feat: add resource_metadata Dynamic field to all resource schemas and models (closes #662)

Adds optional resource_metadata attribute of type Dynamic to every resource
schema and ResourceModel struct. The field is persisted in Terraform state only
and is not sent to the API. Intended for account migration tooling to track
identity mappings between old and new resource IDs across tenancies.

Regenerates docs for all affected resources.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Author: trouze

.changes/unreleased/Changes-20260409-195800.yaml

@@ -0,0 +1,3 @@
+kind: Changes
+body: Add optional `resource_metadata` Dynamic field to all resource schemas and models for account migration tooling support
+time: 2026-04-09T19:58:00.000000+00:00

docs/resources/account_features.md

@@ -47,6 +47,7 @@ resource "dbtcloud_account_features" "my_features" {
 - `fusion_migration_permissions` (Boolean) Whether permissions for accounts migrating to Fusion are enabled.
 - `partial_parsing` (Boolean) Whether partial parsing is enabled.
 - `repo_caching` (Boolean) Whether repository caching is enabled.
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 
 ### Read-Only
 

docs/resources/athena_credential.md

@@ -61,6 +61,7 @@ resource "dbtcloud_athena_credential" "example_wo" {
 - `aws_secret_access_key` (String, Sensitive) AWS secret access key for Athena user. Consider using `aws_secret_access_key_wo` instead, which is not stored in state.
 - `aws_secret_access_key_wo` (String) Write-only alternative to `aws_secret_access_key`. The value is not stored in state. Requires `aws_secret_access_key_wo_version` to trigger updates.
 - `aws_secret_access_key_wo_version` (Number) Version number for `aws_secret_access_key_wo`. Increment this value to trigger an update of the AWS secret access key when using `aws_secret_access_key_wo`.
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 
 ### Read-Only
 

docs/resources/auth_provider.md

@@ -166,6 +166,7 @@ resource "dbtcloud_auth_provider" "gsuite" {
 - `gsuite_admin_id` (String) Google Workspace admin email used to fetch group memberships.
 - `include_indirect_groups` (Boolean) Whether to include transitive (indirect) group memberships from Azure AD. Defaults to true.
 - `max_groups_to_retrieve` (Number) Maximum number of Azure AD groups to fetch per user. Defaults to 250.
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 - `sign_request` (Boolean) Whether to sign SAML authentication requests. Defaults to false.
 - `slug` (String) URL-safe identifier used in the SSO login URL. Auto-generated if omitted. Immutable on accounts where auto-slug enforcement is enabled.
 - `sso_url` (String) SAML Single Sign-On URL from your identity provider. Required for `saml` and `okta`.

docs/resources/azure_ad_application.md

@@ -55,6 +55,7 @@ resource "dbtcloud_azure_ad_application" "this" {
 ### Optional
 
 - `azure_service_authentication_method` (String) The method used for service authentication. One of: ~~~service_user~~~, ~~~service_principal~~~. Defaults to ~~~service_user~~~.
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 
 ### Read-Only
 

docs/resources/bigquery_credential.md

@@ -42,6 +42,7 @@ resource "dbtcloud_bigquery_credential" "my_credential_v1" {
 
 - `connection_id` (Number) The ID of the global connection to use for this credential. When provided, the credential will automatically use the correct adapter version based on the connection's configuration (e.g., bigquery_v1 for connections with use_latest_adapter=true).
 - `is_active` (Boolean) Whether the BigQuery credential is active
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 
 ### Read-Only
 

docs/resources/bigquery_semantic_layer_credential.md

@@ -58,6 +58,7 @@ resource "dbtcloud_bigquery_semantic_layer_credential" "example" {
 - `private_key` (String, Sensitive) Private Key for the Service Account. Consider using `private_key_wo` instead, which is not stored in state.
 - `private_key_wo` (String) Write-only alternative to `private_key`. The value is not stored in state. Requires `private_key_wo_version` to trigger updates.
 - `private_key_wo_version` (Number) Version number for `private_key_wo`. Increment this value to trigger an update of the private key when using `private_key_wo`.
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 
 ### Read-Only
 
@@ -86,6 +87,7 @@ Optional:
 
 - `connection_id` (Number) The ID of the global connection to use for this credential. When provided, the credential will automatically use the correct adapter version based on the connection's configuration (e.g., bigquery_v1 for connections with use_latest_adapter=true).
 - `is_active` (Boolean) Whether the BigQuery credential is active
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 
 Read-Only:
 

docs/resources/connection_catalog_config.md

@@ -99,6 +99,7 @@ resource "dbtcloud_connection_catalog_config" "with_creds" {
 
 - `database_allow` (List of String) List of database names to include. Supports wildcards (e.g., 'analytics_*'). If set, only these databases are ingested.
 - `database_deny` (List of String) List of database names to exclude. Supports wildcards (e.g., 'staging_*'). Matching databases are not ingested.
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 - `schema_allow` (List of String) List of schema names to include. Supports wildcards (e.g., 'public_*'). If set, only these schemas are ingested.
 - `schema_deny` (List of String) List of schema names to exclude. Supports wildcards (e.g., 'temp_*'). Matching schemas are not ingested.
 - `table_allow` (List of String) List of table names to include. Supports wildcards (e.g., 'fact_*'). If set, only these tables are ingested.

docs/resources/databricks_credential.md

@@ -50,6 +50,7 @@ resource "dbtcloud_databricks_credential" "my_databricks_cred_wo" {
 
 - `adapter_type` (String, Deprecated) The type of the adapter. 'spark' is deprecated, but still supported for backwards compatibility. For Spark, please use the spark_credential resource. Optional only when semantic_layer_credential is set to true; otherwise, this field is required.
 - `catalog` (String) The catalog where to create models (only for the databricks adapter)
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 - `schema` (String) The schema where to create models. Optional only when semantic_layer_credential is set to true; otherwise, this field is required.
 - `semantic_layer_credential` (Boolean) This field indicates that the credential is used as part of the Semantic Layer configuration. It is used to create a Databricks credential for the Semantic Layer.
 - `target_name` (String, Deprecated) Target name

docs/resources/databricks_platform_metadata_credential.md

@@ -77,6 +77,7 @@ resource "dbtcloud_databricks_platform_metadata_credential" "example_wo" {
 - `catalog_ingestion_enabled` (Boolean) Whether catalog ingestion is enabled for this credential. When enabled, dbt Cloud will ingest metadata about tables, views, and other objects from your data warehouse.
 - `cost_insights_enabled` (Boolean) Whether cost insights is enabled for this credential.
 - `cost_optimization_enabled` (Boolean) Whether cost optimization data collection is enabled for this credential.
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 - `token` (String, Sensitive) The Databricks personal access token. Consider using `token_wo` instead, which is not stored in state.
 - `token_wo` (String) Write-only alternative to `token`. The value is not stored in state. Requires `token_wo_version` to trigger updates.
 - `token_wo_version` (Number) Version number for `token_wo`. Increment this value to trigger an update of the token when using `token_wo`.