secrets/transform: Add new fields for transform transformation resource. (#2820)

* rebased changes

* added changelog entry

* rebasing changes

* Added support for config control group resource (#2840)

* Rebased changes

* Remove duplicate ControlGroupConfigResource from provider

Removed duplicate sysconfig.NewControlGroupConfigResource entry from the resource list.

* moved changes to unreleased section of changelog

* removed extra space

* changelog: keep only intended entry

* rebased changes

* added changelog entry

* Added support for config control group resource (#2840)

* Rebased changes

* Remove duplicate ControlGroupConfigResource from provider

Removed duplicate sysconfig.NewControlGroupConfigResource entry from the resource list.

* moved changes to unreleased section of changelog

* removed extra space

* rebased changes

* added changelog entry

* rebased changes

* changelog addition

* Delete internal/vault/sys/config/control_group_resource_test.go

* Delete internal/vault/sys/config/control_group_resource.go

* Delete website/docs/r/config_control_group.html.md

* Added support for config control group resource (#2840)

* Rebased changes

* Remove duplicate ControlGroupConfigResource from provider

Removed duplicate sysconfig.NewControlGroupConfigResource entry from the resource list.

* moved changes to unreleased section of changelog

* removed extra space

* rebased changes

* rebased changes

* changelog addition

* Revise CHANGELOG for new features and fixes

Updated CHANGELOG with new features, improvements, and bug fixes for the Vault provider.

* Update CHANGELOG with new features and resources

Added new resources for managing Vault UI headers, RADIUS auth backend, activation flags, and userpass authentication. Updated transformation resource with new fields.

* Delete website/docs/r/config_control_group.html.md

* Delete internal/vault/sys/config/control_group_resource_test.go

* Delete internal/vault/sys/config/control_group_resource.go

Author: johnjosephg

CHANGELOG.md

@@ -8,6 +8,7 @@ FEATURES:
 * **New Resource**: `vault_activation_flags`  for managing Vault features that are gated by one-time flags. Requires Vault 1.16 or later. Needs Vault enterprise licence([#2861](https://github.com/hashicorp/terraform-provider-vault/pull/2861/))
 * **New Resources**: `vault_userpass_auth_backend_user` for user creation, deletion, password updates, and policy updates, and ephemeral resource `vault_userpass_auth_login` for authenticating with Userpass. ([#2859](https://github.com/hashicorp/terraform-provider-vault/pull/2859))
 * Add support for write only paramters for s3 backends for `vault_raft_snapshot_agent_config` by @drewmullen ([#2825]https://github.com/hashicorp/terraform-provider-vault/pull/2825)
+* `vault_transform_transformation`: Added `mapping_mode`, `stores` and `convergent` fields to the resource. ([#2820] https://github.com/hashicorp/terraform-provider-vault/pull/2820/)
 
 
 ## 5.9.0 (April 22, 2026)

internal/consts/consts.go

@@ -314,6 +314,13 @@ const (
 	FieldRedundancyZonesJSON                = "redundancy_zones_json"
 	FieldServers                            = "servers"
 	FieldServersJSON                        = "servers_json"
+	FieldMaskingCharacter                   = "masking_character"
+	FieldTemplate                           = "template"
+	FieldTemplates                          = "templates"
+	FieldTweakSource                        = "tweak_source"
+	FieldMappingMode                        = "mapping_mode"
+	FieldStores                             = "stores"
+	FieldConvergent                         = "convergent"
 	FieldUpgradeInfo                        = "upgrade_info"
 	FieldUpgradeInfoJSON                    = "upgrade_info_json"
 	FieldMaxVersions                        = "max_versions"

vault/resource_transform_transformation.go

@@ -8,8 +8,10 @@ import (
 	"log"
 	"strings"
 
+	"github.com/hashicorp/go-cty/cty"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 
+	"github.com/hashicorp/terraform-provider-vault/internal/consts"
 	"github.com/hashicorp/terraform-provider-vault/internal/provider"
 	"github.com/hashicorp/terraform-provider-vault/util"
 )
@@ -18,7 +20,7 @@ const transformTransformationEndpoint = "/transform/transformation/{name}"
 
 func transformTransformationResource() *schema.Resource {
 	fields := map[string]*schema.Schema{
-		"path": {
+		consts.FieldPath: {
 			Type:        schema.TypeString,
 			Required:    true,
 			ForceNew:    true,
@@ -27,52 +29,71 @@ func transformTransformationResource() *schema.Resource {
 				return strings.Trim(v.(string), "/")
 			},
 		},
-		"allowed_roles": {
+		consts.FieldAllowedRoles: {
 			Type:        schema.TypeList,
 			Elem:        &schema.Schema{Type: schema.TypeString},
 			Optional:    true,
 			Description: `The set of roles allowed to perform this transformation.`,
 		},
-		"masking_character": {
+		consts.FieldMaskingCharacter: {
 			Type:        schema.TypeString,
 			Optional:    true,
 			Description: `The character used to replace data when in masking mode`,
 		},
-		"name": {
+		consts.FieldName: {
 			Type:        schema.TypeString,
 			Required:    true,
 			Description: `The name of the transformation.`,
 			ForceNew:    true,
 		},
-		"template": {
+		consts.FieldTemplate: {
 			Type:        schema.TypeString,
 			Optional:    true,
 			Description: `The name of the template to use.`,
 		},
-		"templates": {
+		consts.FieldTemplates: {
 			Type:        schema.TypeList,
 			Elem:        &schema.Schema{Type: schema.TypeString},
 			Optional:    true,
 			Computed:    true,
 			Description: `Templates configured for transformation.`,
 		},
-		"tweak_source": {
+		consts.FieldTweakSource: {
 			Type:        schema.TypeString,
 			Optional:    true,
 			Description: `The source of where the tweak value comes from. Only valid when in FPE mode.`,
 		},
-		"type": {
+		consts.FieldType: {
 			Type:        schema.TypeString,
 			Optional:    true,
 			Description: `The type of transformation to perform.`,
 		},
-		"deletion_allowed": {
+		consts.FieldDeletionAllowed: {
 			Type:     schema.TypeBool,
 			Optional: true,
 			Default:  false,
 			Description: `If true, this transform can be deleted. ` +
 				`Otherwise deletion is blocked while this value remains false.`,
 		},
+		consts.FieldMappingMode: {
+			Type:        schema.TypeString,
+			Optional:    true,
+			ForceNew:    true,
+			Description: `Specifies the mapping mode for stored values. Only used when type is "tokenization". Cannot be changed after creation.`,
+		},
+		consts.FieldStores: {
+			Type:        schema.TypeList,
+			Elem:        &schema.Schema{Type: schema.TypeString},
+			Optional:    true,
+			ForceNew:    true,
+			Description: `List of stores to use for tokenization state. Only used when type is "tokenization". Cannot be changed after creation.`,
+		},
+		consts.FieldConvergent: {
+			Type:        schema.TypeBool,
+			Optional:    true,
+			ForceNew:    true,
+			Description: `If true, multiple transformations of the same plaintext will produce the same ciphertext. Only used when type is "tokenization". Cannot be changed after creation.`,
+		},
 	}
 	return &schema.Resource{
 		Create: createTransformTransformationResource,
@@ -81,7 +102,7 @@ func transformTransformationResource() *schema.Resource {
 		Exists: resourceTransformTransformationExists,
 		Delete: deleteTransformTransformationResource,
 		Importer: &schema.ResourceImporter{
-			State: schema.ImportStatePassthrough,
+			StateContext: schema.ImportStatePassthroughContext,
 		},
 		Schema: fields,
 	}
@@ -93,30 +114,40 @@ func createTransformTransformationResource(d *schema.ResourceData, meta interfac
 		return e
 	}
 
-	path := d.Get("path").(string)
+	path := d.Get(consts.FieldPath).(string)
 	vaultPath := util.ParsePath(path, transformTransformationEndpoint, d)
 	log.Printf("[DEBUG] Creating %q", vaultPath)
 
 	data := map[string]interface{}{}
-	if v, ok := d.GetOkExists("allowed_roles"); ok {
-		data["allowed_roles"] = v
+	if v, ok := d.GetOkExists(consts.FieldAllowedRoles); ok {
+		data[consts.FieldAllowedRoles] = v
 	}
-	if v, ok := d.GetOkExists("masking_character"); ok {
-		data["masking_character"] = v
+	if v, ok := d.GetOkExists(consts.FieldMaskingCharacter); ok {
+		data[consts.FieldMaskingCharacter] = v
 	}
-	data["name"] = d.Get("name")
-	if v, ok := d.GetOkExists("template"); ok {
-		data["template"] = v
+	data[consts.FieldName] = d.Get(consts.FieldName)
+	if v, ok := d.GetOkExists(consts.FieldTemplate); ok {
+		data[consts.FieldTemplate] = v
 	}
-	if v, ok := d.GetOkExists("tweak_source"); ok {
-		data["tweak_source"] = v
+	if v, ok := d.GetOkExists(consts.FieldTweakSource); ok {
+		data[consts.FieldTweakSource] = v
 	}
-	if v, ok := d.GetOkExists("type"); ok {
-		data["type"] = v
+	if v, ok := d.GetOkExists(consts.FieldType); ok {
+		data[consts.FieldType] = v
 	}
 
 	if provider.IsAPISupported(meta, provider.VaultVersion112) {
-		data["deletion_allowed"] = d.Get("deletion_allowed")
+		data[consts.FieldDeletionAllowed] = d.Get(consts.FieldDeletionAllowed)
+	}
+
+	if v, ok := d.GetOk(consts.FieldMappingMode); ok {
+		data[consts.FieldMappingMode] = v
+	}
+	if v, ok := d.GetOk(consts.FieldStores); ok {
+		data[consts.FieldStores] = v
+	}
+	if raw, _ := d.GetRawConfigAt(cty.GetAttrPath(consts.FieldConvergent)); !raw.IsNull() {
+		data[consts.FieldConvergent] = d.Get(consts.FieldConvergent)
 	}
 
 	log.Printf("[DEBUG] Writing %q", vaultPath)
@@ -156,39 +187,54 @@ func readTransformTransformationResource(d *schema.ResourceData, meta interface{
 			return fmt.Errorf("error setting state %q, %q: %s", paramName, paramVal, err)
 		}
 	}
-	if val, ok := resp.Data["allowed_roles"]; ok {
-		if err := d.Set("allowed_roles", val); err != nil {
-			return fmt.Errorf("error setting state key 'allowed_roles': %s", err)
+	if val, ok := resp.Data[consts.FieldAllowedRoles]; ok {
+		if err := d.Set(consts.FieldAllowedRoles, val); err != nil {
+			return fmt.Errorf("error setting state key %q: %s", consts.FieldAllowedRoles, err)
 		}
 	}
-	if val, ok := resp.Data["masking_character"]; ok {
-		if err := d.Set("masking_character", val); err != nil {
-			return fmt.Errorf("error setting state key 'masking_character': %s", err)
+	if val, ok := resp.Data[consts.FieldMaskingCharacter]; ok {
+		if err := d.Set(consts.FieldMaskingCharacter, val); err != nil {
+			return fmt.Errorf("error setting state key %q: %s", consts.FieldMaskingCharacter, err)
 		}
 	}
-	if val, ok := resp.Data["template"]; ok {
-		if err := d.Set("template", val); err != nil {
-			return fmt.Errorf("error setting state key 'template': %s", err)
+	if val, ok := resp.Data[consts.FieldTemplate]; ok {
+		if err := d.Set(consts.FieldTemplate, val); err != nil {
+			return fmt.Errorf("error setting state key %q: %s", consts.FieldTemplate, err)
 		}
 	}
-	if val, ok := resp.Data["templates"]; ok {
-		if err := d.Set("templates", val); err != nil {
-			return fmt.Errorf("error setting state key 'templates': %s", err)
+	if val, ok := resp.Data[consts.FieldTemplates]; ok {
+		if err := d.Set(consts.FieldTemplates, val); err != nil {
+			return fmt.Errorf("error setting state key %q: %s", consts.FieldTemplates, err)
 		}
 	}
-	if val, ok := resp.Data["tweak_source"]; ok {
-		if err := d.Set("tweak_source", val); err != nil {
-			return fmt.Errorf("error setting state key 'tweak_source': %s", err)
+	if val, ok := resp.Data[consts.FieldTweakSource]; ok {
+		if err := d.Set(consts.FieldTweakSource, val); err != nil {
+			return fmt.Errorf("error setting state key %q: %s", consts.FieldTweakSource, err)
 		}
 	}
-	if val, ok := resp.Data["type"]; ok {
-		if err := d.Set("type", val); err != nil {
-			return fmt.Errorf("error setting state key 'type': %s", err)
+	if val, ok := resp.Data[consts.FieldType]; ok {
+		if err := d.Set(consts.FieldType, val); err != nil {
+			return fmt.Errorf("error setting state key %q: %s", consts.FieldType, err)
 		}
 	}
 	if provider.IsAPISupported(meta, provider.VaultVersion112) {
-		if err := d.Set("deletion_allowed", resp.Data["deletion_allowed"]); err != nil {
-			return fmt.Errorf("error setting state key 'deletion_allowed': %s", err)
+		if err := d.Set(consts.FieldDeletionAllowed, resp.Data[consts.FieldDeletionAllowed]); err != nil {
+			return fmt.Errorf("error setting state key %q: %s", consts.FieldDeletionAllowed, err)
+		}
+	}
+	if val, ok := resp.Data[consts.FieldMappingMode]; ok {
+		if err := d.Set(consts.FieldMappingMode, val); err != nil {
+			return fmt.Errorf("error setting state key %q: %s", consts.FieldMappingMode, err)
+		}
+	}
+	if val, ok := resp.Data[consts.FieldStores]; ok {
+		if err := d.Set(consts.FieldStores, val); err != nil {
+			return fmt.Errorf("error setting state key %q: %s", consts.FieldStores, err)
+		}
+	}
+	if val, ok := resp.Data[consts.FieldConvergent]; ok {
+		if err := d.Set(consts.FieldConvergent, val); err != nil {
+			return fmt.Errorf("error setting state key %q: %s", consts.FieldConvergent, err)
 		}
 	}
 	return nil
@@ -204,24 +250,24 @@ func updateTransformTransformationResource(d *schema.ResourceData, meta interfac
 	log.Printf("[DEBUG] Updating %q", vaultPath)
 
 	data := map[string]interface{}{}
-	if raw, ok := d.GetOk("allowed_roles"); ok {
-		data["allowed_roles"] = raw
+	if raw, ok := d.GetOk(consts.FieldAllowedRoles); ok {
+		data[consts.FieldAllowedRoles] = raw
 	}
-	if raw, ok := d.GetOk("masking_character"); ok {
-		data["masking_character"] = raw
+	if raw, ok := d.GetOk(consts.FieldMaskingCharacter); ok {
+		data[consts.FieldMaskingCharacter] = raw
 	}
-	if raw, ok := d.GetOk("template"); ok {
-		data["template"] = raw
+	if raw, ok := d.GetOk(consts.FieldTemplate); ok {
+		data[consts.FieldTemplate] = raw
 	}
-	if raw, ok := d.GetOk("tweak_source"); ok {
-		data["tweak_source"] = raw
+	if raw, ok := d.GetOk(consts.FieldTweakSource); ok {
+		data[consts.FieldTweakSource] = raw
 	}
-	if raw, ok := d.GetOk("type"); ok {
-		data["type"] = raw
+	if raw, ok := d.GetOk(consts.FieldType); ok {
+		data[consts.FieldType] = raw
 	}
 
 	if provider.IsAPISupported(meta, provider.VaultVersion112) {
-		data["deletion_allowed"] = d.Get("deletion_allowed")
+		data[consts.FieldDeletionAllowed] = d.Get(consts.FieldDeletionAllowed)
 	}
 
 	if _, err := client.Logical().Write(vaultPath, data); err != nil {