From 769937bf6678039fa95f77eae68d32904a89ed00 Mon Sep 17 00:00:00 2001
From: SupportSDM <support@strongdm.com>
Date: Tue, 27 Feb 2024 22:11:28 +0000
Subject: [PATCH] 6.7.0

---
 com/strongdm/api/AWSCertX509Store.java        |  131 +
 com/strongdm/api/SigningCallCredential.java   |    2 +-
 com/strongdm/api/plumbing/Plumbing.java       |   76 +
 .../plumbing/SecretStoresTypesPlumbing.java   | 2854 +++++++++++++++--
 4 files changed, 2757 insertions(+), 306 deletions(-)
 create mode 100644 com/strongdm/api/AWSCertX509Store.java

diff --git a/com/strongdm/api/AWSCertX509Store.java b/com/strongdm/api/AWSCertX509Store.java
new file mode 100644
index 0000000..a11d608
--- /dev/null
+++ b/com/strongdm/api/AWSCertX509Store.java
@@ -0,0 +1,131 @@
+// Copyright 2020 StrongDM Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+// Code generated by protogen. DO NOT EDIT.
+
+package com.strongdm.api;
+
+/**
+ * AWSCertX509Store is currently unstable, and its API may change, or it may be removed, without a
+ * major version bump.
+ */
+public class AWSCertX509Store implements SecretStore {
+  private String caArn;
+  /** The ARN of the CA in AWS Private CA */
+  public String getCaArn() {
+    return this.caArn;
+  }
+  /** The ARN of the CA in AWS Private CA */
+  public void setCaArn(String in) {
+    this.caArn = in;
+  }
+
+  private String certificateTemplateArn;
+  /**
+   * The ARN of the AWS certificate template for requested certificates. Must allow SAN, key usage,
+   * and ext key usage passthrough from CSR
+   */
+  public String getCertificateTemplateArn() {
+    return this.certificateTemplateArn;
+  }
+  /**
+   * The ARN of the AWS certificate template for requested certificates. Must allow SAN, key usage,
+   * and ext key usage passthrough from CSR
+   */
+  public void setCertificateTemplateArn(String in) {
+    this.certificateTemplateArn = in;
+  }
+
+  private String id;
+  /** Unique identifier of the SecretStore. */
+  public String getId() {
+    return this.id;
+  }
+  /** Unique identifier of the SecretStore. */
+  public void setId(String in) {
+    this.id = in;
+  }
+
+  private String issuedCertTtlMinutes;
+  /**
+   * The lifetime of certificates issued by this CA represented in minutes e.g. 600 (for 10 hours).
+   * Defaults to 8 hours if not provided.
+   */
+  public String getIssuedCertTTLMinutes() {
+    return this.issuedCertTtlMinutes;
+  }
+  /**
+   * The lifetime of certificates issued by this CA represented in minutes e.g. 600 (for 10 hours).
+   * Defaults to 8 hours if not provided.
+   */
+  public void setIssuedCertTTLMinutes(String in) {
+    this.issuedCertTtlMinutes = in;
+  }
+
+  private String name;
+  /** Unique human-readable name of the SecretStore. */
+  public String getName() {
+    return this.name;
+  }
+  /** Unique human-readable name of the SecretStore. */
+  public void setName(String in) {
+    this.name = in;
+  }
+
+  private String region;
+  /** The AWS region to target e.g. us-east-1 */
+  public String getRegion() {
+    return this.region;
+  }
+  /** The AWS region to target e.g. us-east-1 */
+  public void setRegion(String in) {
+    this.region = in;
+  }
+
+  private String signingAlgo;
+  /**
+   * The specified signing algorithm family (RSA or ECDSA) must match the algorithm family of the
+   * CA's secret key. e.g. SHA256WITHRSA
+   */
+  public String getSigningAlgo() {
+    return this.signingAlgo;
+  }
+  /**
+   * The specified signing algorithm family (RSA or ECDSA) must match the algorithm family of the
+   * CA's secret key. e.g. SHA256WITHRSA
+   */
+  public void setSigningAlgo(String in) {
+    this.signingAlgo = in;
+  }
+
+  private java.util.Map<String, String> tags;
+  /** Tags is a map of key, value pairs. */
+  public java.util.Map<String, String> getTags() {
+    java.util.Map<String, String> m = new java.util.HashMap<String, String>();
+    if (this.tags != null) {
+      m.putAll(this.tags);
+    }
+    return m;
+  }
+  /** Tags is a map of key, value pairs. */
+  public void setTags(java.util.Map<String, String> in) {
+    if (in == null) {
+      this.tags = null;
+      return;
+    }
+    this.tags = new java.util.HashMap<String, String>();
+    this.tags.putAll(in);
+  }
+}
diff --git a/com/strongdm/api/SigningCallCredential.java b/com/strongdm/api/SigningCallCredential.java
index 3240c5e..25211e6 100644
--- a/com/strongdm/api/SigningCallCredential.java
+++ b/com/strongdm/api/SigningCallCredential.java
@@ -23,7 +23,7 @@ class SigningCallCredential extends CallCredentials {
   private final String apiAccessKey;
   private final String signature;
   private static final String API_VERSION = "2021-08-23";
-  private static final String USER_AGENT = "strongdm-sdk-java/6.6.0";
+  private static final String USER_AGENT = "strongdm-sdk-java/6.7.0";
 
   protected SigningCallCredential(String apiAccessKey, String signature) {
     this.apiAccessKey = apiAccessKey;
diff --git a/com/strongdm/api/plumbing/Plumbing.java b/com/strongdm/api/plumbing/Plumbing.java
index c14a14d..d829ca9 100644
--- a/com/strongdm/api/plumbing/Plumbing.java
+++ b/com/strongdm/api/plumbing/Plumbing.java
@@ -760,6 +760,73 @@ public static List<AWS> convertRepeatedAWSToPlumbing(
         .collect(Collectors.toList());
   }
 
+  public static com.strongdm.api.AWSCertX509Store convertAWSCertX509StoreToPorcelain(
+      AWSCertX509Store plumbing) {
+    com.strongdm.api.AWSCertX509Store porcelain = new com.strongdm.api.AWSCertX509Store();
+    porcelain.setCaArn((plumbing.getCaArn()));
+    porcelain.setCertificateTemplateArn((plumbing.getCertificateTemplateArn()));
+    porcelain.setId((plumbing.getId()));
+    porcelain.setIssuedCertTTLMinutes((plumbing.getIssuedCertTTLMinutes()));
+    porcelain.setName((plumbing.getName()));
+    porcelain.setRegion((plumbing.getRegion()));
+    porcelain.setSigningAlgo((plumbing.getSigningAlgo()));
+    porcelain.setTags(Plumbing.convertTagsToPorcelain(plumbing.getTags()));
+    return porcelain;
+  }
+
+  public static AWSCertX509Store convertAWSCertX509StoreToPlumbing(
+      com.strongdm.api.AWSCertX509Store porcelain) {
+    if (porcelain == null) {
+      return null;
+    }
+    AWSCertX509Store.Builder builder = AWSCertX509Store.newBuilder();
+    if (porcelain.getCaArn() != null) {
+      builder.setCaArn((porcelain.getCaArn()));
+    }
+    if (porcelain.getCertificateTemplateArn() != null) {
+      builder.setCertificateTemplateArn((porcelain.getCertificateTemplateArn()));
+    }
+    if (porcelain.getId() != null) {
+      builder.setId((porcelain.getId()));
+    }
+    if (porcelain.getIssuedCertTTLMinutes() != null) {
+      builder.setIssuedCertTTLMinutes((porcelain.getIssuedCertTTLMinutes()));
+    }
+    if (porcelain.getName() != null) {
+      builder.setName((porcelain.getName()));
+    }
+    if (porcelain.getRegion() != null) {
+      builder.setRegion((porcelain.getRegion()));
+    }
+    if (porcelain.getSigningAlgo() != null) {
+      builder.setSigningAlgo((porcelain.getSigningAlgo()));
+    }
+    if (porcelain.getTags() != null) {
+      builder.setTags(Plumbing.convertTagsToPlumbing(porcelain.getTags()));
+    }
+    return builder.build();
+  }
+
+  public static List<com.strongdm.api.AWSCertX509Store> convertRepeatedAWSCertX509StoreToPorcelain(
+      Collection<AWSCertX509Store> plumbings) {
+    if (plumbings == null) {
+      return new ArrayList<com.strongdm.api.AWSCertX509Store>();
+    }
+    return plumbings.stream()
+        .map(plumbing -> convertAWSCertX509StoreToPorcelain(plumbing))
+        .collect(Collectors.toList());
+  }
+
+  public static List<AWSCertX509Store> convertRepeatedAWSCertX509StoreToPlumbing(
+      Collection<com.strongdm.api.AWSCertX509Store> porcelains) {
+    if (porcelains == null) {
+      return new ArrayList<AWSCertX509Store>();
+    }
+    return porcelains.stream()
+        .map(porcelain -> convertAWSCertX509StoreToPlumbing(porcelain))
+        .collect(Collectors.toList());
+  }
+
   public static com.strongdm.api.AWSConsole convertAWSConsoleToPorcelain(AWSConsole plumbing) {
     com.strongdm.api.AWSConsole porcelain = new com.strongdm.api.AWSConsole();
     porcelain.setBindInterface((plumbing.getBindInterface()));
@@ -13019,6 +13086,9 @@ public static com.strongdm.api.SecretStore convertSecretStoreToPorcelain(SecretS
     if (plumbing.hasAws()) {
       return convertAWSStoreToPorcelain(plumbing.getAws());
     }
+    if (plumbing.hasAwsCertX509()) {
+      return convertAWSCertX509StoreToPorcelain(plumbing.getAwsCertX509());
+    }
     if (plumbing.hasAzure()) {
       return convertAzureStoreToPorcelain(plumbing.getAzure());
     }
@@ -13079,6 +13149,12 @@ public static SecretStore convertSecretStoreToPlumbing(com.strongdm.api.SecretSt
       builder.setAws(convertAWSStoreToPlumbing((com.strongdm.api.AWSStore) porcelain));
       return builder.build();
     }
+    if (porcelain instanceof com.strongdm.api.AWSCertX509Store) {
+      SecretStore.Builder builder = SecretStore.newBuilder();
+      builder.setAwsCertX509(
+          convertAWSCertX509StoreToPlumbing((com.strongdm.api.AWSCertX509Store) porcelain));
+      return builder.build();
+    }
     if (porcelain instanceof com.strongdm.api.AzureStore) {
       SecretStore.Builder builder = SecretStore.newBuilder();
       builder.setAzure(convertAzureStoreToPlumbing((com.strongdm.api.AzureStore) porcelain));
diff --git a/com/strongdm/api/plumbing/SecretStoresTypesPlumbing.java b/com/strongdm/api/plumbing/SecretStoresTypesPlumbing.java
index 98361cd..bbf62a1 100644
--- a/com/strongdm/api/plumbing/SecretStoresTypesPlumbing.java
+++ b/com/strongdm/api/plumbing/SecretStoresTypesPlumbing.java
@@ -47,6 +47,21 @@ public interface SecretStoreOrBuilder extends
      */
     com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStoreOrBuilder getAwsOrBuilder();
 
+    /**
+     * <code>.v1.AWSCertX509Store aws_cert_x_509 = 30 [(.v1.field_options) = { ... }</code>
+     * @return Whether the awsCertX509 field is set.
+     */
+    boolean hasAwsCertX509();
+    /**
+     * <code>.v1.AWSCertX509Store aws_cert_x_509 = 30 [(.v1.field_options) = { ... }</code>
+     * @return The awsCertX509.
+     */
+    com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store getAwsCertX509();
+    /**
+     * <code>.v1.AWSCertX509Store aws_cert_x_509 = 30 [(.v1.field_options) = { ... }</code>
+     */
+    com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509StoreOrBuilder getAwsCertX509OrBuilder();
+
     /**
      * <code>.v1.AzureStore azure = 101 [(.v1.field_options) = { ... }</code>
      * @return Whether the azure field is set.
@@ -395,6 +410,20 @@ private SecretStore(
               secretStoreCase_ = 4;
               break;
             }
+            case 242: {
+              com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store.Builder subBuilder = null;
+              if (secretStoreCase_ == 30) {
+                subBuilder = ((com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store) secretStore_).toBuilder();
+              }
+              secretStore_ =
+                  input.readMessage(com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store.parser(), extensionRegistry);
+              if (subBuilder != null) {
+                subBuilder.mergeFrom((com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store) secretStore_);
+                secretStore_ = subBuilder.buildPartial();
+              }
+              secretStoreCase_ = 30;
+              break;
+            }
             case 722: {
               com.strongdm.api.plumbing.SecretStoresTypesPlumbing.VaultTokenCertSSHStore.Builder subBuilder = null;
               if (secretStoreCase_ == 90) {
@@ -617,6 +646,7 @@ public enum SecretStoreCase
         implements com.google.protobuf.Internal.EnumLite,
             com.google.protobuf.AbstractMessage.InternalOneOfEnum {
       AWS(3),
+      AWS_CERT_X_509(30),
       AZURE(101),
       CYBERARK_CONJUR(301),
       CYBERARK_PAM(303),
@@ -651,6 +681,7 @@ public static SecretStoreCase valueOf(int value) {
       public static SecretStoreCase forNumber(int value) {
         switch (value) {
           case 3: return AWS;
+          case 30: return AWS_CERT_X_509;
           case 101: return AZURE;
           case 301: return CYBERARK_CONJUR;
           case 303: return CYBERARK_PAM;
@@ -713,6 +744,37 @@ public com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStoreOrBuilder get
       return com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore.getDefaultInstance();
     }
 
+    public static final int AWS_CERT_X_509_FIELD_NUMBER = 30;
+    /**
+     * <code>.v1.AWSCertX509Store aws_cert_x_509 = 30 [(.v1.field_options) = { ... }</code>
+     * @return Whether the awsCertX509 field is set.
+     */
+    @java.lang.Override
+    public boolean hasAwsCertX509() {
+      return secretStoreCase_ == 30;
+    }
+    /**
+     * <code>.v1.AWSCertX509Store aws_cert_x_509 = 30 [(.v1.field_options) = { ... }</code>
+     * @return The awsCertX509.
+     */
+    @java.lang.Override
+    public com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store getAwsCertX509() {
+      if (secretStoreCase_ == 30) {
+         return (com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store) secretStore_;
+      }
+      return com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store.getDefaultInstance();
+    }
+    /**
+     * <code>.v1.AWSCertX509Store aws_cert_x_509 = 30 [(.v1.field_options) = { ... }</code>
+     */
+    @java.lang.Override
+    public com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509StoreOrBuilder getAwsCertX509OrBuilder() {
+      if (secretStoreCase_ == 30) {
+         return (com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store) secretStore_;
+      }
+      return com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store.getDefaultInstance();
+    }
+
     public static final int AZURE_FIELD_NUMBER = 101;
     /**
      * <code>.v1.AzureStore azure = 101 [(.v1.field_options) = { ... }</code>
@@ -1235,6 +1297,9 @@ public void writeTo(com.google.protobuf.CodedOutputStream output)
       if (secretStoreCase_ == 4) {
         output.writeMessage(4, (com.strongdm.api.plumbing.SecretStoresTypesPlumbing.VaultAppRoleStore) secretStore_);
       }
+      if (secretStoreCase_ == 30) {
+        output.writeMessage(30, (com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store) secretStore_);
+      }
       if (secretStoreCase_ == 90) {
         output.writeMessage(90, (com.strongdm.api.plumbing.SecretStoresTypesPlumbing.VaultTokenCertSSHStore) secretStore_);
       }
@@ -1299,6 +1364,10 @@ public int getSerializedSize() {
         size += com.google.protobuf.CodedOutputStream
           .computeMessageSize(4, (com.strongdm.api.plumbing.SecretStoresTypesPlumbing.VaultAppRoleStore) secretStore_);
       }
+      if (secretStoreCase_ == 30) {
+        size += com.google.protobuf.CodedOutputStream
+          .computeMessageSize(30, (com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store) secretStore_);
+      }
       if (secretStoreCase_ == 90) {
         size += com.google.protobuf.CodedOutputStream
           .computeMessageSize(90, (com.strongdm.api.plumbing.SecretStoresTypesPlumbing.VaultTokenCertSSHStore) secretStore_);
@@ -1372,6 +1441,10 @@ public boolean equals(final java.lang.Object obj) {
           if (!getAws()
               .equals(other.getAws())) return false;
           break;
+        case 30:
+          if (!getAwsCertX509()
+              .equals(other.getAwsCertX509())) return false;
+          break;
         case 101:
           if (!getAzure()
               .equals(other.getAzure())) return false;
@@ -1455,6 +1528,10 @@ public int hashCode() {
           hash = (37 * hash) + AWS_FIELD_NUMBER;
           hash = (53 * hash) + getAws().hashCode();
           break;
+        case 30:
+          hash = (37 * hash) + AWS_CERT_X_509_FIELD_NUMBER;
+          hash = (53 * hash) + getAwsCertX509().hashCode();
+          break;
         case 101:
           hash = (37 * hash) + AZURE_FIELD_NUMBER;
           hash = (53 * hash) + getAzure().hashCode();
@@ -1695,6 +1772,13 @@ public com.strongdm.api.plumbing.SecretStoresTypesPlumbing.SecretStore buildPart
             result.secretStore_ = awsBuilder_.build();
           }
         }
+        if (secretStoreCase_ == 30) {
+          if (awsCertX509Builder_ == null) {
+            result.secretStore_ = secretStore_;
+          } else {
+            result.secretStore_ = awsCertX509Builder_.build();
+          }
+        }
         if (secretStoreCase_ == 101) {
           if (azureBuilder_ == null) {
             result.secretStore_ = secretStore_;
@@ -1861,6 +1945,10 @@ public Builder mergeFrom(com.strongdm.api.plumbing.SecretStoresTypesPlumbing.Sec
             mergeAws(other.getAws());
             break;
           }
+          case AWS_CERT_X_509: {
+            mergeAwsCertX509(other.getAwsCertX509());
+            break;
+          }
           case AZURE: {
             mergeAzure(other.getAzure());
             break;
@@ -2115,6 +2203,148 @@ public com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStoreOrBuilder get
         return awsBuilder_;
       }
 
+      private com.google.protobuf.SingleFieldBuilderV3<
+          com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store, com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store.Builder, com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509StoreOrBuilder> awsCertX509Builder_;
+      /**
+       * <code>.v1.AWSCertX509Store aws_cert_x_509 = 30 [(.v1.field_options) = { ... }</code>
+       * @return Whether the awsCertX509 field is set.
+       */
+      @java.lang.Override
+      public boolean hasAwsCertX509() {
+        return secretStoreCase_ == 30;
+      }
+      /**
+       * <code>.v1.AWSCertX509Store aws_cert_x_509 = 30 [(.v1.field_options) = { ... }</code>
+       * @return The awsCertX509.
+       */
+      @java.lang.Override
+      public com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store getAwsCertX509() {
+        if (awsCertX509Builder_ == null) {
+          if (secretStoreCase_ == 30) {
+            return (com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store) secretStore_;
+          }
+          return com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store.getDefaultInstance();
+        } else {
+          if (secretStoreCase_ == 30) {
+            return awsCertX509Builder_.getMessage();
+          }
+          return com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store.getDefaultInstance();
+        }
+      }
+      /**
+       * <code>.v1.AWSCertX509Store aws_cert_x_509 = 30 [(.v1.field_options) = { ... }</code>
+       */
+      public Builder setAwsCertX509(com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store value) {
+        if (awsCertX509Builder_ == null) {
+          if (value == null) {
+            throw new NullPointerException();
+          }
+          secretStore_ = value;
+          onChanged();
+        } else {
+          awsCertX509Builder_.setMessage(value);
+        }
+        secretStoreCase_ = 30;
+        return this;
+      }
+      /**
+       * <code>.v1.AWSCertX509Store aws_cert_x_509 = 30 [(.v1.field_options) = { ... }</code>
+       */
+      public Builder setAwsCertX509(
+          com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store.Builder builderForValue) {
+        if (awsCertX509Builder_ == null) {
+          secretStore_ = builderForValue.build();
+          onChanged();
+        } else {
+          awsCertX509Builder_.setMessage(builderForValue.build());
+        }
+        secretStoreCase_ = 30;
+        return this;
+      }
+      /**
+       * <code>.v1.AWSCertX509Store aws_cert_x_509 = 30 [(.v1.field_options) = { ... }</code>
+       */
+      public Builder mergeAwsCertX509(com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store value) {
+        if (awsCertX509Builder_ == null) {
+          if (secretStoreCase_ == 30 &&
+              secretStore_ != com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store.getDefaultInstance()) {
+            secretStore_ = com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store.newBuilder((com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store) secretStore_)
+                .mergeFrom(value).buildPartial();
+          } else {
+            secretStore_ = value;
+          }
+          onChanged();
+        } else {
+          if (secretStoreCase_ == 30) {
+            awsCertX509Builder_.mergeFrom(value);
+          } else {
+            awsCertX509Builder_.setMessage(value);
+          }
+        }
+        secretStoreCase_ = 30;
+        return this;
+      }
+      /**
+       * <code>.v1.AWSCertX509Store aws_cert_x_509 = 30 [(.v1.field_options) = { ... }</code>
+       */
+      public Builder clearAwsCertX509() {
+        if (awsCertX509Builder_ == null) {
+          if (secretStoreCase_ == 30) {
+            secretStoreCase_ = 0;
+            secretStore_ = null;
+            onChanged();
+          }
+        } else {
+          if (secretStoreCase_ == 30) {
+            secretStoreCase_ = 0;
+            secretStore_ = null;
+          }
+          awsCertX509Builder_.clear();
+        }
+        return this;
+      }
+      /**
+       * <code>.v1.AWSCertX509Store aws_cert_x_509 = 30 [(.v1.field_options) = { ... }</code>
+       */
+      public com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store.Builder getAwsCertX509Builder() {
+        return getAwsCertX509FieldBuilder().getBuilder();
+      }
+      /**
+       * <code>.v1.AWSCertX509Store aws_cert_x_509 = 30 [(.v1.field_options) = { ... }</code>
+       */
+      @java.lang.Override
+      public com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509StoreOrBuilder getAwsCertX509OrBuilder() {
+        if ((secretStoreCase_ == 30) && (awsCertX509Builder_ != null)) {
+          return awsCertX509Builder_.getMessageOrBuilder();
+        } else {
+          if (secretStoreCase_ == 30) {
+            return (com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store) secretStore_;
+          }
+          return com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store.getDefaultInstance();
+        }
+      }
+      /**
+       * <code>.v1.AWSCertX509Store aws_cert_x_509 = 30 [(.v1.field_options) = { ... }</code>
+       */
+      private com.google.protobuf.SingleFieldBuilderV3<
+          com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store, com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store.Builder, com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509StoreOrBuilder> 
+          getAwsCertX509FieldBuilder() {
+        if (awsCertX509Builder_ == null) {
+          if (!(secretStoreCase_ == 30)) {
+            secretStore_ = com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store.getDefaultInstance();
+          }
+          awsCertX509Builder_ = new com.google.protobuf.SingleFieldBuilderV3<
+              com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store, com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store.Builder, com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509StoreOrBuilder>(
+                  (com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store) secretStore_,
+                  getParentForChildren(),
+                  isClean());
+          secretStore_ = null;
+        }
+        secretStoreCase_ = 30;
+        onChanged();;
+        return awsCertX509Builder_;
+      }
+
       private com.google.protobuf.SingleFieldBuilderV3<
           com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AzureStore, com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AzureStore.Builder, com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AzureStoreOrBuilder> azureBuilder_;
       /**
@@ -4531,28 +4761,1353 @@ public interface AWSStoreOrBuilder extends
     com.strongdm.api.plumbing.TagsPlumbing.TagsOrBuilder getTagsOrBuilder();
   }
   /**
-   * Protobuf type {@code v1.AWSStore}
+   * Protobuf type {@code v1.AWSStore}
+   */
+  public static final class AWSStore extends
+      com.google.protobuf.GeneratedMessageV3 implements
+      // @@protoc_insertion_point(message_implements:v1.AWSStore)
+      AWSStoreOrBuilder {
+  private static final long serialVersionUID = 0L;
+    // Use AWSStore.newBuilder() to construct.
+    private AWSStore(com.google.protobuf.GeneratedMessageV3.Builder<?> builder) {
+      super(builder);
+    }
+    private AWSStore() {
+      id_ = "";
+      name_ = "";
+      region_ = "";
+    }
+
+    @java.lang.Override
+    @SuppressWarnings({"unused"})
+    protected java.lang.Object newInstance(
+        UnusedPrivateParameter unused) {
+      return new AWSStore();
+    }
+
+    @java.lang.Override
+    public final com.google.protobuf.UnknownFieldSet
+    getUnknownFields() {
+      return this.unknownFields;
+    }
+    private AWSStore(
+        com.google.protobuf.CodedInputStream input,
+        com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+        throws com.google.protobuf.InvalidProtocolBufferException {
+      this();
+      if (extensionRegistry == null) {
+        throw new java.lang.NullPointerException();
+      }
+      com.google.protobuf.UnknownFieldSet.Builder unknownFields =
+          com.google.protobuf.UnknownFieldSet.newBuilder();
+      try {
+        boolean done = false;
+        while (!done) {
+          int tag = input.readTag();
+          switch (tag) {
+            case 0:
+              done = true;
+              break;
+            case 10: {
+              java.lang.String s = input.readStringRequireUtf8();
+
+              id_ = s;
+              break;
+            }
+            case 18: {
+              java.lang.String s = input.readStringRequireUtf8();
+
+              name_ = s;
+              break;
+            }
+            case 26: {
+              java.lang.String s = input.readStringRequireUtf8();
+
+              region_ = s;
+              break;
+            }
+            case 34: {
+              com.strongdm.api.plumbing.TagsPlumbing.Tags.Builder subBuilder = null;
+              if (tags_ != null) {
+                subBuilder = tags_.toBuilder();
+              }
+              tags_ = input.readMessage(com.strongdm.api.plumbing.TagsPlumbing.Tags.parser(), extensionRegistry);
+              if (subBuilder != null) {
+                subBuilder.mergeFrom(tags_);
+                tags_ = subBuilder.buildPartial();
+              }
+
+              break;
+            }
+            default: {
+              if (!parseUnknownField(
+                  input, unknownFields, extensionRegistry, tag)) {
+                done = true;
+              }
+              break;
+            }
+          }
+        }
+      } catch (com.google.protobuf.InvalidProtocolBufferException e) {
+        throw e.setUnfinishedMessage(this);
+      } catch (com.google.protobuf.UninitializedMessageException e) {
+        throw e.asInvalidProtocolBufferException().setUnfinishedMessage(this);
+      } catch (java.io.IOException e) {
+        throw new com.google.protobuf.InvalidProtocolBufferException(
+            e).setUnfinishedMessage(this);
+      } finally {
+        this.unknownFields = unknownFields.build();
+        makeExtensionsImmutable();
+      }
+    }
+    public static final com.google.protobuf.Descriptors.Descriptor
+        getDescriptor() {
+      return com.strongdm.api.plumbing.SecretStoresTypesPlumbing.internal_static_v1_AWSStore_descriptor;
+    }
+
+    @java.lang.Override
+    protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
+        internalGetFieldAccessorTable() {
+      return com.strongdm.api.plumbing.SecretStoresTypesPlumbing.internal_static_v1_AWSStore_fieldAccessorTable
+          .ensureFieldAccessorsInitialized(
+              com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore.class, com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore.Builder.class);
+    }
+
+    public static final int ID_FIELD_NUMBER = 1;
+    private volatile java.lang.Object id_;
+    /**
+     * <pre>
+     * Unique identifier of the SecretStore.
+     * </pre>
+     *
+     * <code>string id = 1 [(.v1.field_options) = { ... }</code>
+     * @return The id.
+     */
+    @java.lang.Override
+    public java.lang.String getId() {
+      java.lang.Object ref = id_;
+      if (ref instanceof java.lang.String) {
+        return (java.lang.String) ref;
+      } else {
+        com.google.protobuf.ByteString bs = 
+            (com.google.protobuf.ByteString) ref;
+        java.lang.String s = bs.toStringUtf8();
+        id_ = s;
+        return s;
+      }
+    }
+    /**
+     * <pre>
+     * Unique identifier of the SecretStore.
+     * </pre>
+     *
+     * <code>string id = 1 [(.v1.field_options) = { ... }</code>
+     * @return The bytes for id.
+     */
+    @java.lang.Override
+    public com.google.protobuf.ByteString
+        getIdBytes() {
+      java.lang.Object ref = id_;
+      if (ref instanceof java.lang.String) {
+        com.google.protobuf.ByteString b = 
+            com.google.protobuf.ByteString.copyFromUtf8(
+                (java.lang.String) ref);
+        id_ = b;
+        return b;
+      } else {
+        return (com.google.protobuf.ByteString) ref;
+      }
+    }
+
+    public static final int NAME_FIELD_NUMBER = 2;
+    private volatile java.lang.Object name_;
+    /**
+     * <pre>
+     * Unique human-readable name of the SecretStore.
+     * </pre>
+     *
+     * <code>string name = 2 [(.v1.field_options) = { ... }</code>
+     * @return The name.
+     */
+    @java.lang.Override
+    public java.lang.String getName() {
+      java.lang.Object ref = name_;
+      if (ref instanceof java.lang.String) {
+        return (java.lang.String) ref;
+      } else {
+        com.google.protobuf.ByteString bs = 
+            (com.google.protobuf.ByteString) ref;
+        java.lang.String s = bs.toStringUtf8();
+        name_ = s;
+        return s;
+      }
+    }
+    /**
+     * <pre>
+     * Unique human-readable name of the SecretStore.
+     * </pre>
+     *
+     * <code>string name = 2 [(.v1.field_options) = { ... }</code>
+     * @return The bytes for name.
+     */
+    @java.lang.Override
+    public com.google.protobuf.ByteString
+        getNameBytes() {
+      java.lang.Object ref = name_;
+      if (ref instanceof java.lang.String) {
+        com.google.protobuf.ByteString b = 
+            com.google.protobuf.ByteString.copyFromUtf8(
+                (java.lang.String) ref);
+        name_ = b;
+        return b;
+      } else {
+        return (com.google.protobuf.ByteString) ref;
+      }
+    }
+
+    public static final int REGION_FIELD_NUMBER = 3;
+    private volatile java.lang.Object region_;
+    /**
+     * <pre>
+     * The AWS region to target e.g. us-east-1
+     * </pre>
+     *
+     * <code>string region = 3 [(.v1.field_options) = { ... }</code>
+     * @return The region.
+     */
+    @java.lang.Override
+    public java.lang.String getRegion() {
+      java.lang.Object ref = region_;
+      if (ref instanceof java.lang.String) {
+        return (java.lang.String) ref;
+      } else {
+        com.google.protobuf.ByteString bs = 
+            (com.google.protobuf.ByteString) ref;
+        java.lang.String s = bs.toStringUtf8();
+        region_ = s;
+        return s;
+      }
+    }
+    /**
+     * <pre>
+     * The AWS region to target e.g. us-east-1
+     * </pre>
+     *
+     * <code>string region = 3 [(.v1.field_options) = { ... }</code>
+     * @return The bytes for region.
+     */
+    @java.lang.Override
+    public com.google.protobuf.ByteString
+        getRegionBytes() {
+      java.lang.Object ref = region_;
+      if (ref instanceof java.lang.String) {
+        com.google.protobuf.ByteString b = 
+            com.google.protobuf.ByteString.copyFromUtf8(
+                (java.lang.String) ref);
+        region_ = b;
+        return b;
+      } else {
+        return (com.google.protobuf.ByteString) ref;
+      }
+    }
+
+    public static final int TAGS_FIELD_NUMBER = 4;
+    private com.strongdm.api.plumbing.TagsPlumbing.Tags tags_;
+    /**
+     * <pre>
+     * Tags is a map of key, value pairs.
+     * </pre>
+     *
+     * <code>.v1.Tags tags = 4 [(.v1.field_options) = { ... }</code>
+     * @return Whether the tags field is set.
+     */
+    @java.lang.Override
+    public boolean hasTags() {
+      return tags_ != null;
+    }
+    /**
+     * <pre>
+     * Tags is a map of key, value pairs.
+     * </pre>
+     *
+     * <code>.v1.Tags tags = 4 [(.v1.field_options) = { ... }</code>
+     * @return The tags.
+     */
+    @java.lang.Override
+    public com.strongdm.api.plumbing.TagsPlumbing.Tags getTags() {
+      return tags_ == null ? com.strongdm.api.plumbing.TagsPlumbing.Tags.getDefaultInstance() : tags_;
+    }
+    /**
+     * <pre>
+     * Tags is a map of key, value pairs.
+     * </pre>
+     *
+     * <code>.v1.Tags tags = 4 [(.v1.field_options) = { ... }</code>
+     */
+    @java.lang.Override
+    public com.strongdm.api.plumbing.TagsPlumbing.TagsOrBuilder getTagsOrBuilder() {
+      return getTags();
+    }
+
+    private byte memoizedIsInitialized = -1;
+    @java.lang.Override
+    public final boolean isInitialized() {
+      byte isInitialized = memoizedIsInitialized;
+      if (isInitialized == 1) return true;
+      if (isInitialized == 0) return false;
+
+      memoizedIsInitialized = 1;
+      return true;
+    }
+
+    @java.lang.Override
+    public void writeTo(com.google.protobuf.CodedOutputStream output)
+                        throws java.io.IOException {
+      if (!com.google.protobuf.GeneratedMessageV3.isStringEmpty(id_)) {
+        com.google.protobuf.GeneratedMessageV3.writeString(output, 1, id_);
+      }
+      if (!com.google.protobuf.GeneratedMessageV3.isStringEmpty(name_)) {
+        com.google.protobuf.GeneratedMessageV3.writeString(output, 2, name_);
+      }
+      if (!com.google.protobuf.GeneratedMessageV3.isStringEmpty(region_)) {
+        com.google.protobuf.GeneratedMessageV3.writeString(output, 3, region_);
+      }
+      if (tags_ != null) {
+        output.writeMessage(4, getTags());
+      }
+      unknownFields.writeTo(output);
+    }
+
+    @java.lang.Override
+    public int getSerializedSize() {
+      int size = memoizedSize;
+      if (size != -1) return size;
+
+      size = 0;
+      if (!com.google.protobuf.GeneratedMessageV3.isStringEmpty(id_)) {
+        size += com.google.protobuf.GeneratedMessageV3.computeStringSize(1, id_);
+      }
+      if (!com.google.protobuf.GeneratedMessageV3.isStringEmpty(name_)) {
+        size += com.google.protobuf.GeneratedMessageV3.computeStringSize(2, name_);
+      }
+      if (!com.google.protobuf.GeneratedMessageV3.isStringEmpty(region_)) {
+        size += com.google.protobuf.GeneratedMessageV3.computeStringSize(3, region_);
+      }
+      if (tags_ != null) {
+        size += com.google.protobuf.CodedOutputStream
+          .computeMessageSize(4, getTags());
+      }
+      size += unknownFields.getSerializedSize();
+      memoizedSize = size;
+      return size;
+    }
+
+    @java.lang.Override
+    public boolean equals(final java.lang.Object obj) {
+      if (obj == this) {
+       return true;
+      }
+      if (!(obj instanceof com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore)) {
+        return super.equals(obj);
+      }
+      com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore other = (com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore) obj;
+
+      if (!getId()
+          .equals(other.getId())) return false;
+      if (!getName()
+          .equals(other.getName())) return false;
+      if (!getRegion()
+          .equals(other.getRegion())) return false;
+      if (hasTags() != other.hasTags()) return false;
+      if (hasTags()) {
+        if (!getTags()
+            .equals(other.getTags())) return false;
+      }
+      if (!unknownFields.equals(other.unknownFields)) return false;
+      return true;
+    }
+
+    @java.lang.Override
+    public int hashCode() {
+      if (memoizedHashCode != 0) {
+        return memoizedHashCode;
+      }
+      int hash = 41;
+      hash = (19 * hash) + getDescriptor().hashCode();
+      hash = (37 * hash) + ID_FIELD_NUMBER;
+      hash = (53 * hash) + getId().hashCode();
+      hash = (37 * hash) + NAME_FIELD_NUMBER;
+      hash = (53 * hash) + getName().hashCode();
+      hash = (37 * hash) + REGION_FIELD_NUMBER;
+      hash = (53 * hash) + getRegion().hashCode();
+      if (hasTags()) {
+        hash = (37 * hash) + TAGS_FIELD_NUMBER;
+        hash = (53 * hash) + getTags().hashCode();
+      }
+      hash = (29 * hash) + unknownFields.hashCode();
+      memoizedHashCode = hash;
+      return hash;
+    }
+
+    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore parseFrom(
+        java.nio.ByteBuffer data)
+        throws com.google.protobuf.InvalidProtocolBufferException {
+      return PARSER.parseFrom(data);
+    }
+    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore parseFrom(
+        java.nio.ByteBuffer data,
+        com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+        throws com.google.protobuf.InvalidProtocolBufferException {
+      return PARSER.parseFrom(data, extensionRegistry);
+    }
+    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore parseFrom(
+        com.google.protobuf.ByteString data)
+        throws com.google.protobuf.InvalidProtocolBufferException {
+      return PARSER.parseFrom(data);
+    }
+    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore parseFrom(
+        com.google.protobuf.ByteString data,
+        com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+        throws com.google.protobuf.InvalidProtocolBufferException {
+      return PARSER.parseFrom(data, extensionRegistry);
+    }
+    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore parseFrom(byte[] data)
+        throws com.google.protobuf.InvalidProtocolBufferException {
+      return PARSER.parseFrom(data);
+    }
+    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore parseFrom(
+        byte[] data,
+        com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+        throws com.google.protobuf.InvalidProtocolBufferException {
+      return PARSER.parseFrom(data, extensionRegistry);
+    }
+    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore parseFrom(java.io.InputStream input)
+        throws java.io.IOException {
+      return com.google.protobuf.GeneratedMessageV3
+          .parseWithIOException(PARSER, input);
+    }
+    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore parseFrom(
+        java.io.InputStream input,
+        com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+        throws java.io.IOException {
+      return com.google.protobuf.GeneratedMessageV3
+          .parseWithIOException(PARSER, input, extensionRegistry);
+    }
+    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore parseDelimitedFrom(java.io.InputStream input)
+        throws java.io.IOException {
+      return com.google.protobuf.GeneratedMessageV3
+          .parseDelimitedWithIOException(PARSER, input);
+    }
+    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore parseDelimitedFrom(
+        java.io.InputStream input,
+        com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+        throws java.io.IOException {
+      return com.google.protobuf.GeneratedMessageV3
+          .parseDelimitedWithIOException(PARSER, input, extensionRegistry);
+    }
+    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore parseFrom(
+        com.google.protobuf.CodedInputStream input)
+        throws java.io.IOException {
+      return com.google.protobuf.GeneratedMessageV3
+          .parseWithIOException(PARSER, input);
+    }
+    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore parseFrom(
+        com.google.protobuf.CodedInputStream input,
+        com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+        throws java.io.IOException {
+      return com.google.protobuf.GeneratedMessageV3
+          .parseWithIOException(PARSER, input, extensionRegistry);
+    }
+
+    @java.lang.Override
+    public Builder newBuilderForType() { return newBuilder(); }
+    public static Builder newBuilder() {
+      return DEFAULT_INSTANCE.toBuilder();
+    }
+    public static Builder newBuilder(com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore prototype) {
+      return DEFAULT_INSTANCE.toBuilder().mergeFrom(prototype);
+    }
+    @java.lang.Override
+    public Builder toBuilder() {
+      return this == DEFAULT_INSTANCE
+          ? new Builder() : new Builder().mergeFrom(this);
+    }
+
+    @java.lang.Override
+    protected Builder newBuilderForType(
+        com.google.protobuf.GeneratedMessageV3.BuilderParent parent) {
+      Builder builder = new Builder(parent);
+      return builder;
+    }
+    /**
+     * Protobuf type {@code v1.AWSStore}
+     */
+    public static final class Builder extends
+        com.google.protobuf.GeneratedMessageV3.Builder<Builder> implements
+        // @@protoc_insertion_point(builder_implements:v1.AWSStore)
+        com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStoreOrBuilder {
+      public static final com.google.protobuf.Descriptors.Descriptor
+          getDescriptor() {
+        return com.strongdm.api.plumbing.SecretStoresTypesPlumbing.internal_static_v1_AWSStore_descriptor;
+      }
+
+      @java.lang.Override
+      protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
+          internalGetFieldAccessorTable() {
+        return com.strongdm.api.plumbing.SecretStoresTypesPlumbing.internal_static_v1_AWSStore_fieldAccessorTable
+            .ensureFieldAccessorsInitialized(
+                com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore.class, com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore.Builder.class);
+      }
+
+      // Construct using com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore.newBuilder()
+      private Builder() {
+        maybeForceBuilderInitialization();
+      }
+
+      private Builder(
+          com.google.protobuf.GeneratedMessageV3.BuilderParent parent) {
+        super(parent);
+        maybeForceBuilderInitialization();
+      }
+      private void maybeForceBuilderInitialization() {
+        if (com.google.protobuf.GeneratedMessageV3
+                .alwaysUseFieldBuilders) {
+        }
+      }
+      @java.lang.Override
+      public Builder clear() {
+        super.clear();
+        id_ = "";
+
+        name_ = "";
+
+        region_ = "";
+
+        if (tagsBuilder_ == null) {
+          tags_ = null;
+        } else {
+          tags_ = null;
+          tagsBuilder_ = null;
+        }
+        return this;
+      }
+
+      @java.lang.Override
+      public com.google.protobuf.Descriptors.Descriptor
+          getDescriptorForType() {
+        return com.strongdm.api.plumbing.SecretStoresTypesPlumbing.internal_static_v1_AWSStore_descriptor;
+      }
+
+      @java.lang.Override
+      public com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore getDefaultInstanceForType() {
+        return com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore.getDefaultInstance();
+      }
+
+      @java.lang.Override
+      public com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore build() {
+        com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore result = buildPartial();
+        if (!result.isInitialized()) {
+          throw newUninitializedMessageException(result);
+        }
+        return result;
+      }
+
+      @java.lang.Override
+      public com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore buildPartial() {
+        com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore result = new com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore(this);
+        result.id_ = id_;
+        result.name_ = name_;
+        result.region_ = region_;
+        if (tagsBuilder_ == null) {
+          result.tags_ = tags_;
+        } else {
+          result.tags_ = tagsBuilder_.build();
+        }
+        onBuilt();
+        return result;
+      }
+
+      @java.lang.Override
+      public Builder clone() {
+        return super.clone();
+      }
+      @java.lang.Override
+      public Builder setField(
+          com.google.protobuf.Descriptors.FieldDescriptor field,
+          java.lang.Object value) {
+        return super.setField(field, value);
+      }
+      @java.lang.Override
+      public Builder clearField(
+          com.google.protobuf.Descriptors.FieldDescriptor field) {
+        return super.clearField(field);
+      }
+      @java.lang.Override
+      public Builder clearOneof(
+          com.google.protobuf.Descriptors.OneofDescriptor oneof) {
+        return super.clearOneof(oneof);
+      }
+      @java.lang.Override
+      public Builder setRepeatedField(
+          com.google.protobuf.Descriptors.FieldDescriptor field,
+          int index, java.lang.Object value) {
+        return super.setRepeatedField(field, index, value);
+      }
+      @java.lang.Override
+      public Builder addRepeatedField(
+          com.google.protobuf.Descriptors.FieldDescriptor field,
+          java.lang.Object value) {
+        return super.addRepeatedField(field, value);
+      }
+      @java.lang.Override
+      public Builder mergeFrom(com.google.protobuf.Message other) {
+        if (other instanceof com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore) {
+          return mergeFrom((com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore)other);
+        } else {
+          super.mergeFrom(other);
+          return this;
+        }
+      }
+
+      public Builder mergeFrom(com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore other) {
+        if (other == com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore.getDefaultInstance()) return this;
+        if (!other.getId().isEmpty()) {
+          id_ = other.id_;
+          onChanged();
+        }
+        if (!other.getName().isEmpty()) {
+          name_ = other.name_;
+          onChanged();
+        }
+        if (!other.getRegion().isEmpty()) {
+          region_ = other.region_;
+          onChanged();
+        }
+        if (other.hasTags()) {
+          mergeTags(other.getTags());
+        }
+        this.mergeUnknownFields(other.unknownFields);
+        onChanged();
+        return this;
+      }
+
+      @java.lang.Override
+      public final boolean isInitialized() {
+        return true;
+      }
+
+      @java.lang.Override
+      public Builder mergeFrom(
+          com.google.protobuf.CodedInputStream input,
+          com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+          throws java.io.IOException {
+        com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore parsedMessage = null;
+        try {
+          parsedMessage = PARSER.parsePartialFrom(input, extensionRegistry);
+        } catch (com.google.protobuf.InvalidProtocolBufferException e) {
+          parsedMessage = (com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore) e.getUnfinishedMessage();
+          throw e.unwrapIOException();
+        } finally {
+          if (parsedMessage != null) {
+            mergeFrom(parsedMessage);
+          }
+        }
+        return this;
+      }
+
+      private java.lang.Object id_ = "";
+      /**
+       * <pre>
+       * Unique identifier of the SecretStore.
+       * </pre>
+       *
+       * <code>string id = 1 [(.v1.field_options) = { ... }</code>
+       * @return The id.
+       */
+      public java.lang.String getId() {
+        java.lang.Object ref = id_;
+        if (!(ref instanceof java.lang.String)) {
+          com.google.protobuf.ByteString bs =
+              (com.google.protobuf.ByteString) ref;
+          java.lang.String s = bs.toStringUtf8();
+          id_ = s;
+          return s;
+        } else {
+          return (java.lang.String) ref;
+        }
+      }
+      /**
+       * <pre>
+       * Unique identifier of the SecretStore.
+       * </pre>
+       *
+       * <code>string id = 1 [(.v1.field_options) = { ... }</code>
+       * @return The bytes for id.
+       */
+      public com.google.protobuf.ByteString
+          getIdBytes() {
+        java.lang.Object ref = id_;
+        if (ref instanceof String) {
+          com.google.protobuf.ByteString b = 
+              com.google.protobuf.ByteString.copyFromUtf8(
+                  (java.lang.String) ref);
+          id_ = b;
+          return b;
+        } else {
+          return (com.google.protobuf.ByteString) ref;
+        }
+      }
+      /**
+       * <pre>
+       * Unique identifier of the SecretStore.
+       * </pre>
+       *
+       * <code>string id = 1 [(.v1.field_options) = { ... }</code>
+       * @param value The id to set.
+       * @return This builder for chaining.
+       */
+      public Builder setId(
+          java.lang.String value) {
+        if (value == null) {
+    throw new NullPointerException();
+  }
+  
+        id_ = value;
+        onChanged();
+        return this;
+      }
+      /**
+       * <pre>
+       * Unique identifier of the SecretStore.
+       * </pre>
+       *
+       * <code>string id = 1 [(.v1.field_options) = { ... }</code>
+       * @return This builder for chaining.
+       */
+      public Builder clearId() {
+        
+        id_ = getDefaultInstance().getId();
+        onChanged();
+        return this;
+      }
+      /**
+       * <pre>
+       * Unique identifier of the SecretStore.
+       * </pre>
+       *
+       * <code>string id = 1 [(.v1.field_options) = { ... }</code>
+       * @param value The bytes for id to set.
+       * @return This builder for chaining.
+       */
+      public Builder setIdBytes(
+          com.google.protobuf.ByteString value) {
+        if (value == null) {
+    throw new NullPointerException();
+  }
+  checkByteStringIsUtf8(value);
+        
+        id_ = value;
+        onChanged();
+        return this;
+      }
+
+      private java.lang.Object name_ = "";
+      /**
+       * <pre>
+       * Unique human-readable name of the SecretStore.
+       * </pre>
+       *
+       * <code>string name = 2 [(.v1.field_options) = { ... }</code>
+       * @return The name.
+       */
+      public java.lang.String getName() {
+        java.lang.Object ref = name_;
+        if (!(ref instanceof java.lang.String)) {
+          com.google.protobuf.ByteString bs =
+              (com.google.protobuf.ByteString) ref;
+          java.lang.String s = bs.toStringUtf8();
+          name_ = s;
+          return s;
+        } else {
+          return (java.lang.String) ref;
+        }
+      }
+      /**
+       * <pre>
+       * Unique human-readable name of the SecretStore.
+       * </pre>
+       *
+       * <code>string name = 2 [(.v1.field_options) = { ... }</code>
+       * @return The bytes for name.
+       */
+      public com.google.protobuf.ByteString
+          getNameBytes() {
+        java.lang.Object ref = name_;
+        if (ref instanceof String) {
+          com.google.protobuf.ByteString b = 
+              com.google.protobuf.ByteString.copyFromUtf8(
+                  (java.lang.String) ref);
+          name_ = b;
+          return b;
+        } else {
+          return (com.google.protobuf.ByteString) ref;
+        }
+      }
+      /**
+       * <pre>
+       * Unique human-readable name of the SecretStore.
+       * </pre>
+       *
+       * <code>string name = 2 [(.v1.field_options) = { ... }</code>
+       * @param value The name to set.
+       * @return This builder for chaining.
+       */
+      public Builder setName(
+          java.lang.String value) {
+        if (value == null) {
+    throw new NullPointerException();
+  }
+  
+        name_ = value;
+        onChanged();
+        return this;
+      }
+      /**
+       * <pre>
+       * Unique human-readable name of the SecretStore.
+       * </pre>
+       *
+       * <code>string name = 2 [(.v1.field_options) = { ... }</code>
+       * @return This builder for chaining.
+       */
+      public Builder clearName() {
+        
+        name_ = getDefaultInstance().getName();
+        onChanged();
+        return this;
+      }
+      /**
+       * <pre>
+       * Unique human-readable name of the SecretStore.
+       * </pre>
+       *
+       * <code>string name = 2 [(.v1.field_options) = { ... }</code>
+       * @param value The bytes for name to set.
+       * @return This builder for chaining.
+       */
+      public Builder setNameBytes(
+          com.google.protobuf.ByteString value) {
+        if (value == null) {
+    throw new NullPointerException();
+  }
+  checkByteStringIsUtf8(value);
+        
+        name_ = value;
+        onChanged();
+        return this;
+      }
+
+      private java.lang.Object region_ = "";
+      /**
+       * <pre>
+       * The AWS region to target e.g. us-east-1
+       * </pre>
+       *
+       * <code>string region = 3 [(.v1.field_options) = { ... }</code>
+       * @return The region.
+       */
+      public java.lang.String getRegion() {
+        java.lang.Object ref = region_;
+        if (!(ref instanceof java.lang.String)) {
+          com.google.protobuf.ByteString bs =
+              (com.google.protobuf.ByteString) ref;
+          java.lang.String s = bs.toStringUtf8();
+          region_ = s;
+          return s;
+        } else {
+          return (java.lang.String) ref;
+        }
+      }
+      /**
+       * <pre>
+       * The AWS region to target e.g. us-east-1
+       * </pre>
+       *
+       * <code>string region = 3 [(.v1.field_options) = { ... }</code>
+       * @return The bytes for region.
+       */
+      public com.google.protobuf.ByteString
+          getRegionBytes() {
+        java.lang.Object ref = region_;
+        if (ref instanceof String) {
+          com.google.protobuf.ByteString b = 
+              com.google.protobuf.ByteString.copyFromUtf8(
+                  (java.lang.String) ref);
+          region_ = b;
+          return b;
+        } else {
+          return (com.google.protobuf.ByteString) ref;
+        }
+      }
+      /**
+       * <pre>
+       * The AWS region to target e.g. us-east-1
+       * </pre>
+       *
+       * <code>string region = 3 [(.v1.field_options) = { ... }</code>
+       * @param value The region to set.
+       * @return This builder for chaining.
+       */
+      public Builder setRegion(
+          java.lang.String value) {
+        if (value == null) {
+    throw new NullPointerException();
+  }
+  
+        region_ = value;
+        onChanged();
+        return this;
+      }
+      /**
+       * <pre>
+       * The AWS region to target e.g. us-east-1
+       * </pre>
+       *
+       * <code>string region = 3 [(.v1.field_options) = { ... }</code>
+       * @return This builder for chaining.
+       */
+      public Builder clearRegion() {
+        
+        region_ = getDefaultInstance().getRegion();
+        onChanged();
+        return this;
+      }
+      /**
+       * <pre>
+       * The AWS region to target e.g. us-east-1
+       * </pre>
+       *
+       * <code>string region = 3 [(.v1.field_options) = { ... }</code>
+       * @param value The bytes for region to set.
+       * @return This builder for chaining.
+       */
+      public Builder setRegionBytes(
+          com.google.protobuf.ByteString value) {
+        if (value == null) {
+    throw new NullPointerException();
+  }
+  checkByteStringIsUtf8(value);
+        
+        region_ = value;
+        onChanged();
+        return this;
+      }
+
+      private com.strongdm.api.plumbing.TagsPlumbing.Tags tags_;
+      private com.google.protobuf.SingleFieldBuilderV3<
+          com.strongdm.api.plumbing.TagsPlumbing.Tags, com.strongdm.api.plumbing.TagsPlumbing.Tags.Builder, com.strongdm.api.plumbing.TagsPlumbing.TagsOrBuilder> tagsBuilder_;
+      /**
+       * <pre>
+       * Tags is a map of key, value pairs.
+       * </pre>
+       *
+       * <code>.v1.Tags tags = 4 [(.v1.field_options) = { ... }</code>
+       * @return Whether the tags field is set.
+       */
+      public boolean hasTags() {
+        return tagsBuilder_ != null || tags_ != null;
+      }
+      /**
+       * <pre>
+       * Tags is a map of key, value pairs.
+       * </pre>
+       *
+       * <code>.v1.Tags tags = 4 [(.v1.field_options) = { ... }</code>
+       * @return The tags.
+       */
+      public com.strongdm.api.plumbing.TagsPlumbing.Tags getTags() {
+        if (tagsBuilder_ == null) {
+          return tags_ == null ? com.strongdm.api.plumbing.TagsPlumbing.Tags.getDefaultInstance() : tags_;
+        } else {
+          return tagsBuilder_.getMessage();
+        }
+      }
+      /**
+       * <pre>
+       * Tags is a map of key, value pairs.
+       * </pre>
+       *
+       * <code>.v1.Tags tags = 4 [(.v1.field_options) = { ... }</code>
+       */
+      public Builder setTags(com.strongdm.api.plumbing.TagsPlumbing.Tags value) {
+        if (tagsBuilder_ == null) {
+          if (value == null) {
+            throw new NullPointerException();
+          }
+          tags_ = value;
+          onChanged();
+        } else {
+          tagsBuilder_.setMessage(value);
+        }
+
+        return this;
+      }
+      /**
+       * <pre>
+       * Tags is a map of key, value pairs.
+       * </pre>
+       *
+       * <code>.v1.Tags tags = 4 [(.v1.field_options) = { ... }</code>
+       */
+      public Builder setTags(
+          com.strongdm.api.plumbing.TagsPlumbing.Tags.Builder builderForValue) {
+        if (tagsBuilder_ == null) {
+          tags_ = builderForValue.build();
+          onChanged();
+        } else {
+          tagsBuilder_.setMessage(builderForValue.build());
+        }
+
+        return this;
+      }
+      /**
+       * <pre>
+       * Tags is a map of key, value pairs.
+       * </pre>
+       *
+       * <code>.v1.Tags tags = 4 [(.v1.field_options) = { ... }</code>
+       */
+      public Builder mergeTags(com.strongdm.api.plumbing.TagsPlumbing.Tags value) {
+        if (tagsBuilder_ == null) {
+          if (tags_ != null) {
+            tags_ =
+              com.strongdm.api.plumbing.TagsPlumbing.Tags.newBuilder(tags_).mergeFrom(value).buildPartial();
+          } else {
+            tags_ = value;
+          }
+          onChanged();
+        } else {
+          tagsBuilder_.mergeFrom(value);
+        }
+
+        return this;
+      }
+      /**
+       * <pre>
+       * Tags is a map of key, value pairs.
+       * </pre>
+       *
+       * <code>.v1.Tags tags = 4 [(.v1.field_options) = { ... }</code>
+       */
+      public Builder clearTags() {
+        if (tagsBuilder_ == null) {
+          tags_ = null;
+          onChanged();
+        } else {
+          tags_ = null;
+          tagsBuilder_ = null;
+        }
+
+        return this;
+      }
+      /**
+       * <pre>
+       * Tags is a map of key, value pairs.
+       * </pre>
+       *
+       * <code>.v1.Tags tags = 4 [(.v1.field_options) = { ... }</code>
+       */
+      public com.strongdm.api.plumbing.TagsPlumbing.Tags.Builder getTagsBuilder() {
+        
+        onChanged();
+        return getTagsFieldBuilder().getBuilder();
+      }
+      /**
+       * <pre>
+       * Tags is a map of key, value pairs.
+       * </pre>
+       *
+       * <code>.v1.Tags tags = 4 [(.v1.field_options) = { ... }</code>
+       */
+      public com.strongdm.api.plumbing.TagsPlumbing.TagsOrBuilder getTagsOrBuilder() {
+        if (tagsBuilder_ != null) {
+          return tagsBuilder_.getMessageOrBuilder();
+        } else {
+          return tags_ == null ?
+              com.strongdm.api.plumbing.TagsPlumbing.Tags.getDefaultInstance() : tags_;
+        }
+      }
+      /**
+       * <pre>
+       * Tags is a map of key, value pairs.
+       * </pre>
+       *
+       * <code>.v1.Tags tags = 4 [(.v1.field_options) = { ... }</code>
+       */
+      private com.google.protobuf.SingleFieldBuilderV3<
+          com.strongdm.api.plumbing.TagsPlumbing.Tags, com.strongdm.api.plumbing.TagsPlumbing.Tags.Builder, com.strongdm.api.plumbing.TagsPlumbing.TagsOrBuilder> 
+          getTagsFieldBuilder() {
+        if (tagsBuilder_ == null) {
+          tagsBuilder_ = new com.google.protobuf.SingleFieldBuilderV3<
+              com.strongdm.api.plumbing.TagsPlumbing.Tags, com.strongdm.api.plumbing.TagsPlumbing.Tags.Builder, com.strongdm.api.plumbing.TagsPlumbing.TagsOrBuilder>(
+                  getTags(),
+                  getParentForChildren(),
+                  isClean());
+          tags_ = null;
+        }
+        return tagsBuilder_;
+      }
+      @java.lang.Override
+      public final Builder setUnknownFields(
+          final com.google.protobuf.UnknownFieldSet unknownFields) {
+        return super.setUnknownFields(unknownFields);
+      }
+
+      @java.lang.Override
+      public final Builder mergeUnknownFields(
+          final com.google.protobuf.UnknownFieldSet unknownFields) {
+        return super.mergeUnknownFields(unknownFields);
+      }
+
+
+      // @@protoc_insertion_point(builder_scope:v1.AWSStore)
+    }
+
+    // @@protoc_insertion_point(class_scope:v1.AWSStore)
+    private static final com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore DEFAULT_INSTANCE;
+    static {
+      DEFAULT_INSTANCE = new com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore();
+    }
+
+    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore getDefaultInstance() {
+      return DEFAULT_INSTANCE;
+    }
+
+    private static final com.google.protobuf.Parser<AWSStore>
+        PARSER = new com.google.protobuf.AbstractParser<AWSStore>() {
+      @java.lang.Override
+      public AWSStore parsePartialFrom(
+          com.google.protobuf.CodedInputStream input,
+          com.google.protobuf.ExtensionRegistryLite extensionRegistry)
+          throws com.google.protobuf.InvalidProtocolBufferException {
+        return new AWSStore(input, extensionRegistry);
+      }
+    };
+
+    public static com.google.protobuf.Parser<AWSStore> parser() {
+      return PARSER;
+    }
+
+    @java.lang.Override
+    public com.google.protobuf.Parser<AWSStore> getParserForType() {
+      return PARSER;
+    }
+
+    @java.lang.Override
+    public com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore getDefaultInstanceForType() {
+      return DEFAULT_INSTANCE;
+    }
+
+  }
+
+  public interface AWSCertX509StoreOrBuilder extends
+      // @@protoc_insertion_point(interface_extends:v1.AWSCertX509Store)
+      com.google.protobuf.MessageOrBuilder {
+
+    /**
+     * <pre>
+     * Unique identifier of the SecretStore.
+     * </pre>
+     *
+     * <code>string id = 1 [(.v1.field_options) = { ... }</code>
+     * @return The id.
+     */
+    java.lang.String getId();
+    /**
+     * <pre>
+     * Unique identifier of the SecretStore.
+     * </pre>
+     *
+     * <code>string id = 1 [(.v1.field_options) = { ... }</code>
+     * @return The bytes for id.
+     */
+    com.google.protobuf.ByteString
+        getIdBytes();
+
+    /**
+     * <pre>
+     * Unique human-readable name of the SecretStore.
+     * </pre>
+     *
+     * <code>string name = 2 [(.v1.field_options) = { ... }</code>
+     * @return The name.
+     */
+    java.lang.String getName();
+    /**
+     * <pre>
+     * Unique human-readable name of the SecretStore.
+     * </pre>
+     *
+     * <code>string name = 2 [(.v1.field_options) = { ... }</code>
+     * @return The bytes for name.
+     */
+    com.google.protobuf.ByteString
+        getNameBytes();
+
+    /**
+     * <pre>
+     * The ARN of the CA in AWS Private CA
+     * </pre>
+     *
+     * <code>string caArn = 5 [(.v1.field_options) = { ... }</code>
+     * @return The caArn.
+     */
+    java.lang.String getCaArn();
+    /**
+     * <pre>
+     * The ARN of the CA in AWS Private CA
+     * </pre>
+     *
+     * <code>string caArn = 5 [(.v1.field_options) = { ... }</code>
+     * @return The bytes for caArn.
+     */
+    com.google.protobuf.ByteString
+        getCaArnBytes();
+
+    /**
+     * <pre>
+     * The ARN of the AWS certificate template for requested certificates. Must allow SAN, key usage, and ext key usage passthrough from CSR
+     * </pre>
+     *
+     * <code>string certificateTemplateArn = 7 [(.v1.field_options) = { ... }</code>
+     * @return The certificateTemplateArn.
+     */
+    java.lang.String getCertificateTemplateArn();
+    /**
+     * <pre>
+     * The ARN of the AWS certificate template for requested certificates. Must allow SAN, key usage, and ext key usage passthrough from CSR
+     * </pre>
+     *
+     * <code>string certificateTemplateArn = 7 [(.v1.field_options) = { ... }</code>
+     * @return The bytes for certificateTemplateArn.
+     */
+    com.google.protobuf.ByteString
+        getCertificateTemplateArnBytes();
+
+    /**
+     * <pre>
+     * The lifetime of certificates issued by this CA represented in minutes e.g. 600 (for 10 hours). Defaults to 8 hours if not provided.
+     * </pre>
+     *
+     * <code>string issuedCertTTLMinutes = 8 [(.v1.field_options) = { ... }</code>
+     * @return The issuedCertTTLMinutes.
+     */
+    java.lang.String getIssuedCertTTLMinutes();
+    /**
+     * <pre>
+     * The lifetime of certificates issued by this CA represented in minutes e.g. 600 (for 10 hours). Defaults to 8 hours if not provided.
+     * </pre>
+     *
+     * <code>string issuedCertTTLMinutes = 8 [(.v1.field_options) = { ... }</code>
+     * @return The bytes for issuedCertTTLMinutes.
+     */
+    com.google.protobuf.ByteString
+        getIssuedCertTTLMinutesBytes();
+
+    /**
+     * <pre>
+     * The AWS region to target e.g. us-east-1
+     * </pre>
+     *
+     * <code>string region = 3 [(.v1.field_options) = { ... }</code>
+     * @return The region.
+     */
+    java.lang.String getRegion();
+    /**
+     * <pre>
+     * The AWS region to target e.g. us-east-1
+     * </pre>
+     *
+     * <code>string region = 3 [(.v1.field_options) = { ... }</code>
+     * @return The bytes for region.
+     */
+    com.google.protobuf.ByteString
+        getRegionBytes();
+
+    /**
+     * <pre>
+     * The specified signing algorithm family (RSA or ECDSA) must match the algorithm family of the CA's secret key. e.g. SHA256WITHRSA
+     * </pre>
+     *
+     * <code>string signingAlgo = 6 [(.v1.field_options) = { ... }</code>
+     * @return The signingAlgo.
+     */
+    java.lang.String getSigningAlgo();
+    /**
+     * <pre>
+     * The specified signing algorithm family (RSA or ECDSA) must match the algorithm family of the CA's secret key. e.g. SHA256WITHRSA
+     * </pre>
+     *
+     * <code>string signingAlgo = 6 [(.v1.field_options) = { ... }</code>
+     * @return The bytes for signingAlgo.
+     */
+    com.google.protobuf.ByteString
+        getSigningAlgoBytes();
+
+    /**
+     * <pre>
+     * Tags is a map of key, value pairs.
+     * </pre>
+     *
+     * <code>.v1.Tags tags = 4 [(.v1.field_options) = { ... }</code>
+     * @return Whether the tags field is set.
+     */
+    boolean hasTags();
+    /**
+     * <pre>
+     * Tags is a map of key, value pairs.
+     * </pre>
+     *
+     * <code>.v1.Tags tags = 4 [(.v1.field_options) = { ... }</code>
+     * @return The tags.
+     */
+    com.strongdm.api.plumbing.TagsPlumbing.Tags getTags();
+    /**
+     * <pre>
+     * Tags is a map of key, value pairs.
+     * </pre>
+     *
+     * <code>.v1.Tags tags = 4 [(.v1.field_options) = { ... }</code>
+     */
+    com.strongdm.api.plumbing.TagsPlumbing.TagsOrBuilder getTagsOrBuilder();
+  }
+  /**
+   * Protobuf type {@code v1.AWSCertX509Store}
    */
-  public static final class AWSStore extends
+  public static final class AWSCertX509Store extends
       com.google.protobuf.GeneratedMessageV3 implements
-      // @@protoc_insertion_point(message_implements:v1.AWSStore)
-      AWSStoreOrBuilder {
+      // @@protoc_insertion_point(message_implements:v1.AWSCertX509Store)
+      AWSCertX509StoreOrBuilder {
   private static final long serialVersionUID = 0L;
-    // Use AWSStore.newBuilder() to construct.
-    private AWSStore(com.google.protobuf.GeneratedMessageV3.Builder<?> builder) {
+    // Use AWSCertX509Store.newBuilder() to construct.
+    private AWSCertX509Store(com.google.protobuf.GeneratedMessageV3.Builder<?> builder) {
       super(builder);
     }
-    private AWSStore() {
+    private AWSCertX509Store() {
       id_ = "";
       name_ = "";
+      caArn_ = "";
+      certificateTemplateArn_ = "";
+      issuedCertTTLMinutes_ = "";
       region_ = "";
+      signingAlgo_ = "";
     }
 
     @java.lang.Override
     @SuppressWarnings({"unused"})
     protected java.lang.Object newInstance(
         UnusedPrivateParameter unused) {
-      return new AWSStore();
+      return new AWSCertX509Store();
     }
 
     @java.lang.Override
@@ -4560,7 +6115,7 @@ protected java.lang.Object newInstance(
     getUnknownFields() {
       return this.unknownFields;
     }
-    private AWSStore(
+    private AWSCertX509Store(
         com.google.protobuf.CodedInputStream input,
         com.google.protobuf.ExtensionRegistryLite extensionRegistry)
         throws com.google.protobuf.InvalidProtocolBufferException {
@@ -4609,6 +6164,30 @@ private AWSStore(
 
               break;
             }
+            case 42: {
+              java.lang.String s = input.readStringRequireUtf8();
+
+              caArn_ = s;
+              break;
+            }
+            case 50: {
+              java.lang.String s = input.readStringRequireUtf8();
+
+              signingAlgo_ = s;
+              break;
+            }
+            case 58: {
+              java.lang.String s = input.readStringRequireUtf8();
+
+              certificateTemplateArn_ = s;
+              break;
+            }
+            case 66: {
+              java.lang.String s = input.readStringRequireUtf8();
+
+              issuedCertTTLMinutes_ = s;
+              break;
+            }
             default: {
               if (!parseUnknownField(
                   input, unknownFields, extensionRegistry, tag)) {
@@ -4632,15 +6211,15 @@ private AWSStore(
     }
     public static final com.google.protobuf.Descriptors.Descriptor
         getDescriptor() {
-      return com.strongdm.api.plumbing.SecretStoresTypesPlumbing.internal_static_v1_AWSStore_descriptor;
+      return com.strongdm.api.plumbing.SecretStoresTypesPlumbing.internal_static_v1_AWSCertX509Store_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.strongdm.api.plumbing.SecretStoresTypesPlumbing.internal_static_v1_AWSStore_fieldAccessorTable
+      return com.strongdm.api.plumbing.SecretStoresTypesPlumbing.internal_static_v1_AWSCertX509Store_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
-              com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore.class, com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore.Builder.class);
+              com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store.class, com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store.Builder.class);
     }
 
     public static final int ID_FIELD_NUMBER = 1;
@@ -4735,6 +6314,144 @@ public java.lang.String getName() {
       }
     }
 
+    public static final int CAARN_FIELD_NUMBER = 5;
+    private volatile java.lang.Object caArn_;
+    /**
+     * <pre>
+     * The ARN of the CA in AWS Private CA
+     * </pre>
+     *
+     * <code>string caArn = 5 [(.v1.field_options) = { ... }</code>
+     * @return The caArn.
+     */
+    @java.lang.Override
+    public java.lang.String getCaArn() {
+      java.lang.Object ref = caArn_;
+      if (ref instanceof java.lang.String) {
+        return (java.lang.String) ref;
+      } else {
+        com.google.protobuf.ByteString bs = 
+            (com.google.protobuf.ByteString) ref;
+        java.lang.String s = bs.toStringUtf8();
+        caArn_ = s;
+        return s;
+      }
+    }
+    /**
+     * <pre>
+     * The ARN of the CA in AWS Private CA
+     * </pre>
+     *
+     * <code>string caArn = 5 [(.v1.field_options) = { ... }</code>
+     * @return The bytes for caArn.
+     */
+    @java.lang.Override
+    public com.google.protobuf.ByteString
+        getCaArnBytes() {
+      java.lang.Object ref = caArn_;
+      if (ref instanceof java.lang.String) {
+        com.google.protobuf.ByteString b = 
+            com.google.protobuf.ByteString.copyFromUtf8(
+                (java.lang.String) ref);
+        caArn_ = b;
+        return b;
+      } else {
+        return (com.google.protobuf.ByteString) ref;
+      }
+    }
+
+    public static final int CERTIFICATETEMPLATEARN_FIELD_NUMBER = 7;
+    private volatile java.lang.Object certificateTemplateArn_;
+    /**
+     * <pre>
+     * The ARN of the AWS certificate template for requested certificates. Must allow SAN, key usage, and ext key usage passthrough from CSR
+     * </pre>
+     *
+     * <code>string certificateTemplateArn = 7 [(.v1.field_options) = { ... }</code>
+     * @return The certificateTemplateArn.
+     */
+    @java.lang.Override
+    public java.lang.String getCertificateTemplateArn() {
+      java.lang.Object ref = certificateTemplateArn_;
+      if (ref instanceof java.lang.String) {
+        return (java.lang.String) ref;
+      } else {
+        com.google.protobuf.ByteString bs = 
+            (com.google.protobuf.ByteString) ref;
+        java.lang.String s = bs.toStringUtf8();
+        certificateTemplateArn_ = s;
+        return s;
+      }
+    }
+    /**
+     * <pre>
+     * The ARN of the AWS certificate template for requested certificates. Must allow SAN, key usage, and ext key usage passthrough from CSR
+     * </pre>
+     *
+     * <code>string certificateTemplateArn = 7 [(.v1.field_options) = { ... }</code>
+     * @return The bytes for certificateTemplateArn.
+     */
+    @java.lang.Override
+    public com.google.protobuf.ByteString
+        getCertificateTemplateArnBytes() {
+      java.lang.Object ref = certificateTemplateArn_;
+      if (ref instanceof java.lang.String) {
+        com.google.protobuf.ByteString b = 
+            com.google.protobuf.ByteString.copyFromUtf8(
+                (java.lang.String) ref);
+        certificateTemplateArn_ = b;
+        return b;
+      } else {
+        return (com.google.protobuf.ByteString) ref;
+      }
+    }
+
+    public static final int ISSUEDCERTTTLMINUTES_FIELD_NUMBER = 8;
+    private volatile java.lang.Object issuedCertTTLMinutes_;
+    /**
+     * <pre>
+     * The lifetime of certificates issued by this CA represented in minutes e.g. 600 (for 10 hours). Defaults to 8 hours if not provided.
+     * </pre>
+     *
+     * <code>string issuedCertTTLMinutes = 8 [(.v1.field_options) = { ... }</code>
+     * @return The issuedCertTTLMinutes.
+     */
+    @java.lang.Override
+    public java.lang.String getIssuedCertTTLMinutes() {
+      java.lang.Object ref = issuedCertTTLMinutes_;
+      if (ref instanceof java.lang.String) {
+        return (java.lang.String) ref;
+      } else {
+        com.google.protobuf.ByteString bs = 
+            (com.google.protobuf.ByteString) ref;
+        java.lang.String s = bs.toStringUtf8();
+        issuedCertTTLMinutes_ = s;
+        return s;
+      }
+    }
+    /**
+     * <pre>
+     * The lifetime of certificates issued by this CA represented in minutes e.g. 600 (for 10 hours). Defaults to 8 hours if not provided.
+     * </pre>
+     *
+     * <code>string issuedCertTTLMinutes = 8 [(.v1.field_options) = { ... }</code>
+     * @return The bytes for issuedCertTTLMinutes.
+     */
+    @java.lang.Override
+    public com.google.protobuf.ByteString
+        getIssuedCertTTLMinutesBytes() {
+      java.lang.Object ref = issuedCertTTLMinutes_;
+      if (ref instanceof java.lang.String) {
+        com.google.protobuf.ByteString b = 
+            com.google.protobuf.ByteString.copyFromUtf8(
+                (java.lang.String) ref);
+        issuedCertTTLMinutes_ = b;
+        return b;
+      } else {
+        return (com.google.protobuf.ByteString) ref;
+      }
+    }
+
     public static final int REGION_FIELD_NUMBER = 3;
     private volatile java.lang.Object region_;
     /**
@@ -4781,6 +6498,52 @@ public java.lang.String getRegion() {
       }
     }
 
+    public static final int SIGNINGALGO_FIELD_NUMBER = 6;
+    private volatile java.lang.Object signingAlgo_;
+    /**
+     * <pre>
+     * The specified signing algorithm family (RSA or ECDSA) must match the algorithm family of the CA's secret key. e.g. SHA256WITHRSA
+     * </pre>
+     *
+     * <code>string signingAlgo = 6 [(.v1.field_options) = { ... }</code>
+     * @return The signingAlgo.
+     */
+    @java.lang.Override
+    public java.lang.String getSigningAlgo() {
+      java.lang.Object ref = signingAlgo_;
+      if (ref instanceof java.lang.String) {
+        return (java.lang.String) ref;
+      } else {
+        com.google.protobuf.ByteString bs = 
+            (com.google.protobuf.ByteString) ref;
+        java.lang.String s = bs.toStringUtf8();
+        signingAlgo_ = s;
+        return s;
+      }
+    }
+    /**
+     * <pre>
+     * The specified signing algorithm family (RSA or ECDSA) must match the algorithm family of the CA's secret key. e.g. SHA256WITHRSA
+     * </pre>
+     *
+     * <code>string signingAlgo = 6 [(.v1.field_options) = { ... }</code>
+     * @return The bytes for signingAlgo.
+     */
+    @java.lang.Override
+    public com.google.protobuf.ByteString
+        getSigningAlgoBytes() {
+      java.lang.Object ref = signingAlgo_;
+      if (ref instanceof java.lang.String) {
+        com.google.protobuf.ByteString b = 
+            com.google.protobuf.ByteString.copyFromUtf8(
+                (java.lang.String) ref);
+        signingAlgo_ = b;
+        return b;
+      } else {
+        return (com.google.protobuf.ByteString) ref;
+      }
+    }
+
     public static final int TAGS_FIELD_NUMBER = 4;
     private com.strongdm.api.plumbing.TagsPlumbing.Tags tags_;
     /**
@@ -4845,6 +6608,18 @@ public void writeTo(com.google.protobuf.CodedOutputStream output)
       if (tags_ != null) {
         output.writeMessage(4, getTags());
       }
+      if (!com.google.protobuf.GeneratedMessageV3.isStringEmpty(caArn_)) {
+        com.google.protobuf.GeneratedMessageV3.writeString(output, 5, caArn_);
+      }
+      if (!com.google.protobuf.GeneratedMessageV3.isStringEmpty(signingAlgo_)) {
+        com.google.protobuf.GeneratedMessageV3.writeString(output, 6, signingAlgo_);
+      }
+      if (!com.google.protobuf.GeneratedMessageV3.isStringEmpty(certificateTemplateArn_)) {
+        com.google.protobuf.GeneratedMessageV3.writeString(output, 7, certificateTemplateArn_);
+      }
+      if (!com.google.protobuf.GeneratedMessageV3.isStringEmpty(issuedCertTTLMinutes_)) {
+        com.google.protobuf.GeneratedMessageV3.writeString(output, 8, issuedCertTTLMinutes_);
+      }
       unknownFields.writeTo(output);
     }
 
@@ -4867,6 +6642,18 @@ public int getSerializedSize() {
         size += com.google.protobuf.CodedOutputStream
           .computeMessageSize(4, getTags());
       }
+      if (!com.google.protobuf.GeneratedMessageV3.isStringEmpty(caArn_)) {
+        size += com.google.protobuf.GeneratedMessageV3.computeStringSize(5, caArn_);
+      }
+      if (!com.google.protobuf.GeneratedMessageV3.isStringEmpty(signingAlgo_)) {
+        size += com.google.protobuf.GeneratedMessageV3.computeStringSize(6, signingAlgo_);
+      }
+      if (!com.google.protobuf.GeneratedMessageV3.isStringEmpty(certificateTemplateArn_)) {
+        size += com.google.protobuf.GeneratedMessageV3.computeStringSize(7, certificateTemplateArn_);
+      }
+      if (!com.google.protobuf.GeneratedMessageV3.isStringEmpty(issuedCertTTLMinutes_)) {
+        size += com.google.protobuf.GeneratedMessageV3.computeStringSize(8, issuedCertTTLMinutes_);
+      }
       size += unknownFields.getSerializedSize();
       memoizedSize = size;
       return size;
@@ -4877,17 +6664,25 @@ public boolean equals(final java.lang.Object obj) {
       if (obj == this) {
        return true;
       }
-      if (!(obj instanceof com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore)) {
+      if (!(obj instanceof com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store)) {
         return super.equals(obj);
       }
-      com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore other = (com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore) obj;
+      com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store other = (com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store) obj;
 
       if (!getId()
           .equals(other.getId())) return false;
       if (!getName()
           .equals(other.getName())) return false;
+      if (!getCaArn()
+          .equals(other.getCaArn())) return false;
+      if (!getCertificateTemplateArn()
+          .equals(other.getCertificateTemplateArn())) return false;
+      if (!getIssuedCertTTLMinutes()
+          .equals(other.getIssuedCertTTLMinutes())) return false;
       if (!getRegion()
           .equals(other.getRegion())) return false;
+      if (!getSigningAlgo()
+          .equals(other.getSigningAlgo())) return false;
       if (hasTags() != other.hasTags()) return false;
       if (hasTags()) {
         if (!getTags()
@@ -4908,8 +6703,16 @@ public int hashCode() {
       hash = (53 * hash) + getId().hashCode();
       hash = (37 * hash) + NAME_FIELD_NUMBER;
       hash = (53 * hash) + getName().hashCode();
+      hash = (37 * hash) + CAARN_FIELD_NUMBER;
+      hash = (53 * hash) + getCaArn().hashCode();
+      hash = (37 * hash) + CERTIFICATETEMPLATEARN_FIELD_NUMBER;
+      hash = (53 * hash) + getCertificateTemplateArn().hashCode();
+      hash = (37 * hash) + ISSUEDCERTTTLMINUTES_FIELD_NUMBER;
+      hash = (53 * hash) + getIssuedCertTTLMinutes().hashCode();
       hash = (37 * hash) + REGION_FIELD_NUMBER;
       hash = (53 * hash) + getRegion().hashCode();
+      hash = (37 * hash) + SIGNINGALGO_FIELD_NUMBER;
+      hash = (53 * hash) + getSigningAlgo().hashCode();
       if (hasTags()) {
         hash = (37 * hash) + TAGS_FIELD_NUMBER;
         hash = (53 * hash) + getTags().hashCode();
@@ -4919,69 +6722,69 @@ public int hashCode() {
       return hash;
     }
 
-    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore parseFrom(
+    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store parseFrom(
         java.nio.ByteBuffer data)
         throws com.google.protobuf.InvalidProtocolBufferException {
       return PARSER.parseFrom(data);
     }
-    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore parseFrom(
+    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store parseFrom(
         java.nio.ByteBuffer data,
         com.google.protobuf.ExtensionRegistryLite extensionRegistry)
         throws com.google.protobuf.InvalidProtocolBufferException {
       return PARSER.parseFrom(data, extensionRegistry);
     }
-    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore parseFrom(
+    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store parseFrom(
         com.google.protobuf.ByteString data)
         throws com.google.protobuf.InvalidProtocolBufferException {
       return PARSER.parseFrom(data);
     }
-    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore parseFrom(
+    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store parseFrom(
         com.google.protobuf.ByteString data,
         com.google.protobuf.ExtensionRegistryLite extensionRegistry)
         throws com.google.protobuf.InvalidProtocolBufferException {
       return PARSER.parseFrom(data, extensionRegistry);
     }
-    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore parseFrom(byte[] data)
+    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store parseFrom(byte[] data)
         throws com.google.protobuf.InvalidProtocolBufferException {
       return PARSER.parseFrom(data);
     }
-    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore parseFrom(
+    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store parseFrom(
         byte[] data,
         com.google.protobuf.ExtensionRegistryLite extensionRegistry)
         throws com.google.protobuf.InvalidProtocolBufferException {
       return PARSER.parseFrom(data, extensionRegistry);
     }
-    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore parseFrom(java.io.InputStream input)
+    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store parseFrom(java.io.InputStream input)
         throws java.io.IOException {
       return com.google.protobuf.GeneratedMessageV3
           .parseWithIOException(PARSER, input);
     }
-    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore parseFrom(
+    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store parseFrom(
         java.io.InputStream input,
         com.google.protobuf.ExtensionRegistryLite extensionRegistry)
         throws java.io.IOException {
       return com.google.protobuf.GeneratedMessageV3
           .parseWithIOException(PARSER, input, extensionRegistry);
     }
-    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore parseDelimitedFrom(java.io.InputStream input)
+    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store parseDelimitedFrom(java.io.InputStream input)
         throws java.io.IOException {
       return com.google.protobuf.GeneratedMessageV3
           .parseDelimitedWithIOException(PARSER, input);
     }
-    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore parseDelimitedFrom(
+    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store parseDelimitedFrom(
         java.io.InputStream input,
         com.google.protobuf.ExtensionRegistryLite extensionRegistry)
         throws java.io.IOException {
       return com.google.protobuf.GeneratedMessageV3
           .parseDelimitedWithIOException(PARSER, input, extensionRegistry);
     }
-    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore parseFrom(
+    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store parseFrom(
         com.google.protobuf.CodedInputStream input)
         throws java.io.IOException {
       return com.google.protobuf.GeneratedMessageV3
           .parseWithIOException(PARSER, input);
     }
-    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore parseFrom(
+    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store parseFrom(
         com.google.protobuf.CodedInputStream input,
         com.google.protobuf.ExtensionRegistryLite extensionRegistry)
         throws java.io.IOException {
@@ -4994,7 +6797,7 @@ public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore parse
     public static Builder newBuilder() {
       return DEFAULT_INSTANCE.toBuilder();
     }
-    public static Builder newBuilder(com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore prototype) {
+    public static Builder newBuilder(com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store prototype) {
       return DEFAULT_INSTANCE.toBuilder().mergeFrom(prototype);
     }
     @java.lang.Override
@@ -5010,26 +6813,26 @@ protected Builder newBuilderForType(
       return builder;
     }
     /**
-     * Protobuf type {@code v1.AWSStore}
+     * Protobuf type {@code v1.AWSCertX509Store}
      */
     public static final class Builder extends
         com.google.protobuf.GeneratedMessageV3.Builder<Builder> implements
-        // @@protoc_insertion_point(builder_implements:v1.AWSStore)
-        com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStoreOrBuilder {
+        // @@protoc_insertion_point(builder_implements:v1.AWSCertX509Store)
+        com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509StoreOrBuilder {
       public static final com.google.protobuf.Descriptors.Descriptor
           getDescriptor() {
-        return com.strongdm.api.plumbing.SecretStoresTypesPlumbing.internal_static_v1_AWSStore_descriptor;
+        return com.strongdm.api.plumbing.SecretStoresTypesPlumbing.internal_static_v1_AWSCertX509Store_descriptor;
       }
 
       @java.lang.Override
       protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
           internalGetFieldAccessorTable() {
-        return com.strongdm.api.plumbing.SecretStoresTypesPlumbing.internal_static_v1_AWSStore_fieldAccessorTable
+        return com.strongdm.api.plumbing.SecretStoresTypesPlumbing.internal_static_v1_AWSCertX509Store_fieldAccessorTable
             .ensureFieldAccessorsInitialized(
-                com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore.class, com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore.Builder.class);
+                com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store.class, com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store.Builder.class);
       }
 
-      // Construct using com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore.newBuilder()
+      // Construct using com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store.newBuilder()
       private Builder() {
         maybeForceBuilderInitialization();
       }
@@ -5051,8 +6854,16 @@ public Builder clear() {
 
         name_ = "";
 
+        caArn_ = "";
+
+        certificateTemplateArn_ = "";
+
+        issuedCertTTLMinutes_ = "";
+
         region_ = "";
 
+        signingAlgo_ = "";
+
         if (tagsBuilder_ == null) {
           tags_ = null;
         } else {
@@ -5065,17 +6876,17 @@ public Builder clear() {
       @java.lang.Override
       public com.google.protobuf.Descriptors.Descriptor
           getDescriptorForType() {
-        return com.strongdm.api.plumbing.SecretStoresTypesPlumbing.internal_static_v1_AWSStore_descriptor;
+        return com.strongdm.api.plumbing.SecretStoresTypesPlumbing.internal_static_v1_AWSCertX509Store_descriptor;
       }
 
       @java.lang.Override
-      public com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore getDefaultInstanceForType() {
-        return com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore.getDefaultInstance();
+      public com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store getDefaultInstanceForType() {
+        return com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store.getDefaultInstance();
       }
 
       @java.lang.Override
-      public com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore build() {
-        com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore result = buildPartial();
+      public com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store build() {
+        com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store result = buildPartial();
         if (!result.isInitialized()) {
           throw newUninitializedMessageException(result);
         }
@@ -5083,11 +6894,15 @@ public com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore build() {
       }
 
       @java.lang.Override
-      public com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore buildPartial() {
-        com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore result = new com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore(this);
+      public com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store buildPartial() {
+        com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store result = new com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store(this);
         result.id_ = id_;
         result.name_ = name_;
+        result.caArn_ = caArn_;
+        result.certificateTemplateArn_ = certificateTemplateArn_;
+        result.issuedCertTTLMinutes_ = issuedCertTTLMinutes_;
         result.region_ = region_;
+        result.signingAlgo_ = signingAlgo_;
         if (tagsBuilder_ == null) {
           result.tags_ = tags_;
         } else {
@@ -5131,16 +6946,16 @@ public Builder addRepeatedField(
       }
       @java.lang.Override
       public Builder mergeFrom(com.google.protobuf.Message other) {
-        if (other instanceof com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore) {
-          return mergeFrom((com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore)other);
+        if (other instanceof com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store) {
+          return mergeFrom((com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store)other);
         } else {
           super.mergeFrom(other);
           return this;
         }
       }
 
-      public Builder mergeFrom(com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore other) {
-        if (other == com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore.getDefaultInstance()) return this;
+      public Builder mergeFrom(com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store other) {
+        if (other == com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store.getDefaultInstance()) return this;
         if (!other.getId().isEmpty()) {
           id_ = other.id_;
           onChanged();
@@ -5149,10 +6964,26 @@ public Builder mergeFrom(com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWS
           name_ = other.name_;
           onChanged();
         }
+        if (!other.getCaArn().isEmpty()) {
+          caArn_ = other.caArn_;
+          onChanged();
+        }
+        if (!other.getCertificateTemplateArn().isEmpty()) {
+          certificateTemplateArn_ = other.certificateTemplateArn_;
+          onChanged();
+        }
+        if (!other.getIssuedCertTTLMinutes().isEmpty()) {
+          issuedCertTTLMinutes_ = other.issuedCertTTLMinutes_;
+          onChanged();
+        }
         if (!other.getRegion().isEmpty()) {
           region_ = other.region_;
           onChanged();
         }
+        if (!other.getSigningAlgo().isEmpty()) {
+          signingAlgo_ = other.signingAlgo_;
+          onChanged();
+        }
         if (other.hasTags()) {
           mergeTags(other.getTags());
         }
@@ -5171,11 +7002,11 @@ public Builder mergeFrom(
           com.google.protobuf.CodedInputStream input,
           com.google.protobuf.ExtensionRegistryLite extensionRegistry)
           throws java.io.IOException {
-        com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore parsedMessage = null;
+        com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store parsedMessage = null;
         try {
           parsedMessage = PARSER.parsePartialFrom(input, extensionRegistry);
         } catch (com.google.protobuf.InvalidProtocolBufferException e) {
-          parsedMessage = (com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore) e.getUnfinishedMessage();
+          parsedMessage = (com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store) e.getUnfinishedMessage();
           throw e.unwrapIOException();
         } finally {
           if (parsedMessage != null) {
@@ -5377,6 +7208,294 @@ public Builder setNameBytes(
         return this;
       }
 
+      private java.lang.Object caArn_ = "";
+      /**
+       * <pre>
+       * The ARN of the CA in AWS Private CA
+       * </pre>
+       *
+       * <code>string caArn = 5 [(.v1.field_options) = { ... }</code>
+       * @return The caArn.
+       */
+      public java.lang.String getCaArn() {
+        java.lang.Object ref = caArn_;
+        if (!(ref instanceof java.lang.String)) {
+          com.google.protobuf.ByteString bs =
+              (com.google.protobuf.ByteString) ref;
+          java.lang.String s = bs.toStringUtf8();
+          caArn_ = s;
+          return s;
+        } else {
+          return (java.lang.String) ref;
+        }
+      }
+      /**
+       * <pre>
+       * The ARN of the CA in AWS Private CA
+       * </pre>
+       *
+       * <code>string caArn = 5 [(.v1.field_options) = { ... }</code>
+       * @return The bytes for caArn.
+       */
+      public com.google.protobuf.ByteString
+          getCaArnBytes() {
+        java.lang.Object ref = caArn_;
+        if (ref instanceof String) {
+          com.google.protobuf.ByteString b = 
+              com.google.protobuf.ByteString.copyFromUtf8(
+                  (java.lang.String) ref);
+          caArn_ = b;
+          return b;
+        } else {
+          return (com.google.protobuf.ByteString) ref;
+        }
+      }
+      /**
+       * <pre>
+       * The ARN of the CA in AWS Private CA
+       * </pre>
+       *
+       * <code>string caArn = 5 [(.v1.field_options) = { ... }</code>
+       * @param value The caArn to set.
+       * @return This builder for chaining.
+       */
+      public Builder setCaArn(
+          java.lang.String value) {
+        if (value == null) {
+    throw new NullPointerException();
+  }
+  
+        caArn_ = value;
+        onChanged();
+        return this;
+      }
+      /**
+       * <pre>
+       * The ARN of the CA in AWS Private CA
+       * </pre>
+       *
+       * <code>string caArn = 5 [(.v1.field_options) = { ... }</code>
+       * @return This builder for chaining.
+       */
+      public Builder clearCaArn() {
+        
+        caArn_ = getDefaultInstance().getCaArn();
+        onChanged();
+        return this;
+      }
+      /**
+       * <pre>
+       * The ARN of the CA in AWS Private CA
+       * </pre>
+       *
+       * <code>string caArn = 5 [(.v1.field_options) = { ... }</code>
+       * @param value The bytes for caArn to set.
+       * @return This builder for chaining.
+       */
+      public Builder setCaArnBytes(
+          com.google.protobuf.ByteString value) {
+        if (value == null) {
+    throw new NullPointerException();
+  }
+  checkByteStringIsUtf8(value);
+        
+        caArn_ = value;
+        onChanged();
+        return this;
+      }
+
+      private java.lang.Object certificateTemplateArn_ = "";
+      /**
+       * <pre>
+       * The ARN of the AWS certificate template for requested certificates. Must allow SAN, key usage, and ext key usage passthrough from CSR
+       * </pre>
+       *
+       * <code>string certificateTemplateArn = 7 [(.v1.field_options) = { ... }</code>
+       * @return The certificateTemplateArn.
+       */
+      public java.lang.String getCertificateTemplateArn() {
+        java.lang.Object ref = certificateTemplateArn_;
+        if (!(ref instanceof java.lang.String)) {
+          com.google.protobuf.ByteString bs =
+              (com.google.protobuf.ByteString) ref;
+          java.lang.String s = bs.toStringUtf8();
+          certificateTemplateArn_ = s;
+          return s;
+        } else {
+          return (java.lang.String) ref;
+        }
+      }
+      /**
+       * <pre>
+       * The ARN of the AWS certificate template for requested certificates. Must allow SAN, key usage, and ext key usage passthrough from CSR
+       * </pre>
+       *
+       * <code>string certificateTemplateArn = 7 [(.v1.field_options) = { ... }</code>
+       * @return The bytes for certificateTemplateArn.
+       */
+      public com.google.protobuf.ByteString
+          getCertificateTemplateArnBytes() {
+        java.lang.Object ref = certificateTemplateArn_;
+        if (ref instanceof String) {
+          com.google.protobuf.ByteString b = 
+              com.google.protobuf.ByteString.copyFromUtf8(
+                  (java.lang.String) ref);
+          certificateTemplateArn_ = b;
+          return b;
+        } else {
+          return (com.google.protobuf.ByteString) ref;
+        }
+      }
+      /**
+       * <pre>
+       * The ARN of the AWS certificate template for requested certificates. Must allow SAN, key usage, and ext key usage passthrough from CSR
+       * </pre>
+       *
+       * <code>string certificateTemplateArn = 7 [(.v1.field_options) = { ... }</code>
+       * @param value The certificateTemplateArn to set.
+       * @return This builder for chaining.
+       */
+      public Builder setCertificateTemplateArn(
+          java.lang.String value) {
+        if (value == null) {
+    throw new NullPointerException();
+  }
+  
+        certificateTemplateArn_ = value;
+        onChanged();
+        return this;
+      }
+      /**
+       * <pre>
+       * The ARN of the AWS certificate template for requested certificates. Must allow SAN, key usage, and ext key usage passthrough from CSR
+       * </pre>
+       *
+       * <code>string certificateTemplateArn = 7 [(.v1.field_options) = { ... }</code>
+       * @return This builder for chaining.
+       */
+      public Builder clearCertificateTemplateArn() {
+        
+        certificateTemplateArn_ = getDefaultInstance().getCertificateTemplateArn();
+        onChanged();
+        return this;
+      }
+      /**
+       * <pre>
+       * The ARN of the AWS certificate template for requested certificates. Must allow SAN, key usage, and ext key usage passthrough from CSR
+       * </pre>
+       *
+       * <code>string certificateTemplateArn = 7 [(.v1.field_options) = { ... }</code>
+       * @param value The bytes for certificateTemplateArn to set.
+       * @return This builder for chaining.
+       */
+      public Builder setCertificateTemplateArnBytes(
+          com.google.protobuf.ByteString value) {
+        if (value == null) {
+    throw new NullPointerException();
+  }
+  checkByteStringIsUtf8(value);
+        
+        certificateTemplateArn_ = value;
+        onChanged();
+        return this;
+      }
+
+      private java.lang.Object issuedCertTTLMinutes_ = "";
+      /**
+       * <pre>
+       * The lifetime of certificates issued by this CA represented in minutes e.g. 600 (for 10 hours). Defaults to 8 hours if not provided.
+       * </pre>
+       *
+       * <code>string issuedCertTTLMinutes = 8 [(.v1.field_options) = { ... }</code>
+       * @return The issuedCertTTLMinutes.
+       */
+      public java.lang.String getIssuedCertTTLMinutes() {
+        java.lang.Object ref = issuedCertTTLMinutes_;
+        if (!(ref instanceof java.lang.String)) {
+          com.google.protobuf.ByteString bs =
+              (com.google.protobuf.ByteString) ref;
+          java.lang.String s = bs.toStringUtf8();
+          issuedCertTTLMinutes_ = s;
+          return s;
+        } else {
+          return (java.lang.String) ref;
+        }
+      }
+      /**
+       * <pre>
+       * The lifetime of certificates issued by this CA represented in minutes e.g. 600 (for 10 hours). Defaults to 8 hours if not provided.
+       * </pre>
+       *
+       * <code>string issuedCertTTLMinutes = 8 [(.v1.field_options) = { ... }</code>
+       * @return The bytes for issuedCertTTLMinutes.
+       */
+      public com.google.protobuf.ByteString
+          getIssuedCertTTLMinutesBytes() {
+        java.lang.Object ref = issuedCertTTLMinutes_;
+        if (ref instanceof String) {
+          com.google.protobuf.ByteString b = 
+              com.google.protobuf.ByteString.copyFromUtf8(
+                  (java.lang.String) ref);
+          issuedCertTTLMinutes_ = b;
+          return b;
+        } else {
+          return (com.google.protobuf.ByteString) ref;
+        }
+      }
+      /**
+       * <pre>
+       * The lifetime of certificates issued by this CA represented in minutes e.g. 600 (for 10 hours). Defaults to 8 hours if not provided.
+       * </pre>
+       *
+       * <code>string issuedCertTTLMinutes = 8 [(.v1.field_options) = { ... }</code>
+       * @param value The issuedCertTTLMinutes to set.
+       * @return This builder for chaining.
+       */
+      public Builder setIssuedCertTTLMinutes(
+          java.lang.String value) {
+        if (value == null) {
+    throw new NullPointerException();
+  }
+  
+        issuedCertTTLMinutes_ = value;
+        onChanged();
+        return this;
+      }
+      /**
+       * <pre>
+       * The lifetime of certificates issued by this CA represented in minutes e.g. 600 (for 10 hours). Defaults to 8 hours if not provided.
+       * </pre>
+       *
+       * <code>string issuedCertTTLMinutes = 8 [(.v1.field_options) = { ... }</code>
+       * @return This builder for chaining.
+       */
+      public Builder clearIssuedCertTTLMinutes() {
+        
+        issuedCertTTLMinutes_ = getDefaultInstance().getIssuedCertTTLMinutes();
+        onChanged();
+        return this;
+      }
+      /**
+       * <pre>
+       * The lifetime of certificates issued by this CA represented in minutes e.g. 600 (for 10 hours). Defaults to 8 hours if not provided.
+       * </pre>
+       *
+       * <code>string issuedCertTTLMinutes = 8 [(.v1.field_options) = { ... }</code>
+       * @param value The bytes for issuedCertTTLMinutes to set.
+       * @return This builder for chaining.
+       */
+      public Builder setIssuedCertTTLMinutesBytes(
+          com.google.protobuf.ByteString value) {
+        if (value == null) {
+    throw new NullPointerException();
+  }
+  checkByteStringIsUtf8(value);
+        
+        issuedCertTTLMinutes_ = value;
+        onChanged();
+        return this;
+      }
+
       private java.lang.Object region_ = "";
       /**
        * <pre>
@@ -5473,6 +7592,102 @@ public Builder setRegionBytes(
         return this;
       }
 
+      private java.lang.Object signingAlgo_ = "";
+      /**
+       * <pre>
+       * The specified signing algorithm family (RSA or ECDSA) must match the algorithm family of the CA's secret key. e.g. SHA256WITHRSA
+       * </pre>
+       *
+       * <code>string signingAlgo = 6 [(.v1.field_options) = { ... }</code>
+       * @return The signingAlgo.
+       */
+      public java.lang.String getSigningAlgo() {
+        java.lang.Object ref = signingAlgo_;
+        if (!(ref instanceof java.lang.String)) {
+          com.google.protobuf.ByteString bs =
+              (com.google.protobuf.ByteString) ref;
+          java.lang.String s = bs.toStringUtf8();
+          signingAlgo_ = s;
+          return s;
+        } else {
+          return (java.lang.String) ref;
+        }
+      }
+      /**
+       * <pre>
+       * The specified signing algorithm family (RSA or ECDSA) must match the algorithm family of the CA's secret key. e.g. SHA256WITHRSA
+       * </pre>
+       *
+       * <code>string signingAlgo = 6 [(.v1.field_options) = { ... }</code>
+       * @return The bytes for signingAlgo.
+       */
+      public com.google.protobuf.ByteString
+          getSigningAlgoBytes() {
+        java.lang.Object ref = signingAlgo_;
+        if (ref instanceof String) {
+          com.google.protobuf.ByteString b = 
+              com.google.protobuf.ByteString.copyFromUtf8(
+                  (java.lang.String) ref);
+          signingAlgo_ = b;
+          return b;
+        } else {
+          return (com.google.protobuf.ByteString) ref;
+        }
+      }
+      /**
+       * <pre>
+       * The specified signing algorithm family (RSA or ECDSA) must match the algorithm family of the CA's secret key. e.g. SHA256WITHRSA
+       * </pre>
+       *
+       * <code>string signingAlgo = 6 [(.v1.field_options) = { ... }</code>
+       * @param value The signingAlgo to set.
+       * @return This builder for chaining.
+       */
+      public Builder setSigningAlgo(
+          java.lang.String value) {
+        if (value == null) {
+    throw new NullPointerException();
+  }
+  
+        signingAlgo_ = value;
+        onChanged();
+        return this;
+      }
+      /**
+       * <pre>
+       * The specified signing algorithm family (RSA or ECDSA) must match the algorithm family of the CA's secret key. e.g. SHA256WITHRSA
+       * </pre>
+       *
+       * <code>string signingAlgo = 6 [(.v1.field_options) = { ... }</code>
+       * @return This builder for chaining.
+       */
+      public Builder clearSigningAlgo() {
+        
+        signingAlgo_ = getDefaultInstance().getSigningAlgo();
+        onChanged();
+        return this;
+      }
+      /**
+       * <pre>
+       * The specified signing algorithm family (RSA or ECDSA) must match the algorithm family of the CA's secret key. e.g. SHA256WITHRSA
+       * </pre>
+       *
+       * <code>string signingAlgo = 6 [(.v1.field_options) = { ... }</code>
+       * @param value The bytes for signingAlgo to set.
+       * @return This builder for chaining.
+       */
+      public Builder setSigningAlgoBytes(
+          com.google.protobuf.ByteString value) {
+        if (value == null) {
+    throw new NullPointerException();
+  }
+  checkByteStringIsUtf8(value);
+        
+        signingAlgo_ = value;
+        onChanged();
+        return this;
+      }
+
       private com.strongdm.api.plumbing.TagsPlumbing.Tags tags_;
       private com.google.protobuf.SingleFieldBuilderV3<
           com.strongdm.api.plumbing.TagsPlumbing.Tags, com.strongdm.api.plumbing.TagsPlumbing.Tags.Builder, com.strongdm.api.plumbing.TagsPlumbing.TagsOrBuilder> tagsBuilder_;
@@ -5640,41 +7855,41 @@ public final Builder mergeUnknownFields(
       }
 
 
-      // @@protoc_insertion_point(builder_scope:v1.AWSStore)
+      // @@protoc_insertion_point(builder_scope:v1.AWSCertX509Store)
     }
 
-    // @@protoc_insertion_point(class_scope:v1.AWSStore)
-    private static final com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore DEFAULT_INSTANCE;
+    // @@protoc_insertion_point(class_scope:v1.AWSCertX509Store)
+    private static final com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store DEFAULT_INSTANCE;
     static {
-      DEFAULT_INSTANCE = new com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore();
+      DEFAULT_INSTANCE = new com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store();
     }
 
-    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore getDefaultInstance() {
+    public static com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store getDefaultInstance() {
       return DEFAULT_INSTANCE;
     }
 
-    private static final com.google.protobuf.Parser<AWSStore>
-        PARSER = new com.google.protobuf.AbstractParser<AWSStore>() {
+    private static final com.google.protobuf.Parser<AWSCertX509Store>
+        PARSER = new com.google.protobuf.AbstractParser<AWSCertX509Store>() {
       @java.lang.Override
-      public AWSStore parsePartialFrom(
+      public AWSCertX509Store parsePartialFrom(
           com.google.protobuf.CodedInputStream input,
           com.google.protobuf.ExtensionRegistryLite extensionRegistry)
           throws com.google.protobuf.InvalidProtocolBufferException {
-        return new AWSStore(input, extensionRegistry);
+        return new AWSCertX509Store(input, extensionRegistry);
       }
     };
 
-    public static com.google.protobuf.Parser<AWSStore> parser() {
+    public static com.google.protobuf.Parser<AWSCertX509Store> parser() {
       return PARSER;
     }
 
     @java.lang.Override
-    public com.google.protobuf.Parser<AWSStore> getParserForType() {
+    public com.google.protobuf.Parser<AWSCertX509Store> getParserForType() {
       return PARSER;
     }
 
     @java.lang.Override
-    public com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSStore getDefaultInstanceForType() {
+    public com.strongdm.api.plumbing.SecretStoresTypesPlumbing.AWSCertX509Store getDefaultInstanceForType() {
       return DEFAULT_INSTANCE;
     }
 
@@ -31870,6 +34085,11 @@ public com.strongdm.api.plumbing.SecretStoresTypesPlumbing.VaultTokenCertX509Sto
   private static final 
     com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
       internal_static_v1_AWSStore_fieldAccessorTable;
+  private static final com.google.protobuf.Descriptors.Descriptor
+    internal_static_v1_AWSCertX509Store_descriptor;
+  private static final 
+    com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
+      internal_static_v1_AWSCertX509Store_fieldAccessorTable;
   private static final com.google.protobuf.Descriptors.Descriptor
     internal_static_v1_AzureStore_descriptor;
   private static final 
@@ -31960,242 +34180,260 @@ public com.strongdm.api.plumbing.SecretStoresTypesPlumbing.VaultTokenCertX509Sto
   static {
     java.lang.String[] descriptorData = {
       "\n\030secret_store_types.proto\022\002v1\032\roptions." +
-      "proto\032\ntags.proto\"\243\r\n\013SecretStore\022?\n\003aws" +
+      "proto\032\ntags.proto\"\377\r\n\013SecretStore\022?\n\003aws" +
       "\030\003 \001(\0132\014.v1.AWSStoreB\"\362\370\263\007\035\312\363\263\007\030\302\364\263\007\023\n\014j" +
-      "son_gateway\022\003awsH\000\022E\n\005azure\030e \001(\0132\016.v1.A" +
-      "zureStoreB$\362\370\263\007\037\312\363\263\007\032\302\364\263\007\025\n\014json_gateway" +
-      "\022\005azureH\000\022b\n\017cyberark_conjur\030\255\002 \001(\0132\027.v1" +
-      ".CyberarkConjurStoreB-\362\370\263\007(\312\363\263\007#\302\364\263\007\036\n\014j" +
-      "son_gateway\022\016cyberarkConjurH\000\022Y\n\014cyberar" +
-      "k_pam\030\257\002 \001(\0132\024.v1.CyberarkPAMStoreB*\362\370\263\007" +
-      "%\312\363\263\007 \302\364\263\007\033\n\014json_gateway\022\013cyberarkPAMH\000" +
-      "\022~\n\031cyberark_pam_experimental\030\256\002 \001(\0132 .v" +
-      "1.CyberarkPAMExperimentalStoreB6\362\370\263\0071\312\363\263" +
-      "\007,\302\364\263\007\'\n\014json_gateway\022\027cyberarkPAMExperi" +
-      "mentalH\000\022L\n\007delinea\030\324\026 \001(\0132\020.v1.DelineaS" +
-      "toreB&\362\370\263\007!\312\363\263\007\034\302\364\263\007\027\n\014json_gateway\022\007del" +
-      "ineaH\000\022@\n\003gcp\030\311\001 \001(\0132\014.v1.GCPStoreB\"\362\370\263\007" +
-      "\035\312\363\263\007\030\302\364\263\007\023\n\014json_gateway\022\003gcpH\000\022[\n\016gcp_" +
-      "cert_x_509\030\312\001 \001(\0132\024.v1.GCPCertX509StoreB" +
-      "*\362\370\263\007%\312\363\263\007 \302\364\263\007\033\n\014json_gateway\022\013gcpCertX" +
-      "509H\000\022\\\n\016vault_app_role\030\004 \001(\0132\025.v1.Vault" +
-      "AppRoleStoreB+\362\370\263\007&\312\363\263\007!\302\364\263\007\034\n\014json_gate" +
-      "way\022\014vaultAppRoleH\000\022s\n\027vault_app_role_ce" +
-      "rt_ssh\030^ \001(\0132\034.v1.VaultAppRoleCertSSHSto" +
-      "reB2\362\370\263\007-\312\363\263\007(\302\364\263\007#\n\014json_gateway\022\023vault" +
-      "AppRoleCertSSHH\000\022w\n\031vault_app_role_cert_" +
-      "x_509\030_ \001(\0132\035.v1.VaultAppRoleCertX509Sto" +
-      "reB3\362\370\263\007.\312\363\263\007)\302\364\263\007$\n\014json_gateway\022\024vault" +
-      "AppRoleCertX509H\000\022O\n\tvault_tls\030\001 \001(\0132\021.v" +
-      "1.VaultTLSStoreB\'\362\370\263\007\"\312\363\263\007\035\302\364\263\007\030\n\014json_g" +
-      "ateway\022\010vaultTLSH\000\022f\n\022vault_tls_cert_ssh" +
-      "\030\\ \001(\0132\030.v1.VaultTLSCertSSHStoreB.\362\370\263\007)\312" +
-      "\363\263\007$\302\364\263\007\037\n\014json_gateway\022\017vaultTLSCertSSH" +
-      "H\000\022j\n\024vault_tls_cert_x_509\030] \001(\0132\031.v1.Va" +
-      "ultTLSCertX509StoreB/\362\370\263\007*\312\363\263\007%\302\364\263\007 \n\014js" +
-      "on_gateway\022\020vaultTLSCertX509H\000\022U\n\013vault_" +
-      "token\030\002 \001(\0132\023.v1.VaultTokenStoreB)\362\370\263\007$\312" +
-      "\363\263\007\037\302\364\263\007\032\n\014json_gateway\022\nvaultTokenH\000\022l\n" +
-      "\024vault_token_cert_ssh\030Z \001(\0132\032.v1.VaultTo" +
-      "kenCertSSHStoreB0\362\370\263\007+\312\363\263\007&\302\364\263\007!\n\014json_g" +
-      "ateway\022\021vaultTokenCertSSHH\000\022p\n\026vault_tok" +
-      "en_cert_x_509\030[ \001(\0132\033.v1.VaultTokenCertX" +
-      "509StoreB1\362\370\263\007,\312\363\263\007\'\302\364\263\007\"\n\014json_gateway\022" +
-      "\022vaultTokenCertX509H\000:\n\372\370\263\007\005\250\363\263\007\001B,\n\014sec" +
-      "ret_store\022\034\252\370\263\007\t\252\370\263\007\004tags\252\370\263\007\t\252\370\263\007\004name\"" +
-      "\374\001\n\010AWSStore\022\026\n\002id\030\001 \001(\tB\n\362\370\263\007\005\260\363\263\007\001\022\035\n\004" +
-      "name\030\002 \001(\tB\017\362\370\263\007\n\260\363\263\007\001\300\363\263\007\001\022?\n\006region\030\003 " +
-      "\001(\tB/\362\370\263\007*\260\363\263\007\001\300\363\263\007\001\312\363\263\007\033\302\364\263\007\026\n\014json_gat" +
-      "eway\022\006region\022\"\n\004tags\030\004 \001(\0132\010.v1.TagsB\n\362\370" +
-      "\263\007\005\260\363\263\007\001:T\372\370\263\007O\250\363\263\007\001\312\363\263\007E\302\364\263\007\n\n\003cli\022\003aws" +
-      "\302\364\263\007\023\n\014json_gateway\022\003aws\302\364\263\007\031\n\022terraform" +
-      "-provider\022\003aws\"\353\001\n\nAzureStore\022\026\n\002id\030\001 \001(" +
-      "\tB\n\362\370\263\007\005\260\363\263\007\001\022\035\n\004name\030\002 \001(\tB\017\362\370\263\007\n\260\363\263\007\001\300" +
-      "\363\263\007\001\022D\n\tvault_uri\030\003 \001(\tB1\362\370\263\007,\260\363\263\007\001\300\363\263\007\001" +
-      "\312\363\263\007\035\302\364\263\007\030\n\014json_gateway\022\010vaultUri\022$\n\004ta" +
-      "gs\030\203\200\002 \001(\0132\010.v1.TagsB\n\362\370\263\007\005\260\363\263\007\001::\372\370\263\0075\250" +
-      "\363\263\007\001\312\363\263\007+\302\364\263\007\014\n\003cli\022\005azure\302\364\263\007\025\n\014json_ga" +
-      "teway\022\005azure\"\253\002\n\023CyberarkConjurStore\022\026\n\002" +
-      "id\030\001 \001(\tB\n\362\370\263\007\005\260\363\263\007\001\022\035\n\004name\030\002 \001(\tB\017\362\370\263\007" +
-      "\n\260\363\263\007\001\300\363\263\007\001\022?\n\006appURL\030\003 \001(\tB/\362\370\263\007*\260\363\263\007\001\300" +
-      "\363\263\007\001\312\363\263\007\033\302\364\263\007\026\n\014json_gateway\022\006appUrl\022$\n\004" +
-      "tags\030\203\200\002 \001(\0132\010.v1.TagsB\n\362\370\263\007\005\260\363\263\007\001:v\372\370\263\007" +
-      "q\250\363\263\007\001\312\363\263\007g\302\364\263\007\025\n\003cli\022\016cyberarkConjur\302\364\263" +
-      "\007\036\n\014json_gateway\022\016cyberarkConjur\302\364\263\007%\n\022t" +
-      "erraform-provider\022\017cyberark_conjur\"\237\002\n\020C" +
-      "yberarkPAMStore\022\026\n\002id\030\001 \001(\tB\n\362\370\263\007\005\260\363\263\007\001\022" +
-      "\035\n\004name\030\002 \001(\tB\017\362\370\263\007\n\260\363\263\007\001\300\363\263\007\001\022?\n\006appURL" +
+      "son_gateway\022\003awsH\000\022Z\n\016aws_cert_x_509\030\036 \001" +
+      "(\0132\024.v1.AWSCertX509StoreB*\362\370\263\007%\312\363\263\007 \302\364\263\007" +
+      "\033\n\014json_gateway\022\013awsCertX509H\000\022E\n\005azure\030" +
+      "e \001(\0132\016.v1.AzureStoreB$\362\370\263\007\037\312\363\263\007\032\302\364\263\007\025\n\014" +
+      "json_gateway\022\005azureH\000\022b\n\017cyberark_conjur" +
+      "\030\255\002 \001(\0132\027.v1.CyberarkConjurStoreB-\362\370\263\007(\312" +
+      "\363\263\007#\302\364\263\007\036\n\014json_gateway\022\016cyberarkConjurH" +
+      "\000\022Y\n\014cyberark_pam\030\257\002 \001(\0132\024.v1.CyberarkPA" +
+      "MStoreB*\362\370\263\007%\312\363\263\007 \302\364\263\007\033\n\014json_gateway\022\013c" +
+      "yberarkPAMH\000\022~\n\031cyberark_pam_experimenta" +
+      "l\030\256\002 \001(\0132 .v1.CyberarkPAMExperimentalSto" +
+      "reB6\362\370\263\0071\312\363\263\007,\302\364\263\007\'\n\014json_gateway\022\027cyber" +
+      "arkPAMExperimentalH\000\022L\n\007delinea\030\324\026 \001(\0132\020" +
+      ".v1.DelineaStoreB&\362\370\263\007!\312\363\263\007\034\302\364\263\007\027\n\014json_" +
+      "gateway\022\007delineaH\000\022@\n\003gcp\030\311\001 \001(\0132\014.v1.GC" +
+      "PStoreB\"\362\370\263\007\035\312\363\263\007\030\302\364\263\007\023\n\014json_gateway\022\003g" +
+      "cpH\000\022[\n\016gcp_cert_x_509\030\312\001 \001(\0132\024.v1.GCPCe" +
+      "rtX509StoreB*\362\370\263\007%\312\363\263\007 \302\364\263\007\033\n\014json_gatew" +
+      "ay\022\013gcpCertX509H\000\022\\\n\016vault_app_role\030\004 \001(" +
+      "\0132\025.v1.VaultAppRoleStoreB+\362\370\263\007&\312\363\263\007!\302\364\263\007" +
+      "\034\n\014json_gateway\022\014vaultAppRoleH\000\022s\n\027vault" +
+      "_app_role_cert_ssh\030^ \001(\0132\034.v1.VaultAppRo" +
+      "leCertSSHStoreB2\362\370\263\007-\312\363\263\007(\302\364\263\007#\n\014json_ga" +
+      "teway\022\023vaultAppRoleCertSSHH\000\022w\n\031vault_ap" +
+      "p_role_cert_x_509\030_ \001(\0132\035.v1.VaultAppRol" +
+      "eCertX509StoreB3\362\370\263\007.\312\363\263\007)\302\364\263\007$\n\014json_ga" +
+      "teway\022\024vaultAppRoleCertX509H\000\022O\n\tvault_t" +
+      "ls\030\001 \001(\0132\021.v1.VaultTLSStoreB\'\362\370\263\007\"\312\363\263\007\035\302" +
+      "\364\263\007\030\n\014json_gateway\022\010vaultTLSH\000\022f\n\022vault_" +
+      "tls_cert_ssh\030\\ \001(\0132\030.v1.VaultTLSCertSSHS" +
+      "toreB.\362\370\263\007)\312\363\263\007$\302\364\263\007\037\n\014json_gateway\022\017vau" +
+      "ltTLSCertSSHH\000\022j\n\024vault_tls_cert_x_509\030]" +
+      " \001(\0132\031.v1.VaultTLSCertX509StoreB/\362\370\263\007*\312\363" +
+      "\263\007%\302\364\263\007 \n\014json_gateway\022\020vaultTLSCertX509" +
+      "H\000\022U\n\013vault_token\030\002 \001(\0132\023.v1.VaultTokenS" +
+      "toreB)\362\370\263\007$\312\363\263\007\037\302\364\263\007\032\n\014json_gateway\022\nvau" +
+      "ltTokenH\000\022l\n\024vault_token_cert_ssh\030Z \001(\0132" +
+      "\032.v1.VaultTokenCertSSHStoreB0\362\370\263\007+\312\363\263\007&\302" +
+      "\364\263\007!\n\014json_gateway\022\021vaultTokenCertSSHH\000\022" +
+      "p\n\026vault_token_cert_x_509\030[ \001(\0132\033.v1.Vau" +
+      "ltTokenCertX509StoreB1\362\370\263\007,\312\363\263\007\'\302\364\263\007\"\n\014j" +
+      "son_gateway\022\022vaultTokenCertX509H\000:\n\372\370\263\007\005" +
+      "\250\363\263\007\001B,\n\014secret_store\022\034\252\370\263\007\t\252\370\263\007\004tags\252\370\263" +
+      "\007\t\252\370\263\007\004name\"\374\001\n\010AWSStore\022\026\n\002id\030\001 \001(\tB\n\362\370" +
+      "\263\007\005\260\363\263\007\001\022\035\n\004name\030\002 \001(\tB\017\362\370\263\007\n\260\363\263\007\001\300\363\263\007\001\022" +
+      "?\n\006region\030\003 \001(\tB/\362\370\263\007*\260\363\263\007\001\300\363\263\007\001\312\363\263\007\033\302\364\263" +
+      "\007\026\n\014json_gateway\022\006region\022\"\n\004tags\030\004 \001(\0132\010" +
+      ".v1.TagsB\n\362\370\263\007\005\260\363\263\007\001:T\372\370\263\007O\250\363\263\007\001\312\363\263\007E\302\364\263" +
+      "\007\n\n\003cli\022\003aws\302\364\263\007\023\n\014json_gateway\022\003aws\302\364\263\007" +
+      "\031\n\022terraform-provider\022\003aws\"\346\004\n\020AWSCertX5" +
+      "09Store\022\026\n\002id\030\001 \001(\tB\n\362\370\263\007\005\260\363\263\007\001\022\035\n\004name\030" +
+      "\002 \001(\tB\017\362\370\263\007\n\260\363\263\007\001\300\363\263\007\001\022=\n\005caArn\030\005 \001(\tB.\362" +
+      "\370\263\007)\260\363\263\007\001\300\363\263\007\001\312\363\263\007\032\302\364\263\007\025\n\014json_gateway\022\005" +
+      "caArn\022_\n\026certificateTemplateArn\030\007 \001(\tB?\362" +
+      "\370\263\007:\260\363\263\007\001\300\363\263\007\001\312\363\263\007+\302\364\263\007&\n\014json_gateway\022\026" +
+      "certificateTemplateArn\022V\n\024issuedCertTTLM" +
+      "inutes\030\010 \001(\tB8\362\370\263\0073\260\363\263\007\001\312\363\263\007)\302\364\263\007$\n\014json" +
+      "_gateway\022\024issuedCertTtlMinutes\022?\n\006region" +
       "\030\003 \001(\tB/\362\370\263\007*\260\363\263\007\001\300\363\263\007\001\312\363\263\007\033\302\364\263\007\026\n\014json_" +
-      "gateway\022\006appUrl\022$\n\004tags\030\203\200\002 \001(\0132\010.v1.Tag" +
-      "sB\n\362\370\263\007\005\260\363\263\007\001:m\372\370\263\007h\250\363\263\007\001\312\363\263\007^\302\364\263\007\022\n\003cli" +
-      "\022\013cyberarkPAM\302\364\263\007\033\n\014json_gateway\022\013cybera" +
-      "rkPAM\302\364\263\007\"\n\022terraform-provider\022\014cyberark" +
-      "_pam\"\330\002\n\034CyberarkPAMExperimentalStore\022\026\n" +
+      "gateway\022\006region\022I\n\013signingAlgo\030\006 \001(\tB4\362\370" +
+      "\263\007/\260\363\263\007\001\300\363\263\007\001\312\363\263\007 \302\364\263\007\033\n\014json_gateway\022\013s" +
+      "igningAlgo\022\"\n\004tags\030\004 \001(\0132\010.v1.TagsB\n\362\370\263\007" +
+      "\005\260\363\263\007\001:s\372\370\263\007n\250\363\263\007\001\312\363\263\007d\210\364\263\007\001\302\364\263\007\022\n\003cli\022\013" +
+      "awsCertX509\302\364\263\007\033\n\014json_gateway\022\013awsCertX" +
+      "509\302\364\263\007#\n\022terraform-provider\022\raws_cert_x" +
+      "509\"\353\001\n\nAzureStore\022\026\n\002id\030\001 \001(\tB\n\362\370\263\007\005\260\363\263" +
+      "\007\001\022\035\n\004name\030\002 \001(\tB\017\362\370\263\007\n\260\363\263\007\001\300\363\263\007\001\022D\n\tvau" +
+      "lt_uri\030\003 \001(\tB1\362\370\263\007,\260\363\263\007\001\300\363\263\007\001\312\363\263\007\035\302\364\263\007\030\n" +
+      "\014json_gateway\022\010vaultUri\022$\n\004tags\030\203\200\002 \001(\0132" +
+      "\010.v1.TagsB\n\362\370\263\007\005\260\363\263\007\001::\372\370\263\0075\250\363\263\007\001\312\363\263\007+\302\364" +
+      "\263\007\014\n\003cli\022\005azure\302\364\263\007\025\n\014json_gateway\022\005azur" +
+      "e\"\253\002\n\023CyberarkConjurStore\022\026\n\002id\030\001 \001(\tB\n\362" +
+      "\370\263\007\005\260\363\263\007\001\022\035\n\004name\030\002 \001(\tB\017\362\370\263\007\n\260\363\263\007\001\300\363\263\007\001" +
+      "\022?\n\006appURL\030\003 \001(\tB/\362\370\263\007*\260\363\263\007\001\300\363\263\007\001\312\363\263\007\033\302\364" +
+      "\263\007\026\n\014json_gateway\022\006appUrl\022$\n\004tags\030\203\200\002 \001(" +
+      "\0132\010.v1.TagsB\n\362\370\263\007\005\260\363\263\007\001:v\372\370\263\007q\250\363\263\007\001\312\363\263\007g" +
+      "\302\364\263\007\025\n\003cli\022\016cyberarkConjur\302\364\263\007\036\n\014json_ga" +
+      "teway\022\016cyberarkConjur\302\364\263\007%\n\022terraform-pr" +
+      "ovider\022\017cyberark_conjur\"\237\002\n\020CyberarkPAMS" +
+      "tore\022\026\n\002id\030\001 \001(\tB\n\362\370\263\007\005\260\363\263\007\001\022\035\n\004name\030\002 \001" +
+      "(\tB\017\362\370\263\007\n\260\363\263\007\001\300\363\263\007\001\022?\n\006appURL\030\003 \001(\tB/\362\370\263" +
+      "\007*\260\363\263\007\001\300\363\263\007\001\312\363\263\007\033\302\364\263\007\026\n\014json_gateway\022\006ap" +
+      "pUrl\022$\n\004tags\030\203\200\002 \001(\0132\010.v1.TagsB\n\362\370\263\007\005\260\363\263" +
+      "\007\001:m\372\370\263\007h\250\363\263\007\001\312\363\263\007^\302\364\263\007\022\n\003cli\022\013cyberarkP" +
+      "AM\302\364\263\007\033\n\014json_gateway\022\013cyberarkPAM\302\364\263\007\"\n" +
+      "\022terraform-provider\022\014cyberark_pam\"\330\002\n\034Cy" +
+      "berarkPAMExperimentalStore\022\026\n\002id\030\001 \001(\tB\n" +
+      "\362\370\263\007\005\260\363\263\007\001\022\035\n\004name\030\002 \001(\tB\017\362\370\263\007\n\260\363\263\007\001\300\363\263\007" +
+      "\001\022?\n\006appURL\030\003 \001(\tB/\362\370\263\007*\260\363\263\007\001\300\363\263\007\001\312\363\263\007\033\302" +
+      "\364\263\007\026\n\014json_gateway\022\006appUrl\022$\n\004tags\030\203\200\002 \001" +
+      "(\0132\010.v1.TagsB\n\362\370\263\007\005\260\363\263\007\001:\231\001\372\370\263\007\223\001\250\363\263\007\001\312\363" +
+      "\263\007\210\001\210\364\263\007\001\302\364\263\007\036\n\003cli\022\027cyberarkPAMExperime" +
+      "ntal\302\364\263\007\'\n\014json_gateway\022\027cyberarkPAMExpe" +
+      "rimental\302\364\263\007/\n\022terraform-provider\022\031cyber" +
+      "ark_pam_experimental\"\263\002\n\014DelineaStore\022\026\n" +
       "\002id\030\001 \001(\tB\n\362\370\263\007\005\260\363\263\007\001\022\035\n\004name\030\002 \001(\tB\017\362\370\263" +
-      "\007\n\260\363\263\007\001\300\363\263\007\001\022?\n\006appURL\030\003 \001(\tB/\362\370\263\007*\260\363\263\007\001" +
-      "\300\363\263\007\001\312\363\263\007\033\302\364\263\007\026\n\014json_gateway\022\006appUrl\022$\n" +
-      "\004tags\030\203\200\002 \001(\0132\010.v1.TagsB\n\362\370\263\007\005\260\363\263\007\001:\231\001\372\370" +
-      "\263\007\223\001\250\363\263\007\001\312\363\263\007\210\001\210\364\263\007\001\302\364\263\007\036\n\003cli\022\027cyberark" +
-      "PAMExperimental\302\364\263\007\'\n\014json_gateway\022\027cybe" +
-      "rarkPAMExperimental\302\364\263\007/\n\022terraform-prov" +
-      "ider\022\031cyberark_pam_experimental\"\263\002\n\014Deli" +
-      "neaStore\022\026\n\002id\030\001 \001(\tB\n\362\370\263\007\005\260\363\263\007\001\022\035\n\004name" +
-      "\030\002 \001(\tB\017\362\370\263\007\n\260\363\263\007\001\300\363\263\007\001\022A\n\nserver_url\030\003 " +
-      "\001(\tB-\362\370\263\007(\260\363\263\007\001\312\363\263\007\036\302\364\263\007\031\n\014json_gateway\022" +
-      "\tserverUrl\022C\n\013tenant_name\030\004 \001(\tB.\362\370\263\007)\260\363" +
-      "\263\007\001\312\363\263\007\037\302\364\263\007\032\n\014json_gateway\022\ntenantName\022" +
-      "$\n\004tags\030\203\200\002 \001(\0132\010.v1.TagsB\n\362\370\263\007\005\260\363\263\007\001:>\372" +
-      "\370\263\0079\250\363\263\007\001\312\363\263\007/\302\364\263\007\016\n\003cli\022\007delinea\302\364\263\007\027\n\014" +
-      "json_gateway\022\007delinea\"\346\001\n\010GCPStore\022\026\n\002id" +
-      "\030\001 \001(\tB\n\362\370\263\007\005\260\363\263\007\001\022\035\n\004name\030\002 \001(\tB\017\362\370\263\007\n\260" +
-      "\363\263\007\001\300\363\263\007\001\022E\n\tprojectID\030\003 \001(\tB2\362\370\263\007-\260\363\263\007\001" +
-      "\300\363\263\007\001\312\363\263\007\036\302\364\263\007\031\n\014json_gateway\022\tprojectId" +
-      "\022$\n\004tags\030\203\200\002 \001(\0132\010.v1.TagsB\n\362\370\263\007\005\260\363\263\007\001:6" +
-      "\372\370\263\0071\250\363\263\007\001\312\363\263\007\'\302\364\263\007\n\n\003cli\022\003gcp\302\364\263\007\023\n\014jso" +
-      "n_gateway\022\003gcp\"\305\003\n\020GCPCertX509Store\022\026\n\002i" +
-      "d\030\001 \001(\tB\n\362\370\263\007\005\260\363\263\007\001\022\035\n\004name\030\002 \001(\tB\017\362\370\263\007\n" +
-      "\260\363\263\007\001\300\363\263\007\001\0226\n\004caID\030\006 \001(\tB(\362\370\263\007#\260\363\263\007\001\312\363\263\007" +
-      "\031\302\364\263\007\024\n\014json_gateway\022\004caId\022C\n\010caPoolID\030\005" +
-      " \001(\tB1\362\370\263\007,\260\363\263\007\001\300\363\263\007\001\312\363\263\007\035\302\364\263\007\030\n\014json_ga" +
-      "teway\022\010caPoolId\022C\n\010location\030\004 \001(\tB1\362\370\263\007," +
-      "\260\363\263\007\001\300\363\263\007\001\312\363\263\007\035\302\364\263\007\030\n\014json_gateway\022\010loca" +
-      "tion\022E\n\tprojectID\030\003 \001(\tB2\362\370\263\007-\260\363\263\007\001\300\363\263\007\001" +
-      "\312\363\263\007\036\302\364\263\007\031\n\014json_gateway\022\tprojectId\022$\n\004t" +
-      "ags\030\203\200\002 \001(\0132\010.v1.TagsB\n\362\370\263\007\005\260\363\263\007\001:K\372\370\263\007F" +
-      "\250\363\263\007\001\312\363\263\007<\210\364\263\007\001\302\364\263\007\022\n\003cli\022\013gcpCertX509\302\364" +
-      "\263\007\033\n\014json_gateway\022\013gcpCertX509\"\362\002\n\021Vault" +
-      "AppRoleStore\022\026\n\002id\030\001 \001(\tB\n\362\370\263\007\005\260\363\263\007\001\022\035\n\004" +
-      "name\030\002 \001(\tB\017\362\370\263\007\n\260\363\263\007\001\300\363\263\007\001\022@\n\tnamespace" +
-      "\030\005 \001(\tB-\362\370\263\007(\260\363\263\007\001\312\363\263\007\036\302\364\263\007\031\n\014json_gatew" +
-      "ay\022\tnamespace\022N\n\016server_address\030\003 \001(\tB6\362" +
-      "\370\263\0071\260\363\263\007\001\300\363\263\007\001\312\363\263\007\"\302\364\263\007\035\n\014json_gateway\022\r" +
-      "serverAddress\022\"\n\004tags\030\010 \001(\0132\010.v1.TagsB\n\362" +
-      "\370\263\007\005\260\363\263\007\001:p\372\370\263\007k\250\363\263\007\001\312\363\263\007a\302\364\263\007\023\n\003cli\022\014va" +
-      "ultAppRole\302\364\263\007\034\n\014json_gateway\022\014vaultAppR" +
-      "ole\302\364\263\007#\n\022terraform-provider\022\rvault_appr" +
-      "ole\"\264\004\n\030VaultAppRoleCertSSHStore\022\026\n\002id\030\001" +
-      " \001(\tB\n\362\370\263\007\005\260\363\263\007\001\022\035\n\004name\030\002 \001(\tB\017\362\370\263\007\n\260\363\263" +
-      "\007\001\300\363\263\007\001\022@\n\tnamespace\030\005 \001(\tB-\362\370\263\007(\260\363\263\007\001\312\363" +
-      "\263\007\036\302\364\263\007\031\n\014json_gateway\022\tnamespace\022N\n\016ser" +
-      "ver_address\030\003 \001(\tB6\362\370\263\0071\260\363\263\007\001\300\363\263\007\001\312\363\263\007\"\302" +
-      "\364\263\007\035\n\014json_gateway\022\rserverAddress\022J\n\014sig" +
-      "ning_role\030\007 \001(\tB4\362\370\263\007/\260\363\263\007\001\300\363\263\007\001\312\363\263\007 \302\364\263" +
-      "\007\033\n\014json_gateway\022\013signingRole\022O\n\017ssh_mou" +
-      "nt_point\030\006 \001(\tB6\362\370\263\0071\260\363\263\007\001\300\363\263\007\001\312\363\263\007\"\302\364\263\007" +
-      "\035\n\014json_gateway\022\rsshMountPoint\022\"\n\004tags\030\010" +
-      " \001(\0132\010.v1.TagsB\n\362\370\263\007\005\260\363\263\007\001:\215\001\372\370\263\007\207\001\250\363\263\007\001" +
-      "\312\363\263\007}\210\364\263\007\001\302\364\263\007\032\n\003cli\022\023vaultAppRoleCertSS" +
-      "H\302\364\263\007#\n\014json_gateway\022\023vaultAppRoleCertSS" +
-      "H\302\364\263\007,\n\022terraform-provider\022\026vault_approl" +
-      "e_cert_ssh\"\271\004\n\031VaultAppRoleCertX509Store" +
-      "\022\026\n\002id\030\001 \001(\tB\n\362\370\263\007\005\260\363\263\007\001\022\035\n\004name\030\002 \001(\tB\017" +
-      "\362\370\263\007\n\260\363\263\007\001\300\363\263\007\001\022@\n\tnamespace\030\005 \001(\tB-\362\370\263\007" +
-      "(\260\363\263\007\001\312\363\263\007\036\302\364\263\007\031\n\014json_gateway\022\tnamespac" +
-      "e\022O\n\017pki_mount_point\030\006 \001(\tB6\362\370\263\0071\260\363\263\007\001\300\363" +
-      "\263\007\001\312\363\263\007\"\302\364\263\007\035\n\014json_gateway\022\rpkiMountPoi" +
-      "nt\022N\n\016server_address\030\003 \001(\tB6\362\370\263\0071\260\363\263\007\001\300\363" +
+      "\007\n\260\363\263\007\001\300\363\263\007\001\022A\n\nserver_url\030\003 \001(\tB-\362\370\263\007(\260" +
+      "\363\263\007\001\312\363\263\007\036\302\364\263\007\031\n\014json_gateway\022\tserverUrl\022" +
+      "C\n\013tenant_name\030\004 \001(\tB.\362\370\263\007)\260\363\263\007\001\312\363\263\007\037\302\364\263" +
+      "\007\032\n\014json_gateway\022\ntenantName\022$\n\004tags\030\203\200\002" +
+      " \001(\0132\010.v1.TagsB\n\362\370\263\007\005\260\363\263\007\001:>\372\370\263\0079\250\363\263\007\001\312\363" +
+      "\263\007/\302\364\263\007\016\n\003cli\022\007delinea\302\364\263\007\027\n\014json_gatewa" +
+      "y\022\007delinea\"\346\001\n\010GCPStore\022\026\n\002id\030\001 \001(\tB\n\362\370\263" +
+      "\007\005\260\363\263\007\001\022\035\n\004name\030\002 \001(\tB\017\362\370\263\007\n\260\363\263\007\001\300\363\263\007\001\022E" +
+      "\n\tprojectID\030\003 \001(\tB2\362\370\263\007-\260\363\263\007\001\300\363\263\007\001\312\363\263\007\036\302" +
+      "\364\263\007\031\n\014json_gateway\022\tprojectId\022$\n\004tags\030\203\200" +
+      "\002 \001(\0132\010.v1.TagsB\n\362\370\263\007\005\260\363\263\007\001:6\372\370\263\0071\250\363\263\007\001\312" +
+      "\363\263\007\'\302\364\263\007\n\n\003cli\022\003gcp\302\364\263\007\023\n\014json_gateway\022\003" +
+      "gcp\"\305\003\n\020GCPCertX509Store\022\026\n\002id\030\001 \001(\tB\n\362\370" +
+      "\263\007\005\260\363\263\007\001\022\035\n\004name\030\002 \001(\tB\017\362\370\263\007\n\260\363\263\007\001\300\363\263\007\001\022" +
+      "6\n\004caID\030\006 \001(\tB(\362\370\263\007#\260\363\263\007\001\312\363\263\007\031\302\364\263\007\024\n\014jso" +
+      "n_gateway\022\004caId\022C\n\010caPoolID\030\005 \001(\tB1\362\370\263\007," +
+      "\260\363\263\007\001\300\363\263\007\001\312\363\263\007\035\302\364\263\007\030\n\014json_gateway\022\010caPo" +
+      "olId\022C\n\010location\030\004 \001(\tB1\362\370\263\007,\260\363\263\007\001\300\363\263\007\001\312" +
+      "\363\263\007\035\302\364\263\007\030\n\014json_gateway\022\010location\022E\n\tpro" +
+      "jectID\030\003 \001(\tB2\362\370\263\007-\260\363\263\007\001\300\363\263\007\001\312\363\263\007\036\302\364\263\007\031\n" +
+      "\014json_gateway\022\tprojectId\022$\n\004tags\030\203\200\002 \001(\013" +
+      "2\010.v1.TagsB\n\362\370\263\007\005\260\363\263\007\001:K\372\370\263\007F\250\363\263\007\001\312\363\263\007<\210" +
+      "\364\263\007\001\302\364\263\007\022\n\003cli\022\013gcpCertX509\302\364\263\007\033\n\014json_g" +
+      "ateway\022\013gcpCertX509\"\362\002\n\021VaultAppRoleStor" +
+      "e\022\026\n\002id\030\001 \001(\tB\n\362\370\263\007\005\260\363\263\007\001\022\035\n\004name\030\002 \001(\tB" +
+      "\017\362\370\263\007\n\260\363\263\007\001\300\363\263\007\001\022@\n\tnamespace\030\005 \001(\tB-\362\370\263" +
+      "\007(\260\363\263\007\001\312\363\263\007\036\302\364\263\007\031\n\014json_gateway\022\tnamespa" +
+      "ce\022N\n\016server_address\030\003 \001(\tB6\362\370\263\0071\260\363\263\007\001\300\363" +
       "\263\007\001\312\363\263\007\"\302\364\263\007\035\n\014json_gateway\022\rserverAddre" +
-      "ss\022J\n\014signing_role\030\007 \001(\tB4\362\370\263\007/\260\363\263\007\001\300\363\263\007" +
-      "\001\312\363\263\007 \302\364\263\007\033\n\014json_gateway\022\013signingRole\022\"" +
-      "\n\004tags\030\010 \001(\0132\010.v1.TagsB\n\362\370\263\007\005\260\363\263\007\001:\221\001\372\370\263" +
-      "\007\213\001\250\363\263\007\001\312\363\263\007\200\001\210\364\263\007\001\302\364\263\007\033\n\003cli\022\024vaultAppR" +
-      "oleCertX509\302\364\263\007$\n\014json_gateway\022\024vaultApp" +
-      "RoleCertX509\302\364\263\007-\n\022terraform-provider\022\027v" +
-      "ault_approle_cert_x509\"\314\004\n\rVaultTLSStore" +
-      "\022\026\n\002id\030\001 \001(\tB\n\362\370\263\007\005\260\363\263\007\001\022\035\n\004name\030\002 \001(\tB\017" +
-      "\362\370\263\007\n\260\363\263\007\001\300\363\263\007\001\022D\n\014CA_cert_path\030\004 \001(\tB.\362" +
-      "\370\263\007)\260\363\263\007\001\312\363\263\007\037\302\364\263\007\032\n\014json_gateway\022\ncaCer" +
-      "tPath\022Q\n\020client_cert_path\030\005 \001(\tB7\362\370\263\0072\260\363" +
-      "\263\007\001\300\363\263\007\001\312\363\263\007#\302\364\263\007\036\n\014json_gateway\022\016client" +
-      "CertPath\022O\n\017client_key_path\030\006 \001(\tB6\362\370\263\0071" +
-      "\260\363\263\007\001\300\363\263\007\001\312\363\263\007\"\302\364\263\007\035\n\014json_gateway\022\rclie" +
-      "ntKeyPath\022@\n\tnamespace\030\010 \001(\tB-\362\370\263\007(\260\363\263\007\001" +
+      "ss\022\"\n\004tags\030\010 \001(\0132\010.v1.TagsB\n\362\370\263\007\005\260\363\263\007\001:p" +
+      "\372\370\263\007k\250\363\263\007\001\312\363\263\007a\302\364\263\007\023\n\003cli\022\014vaultAppRole\302" +
+      "\364\263\007\034\n\014json_gateway\022\014vaultAppRole\302\364\263\007#\n\022t" +
+      "erraform-provider\022\rvault_approle\"\264\004\n\030Vau" +
+      "ltAppRoleCertSSHStore\022\026\n\002id\030\001 \001(\tB\n\362\370\263\007\005" +
+      "\260\363\263\007\001\022\035\n\004name\030\002 \001(\tB\017\362\370\263\007\n\260\363\263\007\001\300\363\263\007\001\022@\n\t" +
+      "namespace\030\005 \001(\tB-\362\370\263\007(\260\363\263\007\001\312\363\263\007\036\302\364\263\007\031\n\014j" +
+      "son_gateway\022\tnamespace\022N\n\016server_address" +
+      "\030\003 \001(\tB6\362\370\263\0071\260\363\263\007\001\300\363\263\007\001\312\363\263\007\"\302\364\263\007\035\n\014json_" +
+      "gateway\022\rserverAddress\022J\n\014signing_role\030\007" +
+      " \001(\tB4\362\370\263\007/\260\363\263\007\001\300\363\263\007\001\312\363\263\007 \302\364\263\007\033\n\014json_ga" +
+      "teway\022\013signingRole\022O\n\017ssh_mount_point\030\006 " +
+      "\001(\tB6\362\370\263\0071\260\363\263\007\001\300\363\263\007\001\312\363\263\007\"\302\364\263\007\035\n\014json_gat" +
+      "eway\022\rsshMountPoint\022\"\n\004tags\030\010 \001(\0132\010.v1.T" +
+      "agsB\n\362\370\263\007\005\260\363\263\007\001:\215\001\372\370\263\007\207\001\250\363\263\007\001\312\363\263\007}\210\364\263\007\001\302" +
+      "\364\263\007\032\n\003cli\022\023vaultAppRoleCertSSH\302\364\263\007#\n\014jso" +
+      "n_gateway\022\023vaultAppRoleCertSSH\302\364\263\007,\n\022ter" +
+      "raform-provider\022\026vault_approle_cert_ssh\"" +
+      "\271\004\n\031VaultAppRoleCertX509Store\022\026\n\002id\030\001 \001(" +
+      "\tB\n\362\370\263\007\005\260\363\263\007\001\022\035\n\004name\030\002 \001(\tB\017\362\370\263\007\n\260\363\263\007\001\300" +
+      "\363\263\007\001\022@\n\tnamespace\030\005 \001(\tB-\362\370\263\007(\260\363\263\007\001\312\363\263\007\036" +
+      "\302\364\263\007\031\n\014json_gateway\022\tnamespace\022O\n\017pki_mo" +
+      "unt_point\030\006 \001(\tB6\362\370\263\0071\260\363\263\007\001\300\363\263\007\001\312\363\263\007\"\302\364\263" +
+      "\007\035\n\014json_gateway\022\rpkiMountPoint\022N\n\016serve" +
+      "r_address\030\003 \001(\tB6\362\370\263\0071\260\363\263\007\001\300\363\263\007\001\312\363\263\007\"\302\364\263" +
+      "\007\035\n\014json_gateway\022\rserverAddress\022J\n\014signi" +
+      "ng_role\030\007 \001(\tB4\362\370\263\007/\260\363\263\007\001\300\363\263\007\001\312\363\263\007 \302\364\263\007\033" +
+      "\n\014json_gateway\022\013signingRole\022\"\n\004tags\030\010 \001(" +
+      "\0132\010.v1.TagsB\n\362\370\263\007\005\260\363\263\007\001:\221\001\372\370\263\007\213\001\250\363\263\007\001\312\363\263" +
+      "\007\200\001\210\364\263\007\001\302\364\263\007\033\n\003cli\022\024vaultAppRoleCertX509" +
+      "\302\364\263\007$\n\014json_gateway\022\024vaultAppRoleCertX50" +
+      "9\302\364\263\007-\n\022terraform-provider\022\027vault_approl" +
+      "e_cert_x509\"\314\004\n\rVaultTLSStore\022\026\n\002id\030\001 \001(" +
+      "\tB\n\362\370\263\007\005\260\363\263\007\001\022\035\n\004name\030\002 \001(\tB\017\362\370\263\007\n\260\363\263\007\001\300" +
+      "\363\263\007\001\022D\n\014CA_cert_path\030\004 \001(\tB.\362\370\263\007)\260\363\263\007\001\312\363" +
+      "\263\007\037\302\364\263\007\032\n\014json_gateway\022\ncaCertPath\022Q\n\020cl" +
+      "ient_cert_path\030\005 \001(\tB7\362\370\263\0072\260\363\263\007\001\300\363\263\007\001\312\363\263" +
+      "\007#\302\364\263\007\036\n\014json_gateway\022\016clientCertPath\022O\n" +
+      "\017client_key_path\030\006 \001(\tB6\362\370\263\0071\260\363\263\007\001\300\363\263\007\001\312" +
+      "\363\263\007\"\302\364\263\007\035\n\014json_gateway\022\rclientKeyPath\022@" +
+      "\n\tnamespace\030\010 \001(\tB-\362\370\263\007(\260\363\263\007\001\312\363\263\007\036\302\364\263\007\031\n" +
+      "\014json_gateway\022\tnamespace\022N\n\016server_addre" +
+      "ss\030\003 \001(\tB6\362\370\263\0071\260\363\263\007\001\300\363\263\007\001\312\363\263\007\"\302\364\263\007\035\n\014jso" +
+      "n_gateway\022\rserverAddress\022\"\n\004tags\030\007 \001(\0132\010" +
+      ".v1.TagsB\n\362\370\263\007\005\260\363\263\007\001:d\372\370\263\007_\250\363\263\007\001\312\363\263\007U\302\364\263" +
+      "\007\017\n\003cli\022\010vaultTLS\302\364\263\007\030\n\014json_gateway\022\010va" +
+      "ultTLS\302\364\263\007\037\n\022terraform-provider\022\tvault_t" +
+      "ls\"\215\006\n\024VaultTLSCertSSHStore\022\026\n\002id\030\001 \001(\tB" +
+      "\n\362\370\263\007\005\260\363\263\007\001\022\035\n\004name\030\002 \001(\tB\017\362\370\263\007\n\260\363\263\007\001\300\363\263" +
+      "\007\001\022D\n\014CA_cert_path\030\004 \001(\tB.\362\370\263\007)\260\363\263\007\001\312\363\263\007" +
+      "\037\302\364\263\007\032\n\014json_gateway\022\ncaCertPath\022Q\n\020clie" +
+      "nt_cert_path\030\005 \001(\tB7\362\370\263\0072\260\363\263\007\001\300\363\263\007\001\312\363\263\007#" +
+      "\302\364\263\007\036\n\014json_gateway\022\016clientCertPath\022O\n\017c" +
+      "lient_key_path\030\006 \001(\tB6\362\370\263\0071\260\363\263\007\001\300\363\263\007\001\312\363\263" +
+      "\007\"\302\364\263\007\035\n\014json_gateway\022\rclientKeyPath\022@\n\t" +
+      "namespace\030\010 \001(\tB-\362\370\263\007(\260\363\263\007\001\312\363\263\007\036\302\364\263\007\031\n\014j" +
+      "son_gateway\022\tnamespace\022N\n\016server_address" +
+      "\030\003 \001(\tB6\362\370\263\0071\260\363\263\007\001\300\363\263\007\001\312\363\263\007\"\302\364\263\007\035\n\014json_" +
+      "gateway\022\rserverAddress\022J\n\014signing_role\030\n" +
+      " \001(\tB4\362\370\263\007/\260\363\263\007\001\300\363\263\007\001\312\363\263\007 \302\364\263\007\033\n\014json_ga" +
+      "teway\022\013signingRole\022O\n\017ssh_mount_point\030\t " +
+      "\001(\tB6\362\370\263\0071\260\363\263\007\001\300\363\263\007\001\312\363\263\007\"\302\364\263\007\035\n\014json_gat" +
+      "eway\022\rsshMountPoint\022\"\n\004tags\030\007 \001(\0132\010.v1.T" +
+      "agsB\n\362\370\263\007\005\260\363\263\007\001:\200\001\372\370\263\007{\250\363\263\007\001\312\363\263\007q\210\364\263\007\001\302\364" +
+      "\263\007\026\n\003cli\022\017vaultTLSCertSSH\302\364\263\007\037\n\014json_gat" +
+      "eway\022\017vaultTLSCertSSH\302\364\263\007(\n\022terraform-pr" +
+      "ovider\022\022vault_tls_cert_ssh\"\221\006\n\025VaultTLSC" +
+      "ertX509Store\022\026\n\002id\030\001 \001(\tB\n\362\370\263\007\005\260\363\263\007\001\022\035\n\004" +
+      "name\030\002 \001(\tB\017\362\370\263\007\n\260\363\263\007\001\300\363\263\007\001\022D\n\014CA_cert_p" +
+      "ath\030\004 \001(\tB.\362\370\263\007)\260\363\263\007\001\312\363\263\007\037\302\364\263\007\032\n\014json_ga" +
+      "teway\022\ncaCertPath\022Q\n\020client_cert_path\030\005 " +
+      "\001(\tB7\362\370\263\0072\260\363\263\007\001\300\363\263\007\001\312\363\263\007#\302\364\263\007\036\n\014json_gat" +
+      "eway\022\016clientCertPath\022O\n\017client_key_path\030" +
+      "\006 \001(\tB6\362\370\263\0071\260\363\263\007\001\300\363\263\007\001\312\363\263\007\"\302\364\263\007\035\n\014json_g" +
+      "ateway\022\rclientKeyPath\022@\n\tnamespace\030\010 \001(\t" +
+      "B-\362\370\263\007(\260\363\263\007\001\312\363\263\007\036\302\364\263\007\031\n\014json_gateway\022\tna" +
+      "mespace\022O\n\017pki_mount_point\030\t \001(\tB6\362\370\263\0071\260" +
+      "\363\263\007\001\300\363\263\007\001\312\363\263\007\"\302\364\263\007\035\n\014json_gateway\022\rpkiMo" +
+      "untPoint\022N\n\016server_address\030\003 \001(\tB6\362\370\263\0071\260" +
+      "\363\263\007\001\300\363\263\007\001\312\363\263\007\"\302\364\263\007\035\n\014json_gateway\022\rserve" +
+      "rAddress\022J\n\014signing_role\030\n \001(\tB4\362\370\263\007/\260\363\263" +
+      "\007\001\300\363\263\007\001\312\363\263\007 \302\364\263\007\033\n\014json_gateway\022\013signing" +
+      "Role\022\"\n\004tags\030\007 \001(\0132\010.v1.TagsB\n\362\370\263\007\005\260\363\263\007\001" +
+      ":\203\001\372\370\263\007~\250\363\263\007\001\312\363\263\007t\210\364\263\007\001\302\364\263\007\027\n\003cli\022\020vault" +
+      "TLSCertX509\302\364\263\007 \n\014json_gateway\022\020vaultTLS" +
+      "CertX509\302\364\263\007)\n\022terraform-provider\022\023vault" +
+      "_tls_cert_x509\"\352\002\n\017VaultTokenStore\022\026\n\002id" +
+      "\030\001 \001(\tB\n\362\370\263\007\005\260\363\263\007\001\022\035\n\004name\030\002 \001(\tB\017\362\370\263\007\n\260" +
+      "\363\263\007\001\300\363\263\007\001\022@\n\tnamespace\030\005 \001(\tB-\362\370\263\007(\260\363\263\007\001" +
       "\312\363\263\007\036\302\364\263\007\031\n\014json_gateway\022\tnamespace\022N\n\016s" +
       "erver_address\030\003 \001(\tB6\362\370\263\0071\260\363\263\007\001\300\363\263\007\001\312\363\263\007" +
       "\"\302\364\263\007\035\n\014json_gateway\022\rserverAddress\022\"\n\004t" +
-      "ags\030\007 \001(\0132\010.v1.TagsB\n\362\370\263\007\005\260\363\263\007\001:d\372\370\263\007_\250\363" +
-      "\263\007\001\312\363\263\007U\302\364\263\007\017\n\003cli\022\010vaultTLS\302\364\263\007\030\n\014json_" +
-      "gateway\022\010vaultTLS\302\364\263\007\037\n\022terraform-provid" +
-      "er\022\tvault_tls\"\215\006\n\024VaultTLSCertSSHStore\022\026" +
-      "\n\002id\030\001 \001(\tB\n\362\370\263\007\005\260\363\263\007\001\022\035\n\004name\030\002 \001(\tB\017\362\370" +
-      "\263\007\n\260\363\263\007\001\300\363\263\007\001\022D\n\014CA_cert_path\030\004 \001(\tB.\362\370\263" +
-      "\007)\260\363\263\007\001\312\363\263\007\037\302\364\263\007\032\n\014json_gateway\022\ncaCertP" +
-      "ath\022Q\n\020client_cert_path\030\005 \001(\tB7\362\370\263\0072\260\363\263\007" +
-      "\001\300\363\263\007\001\312\363\263\007#\302\364\263\007\036\n\014json_gateway\022\016clientCe" +
-      "rtPath\022O\n\017client_key_path\030\006 \001(\tB6\362\370\263\0071\260\363" +
-      "\263\007\001\300\363\263\007\001\312\363\263\007\"\302\364\263\007\035\n\014json_gateway\022\rclient" +
-      "KeyPath\022@\n\tnamespace\030\010 \001(\tB-\362\370\263\007(\260\363\263\007\001\312\363" +
-      "\263\007\036\302\364\263\007\031\n\014json_gateway\022\tnamespace\022N\n\016ser" +
-      "ver_address\030\003 \001(\tB6\362\370\263\0071\260\363\263\007\001\300\363\263\007\001\312\363\263\007\"\302" +
-      "\364\263\007\035\n\014json_gateway\022\rserverAddress\022J\n\014sig" +
-      "ning_role\030\n \001(\tB4\362\370\263\007/\260\363\263\007\001\300\363\263\007\001\312\363\263\007 \302\364\263" +
-      "\007\033\n\014json_gateway\022\013signingRole\022O\n\017ssh_mou" +
-      "nt_point\030\t \001(\tB6\362\370\263\0071\260\363\263\007\001\300\363\263\007\001\312\363\263\007\"\302\364\263\007" +
-      "\035\n\014json_gateway\022\rsshMountPoint\022\"\n\004tags\030\007" +
-      " \001(\0132\010.v1.TagsB\n\362\370\263\007\005\260\363\263\007\001:\200\001\372\370\263\007{\250\363\263\007\001\312" +
-      "\363\263\007q\210\364\263\007\001\302\364\263\007\026\n\003cli\022\017vaultTLSCertSSH\302\364\263\007" +
-      "\037\n\014json_gateway\022\017vaultTLSCertSSH\302\364\263\007(\n\022t" +
-      "erraform-provider\022\022vault_tls_cert_ssh\"\221\006" +
-      "\n\025VaultTLSCertX509Store\022\026\n\002id\030\001 \001(\tB\n\362\370\263" +
-      "\007\005\260\363\263\007\001\022\035\n\004name\030\002 \001(\tB\017\362\370\263\007\n\260\363\263\007\001\300\363\263\007\001\022D" +
-      "\n\014CA_cert_path\030\004 \001(\tB.\362\370\263\007)\260\363\263\007\001\312\363\263\007\037\302\364\263" +
-      "\007\032\n\014json_gateway\022\ncaCertPath\022Q\n\020client_c" +
-      "ert_path\030\005 \001(\tB7\362\370\263\0072\260\363\263\007\001\300\363\263\007\001\312\363\263\007#\302\364\263\007" +
-      "\036\n\014json_gateway\022\016clientCertPath\022O\n\017clien" +
-      "t_key_path\030\006 \001(\tB6\362\370\263\0071\260\363\263\007\001\300\363\263\007\001\312\363\263\007\"\302\364" +
-      "\263\007\035\n\014json_gateway\022\rclientKeyPath\022@\n\tname" +
-      "space\030\010 \001(\tB-\362\370\263\007(\260\363\263\007\001\312\363\263\007\036\302\364\263\007\031\n\014json_" +
-      "gateway\022\tnamespace\022O\n\017pki_mount_point\030\t " +
-      "\001(\tB6\362\370\263\0071\260\363\263\007\001\300\363\263\007\001\312\363\263\007\"\302\364\263\007\035\n\014json_gat" +
-      "eway\022\rpkiMountPoint\022N\n\016server_address\030\003 " +
-      "\001(\tB6\362\370\263\0071\260\363\263\007\001\300\363\263\007\001\312\363\263\007\"\302\364\263\007\035\n\014json_gat" +
-      "eway\022\rserverAddress\022J\n\014signing_role\030\n \001(" +
-      "\tB4\362\370\263\007/\260\363\263\007\001\300\363\263\007\001\312\363\263\007 \302\364\263\007\033\n\014json_gatew" +
-      "ay\022\013signingRole\022\"\n\004tags\030\007 \001(\0132\010.v1.TagsB" +
-      "\n\362\370\263\007\005\260\363\263\007\001:\203\001\372\370\263\007~\250\363\263\007\001\312\363\263\007t\210\364\263\007\001\302\364\263\007\027\n" +
-      "\003cli\022\020vaultTLSCertX509\302\364\263\007 \n\014json_gatewa" +
-      "y\022\020vaultTLSCertX509\302\364\263\007)\n\022terraform-prov" +
-      "ider\022\023vault_tls_cert_x509\"\352\002\n\017VaultToken" +
-      "Store\022\026\n\002id\030\001 \001(\tB\n\362\370\263\007\005\260\363\263\007\001\022\035\n\004name\030\002 " +
-      "\001(\tB\017\362\370\263\007\n\260\363\263\007\001\300\363\263\007\001\022@\n\tnamespace\030\005 \001(\tB" +
-      "-\362\370\263\007(\260\363\263\007\001\312\363\263\007\036\302\364\263\007\031\n\014json_gateway\022\tnam" +
-      "espace\022N\n\016server_address\030\003 \001(\tB6\362\370\263\0071\260\363\263" +
-      "\007\001\300\363\263\007\001\312\363\263\007\"\302\364\263\007\035\n\014json_gateway\022\rserverA" +
-      "ddress\022\"\n\004tags\030\004 \001(\0132\010.v1.TagsB\n\362\370\263\007\005\260\363\263" +
-      "\007\001:j\372\370\263\007e\250\363\263\007\001\312\363\263\007[\302\364\263\007\021\n\003cli\022\nvaultToke" +
-      "n\302\364\263\007\032\n\014json_gateway\022\nvaultToken\302\364\263\007!\n\022t" +
-      "erraform-provider\022\013vault_token\"\254\004\n\026Vault" +
-      "TokenCertSSHStore\022\026\n\002id\030\001 \001(\tB\n\362\370\263\007\005\260\363\263\007" +
-      "\001\022\035\n\004name\030\002 \001(\tB\017\362\370\263\007\n\260\363\263\007\001\300\363\263\007\001\022@\n\tname" +
-      "space\030\005 \001(\tB-\362\370\263\007(\260\363\263\007\001\312\363\263\007\036\302\364\263\007\031\n\014json_" +
-      "gateway\022\tnamespace\022N\n\016server_address\030\003 \001" +
-      "(\tB6\362\370\263\0071\260\363\263\007\001\300\363\263\007\001\312\363\263\007\"\302\364\263\007\035\n\014json_gate" +
-      "way\022\rserverAddress\022J\n\014signing_role\030\007 \001(\t" +
-      "B4\362\370\263\007/\260\363\263\007\001\300\363\263\007\001\312\363\263\007 \302\364\263\007\033\n\014json_gatewa" +
-      "y\022\013signingRole\022O\n\017ssh_mount_point\030\006 \001(\tB" +
-      "6\362\370\263\0071\260\363\263\007\001\300\363\263\007\001\312\363\263\007\"\302\364\263\007\035\n\014json_gateway" +
-      "\022\rsshMountPoint\022\"\n\004tags\030\004 \001(\0132\010.v1.TagsB" +
-      "\n\362\370\263\007\005\260\363\263\007\001:\207\001\372\370\263\007\201\001\250\363\263\007\001\312\363\263\007w\210\364\263\007\001\302\364\263\007\030" +
-      "\n\003cli\022\021vaultTokenCertSSH\302\364\263\007!\n\014json_gate" +
-      "way\022\021vaultTokenCertSSH\302\364\263\007*\n\022terraform-p" +
-      "rovider\022\024vault_token_cert_ssh\"\260\004\n\027VaultT" +
-      "okenCertX509Store\022\026\n\002id\030\001 \001(\tB\n\362\370\263\007\005\260\363\263\007" +
-      "\001\022\035\n\004name\030\002 \001(\tB\017\362\370\263\007\n\260\363\263\007\001\300\363\263\007\001\022@\n\tname" +
-      "space\030\005 \001(\tB-\362\370\263\007(\260\363\263\007\001\312\363\263\007\036\302\364\263\007\031\n\014json_" +
-      "gateway\022\tnamespace\022O\n\017pki_mount_point\030\006 " +
-      "\001(\tB6\362\370\263\0071\260\363\263\007\001\300\363\263\007\001\312\363\263\007\"\302\364\263\007\035\n\014json_gat" +
-      "eway\022\rpkiMountPoint\022N\n\016server_address\030\003 " +
-      "\001(\tB6\362\370\263\0071\260\363\263\007\001\300\363\263\007\001\312\363\263\007\"\302\364\263\007\035\n\014json_gat" +
-      "eway\022\rserverAddress\022J\n\014signing_role\030\007 \001(" +
-      "\tB4\362\370\263\007/\260\363\263\007\001\300\363\263\007\001\312\363\263\007 \302\364\263\007\033\n\014json_gatew" +
-      "ay\022\013signingRole\022\"\n\004tags\030\004 \001(\0132\010.v1.TagsB" +
-      "\n\362\370\263\007\005\260\363\263\007\001:\212\001\372\370\263\007\204\001\250\363\263\007\001\312\363\263\007z\210\364\263\007\001\302\364\263\007\031" +
-      "\n\003cli\022\022vaultTokenCertX509\302\364\263\007\"\n\014json_gat" +
-      "eway\022\022vaultTokenCertX509\302\364\263\007+\n\022terraform" +
-      "-provider\022\025vault_token_cert_x509Bm\n\031com." +
-      "strongdm.api.plumbingB\031SecretStoresTypes" +
-      "PlumbingZ5github.com/strongdm/strongdm-s" +
-      "dk-go/v3/internal/v1;v1b\006proto3"
+      "ags\030\004 \001(\0132\010.v1.TagsB\n\362\370\263\007\005\260\363\263\007\001:j\372\370\263\007e\250\363" +
+      "\263\007\001\312\363\263\007[\302\364\263\007\021\n\003cli\022\nvaultToken\302\364\263\007\032\n\014jso" +
+      "n_gateway\022\nvaultToken\302\364\263\007!\n\022terraform-pr" +
+      "ovider\022\013vault_token\"\254\004\n\026VaultTokenCertSS" +
+      "HStore\022\026\n\002id\030\001 \001(\tB\n\362\370\263\007\005\260\363\263\007\001\022\035\n\004name\030\002" +
+      " \001(\tB\017\362\370\263\007\n\260\363\263\007\001\300\363\263\007\001\022@\n\tnamespace\030\005 \001(\t" +
+      "B-\362\370\263\007(\260\363\263\007\001\312\363\263\007\036\302\364\263\007\031\n\014json_gateway\022\tna" +
+      "mespace\022N\n\016server_address\030\003 \001(\tB6\362\370\263\0071\260\363" +
+      "\263\007\001\300\363\263\007\001\312\363\263\007\"\302\364\263\007\035\n\014json_gateway\022\rserver" +
+      "Address\022J\n\014signing_role\030\007 \001(\tB4\362\370\263\007/\260\363\263\007" +
+      "\001\300\363\263\007\001\312\363\263\007 \302\364\263\007\033\n\014json_gateway\022\013signingR" +
+      "ole\022O\n\017ssh_mount_point\030\006 \001(\tB6\362\370\263\0071\260\363\263\007\001" +
+      "\300\363\263\007\001\312\363\263\007\"\302\364\263\007\035\n\014json_gateway\022\rsshMountP" +
+      "oint\022\"\n\004tags\030\004 \001(\0132\010.v1.TagsB\n\362\370\263\007\005\260\363\263\007\001" +
+      ":\207\001\372\370\263\007\201\001\250\363\263\007\001\312\363\263\007w\210\364\263\007\001\302\364\263\007\030\n\003cli\022\021vaul" +
+      "tTokenCertSSH\302\364\263\007!\n\014json_gateway\022\021vaultT" +
+      "okenCertSSH\302\364\263\007*\n\022terraform-provider\022\024va" +
+      "ult_token_cert_ssh\"\260\004\n\027VaultTokenCertX50" +
+      "9Store\022\026\n\002id\030\001 \001(\tB\n\362\370\263\007\005\260\363\263\007\001\022\035\n\004name\030\002" +
+      " \001(\tB\017\362\370\263\007\n\260\363\263\007\001\300\363\263\007\001\022@\n\tnamespace\030\005 \001(\t" +
+      "B-\362\370\263\007(\260\363\263\007\001\312\363\263\007\036\302\364\263\007\031\n\014json_gateway\022\tna" +
+      "mespace\022O\n\017pki_mount_point\030\006 \001(\tB6\362\370\263\0071\260" +
+      "\363\263\007\001\300\363\263\007\001\312\363\263\007\"\302\364\263\007\035\n\014json_gateway\022\rpkiMo" +
+      "untPoint\022N\n\016server_address\030\003 \001(\tB6\362\370\263\0071\260" +
+      "\363\263\007\001\300\363\263\007\001\312\363\263\007\"\302\364\263\007\035\n\014json_gateway\022\rserve" +
+      "rAddress\022J\n\014signing_role\030\007 \001(\tB4\362\370\263\007/\260\363\263" +
+      "\007\001\300\363\263\007\001\312\363\263\007 \302\364\263\007\033\n\014json_gateway\022\013signing" +
+      "Role\022\"\n\004tags\030\004 \001(\0132\010.v1.TagsB\n\362\370\263\007\005\260\363\263\007\001" +
+      ":\212\001\372\370\263\007\204\001\250\363\263\007\001\312\363\263\007z\210\364\263\007\001\302\364\263\007\031\n\003cli\022\022vaul" +
+      "tTokenCertX509\302\364\263\007\"\n\014json_gateway\022\022vault" +
+      "TokenCertX509\302\364\263\007+\n\022terraform-provider\022\025" +
+      "vault_token_cert_x509Bm\n\031com.strongdm.ap" +
+      "i.plumbingB\031SecretStoresTypesPlumbingZ5g" +
+      "ithub.com/strongdm/strongdm-sdk-go/v3/in" +
+      "ternal/v1;v1b\006proto3"
     };
     descriptor = com.google.protobuf.Descriptors.FileDescriptor
       .internalBuildGeneratedFileFrom(descriptorData,
@@ -32208,105 +34446,111 @@ public com.strongdm.api.plumbing.SecretStoresTypesPlumbing.VaultTokenCertX509Sto
     internal_static_v1_SecretStore_fieldAccessorTable = new
       com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
         internal_static_v1_SecretStore_descriptor,
-        new java.lang.String[] { "Aws", "Azure", "CyberarkConjur", "CyberarkPam", "CyberarkPamExperimental", "Delinea", "Gcp", "GcpCertX509", "VaultAppRole", "VaultAppRoleCertSsh", "VaultAppRoleCertX509", "VaultTls", "VaultTlsCertSsh", "VaultTlsCertX509", "VaultToken", "VaultTokenCertSsh", "VaultTokenCertX509", "SecretStore", });
+        new java.lang.String[] { "Aws", "AwsCertX509", "Azure", "CyberarkConjur", "CyberarkPam", "CyberarkPamExperimental", "Delinea", "Gcp", "GcpCertX509", "VaultAppRole", "VaultAppRoleCertSsh", "VaultAppRoleCertX509", "VaultTls", "VaultTlsCertSsh", "VaultTlsCertX509", "VaultToken", "VaultTokenCertSsh", "VaultTokenCertX509", "SecretStore", });
     internal_static_v1_AWSStore_descriptor =
       getDescriptor().getMessageTypes().get(1);
     internal_static_v1_AWSStore_fieldAccessorTable = new
       com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
         internal_static_v1_AWSStore_descriptor,
         new java.lang.String[] { "Id", "Name", "Region", "Tags", });
-    internal_static_v1_AzureStore_descriptor =
+    internal_static_v1_AWSCertX509Store_descriptor =
       getDescriptor().getMessageTypes().get(2);
+    internal_static_v1_AWSCertX509Store_fieldAccessorTable = new
+      com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
+        internal_static_v1_AWSCertX509Store_descriptor,
+        new java.lang.String[] { "Id", "Name", "CaArn", "CertificateTemplateArn", "IssuedCertTTLMinutes", "Region", "SigningAlgo", "Tags", });
+    internal_static_v1_AzureStore_descriptor =
+      getDescriptor().getMessageTypes().get(3);
     internal_static_v1_AzureStore_fieldAccessorTable = new
       com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
         internal_static_v1_AzureStore_descriptor,
         new java.lang.String[] { "Id", "Name", "VaultUri", "Tags", });
     internal_static_v1_CyberarkConjurStore_descriptor =
-      getDescriptor().getMessageTypes().get(3);
+      getDescriptor().getMessageTypes().get(4);
     internal_static_v1_CyberarkConjurStore_fieldAccessorTable = new
       com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
         internal_static_v1_CyberarkConjurStore_descriptor,
         new java.lang.String[] { "Id", "Name", "AppURL", "Tags", });
     internal_static_v1_CyberarkPAMStore_descriptor =
-      getDescriptor().getMessageTypes().get(4);
+      getDescriptor().getMessageTypes().get(5);
     internal_static_v1_CyberarkPAMStore_fieldAccessorTable = new
       com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
         internal_static_v1_CyberarkPAMStore_descriptor,
         new java.lang.String[] { "Id", "Name", "AppURL", "Tags", });
     internal_static_v1_CyberarkPAMExperimentalStore_descriptor =
-      getDescriptor().getMessageTypes().get(5);
+      getDescriptor().getMessageTypes().get(6);
     internal_static_v1_CyberarkPAMExperimentalStore_fieldAccessorTable = new
       com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
         internal_static_v1_CyberarkPAMExperimentalStore_descriptor,
         new java.lang.String[] { "Id", "Name", "AppURL", "Tags", });
     internal_static_v1_DelineaStore_descriptor =
-      getDescriptor().getMessageTypes().get(6);
+      getDescriptor().getMessageTypes().get(7);
     internal_static_v1_DelineaStore_fieldAccessorTable = new
       com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
         internal_static_v1_DelineaStore_descriptor,
         new java.lang.String[] { "Id", "Name", "ServerUrl", "TenantName", "Tags", });
     internal_static_v1_GCPStore_descriptor =
-      getDescriptor().getMessageTypes().get(7);
+      getDescriptor().getMessageTypes().get(8);
     internal_static_v1_GCPStore_fieldAccessorTable = new
       com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
         internal_static_v1_GCPStore_descriptor,
         new java.lang.String[] { "Id", "Name", "ProjectID", "Tags", });
     internal_static_v1_GCPCertX509Store_descriptor =
-      getDescriptor().getMessageTypes().get(8);
+      getDescriptor().getMessageTypes().get(9);
     internal_static_v1_GCPCertX509Store_fieldAccessorTable = new
       com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
         internal_static_v1_GCPCertX509Store_descriptor,
         new java.lang.String[] { "Id", "Name", "CaID", "CaPoolID", "Location", "ProjectID", "Tags", });
     internal_static_v1_VaultAppRoleStore_descriptor =
-      getDescriptor().getMessageTypes().get(9);
+      getDescriptor().getMessageTypes().get(10);
     internal_static_v1_VaultAppRoleStore_fieldAccessorTable = new
       com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
         internal_static_v1_VaultAppRoleStore_descriptor,
         new java.lang.String[] { "Id", "Name", "Namespace", "ServerAddress", "Tags", });
     internal_static_v1_VaultAppRoleCertSSHStore_descriptor =
-      getDescriptor().getMessageTypes().get(10);
+      getDescriptor().getMessageTypes().get(11);
     internal_static_v1_VaultAppRoleCertSSHStore_fieldAccessorTable = new
       com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
         internal_static_v1_VaultAppRoleCertSSHStore_descriptor,
         new java.lang.String[] { "Id", "Name", "Namespace", "ServerAddress", "SigningRole", "SshMountPoint", "Tags", });
     internal_static_v1_VaultAppRoleCertX509Store_descriptor =
-      getDescriptor().getMessageTypes().get(11);
+      getDescriptor().getMessageTypes().get(12);
     internal_static_v1_VaultAppRoleCertX509Store_fieldAccessorTable = new
       com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
         internal_static_v1_VaultAppRoleCertX509Store_descriptor,
         new java.lang.String[] { "Id", "Name", "Namespace", "PkiMountPoint", "ServerAddress", "SigningRole", "Tags", });
     internal_static_v1_VaultTLSStore_descriptor =
-      getDescriptor().getMessageTypes().get(12);
+      getDescriptor().getMessageTypes().get(13);
     internal_static_v1_VaultTLSStore_fieldAccessorTable = new
       com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
         internal_static_v1_VaultTLSStore_descriptor,
         new java.lang.String[] { "Id", "Name", "CACertPath", "ClientCertPath", "ClientKeyPath", "Namespace", "ServerAddress", "Tags", });
     internal_static_v1_VaultTLSCertSSHStore_descriptor =
-      getDescriptor().getMessageTypes().get(13);
+      getDescriptor().getMessageTypes().get(14);
     internal_static_v1_VaultTLSCertSSHStore_fieldAccessorTable = new
       com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
         internal_static_v1_VaultTLSCertSSHStore_descriptor,
         new java.lang.String[] { "Id", "Name", "CACertPath", "ClientCertPath", "ClientKeyPath", "Namespace", "ServerAddress", "SigningRole", "SshMountPoint", "Tags", });
     internal_static_v1_VaultTLSCertX509Store_descriptor =
-      getDescriptor().getMessageTypes().get(14);
+      getDescriptor().getMessageTypes().get(15);
     internal_static_v1_VaultTLSCertX509Store_fieldAccessorTable = new
       com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
         internal_static_v1_VaultTLSCertX509Store_descriptor,
         new java.lang.String[] { "Id", "Name", "CACertPath", "ClientCertPath", "ClientKeyPath", "Namespace", "PkiMountPoint", "ServerAddress", "SigningRole", "Tags", });
     internal_static_v1_VaultTokenStore_descriptor =
-      getDescriptor().getMessageTypes().get(15);
+      getDescriptor().getMessageTypes().get(16);
     internal_static_v1_VaultTokenStore_fieldAccessorTable = new
       com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
         internal_static_v1_VaultTokenStore_descriptor,
         new java.lang.String[] { "Id", "Name", "Namespace", "ServerAddress", "Tags", });
     internal_static_v1_VaultTokenCertSSHStore_descriptor =
-      getDescriptor().getMessageTypes().get(16);
+      getDescriptor().getMessageTypes().get(17);
     internal_static_v1_VaultTokenCertSSHStore_fieldAccessorTable = new
       com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
         internal_static_v1_VaultTokenCertSSHStore_descriptor,
         new java.lang.String[] { "Id", "Name", "Namespace", "ServerAddress", "SigningRole", "SshMountPoint", "Tags", });
     internal_static_v1_VaultTokenCertX509Store_descriptor =
-      getDescriptor().getMessageTypes().get(17);
+      getDescriptor().getMessageTypes().get(18);
     internal_static_v1_VaultTokenCertX509Store_fieldAccessorTable = new
       com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
         internal_static_v1_VaultTokenCertX509Store_descriptor,