feat: add resource_metadata field to all resources (closes #662)

.changes/unreleased/Changes-20260409-195800.yaml

@@ -0,0 +1,3 @@
+kind: Changes
+body: Add optional `resource_metadata` Dynamic field to all resource schemas and models for account migration tooling support
+time: 2026-04-09T19:58:00.000000+00:00

docs/data-sources/global_connection.md

@@ -25,6 +25,10 @@ data dbtcloud_global_connection my_connection {
 
 - `id` (Number) Connection Identifier
 
+### Optional
+
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
+
 ### Read-Only
 
 - `adapter_version` (String) Version of the adapter

docs/resources/account_features.md

@@ -47,6 +47,7 @@ resource "dbtcloud_account_features" "my_features" {
 - `fusion_migration_permissions` (Boolean) Whether permissions for accounts migrating to Fusion are enabled.
 - `partial_parsing` (Boolean) Whether partial parsing is enabled.
 - `repo_caching` (Boolean) Whether repository caching is enabled.
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 
 ### Read-Only
 

docs/resources/athena_credential.md

@@ -61,6 +61,7 @@ resource "dbtcloud_athena_credential" "example_wo" {
 - `aws_secret_access_key` (String, Sensitive) AWS secret access key for Athena user. Consider using `aws_secret_access_key_wo` instead, which is not stored in state.
 - `aws_secret_access_key_wo` (String) Write-only alternative to `aws_secret_access_key`. The value is not stored in state. Requires `aws_secret_access_key_wo_version` to trigger updates.
 - `aws_secret_access_key_wo_version` (Number) Version number for `aws_secret_access_key_wo`. Increment this value to trigger an update of the AWS secret access key when using `aws_secret_access_key_wo`.
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 
 ### Read-Only
 

docs/resources/auth_provider.md

@@ -166,6 +166,7 @@ resource "dbtcloud_auth_provider" "gsuite" {
 - `gsuite_admin_id` (String) Google Workspace admin email used to fetch group memberships.
 - `include_indirect_groups` (Boolean) Whether to include transitive (indirect) group memberships from Azure AD. Defaults to true.
 - `max_groups_to_retrieve` (Number) Maximum number of Azure AD groups to fetch per user. Defaults to 250.
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 - `sign_request` (Boolean) Whether to sign SAML authentication requests. Defaults to false.
 - `slug` (String) URL-safe identifier used in the SSO login URL. Auto-generated if omitted. Immutable on accounts where auto-slug enforcement is enabled.
 - `sso_url` (String) SAML Single Sign-On URL from your identity provider. Required for `saml` and `okta`.

docs/resources/azure_ad_application.md

@@ -55,6 +55,7 @@ resource "dbtcloud_azure_ad_application" "this" {
 ### Optional
 
 - `azure_service_authentication_method` (String) The method used for service authentication. One of: ~~~service_user~~~, ~~~service_principal~~~. Defaults to ~~~service_user~~~.
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 
 ### Read-Only
 

docs/resources/bigquery_credential.md

@@ -42,6 +42,7 @@ resource "dbtcloud_bigquery_credential" "my_credential_v1" {
 
 - `connection_id` (Number) The ID of the global connection to use for this credential. When provided, the credential will automatically use the correct adapter version based on the connection's configuration (e.g., bigquery_v1 for connections with use_latest_adapter=true).
 - `is_active` (Boolean) Whether the BigQuery credential is active
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 
 ### Read-Only
 

docs/resources/bigquery_semantic_layer_credential.md

@@ -58,6 +58,7 @@ resource "dbtcloud_bigquery_semantic_layer_credential" "example" {
 - `private_key` (String, Sensitive) Private Key for the Service Account. Consider using `private_key_wo` instead, which is not stored in state.
 - `private_key_wo` (String) Write-only alternative to `private_key`. The value is not stored in state. Requires `private_key_wo_version` to trigger updates.
 - `private_key_wo_version` (Number) Version number for `private_key_wo`. Increment this value to trigger an update of the private key when using `private_key_wo`.
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 
 ### Read-Only
 
@@ -86,6 +87,7 @@ Optional:
 
 - `connection_id` (Number) The ID of the global connection to use for this credential. When provided, the credential will automatically use the correct adapter version based on the connection's configuration (e.g., bigquery_v1 for connections with use_latest_adapter=true).
 - `is_active` (Boolean) Whether the BigQuery credential is active
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 
 Read-Only:
 

docs/resources/connection_catalog_config.md

@@ -99,6 +99,7 @@ resource "dbtcloud_connection_catalog_config" "with_creds" {
 
 - `database_allow` (List of String) List of database names to include. Supports wildcards (e.g., 'analytics_*'). If set, only these databases are ingested.
 - `database_deny` (List of String) List of database names to exclude. Supports wildcards (e.g., 'staging_*'). Matching databases are not ingested.
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 - `schema_allow` (List of String) List of schema names to include. Supports wildcards (e.g., 'public_*'). If set, only these schemas are ingested.
 - `schema_deny` (List of String) List of schema names to exclude. Supports wildcards (e.g., 'temp_*'). Matching schemas are not ingested.
 - `table_allow` (List of String) List of table names to include. Supports wildcards (e.g., 'fact_*'). If set, only these tables are ingested.

docs/resources/databricks_credential.md

@@ -50,6 +50,7 @@ resource "dbtcloud_databricks_credential" "my_databricks_cred_wo" {
 
 - `adapter_type` (String, Deprecated) The type of the adapter. 'spark' is deprecated, but still supported for backwards compatibility. For Spark, please use the spark_credential resource. Optional only when semantic_layer_credential is set to true; otherwise, this field is required.
 - `catalog` (String) The catalog where to create models (only for the databricks adapter)
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 - `schema` (String) The schema where to create models. Optional only when semantic_layer_credential is set to true; otherwise, this field is required.
 - `semantic_layer_credential` (Boolean) This field indicates that the credential is used as part of the Semantic Layer configuration. It is used to create a Databricks credential for the Semantic Layer.
 - `target_name` (String, Deprecated) Target name

docs/resources/databricks_platform_metadata_credential.md

@@ -77,6 +77,7 @@ resource "dbtcloud_databricks_platform_metadata_credential" "example_wo" {
 - `catalog_ingestion_enabled` (Boolean) Whether catalog ingestion is enabled for this credential. When enabled, dbt Cloud will ingest metadata about tables, views, and other objects from your data warehouse.
 - `cost_insights_enabled` (Boolean) Whether cost insights is enabled for this credential.
 - `cost_optimization_enabled` (Boolean) Whether cost optimization data collection is enabled for this credential.
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 - `token` (String, Sensitive) The Databricks personal access token. Consider using `token_wo` instead, which is not stored in state.
 - `token_wo` (String) Write-only alternative to `token`. The value is not stored in state. Requires `token_wo_version` to trigger updates.
 - `token_wo_version` (Number) Version number for `token_wo`. Increment this value to trigger an update of the token when using `token_wo`.

docs/resources/databricks_semantic_layer_credential.md

@@ -36,6 +36,10 @@ resource "dbtcloud_databricks_semantic_layer_credential" "sl_cred_databricks_exa
 - `configuration` (Attributes) Semantic Layer credential configuration details. (see [below for nested schema](#nestedatt--configuration))
 - `credential` (Attributes) Databricks credential details, but used in the context of the Semantic Layer. (see [below for nested schema](#nestedatt--credential))
 
+### Optional
+
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
+
 ### Read-Only
 
 - `id` (Number) The ID of the credential
@@ -61,6 +65,7 @@ Optional:
 
 - `adapter_type` (String, Deprecated) The type of the adapter. 'spark' is deprecated, but still supported for backwards compatibility. For Spark, please use the spark_credential resource. Optional only when semantic_layer_credential is set to true; otherwise, this field is required.
 - `catalog` (String) The catalog where to create models (only for the databricks adapter)
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 - `schema` (String) The schema where to create models. Optional only when semantic_layer_credential is set to true; otherwise, this field is required.
 - `semantic_layer_credential` (Boolean) This field indicates that the credential is used as part of the Semantic Layer configuration. It is used to create a Databricks credential for the Semantic Layer.
 - `target_name` (String, Deprecated) Target name

docs/resources/environment.md

@@ -78,6 +78,7 @@ resource "dbtcloud_environment" "profiled_environment" {
 - `extended_attributes_id` (Number) The ID of the extended attributes applied
 - `is_active` (Boolean) Whether the environment is active
 - `primary_profile_id` (Number) The ID of the primary profile for this environment. A profile ties together a connection and credentials. Only applicable to deployment environments. ~> Setting `primary_profile_id` alongside `connection_id`, `credential_id`, or `extended_attributes_id` will produce an error. When a profile is assigned, the API determines those values from the profile. Manage connection, credentials, and extended attributes through the `dbtcloud_profile` resource instead.
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 - `use_custom_branch` (Boolean) Whether to use a custom git branch in this environment
 
 ### Read-Only

docs/resources/environment_variable.md

@@ -40,6 +40,10 @@ resource "dbtcloud_environment_variable" "dbt_my_env_var" {
 - `name` (String) Name for the variable, must be unique within a project, must be prefixed with 'DBT_'
 - `project_id` (Number) Project ID to create the environment variable in
 
+### Optional
+
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
+
 ### Read-Only
 
 - `id` (String) The ID of this resource. Contains the project ID and the environment variable ID.

docs/resources/environment_variable_job_override.md

@@ -31,6 +31,10 @@ resource "dbtcloud_environment_variable_job_override" "my_env_var_job_override"
 - `project_id` (Number) Project ID to create the environment variable job override in
 - `raw_value` (String) The value for the override of the environment variable
 
+### Optional
+
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
+
 ### Read-Only
 
 - `account_id` (Number) The account id

docs/resources/extended_attributes.md

@@ -51,6 +51,7 @@ resource "dbtcloud_environment" "issue_depl" {
 
 ### Optional
 
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 - `state` (Number) The state of the extended attributes (1 = active, 2 = inactive)
 
 ### Read-Only

docs/resources/fabric_credential.md

@@ -88,6 +88,7 @@ resource "dbtcloud_fabric_credential" "my_fabric_cred_serv_princ_wo" {
 - `password` (String, Sensitive) The password for the account to connect to. Only used when connection with AD user/pass. Consider using `password_wo` instead, which is not stored in state.
 - `password_wo` (String) Write-only alternative to `password`. The value is not stored in state. Requires `password_wo_version` to trigger updates.
 - `password_wo_version` (Number) Version number for `password_wo`. Increment this value to trigger an update of the password when using `password_wo`.
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 - `schema_authorization` (String) Optionally set this to the principal who should own the schemas created by dbt
 - `tenant_id` (String) The tenant ID of the Azure Active Directory instance. This is only used when connecting to Azure SQL with a service principal.
 - `user` (String) The username of the Fabric account to connect to. Only used when connection with AD user/pass

docs/resources/global_connection.md

@@ -194,6 +194,7 @@ resource "dbtcloud_global_connection" "teradata" {
 - `postgres` (Attributes) PostgreSQL connection configuration. (see [below for nested schema](#nestedatt--postgres))
 - `private_link_endpoint_id` (String) Private Link Endpoint ID. This ID can be found using the `privatelink_endpoint` data source
 - `redshift` (Attributes) Redshift connection configuration (see [below for nested schema](#nestedatt--redshift))
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 - `salesforce` (Attributes) Salesforce connection configuration. (see [below for nested schema](#nestedatt--salesforce))
 - `snowflake` (Attributes) Snowflake connection configuration (see [below for nested schema](#nestedatt--snowflake))
 - `starburst` (Attributes) Starburst/Trino connection configuration. (see [below for nested schema](#nestedatt--starburst))

docs/resources/group.md

@@ -72,6 +72,7 @@ resource "dbtcloud_group" "tf_group_1" {
 
 - `assign_by_default` (Boolean) Whether the group will be assigned by default to users. The value needs to be the same for all partial permissions for the same group.
 - `group_permissions` (Block Set) Partial permissions for the group. Those permissions will be added/removed when config is added/removed. (see [below for nested schema](#nestedblock--group_permissions))
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 - `sso_mapping_groups` (Set of String) Mapping groups from the IdP. At the moment the complete list needs to be provided in each partial permission for the same group.
 
 ### Read-Only

docs/resources/group_partial_permissions.md

@@ -80,6 +80,7 @@ resource "dbtcloud_group_partial_permissions" "tf_group_2" {
 
 - `assign_by_default` (Boolean) Whether the group will be assigned by default to users. The value needs to be the same for all partial permissions for the same group.
 - `group_permissions` (Attributes Set) Partial permissions for the group. Those permissions will be added/removed when config is added/removed. (see [below for nested schema](#nestedatt--group_permissions))
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 - `sso_mapping_groups` (Set of String) Mapping groups from the IdP. At the moment the complete list needs to be provided in each partial permission for the same group.
 
 ### Read-Only
@@ -97,8 +98,8 @@ Required:
 Optional:
 
 - `project_id` (Number) Project ID to apply this permission to for this group.
-- `writable_environment_categories` (Set of String) What types of environments to apply Write permissions to. 
-Even if Write access is restricted to some environment types, the permission set will have Read access to all environments. 
-The values allowed are `all`, `development`, `staging`, `production` and `other`. 
-Not setting a value is the same as selecting `all`. 
+- `writable_environment_categories` (Set of String) What types of environments to apply Write permissions to.
+Even if Write access is restricted to some environment types, the permission set will have Read access to all environments.
+The values allowed are `all`, `development`, `staging`, `production` and `other`.
+Not setting a value is the same as selecting `all`.
 Not all permission sets support environment level write settings, only `analyst`, `database_admin`, `developer`, `git_admin` and `team_admin`.

docs/resources/ip_restrictions_rule.md

@@ -42,6 +42,7 @@ resource "dbtcloud_ip_restrictions_rule" "test" {
 ### Optional
 
 - `description` (String) A description of the IP restriction rule
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 
 ### Read-Only
 

docs/resources/job.md

@@ -230,6 +230,7 @@ An example can be found [in this GitHub issue](https://github.com/dbt-labs/terra
 - `job_completion_trigger_condition` (Block List) Which other job should trigger this job when it finishes, and on which conditions (sometimes referred as 'job chaining'). (see [below for nested schema](#nestedblock--job_completion_trigger_condition))
 - `job_type` (String) Can be used to enforce the job type betwen `ci`, `merge` and `scheduled`. Without this value the job type is inferred from the triggers configured
 - `num_threads` (Number) Number of threads to use in the job
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 - `run_compare_changes` (Boolean) Whether the CI job should compare data changes introduced by the code changes. Requires `deferring_environment_id` to be set. (Advanced CI needs to be activated in the dbt Cloud Account Settings first as well)
 - `run_generate_sources` (Boolean) Flag for whether the job should add a `dbt source freshness` step to the job. The difference between manually adding a step with `dbt source freshness` in the job steps or using this flag is that with this flag, a failed freshness will still allow the following steps to run.
 - `run_lint` (Boolean) Whether the CI job should lint SQL changes. Defaults to `false`.

docs/resources/license_map.md

@@ -41,6 +41,7 @@ resource "dbtcloud_license_map" "it_license_map" {
 
 ### Optional
 
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 - `sso_license_mapping_groups` (Set of String) SSO license mapping group names for this group
 
 ### Read-Only

docs/resources/lineage_integration.md

@@ -63,6 +63,7 @@ resource "dbtcloud_lineage_integration" "my_lineage_wo" {
 
 ### Optional
 
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 - `token` (String, Sensitive) The secret token value to use to authenticate to the BI server. Consider using `token_wo` instead, which is not stored in state.
 - `token_wo` (String) Write-only alternative to `token`. The value is not stored in state. Requires `token_wo_version` to trigger updates.
 - `token_wo_version` (Number) Version number for `token_wo`. Increment this value to trigger an update of the token when using `token_wo`.

docs/resources/model_notifications.md

@@ -36,6 +36,7 @@ resource "dbtcloud_model_notifications" "prod_model_notifications" {
 - `on_skipped` (Boolean) Whether to send notifications for skipped model runs
 - `on_success` (Boolean) Whether to send notifications for successful model runs
 - `on_warning` (Boolean) Whether to send notifications for model runs with warnings
+- `resource_metadata` (Dynamic) Metadata for tracking resource identity during account migrations. Stored in Terraform state only and not sent to the API.
 
 ### Read-Only