diff --git a/docs/data-sources/landingzone.md b/docs/data-sources/landingzone.md
index 0c25556..b66100a 100644
--- a/docs/data-sources/landingzone.md
+++ b/docs/data-sources/landingzone.md
@@ -111,16 +111,16 @@ Optional:
 - `aws_lambda_arn` (String) If provided, it is invoked after each project replication. You can use it to trigger a custom Account Vending Machine to perform several additional provisioning steps.
 
 <a id="nestedatt--spec--platform_properties--aws--aws_role_mappings"></a>
-### Nested Schema for `spec.platform_properties.aws.aws_lambda_arn`
+### Nested Schema for `spec.platform_properties.aws.aws_role_mappings`
 
 Required:
 
 - `platform_role` (String) The AWS platform role
 - `policies` (List of String) List of policies associated with this role mapping
-- `project_role_ref` (Attributes) the meshProject role (see [below for nested schema](#nestedatt--spec--platform_properties--aws--aws_lambda_arn--project_role_ref))
+- `project_role_ref` (Attributes) the meshProject role (see [below for nested schema](#nestedatt--spec--platform_properties--aws--aws_role_mappings--project_role_ref))
 
-<a id="nestedatt--spec--platform_properties--aws--aws_lambda_arn--project_role_ref"></a>
-### Nested Schema for `spec.platform_properties.aws.aws_lambda_arn.project_role_ref`
+<a id="nestedatt--spec--platform_properties--aws--aws_role_mappings--project_role_ref"></a>
+### Nested Schema for `spec.platform_properties.aws.aws_role_mappings.project_role_ref`
 
 Required:
 
@@ -189,16 +189,16 @@ Optional:
 - `azure_function` (Attributes) Assign an Azure function to the Landing Zone configuration to trigger a small piece of code in the cloud. (see [below for nested schema](#nestedatt--spec--platform_properties--azurerg--azure_function))
 
 <a id="nestedatt--spec--platform_properties--azurerg--azure_rg_role_mappings"></a>
-### Nested Schema for `spec.platform_properties.azurerg.azure_function`
+### Nested Schema for `spec.platform_properties.azurerg.azure_rg_role_mappings`
 
 Required:
 
 - `azure_group_suffix` (String) The given role name will be injected into the group name via the group naming pattern configured on the platform instance.
 - `azure_role_definition_ids` (List of String) Role Definitions with the given IDs will be attached to this Azure Role.
-- `project_role_ref` (Attributes) the meshProject role (see [below for nested schema](#nestedatt--spec--platform_properties--azurerg--azure_function--project_role_ref))
+- `project_role_ref` (Attributes) the meshProject role (see [below for nested schema](#nestedatt--spec--platform_properties--azurerg--azure_rg_role_mappings--project_role_ref))
 
-<a id="nestedatt--spec--platform_properties--azurerg--azure_function--project_role_ref"></a>
-### Nested Schema for `spec.platform_properties.azurerg.azure_function.project_role_ref`
+<a id="nestedatt--spec--platform_properties--azurerg--azure_rg_role_mappings--project_role_ref"></a>
+### Nested Schema for `spec.platform_properties.azurerg.azure_rg_role_mappings.project_role_ref`
 
 Required:
 
@@ -233,15 +233,15 @@ Optional:
 - `gcp_folder_id` (String) Google Cloud Projects will be added to this Google Cloud Folder. This allows applying Organization Policies to all projects managed under this Landing Zone.
 
 <a id="nestedatt--spec--platform_properties--gcp--gcp_role_mappings"></a>
-### Nested Schema for `spec.platform_properties.gcp.gcp_folder_id`
+### Nested Schema for `spec.platform_properties.gcp.gcp_role_mappings`
 
 Required:
 
 - `platform_roles` (List of String) Can be empty. List of GCP IAM roles to assign to the meshProject role.
-- `project_role_ref` (Attributes) the meshProject role (see [below for nested schema](#nestedatt--spec--platform_properties--gcp--gcp_folder_id--project_role_ref))
+- `project_role_ref` (Attributes) the meshProject role (see [below for nested schema](#nestedatt--spec--platform_properties--gcp--gcp_role_mappings--project_role_ref))
 
-<a id="nestedatt--spec--platform_properties--gcp--gcp_folder_id--project_role_ref"></a>
-### Nested Schema for `spec.platform_properties.gcp.gcp_folder_id.project_role_ref`
+<a id="nestedatt--spec--platform_properties--gcp--gcp_role_mappings--project_role_ref"></a>
+### Nested Schema for `spec.platform_properties.gcp.gcp_role_mappings.project_role_ref`
 
 Required:
 
diff --git a/docs/data-sources/platform.md b/docs/data-sources/platform.md
index 61ccec7..432df81 100644
--- a/docs/data-sources/platform.md
+++ b/docs/data-sources/platform.md
@@ -166,7 +166,7 @@ Read-Only:
 - `workload_identity_config` (Attributes) Workload identity configuration (alternative to `service_user_config`) (see [below for nested schema](#nestedatt--spec--config--aws--replication--access_config--workload_identity_config))
 
 <a id="nestedatt--spec--config--aws--replication--access_config--service_user_config"></a>
-### Nested Schema for `spec.config.aws.replication.access_config.workload_identity_config`
+### Nested Schema for `spec.config.aws.replication.access_config.service_user_config`
 
 Read-Only:
 
@@ -196,11 +196,11 @@ Read-Only:
 - `sso_access_token` (String) The AWS IAM Identity Center SCIM Access Token that was generated via the Automatic provisioning config in AWS IAM Identity Center.
 
 <a id="nestedatt--spec--config--aws--replication--aws_sso--aws_role_mappings"></a>
-### Nested Schema for `spec.config.aws.replication.aws_sso.sso_access_token`
+### Nested Schema for `spec.config.aws.replication.aws_sso.aws_role_mappings`
 
 Required:
 
-- `project_role_ref` (Attributes) the meshProject role (see [below for nested schema](#nestedatt--spec--config--aws--replication--aws_sso--sso_access_token--project_role_ref))
+- `project_role_ref` (Attributes) the meshProject role (see [below for nested schema](#nestedatt--spec--config--aws--replication--aws_sso--aws_role_mappings--project_role_ref))
 
 Optional:
 
@@ -210,8 +210,8 @@ Read-Only:
 
 - `aws_role` (String) The AWS role name
 
-<a id="nestedatt--spec--config--aws--replication--aws_sso--sso_access_token--project_role_ref"></a>
-### Nested Schema for `spec.config.aws.replication.aws_sso.sso_access_token.aws_role`
+<a id="nestedatt--spec--config--aws--replication--aws_sso--aws_role_mappings--project_role_ref"></a>
+### Nested Schema for `spec.config.aws.replication.aws_sso.aws_role_mappings.project_role_ref`
 
 Required:
 
@@ -292,7 +292,7 @@ Read-Only:
 - `azure_role` (Attributes) The Azure role definition. (see [below for nested schema](#nestedatt--spec--config--azure--replication--azure_role_mappings--azure_role))
 
 <a id="nestedatt--spec--config--azure--replication--azure_role_mappings--project_role_ref"></a>
-### Nested Schema for `spec.config.azure.replication.azure_role_mappings.azure_role`
+### Nested Schema for `spec.config.azure.replication.azure_role_mappings.project_role_ref`
 
 Required:
 
@@ -333,18 +333,18 @@ Read-Only:
 - `subscription_owner_object_ids` (List of String) One or more principals Object IDs (e.g. user groups, SPNs) that meshStack will ensure have an 'Owner' role assignment on the managed subscriptions. This can be useful to satisfy Azure's constraint of at least one direct 'Owner' role assignment per Subscription. If you want to use a Service Principal please use the Enterprise Application Object ID. You can not use the replicator object ID here, because meshStack always removes its high privilege access after a Subscription creation.
 
 <a id="nestedatt--spec--config--azure--replication--provisioning--customer_agreement"></a>
-### Nested Schema for `spec.config.azure.replication.provisioning.subscription_owner_object_ids`
+### Nested Schema for `spec.config.azure.replication.provisioning.customer_agreement`
 
 Read-Only:
 
 - `billing_scope` (String) ID of the MCA Billing Scope used for creating subscriptions. Must follow this format: `/providers/Microsoft.Billing/billingAccounts/$accountId/billingProfiles/$profileId/invoiceSections/$sectionId`.
 - `destination_entra_id` (String) Microsoft Entra ID Tenant UUID where created subscriptions should be moved. Set this to the Microsoft Entra ID Tenant hosting your landing zones.
 - `source_entra_tenant` (String) Microsoft Entra ID Tenant UUID or domain name used for creating subscriptions. Set this to the Microsoft Entra ID Tenant owning the MCA Billing Scope. If source and destination Microsoft Entra ID Tenants are the same, you need to use UUID.
-- `source_service_principal` (Attributes) Configure the SPN used by meshStack to create a new Subscription in your MCA billing scope. For more information on the required permissions, see the [Azure docs](https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/programmatically-create-subscription-microsoft-customer-agreement-across-tenants). (see [below for nested schema](#nestedatt--spec--config--azure--replication--provisioning--subscription_owner_object_ids--source_service_principal))
+- `source_service_principal` (Attributes) Configure the SPN used by meshStack to create a new Subscription in your MCA billing scope. For more information on the required permissions, see the [Azure docs](https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/programmatically-create-subscription-microsoft-customer-agreement-across-tenants). (see [below for nested schema](#nestedatt--spec--config--azure--replication--provisioning--customer_agreement--source_service_principal))
 - `subscription_creation_error_cooldown_sec` (Number) This value must be defined in seconds. It is a safety mechanism to avoid duplicate Subscription creation in case of an error on Azure's MCA API. This delay should be a bit higher than it usually takes to create subscriptions. For big installations this is somewhere between 5-15 minutes. The default of 900s should be fine for most installations.
 
-<a id="nestedatt--spec--config--azure--replication--provisioning--subscription_owner_object_ids--source_service_principal"></a>
-### Nested Schema for `spec.config.azure.replication.provisioning.subscription_owner_object_ids.subscription_creation_error_cooldown_sec`
+<a id="nestedatt--spec--config--azure--replication--provisioning--customer_agreement--source_service_principal"></a>
+### Nested Schema for `spec.config.azure.replication.provisioning.customer_agreement.source_service_principal`
 
 Read-Only:
 
@@ -355,7 +355,7 @@ Read-Only:
 
 
 <a id="nestedatt--spec--config--azure--replication--provisioning--enterprise_enrollment"></a>
-### Nested Schema for `spec.config.azure.replication.provisioning.subscription_owner_object_ids`
+### Nested Schema for `spec.config.azure.replication.provisioning.enterprise_enrollment`
 
 Read-Only:
 
@@ -366,7 +366,7 @@ Read-Only:
 
 
 <a id="nestedatt--spec--config--azure--replication--provisioning--pre_provisioned"></a>
-### Nested Schema for `spec.config.azure.replication.provisioning.subscription_owner_object_ids`
+### Nested Schema for `spec.config.azure.replication.provisioning.pre_provisioned`
 
 Read-Only:
 
@@ -506,7 +506,7 @@ Read-Only:
 - `gcp_role` (String) The GCP IAM role
 
 <a id="nestedatt--spec--config--gcp--replication--gcp_role_mappings--project_role_ref"></a>
-### Nested Schema for `spec.config.gcp.replication.gcp_role_mappings.gcp_role`
+### Nested Schema for `spec.config.gcp.replication.gcp_role_mappings.project_role_ref`
 
 Required:
 
@@ -527,7 +527,7 @@ Read-Only:
 - `service_account_workload_identity_config` (Attributes) Service account workload identity configuration (alternative to serviceAccountCredentialsConfig) (see [below for nested schema](#nestedatt--spec--config--gcp--replication--service_account_config--service_account_workload_identity_config))
 
 <a id="nestedatt--spec--config--gcp--replication--service_account_config--service_account_credentials_config"></a>
-### Nested Schema for `spec.config.gcp.replication.service_account_config.service_account_workload_identity_config`
+### Nested Schema for `spec.config.gcp.replication.service_account_config.service_account_credentials_config`
 
 Read-Only:
 
@@ -633,7 +633,7 @@ Read-Only:
 - `openshift_role` (String) The OpenShift role name
 
 <a id="nestedatt--spec--config--openshift--replication--openshift_role_mappings--project_role_ref"></a>
-### Nested Schema for `spec.config.openshift.replication.openshift_role_mappings.openshift_role`
+### Nested Schema for `spec.config.openshift.replication.openshift_role_mappings.project_role_ref`
 
 Required:
 
diff --git a/docs/data-sources/tag_definition.md b/docs/data-sources/tag_definition.md
index bbb69c3..c38e2a2 100644
--- a/docs/data-sources/tag_definition.md
+++ b/docs/data-sources/tag_definition.md
@@ -75,7 +75,7 @@ Read-Only:
 - `string` (Attributes) string, represented as JSON string (see [below for nested schema](#nestedatt--tag_definition--spec--value_type--string))
 
 <a id="nestedatt--tag_definition--spec--value_type--email"></a>
-### Nested Schema for `tag_definition.spec.value_type.string`
+### Nested Schema for `tag_definition.spec.value_type.email`
 
 Read-Only:
 
@@ -84,7 +84,7 @@ Read-Only:
 
 
 <a id="nestedatt--tag_definition--spec--value_type--integer"></a>
-### Nested Schema for `tag_definition.spec.value_type.string`
+### Nested Schema for `tag_definition.spec.value_type.integer`
 
 Read-Only:
 
@@ -92,7 +92,7 @@ Read-Only:
 
 
 <a id="nestedatt--tag_definition--spec--value_type--multi_select"></a>
-### Nested Schema for `tag_definition.spec.value_type.string`
+### Nested Schema for `tag_definition.spec.value_type.multi_select`
 
 Read-Only:
 
@@ -101,7 +101,7 @@ Read-Only:
 
 
 <a id="nestedatt--tag_definition--spec--value_type--number"></a>
-### Nested Schema for `tag_definition.spec.value_type.string`
+### Nested Schema for `tag_definition.spec.value_type.number`
 
 Read-Only:
 
@@ -109,7 +109,7 @@ Read-Only:
 
 
 <a id="nestedatt--tag_definition--spec--value_type--single_select"></a>
-### Nested Schema for `tag_definition.spec.value_type.string`
+### Nested Schema for `tag_definition.spec.value_type.single_select`
 
 Read-Only:
 
diff --git a/docs/data-sources/tag_definitions.md b/docs/data-sources/tag_definitions.md
index 3e0152e..ae44ece 100644
--- a/docs/data-sources/tag_definitions.md
+++ b/docs/data-sources/tag_definitions.md
@@ -71,7 +71,7 @@ Read-Only:
 - `string` (Attributes) string, represented as JSON string (see [below for nested schema](#nestedatt--tag_definitions--spec--value_type--string))
 
 <a id="nestedatt--tag_definitions--spec--value_type--email"></a>
-### Nested Schema for `tag_definitions.spec.value_type.string`
+### Nested Schema for `tag_definitions.spec.value_type.email`
 
 Read-Only:
 
@@ -80,7 +80,7 @@ Read-Only:
 
 
 <a id="nestedatt--tag_definitions--spec--value_type--integer"></a>
-### Nested Schema for `tag_definitions.spec.value_type.string`
+### Nested Schema for `tag_definitions.spec.value_type.integer`
 
 Read-Only:
 
@@ -88,7 +88,7 @@ Read-Only:
 
 
 <a id="nestedatt--tag_definitions--spec--value_type--multi_select"></a>
-### Nested Schema for `tag_definitions.spec.value_type.string`
+### Nested Schema for `tag_definitions.spec.value_type.multi_select`
 
 Read-Only:
 
@@ -97,7 +97,7 @@ Read-Only:
 
 
 <a id="nestedatt--tag_definitions--spec--value_type--number"></a>
-### Nested Schema for `tag_definitions.spec.value_type.string`
+### Nested Schema for `tag_definitions.spec.value_type.number`
 
 Read-Only:
 
@@ -105,7 +105,7 @@ Read-Only:
 
 
 <a id="nestedatt--tag_definitions--spec--value_type--single_select"></a>
-### Nested Schema for `tag_definitions.spec.value_type.string`
+### Nested Schema for `tag_definitions.spec.value_type.single_select`
 
 Read-Only:
 
diff --git a/docs/resources/landingzone.md b/docs/resources/landingzone.md
index 17d09f3..56f2208 100644
--- a/docs/resources/landingzone.md
+++ b/docs/resources/landingzone.md
@@ -114,16 +114,16 @@ Optional:
 - `aws_lambda_arn` (String) If provided, it is invoked after each project replication. You can use it to trigger a custom Account Vending Machine to perform several additional provisioning steps.
 
 <a id="nestedatt--spec--platform_properties--aws--aws_role_mappings"></a>
-### Nested Schema for `spec.platform_properties.aws.aws_lambda_arn`
+### Nested Schema for `spec.platform_properties.aws.aws_role_mappings`
 
 Required:
 
 - `platform_role` (String) The AWS platform role
 - `policies` (List of String) List of policies associated with this role mapping
-- `project_role_ref` (Attributes) the meshProject role (see [below for nested schema](#nestedatt--spec--platform_properties--aws--aws_lambda_arn--project_role_ref))
+- `project_role_ref` (Attributes) the meshProject role (see [below for nested schema](#nestedatt--spec--platform_properties--aws--aws_role_mappings--project_role_ref))
 
-<a id="nestedatt--spec--platform_properties--aws--aws_lambda_arn--project_role_ref"></a>
-### Nested Schema for `spec.platform_properties.aws.aws_lambda_arn.project_role_ref`
+<a id="nestedatt--spec--platform_properties--aws--aws_role_mappings--project_role_ref"></a>
+### Nested Schema for `spec.platform_properties.aws.aws_role_mappings.project_role_ref`
 
 Required:
 
@@ -192,16 +192,16 @@ Optional:
 - `azure_function` (Attributes) Assign an Azure function to the Landing Zone configuration to trigger a small piece of code in the cloud. (see [below for nested schema](#nestedatt--spec--platform_properties--azurerg--azure_function))
 
 <a id="nestedatt--spec--platform_properties--azurerg--azure_rg_role_mappings"></a>
-### Nested Schema for `spec.platform_properties.azurerg.azure_function`
+### Nested Schema for `spec.platform_properties.azurerg.azure_rg_role_mappings`
 
 Required:
 
 - `azure_group_suffix` (String) The given role name will be injected into the group name via the group naming pattern configured on the platform instance.
 - `azure_role_definition_ids` (List of String) Role Definitions with the given IDs will be attached to this Azure Role.
-- `project_role_ref` (Attributes) the meshProject role (see [below for nested schema](#nestedatt--spec--platform_properties--azurerg--azure_function--project_role_ref))
+- `project_role_ref` (Attributes) the meshProject role (see [below for nested schema](#nestedatt--spec--platform_properties--azurerg--azure_rg_role_mappings--project_role_ref))
 
-<a id="nestedatt--spec--platform_properties--azurerg--azure_function--project_role_ref"></a>
-### Nested Schema for `spec.platform_properties.azurerg.azure_function.project_role_ref`
+<a id="nestedatt--spec--platform_properties--azurerg--azure_rg_role_mappings--project_role_ref"></a>
+### Nested Schema for `spec.platform_properties.azurerg.azure_rg_role_mappings.project_role_ref`
 
 Required:
 
@@ -236,15 +236,15 @@ Optional:
 - `gcp_folder_id` (String) Google Cloud Projects will be added to this Google Cloud Folder. This allows applying Organization Policies to all projects managed under this Landing Zone.
 
 <a id="nestedatt--spec--platform_properties--gcp--gcp_role_mappings"></a>
-### Nested Schema for `spec.platform_properties.gcp.gcp_folder_id`
+### Nested Schema for `spec.platform_properties.gcp.gcp_role_mappings`
 
 Required:
 
 - `platform_roles` (List of String) Can be empty. List of GCP IAM roles to assign to the meshProject role.
-- `project_role_ref` (Attributes) the meshProject role (see [below for nested schema](#nestedatt--spec--platform_properties--gcp--gcp_folder_id--project_role_ref))
+- `project_role_ref` (Attributes) the meshProject role (see [below for nested schema](#nestedatt--spec--platform_properties--gcp--gcp_role_mappings--project_role_ref))
 
-<a id="nestedatt--spec--platform_properties--gcp--gcp_folder_id--project_role_ref"></a>
-### Nested Schema for `spec.platform_properties.gcp.gcp_folder_id.project_role_ref`
+<a id="nestedatt--spec--platform_properties--gcp--gcp_role_mappings--project_role_ref"></a>
+### Nested Schema for `spec.platform_properties.gcp.gcp_role_mappings.project_role_ref`
 
 Required:
 
diff --git a/docs/resources/platform.md b/docs/resources/platform.md
index d9d4e21..7d28cba 100644
--- a/docs/resources/platform.md
+++ b/docs/resources/platform.md
@@ -308,7 +308,7 @@ Optional:
 - `workload_identity_config` (Attributes) Workload identity configuration (alternative to `service_user_config`) (see [below for nested schema](#nestedatt--spec--config--aws--replication--access_config--workload_identity_config))
 
 <a id="nestedatt--spec--config--aws--replication--access_config--service_user_config"></a>
-### Nested Schema for `spec.config.aws.replication.access_config.workload_identity_config`
+### Nested Schema for `spec.config.aws.replication.access_config.service_user_config`
 
 Required:
 
@@ -344,19 +344,19 @@ Optional:
 - `sso_access_token` (String, Sensitive) The AWS IAM Identity Center SCIM Access Token that was generated via the Automatic provisioning config in AWS IAM Identity Center.
 
 <a id="nestedatt--spec--config--aws--replication--aws_sso--aws_role_mappings"></a>
-### Nested Schema for `spec.config.aws.replication.aws_sso.sso_access_token`
+### Nested Schema for `spec.config.aws.replication.aws_sso.aws_role_mappings`
 
 Required:
 
 - `aws_role` (String) The AWS role name
-- `project_role_ref` (Attributes) the meshProject role (see [below for nested schema](#nestedatt--spec--config--aws--replication--aws_sso--sso_access_token--project_role_ref))
+- `project_role_ref` (Attributes) the meshProject role (see [below for nested schema](#nestedatt--spec--config--aws--replication--aws_sso--aws_role_mappings--project_role_ref))
 
 Optional:
 
 - `permission_set_arns` (List of String) List of permission set ARNs associated with this role mapping
 
-<a id="nestedatt--spec--config--aws--replication--aws_sso--sso_access_token--project_role_ref"></a>
-### Nested Schema for `spec.config.aws.replication.aws_sso.sso_access_token.permission_set_arns`
+<a id="nestedatt--spec--config--aws--replication--aws_sso--aws_role_mappings--project_role_ref"></a>
+### Nested Schema for `spec.config.aws.replication.aws_sso.aws_role_mappings.project_role_ref`
 
 Required:
 
@@ -437,7 +437,7 @@ Required:
 - `project_role_ref` (Attributes) the meshProject role (see [below for nested schema](#nestedatt--spec--config--azure--replication--azure_role_mappings--project_role_ref))
 
 <a id="nestedatt--spec--config--azure--replication--azure_role_mappings--azure_role"></a>
-### Nested Schema for `spec.config.azure.replication.azure_role_mappings.project_role_ref`
+### Nested Schema for `spec.config.azure.replication.azure_role_mappings.azure_role`
 
 Required:
 
@@ -478,7 +478,7 @@ Optional:
 - `subscription_owner_object_ids` (List of String) One or more principals Object IDs (e.g. user groups, SPNs) that meshStack will ensure have an 'Owner' role assignment on the managed subscriptions. This can be useful to satisfy Azure’s constraint of at least one direct 'Owner' role assignment per Subscription. If you want to use a Service Principal please use the Enterprise Application Object ID. You can not use the replicator object ID here, because meshStack always removes its high privilege access after a Subscription creation.
 
 <a id="nestedatt--spec--config--azure--replication--provisioning--customer_agreement"></a>
-### Nested Schema for `spec.config.azure.replication.provisioning.subscription_owner_object_ids`
+### Nested Schema for `spec.config.azure.replication.provisioning.customer_agreement`
 
 Required:
 
@@ -488,11 +488,11 @@ Required:
 
 Optional:
 
-- `source_service_principal` (Attributes) Configure the SPN used by meshStack to create a new Subscription in your MCA billing scope. For more information on the required permissions, see the [Azure docs](https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/programmatically-create-subscription-microsoft-customer-agreement-across-tenants). (see [below for nested schema](#nestedatt--spec--config--azure--replication--provisioning--subscription_owner_object_ids--source_service_principal))
+- `source_service_principal` (Attributes) Configure the SPN used by meshStack to create a new Subscription in your MCA billing scope. For more information on the required permissions, see the [Azure docs](https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/programmatically-create-subscription-microsoft-customer-agreement-across-tenants). (see [below for nested schema](#nestedatt--spec--config--azure--replication--provisioning--customer_agreement--source_service_principal))
 - `subscription_creation_error_cooldown_sec` (Number) This value must be defined in seconds. It is a safety mechanism to avoid duplicate Subscription creation in case of an error on Azure’s MCA API. This delay should be a bit higher than it usually takes to create subscriptions. For big installations this is somewhere between 5-15 minutes. The default of 900s should be fine for most installations.
 
-<a id="nestedatt--spec--config--azure--replication--provisioning--subscription_owner_object_ids--source_service_principal"></a>
-### Nested Schema for `spec.config.azure.replication.provisioning.subscription_owner_object_ids.subscription_creation_error_cooldown_sec`
+<a id="nestedatt--spec--config--azure--replication--provisioning--customer_agreement--source_service_principal"></a>
+### Nested Schema for `spec.config.azure.replication.provisioning.customer_agreement.source_service_principal`
 
 Required:
 
@@ -506,7 +506,7 @@ Optional:
 
 
 <a id="nestedatt--spec--config--azure--replication--provisioning--enterprise_enrollment"></a>
-### Nested Schema for `spec.config.azure.replication.provisioning.subscription_owner_object_ids`
+### Nested Schema for `spec.config.azure.replication.provisioning.enterprise_enrollment`
 
 Required:
 
@@ -520,7 +520,7 @@ Optional:
 
 
 <a id="nestedatt--spec--config--azure--replication--provisioning--pre_provisioned"></a>
-### Nested Schema for `spec.config.azure.replication.provisioning.subscription_owner_object_ids`
+### Nested Schema for `spec.config.azure.replication.provisioning.pre_provisioned`
 
 Required:
 
@@ -690,7 +690,7 @@ Optional:
 - `service_account_workload_identity_config` (Attributes) Service account workload identity configuration (alternative to serviceAccountCredentialsConfig) (see [below for nested schema](#nestedatt--spec--config--gcp--replication--service_account_config--service_account_workload_identity_config))
 
 <a id="nestedatt--spec--config--gcp--replication--service_account_config--service_account_credentials_config"></a>
-### Nested Schema for `spec.config.gcp.replication.service_account_config.service_account_workload_identity_config`
+### Nested Schema for `spec.config.gcp.replication.service_account_config.service_account_credentials_config`
 
 Optional:
 
@@ -847,6 +847,8 @@ Read-Only:
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 # import via platform uuid (= meshStack Platform ID)
 terraform import meshstack_platform.example 09631015-0f06-4f6a-b459-03047fbd89d1
diff --git a/docs/resources/project.md b/docs/resources/project.md
index 0449f08..42e4241 100644
--- a/docs/resources/project.md
+++ b/docs/resources/project.md
@@ -76,6 +76,8 @@ Optional:
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 # import via full project identifier <workspace-identifier>.<project-identifier>
 terraform import 'meshstack_project.example' 'my-workspace-identifier.my-project-identifier'
diff --git a/docs/resources/project_group_binding.md b/docs/resources/project_group_binding.md
index 0dde0ba..aa1ed6c 100644
--- a/docs/resources/project_group_binding.md
+++ b/docs/resources/project_group_binding.md
@@ -84,6 +84,8 @@ Required:
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 # import via project binding name
 terraform import 'meshstack_project_user_binding.example' 'my-binding-name'
diff --git a/docs/resources/project_user_binding.md b/docs/resources/project_user_binding.md
index 0766e29..709f239 100644
--- a/docs/resources/project_user_binding.md
+++ b/docs/resources/project_user_binding.md
@@ -84,6 +84,8 @@ Required:
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 # import via project binding name
 terraform import 'meshstack_project_user_binding.example' 'my-binding-name'
diff --git a/docs/resources/tag_definition.md b/docs/resources/tag_definition.md
index f5fbac7..b7392ba 100644
--- a/docs/resources/tag_definition.md
+++ b/docs/resources/tag_definition.md
@@ -150,6 +150,8 @@ Read-Only:
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 # import via tag definition name
 terraform import 'meshstack_tag_definition.example' 'target_kind.key'
diff --git a/docs/resources/tenant.md b/docs/resources/tenant.md
index 7d4a8cf..d5227fe 100644
--- a/docs/resources/tenant.md
+++ b/docs/resources/tenant.md
@@ -82,6 +82,8 @@ Read-Only:
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 # import via full tenant identifier <workspace-identifier>.<project-identifier>.<full-platform-identifier>
 terraform import 'meshstack_tenant.example' 'my-workspace-identifier.my-project-identifier.my-platform-identifier'
diff --git a/docs/resources/tenant_v4.md b/docs/resources/tenant_v4.md
index 98b7c68..17a86a8 100644
--- a/docs/resources/tenant_v4.md
+++ b/docs/resources/tenant_v4.md
@@ -116,6 +116,8 @@ Read-Only:
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 # import via uuid
 terraform import 'meshstack_tenant_v4.example' '00000000-0000-0000-0000-000000000000'
diff --git a/docs/resources/workspace.md b/docs/resources/workspace.md
index 7723622..3f4cee2 100644
--- a/docs/resources/workspace.md
+++ b/docs/resources/workspace.md
@@ -76,6 +76,8 @@ Optional:
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 # import via workspace identifier
 terraform import meshstack_workspace.example my-workspace-identifier
diff --git a/docs/resources/workspace_group_binding.md b/docs/resources/workspace_group_binding.md
index 5b7d1fd..419d170 100644
--- a/docs/resources/workspace_group_binding.md
+++ b/docs/resources/workspace_group_binding.md
@@ -82,6 +82,8 @@ Required:
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 # import via workspace binding name
 terraform import 'meshstack_workspace_group_binding.example' 'my-binding-name'
diff --git a/docs/resources/workspace_user_binding.md b/docs/resources/workspace_user_binding.md
index 662f4e2..b526b6d 100644
--- a/docs/resources/workspace_user_binding.md
+++ b/docs/resources/workspace_user_binding.md
@@ -82,6 +82,8 @@ Required:
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 # import via workspace binding name
 terraform import 'meshstack_workspace_user_binding.example' 'my-binding-name'
diff --git a/go.mod b/go.mod
index 7e54771..8243930 100644
--- a/go.mod
+++ b/go.mod
@@ -1,11 +1,9 @@
 module github.com/meshcloud/terraform-provider-meshstack
 
-go 1.23.0
-
-toolchain go1.23.12
+go 1.24.0
 
 require (
-	github.com/hashicorp/terraform-plugin-docs v0.16.0
+	github.com/hashicorp/terraform-plugin-docs v0.24.0
 	github.com/hashicorp/terraform-plugin-framework v1.15.1
 	github.com/hashicorp/terraform-plugin-framework-validators v0.12.0
 	github.com/hashicorp/terraform-plugin-go v0.27.0
@@ -13,6 +11,8 @@ require (
 )
 
 require (
+	github.com/BurntSushi/toml v1.2.1 // indirect
+	github.com/Kunde21/markdownfmt/v3 v3.1.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.2.0 // indirect
 	github.com/Masterminds/sprig/v3 v3.2.3 // indirect
@@ -20,10 +20,12 @@ require (
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
 	github.com/armon/go-radix v1.0.0 // indirect
 	github.com/bgentry/speakeasy v0.1.0 // indirect
-	github.com/cloudflare/circl v1.6.0 // indirect
+	github.com/bmatcuk/doublestar/v4 v4.9.1 // indirect
+	github.com/cloudflare/circl v1.6.1 // indirect
 	github.com/fatih/color v1.17.0 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/uuid v1.6.0 // indirect
+	github.com/hashicorp/cli v1.1.7 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-checkpoint v0.5.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
@@ -34,16 +36,17 @@ require (
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
 	github.com/hashicorp/go-version v1.7.0 // indirect
 	github.com/hashicorp/hc-install v0.9.2 // indirect
-	github.com/hashicorp/terraform-exec v0.23.0 // indirect
-	github.com/hashicorp/terraform-json v0.25.0 // indirect
+	github.com/hashicorp/terraform-exec v0.24.0 // indirect
+	github.com/hashicorp/terraform-json v0.27.2 // indirect
 	github.com/hashicorp/terraform-plugin-log v0.9.0 // indirect
 	github.com/hashicorp/terraform-registry-address v0.2.5 // indirect
 	github.com/hashicorp/terraform-svchost v0.1.1 // indirect
 	github.com/hashicorp/yamux v0.1.1 // indirect
 	github.com/huandu/xstrings v1.3.3 // indirect
 	github.com/imdario/mergo v0.3.15 // indirect
-	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-runewidth v0.0.9 // indirect
 	github.com/mitchellh/cli v1.1.5 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/go-testing-interface v1.14.1 // indirect
@@ -55,14 +58,19 @@ require (
 	github.com/spf13/cast v1.5.0 // indirect
 	github.com/vmihailenco/msgpack/v5 v5.4.1 // indirect
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
-	github.com/zclconf/go-cty v1.16.2 // indirect
+	github.com/yuin/goldmark v1.7.7 // indirect
+	github.com/yuin/goldmark-meta v1.1.0 // indirect
+	github.com/zclconf/go-cty v1.17.0 // indirect
+	go.abhg.dev/goldmark/frontmatter v0.2.0 // indirect
 	golang.org/x/crypto v0.38.0 // indirect
 	golang.org/x/exp v0.0.0-20230809150735-7b3493d9a819 // indirect
-	golang.org/x/mod v0.24.0 // indirect
+	golang.org/x/mod v0.28.0 // indirect
 	golang.org/x/net v0.39.0 // indirect
-	golang.org/x/sys v0.33.0 // indirect
-	golang.org/x/text v0.25.0 // indirect
+	golang.org/x/sys v0.36.0 // indirect
+	golang.org/x/text v0.30.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a // indirect
 	google.golang.org/grpc v1.72.1 // indirect
 	google.golang.org/protobuf v1.36.6 // indirect
+	gopkg.in/yaml.v2 v2.3.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/go.sum b/go.sum
index 5432249..8f52601 100644
--- a/go.sum
+++ b/go.sum
@@ -1,5 +1,9 @@
 dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
 dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
+github.com/BurntSushi/toml v1.2.1 h1:9F2/+DoOYIOksmaJFPw1tGFy1eDnIJXg+UHjuD8lTak=
+github.com/BurntSushi/toml v1.2.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
+github.com/Kunde21/markdownfmt/v3 v3.1.0 h1:KiZu9LKs+wFFBQKhrZJrFZwtLnCCWJahL+S+E/3VnM0=
+github.com/Kunde21/markdownfmt/v3 v3.1.0/go.mod h1:tPXN1RTyOzJwhfHoon9wUr4HGYmWgVxSQN6VBJDkrVc=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
 github.com/Masterminds/semver/v3 v3.1.1/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
@@ -19,10 +23,14 @@ github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI=
 github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/bgentry/speakeasy v0.1.0 h1:ByYyxL9InA1OWqxJqqp2A5pYHUrCiAL6K3J+LKSsQkY=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
+github.com/bmatcuk/doublestar/v4 v4.9.1 h1:X8jg9rRZmJd4yRy7ZeNDRnM+T3ZfHv15JiBJ/avrEXE=
+github.com/bmatcuk/doublestar/v4 v4.9.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/bufbuild/protocompile v0.4.0 h1:LbFKd2XowZvQ/kajzguUp2DC9UEIQhIq77fZZlaQsNA=
 github.com/bufbuild/protocompile v0.4.0/go.mod h1:3v93+mbWn/v3xzN+31nwkJfrEpAUwp+BagBSZWx+TP8=
 github.com/cloudflare/circl v1.6.0 h1:cr5JKic4HI+LkINy2lg3W2jF8sHCVTBncJr5gIIq7qk=
 github.com/cloudflare/circl v1.6.0/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
+github.com/cloudflare/circl v1.6.1 h1:zqIqSPIndyBh1bjLVVDHMPpVKqp8Su/V+6MeDzzQBQ0=
+github.com/cloudflare/circl v1.6.1/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
 github.com/cyphar/filepath-securejoin v0.4.1 h1:JyxxyPEaktOD+GAnqIqTf9A8tHyAG22rowi7HkoSU1s=
 github.com/cyphar/filepath-securejoin v0.4.1/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -56,6 +64,8 @@ github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/hashicorp/cli v1.1.7 h1:/fZJ+hNdwfTSfsxMBa9WWMlfjUZbX8/LnUxgAd7lCVU=
+github.com/hashicorp/cli v1.1.7/go.mod h1:e6Mfpga9OCT1vqzFuoGZiiF/KaG9CbUfO5s3ghU3YgU=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -82,10 +92,18 @@ github.com/hashicorp/hc-install v0.9.2 h1:v80EtNX4fCVHqzL9Lg/2xkp62bbvQMnvPQ0G+O
 github.com/hashicorp/hc-install v0.9.2/go.mod h1:XUqBQNnuT4RsxoxiM9ZaUk0NX8hi2h+Lb6/c0OZnC/I=
 github.com/hashicorp/terraform-exec v0.23.0 h1:MUiBM1s0CNlRFsCLJuM5wXZrzA3MnPYEsiXmzATMW/I=
 github.com/hashicorp/terraform-exec v0.23.0/go.mod h1:mA+qnx1R8eePycfwKkCRk3Wy65mwInvlpAeOwmA7vlY=
+github.com/hashicorp/terraform-exec v0.24.0 h1:mL0xlk9H5g2bn0pPF6JQZk5YlByqSqrO5VoaNtAf8OE=
+github.com/hashicorp/terraform-exec v0.24.0/go.mod h1:lluc/rDYfAhYdslLJQg3J0oDqo88oGQAdHR+wDqFvo4=
 github.com/hashicorp/terraform-json v0.25.0 h1:rmNqc/CIfcWawGiwXmRuiXJKEiJu1ntGoxseG1hLhoQ=
 github.com/hashicorp/terraform-json v0.25.0/go.mod h1:sMKS8fiRDX4rVlR6EJUMudg1WcanxCMoWwTLkgZP/vc=
+github.com/hashicorp/terraform-json v0.27.2 h1:BwGuzM6iUPqf9JYM/Z4AF1OJ5VVJEEzoKST/tRDBJKU=
+github.com/hashicorp/terraform-json v0.27.2/go.mod h1:GzPLJ1PLdUG5xL6xn1OXWIjteQRT2CNT9o/6A9mi9hE=
 github.com/hashicorp/terraform-plugin-docs v0.16.0 h1:UmxFr3AScl6Wged84jndJIfFccGyBZn52KtMNsS12dI=
 github.com/hashicorp/terraform-plugin-docs v0.16.0/go.mod h1:M3ZrlKBJAbPMtNOPwHicGi1c+hZUh7/g0ifT/z7TVfA=
+github.com/hashicorp/terraform-plugin-docs v0.17.0 h1:H1Yc+bgB//Geau5g7YKkhG5v9tghI3vplfIYTOl85Uw=
+github.com/hashicorp/terraform-plugin-docs v0.17.0/go.mod h1:cKC8GSLE+0a0bi7LtlpXgrqnlRDCGoGDn15PTEA+Ang=
+github.com/hashicorp/terraform-plugin-docs v0.24.0 h1:YNZYd+8cpYclQyXbl1EEngbld8w7/LPOm99GD5nikIU=
+github.com/hashicorp/terraform-plugin-docs v0.24.0/go.mod h1:YLg+7LEwVmRuJc0EuCw0SPLxuQXw5mW8iJ5ml/kvi+o=
 github.com/hashicorp/terraform-plugin-framework v1.15.1 h1:2mKDkwb8rlx/tvJTlIcpw0ykcmvdWv+4gY3SIgk8Pq8=
 github.com/hashicorp/terraform-plugin-framework v1.15.1/go.mod h1:hxrNI/GY32KPISpWqlCoTLM9JZsGH3CyYlir09bD/fI=
 github.com/hashicorp/terraform-plugin-framework-validators v0.12.0 h1:HOjBuMbOEzl7snOdOoUfE2Jgeto6JOjLVQ39Ls2nksc=
@@ -124,12 +142,16 @@ github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope
 github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-runewidth v0.0.9 h1:Lm995f3rfxdpd6TSmuVCHVb/QhupuXlYr8sCI/QdE+0=
+github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
 github.com/mitchellh/cli v1.1.5 h1:OxRIeJXpAMztws/XHlN2vu6imG5Dpq+j61AzAX5fLng=
 github.com/mitchellh/cli v1.1.5/go.mod h1:v8+iFts2sPIKUV1ltktPXMCC8fumSKFItNcD2cLtRR4=
 github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
@@ -178,8 +200,16 @@ github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV
 github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
 github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/yuin/goldmark v1.7.7 h1:5m9rrB1sW3JUMToKFQfb+FGt1U7r57IHu5GrYrG2nqU=
+github.com/yuin/goldmark v1.7.7/go.mod h1:uzxRWxtg69N339t3louHJ7+O03ezfj6PlliRlaOzY1E=
+github.com/yuin/goldmark-meta v1.1.0 h1:pWw+JLHGZe8Rk0EGsMVssiNb/AaPMHfSRszZeUeiOUc=
+github.com/yuin/goldmark-meta v1.1.0/go.mod h1:U4spWENafuA7Zyg+Lj5RqK/MF+ovMYtBvXi1lBb2VP0=
 github.com/zclconf/go-cty v1.16.2 h1:LAJSwc3v81IRBZyUVQDUdZ7hs3SYs9jv0eZJDWHD/70=
 github.com/zclconf/go-cty v1.16.2/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
+github.com/zclconf/go-cty v1.17.0 h1:seZvECve6XX4tmnvRzWtJNHdscMtYEx5R7bnnVyd/d0=
+github.com/zclconf/go-cty v1.17.0/go.mod h1:wqFzcImaLTI6A5HfsRwB0nj5n0MRZFwmey8YoFPPs3U=
+go.abhg.dev/goldmark/frontmatter v0.2.0 h1:P8kPG0YkL12+aYk2yU3xHv4tcXzeVnN+gU0tJ5JnxRw=
+go.abhg.dev/goldmark/frontmatter v0.2.0/go.mod h1:XqrEkZuM57djk7zrlRUB02x8I5J0px76YjkOzhB4YlU=
 go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
 go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
 go.opentelemetry.io/otel v1.34.0 h1:zRLXxLCgL1WyKsPVrgbSdMN4c0FMkDAskSTQP+0hdUY=
@@ -204,6 +234,8 @@ golang.org/x/exp v0.0.0-20230809150735-7b3493d9a819/go.mod h1:FXUEEKJgO7OQYeo8N0
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
 golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
+golang.org/x/mod v0.28.0 h1:gQBtGhjxykdjY9YhZpSlZIsbnaE2+PgjfLWUQTnoZ1U=
+golang.org/x/mod v0.28.0/go.mod h1:yfB/L0NOf/kmEbXjzCPOx1iK1fRutOydrCMsqRhEBxI=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
@@ -229,6 +261,8 @@ golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
 golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k=
+golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
@@ -238,6 +272,8 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.25.0 h1:qVyWApTSYLk/drJRO5mDlNYskwQznZmkpV2c8q9zls4=
 golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA=
+golang.org/x/text v0.30.0 h1:yznKA/E9zq54KzlzBEAWn1NXSQ8DIp/NYMy88xJjl4k=
+golang.org/x/text v0.30.0/go.mod h1:yDdHFIX9t+tORqspjENWgzaCVXgk0yYnYuSZ8UzzBVM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
@@ -252,6 +288,7 @@ gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8
 gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
 gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=