feat: initial version of mapper

2026-01-29 14:47:25 +01:00
560 changed files with 56540 additions and 56928 deletions
--- a/.copywrite.hcl
+++ b/.copywrite.hcl
@ -0,0 +1,24 @@
+# NOTE: This file is for HashiCorp specific licensing automation and can be deleted after creating a new repo with this template.
+schema_version = 1
+
+project {
+  license        = "Apache-2.0"
+  copyright_year = 2025
+
+  header_ignore = [
+    # internal catalog metadata (prose)
+    "META.d/**/*.yaml",
+
+    # examples used within documentation (prose)
+    "examples/**",
+
+    # GitHub issue template configuration
+    ".github/ISSUE_TEMPLATE/*.yml",
+
+    # golangci-lint tooling configuration
+    ".golangci.yml",
+
+    # GoReleaser tooling configuration
+    ".goreleaser.yml",
+  ]
+}
--- a/.github/actions/acc_test/README.md
+++ b/.github/actions/acc_test/README.md
@ -1 +0,0 @@
-# acceptance test action
--- a/.github/actions/acc_test/action.yaml
+++ b/.github/actions/acc_test/action.yaml
@ -1,285 +0,0 @@
-name: Acceptance Testing
-description: "Acceptance Testing pipeline"
-
-inputs:
-  tf_debug:
-    description: "enable terraform debug logs"
-    default: 'false'
-    required: true
-
-  test_timeout_string:
-    description: "string that determines the timeout (default: 45m)"
-    default: '90m'
-    required: true
-
-  go-version:
-    description: "go version to install"
-    default: '1.25'
-    required: true
-
-  project_id:
-    description: "STACKIT project ID for tests"
-    required: true
-
-  project_user_email:
-    required: true
-    description: "project user email for acc testing"
-
-  tf_acc_kek_key_id:
-    description: "KEK key ID"
-    required: true
-
-  tf_acc_kek_key_ring_id:
-    description: "KEK key ring ID"
-    required: true
-
-  tf_acc_kek_key_version:
-    description: "KEK key version"
-    required: true
-
-  tf_acc_kek_service_account:
-    description: "KEK service account email"
-    required: true
-
-  region:
-    description: "STACKIT region for tests"
-    default: 'eu01'
-    required: true
-
-  service_account_json_content:
-    description: "STACKIT service account JSON file contents"
-    required: true
-    default: ""
-
-  service_account_json_content_b64:
-    description: "STACKIT service account JSON file contents"
-    required: true
-    default: ""
-
-  service_account_json_file_path:
-    description: "STACKIT service account JSON file contents"
-    required: true
-    default: 'service_account.json'
-
-  test_file:
-    description: "testfile to run"
-    default: ''
-
-
-#outputs:
-#  random-number:
-#    description: "Random number"
-#    value: ${{ steps.random-number-generator.outputs.random-number }}
-
-runs:
-  using: "composite"
-  steps:
-#    - name: Random Number Generator
-#      id: random-number-generator
-#      run: echo "random-number=$(echo $RANDOM)" >> $GITHUB_OUTPUT
-#      shell: bash
-
-    - name: Install needed tools
-      shell: bash
-      run: |
-        echo "::group::apt install"
-        set -e
-        apt-get -y -qq update >apt_update.log 2>apt_update_err.log
-        if [ $? -ne 0 ]; then
-          cat apt_update.log apt_update_err.log
-        fi
-        apt-get -y -qq install jq python3 python3-pip python-is-python3 s3cmd git make wget >apt_get.log 2>apt_get_err.log
-        if [ $? -ne 0 ]; then
-          cat apt_get.log apt_get_err.log
-        fi
-        echo "::endgroup::"
-
-    - name: Setup JAVA
-      uses: actions/setup-java@v5
-      with:
-        distribution: 'temurin' # See 'Supported distributions' for available options
-        java-version: '21'
-
-    - name: Install Go ${{ inputs.go-version }}
-      uses: actions/setup-go@v6
-      with:
-        # go-version: ${{ inputs.go-version }}
-        check-latest: true
-        go-version-file: 'go.mod'
-
-    - name: Determine GOMODCACHE
-      shell: bash
-      id: goenv
-      run: |
-        set -e
-        echo "gomodcache=$(go env GOMODCACHE)" >> "$GITHUB_OUTPUT"
-
-    - name: Restore cached GO pkg
-      id: cache-gopkg
-      uses: actions/cache/restore@v5
-      with:
-        path: "${{ steps.goenv.outputs.gomodcache }}"
-        key: ${{ runner.os }}-gopkg
-
-    - name: Install go tools
-      if: steps.cache-gopkg.outputs.cache-hit != 'true'
-      shell: bash
-      run: |
-        echo "::group::go install"
-        set -e
-        go mod download
-        go install golang.org/x/tools/cmd/goimports@latest
-        go install github.com/hashicorp/terraform-plugin-codegen-framework/cmd/tfplugingen-framework@latest
-        go install github.com/hashicorp/terraform-plugin-codegen-openapi/cmd/tfplugingen-openapi@latest
-        go install github.com/hashicorp/terraform-plugin-docs/cmd/tfplugindocs@latest
-        go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
-        echo "::endgroup::"
-    - name: Run go mod tidy
-      shell: bash
-      run: go mod tidy
-
-    - name: Save GO package Cache
-      id: cache-gopkg-save
-      uses: actions/cache/save@v5
-      with:
-        path: |
-          ${{ steps.goenv.outputs.gomodcache }}
-        key: ${{ runner.os }}-gopkg
-
-    - name: Define service account file path variable
-      id: service_account
-      shell: bash
-      run: |
-        echo "safilepath=${PWD}/stackit/${{ inputs.service_account_json_file_path }}" >> "$GITHUB_OUTPUT"
-
-    - name: Creating service_account file from json input
-      if: inputs.service_account_json_content != ''
-      shell: bash
-      run: |
-        echo "::group::create service account file"
-        set -e
-        set -o pipefail
-
-        jsonFile="${{ inputs.service_account_json_file_path }}"
-        jsonFile="${jsonFile:-x}"
-        if [ "${jsonFile}" == "x" ]; then
-          echo "no service account file path provided"
-          exit 1
-        fi
-        
-        if [ ! -f "${jsonFile}" ]; then
-          echo "creating service account file '${{ inputs.service_account_json_file_path }}'"
-          echo "${{ inputs.service_account_json_content }}" > stackit/"${{ inputs.service_account_json_file_path }}"
-        fi
-        ls -l stackit/"${{ inputs.service_account_json_file_path }}"
-        echo "::endgroup::"
-
-    - name: Creating service_account file from base64 json input
-      if: inputs.service_account_json_content_b64 != ''
-      shell: bash
-      run: |
-        echo "::group::create service account file"
-        set -e
-        set -o pipefail
-
-        jsonFile="${{ inputs.service_account_json_file_path }}"
-        jsonFile="${jsonFile:-x}"
-        if [ "${jsonFile}" == "x" ]; then
-          echo "no service account file path provided"
-          exit 1
-        fi
-        
-        if [ ! -f "${jsonFile}" ]; then
-          echo "creating service account file '${{ inputs.service_account_json_file_path }}'"
-          echo "${{ inputs.service_account_json_content_b64 }}" | base64 -d > stackit/"${{ inputs.service_account_json_file_path }}"
-        fi
-        ls -l stackit/"${{ inputs.service_account_json_file_path }}"
-        echo "::endgroup::"
-
-    - name: Run acceptance test file
-      if: ${{ inputs.test_file != '' }}
-      shell: bash
-      run: |
-        echo "::group::go test file"
-        set -e 
-        set -o pipefail
-        
-        if [[ "${{ inputs.tf_debug }}" == "true" ]]; then
-          TF_LOG=INFO
-          export TF_LOG
-        fi
-
-        echo "Running acceptance tests for the terraform provider"
-        cd stackit || exit 1
-        TF_ACC=1 \
-        TF_ACC_PROJECT_ID=${TF_ACC_PROJECT_ID} \
-        TF_ACC_REGION=${TF_ACC_REGION} \
-        TF_ACC_TEST_PROJECT_USER_EMAIL=${TF_ACC_TEST_PROJECT_USER_EMAIL} \
-        TF_ACC_SERVICE_ACCOUNT_FILE="${PWD}/${{ inputs.service_account_json_file_path }}" \
-        TF_ACC_KEK_KEY_ID=${TF_ACC_KEK_KEY_ID} \
-        TF_ACC_KEK_KEY_RING_ID=${TF_ACC_KEK_KEY_RING_ID} \
-        TF_ACC_KEK_KEY_VERSION=${TF_ACC_KEK_KEY_VERSION} \
-        TF_ACC_KEK_SERVICE_ACCOUNT=${TF_ACC_KEK_SERVICE_ACCOUNT} \
-        go test -v ${{ inputs.test_file }} -timeout=${{ inputs.test_timeout_string }}
-        echo "::endgroup::"
-      env:
-        TF_ACC_PROJECT_ID: ${{ inputs.project_id }}
-        TF_ACC_REGION: ${{ inputs.region }}
-        TF_ACC_TEST_PROJECT_USER_EMAIL: ${{ inputs.project_user_email }}
-        TF_ACC_KEK_KEY_ID: ${{ inputs.tf_acc_kek_key_id }}
-        TF_ACC_KEK_KEY_RING_ID: ${{ inputs.tf_acc_kek_key_ring_id }}
-        TF_ACC_KEK_KEY_VERSION: ${{ inputs.tf_acc_kek_key_version }}
-        TF_ACC_KEK_SERVICE_ACCOUNT: ${{ inputs.tf_acc_kek_service_account }}
-
-# does not work correctly
-#    - name: Run test action
-#      if: ${{ inputs.test_file == '' }}
-#      env:
-#        TF_ACC: 1
-#        TF_ACC_PROJECT_ID: ${{ inputs.project_id }}
-#        TF_ACC_REGION: ${{ inputs.region }}
-#        TF_ACC_TEST_PROJECT_USER_EMAIL: ${{ inputs.project_user_email }}
-#        TF_ACC_KEK_KEY_ID: ${{ inputs.tf_acc_kek_key_id }}
-#        TF_ACC_KEK_KEY_RING_ID: ${{ inputs.tf_acc_kek_key_ring_id }}
-#        TF_ACC_KEK_KEY_VERSION: ${{ inputs.tf_acc_kek_key_version }}
-#        TF_ACC_KEK_SERVICE_ACCOUNT: ${{ inputs.tf_acc_kek_service_account }}
-#        TF_ACC_SERVICE_ACCOUNT_FILE: ${{ steps.service_account.outputs.safile }}
-#      uses: robherley/go-test-action@v0
-#      with:
-#        testArguments: "./... -timeout ${{ inputs.test_timeout_string }}"
-#        moduleDirectory: "stackit"
-
-    - name: Run acceptance tests
-      if: ${{ inputs.test_file == '' }}
-      shell: bash
-      run: |
-        echo "::group::go test all"
-        set -e
-        set -o pipefail
-
-        if [[ "${{ inputs.tf_debug }}" == "true" ]]; then
-          TF_LOG=INFO
-          export TF_LOG
-        fi
-
-        echo "Running acceptance tests for the terraform provider"
-        cd stackit || exit 1
-        TF_ACC=1 \
-        TF_ACC_PROJECT_ID=${TF_ACC_PROJECT_ID} \
-        TF_ACC_REGION=${TF_ACC_REGION} \
-        TF_ACC_TEST_PROJECT_USER_EMAIL=${TF_ACC_TEST_PROJECT_USER_EMAIL} \
-        TF_ACC_SERVICE_ACCOUNT_FILE="${PWD}/${{ inputs.service_account_json_file_path }}" \
-        TF_ACC_KEK_KEY_ID=${TF_ACC_KEK_KEY_ID} \
-        TF_ACC_KEK_KEY_RING_ID=${TF_ACC_KEK_KEY_RING_ID} \
-        TF_ACC_KEK_KEY_VERSION=${TF_ACC_KEK_KEY_VERSION} \
-        TF_ACC_KEK_SERVICE_ACCOUNT=${TF_ACC_KEK_SERVICE_ACCOUNT} \
-        go test -v ./... -timeout=${{ inputs.test_timeout_string }}
-        echo "::endgroup::"
-      env:
-        TF_ACC_PROJECT_ID: ${{ inputs.project_id }}
-        TF_ACC_REGION: ${{ inputs.region }}
-        TF_ACC_TEST_PROJECT_USER_EMAIL: ${{ inputs.project_user_email }}
-        TF_ACC_KEK_KEY_ID: ${{ inputs.tf_acc_kek_key_id }}
-        TF_ACC_KEK_KEY_RING_ID: ${{ inputs.tf_acc_kek_key_ring_id }}
-        TF_ACC_KEK_KEY_VERSION: ${{ inputs.tf_acc_kek_key_version }}
-        TF_ACC_KEK_SERVICE_ACCOUNT: ${{ inputs.tf_acc_kek_service_account }}
--- a/.github/actions/build/action.yaml
+++ b/.github/actions/build/action.yaml
@ -3,89 +3,14 @@ description: "Build pipeline"
 inputs:
  go-version:
    description: "Go version to install"
-    default: '1.25'
    required: true
-  java-distribution:
-    description: "JAVA distribution to use (default: temurin)"
-    default: 'temurin'
-  java-version:
-    description: "JAVA version to use (default: 21)"
-    default: '21'
-
 runs:
  using: "composite"
  steps:
-    - name: Install needed tools
-      shell: bash
-      run: |
-        set -e
-        apt-get -y -qq update
-        apt-get -y -qq install jq python3 python3-pip python-is-python3 s3cmd git make wget unzip bc
-
-    - name: Checkout
-      uses: actions/checkout@v6
-
    - name: Install Go ${{ inputs.go-version }}
-      uses: actions/setup-go@v6
+      uses: actions/setup-go@v5
      with:
-        # go-version: ${{ inputs.go-version }}
-        check-latest: true
-        go-version-file: 'go.mod'
-
-    - name: Determine GOMODCACHE
+        go-version: ${{ inputs.go-version }}
+    - name: Install project tools and dependencies
      shell: bash
-      id: goenv
-      run: |
-        set -e
-        # echo "::set-output name=gomodcache::$(go env GOMODCACHE)"
-        echo "gomodcache=$(go env GOMODCACHE)" >> "$GITHUB_OUTPUT"
-
-    - name: Restore cached GO pkg
-      id: cache-gopkg
-      uses: actions/cache/restore@v5
-      with:
-        path: "${{ steps.goenv.outputs.gomodcache }}"
-        key: ${{ runner.os }}-gopkg
-
-    - name: Install go tools
-      if: steps.cache-gopkg.outputs.cache-hit != 'true'
-      shell: bash
-      run: |
-        set -e
-        go install golang.org/x/tools/cmd/goimports@latest
-        go install github.com/hashicorp/terraform-plugin-codegen-framework/cmd/tfplugingen-framework@latest
-        go install github.com/hashicorp/terraform-plugin-codegen-openapi/cmd/tfplugingen-openapi@latest
-        go install github.com/hashicorp/terraform-plugin-docs/cmd/tfplugindocs@latest
-
-#    - name: Run build pkg directory
-#      shell: bash
-#      run: |
-#        set -e
-#        go run generator/main.go build
-
-    - name: Get all go packages
-      if: steps.cache-gopkg.outputs.cache-hit != 'true'
-      shell: bash
-      run: |
-        set -e
-        go get ./...
-
-    - name: Save Cache
-      id: cache-gopkg-save
-      uses: actions/cache/save@v5
-      with:
-        path: |
-          ${{ steps.goenv.outputs.gomodcache }}
-        key: ${{ runner.os }}-gopkg
-
-    - name: Setup JAVA ${{ inputs.java-distribution }} ${{ inputs.go-version }}
-      uses: actions/setup-java@v5
-      with:
-        distribution: ${{ inputs.java-distribution }} # See 'Supported distributions' for available options
-        java-version: ${{ inputs.java-version }}
-
-    - name: Run make to build app
-      shell: bash
-      run: |
-        set -e
-        make build
+      run: make project-tools
--- a/.github/actions/clean_up/README.md
+++ b/.github/actions/clean_up/README.md
@ -1 +0,0 @@
-# acceptance test action
--- a/.github/actions/clean_up/action.yaml
+++ b/.github/actions/clean_up/action.yaml
@ -1,168 +0,0 @@
-name: CleanUp Project Resources
-description: "Acceptance Testing CleanUp"
-
-inputs:
-  project_id:
-    description: "STACKIT project ID for tests"
-    required: true
-
-  region:
-    description: "STACKIT region for tests"
-    default: 'eu01'
-    required: true
-
-  tf_resource_prefix:
-    description: "prefix in resource names"
-    default: 'tf-acc-'
-    required: true
-
-  service_account_json_content:
-    description: "STACKIT service account JSON file contents"
-    required: true
-    default: ''
-
-  service_account_json_content_b64:
-    description: "STACKIT service account JSON file contents"
-    required: true
-    default: ''
-
-  list_only:
-    description: "only list resources, DO NOT delete"
-    required: true
-    default: 'true'
-
-  log_level:
-    description: "Log Level"
-    required: true
-    default: 'warning'
-
-outputs:
-  cli-version:
-    description: "stackit cli version"
-    value: ${{ steps.stackit_version.outputs.version }}
-
-runs:
-  using: "composite"
-  steps:
-    - name: Install needed tools
-      shell: bash
-      run: |
-        echo "::group::apt install"
-        set -e
-        apt-get -y -qq update >apt_update.log 2>apt_update_err.log
-        if [ $? -ne 0 ]; then
-          cat apt_update.log apt_update_err.log
-        fi
-        apt-get -y -qq install curl gnupg jq >apt_get.log 2>apt_get_err.log
-        if [ $? -ne 0 ]; then
-          cat apt_get.log apt_get_err.log
-        fi
-        echo "::endgroup::"
-
-        echo "::group::apt add source"
-        curl https://packages.stackit.cloud/keys/key.gpg | gpg --dearmor -o /usr/share/keyrings/stackit.gpg
-        echo "deb [signed-by=/usr/share/keyrings/stackit.gpg] https://packages.stackit.cloud/apt/cli stackit main" | tee -a /etc/apt/sources.list.d/stackit.list
-        echo "::endgroup::"
-
-        echo "::group::apt install stackit cli"
-        apt-get -y -qq update >apt_update.log 2>apt_update_err.log
-        if [ $? -ne 0 ]; then
-          cat apt_update.log apt_update_err.log
-        fi
-        apt-get -y -qq install stackit >apt_get.log 2>apt_get_err.log
-        if [ $? -ne 0 ]; then
-          cat apt_get.log apt_get_err.log
-        fi        
-        echo "::endgroup::"
-
-    - name: Check stackit cli version
-      id: stackit_version
-      run: |
-        set -e
-        VERSION=$(stackit --version | grep "Version:" | cut -d " " -f 2)
-        echo "stackit cli version: ${VERSION}"
-        echo "version=${VERSION}" >> $GITHUB_OUTPUT
-      shell: bash
-
-    - name: Creating service_account file from json input
-      if: inputs.service_account_json_content != ''
-      shell: bash
-      run: |
-        echo "::group::create service account file"
-        set -e
-        set -o pipefail
-
-        echo "${{ inputs.service_account_json_content }}" > .svc_acc.json
-        echo "::endgroup::"
-
-    - name: Creating service_account file from base64 json input
-      if: inputs.service_account_json_content_b64 != ''
-      shell: bash
-      run: |
-        echo "::group::create service account file"
-        set -e
-        set -o pipefail
-
-        echo "${{ inputs.service_account_json_content_b64 }}" | base64 -d > .svc_acc.json 
-        echo "::endgroup::"
-
-    - name: Check service account file exists
-      shell: bash
-      run: |
-        set -e
-        if [[ ! -s .svc_acc.json ]]; then
-          echo "ERROR: service account file missing or empty"
-          exit 1
-        fi
-
-    - name: Retrieve resources
-      run: |
-        echo "::group::retrieve resources"
-        set -e
-        echo "authenticating api"
-        STACKIT_SERVICE_ACCOUNT_KEY_PATH="${PWD}/.svc_acc.json"
-        export STACKIT_SERVICE_ACCOUNT_KEY_PATH
-        stackit auth activate-service-account --service-account-key-path .svc_acc.json
-
-        echo "SQL Server Flex resources:"
-        stackit --verbosity ${{ inputs.log_level }} --project-id "${{ inputs.project_id }}" beta sqlserverflex instance list --output-format json | jq -r '.[] | select(.name | startswith("${{ inputs.tf_resource_prefix }}"))'
-
-        echo "PostgreSQL Flex resources:"
-        stackit --verbosity ${{ inputs.log_level }} --project-id "${{ inputs.project_id }}" postgresflex instance list --output-format json | jq -r '.[] | select(.name | startswith("${{ inputs.tf_resource_prefix }}"))'
-
-        echo "::endgroup::"
-      shell: bash
-
-    - name: Delete SQL Server Flex resources
-      if: ${{ inputs.list_only != 'true' }}
-      run: |
-        echo "::group::delete SQL Server Flex resources"
-        set -e
-        stackit --verbosity ${{ inputs.log_level }} auth activate-service-account --service-account-key-path .svc_acc.json
-        for s in $(stackit --verbosity ${{ inputs.log_level }} --project-id ${{ inputs.project_id }} beta sqlserverflex instance list --output-format json | jq -r '.[] | select(.name | startswith("${{ inputs.tf_resource_prefix }}")) | .id'); do stackit --verbosity ${{ inputs.log_level }} -y --project-id ${{ inputs.project_id }} beta sqlserverflex instance delete $s; done
-        echo "::endgroup::"
-      shell: bash
-
-    - name: Skip Delete SQL Server Flex resources
-      if: ${{ inputs.list_only == 'true' }}
-      run: |
-        set -e
-        echo "Skip deleting: list only mode"
-      shell: bash
-
-    - name: Delete PostgreSQL Flex resources
-      if: ${{ inputs.list_only != 'true' }}
-      run: |
-        echo "::group::delete PostgreSQL Flex resources"
-        set -e
-        stackit auth activate-service-account --service-account-key-path .svc_acc.json
-        for s in $(stackit --verbosity ${{ inputs.log_level }} --project-id ${{ inputs.project_id }} postgresflex instance list --output-format json | jq -r '.[] | select(.name | startswith("${{ inputs.tf_resource_prefix }}")) | .id'); do stackit --verbosity ${{ inputs.log_level }} -y --project-id ${{ inputs.project_id }} postgresflex instance delete $s; done
-        echo "::endgroup::"
-      shell: bash
-
-    - name: Skip Delete PostgreSQL Flex resources
-      if: ${{ inputs.list_only == 'true' }}
-      run: |
-        set -e
-        echo "Skip deleting: list only mode"
-      shell: bash
--- a/.github/actions/setup-cache-go/action.yaml
+++ b/.github/actions/setup-cache-go/action.yaml
@ -1,71 +0,0 @@
-name: 'Setup Go and cache dependencies'
-author: 'Forgejo authors, Marcel S. Henselin'
-description: |
-  Wrap the setup-go with improved dependency caching.
-
-inputs:
-  username:
-    description: 'User for which to manage the dependency cache'
-    default: root
-
-  go-version:
-    description: "go version to install"
-    default: '1.25'
-    required: true
-
-runs:
-  using: "composite"
-  steps:
-    - name: "Install zstd for faster caching"
-      shell: bash
-      run: |
-        apt-get update -qq
-        apt-get -q install -qq -y zstd
-
-    - name: "Set up Go using setup-go"
-      uses: https://code.forgejo.org/actions/setup-go@v6
-      id: go-version
-      with:
-        # go-version: ${{ inputs.go-version }}
-        check-latest: true # Always check for the latest patch release
-        go-version-file: "go.mod"
-        # do not cache dependencies, we do this manually
-        cache: false
-
-    - name: "Get go environment information"
-      shell: bash
-      id: go-environment
-      run: |
-        chmod 755 $HOME # ensure ${RUN_AS_USER} has permission when go is located in $HOME
-        export GOROOT="$(go env GOROOT)"
-        echo "modcache=$(su ${RUN_AS_USER} -c '${GOROOT}/bin/go env GOMODCACHE')" >> "$GITHUB_OUTPUT"
-        echo "cache=$(su ${RUN_AS_USER} -c '${GOROOT}/bin/go env GOCACHE')" >> "$GITHUB_OUTPUT"
-      env:
-        RUN_AS_USER: ${{ inputs.username }}
-        GO_VERSION: ${{ steps.go-version.outputs.go-version }}
-
-    - name: "Create cache folders with correct permissions (for non-root users)"
-      shell: bash
-      if: inputs.username != 'root'
-      # when the cache is restored, only the permissions of the last part are restored
-      # so assuming that /home/user exists and we are restoring /home/user/go/pkg/mod,
-      # both folders will have the correct permissions, but
-      # /home/user/go and /home/user/go/pkg might be owned by root
-      run: |
-        su ${RUN_AS_USER} -c 'mkdir -p "${MODCACHE_DIR}" "${CACHE_DIR}"'
-      env:
-        RUN_AS_USER: ${{ inputs.username }}
-        MODCACHE_DIR: ${{ steps.go-environment.outputs.modcache }}
-        CACHE_DIR: ${{ steps.go-environment.outputs.cache }}
-
-    - name: "Restore Go dependencies from cache or mark for later caching"
-      id: cache-deps
-      uses: https://code.forgejo.org/actions/cache@v5
-      with:
-        key: setup-cache-go-deps-${{ runner.os }}-${{ inputs.username }}-${{ steps.go-version.outputs.go_version }}-${{ hashFiles('go.sum', 'go.mod') }}
-        restore-keys: |
-          setup-cache-go-deps-${{ runner.os }}-${{ inputs.username }}-${{ steps.go-version.outputs.go_version }}-
-          setup-cache-go-deps-${{ runner.os }}-${{ inputs.username }}-
-        path: |
-          ${{ steps.go-environment.outputs.modcache }}
-          ${{ steps.go-environment.outputs.cache }}
--- a/.github/docs/contribution-guide/resource.go
+++ b/.github/docs/contribution-guide/resource.go
@ -14,10 +14,10 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
 	"github.com/hashicorp/terraform-plugin-framework/types"
 	"github.com/hashicorp/terraform-plugin-log/tflog"
-	"tf-provider.git.onstackit.cloud/stackit-dev-tools/terraform-provider-stackitprivatepreview/stackit/internal/conversion"
-	"tf-provider.git.onstackit.cloud/stackit-dev-tools/terraform-provider-stackitprivatepreview/stackit/internal/core"
-	fooUtils "tf-provider.git.onstackit.cloud/stackit-dev-tools/terraform-provider-stackitprivatepreview/stackit/internal/services/foo/utils"
-	"tf-provider.git.onstackit.cloud/stackit-dev-tools/terraform-provider-stackitprivatepreview/stackit/internal/utils"
+	"github.com/mhenselin/terraform-provider-stackitprivatepreview/stackit/internal/conversion"
+	"github.com/mhenselin/terraform-provider-stackitprivatepreview/stackit/internal/core"
+	fooUtils "github.com/mhenselin/terraform-provider-stackitprivatepreview/stackit/internal/services/foo/utils"
+	"github.com/mhenselin/terraform-provider-stackitprivatepreview/stackit/internal/utils"

 	"github.com/stackitcloud/stackit-sdk-go/services/foo"      // Import service "foo" from the STACKIT SDK for Go
 	"github.com/stackitcloud/stackit-sdk-go/services/foo/wait" // Import service "foo" waiters from the STACKIT SDK for Go (in case the service API has asynchronous endpoints)
--- a/.github/docs/contribution-guide/utils/util.go
+++ b/.github/docs/contribution-guide/utils/util.go
@ -7,10 +7,10 @@ import (
 	"fmt"

 	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/mhenselin/terraform-provider-stackitprivatepreview/stackit/internal/core"
+	"github.com/mhenselin/terraform-provider-stackitprivatepreview/stackit/internal/utils"
 	"github.com/stackitcloud/stackit-sdk-go/core/config"
 	"github.com/stackitcloud/stackit-sdk-go/services/foo"
-	"tf-provider.git.onstackit.cloud/stackit-dev-tools/terraform-provider-stackitprivatepreview/stackit/internal/core"
-	"tf-provider.git.onstackit.cloud/stackit-dev-tools/terraform-provider-stackitprivatepreview/stackit/internal/utils"
 )

 func ConfigureClient(ctx context.Context, providerData *core.ProviderData, diags *diag.Diagnostics) *foo.APIClient {
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@ -0,0 +1,90 @@
+name: CI Workflow
+
+on:
+  pull_request:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+
+env:
+  GO_VERSION: "1.25"
+  CODE_COVERAGE_FILE_NAME: "coverage.out" # must be the same as in Makefile
+  CODE_COVERAGE_ARTIFACT_NAME: "code-coverage"
+
+jobs:
+  main:
+    name: CI
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      
+      - name: Build
+        uses: ./.github/actions/build
+        with:
+          go-version: ${{ env.GO_VERSION }}
+      
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v2
+        with:
+          terraform_wrapper: false
+
+      - name: "Ensure docs are up-to-date"
+        if: ${{ github.event_name == 'pull_request' }}
+        run: ./scripts/check-docs.sh
+        continue-on-error: true
+
+      - name: "Run go mod tidy"
+        if: ${{ github.event_name == 'pull_request' }}
+        run: go mod tidy
+
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v9
+        with:
+          version: v2.7
+          args: --config=golang-ci.yaml --allow-parallel-runners --timeout=5m
+
+      - name: Lint
+        run: make lint
+      
+      - name: Test
+        run: make test
+
+      - name: Archive code coverage results
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ env.CODE_COVERAGE_ARTIFACT_NAME }}
+          path: "stackit/${{ env.CODE_COVERAGE_FILE_NAME }}"
+
+
+  config:
+    name: Check GoReleaser config
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Check GoReleaser
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          args: check
+
+  code_coverage:
+    name: "Code coverage report"
+    if: github.event_name == 'pull_request' # Do not run when workflow is triggered by push to main branch
+    runs-on: ubuntu-latest
+    needs: main
+    permissions:
+      contents: read
+      actions: read  # to download code coverage results from "main" job
+      pull-requests: write # write permission needed to comment on PR
+    steps:
+      - name: Check new code coverage
+        uses: fgrosse/go-coverage-report@v1.2.0
+        continue-on-error: true  # Add this line to prevent pipeline failures in forks
+        with:
+          coverage-artifact-name: ${{ env.CODE_COVERAGE_ARTIFACT_NAME }}
+          coverage-file-name: ${{ env.CODE_COVERAGE_FILE_NAME }}
+          root-package: 'github.com/stackitcloud/terraform-provider-stackit'
--- a/.github/workflows/ci.yaml.bak
+++ b/.github/workflows/ci.yaml.bak
@ -1,290 +0,0 @@
-name: CI Workflow
-
-on:
-  pull_request:
-    branches:
-      - alpha
-      - main
-  workflow_dispatch:
-  schedule:
-    # every sunday at 00:00
-    # - cron: '0 0 * * 0'
-    # every day at 00:00
-    - cron: '0 0 * * *'
-  push:
-    branches:
-      - '!main'
-      - '!alpha'
-
-env:
-  GO_VERSION: "1.25"
-  CODE_COVERAGE_FILE_NAME: "coverage.out" # must be the same as in Makefile
-  CODE_COVERAGE_ARTIFACT_NAME: "code-coverage"
-
-jobs:
-  runner_test:
-    name: "Test STACKIT runner"
-    runs-on: stackit-docker
-    steps:
-      - name: Install needed tools
-        run: |
-          apt-get -y -qq update
-          apt-get -y -qq install jq python3 python3-pip python-is-python3 s3cmd git make wget
-
-      - name: Setup Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ env.GO_VERSION }}
-
-      - name: Install go tools
-        run: |
-          go install golang.org/x/tools/cmd/goimports@latest
-          go install github.com/hashicorp/terraform-plugin-codegen-framework/cmd/tfplugingen-framework@latest
-          go install github.com/hashicorp/terraform-plugin-codegen-openapi/cmd/tfplugingen-openapi@latest
-
-      - name: Setup JAVA
-        uses: actions/setup-java@v5
-        with:
-          distribution: 'temurin' # See 'Supported distributions' for available options
-          java-version: '21'
-
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Run build pkg directory
-        run: |
-          go run cmd/main.go build
-
-  publish_test:
-    name: "Test readiness for publishing provider"
-    needs: config
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read        # Required to identify workflow run.
-      checks: write        # Required to add status summary.
-      contents: read       # Required to checkout repository.
-      pull-requests: write # Required to add PR comment.
-    steps:
-      - name: Install needed tools
-        run: |
-          apt-get -y -qq update
-          apt-get -y -qq install jq python3 python3-pip python-is-python3 s3cmd git make wget
-
-      - name: Setup Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ env.GO_VERSION }}
-
-      - name: Install go tools
-        run: |
-          go install golang.org/x/tools/cmd/goimports@latest
-          go install github.com/hashicorp/terraform-plugin-codegen-framework/cmd/tfplugingen-framework@latest
-          go install github.com/hashicorp/terraform-plugin-codegen-openapi/cmd/tfplugingen-openapi@latest
-
-      - name: Setup JAVA
-        uses: actions/setup-java@v5
-        with:
-          distribution: 'temurin' # See 'Supported distributions' for available options
-          java-version: '21'
-
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Run build pkg directory
-        run: |
-          go run cmd/main.go build
-
-      - name: Set up s3cfg
-        run: |
-          cat <<'EOF' >> ~/.s3cfg
-          [default]
-          host_base = https://object.storage.eu01.onstackit.cloud
-          host_bucket = https://%(bucket).object.storage.eu01.onstackit.cloud
-          check_ssl_certificate = False
-          access_key = ${{ secrets.S3_ACCESS_KEY }}
-          secret_key = ${{ secrets.S3_SECRET_KEY }}
-          EOF
-
-      - name: Import GPG key
-        run: |
-          echo "${{ secrets.PRIVATE_KEY_PEM }}" > ~/private.key.pem
-          gpg --import ~/private.key.pem
-          rm ~/private.key.pem
-
-      - name: Run GoReleaser with SNAPSHOT
-        id: goreleaser
-        env:
-          GITHUB_TOKEN: ${{ env.FORGEJO_TOKEN }}
-          GPG_FINGERPRINT: ${{ secrets.GPG_FINGERPRINT }}
-        uses: goreleaser/goreleaser-action@v6
-        with:
-          args: release --skip publish --clean --snapshot
-
-      - name: Prepare key file
-        run: |
-          echo "${{ secrets.PUBLIC_KEY_PEM }}" >public_key.pem
-
-      - name: Prepare provider directory structure
-        run: |
-          VERSION=$(jq -r .version < dist/metadata.json)
-          go run cmd/main.go \
-            publish \
-              --namespace=mhenselin \
-              --providerName=stackitprivatepreview \
-              --repoName=terraform-provider-stackitprivatepreview \
-              --domain=tfregistry.sysops.stackit.rocks \
-              --gpgFingerprint="${{ secrets.GPG_FINGERPRINT }}" \
-              --gpgPubKeyFile=public_key.pem \
-              --version=${VERSION}
-
-  testing:
-    name: CI run tests
-    runs-on: ubuntu-latest
-    needs: config
-    env:
-      TF_ACC_PROJECT_ID: ${{ vars.TF_ACC_PROJECT_ID }}
-      TF_ACC_REGION: ${{ vars.TF_ACC_REGION }}
-      TF_ACC_TEST_PROJECT_SERVICE_ACCOUNT_EMAIL: ${{ vars.TF_ACC_TEST_PROJECT_SERVICE_ACCOUNT_EMAIL }}
-      TF_ACC_SERVICE_ACCOUNT_FILE: "~/service_account.json"
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Build
-        uses: ./.github/actions/build
-        with:
-          go-version: ${{ env.GO_VERSION }}
-
-      - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v2
-        with:
-          terraform_wrapper: false
-
-      - name: Create service account json file
-        if: ${{ github.event_name == 'pull_request' }}
-        run: |
-          echo "${{ secrets.TF_ACC_SERVICE_ACCOUNT_JSON }}" >~/service_account.json
-
-      - name: Run go mod tidy
-        if: ${{ github.event_name == 'pull_request' }}
-        run: go mod tidy
-
-      - name: Testing
-        run: make test
-
-      - name: Acceptance Testing
-        env:
-          TF_ACC: "1"
-        if: ${{ github.event_name == 'pull_request' }}
-        run: make test-acceptance-tf
-
-      - name: Check coverage threshold
-        shell: bash
-        run: |
-          make coverage
-          COVERAGE=$(go tool cover -func=coverage.out | grep total | awk '{print $3}' | sed 's/%//')
-          echo "Coverage: $COVERAGE%"
-          if (( $(echo "$COVERAGE < 80" | bc -l) )); then
-            echo "Coverage is below 80%"
-            # exit 1
-          fi
-
-      - name: Archive code coverage results
-        uses: actions/upload-artifact@v4
-        with:
-          name: ${{ env.CODE_COVERAGE_ARTIFACT_NAME }}
-          path: "stackit/${{ env.CODE_COVERAGE_FILE_NAME }}"
-
-  main:
-    if: ${{ github.event_name != 'schedule' }}
-    name: CI run build and linting
-    runs-on: ubuntu-latest
-    needs: config
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Build
-        uses: ./.github/actions/build
-        with:
-          go-version: ${{ env.GO_VERSION }}
-
-      - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v2
-        with:
-          terraform_wrapper: false
-
-      - name: "Ensure docs are up-to-date"
-        if: ${{ github.event_name == 'pull_request' }}
-        run: ./scripts/check-docs.sh
-        continue-on-error: true
-
-      - name: "Run go mod tidy"
-        if: ${{ github.event_name == 'pull_request' }}
-        run: go mod tidy
-
-      - name: golangci-lint
-        uses: golangci/golangci-lint-action@v9
-        with:
-          version: v2.9
-          args: --config=golang-ci.yaml --allow-parallel-runners --timeout=5m
-        continue-on-error: true
-
-      - name: Linting
-        run: make lint
-        continue-on-error: true
-
-  #      - name: Testing
-  #        run: make test
-  #
-  #      - name: Acceptance Testing
-  #        if: ${{ github.event_name == 'pull_request' }}
-  #        run: make test-acceptance-tf
-  #
-  #      - name: Check coverage threshold
-  #        shell: bash
-  #        run: |
-  #          make coverage
-  #          COVERAGE=$(go tool cover -func=coverage.out | grep total | awk '{print $3}' | sed 's/%//')
-  #          echo "Coverage: $COVERAGE%"
-  #          if (( $(echo "$COVERAGE < 80" | bc -l) )); then
-  #            echo "Coverage is below 80%"
-  #            # exit 1
-  #          fi
-
-  #      - name: Archive code coverage results
-  #        uses: actions/upload-artifact@v4
-  #        with:
-  #          name: ${{ env.CODE_COVERAGE_ARTIFACT_NAME }}
-  #          path: "stackit/${{ env.CODE_COVERAGE_FILE_NAME }}"
-
-  config:
-    if: ${{ github.event_name != 'schedule' }}
-    name: Check GoReleaser config
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Check GoReleaser
-        uses: goreleaser/goreleaser-action@v6
-        with:
-          args: check
-
-  code_coverage:
-    name: "Code coverage report"
-    if: github.event_name == 'pull_request' # Do not run when workflow is triggered by push to main branch
-    runs-on: ubuntu-latest
-    needs: main
-    permissions:
-      contents: read
-      actions: read  # to download code coverage results from "main" job
-      pull-requests: write # write permission needed to comment on PR
-    steps:
-      - name: Check new code coverage
-        uses: fgrosse/go-coverage-report@v1.2.0
-        continue-on-error: true  # Add this line to prevent pipeline failures in forks
-        with:
-          coverage-artifact-name: ${{ env.CODE_COVERAGE_ARTIFACT_NAME }}
-          coverage-file-name: ${{ env.CODE_COVERAGE_FILE_NAME }}
-          root-package: 'github.com/stackitcloud/terraform-provider-stackit'
--- a/.github/workflows/ci_new.yaml
+++ b/.github/workflows/ci_new.yaml
@ -1,354 +0,0 @@
-name: CI Workflow
-
-on:
-  pull_request:
-    types: [ opened, synchronize, reopened ]
-    branches:
-      - alpha
-      - main
-  workflow_dispatch:
-  schedule:
-    # every sunday at 00:00
-    # - cron: '0 0 * * 0'
-    # every day at 00:00
-    - cron: '0 0 * * *'
-  push:
-    branches:
-      - '!main'
-      - '!alpha'
-    paths:
-      - '!.github'
-
-env:
-  GO_VERSION: "1.25"
-  CODE_COVERAGE_FILE_NAME: "coverage.out" # must be the same as in Makefile
-  CODE_COVERAGE_ARTIFACT_NAME: "code-coverage"
-
-jobs:
-  config:
-    if: ${{ github.event_name != 'schedule' }}
-    name: Check GoReleaser config
-    runs-on: stackit-docker
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Check GoReleaser
-        uses: goreleaser/goreleaser-action@v7
-        with:
-          args: check
-
-  prepare:
-    name: Prepare GO cache
-    runs-on: stackit-docker
-    permissions:
-      actions: read        # Required to identify workflow run.
-      checks: write        # Required to add status summary.
-      contents: read       # Required to checkout repository.
-      pull-requests: write # Required to add PR comment.
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Install Go ${{ inputs.go-version }}
-        id: go-install
-        uses: actions/setup-go@v6
-        with:
-          # go-version: ${{ inputs.go-version }}
-          check-latest: true
-          go-version-file: 'go.mod'
-
-      - name: Determine GOMODCACHE
-        shell: bash
-        id: goenv
-        run: |
-          set -e
-          # echo "::set-output name=gomodcache::$(go env GOMODCACHE)"
-          echo "gomodcache=$(go env GOMODCACHE)" >> "$GITHUB_OUTPUT"
-
-      - name: Restore cached GO pkg
-        id: cache-gopkg
-        uses: actions/cache/restore@v5
-        with:
-          path: "${{ steps.goenv.outputs.gomodcache }}"
-          key: ${{ runner.os }}-gopkg
-
-      - name: Install go tools
-        if: steps.cache-gopkg.outputs.cache-hit != 'true'
-        run: |
-          go install golang.org/x/tools/cmd/goimports@latest
-          go install github.com/hashicorp/terraform-plugin-codegen-framework/cmd/tfplugingen-framework@latest
-          go install github.com/hashicorp/terraform-plugin-codegen-openapi/cmd/tfplugingen-openapi@latest
-
-      - name: Get all go packages
-        if: steps.cache-gopkg.outputs.cache-hit != 'true'
-        shell: bash
-        run: |
-          set -e
-          go get ./...
-
-      - name: Save Cache
-        if: steps.cache-gopkg.outputs.cache-hit != 'true'
-        id: cache-gopkg-save
-        uses: actions/cache/save@v5
-        with:
-          path: |
-            ${{ steps.goenv.outputs.gomodcache }}
-          key: ${{ runner.os }}-gopkg
-
-
-  publish_test:
-    name: "Test readiness for publishing provider"
-    needs:
-      - config
-      - prepare
-    runs-on: stackit-docker
-    permissions:
-      actions: read        # Required to identify workflow run.
-      checks: write        # Required to add status summary.
-      contents: read       # Required to checkout repository.
-      pull-requests: write # Required to add PR comment.
-    steps:
-      - name: Install needed tools
-        run: |
-          apt-get -y -qq update
-          apt-get -y -qq install jq python3 python3-pip python-is-python3 s3cmd git make wget unzip bc
-
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Setup Go
-        uses: actions/setup-go@v6
-        with:
-          # go-version: ${{ env.GO_VERSION }}
-          check-latest: true
-          go-version-file: 'go.mod'
-
-      - name: Install go tools
-        run: |
-          go install golang.org/x/tools/cmd/goimports@latest
-          go install github.com/hashicorp/terraform-plugin-codegen-framework/cmd/tfplugingen-framework@latest
-          go install github.com/hashicorp/terraform-plugin-codegen-openapi/cmd/tfplugingen-openapi@latest
-
-      - name: Setup JAVA
-        uses: actions/setup-java@v5
-        with:
-          distribution: 'temurin' # See 'Supported distributions' for available options
-          java-version: '21'
-
-#      - name: Run build pkg directory
-#        run: |
-#          go run generator/main.go build
-
-      - name: Set up s3cfg
-        run: |
-          cat <<'EOF' >> ~/.s3cfg
-          [default]
-          host_base = https://object.storage.eu01.onstackit.cloud
-          host_bucket = https://%(bucket).object.storage.eu01.onstackit.cloud
-          check_ssl_certificate = False
-          access_key = ${{ secrets.S3_ACCESS_KEY }}
-          secret_key = ${{ secrets.S3_SECRET_KEY }}
-          EOF
-
-      - name: Import GPG key
-        run: |
-          echo "${{ secrets.PRIVATE_KEY_PEM }}" > ~/private.key.pem
-          gpg --import ~/private.key.pem
-          rm ~/private.key.pem
-
-      - name: Run GoReleaser with SNAPSHOT
-        id: goreleaser
-        env:
-          GITHUB_TOKEN: ${{ env.FORGEJO_TOKEN }}
-          GPG_FINGERPRINT: ${{ secrets.GPG_FINGERPRINT }}
-        uses: goreleaser/goreleaser-action@v7
-        with:
-          args: release --skip publish --clean --snapshot
-
-      - name: Prepare key file
-        run: |
-          echo "${{ secrets.PUBLIC_KEY_PEM }}" >public_key.pem
-
-      - name: Prepare provider directory structure
-        run: |
-          VERSION=$(jq -r .version < dist/metadata.json)
-          go run generator/main.go \
-            publish \
-              --namespace=mhenselin \
-              --providerName=stackitprivatepreview \
-              --repoName=terraform-provider-stackitprivatepreview \
-              --domain=tfregistry.sysops.stackit.rocks \
-              --gpgFingerprint="${{ secrets.GPG_FINGERPRINT }}" \
-              --gpgPubKeyFile=public_key.pem \
-              --version=${VERSION}
-
-  testing:
-    name: CI run tests
-    runs-on: stackit-docker
-    needs:
-      - config
-      - prepare
-    env:
-      TF_ACC_PROJECT_ID: ${{ vars.TF_ACC_PROJECT_ID }}
-      TF_ACC_ORGANIZATION_ID: ${{ vars.TF_ACC_ORGANIZATION_ID }}
-      TF_ACC_REGION: ${{ vars.TF_ACC_REGION }}
-      TF_ACC_TEST_PROJECT_SERVICE_ACCOUNT_EMAIL: ${{ vars.TF_ACC_TEST_PROJECT_SERVICE_ACCOUNT_EMAIL }}
-      TF_ACC_SERVICE_ACCOUNT_FILE: "~/service_account.json"
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Build
-        uses: ./.github/actions/build
-        with:
-          go-version: ${{ env.GO_VERSION }}
-
-      - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v2
-        with:
-          terraform_wrapper: false
-
-      - name: Create service account json file
-        if: ${{ github.event_name == 'pull_request' }}
-        run: |
-          echo "${{ secrets.TF_ACC_SERVICE_ACCOUNT_JSON }}" >~/.service_account.json
-
-      - name: Run go mod tidy
-        if: ${{ github.event_name == 'pull_request' }}
-        run: go mod tidy
-
-      - name: Testing
-        if: ${{ github.event_name != 'pull_request' }}
-        run: |
-          unset TF_ACC
-          TF_ACC_SERVICE_ACCOUNT_FILE=~/.service_account.json
-          export TF_ACC_SERVICE_ACCOUNT_FILE
-          make test
-
-      - name: Testing with coverage
-        if: ${{ github.event_name == 'pull_request' }}
-        run: |
-          unset TF_ACC
-          TF_ACC_SERVICE_ACCOUNT_FILE=~/.service_account.json
-          export TF_ACC_SERVICE_ACCOUNT_FILE
-          make coverage
-
-#      - name: Acceptance Testing
-#        env:
-#          TF_ACC: "1"
-#        if: ${{ github.event_name == 'pull_request' }}
-#        run: |
-#          TF_ACC_SERVICE_ACCOUNT_FILE=~/.service_account.json
-#          export TF_ACC_SERVICE_ACCOUNT_FILE
-#          make test-acceptance-tf
-
-#      - name: Run Acceptance Test
-#        if: ${{ github.event_name == 'pull_request' }}
-#        uses: ./.github/actions/acc_test
-#        with:
-#          go-version: ${{ env.GO_VERSION }}
-#          project_id: ${{ vars.TF_ACC_PROJECT_ID }}
-#          region: ${{ vars.TF_ACC_REGION }}
-#          service_account_json_content_b64: "${{ secrets.TF_ACC_SERVICE_ACCOUNT_JSON_B64 }}"
-#          project_user_email: ${{ vars.TEST_PROJECT_USER_EMAIL }}
-#          tf_acc_kek_key_id: ${{ vars.TF_ACC_KEK_KEY_ID }}
-#          tf_acc_kek_key_ring_id: ${{ vars.TF_ACC_KEK_KEY_RING_ID }}
-#          tf_acc_kek_key_version: ${{ vars.TF_ACC_KEK_KEY_VERSION }}
-#          tf_acc_kek_service_account: ${{ vars.TF_ACC_KEK_SERVICE_ACCOUNT }}
-#          # service_account_json_file_path: "~/service_account.json"
-
-      - name: Check coverage threshold
-        shell: bash
-        run: |
-          make coverage
-          COVERAGE=$(go tool cover -func=coverage.out | grep total | awk '{print $3}' | sed 's/%//')
-          echo "Coverage: $COVERAGE%"
-          if (( $(echo "$COVERAGE < 80" | bc -l) )); then
-            echo "Coverage is below 80%"
-            # exit 1
-          fi
-
-      - name: Archive code coverage results
-        uses: actions/upload-artifact@v4
-        with:
-          name: ${{ env.CODE_COVERAGE_ARTIFACT_NAME }}
-          path: "stackit/${{ env.CODE_COVERAGE_FILE_NAME }}"
-
-  main:
-    if: ${{ github.event_name != 'schedule' }}
-    name: CI run build and linting
-    runs-on: stackit-docker
-    needs:
-      - config
-      - prepare
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      
-#      - uses: actions/cache@v5
-#        id: cache
-#        with:
-#          path: path/to/dependencies
-#          key: ${{ runner.os }}-${{ hashFiles('**/lockfiles') }}
-
-#      - name: Install Dependencies
-#        if: steps.cache.outputs.cache-hit != 'true'
-#        run: /install.sh
-
-      - name: Build
-        uses: ./.github/actions/build
-        with:
-          go-version: ${{ env.GO_VERSION }}
-      
-      - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v2
-        with:
-          terraform_wrapper: false
-
-      - name: "Ensure docs are up-to-date"
-        if: ${{ github.event_name == 'pull_request' }}
-        run: ./scripts/check-docs.sh
-        continue-on-error: true
-
-      - name: "Run go mod tidy"
-        if: ${{ github.event_name == 'pull_request' }}
-        run: go mod tidy
-
-      - name: golangci-lint
-        uses: golangci/golangci-lint-action@v9
-        with:
-          version: v2.10
-          args: --config=.golang-ci.yaml --allow-parallel-runners --timeout=5m
-        continue-on-error: true
-
-      - name: Linting terraform files
-        run: make lint-tf
-        continue-on-error: true
-
-  code_coverage:
-    name: "Code coverage report"
-    if: github.event_name == 'pull_request' # Do not run when workflow is triggered by push to main branch
-    runs-on: stackit-docker
-    needs:
-      - main
-      - prepare
-    permissions:
-      contents: read
-      actions: read  # to download code coverage results from "main" job
-      pull-requests: write # write permission needed to comment on PR
-    steps:
-      - name: Install needed tools
-        shell: bash
-        run: |
-          set -e
-          apt-get -y -qq update
-          apt-get -y -qq install sudo
-
-      - name: Check new code coverage
-        uses: fgrosse/go-coverage-report@v1.2.0
-        continue-on-error: true  # Add this line to prevent pipeline failures in forks
-        with:
-          coverage-artifact-name: ${{ env.CODE_COVERAGE_ARTIFACT_NAME }}
-          coverage-file-name: ${{ env.CODE_COVERAGE_FILE_NAME }}
-          root-package: 'github.com/stackitcloud/terraform-provider-stackit'
--- a/.github/workflows/clean_up.yaml
+++ b/.github/workflows/clean_up.yaml
@ -1,45 +0,0 @@
-name: TF Acceptance Test CleanUp
-
-on:
-  workflow_dispatch:
-    inputs:
-      list_only:
-        description: "only list resources"
-        type: boolean
-        default: true
-        required: true
-
-      res_prefix:
-        description: "resource name prefix"
-        type: string
-        default: 'tf-acc-'
-        required: true
-
-      log_level:
-        description: 'Log Level'
-        required: true
-        default: 'warning'
-        type: choice
-        options:
-          - info
-          - warning
-          - debug
-          - error
-
-jobs:
-  clean:
-    name: Clean up
-    runs-on: stackit-docker
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Clean
-        uses: ./.github/actions/clean_up
-        with:
-          project_id: ${{ vars.TF_ACC_PROJECT_ID }}
-          region: 'eu01'
-          tf_resource_prefix: ${{ inputs.res_prefix }}
-          service_account_json_content_b64: "${{ secrets.TF_ACC_SERVICE_ACCOUNT_JSON_B64 }}"
-          list_only: ${{ inputs.list_only }}
-          log_level: ${{ inputs.log_level }}
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@ -1,156 +0,0 @@
-name: Publish
-
-run-name: Publish by @${{ github.actor }}
-
-on:
-  workflow_dispatch:
-
-  push:
-    tags:
-      - 'v*'
-
-env:
-  GO_VERSION: "1.25"
-  CODE_COVERAGE_FILE_NAME: "coverage.out" # must be the same as in Makefile
-  CODE_COVERAGE_ARTIFACT_NAME: "code-coverage"
-
-jobs:
-  config:
-    name: Check GoReleaser config
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Check GoReleaser
-        uses: goreleaser/goreleaser-action@v7
-        with:
-          args: check
-
-  publish:
-    name: "Publish provider"
-    needs: config
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read        # Required to identify workflow run.
-      checks: write        # Required to add status summary.
-      contents: write       # Required to checkout repository.
-      pull-requests: write # Required to add PR comment.
-    steps:
-      - name: Install needed tools
-        run: |
-          apt-get -y -qq update
-          apt-get -y -qq install jq python3 python3-pip python-is-python3 s3cmd git make wget
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          fetch-tags: true
-
-      - name: Setup Go
-        uses: actions/setup-go@v6
-        with:
-          # go-version: ${{ env.GO_VERSION }}
-          check-latest: true
-          go-version-file: 'go.mod'
-
-      - name: Install go tools
-        run: |
-          go install golang.org/x/tools/cmd/goimports@latest
-          go install github.com/hashicorp/terraform-plugin-codegen-framework/cmd/tfplugingen-framework@latest
-          go install github.com/hashicorp/terraform-plugin-codegen-openapi/cmd/tfplugingen-openapi@latest
-
-      - name: Setup JAVA
-        uses: actions/setup-java@v5
-        with:
-          distribution: 'temurin' # See 'Supported distributions' for available options
-          java-version: '21'
-
-      - name: Set up s3cfg
-        run: |
-          cat <<'EOF' >> ~/.s3cfg
-          [default]
-          host_base = https://object.storage.eu01.onstackit.cloud
-          host_bucket = https://%(bucket).object.storage.eu01.onstackit.cloud
-          check_ssl_certificate = False
-          access_key = ${{ secrets.S3_ACCESS_KEY }}
-          secret_key = ${{ secrets.S3_SECRET_KEY }}
-          EOF
-
-      - name: Import GPG key
-        run: |
-          echo "${{ secrets.PRIVATE_KEY_PEM }}" > ~/private.key.pem
-          gpg --import ~/private.key.pem
-          rm ~/private.key.pem
-
-      - name: Run GoReleaser
-        if: github.event_name == 'workflow_dispatch'
-        id: goreleaser
-        env:
-          GITHUB_TOKEN: ${{ env.FORGEJO_TOKEN }}
-          GPG_FINGERPRINT: ${{ secrets.GPG_FINGERPRINT }}
-        uses: goreleaser/goreleaser-action@v7
-        with:
-#          args: release --skip publish --clean --snapshot
-          args: release --skip publish --clean
-
-      - name: Run GoReleaser
-        if: github.event_name != 'workflow_dispatch'
-        id: goreleaser
-        env:
-          GITHUB_TOKEN: ${{ env.FORGEJO_TOKEN }}
-          GPG_FINGERPRINT: ${{ secrets.GPG_FINGERPRINT }}
-        uses: goreleaser/goreleaser-action@v7
-        with:
-          args: release --skip publish --clean
-
-      - name: Prepare key file
-        run: |
-          echo "${{ secrets.PUBLIC_KEY_PEM }}" >public_key.pem
-
-      - name: Determine version
-        id: get_version
-        run: |
-          set -e
-          VERSION=$(jq -r .version < dist/metadata.json)
-          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
-
-      - name: Prepare provider directory structure
-        run: |
-          go run generator/main.go \
-            publish \
-              --namespace=mhenselin \
-              --providerName=stackitprivatepreview \
-              --repoName=terraform-provider-stackitprivatepreview \
-              --domain=tfregistry.sysops.stackit.rocks \
-              --gpgFingerprint="${{ secrets.GPG_FINGERPRINT }}" \
-              --gpgPubKeyFile=public_key.pem \
-              --version=${{ steps.get_version.outputs.version }}
-
-      - name: Prepare documentation nav file
-        run: |
-          go run generator/main.go \
-            docs \
-            --outFile nav.md
-
-      - name: Publish provider to S3
-        run: |
-          set -e
-          cd release/
-          s3cmd put --recursive v1 s3://terraform-provider-privatepreview/
-          s3cmd put --recursive .well-known s3://terraform-provider-privatepreview/
-
-      - name: Import SSH key
-        run: |
-          mkdir -p ~/.ssh
-          echo "${{ secrets.DOCS_UPLOAD_SSH_KEY }}" > ~/.ssh/id_ed25519
-          chmod 0600 ~/.ssh/id_ed25519
-
-      - name: Upload docs via scp
-        run: |
-          set -e
-          ssh -o StrictHostKeyChecking=no ubuntu@${{ vars.DOCS_SERVER_IP }} 'rm -rf /srv/www/docs'
-          echo "${{ steps.get_version.outputs.version }}" >docs/_version.txt
-          # echo "${{ github.ref_name }}" >docs/_version.txt
-          scp -o StrictHostKeyChecking=no -r docs ubuntu@${{ vars.DOCS_SERVER_IP }}:/srv/www/
-          scp -o StrictHostKeyChecking=no nav.md ubuntu@${{ vars.DOCS_SERVER_IP }}:/srv/www/
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@ -4,9 +4,9 @@ name: Release
 # This GitHub action creates a release when a tag that matches the pattern
 # "v*" (e.g. v0.1.0) is created.
 on:
-#  push:
-#    tags:
-#      - "v*"
+  push:
+    tags:
+      - "v*"
  workflow_dispatch:

 # Releases need permissions to read and write the repository contents.
@ -16,25 +16,23 @@ permissions:

 jobs:
  goreleaser:
-    runs-on: stackit-docker
+    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
        with:
          # Allow goreleaser to access older tag information.
          fetch-depth: 0
-
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v5
        with:
          go-version-file: "go.mod"
          cache: true
-
      - name: Import GPG key
        uses: crazy-max/ghaction-import-gpg@v6
        id: import_gpg
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v7
+        uses: goreleaser/goreleaser-action@v6
        with:
          args: release --clean
        env:
--- a/.github/workflows/renovate.yaml
+++ b/.github/workflows/renovate.yaml
@ -8,14 +8,12 @@ on:
 jobs:
  renovate:
    name: Renovate
-    runs-on: stackit-docker
+    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
-
+        uses: actions/checkout@v4
      - name: Self-hosted Renovate
-        uses: renovatebot/github-action@v46.1.5
+        uses: renovatebot/github-action@v41.0.0
        with:
          configurationFile: .github/renovate.json
-          # token: ${{ secrets.RENOVATE_TOKEN }}
-          token: ${{ env.FORGEJO_TOKEN }}
+          token: ${{ secrets.RENOVATE_TOKEN }}
--- a/.github/workflows/runnerstats.yaml
+++ b/.github/workflows/runnerstats.yaml
@ -1,29 +0,0 @@
-name: Runner stats
-
-on:
-  workflow_dispatch:
-
-jobs:
-  stats-own:
-    name: "Get own runner stats"
-    runs-on: ubuntu-latest
-    steps:
-      - name: Install needed tools
-        run: |
-          apt-get -y -qq update
-          apt-get -y -qq install inxi
-
-      - name: Show stats
-        run: inxi -c 0
-
-  stats-stackit:
-    name: "Get STACKIT runner stats"
-    runs-on: stackit-docker
-    steps:
-      - name: Install needed tools
-        run: |
-          apt-get -y -qq update
-          apt-get -y -qq install inxi
-
-      - name: Show stats
-        run: inxi -c 0
--- a/.github/workflows/stale.yaml
+++ b/.github/workflows/stale.yaml
@ -20,7 +20,7 @@ permissions:
 jobs:
  stale:
    name: "Stale"
-    runs-on: stackit-docker
+    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: "Mark old PRs as stale"
--- a/.github/workflows/tf-acc-test.yaml
+++ b/.github/workflows/tf-acc-test.yaml
@ -1,61 +1,27 @@
 name: TF Acceptance Tests Workflow

 on:
-  pull_request:
-    types: [opened, synchronize, reopened]
-    branches:
-      - alpha
-      - main
  push:
    branches:
      - master
  workflow_dispatch:
-    inputs:
-      enable_debug:
-        description: "enable terraform debug logs"
-        type: boolean
-        default: false
-        required: true
-      test_timeout_string:
-        description: "string that determines the timeout (default: 45m)"
-        type: string
-        default: '90m'
-        required: true

 jobs:
-  acc_test:
+  main:
    name: Acceptance Tests
-    runs-on: stackit-docker
+    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Run Test (workflow dispatch)
-        if: ${{ github.event_name == 'workflow_dispatch' }}
-        uses: ./.github/actions/acc_test
-        with:
-          go-version: ${{ env.GO_VERSION }}
-          project_id: ${{ vars.TF_ACC_PROJECT_ID }}
-          region: 'eu01'
-          service_account_json_content_b64: "${{ secrets.TF_ACC_SERVICE_ACCOUNT_JSON_B64 }}"
-          project_user_email: ${{ vars.TEST_PROJECT_USER_EMAIL }}
-          tf_acc_kek_key_id: ${{ vars.TF_ACC_KEK_KEY_ID }}
-          tf_acc_kek_key_ring_id: ${{ vars.TF_ACC_KEK_KEY_RING_ID }}
-          tf_acc_kek_key_version: ${{ vars.TF_ACC_KEK_KEY_VERSION }}
-          tf_acc_kek_service_account: ${{ vars.TF_ACC_KEK_SERVICE_ACCOUNT }}
-          tf_debug: ${{ inputs.enable_debug }}
-          test_timeout_string: ${{ inputs.test_timeout_string }}
-
-      - name: Run Test (automatic)
-        if: ${{ github.event_name != 'workflow_dispatch' }}
-        uses: ./.github/actions/acc_test
-        with:
-          go-version: ${{ env.GO_VERSION }}
-          project_id: ${{ vars.TF_ACC_PROJECT_ID }}
-          region: 'eu01'
-          service_account_json_content_b64: "${{ secrets.TF_ACC_SERVICE_ACCOUNT_JSON_B64 }}"
-          project_user_email: ${{ vars.TEST_PROJECT_USER_EMAIL }}
-          tf_acc_kek_key_id: ${{ vars.TF_ACC_KEK_KEY_ID }}
-          tf_acc_kek_key_ring_id: ${{ vars.TF_ACC_KEK_KEY_RING_ID }}
-          tf_acc_kek_key_version: ${{ vars.TF_ACC_KEK_KEY_VERSION }}
-          tf_acc_kek_service_account: ${{ vars.TF_ACC_KEK_SERVICE_ACCOUNT }}
+        uses: actions/checkout@v4
+      - name: Install project tools and dependencies
+        run: make project-tools
+      - name: Run tests
+        run: |
+          make test-acceptance-tf TF_ACC_PROJECT_ID=$${{ secrets.TF_ACC_PROJECT_ID }} TF_ACC_ORGANIZATION_ID=$${{ secrets.TF_ACC_ORGANIZATION_ID }} TF_ACC_REGION="eu01"
+        env:
+          STACKIT_SERVICE_ACCOUNT_TOKEN: ${{ secrets.TF_ACC_SERVICE_ACCOUNT_TOKEN }}
+          TF_ACC_TEST_PROJECT_SERVICE_ACCOUNT_EMAIL: ${{ secrets.TF_ACC_TEST_PROJECT_SERVICE_ACCOUNT_EMAIL }}
+          TF_ACC_TEST_PROJECT_SERVICE_ACCOUNT_TOKEN: ${{ secrets.TF_ACC_TEST_PROJECT_SERVICE_ACCOUNT_TOKEN }}
+          TF_ACC_TEST_PROJECT_PARENT_CONTAINER_ID: ${{ secrets.TF_ACC_TEST_PROJECT_PARENT_CONTAINER_ID }}
+          TF_ACC_TEST_PROJECT_PARENT_UUID: ${{ secrets.TF_ACC_TEST_PROJECT_PARENT_UUID }}
+          TF_ACC_TEST_PROJECT_USER_EMAIL: ${{ secrets.TF_ACC_TEST_PROJECT_USER_EMAIL }}
--- a/.gitignore
+++ b/.gitignore
@ -38,14 +38,3 @@ stackit/internal/services/iaas/test-512k.img
 # Test coverage reports
 coverage.out
 coverage.html
-generated
-stackit-sdk-generator
-stackit-sdk-generator/**
-dist
-
-.secrets
-
-pkg_gen
-/release/
-.env
-**/.env
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@ -5,8 +5,6 @@
 # behavior.
 version: 2

-project_name: terraform-provider-stackitprivatepreview
-
 builds:
 - env:
    # goreleaser does not work with CGO, it could also complicate
@ -31,16 +29,14 @@ builds:
  ignore:
    - goos: darwin
      goarch: '386'
-    - goos: windows
-      goarch: arm
  binary: '{{ .ProjectName }}_v{{ .Version }}'
 archives:
 - formats: [ 'zip' ]
  name_template: '{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}'
 checksum:
-#  extra_files:
-#    - glob: 'terraform-registry-manifest.json'
-#      name_template: '{{ .ProjectName }}_{{ .Version }}_manifest.json'
+  extra_files:
+    - glob: 'terraform-registry-manifest.json'
+      name_template: '{{ .ProjectName }}_{{ .Version }}_manifest.json'
  name_template: '{{ .ProjectName }}_{{ .Version }}_SHA256SUMS'
  algorithm: sha256
 signs:
--- a/25
+++ b/25
@ -1,6 +1,5 @@
 ROOT_DIR              ?= $(shell git rev-parse --show-toplevel)
 SCRIPTS_BASE          ?= $(ROOT_DIR)/scripts
-VERSION               ?= ${VER}

 # SETUP AND TOOL INITIALIZATION TASKS
 project-help:
@ -12,20 +11,17 @@ project-tools:
 # LINT
 lint-golangci-lint:
 	@echo "Linting with golangci-lint"
-	@go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint run --fix --config .golang-ci.yaml
+	@$(SCRIPTS_BASE)/lint-golangci-lint.sh

-
-lint-tf:
+lint-tf: 
 	@echo "Linting terraform files"
-	@terraform fmt -check -diff -recursive examples/
-	@terraform fmt -check -diff -recursive stackit/
+	@terraform fmt -check -diff -recursive

 lint: lint-golangci-lint lint-tf

 # DOCUMENTATION GENERATION
 generate-docs:
 	@echo "Generating documentation with tfplugindocs"
-
 	@$(SCRIPTS_BASE)/tfplugindocs.sh

 build:
@ -37,16 +33,15 @@ fmt:
 	@terraform fmt -diff -recursive

 # TEST
-.PHONY: test coverage
 test:
 	@echo "Running tests for the terraform provider"
-	@cd $(ROOT_DIR)/stackit && go test -timeout 0 ./... -count=1 -coverprofile=../coverage.out && cd $(ROOT_DIR)
+	@cd $(ROOT_DIR)/stackit && go test ./... -count=1 -coverprofile=coverage.out && cd $(ROOT_DIR)

 # Test coverage
 coverage:
 	@echo ">> Creating test coverage report for the terraform provider"
-	@cd $(ROOT_DIR)/stackit && (go test -timeout 0 ./... -count=1 -coverprofile=../coverage.out || true) && cd $(ROOT_DIR)
-	@cd $(ROOT_DIR)/stackit && go tool cover -html=../coverage.out -o ../coverage.html && cd $(ROOT_DIR)
+	@cd $(ROOT_DIR)/stackit && (go test ./... -count=1 -coverprofile=coverage.out || true) && cd $(ROOT_DIR)
+	@cd $(ROOT_DIR)/stackit && go tool cover -html=coverage.out -o coverage.html && cd $(ROOT_DIR)

 test-acceptance-tf:
 	@if [ -z $(TF_ACC_PROJECT_ID) ]; then echo "Input TF_ACC_PROJECT_ID missing"; exit 1; fi
@ -62,11 +57,3 @@ test-acceptance-tf:
 	TF_ACC_REGION=$(TF_ACC_REGION) \
 	go test ./... -count=1 -timeout=30m && \
 	cd $(ROOT_DIR)
-
-publish: build
-ifeq ($(strip $(VERSION)),)
-	@echo "please call like this: VER=0.1.0 make publish"
-else
-	@echo "version: $(VERSION)"
-endif
-
--- a/README.md
+++ b/README.md
@ -1,14 +1,15 @@
 <div align="center">
+<br>
 <img src=".github/images/stackit-logo.svg" alt="STACKIT logo" width="50%"/>
+<br>
+<br>
 </div>

-# STACKIT Terraform Provider <br />(PRIVATE PREVIEW)
+# STACKIT Terraform Provider

-[![GitHub Release](https://img.shields.io/github/v/release/stackitcloud/terraform-provider-stackit)](https://registry.terraform.io/providers/stackitcloud/stackit/latest) ![GitHub go.mod Go version](https://img.shields.io/github/go-mod/go-version/stackitcloud/terraform-provider-stackit) [![GitHub License](https://img.shields.io/github/license/stackitcloud/terraform-provider-stackit)](https://www.apache.org/licenses/LICENSE-2.0)
+[![Go Report Card](https://goreportcard.com/badge/github.com/stackitcloud/terraform-provider-stackit)](https://goreportcard.com/report/github.com/stackitcloud/terraform-provider-stackit) [![GitHub Release](https://img.shields.io/github/v/release/stackitcloud/terraform-provider-stackit)](https://registry.terraform.io/providers/stackitcloud/stackit/latest) ![GitHub go.mod Go version](https://img.shields.io/github/go-mod/go-version/stackitcloud/terraform-provider-stackit) [![GitHub License](https://img.shields.io/github/license/stackitcloud/terraform-provider-stackit)](https://www.apache.org/licenses/LICENSE-2.0)

-This project is the **NOT** official [Terraform Provider](https://registry.terraform.io/providers/stackitcloud/stackit/latest/docs) for [STACKIT](https://www.stackit.de/en/)!
-
-This a **private preview only**, which allows you to manage STACKIT resources through Terraform.
+This project is the official [Terraform Provider](https://registry.terraform.io/providers/stackitcloud/stackit/latest/docs) for [STACKIT](https://www.stackit.de/en/), which allows you to manage STACKIT resources through Terraform.

 ## Getting Started

@ -17,27 +18,26 @@ To install the [STACKIT Terraform Provider](https://registry.terraform.io/provid
 ```hcl
 terraform {
  required_providers {
-    stackitprivatepreview = {
-      source  = "tfregistry.sysops.stackit.rocks/mhenselin/stackitprivatepreview"
-      version = ">= 0.1.0"
+    stackit = {
+      source = "stackitcloud/stackit"
+      version = "X.X.X"
    }
  }
 }

-provider "stackitprivatepreview" {
+provider "stackit" {
  # Configuration options
 }
 ```

 Check one of the examples in the [examples](examples/) folder.

-<big font-size="3rem">TODO: revise the following sections</big>
-
 ## Authentication

 To authenticate, you will need a [service account](https://docs.stackit.cloud/platform/access-and-identity/service-accounts/). Create it in the [STACKIT Portal](https://portal.stackit.cloud/) and assign the necessary permissions to it, e.g. `project.owner`. There are multiple ways to authenticate:

 - Key flow (recommended)
+- Token flow (is scheduled for deprecation and will be removed on December 17, 2025.)

 When setting up authentication, the provider will always try to use the key flow first and search for credentials in several locations, following a specific order:

@ -51,6 +51,7 @@ When setting up authentication, the provider will always try to use the key flow

   ```json
   {
+     "STACKIT_SERVICE_ACCOUNT_TOKEN": "foo_token",
     "STACKIT_SERVICE_ACCOUNT_KEY_PATH": "path/to/sa_key.json"
   }
   ```
@ -69,41 +70,35 @@ To configure the key flow, follow this steps:

 1.  Create a service account key:

-   - Use the [STACKIT Portal](https://portal.stackit.cloud/): go to the `Service Accounts` tab, choose a `Service Account` and go to `Service Account Keys` to create a key. For more details, see [Create a service account key](https://docs.stackit.cloud/platform/access-and-identity/service-accounts/how-tos/manage-service-account-keys/)
+- Use the [STACKIT Portal](https://portal.stackit.cloud/): go to the `Service Accounts` tab, choose a `Service Account` and go to `Service Account Keys` to create a key. For more details, see [Create a service account key](https://docs.stackit.cloud/platform/access-and-identity/service-accounts/how-tos/manage-service-account-keys/)

 2.  Save the content of the service account key by copying it and saving it in a JSON file.

    The expected format of the service account key is a **JSON** with the following structure:

-    ```json
-    {
-      "id": "uuid",
-      "publicKey": "public key",
-      "createdAt": "2023-08-24T14:15:22Z",
-      "validUntil": "2023-08-24T14:15:22Z",
-      "keyType": "USER_MANAGED",
-      "keyOrigin": "USER_PROVIDED",
-      "keyAlgorithm": "RSA_2048",
-      "active": true,
-      "credentials": {
-        "kid": "string",
-        "iss": "my-sa@sa.stackit.cloud",
-        "sub": "uuid",
-        "aud": "string",
-        (optional) "privateKey": "private key when generated by the SA service"
-      }
-    }
-    ```
+```json
+{
+  "id": "uuid",
+  "publicKey": "public key",
+  "createdAt": "2023-08-24T14:15:22Z",
+  "validUntil": "2023-08-24T14:15:22Z",
+  "keyType": "USER_MANAGED",
+  "keyOrigin": "USER_PROVIDED",
+  "keyAlgorithm": "RSA_2048",
+  "active": true,
+  "credentials": {
+    "kid": "string",
+    "iss": "my-sa@sa.stackit.cloud",
+    "sub": "uuid",
+    "aud": "string",
+    (optional) "privateKey": "private key when generated by the SA service"
+  }
+}
+```

 3. Configure the service account key for authentication in the provider by following one of the alternatives below:

   - setting the fields in the provider block: `service_account_key` or `service_account_key_path`
-     ```hcl
-     provider "stackitprivatepreview" {
-        default_region           = "eu01"
-        service_account_key_path = "../service_account.json"
-     }
-     ```
   - setting the environment variable: `STACKIT_SERVICE_ACCOUNT_KEY_PATH` or `STACKIT_SERVICE_ACCOUNT_KEY`
     - ensure the set the service account key in `STACKIT_SERVICE_ACCOUNT_KEY` is correctly formatted. Use e.g.
       `$ export STACKIT_SERVICE_ACCOUNT_KEY=$(cat ./service-account-key.json)`
@ -115,6 +110,16 @@ To configure the key flow, follow this steps:
 > - setting the environment variable: `STACKIT_PRIVATE_KEY_PATH` or `STACKIT_PRIVATE_KEY`
 > - setting `STACKIT_PRIVATE_KEY_PATH` in the credentials file (see above)

+### Token flow
+
+> Is scheduled for deprecation and will be removed on December 17, 2025.
+
+Using this flow is less secure since the token is long-lived. You can provide the token in several ways:
+
+1. Setting the field `service_account_token` in the provider
+2. Setting the environment variable `STACKIT_SERVICE_ACCOUNT_TOKEN`
+3. Setting it in the credentials file (see above)
+
 ## Backend configuration

 To keep track of your terraform state, you can configure an [S3 backend](https://developer.hashicorp.com/terraform/language/settings/backends/s3) using [STACKIT Object Storage](https://docs.stackit.cloud/products/storage/object-storage).
@ -144,6 +149,62 @@ terraform {

 Note: AWS specific checks must be skipped as they do not work on STACKIT. For details on what those validations do, see [here](https://developer.hashicorp.com/terraform/language/settings/backends/s3#configuration).

+## Opting into Beta Resources
+
+To use beta resources in the STACKIT Terraform provider, follow these steps:
+
+1. **Provider Configuration Option**
+
+   Set the `enable_beta_resources` option in the provider configuration. This is a boolean attribute that can be either `true` or `false`.
+
+   ```hcl
+   provider "stackit" {
+     default_region        = "eu01"
+     enable_beta_resources = true
+   }
+   ```
+
+2. **Environment Variable**
+
+   Set the `STACKIT_TF_ENABLE_BETA_RESOURCES` environment variable to `"true"` or `"false"`. Other values will be ignored and will produce a warning.
+
+   ```sh
+   export STACKIT_TF_ENABLE_BETA_RESOURCES=true
+   ```
+
+> **Note**: The environment variable takes precedence over the provider configuration option. This means that if the `STACKIT_TF_ENABLE_BETA_RESOURCES` environment variable is set to a valid value (`"true"` or `"false"`), it will override the `enable_beta_resources` option specified in the provider configuration.
+
+For more details, please refer to the [beta resources configuration guide](https://registry.terraform.io/providers/stackitcloud/stackit/latest/docs/guides/opting_into_beta_resources).
+
+## Opting into Experiments
+
+Experiments are features that are even less mature and stable than Beta Resources. While there is some assumed stability in beta resources, will have to expect breaking changes while using experimental resources. Experimental Resources do not come with any support or warranty.
+
+To enable experiments set the experiments field in the provider definition:
+
+```hcl
+provider "stackit" {
+  default_region        = "eu01"
+  experiments           = ["iam", "routing-tables", "network"]
+}
+```
+
+### Available Experiments
+
+#### `iam`
+
+Enables IAM management features in the Terraform provider. The underlying IAM API is expected to undergo a redesign in the future, which leads to it being considered experimental.
+
+#### `routing-tables`
+
+This feature enables experimental routing table capabilities in the Terraform Provider, available only to designated SNAs at this time.
+
+#### `network`
+
+The `stackit_network` provides the fields `region` and `routing_table_id` when the experiment flag `network` is set. 
+The underlying API is not stable yet and could change in the future.  
+If you don't need these fields, don't set the experiment flag `network`, to use the stable api.
+
 ## Acceptance Tests

 > [!WARNING]
--- a/docs/data-sources/postgresflexalpha_database.md
+++ b/docs/data-sources/postgresflexalpha_database.md
@ -3,12 +3,12 @@
 page_title: "stackitprivatepreview_postgresflexalpha_database Data Source - stackitprivatepreview"
 subcategory: ""
 description: |-
-  
+  Postgres Flex database resource schema. Must have a region specified in the provider configuration.
 ---

 # stackitprivatepreview_postgresflexalpha_database (Data Source)

-
+Postgres Flex database resource schema. Must have a `region` specified in the provider configuration.

 ## Example Usage

@ -25,17 +25,16 @@ data "stackitprivatepreview_postgresflexalpha_database" "example" {

 ### Required

- `database_id` (Number) The ID of the database.
- `instance_id` (String) The ID of the instance.
- `project_id` (String) The STACKIT project ID.
+- `database_id` (String) Database ID.
+- `instance_id` (String) ID of the Postgres Flex instance.
+- `project_id` (String) STACKIT project ID to which the instance is associated.

 ### Optional

- `region` (String) The region which should be addressed
+- `region` (String) The resource region. If not defined, the provider region is used.

 ### Read-Only

- `id` (String) Terraform's internal resource ID. It is structured as \"`project_id`,`region`,`instance_id`,`database_id`\".",
- `name` (String) The name of the database.
- `owner` (String) The owner of the database.
- `tf_original_api_id` (Number) The id of the database.
+- `id` (String) Terraform's internal resource ID. It is structured as "`project_id`,`region`,`instance_id`,`database_id`".
+- `name` (String) Database name.
+- `owner` (String) Username of the database owner.
--- a/docs/data-sources/postgresflexalpha_flavor.md
+++ b/docs/data-sources/postgresflexalpha_flavor.md
@ -10,18 +10,7 @@ description: |-



-## Example Usage

-```terraform
-data "stackitprivatepreview_postgresflexalpha_flavor" "flavor" {
-  project_id    = var.project_id
-  region        = var.region
-  cpu           = 4
-  ram           = 16
-  node_type     = "Single"
-  storage_class = "premium-perf2-stackit"
-}
-```

 <!-- schema generated by tfplugindocs -->
 ## Schema
--- a/docs/data-sources/postgresflexalpha_flavors.md
+++ b/docs/data-sources/postgresflexalpha_flavors.md
@ -1,68 +0,0 @@
---
-# generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "stackitprivatepreview_postgresflexalpha_flavors Data Source - stackitprivatepreview"
-subcategory: ""
-description: |-
-  
---
-
-# stackitprivatepreview_postgresflexalpha_flavors (Data Source)
-
-
-
-
-
-<!-- schema generated by tfplugindocs -->
-## Schema
-
-### Required
-
- `project_id` (String) The STACKIT project ID.
- `region` (String) The region which should be addressed
-
-### Optional
-
- `page` (Number) Number of the page of items list to be returned.
- `size` (Number) Number of items to be returned on each page.
- `sort` (String) Sorting of the flavors to be returned on each page.
-
-### Read-Only
-
- `flavors` (Attributes List) List of flavors available for the project. (see [below for nested schema](#nestedatt--flavors))
- `pagination` (Attributes) (see [below for nested schema](#nestedatt--pagination))
-
-<a id="nestedatt--flavors"></a>
-### Nested Schema for `flavors`
-
-Read-Only:
-
- `cpu` (Number) The cpu count of the instance.
- `description` (String) The flavor description.
- `max_gb` (Number) maximum storage which can be ordered for the flavor in Gigabyte.
- `memory` (Number) The memory of the instance in Gibibyte.
- `min_gb` (Number) minimum storage which is required to order in Gigabyte.
- `node_type` (String) defines the nodeType it can be either single or replica
- `storage_classes` (Attributes List) maximum storage which can be ordered for the flavor in Gigabyte. (see [below for nested schema](#nestedatt--flavors--storage_classes))
- `tf_original_api_id` (String) The id of the instance flavor.
-
-<a id="nestedatt--flavors--storage_classes"></a>
-### Nested Schema for `flavors.storage_classes`
-
-Read-Only:
-
- `class` (String)
- `max_io_per_sec` (Number)
- `max_through_in_mb` (Number)
-
-
-
-<a id="nestedatt--pagination"></a>
-### Nested Schema for `pagination`
-
-Read-Only:
-
- `page` (Number)
- `size` (Number)
- `sort` (String)
- `total_pages` (Number)
- `total_rows` (Number)
--- a/docs/data-sources/postgresflexalpha_instance.md
+++ b/docs/data-sources/postgresflexalpha_instance.md
@ -3,12 +3,12 @@
 page_title: "stackitprivatepreview_postgresflexalpha_instance Data Source - stackitprivatepreview"
 subcategory: ""
 description: |-
-  
+  Postgres Flex instance data source schema. Must have a region specified in the provider configuration.
 ---

 # stackitprivatepreview_postgresflexalpha_instance (Data Source)

-
+Postgres Flex instance data source schema. Must have a `region` specified in the provider configuration.

 ## Example Usage

@ -24,58 +24,34 @@ data "stackitprivatepreview_postgresflexalpha_instance" "example" {

 ### Required

- `instance_id` (String) The ID of the instance.
- `project_id` (String) The STACKIT project ID.
+- `instance_id` (String) ID of the PostgresFlex instance.
+- `project_id` (String) STACKIT project ID to which the instance is associated.

 ### Optional

- `region` (String) The region which should be addressed
+- `region` (String) The resource region. If not defined, the provider region is used.

 ### Read-Only

- `acl` (List of String) List of IPV4 cidr.
- `backup_schedule` (String) The schedule for when the database backup will be created. Currently, ONLY daily schedules are supported (every 24 hours). The schedule is written as a cron schedule.
- `connection_info` (Attributes) The connection information of the instance (see [below for nested schema](#nestedatt--connection_info))
- `encryption` (Attributes) The configuration for instance's volume and backup storage encryption.
-
-⚠︝ **Note:** This feature is in private preview. Supplying this object is only permitted for enabled accounts. If your account does not have access, the request will be rejected. (see [below for nested schema](#nestedatt--encryption))
- `flavor_id` (String) The id of the instance flavor.
- `id` (String) internal ID
- `is_deletable` (Boolean) Whether the instance can be deleted or not.
- `name` (String) The name of the instance.
- `network` (Attributes) The access configuration of the instance (see [below for nested schema](#nestedatt--network))
- `replicas` (Number) How many replicas the instance should have.
- `retention_days` (Number) How long backups are retained. The value can only be between 32 and 365 days.
- `status` (String) The current status of the instance.
- `storage` (Attributes) The object containing information about the storage size and class. (see [below for nested schema](#nestedatt--storage))
- `tf_original_api_id` (String) The ID of the instance.
- `version` (String) The Postgres version used for the instance. See [Versions Endpoint](/documentation/postgres-flex-service/version/v3alpha1#tag/Version) for supported version parameters.
-
-<a id="nestedatt--connection_info"></a>
-### Nested Schema for `connection_info`
-
-Read-Only:
-
- `write` (Attributes) The DNS name and port in the instance overview (see [below for nested schema](#nestedatt--connection_info--write))
-
-<a id="nestedatt--connection_info--write"></a>
-### Nested Schema for `connection_info.write`
-
-Read-Only:
-
- `host` (String) The host of the instance.
- `port` (Number) The port of the instance.
-
-
+- `backup_schedule` (String)
+- `encryption` (Attributes) (see [below for nested schema](#nestedatt--encryption))
+- `flavor_id` (String)
+- `id` (String) Terraform's internal data source. ID. It is structured as "`project_id`,`region`,`instance_id`".
+- `name` (String) Instance name.
+- `network` (Attributes) (see [below for nested schema](#nestedatt--network))
+- `replicas` (Number)
+- `retention_days` (Number)
+- `storage` (Attributes) (see [below for nested schema](#nestedatt--storage))
+- `version` (String)

 <a id="nestedatt--encryption"></a>
 ### Nested Schema for `encryption`

 Read-Only:

- `kek_key_id` (String) The encryption-key key identifier
- `kek_key_ring_id` (String) The encryption-key keyring identifier
- `kek_key_version` (String) The encryption-key version
+- `key_id` (String)
+- `key_version` (String)
+- `keyring_id` (String)
 - `service_account` (String)


@ -84,8 +60,8 @@ Read-Only:

 Read-Only:

- `access_scope` (String) The access scope of the instance. It defines if the instance is public or airgapped.
- `acl` (List of String) List of IPV4 cidr.
+- `access_scope` (String)
+- `acl` (List of String) The Access Control List (ACL) for the PostgresFlex instance.
 - `instance_address` (String)
 - `router_address` (String)

@ -95,5 +71,5 @@ Read-Only:

 Read-Only:

- `performance_class` (String) The storage class for the storage.
- `size` (Number) The storage size in Gigabytes.
+- `class` (String)
+- `size` (Number)
--- a/docs/data-sources/postgresflexalpha_user.md
+++ b/docs/data-sources/postgresflexalpha_user.md
@ -3,12 +3,12 @@
 page_title: "stackitprivatepreview_postgresflexalpha_user Data Source - stackitprivatepreview"
 subcategory: ""
 description: |-
-  
+  Postgres Flex user data source schema. Must have a region specified in the provider configuration.
 ---

 # stackitprivatepreview_postgresflexalpha_user (Data Source)

-
+Postgres Flex user data source schema. Must have a `region` specified in the provider configuration.

 ## Example Usage

@ -25,18 +25,20 @@ data "stackitprivatepreview_postgresflexalpha_user" "example" {

 ### Required

- `instance_id` (String) The ID of the instance.
- `project_id` (String) The STACKIT project ID.
- `user_id` (Number) The ID of the user.
+- `instance_id` (String) ID of the PostgresFlex instance.
+- `project_id` (String) STACKIT project ID to which the instance is associated.
+- `user_id` (String) User ID.

 ### Optional

- `id` (String) Terraform's internal resource ID. It is structured as \"`project_id`,`region`,`instance_id`,`user_id`\".",
- `region` (String) The region which should be addressed
+- `region` (String) The resource region. If not defined, the provider region is used.

 ### Read-Only

- `name` (String) The name of the user.
- `roles` (List of String) A list of user roles.
- `status` (String) The current status of the user.
- `tf_original_api_id` (Number) The ID of the user.
+- `connection_string` (String)
+- `host` (String)
+- `id` (String) Terraform's internal data source. ID. It is structured as "`project_id`,`region`,`instance_id`,`user_id`".
+- `port` (Number)
+- `roles` (Set of String)
+- `status` (String)
+- `username` (String)
--- a/docs/data-sources/sqlserverflexalpha_database.md
+++ b/docs/data-sources/sqlserverflexalpha_database.md
@ -1,32 +0,0 @@
---
-# generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "stackitprivatepreview_sqlserverflexalpha_database Data Source - stackitprivatepreview"
-subcategory: ""
-description: |-
-  
---
-
-# stackitprivatepreview_sqlserverflexalpha_database (Data Source)
-
-
-
-
-
-<!-- schema generated by tfplugindocs -->
-## Schema
-
-### Required
-
- `database_name` (String) The name of the database.
- `instance_id` (String) The ID of the instance.
- `project_id` (String) The STACKIT project ID.
- `region` (String) The region which should be addressed
-
-### Read-Only
-
- `collation_name` (String) The collation of the database. This database collation should match the *collation_name* of one of the collations given by the **Get database collation list** endpoint.
- `compatibility_level` (Number) CompatibilityLevel of the Database.
- `id` (String) The terraform internal identifier.
- `name` (String) The name of the database.
- `owner` (String) The owner of the database.
- `tf_original_api_id` (Number) The id of the database.
--- a/docs/data-sources/sqlserverflexalpha_flavor.md
+++ b/docs/data-sources/sqlserverflexalpha_flavor.md
@ -0,0 +1,43 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "stackitprivatepreview_sqlserverflexalpha_flavor Data Source - stackitprivatepreview"
+subcategory: ""
+description: |-
+  
+---
+
+# stackitprivatepreview_sqlserverflexalpha_flavor (Data Source)
+
+
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `cpu` (Number) The cpu count of the instance.
+- `node_type` (String) defines the nodeType it can be either single or replica
+- `project_id` (String) The cpu count of the instance.
+- `ram` (Number) The memory of the instance in Gibibyte.
+- `region` (String) The flavor description.
+- `storage_class` (String) The memory of the instance in Gibibyte.
+
+### Read-Only
+
+- `description` (String) The flavor description.
+- `flavor_id` (String) The flavor id of the instance flavor.
+- `id` (String) The terraform id of the instance flavor.
+- `max_gb` (Number) maximum storage which can be ordered for the flavor in Gigabyte.
+- `min_gb` (Number) minimum storage which is required to order in Gigabyte.
+- `storage_classes` (Attributes List) (see [below for nested schema](#nestedatt--storage_classes))
+
+<a id="nestedatt--storage_classes"></a>
+### Nested Schema for `storage_classes`
+
+Read-Only:
+
+- `class` (String)
+- `max_io_per_sec` (Number)
+- `max_through_in_mb` (Number)
--- a/docs/data-sources/sqlserverflexalpha_instance.md
+++ b/docs/data-sources/sqlserverflexalpha_instance.md
@ -3,12 +3,12 @@
 page_title: "stackitprivatepreview_sqlserverflexalpha_instance Data Source - stackitprivatepreview"
 subcategory: ""
 description: |-
-  
+  SQLServer Flex ALPHA instance resource schema. Must have a region specified in the provider configuration.
 ---

 # stackitprivatepreview_sqlserverflexalpha_instance (Data Source)

-
+SQLServer Flex ALPHA instance resource schema. Must have a `region` specified in the provider configuration.

 ## Example Usage

@ -24,48 +24,61 @@ data "stackitprivatepreview_sqlserverflexalpha_instance" "example" {

 ### Required

- `instance_id` (String) The ID of the instance.
- `project_id` (String) The STACKIT project ID.
- `region` (String) The region which should be addressed
+- `instance_id` (String) ID of the SQLServer Flex instance.
+- `project_id` (String) STACKIT project ID to which the instance is associated.
+
+### Optional
+
+- `region` (String) The resource region. If not defined, the provider region is used.

 ### Read-Only

- `backup_schedule` (String) The schedule for on what time and how often the database backup will be created. The schedule is written as a cron schedule.
- `edition` (String) Edition of the MSSQL server instance
- `encryption` (Attributes) this defines which key to use for storage encryption (see [below for nested schema](#nestedatt--encryption))
- `flavor_id` (String) The id of the instance flavor.
- `is_deletable` (Boolean) Whether the instance can be deleted or not.
- `name` (String) The name of the instance.
- `network` (Attributes) The access configuration of the instance (see [below for nested schema](#nestedatt--network))
- `replicas` (Number) How many replicas the instance should have.
- `retention_days` (Number) The days for how long the backup files should be stored before cleaned up. 30 to 365
+- `backup_schedule` (String) The backup schedule. Should follow the cron scheduling system format (e.g. "0 0 * * *")
+- `edition` (String)
+- `encryption` (Attributes) The encryption block. (see [below for nested schema](#nestedatt--encryption))
+- `flavor` (Attributes) (see [below for nested schema](#nestedatt--flavor))
+- `id` (String) Terraform's internal resource ID. It is structured as "`project_id`,`region`,`instance_id`".
+- `is_deletable` (Boolean)
+- `name` (String) Instance name.
+- `network` (Attributes) The network block. (see [below for nested schema](#nestedatt--network))
+- `replicas` (Number)
+- `retention_days` (Number)
 - `status` (String)
- `storage` (Attributes) The object containing information about the storage size and class. (see [below for nested schema](#nestedatt--storage))
- `tf_original_api_id` (String) The ID of the instance.
- `version` (String) The sqlserver version used for the instance.
+- `storage` (Attributes) (see [below for nested schema](#nestedatt--storage))
+- `version` (String)

 <a id="nestedatt--encryption"></a>
 ### Nested Schema for `encryption`

 Read-Only:

- `kek_key_id` (String) The key identifier
- `kek_key_ring_id` (String) The keyring identifier
- `kek_key_version` (String) The key version
+- `key_id` (String) STACKIT KMS - Key ID of the encryption key to use.
+- `key_version` (String) STACKIT KMS - Key version to use in the encryption key.
+- `keyring_id` (String) STACKIT KMS - KeyRing ID of the encryption key to use.
 - `service_account` (String)


+<a id="nestedatt--flavor"></a>
+### Nested Schema for `flavor`
+
+Read-Only:
+
+- `cpu` (Number)
+- `description` (String)
+- `id` (String)
+- `node_type` (String)
+- `ram` (Number)
+
+
 <a id="nestedatt--network"></a>
 ### Nested Schema for `network`

 Read-Only:

- `access_scope` (String) The network access scope of the instance
-
-⚠️ **Note:** This feature is in private preview. Supplying this object is only permitted for enabled accounts. If your account does not have access, the request will be rejected.
- `acl` (List of String) List of IPV4 cidr.
- `instance_address` (String)
- `router_address` (String)
+- `access_scope` (String) The access scope of the instance. (e.g. SNA)
+- `acl` (List of String) The Access Control List (ACL) for the SQLServer Flex instance.
+- `instance_address` (String) The returned instance IP address of the SQLServer Flex instance.
+- `router_address` (String) The returned router IP address of the SQLServer Flex instance.


 <a id="nestedatt--storage"></a>
@ -73,5 +86,5 @@ Read-Only:

 Read-Only:

- `class` (String) The storage class for the storage.
- `size` (Number) The storage size in Gigabytes.
+- `class` (String)
+- `size` (Number)
--- a/docs/data-sources/sqlserverflexalpha_user.md
+++ b/docs/data-sources/sqlserverflexalpha_user.md
@ -3,12 +3,12 @@
 page_title: "stackitprivatepreview_sqlserverflexalpha_user Data Source - stackitprivatepreview"
 subcategory: ""
 description: |-
-  
+  SQLServer Flex user data source schema. Must have a region specified in the provider configuration.
 ---

 # stackitprivatepreview_sqlserverflexalpha_user (Data Source)

-
+SQLServer Flex user data source schema. Must have a `region` specified in the provider configuration.

 ## Example Usage

@ -25,38 +25,20 @@ data "stackitprivatepreview_sqlserverflexalpha_user" "example" {

 ### Required

- `instance_id` (String) The ID of the instance.
- `project_id` (String) The STACKIT project ID.
- `region` (String) The region which should be addressed
+- `instance_id` (String) ID of the SQLServer Flex instance.
+- `project_id` (String) STACKIT project ID to which the instance is associated.
+- `user_id` (Number) User ID.

 ### Optional

- `page` (Number) Number of the page of items list to be returned.
- `size` (Number) Number of items to be returned on each page.
- `sort` (String) Sorting of the users to be returned on each page.
+- `region` (String) The resource region. If not defined, the provider region is used.

 ### Read-Only

- `pagination` (Attributes) (see [below for nested schema](#nestedatt--pagination))
- `users` (Attributes List) List of all users inside an instance (see [below for nested schema](#nestedatt--users))
-
-<a id="nestedatt--pagination"></a>
-### Nested Schema for `pagination`
-
-Read-Only:
-
- `page` (Number)
- `size` (Number)
- `sort` (String)
- `total_pages` (Number)
- `total_rows` (Number)
-
-
-<a id="nestedatt--users"></a>
-### Nested Schema for `users`
-
-Read-Only:
-
- `status` (String) The current status of the user.
- `tf_original_api_id` (Number) The ID of the user.
- `username` (String) The name of the user.
+- `default_database` (String)
+- `host` (String)
+- `id` (String) Terraform's internal data source. ID. It is structured as "`project_id`,`region`,`instance_id`,`user_id`".
+- `port` (Number)
+- `roles` (Set of String) Database access levels for the user.
+- `status` (String)
+- `username` (String) Username of the SQLServer Flex instance.
--- a/docs/data-sources/sqlserverflexbeta_database.md
+++ b/docs/data-sources/sqlserverflexbeta_database.md
@ -1,40 +0,0 @@
---
-# generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "stackitprivatepreview_sqlserverflexbeta_database Data Source - stackitprivatepreview"
-subcategory: ""
-description: |-
-  
---
-
-# stackitprivatepreview_sqlserverflexbeta_database (Data Source)
-
-
-
-## Example Usage
-
-```terraform
-data "stackitprivatepreview_sqlserverflexbeta_database" "example" {
-  project_id    = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-  instance_id   = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-  database_name = "dbname"
-}
-```
-
-<!-- schema generated by tfplugindocs -->
-## Schema
-
-### Required
-
- `database_name` (String) The name of the database.
- `instance_id` (String) The ID of the instance.
- `project_id` (String) The STACKIT project ID.
- `region` (String) The region which should be addressed
-
-### Read-Only
-
- `collation_name` (String) The collation of the database. This database collation should match the *collation_name* of one of the collations given by the **Get database collation list** endpoint.
- `compatibility_level` (Number) CompatibilityLevel of the Database.
- `id` (String) The terraform internal identifier.
- `name` (String) The name of the database.
- `owner` (String) The owner of the database.
- `tf_original_api_id` (Number) The id of the database.
--- a/docs/data-sources/sqlserverflexbeta_instance.md
+++ b/docs/data-sources/sqlserverflexbeta_instance.md
@ -1,77 +0,0 @@
---
-# generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "stackitprivatepreview_sqlserverflexbeta_instance Data Source - stackitprivatepreview"
-subcategory: ""
-description: |-
-  
---
-
-# stackitprivatepreview_sqlserverflexbeta_instance (Data Source)
-
-
-
-## Example Usage
-
-```terraform
-data "stackitprivatepreview_sqlserverflexbeta_instance" "example" {
-  project_id  = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-  instance_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-}
-```
-
-<!-- schema generated by tfplugindocs -->
-## Schema
-
-### Required
-
- `instance_id` (String) The ID of the instance.
- `project_id` (String) The STACKIT project ID.
- `region` (String) The region which should be addressed
-
-### Read-Only
-
- `backup_schedule` (String) The schedule for on what time and how often the database backup will be created. The schedule is written as a cron schedule.
- `edition` (String) Edition of the MSSQL server instance
- `encryption` (Attributes) this defines which key to use for storage encryption (see [below for nested schema](#nestedatt--encryption))
- `flavor_id` (String) The id of the instance flavor.
- `is_deletable` (Boolean) Whether the instance can be deleted or not.
- `name` (String) The name of the instance.
- `network` (Attributes) The access configuration of the instance (see [below for nested schema](#nestedatt--network))
- `replicas` (Number) How many replicas the instance should have.
- `retention_days` (Number) The days for how long the backup files should be stored before cleaned up. 30 to 365
- `status` (String)
- `storage` (Attributes) The object containing information about the storage size and class. (see [below for nested schema](#nestedatt--storage))
- `tf_original_api_id` (String) The ID of the instance.
- `version` (String) The sqlserver version used for the instance.
-
-<a id="nestedatt--encryption"></a>
-### Nested Schema for `encryption`
-
-Read-Only:
-
- `kek_key_id` (String) The key identifier
- `kek_key_ring_id` (String) The keyring identifier
- `kek_key_version` (String) The key version
- `service_account` (String)
-
-
-<a id="nestedatt--network"></a>
-### Nested Schema for `network`
-
-Read-Only:
-
- `access_scope` (String) The network access scope of the instance
-
-⚠️ **Note:** This feature is in private preview. Supplying this object is only permitted for enabled accounts. If your account does not have access, the request will be rejected.
- `acl` (List of String) List of IPV4 cidr.
- `instance_address` (String)
- `router_address` (String)
-
-
-<a id="nestedatt--storage"></a>
-### Nested Schema for `storage`
-
-Read-Only:
-
- `class` (String) The storage class for the storage.
- `size` (Number) The storage size in Gigabytes.
--- a/docs/data-sources/sqlserverflexbeta_user.md
+++ b/docs/data-sources/sqlserverflexbeta_user.md
@ -1,54 +0,0 @@
---
-# generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "stackitprivatepreview_sqlserverflexbeta_user Data Source - stackitprivatepreview"
-subcategory: ""
-description: |-
-  
---
-
-# stackitprivatepreview_sqlserverflexbeta_user (Data Source)
-
-
-
-
-
-<!-- schema generated by tfplugindocs -->
-## Schema
-
-### Required
-
- `instance_id` (String) The ID of the instance.
- `project_id` (String) The STACKIT project ID.
- `region` (String) The region which should be addressed
-
-### Optional
-
- `page` (Number) Number of the page of items list to be returned.
- `size` (Number) Number of items to be returned on each page.
- `sort` (String) Sorting of the users to be returned on each page.
-
-### Read-Only
-
- `pagination` (Attributes) (see [below for nested schema](#nestedatt--pagination))
- `users` (Attributes List) List of all users inside an instance (see [below for nested schema](#nestedatt--users))
-
-<a id="nestedatt--pagination"></a>
-### Nested Schema for `pagination`
-
-Read-Only:
-
- `page` (Number)
- `size` (Number)
- `sort` (String)
- `total_pages` (Number)
- `total_rows` (Number)
-
-
-<a id="nestedatt--users"></a>
-### Nested Schema for `users`
-
-Read-Only:
-
- `status` (String) The current status of the user.
- `tf_original_api_id` (Number) The ID of the user.
- `username` (String) The name of the user.
--- a/docs/index.md
+++ b/docs/index.md
@ -16,13 +16,14 @@ provider "stackitprivatepreview" {
  default_region = "eu01"
 }

-provider "stackitprivatepreview" {
-  default_region           = "eu01"
-  service_account_key_path = "service_account.json"
-}
-
 # Authentication

+# Token flow (scheduled for deprecation and will be removed on December 17, 2025)
+provider "stackitprivatepreview" {
+  default_region        = "eu01"
+  service_account_token = var.service_account_token
+}
+
 # Key flow
 provider "stackitprivatepreview" {
  default_region      = "eu01"
--- a/docs/resources/postgresflexalpha_database.md
+++ b/docs/resources/postgresflexalpha_database.md
@ -3,12 +3,12 @@
 page_title: "stackitprivatepreview_postgresflexalpha_database Resource - stackitprivatepreview"
 subcategory: ""
 description: |-
-  
+  Postgres Flex database resource schema. Must have a region specified in the provider configuration.
 ---

 # stackitprivatepreview_postgresflexalpha_database (Resource)

-
+Postgres Flex database resource schema. Must have a `region` specified in the provider configuration.

 ## Example Usage

@ -25,16 +25,6 @@ import {
  to = stackitprivatepreview_postgresflexalpha_database.import-example
  id = "${var.project_id},${var.region},${var.postgres_instance_id},${var.postgres_database_id}"
 }
-
-import {
-  to = stackitprivatepreview_postgresflexalpha_database.import-example
-  identity = {
-    project_id  = "project_id"
-    region      = "region"
-    instance_id = "instance_id"
-    database_id = "database_id"
-  }
-}
 ```

 <!-- schema generated by tfplugindocs -->
@ -42,16 +32,16 @@ import {

 ### Required

- `name` (String) The name of the database.
+- `instance_id` (String) ID of the Postgres Flex instance.
+- `name` (String) Database name.
+- `owner` (String) Username of the database owner.
+- `project_id` (String) STACKIT project ID to which the instance is associated.

 ### Optional

- `database_id` (Number) The ID of the database.
- `instance_id` (String) The ID of the instance.
- `owner` (String) The owner of the database.
- `project_id` (String) The STACKIT project ID.
- `region` (String) The region which should be addressed
+- `region` (String) The resource region. If not defined, the provider region is used.

 ### Read-Only

- `id` (String) The id of the database.
+- `database_id` (Number) Database ID.
+- `id` (String) Terraform's internal resource ID. It is structured as "`project_id`,`region`,`instance_id`,`database_id`".
--- a/docs/resources/postgresflexalpha_instance.md
+++ b/docs/resources/postgresflexalpha_instance.md
@ -3,39 +3,31 @@
 page_title: "stackitprivatepreview_postgresflexalpha_instance Resource - stackitprivatepreview"
 subcategory: ""
 description: |-
-  
+  Postgres Flex instance resource schema. Must have a region specified in the provider configuration.
 ---

 # stackitprivatepreview_postgresflexalpha_instance (Resource)

-
+Postgres Flex instance resource schema. Must have a `region` specified in the provider configuration.

 ## Example Usage

 ```terraform
-resource "stackitprivatepreview_postgresflexalpha_instance" "example-instance" {
+resource "stackitprivatepreview_postgresflexalpha_instance" "example" {
  project_id      = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  name            = "example-instance"
  acl             = ["XXX.XXX.XXX.X/XX", "XX.XXX.XX.X/XX"]
-  backup_schedule = "0 0 * * *"
-  retention_days  = 30
-  flavor_id       = "flavor.id"
-  replicas        = 1
+  backup_schedule = "00 00 * * *"
+  flavor = {
+    cpu = 2
+    ram = 4
+  }
+  replicas = 3
  storage = {
-    performance_class = "premium-perf2-stackit"
-    size              = 10
+    class = "class"
+    size  = 5
  }
-  encryption = {
-    kek_key_id      = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-    kek_key_ring_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-    kek_key_version = 1
-    service_account = "service@account.email"
-  }
-  network = {
-    acl          = ["XXX.XXX.XXX.X/XX", "XX.XXX.XX.X/XX"]
-    access_scope = "PUBLIC"
-  }
-  version = 17
+  version = 14
 }

 # Only use the import statement, if you want to import an existing postgresflex instance
@ -43,15 +35,6 @@ import {
  to = stackitprivatepreview_postgresflexalpha_instance.import-example
  id = "${var.project_id},${var.region},${var.postgres_instance_id}"
 }
-
-import {
-  to = stackitprivatepreview_postgresflexalpha_instance.import-example
-  identity = {
-    project_id  = var.project_id
-    region      = var.region
-    instance_id = var.postgres_instance_id
-  }
-}
 ```

 <!-- schema generated by tfplugindocs -->
@ -59,47 +42,49 @@ import {

 ### Required

- `backup_schedule` (String) The schedule for when the database backup will be created. Currently, ONLY daily schedules are supported (every 24 hours). The schedule is written as a cron schedule.
- `flavor_id` (String) The id of the instance flavor.
- `name` (String) The name of the instance.
- `network` (Attributes) The access configuration of the instance (see [below for nested schema](#nestedatt--network))
- `replicas` (Number) How many replicas the instance should have.
- `retention_days` (Number) How long backups are retained. The value can only be between 32 and 365 days.
- `storage` (Attributes) The object containing information about the storage size and class. (see [below for nested schema](#nestedatt--storage))
- `version` (String) The Postgres version used for the instance. See [Versions Endpoint](/documentation/postgres-flex-service/version/v3alpha1#tag/Version) for supported version parameters.
+- `backup_schedule` (String)
+- `encryption` (Attributes) The encryption block. (see [below for nested schema](#nestedatt--encryption))
+- `flavor_id` (String)
+- `name` (String) Instance name.
+- `network` (Attributes) The network block configuration. (see [below for nested schema](#nestedatt--network))
+- `project_id` (String) STACKIT project ID to which the instance is associated.
+- `replicas` (Number)
+- `retention_days` (Number) The days of the retention period.
+- `storage` (Attributes) (see [below for nested schema](#nestedatt--storage))
+- `version` (String) The database version used.

 ### Optional

- `encryption` (Attributes) The configuration for instance's volume and backup storage encryption.
-
-⚠︝ **Note:** This feature is in private preview. Supplying this object is only permitted for enabled accounts. If your account does not have access, the request will be rejected. (see [below for nested schema](#nestedatt--encryption))
- `instance_id` (String) The ID of the instance.
- `project_id` (String) The STACKIT project ID.
- `region` (String) The region which should be addressed
+- `region` (String) The resource region. If not defined, the provider region is used.

 ### Read-Only

- `acl` (List of String) List of IPV4 cidr.
- `connection_info` (Attributes) The connection information of the instance (see [below for nested schema](#nestedatt--connection_info))
- `id` (String) The ID of the instance.
- `is_deletable` (Boolean) Whether the instance can be deleted or not.
- `status` (String) The current status of the instance.
+- `id` (String) Terraform's internal resource ID. It is structured as "`project_id`,`region`,`instance_id`".
+- `instance_id` (String) ID of the PostgresFlex instance.
+
+<a id="nestedatt--encryption"></a>
+### Nested Schema for `encryption`
+
+Required:
+
+- `key_id` (String) Key ID of the encryption key.
+- `key_version` (String) Key version of the encryption key.
+- `keyring_id` (String) KeyRing ID of the encryption key.
+- `service_account` (String) The service account ID of the service account.
+

 <a id="nestedatt--network"></a>
 ### Nested Schema for `network`

 Required:

- `acl` (List of String) List of IPV4 cidr.
+- `acl` (List of String) The Access Control List (ACL) for the PostgresFlex instance.

 Optional:

- `access_scope` (String) The access scope of the instance. It defines if the instance is public or airgapped.
-
-Read-Only:
-
- `instance_address` (String)
- `router_address` (String)
+- `access_scope` (String) The access scope. (Either SNA or PUBLIC)
+- `instance_address` (String) The returned instance address.
+- `router_address` (String) The returned router address.


 <a id="nestedatt--storage"></a>
@ -107,32 +92,5 @@ Read-Only:

 Required:

- `performance_class` (String) The storage class for the storage.
- `size` (Number) The storage size in Gigabytes.
-
-
-<a id="nestedatt--encryption"></a>
-### Nested Schema for `encryption`
-
-Required:
-
- `kek_key_id` (String) The encryption-key key identifier
- `kek_key_ring_id` (String) The encryption-key keyring identifier
- `kek_key_version` (String) The encryption-key version
- `service_account` (String)
-
-
-<a id="nestedatt--connection_info"></a>
-### Nested Schema for `connection_info`
-
-Read-Only:
-
- `write` (Attributes) The DNS name and port in the instance overview (see [below for nested schema](#nestedatt--connection_info--write))
-
-<a id="nestedatt--connection_info--write"></a>
-### Nested Schema for `connection_info.write`
-
-Read-Only:
-
- `host` (String) The host of the instance.
- `port` (Number) The port of the instance.
+- `class` (String) The storage class used.
+- `size` (Number) The disk size of the storage.
--- a/docs/resources/postgresflexalpha_user.md
+++ b/docs/resources/postgresflexalpha_user.md
@ -3,12 +3,12 @@
 page_title: "stackitprivatepreview_postgresflexalpha_user Resource - stackitprivatepreview"
 subcategory: ""
 description: |-
-  
+  Postgres Flex user resource schema. Must have a region specified in the provider configuration.
 ---

 # stackitprivatepreview_postgresflexalpha_user (Resource)

-
+Postgres Flex user resource schema. Must have a `region` specified in the provider configuration.

 ## Example Usage

@ -16,7 +16,7 @@ description: |-
 resource "stackitprivatepreview_postgresflexalpha_user" "example" {
  project_id  = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  instance_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-  name        = "username"
+  username    = "username"
  roles       = ["role"]
 }

@ -25,16 +25,6 @@ import {
  to = stackitprivatepreview_postgresflexalpha_user.import-example
  id = "${var.project_id},${var.region},${var.postgres_instance_id},${var.user_id}"
 }
-
-import {
-  to = stackitprivatepreview_postgresflexalpha_user.import-example
-  identity = {
-    project_id  = "project.id"
-    region      = "region"
-    instance_id = "instance.id"
-    user_id     = "user.id"
-  }
-}
 ```

 <!-- schema generated by tfplugindocs -->
@ -42,18 +32,19 @@ import {

 ### Required

- `name` (String) The name of the user.
+- `instance_id` (String) ID of the PostgresFlex instance.
+- `project_id` (String) STACKIT project ID to which the instance is associated.
+- `roles` (Set of String) Database access levels for the user. Possible values are: `login`, `createdb`.
+- `username` (String)

 ### Optional

- `instance_id` (String) The ID of the instance.
- `project_id` (String) The STACKIT project ID.
- `region` (String) The region which should be addressed
- `roles` (List of String) A list containing the user roles for the instance.
- `user_id` (Number) The ID of the user.
+- `region` (String) The resource region. If not defined, the provider region is used.

 ### Read-Only

- `id` (String) The ID of the user.
- `password` (String) The password for the user.
- `status` (String) The current status of the user.
+- `connection_string` (String)
+- `id` (String) Terraform's internal resource ID. It is structured as "`project_id`,`region`,`instance_id`,`user_id`".
+- `password` (String, Sensitive)
+- `status` (String)
+- `user_id` (Number) User ID.
--- a/docs/resources/sqlserverflexalpha_database.md
+++ b/docs/resources/sqlserverflexalpha_database.md
@ -1,63 +0,0 @@
---
-# generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "stackitprivatepreview_sqlserverflexalpha_database Resource - stackitprivatepreview"
-subcategory: ""
-description: |-
-  
---
-
-# stackitprivatepreview_sqlserverflexalpha_database (Resource)
-
-
-
-## Example Usage
-
-```terraform
-resource "stackitprivatepreview_sqlserverflexalpha_database" "example" {
-  project_id    = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-  instance_id   = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-  collation     = ""
-  compatibility = "160"
-  name          = ""
-  owner         = ""
-}
-
-# Only use the import statement, if you want to import a existing sqlserverflex database
-import {
-  to = stackitprivatepreview_sqlserverflexalpha_database.import-example
-  id = "${var.project_id},${var.region},${var.sql_instance_id},${var.sql_user_id}"
-}
-
-import {
-  to = stackitprivatepreview_sqlserverflexalpha_database.import-example
-  identity = {
-    project_id  = "project.id"
-    region      = "region"
-    instance_id = "instance.id"
-    database_id = "database.id"
-  }
-}
-```
-
-<!-- schema generated by tfplugindocs -->
-## Schema
-
-### Required
-
- `name` (String) The name of the database.
- `owner` (String) The owner of the database.
-
-### Optional
-
- `collation` (String) The collation of the database. This database collation should match the *collation_name* of one of the collations given by the **Get database collation list** endpoint.
- `compatibility` (Number) CompatibilityLevel of the Database.
- `database_name` (String) The name of the database.
- `instance_id` (String) The ID of the instance.
- `project_id` (String) The STACKIT project ID.
- `region` (String) The region which should be addressed
-
-### Read-Only
-
- `collation_name` (String) The collation of the database. This database collation should match the *collation_name* of one of the collations given by the **Get database collation list** endpoint.
- `compatibility_level` (Number) CompatibilityLevel of the Database.
- `id` (Number) The id of the database.
--- a/docs/resources/sqlserverflexalpha_instance.md
+++ b/docs/resources/sqlserverflexalpha_instance.md
@ -3,12 +3,12 @@
 page_title: "stackitprivatepreview_sqlserverflexalpha_instance Resource - stackitprivatepreview"
 subcategory: ""
 description: |-
-  
+  SQLServer Flex ALPHA instance resource schema. Must have a region specified in the provider configuration.
 ---

 # stackitprivatepreview_sqlserverflexalpha_instance (Resource)

-
+SQLServer Flex ALPHA instance resource schema. Must have a `region` specified in the provider configuration.

 ## Example Usage

@ -41,63 +41,58 @@ import {

 ### Required

- `backup_schedule` (String) The schedule for on what time and how often the database backup will be created. The schedule is written as a cron schedule.
- `flavor_id` (String) The id of the instance flavor.
- `name` (String) The name of the instance.
- `network` (Attributes) the network configuration of the instance. (see [below for nested schema](#nestedatt--network))
- `retention_days` (Number) The days for how long the backup files should be stored before cleaned up. 30 to 365
- `storage` (Attributes) The object containing information about the storage size and class. (see [below for nested schema](#nestedatt--storage))
- `version` (String) The sqlserver version used for the instance.
+- `encryption` (Attributes) The encryption block. (see [below for nested schema](#nestedatt--encryption))
+- `flavor_id` (String)
+- `name` (String) Instance name.
+- `network` (Attributes) The network block. (see [below for nested schema](#nestedatt--network))
+- `project_id` (String) STACKIT project ID to which the instance is associated.

 ### Optional

- `encryption` (Attributes) this defines which key to use for storage encryption (see [below for nested schema](#nestedatt--encryption))
- `instance_id` (String) The ID of the instance.
- `project_id` (String) The STACKIT project ID.
- `region` (String) The region which should be addressed
+- `backup_schedule` (String) The backup schedule. Should follow the cron scheduling system format (e.g. "0 0 * * *")
+- `is_deletable` (Boolean)
+- `region` (String) The resource region. If not defined, the provider region is used.
+- `retention_days` (Number)
+- `status` (String)
+- `storage` (Attributes) (see [below for nested schema](#nestedatt--storage))
+- `version` (String)

 ### Read-Only

- `edition` (String) Edition of the MSSQL server instance
- `id` (String) The ID of the instance.
- `is_deletable` (Boolean) Whether the instance can be deleted or not.
- `replicas` (Number) How many replicas the instance should have.
- `status` (String)
-
-<a id="nestedatt--network"></a>
-### Nested Schema for `network`
-
-Required:
-
- `acl` (List of String) List of IPV4 cidr.
-
-Optional:
-
- `access_scope` (String) The network access scope of the instance
-
-⚠️ **Note:** This feature is in private preview. Supplying this object is only permitted for enabled accounts. If your account does not have access, the request will be rejected.
-
-Read-Only:
-
- `instance_address` (String)
- `router_address` (String)
-
-
-<a id="nestedatt--storage"></a>
-### Nested Schema for `storage`
-
-Required:
-
- `class` (String) The storage class for the storage.
- `size` (Number) The storage size in Gigabytes.
-
+- `edition` (String)
+- `id` (String) Terraform's internal resource ID. It is structured as "`project_id`,`region`,`instance_id`".
+- `instance_id` (String) ID of the SQLServer Flex instance.
+- `replicas` (Number)

 <a id="nestedatt--encryption"></a>
 ### Nested Schema for `encryption`

 Required:

- `kek_key_id` (String) The key identifier
- `kek_key_ring_id` (String) The keyring identifier
- `kek_key_version` (String) The key version
+- `key_id` (String) STACKIT KMS - Key ID of the encryption key to use.
+- `key_version` (String) STACKIT KMS - Key version to use in the encryption key.
+- `keyring_id` (String) STACKIT KMS - KeyRing ID of the encryption key to use.
 - `service_account` (String)
+
+
+<a id="nestedatt--network"></a>
+### Nested Schema for `network`
+
+Required:
+
+- `access_scope` (String) The access scope of the instance. (SNA | PUBLIC)
+- `acl` (List of String) The Access Control List (ACL) for the SQLServer Flex instance.
+
+Read-Only:
+
+- `instance_address` (String) The returned instance IP address of the SQLServer Flex instance.
+- `router_address` (String) The returned router IP address of the SQLServer Flex instance.
+
+
+<a id="nestedatt--storage"></a>
+### Nested Schema for `storage`
+
+Optional:
+
+- `class` (String)
+- `size` (Number)
--- a/docs/resources/sqlserverflexalpha_user.md
+++ b/docs/resources/sqlserverflexalpha_user.md
@ -3,12 +3,12 @@
 page_title: "stackitprivatepreview_sqlserverflexalpha_user Resource - stackitprivatepreview"
 subcategory: ""
 description: |-
-  
+  SQLServer Flex user resource schema. Must have a region specified in the provider configuration.
 ---

 # stackitprivatepreview_sqlserverflexalpha_user (Resource)

-
+SQLServer Flex user resource schema. Must have a `region` specified in the provider configuration.

 ## Example Usage

@ -32,22 +32,21 @@ import {

 ### Required

- `roles` (List of String) A list containing the user roles for the instance. A list with the valid user roles can be retrieved using the List Roles endpoint.
- `username` (String) The name of the user.
+- `instance_id` (String) ID of the SQLServer Flex instance.
+- `project_id` (String) STACKIT project ID to which the instance is associated.
+- `roles` (Set of String) Database access levels for the user. The values for the default roles are: `##STACKIT_DatabaseManager##`, `##STACKIT_LoginManager##`, `##STACKIT_ProcessManager##`, `##STACKIT_ServerManager##`, `##STACKIT_SQLAgentManager##`, `##STACKIT_SQLAgentUser##`
+- `username` (String) Username of the SQLServer Flex instance.

 ### Optional

- `default_database` (String) The default database for a user of the instance.
- `instance_id` (String) The ID of the instance.
- `project_id` (String) The STACKIT project ID.
- `region` (String) The region which should be addressed
- `user_id` (Number) The ID of the user.
+- `region` (String)

 ### Read-Only

- `host` (String) The host of the instance in which the user belongs to.
- `id` (Number) The ID of the user.
- `password` (String) The password for the user.
- `port` (Number) The port of the instance in which the user belongs to.
- `status` (String) The current status of the user.
- `uri` (String) The connection string for the user to the instance.
+- `default_database` (String)
+- `host` (String)
+- `id` (String) Terraform's internal resource ID. It is structured as "`project_id`,`region`,`instance_id`,`user_id`".
+- `password` (String, Sensitive) Password of the user account.
+- `port` (Number)
+- `status` (String)
+- `user_id` (Number) User ID.
--- a/docs/resources/sqlserverflexbeta_database.md
+++ b/docs/resources/sqlserverflexbeta_database.md
@ -1,51 +0,0 @@
---
-# generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "stackitprivatepreview_sqlserverflexbeta_database Resource - stackitprivatepreview"
-subcategory: ""
-description: |-
-  
---
-
-# stackitprivatepreview_sqlserverflexbeta_database (Resource)
-
-
-
-## Example Usage
-
-```terraform
-resource "stackitprivatepreview_sqlserverflexalpha_user" "example" {
-  project_id  = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-  instance_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-  username    = "username"
-  roles       = ["role"]
-}
-
-# Only use the import statement, if you want to import an existing sqlserverflex user
-import {
-  to = stackitprivatepreview_sqlserverflexalpha_user.import-example
-  id = "${var.project_id},${var.region},${var.sql_instance_id},${var.sql_user_id}"
-}
-```
-
-<!-- schema generated by tfplugindocs -->
-## Schema
-
-### Required
-
- `name` (String) The name of the database.
- `owner` (String) The owner of the database.
-
-### Optional
-
- `collation` (String) The collation of the database. This database collation should match the *collation_name* of one of the collations given by the **Get database collation list** endpoint.
- `compatibility` (Number) CompatibilityLevel of the Database.
- `database_name` (String) The name of the database.
- `instance_id` (String) The ID of the instance.
- `project_id` (String) The STACKIT project ID.
- `region` (String) The region which should be addressed
-
-### Read-Only
-
- `collation_name` (String) The collation of the database. This database collation should match the *collation_name* of one of the collations given by the **Get database collation list** endpoint.
- `compatibility_level` (Number) CompatibilityLevel of the Database.
- `id` (Number) The id of the database.
--- a/docs/resources/sqlserverflexbeta_instance.md
+++ b/docs/resources/sqlserverflexbeta_instance.md
@ -1,158 +0,0 @@
---
-# generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "stackitprivatepreview_sqlserverflexbeta_instance Resource - stackitprivatepreview"
-subcategory: ""
-description: |-
-  
---
-
-# stackitprivatepreview_sqlserverflexbeta_instance (Resource)
-
-
-
-## Example Usage
-
-```terraform
-# without encryption and SNA
-resource "stackitprivatepreview_sqlserverflexbeta_instance" "instance" {
-  project_id      = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-  name            = "example-instance"
-  backup_schedule = "0 3 * * *"
-  retention_days  = 31
-  flavor_id       = "flavor_id"
-  storage = {
-    class = "premium-perf2-stackit"
-    size  = 50
-  }
-  version = 2022
-  network = {
-    acl          = ["XXX.XXX.XXX.X/XX", "XX.XXX.XX.X/XX"]
-    access_scope = "SNA"
-  }
-}
-
-# without encryption and PUBLIC
-resource "stackitprivatepreview_sqlserverflexbeta_instance" "instance" {
-  project_id      = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-  name            = "example-instance"
-  backup_schedule = "0 3 * * *"
-  retention_days  = 31
-  flavor_id       = "flavor_id"
-  storage = {
-    class = "premium-perf2-stackit"
-    size  = 50
-  }
-  version = 2022
-  network = {
-    acl          = ["XXX.XXX.XXX.X/XX", "XX.XXX.XX.X/XX"]
-    access_scope = "PUBLIC"
-  }
-}
-
-# with encryption and SNA
-resource "stackitprivatepreview_sqlserverflexbeta_instance" "instance" {
-  project_id      = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-  name            = "example-instance"
-  backup_schedule = "0 3 * * *"
-  retention_days  = 31
-  flavor_id       = "flavor_id"
-  storage = {
-    class = "premium-perf2-stackit"
-    size  = 50
-  }
-  version = 2022
-  encryption = {
-    kek_key_id      = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-    kek_key_ring_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-    kek_key_version = 1
-    service_account = "service_account@email"
-  }
-  network = {
-    acl          = ["XXX.XXX.XXX.X/XX", "XX.XXX.XX.X/XX"]
-    access_scope = "SNA"
-  }
-}
-
-
-# Only use the import statement, if you want to import an existing sqlserverflex instance
-import {
-  to = stackitprivatepreview_sqlserverflexalpha_instance.import-example
-  id = "${var.project_id},${var.region},${var.sql_instance_id}"
-}
-
-# import with identity
-import {
-  to = stackitprivatepreview_sqlserverflexalpha_instance.import-example
-  identity = {
-    project_id  = var.project_id
-    region      = var.region
-    instance_id = var.sql_instance_id
-  }
-}
-```
-
-<!-- schema generated by tfplugindocs -->
-## Schema
-
-### Required
-
- `backup_schedule` (String) The schedule for on what time and how often the database backup will be created. The schedule is written as a cron schedule.
- `flavor_id` (String) The id of the instance flavor.
- `name` (String) The name of the instance.
- `network` (Attributes) the network configuration of the instance. (see [below for nested schema](#nestedatt--network))
- `retention_days` (Number) The days for how long the backup files should be stored before cleaned up. 30 to 365
- `storage` (Attributes) The object containing information about the storage size and class. (see [below for nested schema](#nestedatt--storage))
- `version` (String) The sqlserver version used for the instance.
-
-### Optional
-
- `encryption` (Attributes) this defines which key to use for storage encryption (see [below for nested schema](#nestedatt--encryption))
- `instance_id` (String) The ID of the instance.
- `project_id` (String) The STACKIT project ID.
- `region` (String) The region which should be addressed
-
-### Read-Only
-
- `edition` (String) Edition of the MSSQL server instance
- `id` (String) The ID of the instance.
- `is_deletable` (Boolean) Whether the instance can be deleted or not.
- `replicas` (Number) How many replicas the instance should have.
- `status` (String)
-
-<a id="nestedatt--network"></a>
-### Nested Schema for `network`
-
-Required:
-
- `acl` (List of String) List of IPV4 cidr.
-
-Optional:
-
- `access_scope` (String) The network access scope of the instance
-
-⚠️ **Note:** This feature is in private preview. Supplying this object is only permitted for enabled accounts. If your account does not have access, the request will be rejected.
-
-Read-Only:
-
- `instance_address` (String)
- `router_address` (String)
-
-
-<a id="nestedatt--storage"></a>
-### Nested Schema for `storage`
-
-Required:
-
- `class` (String) The storage class for the storage.
- `size` (Number) The storage size in Gigabytes.
-
-
-<a id="nestedatt--encryption"></a>
-### Nested Schema for `encryption`
-
-Required:
-
- `kek_key_id` (String) The key identifier
- `kek_key_ring_id` (String) The keyring identifier
- `kek_key_version` (String) The key version
- `service_account` (String)
--- a/docs/resources/sqlserverflexbeta_user.md
+++ b/docs/resources/sqlserverflexbeta_user.md
@ -1,53 +0,0 @@
---
-# generated by https://github.com/hashicorp/terraform-plugin-docs
-page_title: "stackitprivatepreview_sqlserverflexbeta_user Resource - stackitprivatepreview"
-subcategory: ""
-description: |-
-  
---
-
-# stackitprivatepreview_sqlserverflexbeta_user (Resource)
-
-
-
-## Example Usage
-
-```terraform
-resource "stackitprivatepreview_sqlserverflexalpha_user" "example" {
-  project_id  = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-  instance_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-  username    = "username"
-  roles       = ["role"]
-}
-
-# Only use the import statement, if you want to import an existing sqlserverflex user
-import {
-  to = stackitprivatepreview_sqlserverflexalpha_user.import-example
-  id = "${var.project_id},${var.region},${var.sql_instance_id},${var.sql_user_id}"
-}
-```
-
-<!-- schema generated by tfplugindocs -->
-## Schema
-
-### Required
-
- `roles` (List of String) A list containing the user roles for the instance. A list with the valid user roles can be retrieved using the List Roles endpoint.
- `username` (String) The name of the user.
-
-### Optional
-
- `default_database` (String) The default database for a user of the instance.
- `instance_id` (String) The ID of the instance.
- `project_id` (String) The STACKIT project ID.
- `region` (String) The region which should be addressed
- `user_id` (Number) The ID of the user.
-
-### Read-Only
-
- `host` (String) The host of the instance in which the user belongs to.
- `id` (Number) The ID of the user.
- `password` (String) The password for the user.
- `port` (Number) The port of the instance in which the user belongs to.
- `status` (String) The current status of the user.
- `uri` (String) The connection string for the user to the instance.
--- a/examples/data-sources/stackitprivatepreview_postgresflexalpha_flavor/data-source.tf
+++ b/examples/data-sources/stackitprivatepreview_postgresflexalpha_flavor/data-source.tf
@ -1,8 +0,0 @@
-data "stackitprivatepreview_postgresflexalpha_flavor" "flavor" {
-  project_id    = var.project_id
-  region        = var.region
-  cpu           = 4
-  ram           = 16
-  node_type     = "Single"
-  storage_class = "premium-perf2-stackit"
-}
--- a/examples/data-sources/stackitprivatepreview_sqlserverflexalpha_flavor/data-source.tf
+++ b/examples/data-sources/stackitprivatepreview_sqlserverflexalpha_flavor/data-source.tf
@ -1,8 +0,0 @@
-data "stackitprivatepreview_sqlserverflexalpha_flavor" "flavor" {
-  project_id    = var.project_id
-  region        = var.region
-  cpu           = 4
-  ram           = 16
-  node_type     = "Single"
-  storage_class = "premium-perf2-stackit"
-}
--- a/examples/data-sources/stackitprivatepreview_sqlserverflexbeta_database/data-source.tf
+++ b/examples/data-sources/stackitprivatepreview_sqlserverflexbeta_database/data-source.tf
@ -1,5 +0,0 @@
-data "stackitprivatepreview_sqlserverflexbeta_database" "example" {
-  project_id    = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-  instance_id   = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-  database_name = "dbname"
-}
--- a/examples/data-sources/stackitprivatepreview_sqlserverflexbeta_flavor/data-source.tf
+++ b/examples/data-sources/stackitprivatepreview_sqlserverflexbeta_flavor/data-source.tf
@ -1,8 +0,0 @@
-data "stackitprivatepreview_sqlserverflexbeta_flavor" "flavor" {
-  project_id    = var.project_id
-  region        = var.region
-  cpu           = 4
-  ram           = 16
-  node_type     = "Single"
-  storage_class = "premium-perf2-stackit"
-}
--- a/examples/data-sources/stackitprivatepreview_sqlserverflexbeta_instance/data-source.tf
+++ b/examples/data-sources/stackitprivatepreview_sqlserverflexbeta_instance/data-source.tf
@ -1,4 +0,0 @@
-data "stackitprivatepreview_sqlserverflexbeta_instance" "example" {
-  project_id  = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-  instance_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-}
--- a/examples/provider/provider.tf
+++ b/examples/provider/provider.tf
@ -2,13 +2,14 @@ provider "stackitprivatepreview" {
  default_region = "eu01"
 }

-provider "stackitprivatepreview" {
-  default_region           = "eu01"
-  service_account_key_path = "service_account.json"
-}
-
 # Authentication

+# Token flow (scheduled for deprecation and will be removed on December 17, 2025)
+provider "stackitprivatepreview" {
+  default_region        = "eu01"
+  service_account_token = var.service_account_token
+}
+
 # Key flow
 provider "stackitprivatepreview" {
  default_region      = "eu01"
@ -22,3 +23,4 @@ provider "stackitprivatepreview" {
  service_account_key_path = var.service_account_key_path
  private_key_path         = var.private_key_path
 }
+
--- a/examples/resources/stackitprivatepreview_postgresflexalpha_database/resource.tf
+++ b/examples/resources/stackitprivatepreview_postgresflexalpha_database/resource.tf
@ -9,14 +9,4 @@ resource "stackitprivatepreview_postgresflexalpha_database" "example" {
 import {
  to = stackitprivatepreview_postgresflexalpha_database.import-example
  id = "${var.project_id},${var.region},${var.postgres_instance_id},${var.postgres_database_id}"
-}
-
-import {
-  to = stackitprivatepreview_postgresflexalpha_database.import-example
-  identity = {
-    project_id  = "project_id"
-    region      = "region"
-    instance_id = "instance_id"
-    database_id = "database_id"
-  }
-}
+}
--- a/examples/resources/stackitprivatepreview_postgresflexalpha_instance/resource.tf
+++ b/examples/resources/stackitprivatepreview_postgresflexalpha_instance/resource.tf
@ -1,39 +1,22 @@
-resource "stackitprivatepreview_postgresflexalpha_instance" "example-instance" {
+resource "stackitprivatepreview_postgresflexalpha_instance" "example" {
  project_id      = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  name            = "example-instance"
  acl             = ["XXX.XXX.XXX.X/XX", "XX.XXX.XX.X/XX"]
-  backup_schedule = "0 0 * * *"
-  retention_days  = 30
-  flavor_id       = "flavor.id"
-  replicas        = 1
+  backup_schedule = "00 00 * * *"
+  flavor = {
+    cpu = 2
+    ram = 4
+  }
+  replicas = 3
  storage = {
-    performance_class = "premium-perf2-stackit"
-    size              = 10
+    class = "class"
+    size  = 5
  }
-  encryption = {
-    kek_key_id      = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-    kek_key_ring_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-    kek_key_version = 1
-    service_account = "service@account.email"
-  }
-  network = {
-    acl          = ["XXX.XXX.XXX.X/XX", "XX.XXX.XX.X/XX"]
-    access_scope = "PUBLIC"
-  }
-  version = 17
+  version = 14
 }

 # Only use the import statement, if you want to import an existing postgresflex instance
 import {
  to = stackitprivatepreview_postgresflexalpha_instance.import-example
  id = "${var.project_id},${var.region},${var.postgres_instance_id}"
-}
-
-import {
-  to = stackitprivatepreview_postgresflexalpha_instance.import-example
-  identity = {
-    project_id  = var.project_id
-    region      = var.region
-    instance_id = var.postgres_instance_id
-  }
-}
+}
--- a/examples/resources/stackitprivatepreview_postgresflexalpha_user/resource.tf
+++ b/examples/resources/stackitprivatepreview_postgresflexalpha_user/resource.tf
@ -1,7 +1,7 @@
 resource "stackitprivatepreview_postgresflexalpha_user" "example" {
  project_id  = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  instance_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-  name        = "username"
+  username    = "username"
  roles       = ["role"]
 }

@ -9,14 +9,4 @@ resource "stackitprivatepreview_postgresflexalpha_user" "example" {
 import {
  to = stackitprivatepreview_postgresflexalpha_user.import-example
  id = "${var.project_id},${var.region},${var.postgres_instance_id},${var.user_id}"
-}
-
-import {
-  to = stackitprivatepreview_postgresflexalpha_user.import-example
-  identity = {
-    project_id  = "project.id"
-    region      = "region"
-    instance_id = "instance.id"
-    user_id     = "user.id"
-  }
-}
+}
--- a/examples/resources/stackitprivatepreview_sqlserverflexalpha_database/resource.tf
+++ b/examples/resources/stackitprivatepreview_sqlserverflexalpha_database/resource.tf
@ -1,24 +0,0 @@
-resource "stackitprivatepreview_sqlserverflexalpha_database" "example" {
-  project_id    = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-  instance_id   = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-  collation     = ""
-  compatibility = "160"
-  name          = ""
-  owner         = ""
-}
-
-# Only use the import statement, if you want to import a existing sqlserverflex database
-import {
-  to = stackitprivatepreview_sqlserverflexalpha_database.import-example
-  id = "${var.project_id},${var.region},${var.sql_instance_id},${var.sql_user_id}"
-}
-
-import {
-  to = stackitprivatepreview_sqlserverflexalpha_database.import-example
-  identity = {
-    project_id  = "project.id"
-    region      = "region"
-    instance_id = "instance.id"
-    database_id = "database.id"
-  }
-}
--- a/examples/resources/stackitprivatepreview_sqlserverflexbeta_database/resource.tf
+++ b/examples/resources/stackitprivatepreview_sqlserverflexbeta_database/resource.tf
@ -1,12 +0,0 @@
-resource "stackitprivatepreview_sqlserverflexalpha_user" "example" {
-  project_id  = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-  instance_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-  username    = "username"
-  roles       = ["role"]
-}
-
-# Only use the import statement, if you want to import an existing sqlserverflex user
-import {
-  to = stackitprivatepreview_sqlserverflexalpha_user.import-example
-  id = "${var.project_id},${var.region},${var.sql_instance_id},${var.sql_user_id}"
-}
--- a/examples/resources/stackitprivatepreview_sqlserverflexbeta_instance/resource.tf
+++ b/examples/resources/stackitprivatepreview_sqlserverflexbeta_instance/resource.tf
@ -1,76 +0,0 @@
-# without encryption and SNA
-resource "stackitprivatepreview_sqlserverflexbeta_instance" "instance" {
-  project_id      = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-  name            = "example-instance"
-  backup_schedule = "0 3 * * *"
-  retention_days  = 31
-  flavor_id       = "flavor_id"
-  storage = {
-    class = "premium-perf2-stackit"
-    size  = 50
-  }
-  version = 2022
-  network = {
-    acl          = ["XXX.XXX.XXX.X/XX", "XX.XXX.XX.X/XX"]
-    access_scope = "SNA"
-  }
-}
-
-# without encryption and PUBLIC
-resource "stackitprivatepreview_sqlserverflexbeta_instance" "instance" {
-  project_id      = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-  name            = "example-instance"
-  backup_schedule = "0 3 * * *"
-  retention_days  = 31
-  flavor_id       = "flavor_id"
-  storage = {
-    class = "premium-perf2-stackit"
-    size  = 50
-  }
-  version = 2022
-  network = {
-    acl          = ["XXX.XXX.XXX.X/XX", "XX.XXX.XX.X/XX"]
-    access_scope = "PUBLIC"
-  }
-}
-
-# with encryption and SNA
-resource "stackitprivatepreview_sqlserverflexbeta_instance" "instance" {
-  project_id      = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-  name            = "example-instance"
-  backup_schedule = "0 3 * * *"
-  retention_days  = 31
-  flavor_id       = "flavor_id"
-  storage = {
-    class = "premium-perf2-stackit"
-    size  = 50
-  }
-  version = 2022
-  encryption = {
-    kek_key_id      = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-    kek_key_ring_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-    kek_key_version = 1
-    service_account = "service_account@email"
-  }
-  network = {
-    acl          = ["XXX.XXX.XXX.X/XX", "XX.XXX.XX.X/XX"]
-    access_scope = "SNA"
-  }
-}
-
-
-# Only use the import statement, if you want to import an existing sqlserverflex instance
-import {
-  to = stackitprivatepreview_sqlserverflexalpha_instance.import-example
-  id = "${var.project_id},${var.region},${var.sql_instance_id}"
-}
-
-# import with identity
-import {
-  to = stackitprivatepreview_sqlserverflexalpha_instance.import-example
-  identity = {
-    project_id  = var.project_id
-    region      = var.region
-    instance_id = var.sql_instance_id
-  }
-}
--- a/examples/resources/stackitprivatepreview_sqlserverflexbeta_user/resource.tf
+++ b/examples/resources/stackitprivatepreview_sqlserverflexbeta_user/resource.tf
@ -1,12 +0,0 @@
-resource "stackitprivatepreview_sqlserverflexalpha_user" "example" {
-  project_id  = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-  instance_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-  username    = "username"
-  roles       = ["role"]
-}
-
-# Only use the import statement, if you want to import an existing sqlserverflex user
-import {
-  to = stackitprivatepreview_sqlserverflexalpha_user.import-example
-  id = "${var.project_id},${var.region},${var.sql_instance_id},${var.sql_user_id}"
-}
--- a/generator/cmd/build/build.go
+++ b/generator/cmd/build/build.go
@ -1,341 +0,0 @@
-package build
-
-import (
-	"errors"
-	"fmt"
-	"go/ast"
-	"go/parser"
-	"go/token"
-	"log/slog"
-	"os"
-	"path"
-	"regexp"
-	"strings"
-
-	"tf-provider.git.onstackit.cloud/stackit-dev-tools/terraform-provider-stackitprivatepreview/generator/cmd/tools"
-)
-
-type Builder struct {
-	rootDir      string
-	SkipClone    bool
-	SkipCleanup  bool
-	PackagesOnly bool
-	Verbose      bool
-	Debug        bool
-}
-
-func (b *Builder) Build() error {
-	slog.Info("Starting Builder")
-	if b.PackagesOnly {
-		slog.Info("  >>> only generating pkg_gen <<<")
-	}
-
-	rootErr := b.determineRoot()
-	if rootErr != nil {
-		return rootErr
-	}
-
-	if !b.PackagesOnly {
-		if b.Verbose {
-			slog.Info("  ... Checking needed commands available")
-		}
-		chkErr := checkCommands([]string{})
-		if chkErr != nil {
-			return chkErr
-		}
-	}
-
-	// if !b.SkipCleanup {
-	//	slog.Info("Cleaning up old packages directory")
-	//	err := os.RemoveAll(path.Join(b.rootDir, "pkg_gen"))
-	//	if err != nil {
-	//		return err
-	//	}
-	//}
-	//
-	// if !b.SkipCleanup && !b.PackagesOnly {
-	//	slog.Info("Cleaning up old packages directory")
-	//	err := os.RemoveAll(path.Join(b.rootDir, "pkg_gen"))
-	//	if err != nil {
-	//		return err
-	//	}
-	//}
-
-	// slog.Info("Creating generator dir", "dir", fmt.Sprintf("%s/%s", *root, GEN_REPO_NAME))
-	// genDir := path.Join(*root, GEN_REPO_NAME)
-	// if !b.SkipClone {
-	//	err = createGeneratorDir(GEN_REPO, genDir, b.SkipClone)
-	//	if err != nil {
-	//		return err
-	//	}
-	//}
-
-	oasHandlerErr := b.oasHandler(path.Join(b.rootDir, "service_specs"))
-	if oasHandlerErr != nil {
-		return oasHandlerErr
-	}
-
-	// if !b.PackagesOnly {
-	//	slog.Info("Generating service boilerplate")
-	//	err = generateServiceFiles(*root, path.Join(*root, GEN_REPO_NAME))
-	//	if err != nil {
-	//		return err
-	//	}
-	//
-	//	slog.Info("Copying all service files")
-	//	err = CopyDirectory(
-	//		path.Join(*root, "generated", "internal", "services"),
-	//		path.Join(*root, "stackit", "internal", "services"),
-	//	)
-	//	if err != nil {
-	//		return err
-	//	}
-	//
-	//	err = createBoilerplate(*root, path.Join(*root, "stackit", "internal", "services"))
-	//	if err != nil {
-	//		return err
-	//	}
-	//}
-
-	// workaround to remove linter complain :D
-	if b.PackagesOnly && b.Verbose && b.SkipClone && b.SkipCleanup {
-		bpErr := createBoilerplate(b.rootDir, "boilerplate")
-		if bpErr != nil {
-			return bpErr
-		}
-	}
-
-	slog.Info("Done")
-	return nil
-}
-
-type templateData struct {
-	PackageName       string
-	PackageNameCamel  string
-	PackageNamePascal string
-	NameCamel         string
-	NamePascal        string
-	NameSnake         string
-	Fields            []string
-}
-
-func createBoilerplate(rootFolder, folder string) error {
-	services, err := os.ReadDir(folder)
-	if err != nil {
-		return err
-	}
-	for _, svc := range services {
-		if !svc.IsDir() {
-			continue
-		}
-		resources, err := os.ReadDir(path.Join(folder, svc.Name()))
-		if err != nil {
-			return err
-		}
-
-		var handleDS bool
-		var handleRes bool
-		var foundDS bool
-		var foundRes bool
-
-		for _, res := range resources {
-			if !res.IsDir() {
-				continue
-			}
-
-			resourceName := res.Name()
-
-			dsFile := path.Join(
-				folder,
-				svc.Name(),
-				res.Name(),
-				"datasources_gen",
-				fmt.Sprintf("%s_data_source_gen.go", res.Name()),
-			)
-			handleDS = FileExists(dsFile)
-
-			resFile := path.Join(
-				folder,
-				svc.Name(),
-				res.Name(),
-				"resources_gen",
-				fmt.Sprintf("%s_resource_gen.go", res.Name()),
-			)
-			handleRes = FileExists(resFile)
-
-			dsGoFile := path.Join(folder, svc.Name(), res.Name(), "datasource.go")
-			foundDS = FileExists(dsGoFile)
-
-			resGoFile := path.Join(folder, svc.Name(), res.Name(), "resource.go")
-			foundRes = FileExists(resGoFile)
-
-			if handleDS && !foundDS {
-				slog.Info("  creating missing datasource.go", "service", svc.Name(), "resource", resourceName)
-				if !ValidateSnakeCase(resourceName) {
-					return errors.New("resource name is invalid")
-				}
-
-				fields, tokenErr := getTokens(dsFile)
-				if tokenErr != nil {
-					return fmt.Errorf("error reading tokens: %w", tokenErr)
-				}
-
-				tplName := "data_source_scaffold.gotmpl"
-				err = writeTemplateToFile(
-					tplName,
-					path.Join(rootFolder, "cmd", "cmd", "build", "templates", tplName),
-					dsGoFile,
-					&templateData{
-						PackageName:       svc.Name(),
-						PackageNameCamel:  ToCamelCase(svc.Name()),
-						PackageNamePascal: ToPascalCase(svc.Name()),
-						NameCamel:         ToCamelCase(resourceName),
-						NamePascal:        ToPascalCase(resourceName),
-						NameSnake:         resourceName,
-						Fields:            fields,
-					},
-				)
-				if err != nil {
-					panic(err)
-				}
-			}
-
-			if handleRes && !foundRes {
-				slog.Info("  creating missing resource.go", "service", svc.Name(), "resource", resourceName)
-				if !ValidateSnakeCase(resourceName) {
-					return errors.New("resource name is invalid")
-				}
-
-				fields, tokenErr := getTokens(resFile)
-				if tokenErr != nil {
-					return fmt.Errorf("error reading tokens: %w", tokenErr)
-				}
-
-				tplName := "resource_scaffold.gotmpl"
-				err = writeTemplateToFile(
-					tplName,
-					path.Join(rootFolder, "cmd", "cmd", "build", "templates", tplName),
-					resGoFile,
-					&templateData{
-						PackageName:       svc.Name(),
-						PackageNameCamel:  ToCamelCase(svc.Name()),
-						PackageNamePascal: ToPascalCase(svc.Name()),
-						NameCamel:         ToCamelCase(resourceName),
-						NamePascal:        ToPascalCase(resourceName),
-						NameSnake:         resourceName,
-						Fields:            fields,
-					},
-				)
-				if err != nil {
-					return err
-				}
-
-				if !FileExists(path.Join(folder, svc.Name(), res.Name(), "functions.go")) {
-					slog.Info("  creating missing functions.go", "service", svc.Name(), "resource", resourceName)
-					if !ValidateSnakeCase(resourceName) {
-						return errors.New("resource name is invalid")
-					}
-					fncTplName := "functions_scaffold.gotmpl"
-					err = writeTemplateToFile(
-						fncTplName,
-						path.Join(rootFolder, "cmd", "cmd", "build", "templates", fncTplName),
-						path.Join(folder, svc.Name(), res.Name(), "functions.go"),
-						&templateData{
-							PackageName:       svc.Name(),
-							PackageNameCamel:  ToCamelCase(svc.Name()),
-							PackageNamePascal: ToPascalCase(svc.Name()),
-							NameCamel:         ToCamelCase(resourceName),
-							NamePascal:        ToPascalCase(resourceName),
-							NameSnake:         resourceName,
-						},
-					)
-					if err != nil {
-						return err
-					}
-				}
-			}
-		}
-	}
-	return nil
-}
-
-func handleLine(line string) (string, error) {
-	schemaRegex := regexp.MustCompile(`(\s+")(id)(": schema.[a-zA-Z0-9]+Attribute{)`)
-
-	schemaMatches := schemaRegex.FindAllStringSubmatch(line, -1)
-	if schemaMatches != nil {
-		return fmt.Sprintf("%stf_original_api_id%s", schemaMatches[0][1], schemaMatches[0][3]), nil
-	}
-
-	modelRegex := regexp.MustCompile(`(\s+Id\s+types.[a-zA-Z0-9]+\s+.tfsdk:")(id)(".)`)
-	modelMatches := modelRegex.FindAllStringSubmatch(line, -1)
-	if modelMatches != nil {
-		return fmt.Sprintf("%stf_original_api_id%s", modelMatches[0][1], modelMatches[0][3]), nil
-	}
-
-	return line, nil
-}
-
-func (b *Builder) determineRoot() error {
-	root, err := tools.GetGitRoot()
-	if err != nil {
-		return err
-	}
-	b.rootDir = root
-	if b.Verbose {
-		slog.Info("  ... using root", "dir", b.rootDir)
-	}
-	return nil
-}
-
-// func createGeneratorDir(repoUrl, targetDir string, skipClone bool) error {
-//	if !skipClone {
-//		if FileExists(targetDir) {
-//			remErr := os.RemoveAll(targetDir)
-//			if remErr != nil {
-//				return remErr
-//			}
-//		}