links.Pages == nil || listResp.JSON200.Links.Pages.Next == nil {
+					nextPage = false
+					break
+				}
+
+				page++
+			}
+			return nil
+		},
+	})
+}

internal/provider/provider.go

@@ -2,12 +2,9 @@ package provider
 
 import (
 	"context"
-	"os"
 	"terraform-provider-binarylane/internal/binarylane"
 
-	"github.com/deepmap/oapi-codegen/pkg/securityprovider"
 	"github.com/hashicorp/terraform-plugin-framework/datasource"
-	"github.com/hashicorp/terraform-plugin-framework/path"
 	"github.com/hashicorp/terraform-plugin-framework/provider"
 	"github.com/hashicorp/terraform-plugin-framework/provider/schema"
 	"github.com/hashicorp/terraform-plugin-framework/resource"
@@ -25,8 +22,7 @@ func New(version string) func() provider.Provider {
 }
 
 type BinarylaneClient struct {
-	endpoint string
-	client   *binarylane.ClientWithResponses
+	client *binarylane.ClientWithResponses
 }
 
 type binarylaneProvider struct {
@@ -67,68 +63,17 @@ func (p *binarylaneProvider) Configure(ctx context.Context, req provider.Configu
 		return
 	}
 
-	if config.Endpoint.IsUnknown() {
-		resp.Diagnostics.AddAttributeError(
-			path.Root("api_endpoint"),
-			"Unknown Binary Lane API endpoint",
-			"The provider cannot create the Binary Lane API client as there is an unknown configuration value for the "+
-				"Binary Lane API endpoint. Either target apply the source of the value first, set the value statically in "+
-				"the configuration, or use the BINARYLANE_API_ENDPOINT environment variable.",
-		)
-	}
-	if config.Token.IsUnknown() {
-		resp.Diagnostics.AddAttributeError(
-			path.Root("api_token"),
-			"Unknown Binary Lane token",
-			"The provider cannot create the Binary Lane API client as there is an unknown configuration value for the "+
-				"Binary Lane API token. Either target apply the source of the value first, set the value statically in the "+
-				"configuration, or use the BINARYLANE_API_TOKEN environment variable.",
-		)
-	}
-	if resp.Diagnostics.HasError() {
-		return
-	}
-
-	// Default values to environment variables, but override
-	// with Terraform configuration value if set.
-	endpoint := os.Getenv("BINARYLANE_API_ENDPOINT")
-	token := os.Getenv("BINARYLANE_API_TOKEN")
-	if !config.Endpoint.IsNull() {
-		endpoint = config.Endpoint.ValueString()
-	}
-	if !config.Token.IsNull() {
-		token = config.Token.ValueString()
-	}
-	if endpoint == "" {
-		endpoint = "https://api.binarylane.com.au/v2"
-	}
-	if token == "" {
-		resp.Diagnostics.AddAttributeError(
-			path.Root("api_token"),
-			"Missing Binary Lane API token",
-			"The provider cannot create the Binary Lane API client as there is a missing or empty value for the Binary "+
-				"Lane API token. Set the token value in the configuration or use the BINARYLANE_API_TOKEN environment "+
-				"variable. If either is already set, ensure the value is not empty.",
-		)
-	}
-	if resp.Diagnostics.HasError() {
-		return
-	}
-	auth, err := securityprovider.NewSecurityProviderBearerToken(token)
-	if err != nil {
-		resp.Diagnostics.AddError("Failed to create security provider with supplied token", err.Error())
-		return
-	}
-
-	client, err := binarylane.NewClientWithResponses(endpoint, binarylane.WithRequestEditorFn(auth.Intercept))
+	client, err := binarylane.NewClientWithConfig(
+		config.Endpoint.ValueString(),
+		config.Token.ValueString(),
+	)
 	if err != nil {
 		resp.Diagnostics.AddError("Failed to create Binary Lane API client", err.Error())
 		return
 	}
 
 	binarylaneClient := BinarylaneClient{
-		endpoint: endpoint,
-		client:   client,
+		client: client,
 	}
 
 	resp.DataSourceData = binarylaneClient

internal/provider/provider_test.go

@@ -11,6 +11,9 @@ provider "binarylane" {
   # api_token = "test123"
 	# api_endpoint = "https://test.binarylane.internal.au/v2"
 }
+
+# End of provider config
+
 `
 )
 

internal/provider/server_data_source.go

@@ -151,8 +151,23 @@ func (d *serverDataSource) Read(ctx context.Context, req datasource.ReadRequest,
 	data.PrivateIPv4Addresses, diags = types.ListValueFrom(ctx, types.StringType, privateIpv4Addresses)
 	resp.Diagnostics.Append(diags...)
 
-	// Save data into Terraform state
-	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+	// Get user data script
+	userDataResp, err := d.bc.client.GetServersServerIdUserDataWithResponse(ctx, data.Id.ValueInt64())
+	if err != nil {
+		resp.Diagnostics.AddError(
+			fmt.Sprintf("Error reading server user data: id=%s, name=%s", data.Id.String(), data.Name.ValueString()),
+			err.Error(),
+		)
+		return
+	}
+	if userDataResp.StatusCode() != http.StatusOK {
+		resp.Diagnostics.AddError(
+			fmt.Sprintf("Unexpected HTTP status %d reading server user data: name=%s, id=%s", userDataResp.StatusCode(), data.Name.ValueString(), data.Id.String()),
+			string(userDataResp.Body),
+		)
+		return
+	}
+	data.UserData = types.StringPointerValue(userDataResp.JSON200.UserData)
 
 	// Save data into Terraform state
 	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)

internal/provider/server_firewall_rules_resource_test.go

@@ -15,33 +15,34 @@ func TestServerFirewallRulesResource(t *testing.T) {
 	rand.Read(pw_bytes)
 	password := base64.URLEncoding.EncodeToString(pw_bytes)
 
-	resource.Test(t, resource.TestCase{
+	resource.ParallelTest(t, resource.TestCase{
 		ProtoV6ProviderFactories: testAccProtoV6ProviderFactories,
 		Steps: []resource.TestStep{
 			// Create and Read testing
 			{
 				Config: providerConfig + `
+
 resource "binarylane_server" "test" {
-	name   = "tf-test-server-fw-rules"
-  region = "per"
-  image  = "debian-12"
-  size   = "std-min"
-	password = "` + password + `"
-	wait_for_create = 60  # Must wait for the server to be ready before creating firewall rules
+  name              = "tf-test-server-fw-rules"
+  region            = "per"
+  image             = "debian-12"
+  size              = "std-min"
+  password          = "` + password + `"
+  public_ipv4_count = 0
 }
 
 resource "binarylane_server_firewall_rules" "test" {
   server_id = binarylane_server.test.id
-	firewall_rules = [
-		{
-			description = "Allow SSH"
-			protocol = "tcp"
-			source_addresses = ["0.0.0.0/0"]
-			destination_addresses = [binarylane_server.test.private_ipv4_addresses.0]
-			destination_ports = ["22"]
-			action = "accept"
-		}
-	]
+  firewall_rules = [
+    {
+      description           = "Allow SSH"
+      protocol              = "tcp"
+      source_addresses      = ["0.0.0.0/0"]
+      destination_addresses = [binarylane_server.test.private_ipv4_addresses.0]
+      destination_ports     = ["22"]
+      action                = "accept"
+    }
+  ]
 }
 
 data "binarylane_server_firewall_rules" "test" {
@@ -95,27 +96,28 @@ data "binarylane_server_firewall_rules" "test" {
 			// Update and Read testing
 			{
 				Config: providerConfig + `
+
 resource "binarylane_server" "test" {
-	name   = "tf-test-server-fw-rules"
-  region = "per"
-  image  = "debian-12"
-  size   = "std-min"
-	password = "` + password + `"
-	wait_for_create = 60  # Must wait for the server to be ready before creating firewall rules
+  name              = "tf-test-server-fw-rules"
+  region            = "per"
+  image             = "debian-12"
+  size              = "std-min"
+  password          = "` + password + `"
+  public_ipv4_count = 0
 }
 
 resource "binarylane_server_firewall_rules" "test" {
   server_id = binarylane_server.test.id
-	firewall_rules = [
-		{
-			description = "Allow HTTP" # Updated description
-			protocol = "tcp"
-			source_addresses = ["0.0.0.0/0"]
-			destination_addresses = [binarylane_server.test.private_ipv4_addresses.0]
-			destination_ports = ["80"] # Updated port
-			action = "accept"
-		},
-	]
+  firewall_rules = [
+    {
+      description           = "Allow HTTP" # Updated description
+      protocol              = "tcp"
+      source_addresses      = ["0.0.0.0/0"]
+      destination_addresses = [binarylane_server.test.private_ipv4_addresses.0]
+      destination_ports     = ["80"] # Updated port
+      action                = "accept"
+    },
+  ]
 }
 	`,
 				Check: resource.ComposeAggregateTestCheckFunc(

internal/provider/server_resource.go

@@ -6,18 +6,23 @@ import (
 	"net/http"
 	"slices"
 	"strconv"
+	"strings"
 	"terraform-provider-binarylane/internal/binarylane"
 	"terraform-provider-binarylane/internal/resources"
 	"time"
 
+	"github.com/hashicorp/terraform-plugin-framework-timeouts/resource/timeouts"
+	"github.com/hashicorp/terraform-plugin-framework-validators/boolvalidator"
 	"github.com/hashicorp/terraform-plugin-framework-validators/int32validator"
 	"github.com/hashicorp/terraform-plugin-framework-validators/int64validator"
 	"github.com/hashicorp/terraform-plugin-framework-validators/listvalidator"
+	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
+	"github.com/hashicorp/terraform-plugin-framework/attr"
 	"github.com/hashicorp/terraform-plugin-framework/path"
 	"github.com/hashicorp/terraform-plugin-framework/resource"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema/booldefault"
-	"github.com/hashicorp/terraform-plugin-framework/resource/schema/int32default"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/boolplanmodifier"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema/int64planmodifier"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema/listplanmodifier"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
@@ -32,6 +37,7 @@ var (
 	_ resource.Resource                = &serverResource{}
 	_ resource.ResourceWithConfigure   = &serverResource{}
 	_ resource.ResourceWithImportState = &serverResource{}
+	_ resource.ResourceWithModifyPlan  = &serverResource{}
 )
 
 // Helper function to simplify the provider implementation.
@@ -45,12 +51,14 @@ type serverResource struct {
 
 type serverModel struct {
 	resources.ServerModel
-	WaitForCreateSeconds types.Int32  `tfsdk:"wait_for_create"`
-	PublicIpv4Count      types.Int32  `tfsdk:"public_ipv4_count"`
-	PublicIpv4Addresses  types.List   `tfsdk:"public_ipv4_addresses"`
-	PrivateIPv4Addresses types.List   `tfsdk:"private_ipv4_addresses"`
-	Permalink            types.String `tfsdk:"permalink"`
-	Password             types.String `tfsdk:"password"`
+	PublicIpv4Count           types.Int32    `tfsdk:"public_ipv4_count"`
+	PublicIpv4Addresses       types.List     `tfsdk:"public_ipv4_addresses"`
+	PrivateIPv4Addresses      types.List     `tfsdk:"private_ipv4_addresses"`
+	SourceAndDestinationCheck types.Bool     `tfsdk:"source_and_destination_check"`
+	Permalink                 types.String   `tfsdk:"permalink"`
+	Password                  types.String   `tfsdk:"password"`
+	PasswordChangeSupported   types.Bool     `tfsdk:"password_change_supported"`
+	Timeouts                  timeouts.Value `tfsdk:"timeouts"`
 }
 
 func (d *serverResource) Configure(_ context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) {
@@ -93,13 +101,26 @@ func (r *serverResource) Schema(ctx context.Context, _ resource.SchemaRequest, r
 		},
 	}
 
+	image := resp.Schema.Attributes["image"]
+	resp.Schema.Attributes["image"] = &schema.StringAttribute{
+		Description:         image.GetDescription(),
+		MarkdownDescription: image.GetMarkdownDescription(),
+		Required:            image.IsRequired(),
+		Optional:            image.IsOptional(),
+		Computed:            image.IsComputed(),
+		Validators: []validator.String{
+			stringvalidator.LengthAtLeast(1),
+		},
+	}
+
 	backups := resp.Schema.Attributes["backups"]
 	resp.Schema.Attributes["backups"] = &schema.BoolAttribute{
 		Description:         backups.GetDescription(),
 		MarkdownDescription: backups.GetMarkdownDescription(),
 		Optional:            backups.IsOptional(),
 		Computed:            backups.IsComputed(),
-		Default:             booldefault.StaticBool(false), // Add default to backups
+		Default:             booldefault.StaticBool(false),                           // Add default to backups
+		PlanModifiers:       []planmodifier.Bool{boolplanmodifier.RequiresReplace()}, // TODO (#37)
 	}
 
 	user_data := resp.Schema.Attributes["user_data"]
@@ -108,9 +129,6 @@ func (r *serverResource) Schema(ctx context.Context, _ resource.SchemaRequest, r
 		MarkdownDescription: user_data.GetMarkdownDescription(),
 		Optional:            true,  // Optional as not all servers have an initialization script
 		Computed:            false, // User defined
-		PlanModifiers: []planmodifier.String{
-			stringplanmodifier.RequiresReplace(), // If user changes init script, assume they want to replace server
-		},
 	}
 
 	vpcId := resp.Schema.Attributes["vpc_id"]
@@ -119,6 +137,7 @@ func (r *serverResource) Schema(ctx context.Context, _ resource.SchemaRequest, r
 		MarkdownDescription: vpcId.GetMarkdownDescription(),
 		Optional:            vpcId.IsOptional(),
 		Computed:            false, // VPC ID is not computed, defined at creation
+		PlanModifiers:       []planmodifier.Int64{int64planmodifier.RequiresReplace()},
 	}
 
 	portBlocking := resp.Schema.Attributes["port_blocking"]
@@ -128,6 +147,7 @@ func (r *serverResource) Schema(ctx context.Context, _ resource.SchemaRequest, r
 		Optional:            portBlocking.IsOptional(),
 		Computed:            portBlocking.IsComputed(),
 		Default:             booldefault.StaticBool(true), // Add default to port_blocking
+		PlanModifiers:       []planmodifier.Bool{boolplanmodifier.RequiresReplace()},
 	}
 
 	sshKeys := resp.Schema.Attributes["ssh_keys"]
@@ -136,8 +156,7 @@ func (r *serverResource) Schema(ctx context.Context, _ resource.SchemaRequest, r
 		Description:         sshKeys.GetMarkdownDescription(),
 		MarkdownDescription: sshKeys.GetDescription(),
 		Optional:            sshKeys.IsOptional(),
-		Computed:            false,                                                   // SSH keys are not computed, defined at creation
-		PlanModifiers:       []planmodifier.List{listplanmodifier.RequiresReplace()}, // Cannot update SSH keys with API
+		Computed:            false, // SSH keys are not computed, defined at creation
 		Validators: []validator.List{
 			listvalidator.ValueInt64sAre(int64validator.AtLeast(1)),
 		},
@@ -154,16 +173,7 @@ func (r *serverResource) Schema(ctx context.Context, _ resource.SchemaRequest, r
 		Optional:            true,  // Password optional, if not set will be emailed to user
 		Computed:            false, // Computed must be false to allow server to be created without password
 		Sensitive:           true,  // Mark password as sensitive
-	}
-
-	waitDescription := "The number of seconds to wait for the server to be created, after which, a timeout error will " +
-		"be reported. If `wait_seconds` is left empty or set to 0, Terraform will succeed without waiting for the " +
-		"server creation to complete."
-	resp.Schema.Attributes["wait_for_create"] = &schema.Int32Attribute{
-		Description:         waitDescription,
-		MarkdownDescription: waitDescription,
-		Optional:            true,
-		Computed:            false,
+		PlanModifiers:       []planmodifier.String{stringplanmodifier.RequiresReplace()},
 	}
 
 	publicIpv4CountDescription := "The number of public IPv4 addresses to assign to the server. If this is not provided, the " +
@@ -171,9 +181,10 @@ func (r *serverResource) Schema(ctx context.Context, _ resource.SchemaRequest, r
 	resp.Schema.Attributes["public_ipv4_count"] = &schema.Int32Attribute{
 		Description:         publicIpv4CountDescription,
 		MarkdownDescription: publicIpv4CountDescription,
-		Optional:            true,
-		Computed:            true,
-		Default:             int32default.StaticInt32(1),
+		Required:            true,
+		Optional:            false,
+		Computed:            false,
+		// Default:             int32default.StaticInt32(0), // TODO: Uncomment with 1.0 release (see issue #30)
 		Validators: []validator.Int32{
 			int32validator.AtLeast(0),
 		},
@@ -188,8 +199,25 @@ func (r *serverResource) Schema(ctx context.Context, _ resource.SchemaRequest, r
 		Optional: false,
 		Required: false,
 		Computed: true,
-		PlanModifiers: []planmodifier.List{
-			listplanmodifier.UseStateForUnknown(),
+	}
+
+	sourceDestCheckDescription := "This attribute can only be set if your server also has a `vpc_id` attribute set. " +
+		"When enabled (which is `true` by default), your server will only be able to send or receive " +
+		"packets that are directly addressed to one of the IP addresses associated with the Cloud Server. Generally, " +
+		"this is desirable behaviour because it prevents IP conflicts and other hard-to-diagnose networking faults due " +
+		"to incorrect network configuration. When `source_and_destination_check` is `false`, your Cloud Server will be able " +
+		"to send and receive packets addressed to any server. This is typically used when you want to use " +
+		"your Cloud Server as a VPN endpoint, a NAT server to provide internet access, or IP forwarding."
+	resp.Schema.Attributes["source_and_destination_check"] = &schema.BoolAttribute{
+		Description:         sourceDestCheckDescription,
+		MarkdownDescription: sourceDestCheckDescription,
+		Optional:            true,
+		Required:            false,
+		Computed:            true,
+		Validators: []validator.Bool{
+			boolvalidator.AlsoRequires(path.Expressions{
+				path.MatchRoot("vpc_id"),
+			}...),
 		},
 	}
 
@@ -214,7 +242,99 @@ func (r *serverResource) Schema(ctx context.Context, _ resource.SchemaRequest, r
 		Optional: false,
 		Required: false,
 		Computed: true,
+		PlanModifiers: []planmodifier.String{
+			stringplanmodifier.UseStateForUnknown(),
+		},
 	}
+
+	pwChangeDescription := "If this is true then the `password` attribute can be changed with Terraform. " +
+		"If this is false then the `password` attribute can only be replaced with a null/empty value, which will clear " +
+		"the root/administrator password allowing the password to be changed via the web console."
+	resp.Schema.Attributes["password_change_supported"] = &schema.BoolAttribute{
+		Description:         pwChangeDescription,
+		MarkdownDescription: pwChangeDescription,
+		// read only
+		Optional: false,
+		Required: false,
+		Computed: true,
+		PlanModifiers: []planmodifier.Bool{
+			boolplanmodifier.UseStateForUnknown(),
+		},
+	}
+
+	resp.Schema.Attributes["timeouts"] =
+		timeouts.Attributes(ctx, timeouts.Opts{
+			Create: true,
+			Update: true,
+		})
+}
+
+func (r *serverResource) ModifyPlan(ctx context.Context, req resource.ModifyPlanRequest, resp *resource.ModifyPlanResponse) {
+	var plan, state serverModel
+
+	if req.Plan.Raw.IsNull() {
+		// Destruction plan, no modification needed
+		return
+	}
+	// Read Terraform plan data into the model
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	if plan.SourceAndDestinationCheck.IsUnknown() {
+		if plan.VpcId.IsNull() {
+			plan.SourceAndDestinationCheck = types.BoolNull()
+		} else {
+			plan.SourceAndDestinationCheck = types.BoolPointerValue(Pointer(true))
+		}
+		resp.Diagnostics.Append(resp.Plan.Set(ctx, &plan)...)
+	}
+
+	if req.State.Raw.IsNull() {
+		// Creation plan, no further modification needed
+		return
+	}
+	// Read Terraform state data into the model
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	// When IP count is changed, plan should show addition/removal of public IPs
+	plannedPublicIpV4Count := int(plan.PublicIpv4Count.ValueInt32())
+	plannedPublicIpAddresses := make([]attr.Value, plannedPublicIpV4Count)
+	stateIpV4Addresses := []*string{}
+	diags := state.PublicIpv4Addresses.ElementsAs(ctx, &stateIpV4Addresses, false)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	for i := range plannedPublicIpAddresses {
+		if i < len(stateIpV4Addresses) {
+			plannedPublicIpAddresses[i] = types.StringValue(*stateIpV4Addresses[i])
+		} else {
+			plannedPublicIpAddresses[i] = types.StringUnknown()
+		}
+	}
+	plan.PublicIpv4Addresses, diags = types.ListValueFrom(ctx, types.StringType, plannedPublicIpAddresses)
+	resp.Diagnostics.Append(diags...)
+
+	// Add warning if rebuild is required
+	attrsRequiringRebuild := attrsRequiringRebuild(&plan, &state)
+	if len(attrsRequiringRebuild) > 0 {
+		resp.Diagnostics.AddWarning(
+			"Server Rebuild Required",
+			fmt.Sprintf(
+				"Server %d will lose all data if this Terraform plan is applied, because of modified attribute(s): %s",
+				state.Id.ValueInt64(),
+				strings.Join(attrsRequiringRebuild, ", "),
+			),
+		)
+	}
+
+	// Save data into Terraform state
+	resp.Diagnostics.Append(resp.Plan.Set(ctx, &plan)...)
 }
 
 func (r *serverResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
@@ -227,6 +347,11 @@ func (r *serverResource) Create(ctx context.Context, req resource.CreateRequest,
 		return
 	}
 
+	timeout, diags := data.Timeouts.Create(ctx, 20*time.Minute)
+	resp.Diagnostics.Append(diags...)
+	ctx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+
 	// Create API call logic
 	tflog.Debug(ctx, fmt.Sprintf("Creating server: name=%s", data.Name.ValueString()))
 
@@ -255,6 +380,7 @@ func (r *serverResource) Create(ctx context.Context, req resource.CreateRequest,
 		data.Password = types.StringNull()
 	} else {
 		body.Password = data.Password.ValueStringPointer()
+		ctx = tflog.MaskMessageStrings(ctx, data.Password.String())
 	}
 
 	serverResp, err := r.bc.client.PostServersWithResponse(ctx, body)
@@ -265,43 +391,11 @@ func (r *serverResource) Create(ctx context.Context, req resource.CreateRequest,
 		)
 		return
 	}
-
 	if serverResp.StatusCode() != http.StatusOK {
 		resp.Diagnostics.AddError(
 			"Unexpected HTTP status code creating server",
-			fmt.Sprintf("Received %s creating new server: name=%s. Details: %s", serverResp.Status(), data.Name.ValueString(), serverResp.Body))
-		return
-	}
-
-	data.Id = types.Int64Value(*serverResp.JSON200.Server.Id)
-	data.Name = types.StringValue(*serverResp.JSON200.Server.Name)
-	data.Image = types.StringValue(*serverResp.JSON200.Server.Image.Slug)
-	data.Region = types.StringValue(*serverResp.JSON200.Server.Region.Slug)
-	data.Size = types.StringValue(*serverResp.JSON200.Server.Size.Slug)
-	data.Backups = types.BoolValue(serverResp.JSON200.Server.NextBackupWindow != nil)
-	data.PortBlocking = types.BoolValue(serverResp.JSON200.Server.Networks.PortBlocking)
-	data.VpcId = types.Int64PointerValue(serverResp.JSON200.Server.VpcId)
-	data.Permalink = types.StringValue(*serverResp.JSON200.Server.Permalink)
-
-	var publicIpv4Addresses []string
-	var privateIpv4Addresses []string
-
-	for _, v4address := range serverResp.JSON200.Server.Networks.V4 {
-		if v4address.Type == "public" {
-			publicIpv4Addresses = append(publicIpv4Addresses, v4address.IpAddress)
-		} else {
-			privateIpv4Addresses = append(privateIpv4Addresses, v4address.IpAddress)
-		}
-	}
-	data.PublicIpv4Addresses, diags = types.ListValueFrom(ctx, types.StringType, publicIpv4Addresses)
-	resp.Diagnostics.Append(diags...)
-	data.PrivateIPv4Addresses, diags = types.ListValueFrom(ctx, types.StringType, privateIpv4Addresses)
-	resp.Diagnostics.Append(diags...)
-
-	// Save data into Terraform state
-	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
-
-	if data.WaitForCreateSeconds.ValueInt32() <= 0 {
+			fmt.Sprintf("Received %s creating new server: name=%s. Details: %s", serverResp.Status(), data.Name.ValueString(), serverResp.Body),
+		)
 		return
 	}
 
@@ -319,34 +413,54 @@ func (r *serverResource) Create(ctx context.Context, req resource.CreateRequest,
 			fmt.Sprintf("Received %s creating new server: name=%s. Details: %s", serverResp.Status(), data.Name.ValueString(), serverResp.Body))
 		return
 	}
-
-	timeLimit := time.Now().Add(time.Duration(data.WaitForCreateSeconds.ValueInt32()) * time.Second)
-	for {
-		tflog.Info(ctx, "Waiting for server to be ready...")
-
-		readyResp, err := r.bc.client.GetServersServerIdActionsActionIdWithResponse(ctx, data.Id.ValueInt64(), createActionId)
-		if err != nil {
-			resp.Diagnostics.AddError("Error waiting for server to be ready", err.Error())
-			return
-		}
-		if readyResp.StatusCode() == http.StatusOK && readyResp.JSON200.Action.CompletedAt != nil {
-			tflog.Info(ctx, "Server is ready")
-			break
-		}
-		if time.Now().After(timeLimit) {
-			resp.Diagnostics.AddError(
-				"Timed out waiting for server to be ready",
-				fmt.Sprintf(
-					"Timed out waiting for server to be created, as `wait_for_create` was surpassed without "+
-						"recieving a `completed_at` in response: name=%s, status=%s, details: %s",
-					data.Name.ValueString(), readyResp.Status(), readyResp.Body,
-				),
-			)
-			return
-		}
-		tflog.Debug(ctx, fmt.Sprintf("Waiting for server to be ready: name=%s, status=%s, details: %s", data.Name.ValueString(), readyResp.Status(), readyResp.Body))
-		time.Sleep(time.Second * 5)
+	err = r.waitForServerAction(ctx, *serverResp.JSON200.Server.Id, createActionId)
+	if err != nil {
+		resp.Diagnostics.AddError("Error waiting for server to be created", err.Error())
 	}
+
+	data.Id = types.Int64Value(*serverResp.JSON200.Server.Id)
+	data.Name = types.StringValue(*serverResp.JSON200.Server.Name)
+	data.Image = types.StringValue(*serverResp.JSON200.Server.Image.Slug)
+	data.Region = types.StringValue(*serverResp.JSON200.Server.Region.Slug)
+	data.Size = types.StringValue(*serverResp.JSON200.Server.Size.Slug)
+	data.Backups = types.BoolValue(serverResp.JSON200.Server.NextBackupWindow != nil)
+	data.PortBlocking = types.BoolValue(serverResp.JSON200.Server.Networks.PortBlocking)
+	data.VpcId = types.Int64PointerValue(serverResp.JSON200.Server.VpcId)
+	data.Permalink = types.StringValue(*serverResp.JSON200.Server.Permalink)
+	data.PasswordChangeSupported = types.BoolValue(*serverResp.JSON200.Server.PasswordChangeSupported)
+	plannedSourceDestCheck := data.SourceAndDestinationCheck
+	serverRespSourceDestCheck := types.BoolPointerValue(serverResp.JSON200.Server.Networks.SourceAndDestinationCheck)
+	data.SourceAndDestinationCheck = serverRespSourceDestCheck
+
+	publicIpv4Addresses := []string{}
+	privateIpv4Addresses := []string{}
+	for _, v4address := range serverResp.JSON200.Server.Networks.V4 {
+		if v4address.Type == "public" {
+			publicIpv4Addresses = append(publicIpv4Addresses, v4address.IpAddress)
+		} else {
+			privateIpv4Addresses = append(privateIpv4Addresses, v4address.IpAddress)
+		}
+	}
+	data.PublicIpv4Addresses, diags = types.ListValueFrom(ctx, types.StringType, publicIpv4Addresses)
+	resp.Diagnostics.Append(diags...)
+	data.PrivateIPv4Addresses, diags = types.ListValueFrom(ctx, types.StringType, privateIpv4Addresses)
+	resp.Diagnostics.Append(diags...)
+
+	// Save data into Terraform state
+	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+
+	// Update source_and_destination_check if needed
+	if plannedSourceDestCheck.Equal(types.BoolPointerValue(Pointer(false))) {
+		err := r.updateSourceDestCheck(ctx, data.Id.ValueInt64(), false)
+		if err != nil {
+			resp.Diagnostics.AddError("Error updating source and destination check", err.Error())
+			return
+		}
+		data.SourceAndDestinationCheck = plannedSourceDestCheck
+	}
+
+	// Save data into Terraform state
+	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
 }
 
 func (r *serverResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
@@ -370,7 +484,6 @@ func (r *serverResource) Read(ctx context.Context, req resource.ReadRequest, res
 		)
 		return
 	}
-
 	if serverResp.StatusCode() != http.StatusOK {
 		resp.Diagnostics.AddError(
 			fmt.Sprintf("Unexpected HTTP status code %s reading server: name=%s, id=%s", serverResp.Status(), data.Name.ValueString(), data.Id.String()),
@@ -388,10 +501,11 @@ func (r *serverResource) Read(ctx context.Context, req resource.ReadRequest, res
 	data.PortBlocking = types.BoolValue(serverResp.JSON200.Server.Networks.PortBlocking)
 	data.VpcId = types.Int64PointerValue(serverResp.JSON200.Server.VpcId)
 	data.Permalink = types.StringValue(*serverResp.JSON200.Server.Permalink)
+	data.PasswordChangeSupported = types.BoolValue(*serverResp.JSON200.Server.PasswordChangeSupported)
+	data.SourceAndDestinationCheck = types.BoolPointerValue(serverResp.JSON200.Server.Networks.SourceAndDestinationCheck)
 
-	var publicIpv4Addresses []string
-	var privateIpv4Addresses []string
-
+	publicIpv4Addresses := []string{}
+	privateIpv4Addresses := []string{}
 	for _, v4address := range serverResp.JSON200.Server.Networks.V4 {
 		if v4address.Type == "public" {
 			publicIpv4Addresses = append(publicIpv4Addresses, v4address.IpAddress)
@@ -403,30 +517,243 @@ func (r *serverResource) Read(ctx context.Context, req resource.ReadRequest, res
 	resp.Diagnostics.Append(diags...)
 	data.PrivateIPv4Addresses, diags = types.ListValueFrom(ctx, types.StringType, privateIpv4Addresses)
 	resp.Diagnostics.Append(diags...)
+	data.PublicIpv4Count = types.Int32Value(int32(len(publicIpv4Addresses)))
 
 	if resp.Diagnostics.HasError() {
 		return
 	}
 
+	// Get user data script
+	userDataResp, err := r.bc.client.GetServersServerIdUserDataWithResponse(ctx, data.Id.ValueInt64())
+	if err != nil {
+		resp.Diagnostics.AddError(
+			fmt.Sprintf("Error reading server user data: id=%s, name=%s", data.Id.String(), data.Name.ValueString()),
+			err.Error(),
+		)
+		return
+	}
+	if userDataResp.StatusCode() != http.StatusOK {
+		resp.Diagnostics.AddError(
+			fmt.Sprintf("Unexpected HTTP status %d reading server user data: name=%s, id=%s", userDataResp.StatusCode(), data.Name.ValueString(), data.Id.String()),
+			string(userDataResp.Body),
+		)
+		return
+	}
+	data.UserData = types.StringPointerValue(userDataResp.JSON200.UserData)
+
 	// Save updated data into Terraform state
 	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
 }
 
 func (r *serverResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
-	var data serverModel
+	var plan, state serverModel
 
 	// Read Terraform plan data into the model
-	resp.Diagnostics.Append(req.Plan.Get(ctx, &data)...)
-
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
 	if resp.Diagnostics.HasError() {
 		return
 	}
 
-	// Update API call logic
-	// TODO
+	timeout, diags := plan.Timeouts.Update(ctx, 20*time.Minute)
+	resp.Diagnostics.Append(diags...)
+	ctx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
 
-	// Save updated data into Terraform state
-	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+	rebuildNeeded := len(attrsRequiringRebuild(&plan, &state)) > 0
+
+	// Rename
+	if !plan.Name.Equal(state.Name) && !rebuildNeeded {
+		renameResp, err := r.bc.client.PostServersServerIdActionsRenameWithResponse(
+			ctx,
+			state.Id.ValueInt64(),
+			binarylane.PostServersServerIdActionsRenameJSONRequestBody{
+				Type: "rename",
+				Name: plan.Name.ValueString(),
+			},
+		)
+		if err != nil {
+			resp.Diagnostics.AddError(
+				fmt.Sprintf("Error renaming server: server_id=%s", state.Id.String()),
+				err.Error(),
+			)
+			return
+		}
+		if renameResp.StatusCode() != http.StatusOK {
+			resp.Diagnostics.AddError(
+				"Unexpected HTTP status code renaming server",
+				fmt.Sprintf("Received %s renaming server: server_id=%s. Details: %s", renameResp.Status(), state.Id.String(), renameResp.Body))
+			return
+		}
+		if *renameResp.JSON200.Action.Status == "errored" {
+			resp.Diagnostics.AddError(
+				"Unexpected response with \"errored\" status when renaming server",
+				fmt.Sprintf("Received %s renaming server: server_id=%s. Details: %s", renameResp.Status(), state.Id.String(), renameResp.Body))
+			return
+		}
+
+		// TODO - Currently, the API does not support polling for the rename to complete, because the action ID returns a 404 response (see #13)
+
+		state.Name = types.StringValue(plan.Name.ValueString())
+	}
+
+	// Resize operation
+	if !plan.Size.Equal(state.Size) || !plan.PublicIpv4Count.Equal(state.PublicIpv4Count) || !plan.Image.Equal(state.Image) {
+		resizeReq := &binarylane.PostServersServerIdActionsResizeJSONRequestBody{
+			Type: "resize",
+		}
+		if !plan.Size.Equal(state.Size) {
+			resizeReq.Size = plan.Size.ValueStringPointer()
+			state.Size = plan.Size
+		}
+		if !plan.PublicIpv4Count.Equal(state.PublicIpv4Count) {
+			resizeReq.Options = &binarylane.ChangeSizeOptionsRequest{
+				Ipv4Addresses: plan.PublicIpv4Count.ValueInt32Pointer(),
+			}
+			if plan.PublicIpv4Count.ValueInt32() < state.PublicIpv4Count.ValueInt32() {
+				currentIps := []string{}
+				diags := state.PublicIpv4Addresses.ElementsAs(ctx, &currentIps, false)
+				resp.Diagnostics.Append(diags...)
+				if resp.Diagnostics.HasError() {
+					return
+				}
+				removedIps := currentIps[plan.PublicIpv4Count.ValueInt32():state.PublicIpv4Count.ValueInt32()]
+				resizeReq.Options.Ipv4AddressesToRemove = &removedIps
+				resp.Diagnostics.Append(diags...)
+				if resp.Diagnostics.HasError() {
+					return
+				}
+			}
+			state.PublicIpv4Count = plan.PublicIpv4Count
+			state.PublicIpv4Addresses = plan.PublicIpv4Addresses
+		}
+		if !plan.Image.Equal(state.Image) {
+			resizeReq.ChangeImage = &binarylane.ChangeImage{
+				Image: plan.Image.ValueStringPointer(),
+			}
+			state.Image = plan.Image
+		}
+
+		tflog.Info(ctx, fmt.Sprintf("Resizing server: server_id=%s", state.Id.String()))
+
+		resizeResp, err := r.bc.client.PostServersServerIdActionsResizeWithResponse(
+			ctx,
+			state.Id.ValueInt64(),
+			*resizeReq,
+		)
+		if err != nil {
+			resp.Diagnostics.AddError(
+				fmt.Sprintf("Error resizing server: server_id=%s", state.Id.String()),
+				err.Error(),
+			)
+			return
+		}
+		if resizeResp.StatusCode() != http.StatusOK {
+			resp.Diagnostics.AddError(
+				"Unexpected HTTP status code resizing server",
+				fmt.Sprintf("Received %s resizing server: server_id=%s. Details: %s", resizeResp.Status(), state.Id.String(), resizeResp.Body))
+			return
+		}
+		err = r.waitForServerAction(ctx, state.Id.ValueInt64(), *resizeResp.JSON200.Action.Id)
+		if err != nil {
+			resp.Diagnostics.AddError("Error waiting for server to be resized", err.Error())
+			return
+		}
+
+		// Success
+
+		if state.PublicIpv4Addresses.IsUnknown() || listContainsUnknown(ctx, state.PublicIpv4Addresses) {
+			// New IPs may have been allocated, so we need to check the server again
+			serverResp, err := r.bc.client.GetServersServerIdWithResponse(ctx, state.Id.ValueInt64())
+			if err != nil {
+				resp.Diagnostics.AddError("Error checking IPs for server after resize", err.Error())
+				return
+			}
+			if serverResp.StatusCode() != http.StatusOK {
+				resp.Diagnostics.AddError("Unexpected HTTP status code checking IPs for server after resize",
+					fmt.Sprintf("Received %s checking IPs for server after resize: name=%s. Details: %s", serverResp.Status(), state.Name.ValueString(), serverResp.Body))
+				return
+			}
+			publicIpv4Addresses := []string{}
+			for _, v4address := range serverResp.JSON200.Server.Networks.V4 {
+				if v4address.Type == "public" {
+					publicIpv4Addresses = append(publicIpv4Addresses, v4address.IpAddress)
+				}
+			}
+			state.PublicIpv4Addresses, diags = types.ListValueFrom(ctx, types.StringType, publicIpv4Addresses)
+			resp.Diagnostics.Append(diags...)
+		}
+
+		// Save updated data into Terraform state
+		resp.Diagnostics.Append(resp.State.Set(ctx, &state)...)
+	}
+
+	// Rebuild operation
+	if !plan.SshKeys.Equal(state.SshKeys) || !plan.UserData.IsNull() && !plan.UserData.Equal(state.UserData) {
+		var rebuildReq *binarylane.PostServersServerIdActionsRebuildJSONRequestBody
+
+		sshKeys := []int{}
+		diags := plan.SshKeys.ElementsAs(ctx, &sshKeys, false)
+		resp.Diagnostics.Append(diags...)
+		if resp.Diagnostics.HasError() {
+			return
+		}
+		rebuildReq = &binarylane.PostServersServerIdActionsRebuildJSONRequestBody{
+			Type: "rebuild",
+			Options: &binarylane.ImageOptions{
+				Name:     plan.Name.ValueStringPointer(),
+				Password: plan.Password.ValueStringPointer(),
+				UserData: plan.UserData.ValueStringPointer(),
+				SshKeys:  &sshKeys,
+			},
+		}
+		rebuildResp, err := r.bc.client.PostServersServerIdActionsRebuildWithResponse(
+			ctx,
+			state.Id.ValueInt64(),
+			*rebuildReq,
+		)
+		if err != nil {
+			resp.Diagnostics.AddError(
+				fmt.Sprintf("Error rebuilding server: server_id=%s", state.Id.String()),
+				err.Error(),
+			)
+			return
+		}
+		if rebuildResp.StatusCode() != http.StatusOK {
+			resp.Diagnostics.AddError(
+				"Unexpected HTTP status code rebuilding server",
+				fmt.Sprintf("Received %s rebuilding server: server_id=%s. Details: %s", rebuildResp.Status(), state.Id.String(), rebuildResp.Body))
+			return
+		}
+		err = r.waitForServerAction(ctx, state.Id.ValueInt64(), *rebuildResp.JSON200.Action.Id)
+		if err != nil {
+			resp.Diagnostics.AddError("Error waiting for server to be rebuilt", err.Error())
+			return
+		}
+		state.Name = plan.Name
+		state.Password = plan.Password
+		state.UserData = plan.UserData
+		state.SshKeys = plan.SshKeys
+
+		// Save updated data into Terraform state
+		resp.Diagnostics.Append(resp.State.Set(ctx, &state)...)
+	}
+
+	// Check source_and_destination_check
+	if !plan.SourceAndDestinationCheck.Equal(state.SourceAndDestinationCheck) {
+		if !plan.SourceAndDestinationCheck.IsNull() {
+			err := r.updateSourceDestCheck(ctx, state.Id.ValueInt64(), plan.SourceAndDestinationCheck.ValueBool())
+			if err != nil {
+				resp.Diagnostics.AddError("Error updating source and destination check", err.Error())
+				return
+			}
+		}
+
+		state.SourceAndDestinationCheck = plan.SourceAndDestinationCheck
+
+		// Save updated data into Terraform state
+		resp.Diagnostics.Append(resp.State.Set(ctx, &state)...)
+	}
 }
 
 func (r *serverResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
@@ -434,7 +761,6 @@ func (r *serverResource) Delete(ctx context.Context, req resource.DeleteRequest,
 
 	// Read Terraform prior state data into the model
 	resp.Diagnostics.Append(req.State.Get(ctx, &data)...)
-
 	if resp.Diagnostics.HasError() {
 		return
 	}
@@ -467,42 +793,127 @@ func (r *serverResource) Delete(ctx context.Context, req resource.DeleteRequest,
 func (r *serverResource) ImportState(
 	ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse,
 ) {
+	// Import by ID
 	id, err := strconv.ParseInt(req.ID, 10, 32)
 	if err == nil {
 		diags := resp.State.SetAttribute(ctx, path.Root("id"), int32(id))
 		resp.Diagnostics.Append(diags...)
-	} else {
-		name := req.ID
-		params := binarylane.GetServersParams{
-			Hostname: &name,
-		}
+		return
+	}
 
-		serverResp, err := r.bc.client.GetServersWithResponse(ctx, &params)
-		if err != nil {
-			resp.Diagnostics.AddError(fmt.Sprintf("Error getting server: hostname=%s", name), err.Error())
-			return
-		}
+	// Import by name
 
-		if serverResp.StatusCode() != http.StatusOK {
-			resp.Diagnostics.AddError(
-				"Unexpected HTTP status code getting server",
-				fmt.Sprintf("Received %s reading server: hostname=%s. Details: %s", serverResp.Status(), name,
-					serverResp.Body))
-			return
-		}
+	name := req.ID
+	params := binarylane.GetServersParams{
+		Hostname: &name,
+	}
 
-		servers := *serverResp.JSON200.Servers
-		idx := slices.IndexFunc(servers, func(s binarylane.Server) bool { return *s.Name == name })
-		if idx == -1 {
-			resp.Diagnostics.AddError(
-				"Could not find server by hostname",
-				fmt.Sprintf("Error finding server: hostname=%s", name),
+	serverResp, err := r.bc.client.GetServersWithResponse(ctx, &params)
+	if err != nil {
+		resp.Diagnostics.AddError(fmt.Sprintf("Error getting server: hostname=%s", name), err.Error())
+		return
+	}
+
+	if serverResp.StatusCode() != http.StatusOK {
+		resp.Diagnostics.AddError(
+			"Unexpected HTTP status code getting server",
+			fmt.Sprintf("Received %s reading server: hostname=%s. Details: %s", serverResp.Status(), name,
+				serverResp.Body))
+		return
+	}
+
+	servers := *serverResp.JSON200.Servers
+	idx := slices.IndexFunc(servers, func(s binarylane.Server) bool { return *s.Name == name })
+	if idx == -1 {
+		resp.Diagnostics.AddError(
+			"Could not find server by hostname",
+			fmt.Sprintf("Error finding server: hostname=%s", name),
+		)
+		return
+	}
+	server := servers[idx]
+
+	diags := resp.State.SetAttribute(ctx, path.Root("id"), int32(*server.Id))
+	resp.Diagnostics.Append(diags...)
+}
+
+func (r *serverResource) waitForServerAction(ctx context.Context, serverId int64, actionId int64) error {
+	var lastReadyResp *binarylane.GetServersServerIdActionsActionIdResponse
+
+	for {
+		select {
+		case <-ctx.Done():
+			if lastReadyResp == nil {
+				return fmt.Errorf("timed out waiting for server action: server_id=%d, action_id=%d", serverId, actionId)
+			} else {
+				return fmt.Errorf("timed out waiting for server action: server_id=%d, action_id=%d, last response was status=%s, body: %s",
+					serverId, actionId, lastReadyResp.Status(), lastReadyResp.Body)
+			}
+		default:
+			readyResp, err := r.bc.client.GetServersServerIdActionsActionIdWithResponse(ctx, serverId, actionId)
+			if err != nil {
+				return fmt.Errorf("unexpected error waiting for server action: server_id=%d, action_id=%d, error: %w", serverId, actionId, err)
+			}
+			if readyResp.StatusCode() == http.StatusOK && *readyResp.JSON200.Action.Status == binarylane.Errored {
+				return fmt.Errorf("server action failed to with error: server_id=%d, action_id=%d, error: %s", serverId, actionId, *readyResp.JSON200.Action.ResultData)
+			}
+			if readyResp.StatusCode() == http.StatusOK && readyResp.JSON200.Action.CompletedAt != nil {
+				return nil
+			}
+			lastReadyResp = readyResp
+			tflog.Debug(ctx,
+				fmt.Sprintf("waiting for server action for server_id=%d, action_id=%d: last response was status=%s, details: %s",
+					serverId, actionId, readyResp.Status(), readyResp.Body,
+				),
 			)
-			return
 		}
-		server := servers[idx]
-
-		diags := resp.State.SetAttribute(ctx, path.Root("id"), int32(*server.Id))
-		resp.Diagnostics.Append(diags...)
+		time.Sleep(time.Second * 5)
 	}
 }
+
+func attrsRequiringRebuild(plan *serverModel, state *serverModel) []string {
+	attrs := []string{}
+
+	if !plan.SshKeys.Equal(state.SshKeys) {
+		attrs = append(attrs, "ssh_keys")
+	}
+	if !plan.Image.Equal(state.Image) {
+		attrs = append(attrs, "image")
+	}
+	if !plan.UserData.IsNull() && !plan.UserData.Equal(state.UserData) {
+		attrs = append(attrs, "user_data")
+	}
+
+	return attrs
+}
+
+func (r *serverResource) updateSourceDestCheck(
+	ctx context.Context,
+	serverId int64,
+	sourceDestCheckEnabled bool,
+) error {
+	tflog.Info(ctx, fmt.Sprintf("Changing source and destination check for server: server_id=%d, enabled=%t",
+		serverId, sourceDestCheckEnabled))
+
+	sourceDestCheckResp, err := r.bc.client.PostServersServerIdActionsChangeSourceAndDestinationCheckWithResponse(
+		ctx,
+		serverId,
+		binarylane.PostServersServerIdActionsChangeSourceAndDestinationCheckJSONRequestBody{
+			Type:    "change_source_and_destination_check",
+			Enabled: sourceDestCheckEnabled,
+		},
+	)
+	if err != nil {
+		return fmt.Errorf("error changing source and destination check for server: server_id=%d, error: %w", serverId, err)
+	}
+	if sourceDestCheckResp.StatusCode() != http.StatusOK {
+		return fmt.Errorf("unexpected HTTP status code changing source and destination check for server: server_id=%d, details: %s", serverId, sourceDestCheckResp.Body)
+	}
+
+	err = r.waitForServerAction(ctx, serverId, *sourceDestCheckResp.JSON200.Action.Id)
+	if err != nil {
+		return fmt.Errorf("error changing source and destination check: %w", err)
+	}
+
+	return nil
+}

internal/provider/server_resource_test.go

@@ -1,8 +1,14 @@
 package provider
 
 import (
+	"context"
 	"crypto/rand"
 	"encoding/base64"
+	"fmt"
+	"log"
+	"net/http"
+	"strings"
+	"terraform-provider-binarylane/internal/binarylane"
 	"testing"
 
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -18,48 +24,53 @@ func TestServerResource(t *testing.T) {
 	}
 	password := base64.URLEncoding.EncodeToString(pw_bytes)
 
-	resource.Test(t, resource.TestCase{
+	sshPublicKeyInitial := GeneratePublicKey(t)
+	sshPublicKeyUpdated := GeneratePublicKey(t)
+
+	resource.ParallelTest(t, resource.TestCase{
 		ProtoV6ProviderFactories: testAccProtoV6ProviderFactories,
 		Steps: []resource.TestStep{
 			// Create and Read testing
 			{
 				Config: providerConfig + `
+
 resource "binarylane_vpc" "test" {
-	name     = "tf-test-server-resource"
-	ip_range = "10.240.0.0/16"
+  name     = "tf-test-server-resource"
+  ip_range = "10.240.0.0/16"
 }
 
-resource "binarylane_ssh_key" "test" {
-  name       = "tf-test-server-resource"
-  public_key = "` + GeneratePublicKey(t) + `"
+resource "binarylane_ssh_key" "initial" {
+  name       = "tf-test-server-resource-initial"
+  public_key = "` + sshPublicKeyInitial + `"
   default    = true
 }
 
-resource "binarylane_ssh_key" "unused" {
-  name       = "tf-test-server-resource-unused"
-  public_key = "` + GeneratePublicKey(t) + `"
+resource "binarylane_ssh_key" "updated" {
+  name       = "tf-test-server-resource-updated"
+  public_key = "` + sshPublicKeyUpdated + `"
   default    = true
 }
 
 resource "binarylane_server" "test" {
-	name   = "tf-test-server-resource"
-  region = "per"
-  image  = "debian-12"
-  size   = "std-min"
-	password = "` + password + `"
-	vpc_id = binarylane_vpc.test.id
-	public_ipv4_count = 0
-	user_data = <<EOT
+  name              = "tf-test-server-resource"
+  region            = "per"
+  image             = "debian-11"
+  size              = "std-min"
+  password          = "` + password + `"
+  vpc_id            = binarylane_vpc.test.id
+  public_ipv4_count = 1
+  ssh_keys          = [binarylane_ssh_key.initial.id]
+	source_and_destination_check = false
+  user_data         = <<EOT
 #cloud-config
 echo "Hello World" > /var/tmp/output.txt
 EOT
-	ssh_keys = [binarylane_ssh_key.test.id]
 }
 
 data "binarylane_server" "test" {
   depends_on = [binarylane_server.test]
 
-	id = binarylane_server.test.id
+  id = binarylane_server.test.id
 }
 `,
 				Check: resource.ComposeAggregateTestCheckFunc(
@@ -67,28 +78,32 @@ data "binarylane_server" "test" {
 					resource.TestCheckResourceAttrSet("binarylane_server.test", "id"),
 					resource.TestCheckResourceAttr("binarylane_server.test", "name", "tf-test-server-resource"),
 					resource.TestCheckResourceAttr("binarylane_server.test", "region", "per"),
-					resource.TestCheckResourceAttr("binarylane_server.test", "image", "debian-12"),
+					resource.TestCheckResourceAttr("binarylane_server.test", "image", "debian-11"),
 					resource.TestCheckResourceAttr("binarylane_server.test", "size", "std-min"),
 					resource.TestCheckResourceAttrSet("binarylane_server.test", "vpc_id"),
-					resource.TestCheckResourceAttr("binarylane_server.test", "public_ipv4_count", "0"),
+					resource.TestCheckResourceAttr("binarylane_server.test", "public_ipv4_count", "1"),
 					resource.TestCheckResourceAttr("binarylane_server.test", "password", password),
 					resource.TestCheckResourceAttr("binarylane_server.test", "user_data", `#cloud-config
 echo "Hello World" > /var/tmp/output.txt
 `),
-					resource.TestCheckResourceAttr("binarylane_server.test", "public_ipv4_addresses.#", "0"),
+					resource.TestCheckResourceAttr("binarylane_server.test", "public_ipv4_addresses.#", "1"),
 					resource.TestCheckResourceAttrSet("binarylane_server.test", "private_ipv4_addresses.0"),
 					resource.TestCheckResourceAttr("binarylane_server.test", "port_blocking", "true"),
-					resource.TestCheckResourceAttr("binarylane_server.test", "ssh_keys.#", "1"), // Only the test SSH key should be registered
-					resource.TestCheckResourceAttrPair("binarylane_server.test", "ssh_keys.0", "binarylane_ssh_key.test", "id"),
+					resource.TestCheckResourceAttr("binarylane_server.test", "ssh_keys.#", "1"),
+					resource.TestCheckResourceAttrPair("binarylane_server.test", "ssh_keys.0", "binarylane_ssh_key.initial", "id"),
 					resource.TestCheckResourceAttrSet("binarylane_server.test", "permalink"),
+					resource.TestCheckResourceAttr("binarylane_server.test", "source_and_destination_check", "false"),
 
 					// Verify data source values
 					resource.TestCheckResourceAttrPair("data.binarylane_server.test", "id", "binarylane_server.test", "id"),
 					resource.TestCheckResourceAttr("data.binarylane_server.test", "name", "tf-test-server-resource"),
 					resource.TestCheckResourceAttr("data.binarylane_server.test", "region", "per"),
-					resource.TestCheckResourceAttr("data.binarylane_server.test", "image", "debian-12"),
+					resource.TestCheckResourceAttr("data.binarylane_server.test", "image", "debian-11"),
 					resource.TestCheckResourceAttr("data.binarylane_server.test", "size", "std-min"),
 					resource.TestCheckResourceAttrPair("data.binarylane_server.test", "permalink", "binarylane_server.test", "permalink"),
+					resource.TestCheckResourceAttr("data.binarylane_server.test", "user_data", `#cloud-config
+echo "Hello World" > /var/tmp/output.txt
+`),
 				),
 			},
 			// Test import by ID
@@ -96,7 +111,7 @@ echo "Hello World" > /var/tmp/output.txt
 				ResourceName:            "binarylane_server.test",
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"password", "ssh_keys", "user_data", "wait_for_create", "public_ipv4_count"},
+				ImportStateVerifyIgnore: []string{"password", "ssh_keys", "timeouts"},
 			},
 			// Test import by name
 			{
@@ -104,8 +119,125 @@ echo "Hello World" > /var/tmp/output.txt
 				ImportState:             true,
 				ImportStateId:           "tf-test-server-resource",
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"password", "ssh_keys", "user_data", "wait_for_create", "public_ipv4_count"},
+				ImportStateVerifyIgnore: []string{"password", "ssh_keys", "timeouts"},
+			},
+			// Update and Read testing
+			{
+				Config: providerConfig + `
+resource "binarylane_vpc" "test" {
+  name     = "tf-test-server-resource"
+  ip_range = "10.240.0.0/16"
+}
+
+resource "binarylane_ssh_key" "initial" {
+  name       = "tf-test-server-resource-initial"
+  public_key = "` + sshPublicKeyInitial + `"
+  default    = true
+}
+
+resource "binarylane_ssh_key" "updated" {
+  name       = "tf-test-server-resource-updated"
+  public_key = "` + sshPublicKeyUpdated + `"
+  default    = true
+}
+
+resource "binarylane_server" "test" {
+  name              = "tf-test-server-resource-2"
+  region            = "per"
+  image             = "debian-12"
+  size              = "std-1vcpu"
+  password          = "` + password + `"
+  vpc_id            = binarylane_vpc.test.id
+  public_ipv4_count = 0
+  ssh_keys          = [binarylane_ssh_key.updated.id]
+	# source_and_destination_check =  true  # defaults to true
+  user_data         = <<EOT
+#cloud-config
+echo "Hello Whitespace" > /var/tmp/output.txt
+
+
+EOT
+}
+`,
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr("binarylane_server.test", "name", "tf-test-server-resource-2"),
+					resource.TestCheckResourceAttr("binarylane_server.test", "size", "std-1vcpu"),
+					resource.TestCheckResourceAttr("binarylane_server.test", "public_ipv4_count", "0"),
+					resource.TestCheckResourceAttr("binarylane_server.test", "public_ipv4_addresses.#", "0"),
+					resource.TestCheckResourceAttr("binarylane_server.test", "image", "debian-12"),
+					resource.TestCheckResourceAttr("binarylane_server.test", "ssh_keys.#", "1"),
+					resource.TestCheckResourceAttrPair("binarylane_server.test", "ssh_keys.0", "binarylane_ssh_key.updated", "id"),
+					resource.TestCheckResourceAttr("binarylane_server.test", "source_and_destination_check", "true"),
+					resource.TestCheckResourceAttr("binarylane_server.test", "user_data", // test extra whitespace
+						`#cloud-config
+echo "Hello Whitespace" > /var/tmp/output.txt
+
+
+`),
+				),
 			},
 		},
 	})
 }
+
+func init() {
+	resource.AddTestSweepers("server", &resource.Sweeper{
+		Name: "server",
+		F: func(_ string) error {
+			client, err := binarylane.NewClientWithDefaultConfig()
+
+			if err != nil {
+				return fmt.Errorf("Error creating Binary Lane API client: %w", err)
+			}
+
+			ctx := context.Background()
+
+			var page int32 = 1
+			perPage := int32(200)
+			nextPage := true
+
+			for nextPage {
+				params := binarylane.GetServersParams{
+					Page:    &page,
+					PerPage: &perPage,
+				}
+
+				listResp, err := client.GetServersWithResponse(ctx, &params)
+				if err != nil {
+					return fmt.Errorf("Error getting servers for test sweep: %w", err)
+				}
+
+				if listResp.StatusCode() != http.StatusOK {
+					return fmt.Errorf("Unexpected status code getting servers in test sweep: %s", listResp.Body)
+				}
+
+				servers := *listResp.JSON200.Servers
+				for _, s := range servers {
+					if strings.HasPrefix(*s.Name, "tf-test-") {
+						reason := "Terraform deletion"
+						params := binarylane.DeleteServersServerIdParams{
+							Reason: &reason,
+						}
+
+						deleteResp, err := client.DeleteServersServerIdWithResponse(ctx, *s.Id, &params)
+						if err != nil {
+							return fmt.Errorf("Error deleting server %d during test sweep: %w", *s.Id, err)
+						}
+						if deleteResp.StatusCode() != http.StatusNoContent {
+							return fmt.Errorf("Unexpected status %d deleting server %d in test sweep: %s", deleteResp.StatusCode(), *s.Id, deleteResp.Body)
+						}
+						log.Println("Deleted server during test sweep:", *s.Id)
+					}
+				}
+				if listResp.JSON200.Links == nil || listResp.JSON200.Links.Pages == nil || listResp.JSON200.Links.Pages.Next == nil {
+					nextPage = false
+					break
+				}
+
+				page++
+			}
+
+			return nil
+		},
+	})
+}

internal/provider/ssh_key_data_source.go

@@ -7,6 +7,7 @@ import (
 	"terraform-provider-binarylane/internal/resources"
 
 	"github.com/hashicorp/terraform-plugin-framework/datasource"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
 	"github.com/hashicorp/terraform-plugin-framework/types"
 )
 
@@ -59,10 +60,20 @@ func (d *sshKeyDataSource) Schema(ctx context.Context, req datasource.SchemaRequ
 	}
 	resp.Schema = *ds
 	// resp.Schema.Description = "TODO"
+
+	// Additional attributes
+	fingerprintDescription := "The fingerprint of the SSH key."
+	resp.Schema.Attributes["fingerprint"] = &schema.StringAttribute{
+		Description:         fingerprintDescription,
+		MarkdownDescription: fingerprintDescription,
+		Optional:            false,
+		Required:            false,
+		Computed:            true,
+	}
 }
 
 func (d *sshKeyDataSource) Read(ctx context.Context, req datasource.ReadRequest, resp *datasource.ReadResponse) {
-	var data resources.SshKeyModel
+	var data sshKeyModel
 
 	// Read Terraform configuration data into the model
 	resp.Diagnostics.Append(req.Config.Get(ctx, &data)...)
@@ -88,11 +99,11 @@ func (d *sshKeyDataSource) Read(ctx context.Context, req datasource.ReadRequest,
 		return
 	}
 
-	// Example data value setting
 	data.Id = types.Int64Value(*sshResp.JSON200.SshKey.Id)
 	data.Default = types.BoolValue(*sshResp.JSON200.SshKey.Default)
 	data.Name = types.StringValue(*sshResp.JSON200.SshKey.Name)
 	data.PublicKey = types.StringValue(*sshResp.JSON200.SshKey.PublicKey)
+	data.Fingerprint = types.StringValue(*sshResp.JSON200.SshKey.Fingerprint)
 
 	// Save data into Terraform state
 	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)

internal/provider/ssh_key_resource.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"net/http"
+	"strconv"
 	"terraform-provider-binarylane/internal/binarylane"
 	"terraform-provider-binarylane/internal/resources"
 
@@ -20,7 +21,7 @@ import (
 var (
 	_ resource.Resource                = &sshKeyResource{}
 	_ resource.ResourceWithConfigure   = &sshKeyResource{}
-	_ resource.ResourceWithImportState = &serverResource{}
+	_ resource.ResourceWithImportState = &sshKeyResource{}
 )
 
 func NewSshKeyResource() resource.Resource {
@@ -31,6 +32,11 @@ type sshKeyResource struct {
 	bc *BinarylaneClient
 }
 
+type sshKeyModel struct {
+	resources.SshKeyModel
+	Fingerprint types.String `tfsdk:"fingerprint"`
+}
+
 func (d *sshKeyResource) Configure(_ context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) {
 	if req.ProviderData == nil {
 		return
@@ -74,10 +80,20 @@ func (r *sshKeyResource) Schema(ctx context.Context, req resource.SchemaRequest,
 		MarkdownDescription: public_key.GetMarkdownDescription(),
 		PlanModifiers:       []planmodifier.String{stringplanmodifier.RequiresReplace()},
 	}
+
+	// Additional attributes
+	fingerprintDescription := "The fingerprint of the SSH key."
+	resp.Schema.Attributes["fingerprint"] = &schema.StringAttribute{
+		Description:         fingerprintDescription,
+		MarkdownDescription: fingerprintDescription,
+		Optional:            false,
+		Required:            false,
+		Computed:            true,
+	}
 }
 
 func (r *sshKeyResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
-	var data resources.SshKeyModel
+	var data sshKeyModel
 
 	// Read Terraform plan data into the model
 	resp.Diagnostics.Append(req.Plan.Get(ctx, &data)...)
@@ -86,7 +102,6 @@ func (r *sshKeyResource) Create(ctx context.Context, req resource.CreateRequest,
 		return
 	}
 
-	// Create API call logic
 	sshResp, err := r.bc.client.PostAccountKeysWithResponse(ctx, binarylane.SshKeyRequest{
 		Name:      data.Name.ValueString(),
 		Default:   data.Default.ValueBoolPointer(),
@@ -101,14 +116,15 @@ func (r *sshKeyResource) Create(ctx context.Context, req resource.CreateRequest,
 	}
 	if sshResp.StatusCode() != http.StatusOK {
 		resp.Diagnostics.AddError(
-			"Unexpected HTTP status code creating server",
-			fmt.Sprintf("Received %s creating new server: name=%s. Details: %s", sshResp.Status(), data.Name.ValueString(), sshResp.Body),
+			"Unexpected HTTP status code creating SSH key",
+			fmt.Sprintf("Received %s creating SSH key: name=%s. Details: %s", sshResp.Status(), data.Name.ValueString(), sshResp.Body),
 		)
 		return
 	}
 
 	// Set data values
 	data.Id = types.Int64Value(*sshResp.JSON200.SshKey.Id)
+	data.Fingerprint = types.StringValue(*sshResp.JSON200.SshKey.Fingerprint)
 
 	if resp.Diagnostics.HasError() {
 		return
@@ -119,7 +135,7 @@ func (r *sshKeyResource) Create(ctx context.Context, req resource.CreateRequest,
 }
 
 func (r *sshKeyResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
-	var data resources.SshKeyModel
+	var data sshKeyModel
 
 	// Read Terraform prior state data into the model
 	resp.Diagnostics.Append(req.State.Get(ctx, &data)...)
@@ -141,8 +157,8 @@ func (r *sshKeyResource) Read(ctx context.Context, req resource.ReadRequest, res
 	}
 	if sshResp.StatusCode() != http.StatusOK {
 		resp.Diagnostics.AddError(
-			"Unexpected HTTP status code creating server",
-			fmt.Sprintf("Received %s creating new server: name=%s. Details: %s", sshResp.Status(), data.Name.ValueString(), sshResp.Body),
+			"Unexpected HTTP status code getting SSH key",
+			fmt.Sprintf("Received %s getting SSH key: name=%s. Details: %s", sshResp.Status(), data.Name.ValueString(), sshResp.Body),
 		)
 		return
 	}
@@ -151,29 +167,36 @@ func (r *sshKeyResource) Read(ctx context.Context, req resource.ReadRequest, res
 	data.Id = types.Int64Value(*sshResp.JSON200.SshKey.Id)
 	data.Default = types.BoolValue(*sshResp.JSON200.SshKey.Default)
 	data.Name = types.StringValue(*sshResp.JSON200.SshKey.Name)
-	// data.PublicKey = types.StringValue(*sshResp.JSON200.SshKey.PublicKey) // don't set or it will force replacement every time
+	data.PublicKey = types.StringValue(*sshResp.JSON200.SshKey.PublicKey)
+	data.Fingerprint = types.StringValue(*sshResp.JSON200.SshKey.Fingerprint)
 
 	// Save updated data into Terraform state
 	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
 }
 
 func (r *sshKeyResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
-	var data resources.SshKeyModel
+	var plan, state sshKeyModel
+
+	// Read Terraform prior state data into the model
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
 
 	// Read Terraform plan data into the model
-	resp.Diagnostics.Append(req.Plan.Get(ctx, &data)...)
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
 	if resp.Diagnostics.HasError() {
 		return
 	}
 
 	// Update API call logic
-	sshResp, err := r.bc.client.PutAccountKeysKeyIdWithResponse(ctx, int(data.Id.ValueInt64()), binarylane.UpdateSshKeyRequest{
-		Name:    data.Name.ValueString(),
-		Default: data.Default.ValueBoolPointer(),
+	sshResp, err := r.bc.client.PutAccountKeysKeyIdWithResponse(ctx, int(state.Id.ValueInt64()), binarylane.UpdateSshKeyRequest{
+		Name:    plan.Name.ValueString(),
+		Default: plan.Default.ValueBoolPointer(),
 	})
 	if err != nil {
 		resp.Diagnostics.AddError(
-			fmt.Sprintf("Error updating SSH Key: name=%s", data.Name.ValueString()),
+			fmt.Sprintf("Error updating SSH Key: name=%s", plan.Name.ValueString()),
 			err.Error(),
 		)
 		return
@@ -181,30 +204,29 @@ func (r *sshKeyResource) Update(ctx context.Context, req resource.UpdateRequest,
 	if sshResp.StatusCode() != http.StatusOK {
 		resp.Diagnostics.AddError(
 			"Unexpected HTTP status code updating SSH Key",
-			fmt.Sprintf("Received %s updating new SSH Key: name=%s. Details: %s", sshResp.Status(), data.Name.ValueString(), sshResp.Body),
+			fmt.Sprintf("Received %s updating new SSH Key: name=%s. Details: %s", sshResp.Status(), plan.Name.ValueString(), sshResp.Body),
 		)
 		return
 	}
 
 	// Save updated data into Terraform state
-	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+	resp.Diagnostics.Append(resp.State.Set(ctx, &plan)...)
 }
 
 func (r *sshKeyResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
-	var data resources.SshKeyModel
-
-	// Read Terraform prior state data into the model
-	resp.Diagnostics.Append(req.State.Get(ctx, &data)...)
+	var state sshKeyModel
 
+	// Read Terraform prior state into the model
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
 	if resp.Diagnostics.HasError() {
 		return
 	}
 
 	// Delete API call logic
-	sshResp, err := r.bc.client.DeleteAccountKeysKeyIdWithResponse(ctx, int(data.Id.ValueInt64()))
+	sshResp, err := r.bc.client.DeleteAccountKeysKeyIdWithResponse(ctx, int(state.Id.ValueInt64()))
 	if err != nil {
 		resp.Diagnostics.AddError(
-			fmt.Sprintf("Error deleting SSH Key: name=%s", data.Name.ValueString()),
+			fmt.Sprintf("Error deleting SSH Key: name=%s", state.Name.ValueString()),
 			err.Error(),
 		)
 		return
@@ -212,13 +234,73 @@ func (r *sshKeyResource) Delete(ctx context.Context, req resource.DeleteRequest,
 	if sshResp.StatusCode() != http.StatusNoContent {
 		resp.Diagnostics.AddError(
 			"Unexpected HTTP status code deleting SSH Key",
-			fmt.Sprintf("Received %s deleting SSH Key: name=%s. Details: %s", sshResp.Status(), data.Name.ValueString(), sshResp.Body),
+			fmt.Sprintf("Received %s deleting SSH Key: name=%s. Details: %s", sshResp.Status(), state.Name.ValueString(), sshResp.Body),
 		)
 		return
 	}
 }
 
-func (r *sshKeyResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
-	// Retrieve import ID and save to id attribute
-	resource.ImportStatePassthroughID(ctx, path.Root("id"), req, resp)
+func (r *sshKeyResource) ImportState(
+	ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse,
+) {
+	// Import by ID
+	id, err := strconv.ParseInt(req.ID, 10, 32)
+	if err == nil {
+		diags := resp.State.SetAttribute(ctx, path.Root("id"), int32(id))
+		resp.Diagnostics.Append(diags...)
+		return
+	}
+
+	// Import by name
+	var page int32 = 1
+	perPage := int32(200)
+	var sshKey binarylane.SshKey
+	var nextPage bool = true
+
+	for nextPage { // Need to paginate because the API does not support filtering by fingerprint
+		params := binarylane.GetAccountKeysParams{
+			Page:    &page,
+			PerPage: &perPage,
+		}
+
+		sshResp, err := r.bc.client.GetAccountKeysWithResponse(ctx, &params)
+		if err != nil {
+			resp.Diagnostics.AddError(fmt.Sprintf("Error getting SSH key for import: fingerprint=%s", req.ID), err.Error())
+			return
+		}
+
+		if sshResp.StatusCode() != http.StatusOK {
+			resp.Diagnostics.AddError(
+				"Unexpected HTTP status code getting SSH key for import",
+				fmt.Sprintf("Received %s getting SSH key for import: fingerprint=%s. Details: %s", sshResp.Status(), req.ID,
+					sshResp.Body))
+			return
+		}
+
+		sshKeys := sshResp.JSON200.SshKeys
+		for _, key := range sshKeys {
+			if *key.Fingerprint == req.ID {
+				sshKey = key
+				nextPage = false
+				break
+			}
+		}
+		if sshResp.JSON200.Links == nil || sshResp.JSON200.Links.Pages == nil || sshResp.JSON200.Links.Pages.Next == nil {
+			nextPage = false
+			break
+		}
+
+		page++
+	}
+
+	if sshKey.Id == nil {
+		resp.Diagnostics.AddError(
+			"Could not find SSH key by fingerprint",
+			fmt.Sprintf("Error finding SSH key: fingerprint=%s", req.ID),
+		)
+		return
+	}
+
+	diags := resp.State.SetAttribute(ctx, path.Root("id"), *sshKey.Id)
+	resp.Diagnostics.Append(diags...)
 }

internal/provider/ssh_key_resource_test.go

@@ -1,67 +1,81 @@
 package provider
 
 import (
+	"context"
 	"crypto/ed25519"
 	"encoding/base64"
 	"fmt"
+	"log"
+	"net/http"
+	"strings"
+	"terraform-provider-binarylane/internal/binarylane"
 	"testing"
 
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
 )
 
 func TestSshKeyResource(t *testing.T) {
 	publicKey := GeneratePublicKey(t)
-	resource.Test(t, resource.TestCase{
+
+	resource.ParallelTest(t, resource.TestCase{
 		ProtoV6ProviderFactories: testAccProtoV6ProviderFactories,
 		Steps: []resource.TestStep{
 			// Create and Read testing
 			{
 				Config: providerConfig + `
+
 resource "binarylane_ssh_key" "test" {
-	name       = "tf_ssh_key_resource_test"
-	public_key = "` + publicKey + `"
+  name       = "tf-test-key-resource-test"
+  public_key = "` + publicKey + `"
 }
 
 data "binarylane_ssh_key" "test" {
   depends_on = [binarylane_ssh_key.test]
 
-	id = binarylane_ssh_key.test.id
+  id = binarylane_ssh_key.test.id
 }
 `,
 				Check: resource.ComposeAggregateTestCheckFunc(
 					// Verify resource values
-					resource.TestCheckResourceAttr("binarylane_ssh_key.test", "name", "tf_ssh_key_resource_test"),
+					resource.TestCheckResourceAttr("binarylane_ssh_key.test", "name", "tf-test-key-resource-test"),
 					resource.TestCheckResourceAttr("binarylane_ssh_key.test", "public_key", publicKey),
 					resource.TestCheckResourceAttr("binarylane_ssh_key.test", "default", "false"),
 					resource.TestCheckResourceAttrSet("binarylane_ssh_key.test", "id"),
 
 					// Verify data source values
-					resource.TestCheckResourceAttr("data.binarylane_ssh_key.test", "name", "tf_ssh_key_resource_test"),
+					resource.TestCheckResourceAttr("data.binarylane_ssh_key.test", "name", "tf-test-key-resource-test"),
 					resource.TestCheckResourceAttrSet("data.binarylane_ssh_key.test", "public_key"), // Ideally would check this is identical, but whitespace is not preserved
 					resource.TestCheckResourceAttr("data.binarylane_ssh_key.test", "default", "false"),
 					resource.TestCheckResourceAttrSet("data.binarylane_ssh_key.test", "id"),
 				),
 			},
 			// ImportState testing
-			// TODO
-			// {
-			// 	ResourceName:            "binarylane_ssh_key.test",
-			// 	ImportState:             true,
-			// 	ImportStateVerify:       true,
-			// 	ImportStateVerifyIgnore: []string{}, // nothing to ignore
-			// },
+			{
+				ResourceName:            "binarylane_ssh_key.test",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{}, // nothing to ignore
+			},
+			{
+				ResourceName:            "binarylane_ssh_key.test",
+				ImportStateIdFunc:       ImportByFingerprint,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{}, // nothing to ignore
+			},
 			// TODO: Update and Read testing
 			// 			{
 			// 				Config: providerConfig + `
 			// resource "binarylane_ssh_key" "test" {
-			// 	name       = "tf_ssh_key_resource_test"
+			// 	name       = "tf-test-key-resource-test"
 			// 	public_key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJCsuosklP0T4fJcQDgkeVh7dQu+eV+vev1CfwdUkj7h test@company.internal"
 			// 	default    = true
 			// }
 			// 			`,
 			// 				Check: resource.ComposeAggregateTestCheckFunc(
 			// 					// Verify resource values
-			// 					resource.TestCheckResourceAttr("binarylane_ssh_key.test", "name", "tf_ssh_key_resource_test"),
+			// 					resource.TestCheckResourceAttr("binarylane_ssh_key.test", "name", "tf-test-key-resource-test"),
 			// 					resource.TestCheckResourceAttr("data.binarylane_ssh_key.test", "default", "true"),
 			// 				),
 			// 			},
@@ -73,7 +87,7 @@ data "binarylane_ssh_key" "test" {
 func GeneratePublicKey(t *testing.T) string {
 	t.Helper()
 
-	_, pub, err := ed25519.GenerateKey(nil)
+	pub, _, err := ed25519.GenerateKey(nil)
 	if err != nil {
 		t.Fatalf("failed to generate key: %v", err)
 	}
@@ -81,3 +95,78 @@ func GeneratePublicKey(t *testing.T) string {
 	encoded := base64.StdEncoding.EncodeToString(pub)
 	return fmt.Sprintf("ssh-ed25519 %s test@company.internal", encoded)
 }
+
+func ImportByFingerprint(state *terraform.State) (fingerprint string, err error) {
+	resourceName := "binarylane_ssh_key.test"
+	var rawState map[string]string
+	for _, m := range state.Modules {
+		if len(m.Resources) > 0 {
+			if v, ok := m.Resources[resourceName]; ok {
+				rawState = v.Primary.Attributes
+			}
+		}
+	}
+	if rawState == nil {
+		return "", fmt.Errorf("resource not found: %s", resourceName)
+	}
+
+	return rawState["fingerprint"], nil
+}
+
+func init() {
+	resource.AddTestSweepers("ssh_key", &resource.Sweeper{
+		Name: "ssh_key",
+		F: func(_ string) error {
+			client, err := binarylane.NewClientWithDefaultConfig()
+
+			if err != nil {
+				return fmt.Errorf("Error creating Binary Lane API client: %w", err)
+			}
+
+			ctx := context.Background()
+
+			var page int32 = 1
+			perPage := int32(200)
+			nextPage := true
+
+			for nextPage {
+				params := binarylane.GetAccountKeysParams{
+					Page:    &page,
+					PerPage: &perPage,
+				}
+
+				listResp, err := client.GetAccountKeysWithResponse(ctx, &params)
+				if err != nil {
+					return fmt.Errorf("Error getting SSH keys for test sweep: %w", err)
+				}
+
+				if listResp.StatusCode() != http.StatusOK {
+					return fmt.Errorf("Unexpected status code getting SSH keys for test sweep: %s", listResp.Body)
+				}
+
+				keys := listResp.JSON200.SshKeys
+				for _, k := range keys {
+					if strings.HasPrefix(*k.Name, "tf-test-") {
+
+						deleteResp, err := client.DeleteAccountKeysKeyIdWithResponse(ctx, int(*k.Id))
+						if err != nil {
+							return fmt.Errorf("Error deleting SSH key %d for test sweep: %w", *k.Id, err)
+						}
+						if deleteResp.StatusCode() != http.StatusNoContent {
+							return fmt.Errorf("Unexpected status %d deleting SSH key %d for test sweep: %s", deleteResp.StatusCode(), *k.Id, deleteResp.Body)
+						}
+						log.Println("Deleted SSH key for test sweep:", *k.Id)
+					}
+				}
+				if listResp.JSON200.Links == nil || listResp.JSON200.Links.Pages == nil || listResp.JSON200.Links.Pages.Next == nil {
+					nextPage = false
+					break
+				}
+
+				page++
+			}
+
+			return nil
+		},
+	})
+}

internal/provider/sweeper_test.go

@@ -0,0 +1,11 @@
+package provider
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+)
+
+func TestMain(m *testing.M) {
+	resource.TestMain(m)
+}

internal/provider/util.go

@@ -1,6 +1,7 @@
 package provider
 
 import (
+	"context"
 	"fmt"
 	"slices"
 
@@ -153,3 +154,30 @@ func convertResourceSchemaToDataSourceSchema(rs r_schema.Schema, cfg AttributeCo
 
 	return &ds, nil
 }
+
+func listContainsUnknown(ctx context.Context, list types.List) bool {
+	// If the whole list is unknown, return true
+	if list.IsUnknown() {
+		return true
+	}
+
+	// Get elements as generic attr.Value to check individual unknown status
+	var elements []attr.Value
+	diags := list.ElementsAs(ctx, &elements, false)
+	if diags.HasError() {
+		return true // Assume unknown in case of errors
+	}
+
+	// Check if any element is unknown
+	for _, elem := range elements {
+		if elem.IsUnknown() {
+			return true
+		}
+	}
+
+	return false
+}
+
+func Pointer[T any](d T) *T {
+	return &d
+}

internal/provider/vpc_resource_test.go

@@ -1,6 +1,12 @@
 package provider
 
 import (
+	"context"
+	"fmt"
+	"log"
+	"net/http"
+	"strings"
+	"terraform-provider-binarylane/internal/binarylane"
 	"testing"
 
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
@@ -8,36 +14,37 @@ import (
 )
 
 func TestVpcResource(t *testing.T) {
-	resource.Test(t, resource.TestCase{
+	resource.ParallelTest(t, resource.TestCase{
 		ProtoV6ProviderFactories: testAccProtoV6ProviderFactories,
 		Steps: []resource.TestStep{
 			// Create and Read testing
 			{
 				Config: providerConfig + `
+
 resource "binarylane_vpc" "test" {
-	name     = "tf-test-vpc"
-	ip_range = "10.240.0.0/16"
+  name     = "tf-test-vpc"
+  ip_range = "10.240.0.0/16"
 }
 
 data "binarylane_vpc" "test" {
   depends_on = [binarylane_vpc.test]
 
-	id = binarylane_vpc.test.id
+  id = binarylane_vpc.test.id
 }
 
 resource "binarylane_vpc_route_entries" "test" {
-	vpc_id = binarylane_vpc.test.id
-	route_entries = [
-		{
-			description = "test"
-			destination = "0.0.0.0/0"
-			router      = "10.240.0.1"
-		}
-	]
+  vpc_id = binarylane_vpc.test.id
+  route_entries = [
+    {
+      description = "test"
+      destination = "0.0.0.0/0"
+      router      = "10.240.0.1"
+    }
+  ]
 }
 
 data "binarylane_vpc_route_entries" "test" {
-	vpc_id = binarylane_vpc_route_entries.test.vpc_id
+  vpc_id = binarylane_vpc_route_entries.test.vpc_id
 }
 `,
 				Check: resource.ComposeAggregateTestCheckFunc(
@@ -82,21 +89,23 @@ data "binarylane_vpc_route_entries" "test" {
 			// Update and Read testing
 			{
 				Config: providerConfig + `
+
 resource "binarylane_vpc" "test" {
-	name     = "tf-test-vpc-renamed"
-	ip_range = "10.240.0.0/16"
+  name     = "tf-test-vpc-renamed"
+  ip_range = "10.240.0.0/16"
 }
 
 resource "binarylane_vpc_route_entries" "test" {
-	vpc_id = binarylane_vpc.test.id
-	route_entries = [
-		{
-			description = "test-renamed"
-			destination = "0.0.0.0/0"
-			router      = "10.240.0.2"
-		}
-	]
-}`,
+  vpc_id = binarylane_vpc.test.id
+  route_entries = [
+    {
+      description = "test-renamed"
+      destination = "0.0.0.0/0"
+      router      = "10.240.0.2"
+    }
+  ]
+}
+`,
 				Check: resource.ComposeAggregateTestCheckFunc(
 					// Verify binarylane_vpc resource values updated
 					resource.TestCheckResourceAttr("binarylane_vpc.test", "name", "tf-test-vpc-renamed"), // Updated name
@@ -114,3 +123,61 @@ resource "binarylane_vpc_route_entries" "test" {
 		},
 	})
 }
+
+func init() {
+	resource.AddTestSweepers("vpc", &resource.Sweeper{
+		Name: "vpc",
+		F: func(_ string) error {
+			client, err := binarylane.NewClientWithDefaultConfig()
+
+			if err != nil {
+				return fmt.Errorf("Error creating Binary Lane API client: %w", err)
+			}
+
+			ctx := context.Background()
+
+			var page int32 = 1
+			perPage := int32(200)
+			nextPage := true
+
+			for nextPage {
+				params := binarylane.GetVpcsParams{
+					Page:    &page,
+					PerPage: &perPage,
+				}
+
+				listResp, err := client.GetVpcsWithResponse(ctx, &params)
+				if err != nil {
+					return fmt.Errorf("Error getting VPCs for test sweep: %w", err)
+				}
+
+				if listResp.StatusCode() != http.StatusOK {
+					return fmt.Errorf("Unexpected status code getting VPCs for test sweep: %s", listResp.Body)
+				}
+
+				vpcs := listResp.JSON200.Vpcs
+				for _, vpc := range *vpcs {
+					if strings.HasPrefix(*vpc.Name, "tf-test-") {
+
+						deleteResp, err := client.DeleteVpcsVpcIdWithResponse(ctx, *vpc.Id)
+						if err != nil {
+							return fmt.Errorf("Error deleting VPC %d in test sweep: %w", *vpc.Id, err)
+						}
+						if deleteResp.StatusCode() != http.StatusNoContent {
+							return fmt.Errorf("Unexpected status %d deleting VPC %d for test sweep: %s", deleteResp.StatusCode(), *vpc.Id, deleteResp.Body)
+						}
+						log.Println("Deleted VPC for test sweep:", *vpc.Id)
+					}
+				}
+				if listResp.JSON200.Links == nil || listResp.JSON200.Links.Pages == nil || listResp.JSON200.Links.Pages.Next == nil {
+					nextPage = false
+					break
+				}
+
+				page++
+			}
+
+			return nil
+		},
+	})
+}

internal/resources/server_firewall_rules_resource_gen.go

@@ -621,11 +621,19 @@ func (v FirewallRulesValue) String() string {
 func (v FirewallRulesValue) ToObjectValue(ctx context.Context) (basetypes.ObjectValue, diag.Diagnostics) {
 	var diags diag.Diagnostics
 
-	destinationAddressesVal, d := types.ListValue(types.StringType, v.DestinationAddresses.Elements())
+	var destinationAddressesVal basetypes.ListValue
+	switch {
+	case v.DestinationAddresses.IsUnknown():
+		destinationAddressesVal = types.ListUnknown(types.StringType)
+	case v.DestinationAddresses.IsNull():
+		destinationAddressesVal = types.ListNull(types.StringType)
+	default:
+		var d diag.Diagnostics
+		destinationAddressesVal, d = types.ListValue(types.StringType, v.DestinationAddresses.Elements())
+		diags.Append(d...)
+	}
 
-	diags.Append(d...)
-
-	if d.HasError() {
+	if diags.HasError() {
 		return types.ObjectUnknown(map[string]attr.Type{
 			"action":      basetypes.StringType{},
 			"description": basetypes.StringType{},
@@ -642,11 +650,19 @@ func (v FirewallRulesValue) ToObjectValue(ctx context.Context) (basetypes.Object
 		}), diags
 	}
 
-	destinationPortsVal, d := types.ListValue(types.StringType, v.DestinationPorts.Elements())
+	var destinationPortsVal basetypes.ListValue
+	switch {
+	case v.DestinationPorts.IsUnknown():
+		destinationPortsVal = types.ListUnknown(types.StringType)
+	case v.DestinationPorts.IsNull():
+		destinationPortsVal = types.ListNull(types.StringType)
+	default:
+		var d diag.Diagnostics
+		destinationPortsVal, d = types.ListValue(types.StringType, v.DestinationPorts.Elements())
+		diags.Append(d...)
+	}
 
-	diags.Append(d...)
-
-	if d.HasError() {
+	if diags.HasError() {
 		return types.ObjectUnknown(map[string]attr.Type{
 			"action":      basetypes.StringType{},
 			"description": basetypes.StringType{},
@@ -663,11 +679,19 @@ func (v FirewallRulesValue) ToObjectValue(ctx context.Context) (basetypes.Object
 		}), diags
 	}
 
-	sourceAddressesVal, d := types.ListValue(types.StringType, v.SourceAddresses.Elements())
+	var sourceAddressesVal basetypes.ListValue
+	switch {
+	case v.SourceAddresses.IsUnknown():
+		sourceAddressesVal = types.ListUnknown(types.StringType)
+	case v.SourceAddresses.IsNull():
+		sourceAddressesVal = types.ListNull(types.StringType)
+	default:
+		var d diag.Diagnostics
+		sourceAddressesVal, d = types.ListValue(types.StringType, v.SourceAddresses.Elements())
+		diags.Append(d...)
+	}
 
-	diags.Append(d...)
-
-	if d.HasError() {
+	if diags.HasError() {
 		return types.ObjectUnknown(map[string]attr.Type{
 			"action":      basetypes.StringType{},
 			"description": basetypes.StringType{},