diff --git a/sdk/dotnet/Aws/AuthBackendLogin.cs b/sdk/dotnet/Aws/AuthBackendLogin.cs
index 13f5cac50..a561df8f1 100644
--- a/sdk/dotnet/Aws/AuthBackendLogin.cs
+++ b/sdk/dotnet/Aws/AuthBackendLogin.cs
@@ -93,7 +93,7 @@ public partial class AuthBackendLogin : global::Pulumi.CustomResource
         /// authentication used to generate this token.
         /// </summary>
         [Output("metadata")]
-        public Output<ImmutableDictionary<string, object>> Metadata { get; private set; } = null!;
+        public Output<ImmutableDictionary<string, string>> Metadata { get; private set; } = null!;
 
         /// <summary>
         /// The namespace to provision the resource in.
@@ -370,15 +370,15 @@ public Input<string>? ClientToken
         public Input<string>? LeaseStartTime { get; set; }
 
         [Input("metadata")]
-        private InputMap<object>? _metadata;
+        private InputMap<string>? _metadata;
 
         /// <summary>
         /// A map of information returned by the Vault server about the
         /// authentication used to generate this token.
         /// </summary>
-        public InputMap<object> Metadata
+        public InputMap<string> Metadata
         {
-            get => _metadata ?? (_metadata = new InputMap<object>());
+            get => _metadata ?? (_metadata = new InputMap<string>());
             set => _metadata = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountCassandraArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountCassandraArgs.cs
index d7c6865ed..54da3d47a 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountCassandraArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountCassandraArgs.cs
@@ -32,16 +32,16 @@ public InputList<string> AllowedRoles
         public Input<int>? ConnectTimeout { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountCassandraGetArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountCassandraGetArgs.cs
index 83b574db9..d678804d1 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountCassandraGetArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountCassandraGetArgs.cs
@@ -32,16 +32,16 @@ public InputList<string> AllowedRoles
         public Input<int>? ConnectTimeout { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountCouchbaseArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountCouchbaseArgs.cs
index 9f4c9da9b..8ee2add1d 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountCouchbaseArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountCouchbaseArgs.cs
@@ -48,16 +48,16 @@ public Input<string>? Base64Pem
         public Input<string>? BucketName { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountCouchbaseGetArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountCouchbaseGetArgs.cs
index 5368a33b0..9f698b13f 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountCouchbaseGetArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountCouchbaseGetArgs.cs
@@ -48,16 +48,16 @@ public Input<string>? Base64Pem
         public Input<string>? BucketName { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountElasticsearchArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountElasticsearchArgs.cs
index 22382fb4e..4949700cd 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountElasticsearchArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountElasticsearchArgs.cs
@@ -50,16 +50,16 @@ public InputList<string> AllowedRoles
         public Input<string>? ClientKey { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountElasticsearchGetArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountElasticsearchGetArgs.cs
index 74c7729cd..c0d67d701 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountElasticsearchGetArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountElasticsearchGetArgs.cs
@@ -50,16 +50,16 @@ public InputList<string> AllowedRoles
         public Input<string>? ClientKey { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountHanaArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountHanaArgs.cs
index 3b125522e..4b80ce915 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountHanaArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountHanaArgs.cs
@@ -32,16 +32,16 @@ public InputList<string> AllowedRoles
         public Input<string>? ConnectionUrl { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountHanaGetArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountHanaGetArgs.cs
index c3c9dfda8..b48c19200 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountHanaGetArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountHanaGetArgs.cs
@@ -32,16 +32,16 @@ public InputList<string> AllowedRoles
         public Input<string>? ConnectionUrl { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountInfluxdbArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountInfluxdbArgs.cs
index 56fdc632f..56065d7e2 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountInfluxdbArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountInfluxdbArgs.cs
@@ -32,16 +32,16 @@ public InputList<string> AllowedRoles
         public Input<int>? ConnectTimeout { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountInfluxdbGetArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountInfluxdbGetArgs.cs
index e74bc7f36..28036fe2e 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountInfluxdbGetArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountInfluxdbGetArgs.cs
@@ -32,16 +32,16 @@ public InputList<string> AllowedRoles
         public Input<int>? ConnectTimeout { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountMongodbArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountMongodbArgs.cs
index 1524e32a9..679f43e0b 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountMongodbArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountMongodbArgs.cs
@@ -32,16 +32,16 @@ public InputList<string> AllowedRoles
         public Input<string>? ConnectionUrl { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountMongodbGetArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountMongodbGetArgs.cs
index 13a214eb0..b5c54eec0 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountMongodbGetArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountMongodbGetArgs.cs
@@ -32,16 +32,16 @@ public InputList<string> AllowedRoles
         public Input<string>? ConnectionUrl { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountMongodbatlaArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountMongodbatlaArgs.cs
index b832d0044..abd82fed2 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountMongodbatlaArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountMongodbatlaArgs.cs
@@ -26,16 +26,16 @@ public InputList<string> AllowedRoles
         }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountMongodbatlaGetArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountMongodbatlaGetArgs.cs
index 2b8a36658..26890bac1 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountMongodbatlaGetArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountMongodbatlaGetArgs.cs
@@ -26,16 +26,16 @@ public InputList<string> AllowedRoles
         }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountMssqlArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountMssqlArgs.cs
index 76d2d23b2..b25631161 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountMssqlArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountMssqlArgs.cs
@@ -38,16 +38,16 @@ public InputList<string> AllowedRoles
         public Input<bool>? ContainedDb { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountMssqlGetArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountMssqlGetArgs.cs
index b939e0b34..c8a7c9b9c 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountMssqlGetArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountMssqlGetArgs.cs
@@ -38,16 +38,16 @@ public InputList<string> AllowedRoles
         public Input<bool>? ContainedDb { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountMysqlArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountMysqlArgs.cs
index bed8f76c2..db2164885 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountMysqlArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountMysqlArgs.cs
@@ -38,16 +38,16 @@ public InputList<string> AllowedRoles
         public Input<string>? ConnectionUrl { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountMysqlAuroraArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountMysqlAuroraArgs.cs
index a57393875..87d183b70 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountMysqlAuroraArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountMysqlAuroraArgs.cs
@@ -38,16 +38,16 @@ public InputList<string> AllowedRoles
         public Input<string>? ConnectionUrl { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountMysqlAuroraGetArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountMysqlAuroraGetArgs.cs
index 12320dc08..6d7a47cdf 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountMysqlAuroraGetArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountMysqlAuroraGetArgs.cs
@@ -38,16 +38,16 @@ public InputList<string> AllowedRoles
         public Input<string>? ConnectionUrl { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountMysqlGetArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountMysqlGetArgs.cs
index 79efc56c3..98fc8c43c 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountMysqlGetArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountMysqlGetArgs.cs
@@ -38,16 +38,16 @@ public InputList<string> AllowedRoles
         public Input<string>? ConnectionUrl { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountMysqlLegacyArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountMysqlLegacyArgs.cs
index e1507b287..221c5ec71 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountMysqlLegacyArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountMysqlLegacyArgs.cs
@@ -38,16 +38,16 @@ public InputList<string> AllowedRoles
         public Input<string>? ConnectionUrl { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountMysqlLegacyGetArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountMysqlLegacyGetArgs.cs
index 678559017..40423c919 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountMysqlLegacyGetArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountMysqlLegacyGetArgs.cs
@@ -38,16 +38,16 @@ public InputList<string> AllowedRoles
         public Input<string>? ConnectionUrl { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountMysqlRdArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountMysqlRdArgs.cs
index 5ea77c9ac..0d171202c 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountMysqlRdArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountMysqlRdArgs.cs
@@ -38,16 +38,16 @@ public InputList<string> AllowedRoles
         public Input<string>? ConnectionUrl { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountMysqlRdGetArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountMysqlRdGetArgs.cs
index afa0946c1..89af84026 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountMysqlRdGetArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountMysqlRdGetArgs.cs
@@ -38,16 +38,16 @@ public InputList<string> AllowedRoles
         public Input<string>? ConnectionUrl { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountOracleArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountOracleArgs.cs
index c87e0d187..f177fb5ed 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountOracleArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountOracleArgs.cs
@@ -32,16 +32,16 @@ public InputList<string> AllowedRoles
         public Input<string>? ConnectionUrl { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountOracleGetArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountOracleGetArgs.cs
index a37233b23..a9f81fc08 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountOracleGetArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountOracleGetArgs.cs
@@ -32,16 +32,16 @@ public InputList<string> AllowedRoles
         public Input<string>? ConnectionUrl { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountPostgresqlArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountPostgresqlArgs.cs
index 9e86a27ba..fd2ac32e4 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountPostgresqlArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountPostgresqlArgs.cs
@@ -38,16 +38,16 @@ public InputList<string> AllowedRoles
         public Input<string>? ConnectionUrl { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountPostgresqlGetArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountPostgresqlGetArgs.cs
index 158d91d79..22661a946 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountPostgresqlGetArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountPostgresqlGetArgs.cs
@@ -38,16 +38,16 @@ public InputList<string> AllowedRoles
         public Input<string>? ConnectionUrl { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountRediArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountRediArgs.cs
index a04cb7c51..94ef8e45b 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountRediArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountRediArgs.cs
@@ -32,16 +32,16 @@ public InputList<string> AllowedRoles
         public Input<string>? CaCert { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountRediGetArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountRediGetArgs.cs
index 8feff70de..91502660f 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountRediGetArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountRediGetArgs.cs
@@ -32,16 +32,16 @@ public InputList<string> AllowedRoles
         public Input<string>? CaCert { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountRedisElasticachArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountRedisElasticachArgs.cs
index 756bf602d..9ec96acdd 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountRedisElasticachArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountRedisElasticachArgs.cs
@@ -26,16 +26,16 @@ public InputList<string> AllowedRoles
         }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountRedisElasticachGetArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountRedisElasticachGetArgs.cs
index e56f419d0..10b071aa1 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountRedisElasticachGetArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountRedisElasticachGetArgs.cs
@@ -26,16 +26,16 @@ public InputList<string> AllowedRoles
         }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountRedshiftArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountRedshiftArgs.cs
index 3af6ebc7f..ee3cc4b9d 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountRedshiftArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountRedshiftArgs.cs
@@ -32,16 +32,16 @@ public InputList<string> AllowedRoles
         public Input<string>? ConnectionUrl { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountRedshiftGetArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountRedshiftGetArgs.cs
index 472aeeac9..37504d805 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountRedshiftGetArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountRedshiftGetArgs.cs
@@ -32,16 +32,16 @@ public InputList<string> AllowedRoles
         public Input<string>? ConnectionUrl { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountSnowflakeArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountSnowflakeArgs.cs
index b0d54d155..6c2931ec8 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountSnowflakeArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountSnowflakeArgs.cs
@@ -32,16 +32,16 @@ public InputList<string> AllowedRoles
         public Input<string>? ConnectionUrl { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Inputs/SecretsMountSnowflakeGetArgs.cs b/sdk/dotnet/Database/Inputs/SecretsMountSnowflakeGetArgs.cs
index 691ad9e78..f1b297582 100644
--- a/sdk/dotnet/Database/Inputs/SecretsMountSnowflakeGetArgs.cs
+++ b/sdk/dotnet/Database/Inputs/SecretsMountSnowflakeGetArgs.cs
@@ -32,16 +32,16 @@ public InputList<string> AllowedRoles
         public Input<string>? ConnectionUrl { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/Outputs/SecretsMountCassandra.cs b/sdk/dotnet/Database/Outputs/SecretsMountCassandra.cs
index 2b8aa6b5b..b71161e6a 100644
--- a/sdk/dotnet/Database/Outputs/SecretsMountCassandra.cs
+++ b/sdk/dotnet/Database/Outputs/SecretsMountCassandra.cs
@@ -27,7 +27,7 @@ public sealed class SecretsMountCassandra
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public readonly ImmutableDictionary<string, object>? Data;
+        public readonly ImmutableDictionary<string, string>? Data;
         /// <summary>
         /// Cassandra hosts to connect to.
         /// </summary>
@@ -88,7 +88,7 @@ private SecretsMountCassandra(
 
             int? connectTimeout,
 
-            ImmutableDictionary<string, object>? data,
+            ImmutableDictionary<string, string>? data,
 
             ImmutableArray<string> hosts,
 
diff --git a/sdk/dotnet/Database/Outputs/SecretsMountCouchbase.cs b/sdk/dotnet/Database/Outputs/SecretsMountCouchbase.cs
index 228af9b5d..b29daf46c 100644
--- a/sdk/dotnet/Database/Outputs/SecretsMountCouchbase.cs
+++ b/sdk/dotnet/Database/Outputs/SecretsMountCouchbase.cs
@@ -31,7 +31,7 @@ public sealed class SecretsMountCouchbase
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public readonly ImmutableDictionary<string, object>? Data;
+        public readonly ImmutableDictionary<string, string>? Data;
         /// <summary>
         /// A set of Couchbase URIs to connect to. Must use `couchbases://` scheme if `tls` is `true`.
         /// </summary>
@@ -82,7 +82,7 @@ private SecretsMountCouchbase(
 
             string? bucketName,
 
-            ImmutableDictionary<string, object>? data,
+            ImmutableDictionary<string, string>? data,
 
             ImmutableArray<string> hosts,
 
diff --git a/sdk/dotnet/Database/Outputs/SecretsMountElasticsearch.cs b/sdk/dotnet/Database/Outputs/SecretsMountElasticsearch.cs
index 2742a0a8d..beca7954b 100644
--- a/sdk/dotnet/Database/Outputs/SecretsMountElasticsearch.cs
+++ b/sdk/dotnet/Database/Outputs/SecretsMountElasticsearch.cs
@@ -39,7 +39,7 @@ public sealed class SecretsMountElasticsearch
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public readonly ImmutableDictionary<string, object>? Data;
+        public readonly ImmutableDictionary<string, string>? Data;
         /// <summary>
         /// Whether to disable certificate verification
         /// </summary>
@@ -94,7 +94,7 @@ private SecretsMountElasticsearch(
 
             string? clientKey,
 
-            ImmutableDictionary<string, object>? data,
+            ImmutableDictionary<string, string>? data,
 
             bool? insecure,
 
diff --git a/sdk/dotnet/Database/Outputs/SecretsMountHana.cs b/sdk/dotnet/Database/Outputs/SecretsMountHana.cs
index 57da96594..58a3f8df2 100644
--- a/sdk/dotnet/Database/Outputs/SecretsMountHana.cs
+++ b/sdk/dotnet/Database/Outputs/SecretsMountHana.cs
@@ -27,7 +27,7 @@ public sealed class SecretsMountHana
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public readonly ImmutableDictionary<string, object>? Data;
+        public readonly ImmutableDictionary<string, string>? Data;
         /// <summary>
         /// Disable special character escaping in username and password
         /// </summary>
@@ -76,7 +76,7 @@ private SecretsMountHana(
 
             string? connectionUrl,
 
-            ImmutableDictionary<string, object>? data,
+            ImmutableDictionary<string, string>? data,
 
             bool? disableEscaping,
 
diff --git a/sdk/dotnet/Database/Outputs/SecretsMountInfluxdb.cs b/sdk/dotnet/Database/Outputs/SecretsMountInfluxdb.cs
index 22eda74a6..b56503099 100644
--- a/sdk/dotnet/Database/Outputs/SecretsMountInfluxdb.cs
+++ b/sdk/dotnet/Database/Outputs/SecretsMountInfluxdb.cs
@@ -27,7 +27,7 @@ public sealed class SecretsMountInfluxdb
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public readonly ImmutableDictionary<string, object>? Data;
+        public readonly ImmutableDictionary<string, string>? Data;
         /// <summary>
         /// Influxdb host to connect to.
         /// </summary>
@@ -88,7 +88,7 @@ private SecretsMountInfluxdb(
 
             int? connectTimeout,
 
-            ImmutableDictionary<string, object>? data,
+            ImmutableDictionary<string, string>? data,
 
             string host,
 
diff --git a/sdk/dotnet/Database/Outputs/SecretsMountMongodb.cs b/sdk/dotnet/Database/Outputs/SecretsMountMongodb.cs
index f7440f5fb..39faaa375 100644
--- a/sdk/dotnet/Database/Outputs/SecretsMountMongodb.cs
+++ b/sdk/dotnet/Database/Outputs/SecretsMountMongodb.cs
@@ -27,7 +27,7 @@ public sealed class SecretsMountMongodb
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public readonly ImmutableDictionary<string, object>? Data;
+        public readonly ImmutableDictionary<string, string>? Data;
         /// <summary>
         /// Maximum number of seconds a connection may be reused.
         /// </summary>
@@ -76,7 +76,7 @@ private SecretsMountMongodb(
 
             string? connectionUrl,
 
-            ImmutableDictionary<string, object>? data,
+            ImmutableDictionary<string, string>? data,
 
             int? maxConnectionLifetime,
 
diff --git a/sdk/dotnet/Database/Outputs/SecretsMountMongodbatla.cs b/sdk/dotnet/Database/Outputs/SecretsMountMongodbatla.cs
index a49210ea8..3f5edf597 100644
--- a/sdk/dotnet/Database/Outputs/SecretsMountMongodbatla.cs
+++ b/sdk/dotnet/Database/Outputs/SecretsMountMongodbatla.cs
@@ -23,7 +23,7 @@ public sealed class SecretsMountMongodbatla
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public readonly ImmutableDictionary<string, object>? Data;
+        public readonly ImmutableDictionary<string, string>? Data;
         /// <summary>
         /// Name of the database connection.
         /// </summary>
@@ -58,7 +58,7 @@ public sealed class SecretsMountMongodbatla
         private SecretsMountMongodbatla(
             ImmutableArray<string> allowedRoles,
 
-            ImmutableDictionary<string, object>? data,
+            ImmutableDictionary<string, string>? data,
 
             string name,
 
diff --git a/sdk/dotnet/Database/Outputs/SecretsMountMssql.cs b/sdk/dotnet/Database/Outputs/SecretsMountMssql.cs
index c9e741628..f5eb3c326 100644
--- a/sdk/dotnet/Database/Outputs/SecretsMountMssql.cs
+++ b/sdk/dotnet/Database/Outputs/SecretsMountMssql.cs
@@ -31,7 +31,7 @@ public sealed class SecretsMountMssql
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public readonly ImmutableDictionary<string, object>? Data;
+        public readonly ImmutableDictionary<string, string>? Data;
         /// <summary>
         /// Disable special character escaping in username and password
         /// </summary>
@@ -86,7 +86,7 @@ private SecretsMountMssql(
 
             bool? containedDb,
 
-            ImmutableDictionary<string, object>? data,
+            ImmutableDictionary<string, string>? data,
 
             bool? disableEscaping,
 
diff --git a/sdk/dotnet/Database/Outputs/SecretsMountMysql.cs b/sdk/dotnet/Database/Outputs/SecretsMountMysql.cs
index 1431125fe..4f1cbc937 100644
--- a/sdk/dotnet/Database/Outputs/SecretsMountMysql.cs
+++ b/sdk/dotnet/Database/Outputs/SecretsMountMysql.cs
@@ -31,7 +31,7 @@ public sealed class SecretsMountMysql
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public readonly ImmutableDictionary<string, object>? Data;
+        public readonly ImmutableDictionary<string, string>? Data;
         /// <summary>
         /// Maximum number of seconds a connection may be reused.
         /// </summary>
@@ -94,7 +94,7 @@ private SecretsMountMysql(
 
             string? connectionUrl,
 
-            ImmutableDictionary<string, object>? data,
+            ImmutableDictionary<string, string>? data,
 
             int? maxConnectionLifetime,
 
diff --git a/sdk/dotnet/Database/Outputs/SecretsMountMysqlAurora.cs b/sdk/dotnet/Database/Outputs/SecretsMountMysqlAurora.cs
index 1006cc975..006c63d05 100644
--- a/sdk/dotnet/Database/Outputs/SecretsMountMysqlAurora.cs
+++ b/sdk/dotnet/Database/Outputs/SecretsMountMysqlAurora.cs
@@ -31,7 +31,7 @@ public sealed class SecretsMountMysqlAurora
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public readonly ImmutableDictionary<string, object>? Data;
+        public readonly ImmutableDictionary<string, string>? Data;
         /// <summary>
         /// Maximum number of seconds a connection may be reused.
         /// </summary>
@@ -94,7 +94,7 @@ private SecretsMountMysqlAurora(
 
             string? connectionUrl,
 
-            ImmutableDictionary<string, object>? data,
+            ImmutableDictionary<string, string>? data,
 
             int? maxConnectionLifetime,
 
diff --git a/sdk/dotnet/Database/Outputs/SecretsMountMysqlLegacy.cs b/sdk/dotnet/Database/Outputs/SecretsMountMysqlLegacy.cs
index c45b44270..0cfb13b8d 100644
--- a/sdk/dotnet/Database/Outputs/SecretsMountMysqlLegacy.cs
+++ b/sdk/dotnet/Database/Outputs/SecretsMountMysqlLegacy.cs
@@ -31,7 +31,7 @@ public sealed class SecretsMountMysqlLegacy
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public readonly ImmutableDictionary<string, object>? Data;
+        public readonly ImmutableDictionary<string, string>? Data;
         /// <summary>
         /// Maximum number of seconds a connection may be reused.
         /// </summary>
@@ -94,7 +94,7 @@ private SecretsMountMysqlLegacy(
 
             string? connectionUrl,
 
-            ImmutableDictionary<string, object>? data,
+            ImmutableDictionary<string, string>? data,
 
             int? maxConnectionLifetime,
 
diff --git a/sdk/dotnet/Database/Outputs/SecretsMountMysqlRd.cs b/sdk/dotnet/Database/Outputs/SecretsMountMysqlRd.cs
index 565a5d1a2..2e13037c1 100644
--- a/sdk/dotnet/Database/Outputs/SecretsMountMysqlRd.cs
+++ b/sdk/dotnet/Database/Outputs/SecretsMountMysqlRd.cs
@@ -31,7 +31,7 @@ public sealed class SecretsMountMysqlRd
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public readonly ImmutableDictionary<string, object>? Data;
+        public readonly ImmutableDictionary<string, string>? Data;
         /// <summary>
         /// Maximum number of seconds a connection may be reused.
         /// </summary>
@@ -94,7 +94,7 @@ private SecretsMountMysqlRd(
 
             string? connectionUrl,
 
-            ImmutableDictionary<string, object>? data,
+            ImmutableDictionary<string, string>? data,
 
             int? maxConnectionLifetime,
 
diff --git a/sdk/dotnet/Database/Outputs/SecretsMountOracle.cs b/sdk/dotnet/Database/Outputs/SecretsMountOracle.cs
index c283a1ab3..164be60c0 100644
--- a/sdk/dotnet/Database/Outputs/SecretsMountOracle.cs
+++ b/sdk/dotnet/Database/Outputs/SecretsMountOracle.cs
@@ -27,7 +27,7 @@ public sealed class SecretsMountOracle
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public readonly ImmutableDictionary<string, object>? Data;
+        public readonly ImmutableDictionary<string, string>? Data;
         /// <summary>
         /// Set to true to disconnect any open sessions prior to running the revocation statements.
         /// </summary>
@@ -84,7 +84,7 @@ private SecretsMountOracle(
 
             string? connectionUrl,
 
-            ImmutableDictionary<string, object>? data,
+            ImmutableDictionary<string, string>? data,
 
             bool? disconnectSessions,
 
diff --git a/sdk/dotnet/Database/Outputs/SecretsMountPostgresql.cs b/sdk/dotnet/Database/Outputs/SecretsMountPostgresql.cs
index caea71a7e..f8f848d19 100644
--- a/sdk/dotnet/Database/Outputs/SecretsMountPostgresql.cs
+++ b/sdk/dotnet/Database/Outputs/SecretsMountPostgresql.cs
@@ -31,7 +31,7 @@ public sealed class SecretsMountPostgresql
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public readonly ImmutableDictionary<string, object>? Data;
+        public readonly ImmutableDictionary<string, string>? Data;
         /// <summary>
         /// Disable special character escaping in username and password
         /// </summary>
@@ -90,7 +90,7 @@ private SecretsMountPostgresql(
 
             string? connectionUrl,
 
-            ImmutableDictionary<string, object>? data,
+            ImmutableDictionary<string, string>? data,
 
             bool? disableEscaping,
 
diff --git a/sdk/dotnet/Database/Outputs/SecretsMountRedi.cs b/sdk/dotnet/Database/Outputs/SecretsMountRedi.cs
index 0adf2fda0..95e77873f 100644
--- a/sdk/dotnet/Database/Outputs/SecretsMountRedi.cs
+++ b/sdk/dotnet/Database/Outputs/SecretsMountRedi.cs
@@ -27,7 +27,7 @@ public sealed class SecretsMountRedi
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public readonly ImmutableDictionary<string, object>? Data;
+        public readonly ImmutableDictionary<string, string>? Data;
         /// <summary>
         /// Specifies the host to connect to
         /// </summary>
@@ -76,7 +76,7 @@ private SecretsMountRedi(
 
             string? caCert,
 
-            ImmutableDictionary<string, object>? data,
+            ImmutableDictionary<string, string>? data,
 
             string host,
 
diff --git a/sdk/dotnet/Database/Outputs/SecretsMountRedisElasticach.cs b/sdk/dotnet/Database/Outputs/SecretsMountRedisElasticach.cs
index 9d7dfa9b6..45e1664fe 100644
--- a/sdk/dotnet/Database/Outputs/SecretsMountRedisElasticach.cs
+++ b/sdk/dotnet/Database/Outputs/SecretsMountRedisElasticach.cs
@@ -23,7 +23,7 @@ public sealed class SecretsMountRedisElasticach
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public readonly ImmutableDictionary<string, object>? Data;
+        public readonly ImmutableDictionary<string, string>? Data;
         /// <summary>
         /// Name of the database connection.
         /// </summary>
@@ -62,7 +62,7 @@ public sealed class SecretsMountRedisElasticach
         private SecretsMountRedisElasticach(
             ImmutableArray<string> allowedRoles,
 
-            ImmutableDictionary<string, object>? data,
+            ImmutableDictionary<string, string>? data,
 
             string name,
 
diff --git a/sdk/dotnet/Database/Outputs/SecretsMountRedshift.cs b/sdk/dotnet/Database/Outputs/SecretsMountRedshift.cs
index 055610b7f..5d6719026 100644
--- a/sdk/dotnet/Database/Outputs/SecretsMountRedshift.cs
+++ b/sdk/dotnet/Database/Outputs/SecretsMountRedshift.cs
@@ -27,7 +27,7 @@ public sealed class SecretsMountRedshift
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public readonly ImmutableDictionary<string, object>? Data;
+        public readonly ImmutableDictionary<string, string>? Data;
         /// <summary>
         /// Disable special character escaping in username and password
         /// </summary>
@@ -80,7 +80,7 @@ private SecretsMountRedshift(
 
             string? connectionUrl,
 
-            ImmutableDictionary<string, object>? data,
+            ImmutableDictionary<string, string>? data,
 
             bool? disableEscaping,
 
diff --git a/sdk/dotnet/Database/Outputs/SecretsMountSnowflake.cs b/sdk/dotnet/Database/Outputs/SecretsMountSnowflake.cs
index 1533d6157..b42e1f1a6 100644
--- a/sdk/dotnet/Database/Outputs/SecretsMountSnowflake.cs
+++ b/sdk/dotnet/Database/Outputs/SecretsMountSnowflake.cs
@@ -27,7 +27,7 @@ public sealed class SecretsMountSnowflake
         /// 
         /// Supported list of database secrets engines that can be configured:
         /// </summary>
-        public readonly ImmutableDictionary<string, object>? Data;
+        public readonly ImmutableDictionary<string, string>? Data;
         /// <summary>
         /// Maximum number of seconds a connection may be reused.
         /// </summary>
@@ -76,7 +76,7 @@ private SecretsMountSnowflake(
 
             string? connectionUrl,
 
-            ImmutableDictionary<string, object>? data,
+            ImmutableDictionary<string, string>? data,
 
             int? maxConnectionLifetime,
 
diff --git a/sdk/dotnet/Database/SecretBackendConnection.cs b/sdk/dotnet/Database/SecretBackendConnection.cs
index 266c5ac2f..d4be4bdb2 100644
--- a/sdk/dotnet/Database/SecretBackendConnection.cs
+++ b/sdk/dotnet/Database/SecretBackendConnection.cs
@@ -84,7 +84,7 @@ public partial class SecretBackendConnection : global::Pulumi.CustomResource
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// </summary>
         [Output("data")]
-        public Output<ImmutableDictionary<string, object>?> Data { get; private set; } = null!;
+        public Output<ImmutableDictionary<string, string>?> Data { get; private set; } = null!;
 
         /// <summary>
         /// A nested block containing configuration options for Elasticsearch connections.
@@ -296,14 +296,14 @@ public InputList<string> AllowedRoles
         public Input<Inputs.SecretBackendConnectionCouchbaseArgs>? Couchbase { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
@@ -485,14 +485,14 @@ public InputList<string> AllowedRoles
         public Input<Inputs.SecretBackendConnectionCouchbaseGetArgs>? Couchbase { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/Database/SecretBackendRole.cs b/sdk/dotnet/Database/SecretBackendRole.cs
index c310293f8..4033f1c98 100644
--- a/sdk/dotnet/Database/SecretBackendRole.cs
+++ b/sdk/dotnet/Database/SecretBackendRole.cs
@@ -86,7 +86,7 @@ public partial class SecretBackendRole : global::Pulumi.CustomResource
         /// The following options are available for each `credential_type` value:
         /// </summary>
         [Output("credentialConfig")]
-        public Output<ImmutableDictionary<string, object>?> CredentialConfig { get; private set; } = null!;
+        public Output<ImmutableDictionary<string, string>?> CredentialConfig { get; private set; } = null!;
 
         /// <summary>
         /// Specifies the type of credential that
@@ -219,7 +219,7 @@ public InputList<string> CreationStatements
         }
 
         [Input("credentialConfig")]
-        private InputMap<object>? _credentialConfig;
+        private InputMap<string>? _credentialConfig;
 
         /// <summary>
         /// Specifies the configuration
@@ -227,9 +227,9 @@ public InputList<string> CreationStatements
         /// 
         /// The following options are available for each `credential_type` value:
         /// </summary>
-        public InputMap<object> CredentialConfig
+        public InputMap<string> CredentialConfig
         {
-            get => _credentialConfig ?? (_credentialConfig = new InputMap<object>());
+            get => _credentialConfig ?? (_credentialConfig = new InputMap<string>());
             set => _credentialConfig = value;
         }
 
@@ -344,7 +344,7 @@ public InputList<string> CreationStatements
         }
 
         [Input("credentialConfig")]
-        private InputMap<object>? _credentialConfig;
+        private InputMap<string>? _credentialConfig;
 
         /// <summary>
         /// Specifies the configuration
@@ -352,9 +352,9 @@ public InputList<string> CreationStatements
         /// 
         /// The following options are available for each `credential_type` value:
         /// </summary>
-        public InputMap<object> CredentialConfig
+        public InputMap<string> CredentialConfig
         {
-            get => _credentialConfig ?? (_credentialConfig = new InputMap<object>());
+            get => _credentialConfig ?? (_credentialConfig = new InputMap<string>());
             set => _credentialConfig = value;
         }
 
diff --git a/sdk/dotnet/Database/SecretsMount.cs b/sdk/dotnet/Database/SecretsMount.cs
index 5f922b522..bc0ac85a9 100644
--- a/sdk/dotnet/Database/SecretsMount.cs
+++ b/sdk/dotnet/Database/SecretsMount.cs
@@ -273,7 +273,7 @@ public partial class SecretsMount : global::Pulumi.CustomResource
         /// Specifies mount type specific options that are passed to the backend
         /// </summary>
         [Output("options")]
-        public Output<ImmutableDictionary<string, object>?> Options { get; private set; } = null!;
+        public Output<ImmutableDictionary<string, string>?> Options { get; private set; } = null!;
 
         /// <summary>
         /// A nested block containing configuration options for Oracle connections.  
@@ -654,14 +654,14 @@ public InputList<Inputs.SecretsMountMysqlArgs> Mysqls
         public Input<string>? Namespace { get; set; }
 
         [Input("options")]
-        private InputMap<object>? _options;
+        private InputMap<string>? _options;
 
         /// <summary>
         /// Specifies mount type specific options that are passed to the backend
         /// </summary>
-        public InputMap<object> Options
+        public InputMap<string> Options
         {
-            get => _options ?? (_options = new InputMap<object>());
+            get => _options ?? (_options = new InputMap<string>());
             set => _options = value;
         }
 
@@ -1060,14 +1060,14 @@ public InputList<Inputs.SecretsMountMysqlGetArgs> Mysqls
         public Input<string>? Namespace { get; set; }
 
         [Input("options")]
-        private InputMap<object>? _options;
+        private InputMap<string>? _options;
 
         /// <summary>
         /// Specifies mount type specific options that are passed to the backend
         /// </summary>
-        public InputMap<object> Options
+        public InputMap<string> Options
         {
-            get => _options ?? (_options = new InputMap<object>());
+            get => _options ?? (_options = new InputMap<string>());
             set => _options = value;
         }
 
diff --git a/sdk/dotnet/Generic/GetSecret.cs b/sdk/dotnet/Generic/GetSecret.cs
index 3ce149adb..a6ee9b94c 100644
--- a/sdk/dotnet/Generic/GetSecret.cs
+++ b/sdk/dotnet/Generic/GetSecret.cs
@@ -221,7 +221,7 @@ public sealed class GetSecretResult
         /// represent string data, so any non-string values returned from Vault are
         /// serialized as JSON.
         /// </summary>
-        public readonly ImmutableDictionary<string, object> Data;
+        public readonly ImmutableDictionary<string, string> Data;
         /// <summary>
         /// A string containing the full data payload retrieved from
         /// Vault, serialized in JSON format.
@@ -250,7 +250,7 @@ public sealed class GetSecretResult
 
         [OutputConstructor]
         private GetSecretResult(
-            ImmutableDictionary<string, object> data,
+            ImmutableDictionary<string, string> data,
 
             string dataJson,
 
diff --git a/sdk/dotnet/Generic/Secret.cs b/sdk/dotnet/Generic/Secret.cs
index b5a80efa2..aeab6786e 100644
--- a/sdk/dotnet/Generic/Secret.cs
+++ b/sdk/dotnet/Generic/Secret.cs
@@ -28,7 +28,7 @@ public partial class Secret : global::Pulumi.CustomResource
         /// serialized as JSON.
         /// </summary>
         [Output("data")]
-        public Output<ImmutableDictionary<string, object>> Data { get; private set; } = null!;
+        public Output<ImmutableDictionary<string, string>> Data { get; private set; } = null!;
 
         /// <summary>
         /// String containing a JSON-encoded object that will be
@@ -186,7 +186,7 @@ public SecretArgs()
     public sealed class SecretState : global::Pulumi.ResourceArgs
     {
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A mapping whose keys are the top-level data keys returned from
@@ -194,12 +194,12 @@ public sealed class SecretState : global::Pulumi.ResourceArgs
         /// represent string data, so any non-string values returned from Vault are
         /// serialized as JSON.
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set
             {
-                var emptySecret = Output.CreateSecret(ImmutableDictionary.Create<string, object>());
+                var emptySecret = Output.CreateSecret(ImmutableDictionary.Create<string, string>());
                 _data = Output.All(value, emptySecret).Apply(v => v[0]);
             }
         }
diff --git a/sdk/dotnet/GetNamespace.cs b/sdk/dotnet/GetNamespace.cs
index 47dc7710e..60f1ddce0 100644
--- a/sdk/dotnet/GetNamespace.cs
+++ b/sdk/dotnet/GetNamespace.cs
@@ -198,7 +198,7 @@ public sealed class GetNamespaceResult
         /// Only fetched if `path` is specified.
         /// *Requires Vault 1.12+.*
         /// </summary>
-        public readonly ImmutableDictionary<string, object> CustomMetadata;
+        public readonly ImmutableDictionary<string, string> CustomMetadata;
         /// <summary>
         /// The provider-assigned unique ID for this managed resource.
         /// </summary>
@@ -218,7 +218,7 @@ public sealed class GetNamespaceResult
 
         [OutputConstructor]
         private GetNamespaceResult(
-            ImmutableDictionary<string, object> customMetadata,
+            ImmutableDictionary<string, string> customMetadata,
 
             string id,
 
diff --git a/sdk/dotnet/GetRaftAutopilotState.cs b/sdk/dotnet/GetRaftAutopilotState.cs
index 0637cd1fc..b8f184db0 100644
--- a/sdk/dotnet/GetRaftAutopilotState.cs
+++ b/sdk/dotnet/GetRaftAutopilotState.cs
@@ -121,7 +121,7 @@ public sealed class GetRaftAutopilotStateResult
         /// <summary>
         /// Additional output related to redundancy zones stored as a serialized map of strings.
         /// </summary>
-        public readonly ImmutableDictionary<string, object> RedundancyZones;
+        public readonly ImmutableDictionary<string, string> RedundancyZones;
         /// <summary>
         /// Additional output related to redundancy zones.
         /// </summary>
@@ -129,7 +129,7 @@ public sealed class GetRaftAutopilotStateResult
         /// <summary>
         /// Additionaly output related to servers in the cluster stored as a serialized map of strings.
         /// </summary>
-        public readonly ImmutableDictionary<string, object> Servers;
+        public readonly ImmutableDictionary<string, string> Servers;
         /// <summary>
         /// Additionaly output related to servers in the cluster.
         /// </summary>
@@ -137,7 +137,7 @@ public sealed class GetRaftAutopilotStateResult
         /// <summary>
         /// Additional output related to upgrade information stored as a serialized map of strings.
         /// </summary>
-        public readonly ImmutableDictionary<string, object> UpgradeInfo;
+        public readonly ImmutableDictionary<string, string> UpgradeInfo;
         /// <summary>
         /// Additional output related to upgrade information.
         /// </summary>
@@ -161,15 +161,15 @@ private GetRaftAutopilotStateResult(
 
             int optimisticFailureTolerance,
 
-            ImmutableDictionary<string, object> redundancyZones,
+            ImmutableDictionary<string, string> redundancyZones,
 
             string redundancyZonesJson,
 
-            ImmutableDictionary<string, object> servers,
+            ImmutableDictionary<string, string> servers,
 
             string serversJson,
 
-            ImmutableDictionary<string, object> upgradeInfo,
+            ImmutableDictionary<string, string> upgradeInfo,
 
             string upgradeInfoJson,
 
diff --git a/sdk/dotnet/Identity/GetEntity.cs b/sdk/dotnet/Identity/GetEntity.cs
index c615f2c69..556415dd3 100644
--- a/sdk/dotnet/Identity/GetEntity.cs
+++ b/sdk/dotnet/Identity/GetEntity.cs
@@ -222,7 +222,7 @@ public sealed class GetEntityResult
         /// <summary>
         /// Arbitrary metadata
         /// </summary>
-        public readonly ImmutableDictionary<string, object> Metadata;
+        public readonly ImmutableDictionary<string, string> Metadata;
         public readonly string? Namespace;
         /// <summary>
         /// Namespace of which the entity is part of
@@ -265,7 +265,7 @@ private GetEntityResult(
 
             ImmutableArray<string> mergedEntityIds,
 
-            ImmutableDictionary<string, object> metadata,
+            ImmutableDictionary<string, string> metadata,
 
             string? @namespace,
 
diff --git a/sdk/dotnet/Identity/GetGroup.cs b/sdk/dotnet/Identity/GetGroup.cs
index d32e87cc6..1f3fb9e4c 100644
--- a/sdk/dotnet/Identity/GetGroup.cs
+++ b/sdk/dotnet/Identity/GetGroup.cs
@@ -193,7 +193,7 @@ public sealed class GetGroupResult
         /// <summary>
         /// Arbitrary metadata
         /// </summary>
-        public readonly ImmutableDictionary<string, object> AliasMetadata;
+        public readonly ImmutableDictionary<string, string> AliasMetadata;
         public readonly string AliasMountAccessor;
         /// <summary>
         /// Authentication mount path which this alias belongs to
@@ -234,7 +234,7 @@ public sealed class GetGroupResult
         /// <summary>
         /// Arbitrary metadata
         /// </summary>
-        public readonly ImmutableDictionary<string, object> Metadata;
+        public readonly ImmutableDictionary<string, string> Metadata;
         /// <summary>
         /// Modify index of the group
         /// </summary>
@@ -269,7 +269,7 @@ private GetGroupResult(
 
             ImmutableArray<string> aliasMergedFromCanonicalIds,
 
-            ImmutableDictionary<string, object> aliasMetadata,
+            ImmutableDictionary<string, string> aliasMetadata,
 
             string aliasMountAccessor,
 
@@ -295,7 +295,7 @@ private GetGroupResult(
 
             ImmutableArray<string> memberGroupIds,
 
-            ImmutableDictionary<string, object> metadata,
+            ImmutableDictionary<string, string> metadata,
 
             int modifyIndex,
 
diff --git a/sdk/dotnet/Identity/GetOidcPublicKeys.cs b/sdk/dotnet/Identity/GetOidcPublicKeys.cs
index 07d78db55..7d27b4df9 100644
--- a/sdk/dotnet/Identity/GetOidcPublicKeys.cs
+++ b/sdk/dotnet/Identity/GetOidcPublicKeys.cs
@@ -183,7 +183,7 @@ public sealed class GetOidcPublicKeysResult
         /// The public portion of keys for an OIDC provider. 
         /// Clients can use them to validate the authenticity of an identity token.
         /// </summary>
-        public readonly ImmutableArray<ImmutableDictionary<string, object>> Keys;
+        public readonly ImmutableArray<ImmutableDictionary<string, string>> Keys;
         public readonly string Name;
         public readonly string? Namespace;
 
@@ -191,7 +191,7 @@ public sealed class GetOidcPublicKeysResult
         private GetOidcPublicKeysResult(
             string id,
 
-            ImmutableArray<ImmutableDictionary<string, object>> keys,
+            ImmutableArray<ImmutableDictionary<string, string>> keys,
 
             string name,
 
diff --git a/sdk/dotnet/Identity/Outputs/GetEntityAliasResult.cs b/sdk/dotnet/Identity/Outputs/GetEntityAliasResult.cs
index ddf3b644c..2689fb50a 100644
--- a/sdk/dotnet/Identity/Outputs/GetEntityAliasResult.cs
+++ b/sdk/dotnet/Identity/Outputs/GetEntityAliasResult.cs
@@ -36,7 +36,7 @@ public sealed class GetEntityAliasResult
         /// <summary>
         /// Arbitrary metadata
         /// </summary>
-        public readonly ImmutableDictionary<string, object> Metadata;
+        public readonly ImmutableDictionary<string, string> Metadata;
         /// <summary>
         /// Authentication mount acccessor which this alias belongs to
         /// </summary>
@@ -66,7 +66,7 @@ private GetEntityAliasResult(
 
             ImmutableArray<string> mergedFromCanonicalIds,
 
-            ImmutableDictionary<string, object> metadata,
+            ImmutableDictionary<string, string> metadata,
 
             string mountAccessor,
 
diff --git a/sdk/dotnet/Jwt/AuthBackendRole.cs b/sdk/dotnet/Jwt/AuthBackendRole.cs
index c49839ec5..68ab988b6 100644
--- a/sdk/dotnet/Jwt/AuthBackendRole.cs
+++ b/sdk/dotnet/Jwt/AuthBackendRole.cs
@@ -131,7 +131,7 @@ public partial class AuthBackendRole : global::Pulumi.CustomResource
         /// comma-separated values, e.g. `"red"` or `"red,green,blue"`.
         /// </summary>
         [Output("boundClaims")]
-        public Output<ImmutableDictionary<string, object>?> BoundClaims { get; private set; } = null!;
+        public Output<ImmutableDictionary<string, string>?> BoundClaims { get; private set; } = null!;
 
         /// <summary>
         /// How to interpret values in the claims/values
@@ -153,7 +153,7 @@ public partial class AuthBackendRole : global::Pulumi.CustomResource
         /// to specified metadata fields (values).
         /// </summary>
         [Output("claimMappings")]
-        public Output<ImmutableDictionary<string, object>?> ClaimMappings { get; private set; } = null!;
+        public Output<ImmutableDictionary<string, string>?> ClaimMappings { get; private set; } = null!;
 
         /// <summary>
         /// The amount of leeway to add to all claims to account for clock skew, in
@@ -388,16 +388,16 @@ public InputList<string> BoundAudiences
         }
 
         [Input("boundClaims")]
-        private InputMap<object>? _boundClaims;
+        private InputMap<string>? _boundClaims;
 
         /// <summary>
         /// If set, a map of claims to values to match against.
         /// A claim's value must be a string, which may contain one value or multiple
         /// comma-separated values, e.g. `"red"` or `"red,green,blue"`.
         /// </summary>
-        public InputMap<object> BoundClaims
+        public InputMap<string> BoundClaims
         {
-            get => _boundClaims ?? (_boundClaims = new InputMap<object>());
+            get => _boundClaims ?? (_boundClaims = new InputMap<string>());
             set => _boundClaims = value;
         }
 
@@ -417,15 +417,15 @@ public InputMap<object> BoundClaims
         public Input<string>? BoundSubject { get; set; }
 
         [Input("claimMappings")]
-        private InputMap<object>? _claimMappings;
+        private InputMap<string>? _claimMappings;
 
         /// <summary>
         /// If set, a map of claims (keys) to be copied
         /// to specified metadata fields (values).
         /// </summary>
-        public InputMap<object> ClaimMappings
+        public InputMap<string> ClaimMappings
         {
-            get => _claimMappings ?? (_claimMappings = new InputMap<object>());
+            get => _claimMappings ?? (_claimMappings = new InputMap<string>());
             set => _claimMappings = value;
         }
 
@@ -642,16 +642,16 @@ public InputList<string> BoundAudiences
         }
 
         [Input("boundClaims")]
-        private InputMap<object>? _boundClaims;
+        private InputMap<string>? _boundClaims;
 
         /// <summary>
         /// If set, a map of claims to values to match against.
         /// A claim's value must be a string, which may contain one value or multiple
         /// comma-separated values, e.g. `"red"` or `"red,green,blue"`.
         /// </summary>
-        public InputMap<object> BoundClaims
+        public InputMap<string> BoundClaims
         {
-            get => _boundClaims ?? (_boundClaims = new InputMap<object>());
+            get => _boundClaims ?? (_boundClaims = new InputMap<string>());
             set => _boundClaims = value;
         }
 
@@ -671,15 +671,15 @@ public InputMap<object> BoundClaims
         public Input<string>? BoundSubject { get; set; }
 
         [Input("claimMappings")]
-        private InputMap<object>? _claimMappings;
+        private InputMap<string>? _claimMappings;
 
         /// <summary>
         /// If set, a map of claims (keys) to be copied
         /// to specified metadata fields (values).
         /// </summary>
-        public InputMap<object> ClaimMappings
+        public InputMap<string> ClaimMappings
         {
-            get => _claimMappings ?? (_claimMappings = new InputMap<object>());
+            get => _claimMappings ?? (_claimMappings = new InputMap<string>());
             set => _claimMappings = value;
         }
 
diff --git a/sdk/dotnet/Kubernetes/SecretBackend.cs b/sdk/dotnet/Kubernetes/SecretBackend.cs
index bd79241d5..998389697 100644
--- a/sdk/dotnet/Kubernetes/SecretBackend.cs
+++ b/sdk/dotnet/Kubernetes/SecretBackend.cs
@@ -168,7 +168,7 @@ public partial class SecretBackend : global::Pulumi.CustomResource
         /// Specifies mount type specific options that are passed to the backend
         /// </summary>
         [Output("options")]
-        public Output<ImmutableDictionary<string, object>?> Options { get; private set; } = null!;
+        public Output<ImmutableDictionary<string, string>?> Options { get; private set; } = null!;
 
         /// <summary>
         /// List of headers to allow and pass from the request to the plugin
@@ -388,14 +388,14 @@ public InputList<string> DelegatedAuthAccessors
         public Input<string>? Namespace { get; set; }
 
         [Input("options")]
-        private InputMap<object>? _options;
+        private InputMap<string>? _options;
 
         /// <summary>
         /// Specifies mount type specific options that are passed to the backend
         /// </summary>
-        public InputMap<object> Options
+        public InputMap<string> Options
         {
-            get => _options ?? (_options = new InputMap<object>());
+            get => _options ?? (_options = new InputMap<string>());
             set => _options = value;
         }
 
@@ -597,14 +597,14 @@ public InputList<string> DelegatedAuthAccessors
         public Input<string>? Namespace { get; set; }
 
         [Input("options")]
-        private InputMap<object>? _options;
+        private InputMap<string>? _options;
 
         /// <summary>
         /// Specifies mount type specific options that are passed to the backend
         /// </summary>
-        public InputMap<object> Options
+        public InputMap<string> Options
         {
-            get => _options ?? (_options = new InputMap<object>());
+            get => _options ?? (_options = new InputMap<string>());
             set => _options = value;
         }
 
diff --git a/sdk/dotnet/Ldap/SecretBackend.cs b/sdk/dotnet/Ldap/SecretBackend.cs
index 23ed398f0..7664764c1 100644
--- a/sdk/dotnet/Ldap/SecretBackend.cs
+++ b/sdk/dotnet/Ldap/SecretBackend.cs
@@ -187,7 +187,7 @@ public partial class SecretBackend : global::Pulumi.CustomResource
         /// Specifies mount type specific options that are passed to the backend
         /// </summary>
         [Output("options")]
-        public Output<ImmutableDictionary<string, object>?> Options { get; private set; } = null!;
+        public Output<ImmutableDictionary<string, string>?> Options { get; private set; } = null!;
 
         /// <summary>
         /// List of headers to allow and pass from the request to the plugin
@@ -517,14 +517,14 @@ public InputList<string> DelegatedAuthAccessors
         public Input<string>? Namespace { get; set; }
 
         [Input("options")]
-        private InputMap<object>? _options;
+        private InputMap<string>? _options;
 
         /// <summary>
         /// Specifies mount type specific options that are passed to the backend
         /// </summary>
-        public InputMap<object> Options
+        public InputMap<string> Options
         {
-            get => _options ?? (_options = new InputMap<object>());
+            get => _options ?? (_options = new InputMap<string>());
             set => _options = value;
         }
 
@@ -824,14 +824,14 @@ public InputList<string> DelegatedAuthAccessors
         public Input<string>? Namespace { get; set; }
 
         [Input("options")]
-        private InputMap<object>? _options;
+        private InputMap<string>? _options;
 
         /// <summary>
         /// Specifies mount type specific options that are passed to the backend
         /// </summary>
-        public InputMap<object> Options
+        public InputMap<string> Options
         {
-            get => _options ?? (_options = new InputMap<object>());
+            get => _options ?? (_options = new InputMap<string>());
             set => _options = value;
         }
 
diff --git a/sdk/dotnet/Mount.cs b/sdk/dotnet/Mount.cs
index 6896df8ee..cb6426d98 100644
--- a/sdk/dotnet/Mount.cs
+++ b/sdk/dotnet/Mount.cs
@@ -70,7 +70,7 @@ namespace Pulumi.Vault
     ///         Description = "This is an example transit secret engine mount",
     ///         Options = 
     ///         {
-    ///             { "convergent_encryption", false },
+    ///             { "convergent_encryption", "false" },
     ///         },
     ///     });
     /// 
@@ -203,7 +203,7 @@ public partial class Mount : global::Pulumi.CustomResource
         /// Specifies mount type specific options that are passed to the backend
         /// </summary>
         [Output("options")]
-        public Output<ImmutableDictionary<string, object>?> Options { get; private set; } = null!;
+        public Output<ImmutableDictionary<string, string>?> Options { get; private set; } = null!;
 
         /// <summary>
         /// List of headers to allow and pass from the request to
@@ -400,14 +400,14 @@ public InputList<string> DelegatedAuthAccessors
         public Input<string>? Namespace { get; set; }
 
         [Input("options")]
-        private InputMap<object>? _options;
+        private InputMap<string>? _options;
 
         /// <summary>
         /// Specifies mount type specific options that are passed to the backend
         /// </summary>
-        public InputMap<object> Options
+        public InputMap<string> Options
         {
-            get => _options ?? (_options = new InputMap<object>());
+            get => _options ?? (_options = new InputMap<string>());
             set => _options = value;
         }
 
@@ -580,14 +580,14 @@ public InputList<string> DelegatedAuthAccessors
         public Input<string>? Namespace { get; set; }
 
         [Input("options")]
-        private InputMap<object>? _options;
+        private InputMap<string>? _options;
 
         /// <summary>
         /// Specifies mount type specific options that are passed to the backend
         /// </summary>
-        public InputMap<object> Options
+        public InputMap<string> Options
         {
-            get => _options ?? (_options = new InputMap<object>());
+            get => _options ?? (_options = new InputMap<string>());
             set => _options = value;
         }
 
diff --git a/sdk/dotnet/Namespace.cs b/sdk/dotnet/Namespace.cs
index a2ae6f17f..2f1ebac08 100644
--- a/sdk/dotnet/Namespace.cs
+++ b/sdk/dotnet/Namespace.cs
@@ -68,7 +68,7 @@ public partial class Namespace : global::Pulumi.CustomResource
         /// is `map[string]string`. Requires Vault version 1.12+.
         /// </summary>
         [Output("customMetadata")]
-        public Output<ImmutableDictionary<string, object>> CustomMetadata { get; private set; } = null!;
+        public Output<ImmutableDictionary<string, string>> CustomMetadata { get; private set; } = null!;
 
         /// <summary>
         /// The namespace to provision the resource in.
@@ -145,15 +145,15 @@ public static Namespace Get(string name, Input<string> id, NamespaceState? state
     public sealed class NamespaceArgs : global::Pulumi.ResourceArgs
     {
         [Input("customMetadata")]
-        private InputMap<object>? _customMetadata;
+        private InputMap<string>? _customMetadata;
 
         /// <summary>
         /// Custom metadata describing this namespace. Value type
         /// is `map[string]string`. Requires Vault version 1.12+.
         /// </summary>
-        public InputMap<object> CustomMetadata
+        public InputMap<string> CustomMetadata
         {
-            get => _customMetadata ?? (_customMetadata = new InputMap<object>());
+            get => _customMetadata ?? (_customMetadata = new InputMap<string>());
             set => _customMetadata = value;
         }
 
@@ -188,15 +188,15 @@ public NamespaceArgs()
     public sealed class NamespaceState : global::Pulumi.ResourceArgs
     {
         [Input("customMetadata")]
-        private InputMap<object>? _customMetadata;
+        private InputMap<string>? _customMetadata;
 
         /// <summary>
         /// Custom metadata describing this namespace. Value type
         /// is `map[string]string`. Requires Vault version 1.12+.
         /// </summary>
-        public InputMap<object> CustomMetadata
+        public InputMap<string> CustomMetadata
         {
-            get => _customMetadata ?? (_customMetadata = new InputMap<object>());
+            get => _customMetadata ?? (_customMetadata = new InputMap<string>());
             set => _customMetadata = value;
         }
 
diff --git a/sdk/dotnet/PkiSecret/BackendConfigEst.cs b/sdk/dotnet/PkiSecret/BackendConfigEst.cs
index 393194f5b..335906689 100644
--- a/sdk/dotnet/PkiSecret/BackendConfigEst.cs
+++ b/sdk/dotnet/PkiSecret/BackendConfigEst.cs
@@ -74,7 +74,7 @@ public partial class BackendConfigEst : global::Pulumi.CustomResource
         /// Configures a pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:&lt;role_name&gt;. Labels must be unique across Vault cluster, and will register .well-known/est/&lt;label&gt; URL paths.
         /// </summary>
         [Output("labelToPathPolicy")]
-        public Output<ImmutableDictionary<string, object>?> LabelToPathPolicy { get; private set; } = null!;
+        public Output<ImmutableDictionary<string, string>?> LabelToPathPolicy { get; private set; } = null!;
 
         /// <summary>
         /// A read-only timestamp representing the last time the configuration was updated.
@@ -189,14 +189,14 @@ public InputList<string> AuditFields
         public Input<bool>? Enabled { get; set; }
 
         [Input("labelToPathPolicy")]
-        private InputMap<object>? _labelToPathPolicy;
+        private InputMap<string>? _labelToPathPolicy;
 
         /// <summary>
         /// Configures a pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:&lt;role_name&gt;. Labels must be unique across Vault cluster, and will register .well-known/est/&lt;label&gt; URL paths.
         /// </summary>
-        public InputMap<object> LabelToPathPolicy
+        public InputMap<string> LabelToPathPolicy
         {
-            get => _labelToPathPolicy ?? (_labelToPathPolicy = new InputMap<object>());
+            get => _labelToPathPolicy ?? (_labelToPathPolicy = new InputMap<string>());
             set => _labelToPathPolicy = value;
         }
 
@@ -269,14 +269,14 @@ public InputList<string> AuditFields
         public Input<bool>? Enabled { get; set; }
 
         [Input("labelToPathPolicy")]
-        private InputMap<object>? _labelToPathPolicy;
+        private InputMap<string>? _labelToPathPolicy;
 
         /// <summary>
         /// Configures a pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:&lt;role_name&gt;. Labels must be unique across Vault cluster, and will register .well-known/est/&lt;label&gt; URL paths.
         /// </summary>
-        public InputMap<object> LabelToPathPolicy
+        public InputMap<string> LabelToPathPolicy
         {
-            get => _labelToPathPolicy ?? (_labelToPathPolicy = new InputMap<object>());
+            get => _labelToPathPolicy ?? (_labelToPathPolicy = new InputMap<string>());
             set => _labelToPathPolicy = value;
         }
 
diff --git a/sdk/dotnet/PkiSecret/GetBackendConfigEst.cs b/sdk/dotnet/PkiSecret/GetBackendConfigEst.cs
index a8716e2eb..3a5200a44 100644
--- a/sdk/dotnet/PkiSecret/GetBackendConfigEst.cs
+++ b/sdk/dotnet/PkiSecret/GetBackendConfigEst.cs
@@ -155,7 +155,7 @@ public sealed class GetBackendConfigEstResult
         /// <summary>
         /// A pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:&lt;role_name&gt;. Labels must be unique across Vault cluster, and will register .well-known/est/&lt;label&gt; URL paths.
         /// </summary>
-        public readonly ImmutableDictionary<string, object> LabelToPathPolicy;
+        public readonly ImmutableDictionary<string, string> LabelToPathPolicy;
         /// <summary>
         /// A read-only timestamp representing the last time the configuration was updated.
         /// </summary>
@@ -180,7 +180,7 @@ private GetBackendConfigEstResult(
 
             string id,
 
-            ImmutableDictionary<string, object> labelToPathPolicy,
+            ImmutableDictionary<string, string> labelToPathPolicy,
 
             string lastUpdated,
 
diff --git a/sdk/dotnet/PkiSecret/GetBackendIssuers.cs b/sdk/dotnet/PkiSecret/GetBackendIssuers.cs
index 5f9c8e7bf..0e88e429b 100644
--- a/sdk/dotnet/PkiSecret/GetBackendIssuers.cs
+++ b/sdk/dotnet/PkiSecret/GetBackendIssuers.cs
@@ -149,7 +149,7 @@ public sealed class GetBackendIssuersResult
         /// <summary>
         /// Map of issuer strings read from Vault.
         /// </summary>
-        public readonly ImmutableDictionary<string, object> KeyInfo;
+        public readonly ImmutableDictionary<string, string> KeyInfo;
         /// <summary>
         /// JSON-encoded issuer data read from Vault.
         /// </summary>
@@ -166,7 +166,7 @@ private GetBackendIssuersResult(
 
             string id,
 
-            ImmutableDictionary<string, object> keyInfo,
+            ImmutableDictionary<string, string> keyInfo,
 
             string keyInfoJson,
 
diff --git a/sdk/dotnet/PkiSecret/GetBackendKeys.cs b/sdk/dotnet/PkiSecret/GetBackendKeys.cs
index 4c0c20607..1d7edcb41 100644
--- a/sdk/dotnet/PkiSecret/GetBackendKeys.cs
+++ b/sdk/dotnet/PkiSecret/GetBackendKeys.cs
@@ -149,7 +149,7 @@ public sealed class GetBackendKeysResult
         /// <summary>
         /// Map of key strings read from Vault.
         /// </summary>
-        public readonly ImmutableDictionary<string, object> KeyInfo;
+        public readonly ImmutableDictionary<string, string> KeyInfo;
         /// <summary>
         /// JSON-encoded key data read from Vault.
         /// </summary>
@@ -166,7 +166,7 @@ private GetBackendKeysResult(
 
             string id,
 
-            ImmutableDictionary<string, object> keyInfo,
+            ImmutableDictionary<string, string> keyInfo,
 
             string keyInfoJson,
 
diff --git a/sdk/dotnet/PkiSecret/Inputs/BackendConfigEstAuthenticatorsArgs.cs b/sdk/dotnet/PkiSecret/Inputs/BackendConfigEstAuthenticatorsArgs.cs
index 611c56bb0..e0a60398d 100644
--- a/sdk/dotnet/PkiSecret/Inputs/BackendConfigEstAuthenticatorsArgs.cs
+++ b/sdk/dotnet/PkiSecret/Inputs/BackendConfigEstAuthenticatorsArgs.cs
@@ -13,26 +13,26 @@ namespace Pulumi.Vault.PkiSecret.Inputs
     public sealed class BackendConfigEstAuthenticatorsArgs : global::Pulumi.ResourceArgs
     {
         [Input("cert")]
-        private InputMap<object>? _cert;
+        private InputMap<string>? _cert;
 
         /// <summary>
         /// "The accessor (required) and cert_role (optional) properties for cert auth backends".
         /// </summary>
-        public InputMap<object> Cert
+        public InputMap<string> Cert
         {
-            get => _cert ?? (_cert = new InputMap<object>());
+            get => _cert ?? (_cert = new InputMap<string>());
             set => _cert = value;
         }
 
         [Input("userpass")]
-        private InputMap<object>? _userpass;
+        private InputMap<string>? _userpass;
 
         /// <summary>
         /// "The accessor (required) property for user pass auth backends".
         /// </summary>
-        public InputMap<object> Userpass
+        public InputMap<string> Userpass
         {
-            get => _userpass ?? (_userpass = new InputMap<object>());
+            get => _userpass ?? (_userpass = new InputMap<string>());
             set => _userpass = value;
         }
 
diff --git a/sdk/dotnet/PkiSecret/Inputs/BackendConfigEstAuthenticatorsGetArgs.cs b/sdk/dotnet/PkiSecret/Inputs/BackendConfigEstAuthenticatorsGetArgs.cs
index 43edacf4d..5399dc0cb 100644
--- a/sdk/dotnet/PkiSecret/Inputs/BackendConfigEstAuthenticatorsGetArgs.cs
+++ b/sdk/dotnet/PkiSecret/Inputs/BackendConfigEstAuthenticatorsGetArgs.cs
@@ -13,26 +13,26 @@ namespace Pulumi.Vault.PkiSecret.Inputs
     public sealed class BackendConfigEstAuthenticatorsGetArgs : global::Pulumi.ResourceArgs
     {
         [Input("cert")]
-        private InputMap<object>? _cert;
+        private InputMap<string>? _cert;
 
         /// <summary>
         /// "The accessor (required) and cert_role (optional) properties for cert auth backends".
         /// </summary>
-        public InputMap<object> Cert
+        public InputMap<string> Cert
         {
-            get => _cert ?? (_cert = new InputMap<object>());
+            get => _cert ?? (_cert = new InputMap<string>());
             set => _cert = value;
         }
 
         [Input("userpass")]
-        private InputMap<object>? _userpass;
+        private InputMap<string>? _userpass;
 
         /// <summary>
         /// "The accessor (required) property for user pass auth backends".
         /// </summary>
-        public InputMap<object> Userpass
+        public InputMap<string> Userpass
         {
-            get => _userpass ?? (_userpass = new InputMap<object>());
+            get => _userpass ?? (_userpass = new InputMap<string>());
             set => _userpass = value;
         }
 
diff --git a/sdk/dotnet/PkiSecret/Outputs/BackendConfigEstAuthenticators.cs b/sdk/dotnet/PkiSecret/Outputs/BackendConfigEstAuthenticators.cs
index 70511682c..4bed3fca7 100644
--- a/sdk/dotnet/PkiSecret/Outputs/BackendConfigEstAuthenticators.cs
+++ b/sdk/dotnet/PkiSecret/Outputs/BackendConfigEstAuthenticators.cs
@@ -16,17 +16,17 @@ public sealed class BackendConfigEstAuthenticators
         /// <summary>
         /// "The accessor (required) and cert_role (optional) properties for cert auth backends".
         /// </summary>
-        public readonly ImmutableDictionary<string, object>? Cert;
+        public readonly ImmutableDictionary<string, string>? Cert;
         /// <summary>
         /// "The accessor (required) property for user pass auth backends".
         /// </summary>
-        public readonly ImmutableDictionary<string, object>? Userpass;
+        public readonly ImmutableDictionary<string, string>? Userpass;
 
         [OutputConstructor]
         private BackendConfigEstAuthenticators(
-            ImmutableDictionary<string, object>? cert,
+            ImmutableDictionary<string, string>? cert,
 
-            ImmutableDictionary<string, object>? userpass)
+            ImmutableDictionary<string, string>? userpass)
         {
             Cert = cert;
             Userpass = userpass;
diff --git a/sdk/dotnet/PkiSecret/Outputs/GetBackendConfigEstAuthenticatorResult.cs b/sdk/dotnet/PkiSecret/Outputs/GetBackendConfigEstAuthenticatorResult.cs
index 23e030c7c..570314f42 100644
--- a/sdk/dotnet/PkiSecret/Outputs/GetBackendConfigEstAuthenticatorResult.cs
+++ b/sdk/dotnet/PkiSecret/Outputs/GetBackendConfigEstAuthenticatorResult.cs
@@ -16,17 +16,17 @@ public sealed class GetBackendConfigEstAuthenticatorResult
         /// <summary>
         /// "The accessor and cert_role properties for cert auth backends".
         /// </summary>
-        public readonly ImmutableDictionary<string, object>? Cert;
+        public readonly ImmutableDictionary<string, string>? Cert;
         /// <summary>
         /// "The accessor property for user pass auth backends".
         /// </summary>
-        public readonly ImmutableDictionary<string, object>? Userpass;
+        public readonly ImmutableDictionary<string, string>? Userpass;
 
         [OutputConstructor]
         private GetBackendConfigEstAuthenticatorResult(
-            ImmutableDictionary<string, object>? cert,
+            ImmutableDictionary<string, string>? cert,
 
-            ImmutableDictionary<string, object>? userpass)
+            ImmutableDictionary<string, string>? userpass)
         {
             Cert = cert;
             Userpass = userpass;
diff --git a/sdk/dotnet/Saml/AuthBackendRole.cs b/sdk/dotnet/Saml/AuthBackendRole.cs
index 58467edae..a8f4dd2a2 100644
--- a/sdk/dotnet/Saml/AuthBackendRole.cs
+++ b/sdk/dotnet/Saml/AuthBackendRole.cs
@@ -75,7 +75,7 @@ public partial class AuthBackendRole : global::Pulumi.CustomResource
         /// exist in the SAML assertion.
         /// </summary>
         [Output("boundAttributes")]
-        public Output<ImmutableDictionary<string, object>?> BoundAttributes { get; private set; } = null!;
+        public Output<ImmutableDictionary<string, string>?> BoundAttributes { get; private set; } = null!;
 
         /// <summary>
         /// The type of matching assertion to perform on
@@ -225,15 +225,15 @@ public static AuthBackendRole Get(string name, Input<string> id, AuthBackendRole
     public sealed class AuthBackendRoleArgs : global::Pulumi.ResourceArgs
     {
         [Input("boundAttributes")]
-        private InputMap<object>? _boundAttributes;
+        private InputMap<string>? _boundAttributes;
 
         /// <summary>
         /// Mapping of attribute names to values that are expected to
         /// exist in the SAML assertion.
         /// </summary>
-        public InputMap<object> BoundAttributes
+        public InputMap<string> BoundAttributes
         {
-            get => _boundAttributes ?? (_boundAttributes = new InputMap<object>());
+            get => _boundAttributes ?? (_boundAttributes = new InputMap<string>());
             set => _boundAttributes = value;
         }
 
@@ -365,15 +365,15 @@ public AuthBackendRoleArgs()
     public sealed class AuthBackendRoleState : global::Pulumi.ResourceArgs
     {
         [Input("boundAttributes")]
-        private InputMap<object>? _boundAttributes;
+        private InputMap<string>? _boundAttributes;
 
         /// <summary>
         /// Mapping of attribute names to values that are expected to
         /// exist in the SAML assertion.
         /// </summary>
-        public InputMap<object> BoundAttributes
+        public InputMap<string> BoundAttributes
         {
-            get => _boundAttributes ?? (_boundAttributes = new InputMap<object>());
+            get => _boundAttributes ?? (_boundAttributes = new InputMap<string>());
             set => _boundAttributes = value;
         }
 
diff --git a/sdk/dotnet/Secrets/SyncAwsDestination.cs b/sdk/dotnet/Secrets/SyncAwsDestination.cs
index a00271c29..7ecdf5479 100644
--- a/sdk/dotnet/Secrets/SyncAwsDestination.cs
+++ b/sdk/dotnet/Secrets/SyncAwsDestination.cs
@@ -61,7 +61,7 @@ public partial class SyncAwsDestination : global::Pulumi.CustomResource
         /// Custom tags to set on the secret managed at the destination.
         /// </summary>
         [Output("customTags")]
-        public Output<ImmutableDictionary<string, object>?> CustomTags { get; private set; } = null!;
+        public Output<ImmutableDictionary<string, string>?> CustomTags { get; private set; } = null!;
 
         /// <summary>
         /// Optional extra protection that must match the trust policy granting access to the
@@ -192,14 +192,14 @@ public sealed class SyncAwsDestinationArgs : global::Pulumi.ResourceArgs
         public Input<string>? AccessKeyId { get; set; }
 
         [Input("customTags")]
-        private InputMap<object>? _customTags;
+        private InputMap<string>? _customTags;
 
         /// <summary>
         /// Custom tags to set on the secret managed at the destination.
         /// </summary>
-        public InputMap<object> CustomTags
+        public InputMap<string> CustomTags
         {
-            get => _customTags ?? (_customTags = new InputMap<object>());
+            get => _customTags ?? (_customTags = new InputMap<string>());
             set => _customTags = value;
         }
 
@@ -294,14 +294,14 @@ public sealed class SyncAwsDestinationState : global::Pulumi.ResourceArgs
         public Input<string>? AccessKeyId { get; set; }
 
         [Input("customTags")]
-        private InputMap<object>? _customTags;
+        private InputMap<string>? _customTags;
 
         /// <summary>
         /// Custom tags to set on the secret managed at the destination.
         /// </summary>
-        public InputMap<object> CustomTags
+        public InputMap<string> CustomTags
         {
-            get => _customTags ?? (_customTags = new InputMap<object>());
+            get => _customTags ?? (_customTags = new InputMap<string>());
             set => _customTags = value;
         }
 
diff --git a/sdk/dotnet/Secrets/SyncAzureDestination.cs b/sdk/dotnet/Secrets/SyncAzureDestination.cs
index 1a5ebb27d..1e54e4b06 100644
--- a/sdk/dotnet/Secrets/SyncAzureDestination.cs
+++ b/sdk/dotnet/Secrets/SyncAzureDestination.cs
@@ -74,7 +74,7 @@ public partial class SyncAzureDestination : global::Pulumi.CustomResource
         /// Custom tags to set on the secret managed at the destination.
         /// </summary>
         [Output("customTags")]
-        public Output<ImmutableDictionary<string, object>?> CustomTags { get; private set; } = null!;
+        public Output<ImmutableDictionary<string, string>?> CustomTags { get; private set; } = null!;
 
         /// <summary>
         /// Determines what level of information is synced as a distinct resource
@@ -209,14 +209,14 @@ public Input<string>? ClientSecret
         public Input<string>? Cloud { get; set; }
 
         [Input("customTags")]
-        private InputMap<object>? _customTags;
+        private InputMap<string>? _customTags;
 
         /// <summary>
         /// Custom tags to set on the secret managed at the destination.
         /// </summary>
-        public InputMap<object> CustomTags
+        public InputMap<string> CustomTags
         {
-            get => _customTags ?? (_customTags = new InputMap<object>());
+            get => _customTags ?? (_customTags = new InputMap<string>());
             set => _customTags = value;
         }
 
@@ -305,14 +305,14 @@ public Input<string>? ClientSecret
         public Input<string>? Cloud { get; set; }
 
         [Input("customTags")]
-        private InputMap<object>? _customTags;
+        private InputMap<string>? _customTags;
 
         /// <summary>
         /// Custom tags to set on the secret managed at the destination.
         /// </summary>
-        public InputMap<object> CustomTags
+        public InputMap<string> CustomTags
         {
-            get => _customTags ?? (_customTags = new InputMap<object>());
+            get => _customTags ?? (_customTags = new InputMap<string>());
             set => _customTags = value;
         }
 
diff --git a/sdk/dotnet/Secrets/SyncGcpDestination.cs b/sdk/dotnet/Secrets/SyncGcpDestination.cs
index 832e03210..b470972ce 100644
--- a/sdk/dotnet/Secrets/SyncGcpDestination.cs
+++ b/sdk/dotnet/Secrets/SyncGcpDestination.cs
@@ -62,7 +62,7 @@ public partial class SyncGcpDestination : global::Pulumi.CustomResource
         /// Custom tags to set on the secret managed at the destination.
         /// </summary>
         [Output("customTags")]
-        public Output<ImmutableDictionary<string, object>?> CustomTags { get; private set; } = null!;
+        public Output<ImmutableDictionary<string, string>?> CustomTags { get; private set; } = null!;
 
         /// <summary>
         /// Determines what level of information is synced as a distinct resource
@@ -176,14 +176,14 @@ public Input<string>? Credentials
         }
 
         [Input("customTags")]
-        private InputMap<object>? _customTags;
+        private InputMap<string>? _customTags;
 
         /// <summary>
         /// Custom tags to set on the secret managed at the destination.
         /// </summary>
-        public InputMap<object> CustomTags
+        public InputMap<string> CustomTags
         {
-            get => _customTags ?? (_customTags = new InputMap<object>());
+            get => _customTags ?? (_customTags = new InputMap<string>());
             set => _customTags = value;
         }
 
@@ -251,14 +251,14 @@ public Input<string>? Credentials
         }
 
         [Input("customTags")]
-        private InputMap<object>? _customTags;
+        private InputMap<string>? _customTags;
 
         /// <summary>
         /// Custom tags to set on the secret managed at the destination.
         /// </summary>
-        public InputMap<object> CustomTags
+        public InputMap<string> CustomTags
         {
-            get => _customTags ?? (_customTags = new InputMap<object>());
+            get => _customTags ?? (_customTags = new InputMap<string>());
             set => _customTags = value;
         }
 
diff --git a/sdk/dotnet/Ssh/SecretBackendRole.cs b/sdk/dotnet/Ssh/SecretBackendRole.cs
index b95464770..cf5d006f0 100644
--- a/sdk/dotnet/Ssh/SecretBackendRole.cs
+++ b/sdk/dotnet/Ssh/SecretBackendRole.cs
@@ -157,13 +157,13 @@ public partial class SecretBackendRole : global::Pulumi.CustomResource
         /// Specifies a map of critical options that certificates have when signed.
         /// </summary>
         [Output("defaultCriticalOptions")]
-        public Output<ImmutableDictionary<string, object>?> DefaultCriticalOptions { get; private set; } = null!;
+        public Output<ImmutableDictionary<string, string>?> DefaultCriticalOptions { get; private set; } = null!;
 
         /// <summary>
         /// Specifies a map of extensions that certificates have when signed.
         /// </summary>
         [Output("defaultExtensions")]
-        public Output<ImmutableDictionary<string, object>?> DefaultExtensions { get; private set; } = null!;
+        public Output<ImmutableDictionary<string, string>?> DefaultExtensions { get; private set; } = null!;
 
         /// <summary>
         /// Specifies the default username for which a credential will be generated.
@@ -368,26 +368,26 @@ public InputList<Inputs.SecretBackendRoleAllowedUserKeyConfigArgs> AllowedUserKe
         public Input<string>? CidrList { get; set; }
 
         [Input("defaultCriticalOptions")]
-        private InputMap<object>? _defaultCriticalOptions;
+        private InputMap<string>? _defaultCriticalOptions;
 
         /// <summary>
         /// Specifies a map of critical options that certificates have when signed.
         /// </summary>
-        public InputMap<object> DefaultCriticalOptions
+        public InputMap<string> DefaultCriticalOptions
         {
-            get => _defaultCriticalOptions ?? (_defaultCriticalOptions = new InputMap<object>());
+            get => _defaultCriticalOptions ?? (_defaultCriticalOptions = new InputMap<string>());
             set => _defaultCriticalOptions = value;
         }
 
         [Input("defaultExtensions")]
-        private InputMap<object>? _defaultExtensions;
+        private InputMap<string>? _defaultExtensions;
 
         /// <summary>
         /// Specifies a map of extensions that certificates have when signed.
         /// </summary>
-        public InputMap<object> DefaultExtensions
+        public InputMap<string> DefaultExtensions
         {
-            get => _defaultExtensions ?? (_defaultExtensions = new InputMap<object>());
+            get => _defaultExtensions ?? (_defaultExtensions = new InputMap<string>());
             set => _defaultExtensions = value;
         }
 
@@ -556,26 +556,26 @@ public InputList<Inputs.SecretBackendRoleAllowedUserKeyConfigGetArgs> AllowedUse
         public Input<string>? CidrList { get; set; }
 
         [Input("defaultCriticalOptions")]
-        private InputMap<object>? _defaultCriticalOptions;
+        private InputMap<string>? _defaultCriticalOptions;
 
         /// <summary>
         /// Specifies a map of critical options that certificates have when signed.
         /// </summary>
-        public InputMap<object> DefaultCriticalOptions
+        public InputMap<string> DefaultCriticalOptions
         {
-            get => _defaultCriticalOptions ?? (_defaultCriticalOptions = new InputMap<object>());
+            get => _defaultCriticalOptions ?? (_defaultCriticalOptions = new InputMap<string>());
             set => _defaultCriticalOptions = value;
         }
 
         [Input("defaultExtensions")]
-        private InputMap<object>? _defaultExtensions;
+        private InputMap<string>? _defaultExtensions;
 
         /// <summary>
         /// Specifies a map of extensions that certificates have when signed.
         /// </summary>
-        public InputMap<object> DefaultExtensions
+        public InputMap<string> DefaultExtensions
         {
-            get => _defaultExtensions ?? (_defaultExtensions = new InputMap<object>());
+            get => _defaultExtensions ?? (_defaultExtensions = new InputMap<string>());
             set => _defaultExtensions = value;
         }
 
diff --git a/sdk/dotnet/Transform/GetDecode.cs b/sdk/dotnet/Transform/GetDecode.cs
index 9936f52ee..878b7311a 100644
--- a/sdk/dotnet/Transform/GetDecode.cs
+++ b/sdk/dotnet/Transform/GetDecode.cs
@@ -130,26 +130,26 @@ public static Output<GetDecodeResult> Invoke(GetDecodeInvokeArgs args, InvokeOpt
     public sealed class GetDecodeArgs : global::Pulumi.InvokeArgs
     {
         [Input("batchInputs")]
-        private List<ImmutableDictionary<string, object>>? _batchInputs;
+        private List<ImmutableDictionary<string, string>>? _batchInputs;
 
         /// <summary>
         /// Specifies a list of items to be decoded in a single batch. If this parameter is set, the top-level parameters 'value', 'transformation' and 'tweak' will be ignored. Each batch item within the list can specify these parameters instead.
         /// </summary>
-        public List<ImmutableDictionary<string, object>> BatchInputs
+        public List<ImmutableDictionary<string, string>> BatchInputs
         {
-            get => _batchInputs ?? (_batchInputs = new List<ImmutableDictionary<string, object>>());
+            get => _batchInputs ?? (_batchInputs = new List<ImmutableDictionary<string, string>>());
             set => _batchInputs = value;
         }
 
         [Input("batchResults")]
-        private List<ImmutableDictionary<string, object>>? _batchResults;
+        private List<ImmutableDictionary<string, string>>? _batchResults;
 
         /// <summary>
         /// The result of decoding a batch.
         /// </summary>
-        public List<ImmutableDictionary<string, object>> BatchResults
+        public List<ImmutableDictionary<string, string>> BatchResults
         {
-            get => _batchResults ?? (_batchResults = new List<ImmutableDictionary<string, object>>());
+            get => _batchResults ?? (_batchResults = new List<ImmutableDictionary<string, string>>());
             set => _batchResults = value;
         }
 
@@ -207,26 +207,26 @@ public GetDecodeArgs()
     public sealed class GetDecodeInvokeArgs : global::Pulumi.InvokeArgs
     {
         [Input("batchInputs")]
-        private InputList<ImmutableDictionary<string, object>>? _batchInputs;
+        private InputList<ImmutableDictionary<string, string>>? _batchInputs;
 
         /// <summary>
         /// Specifies a list of items to be decoded in a single batch. If this parameter is set, the top-level parameters 'value', 'transformation' and 'tweak' will be ignored. Each batch item within the list can specify these parameters instead.
         /// </summary>
-        public InputList<ImmutableDictionary<string, object>> BatchInputs
+        public InputList<ImmutableDictionary<string, string>> BatchInputs
         {
-            get => _batchInputs ?? (_batchInputs = new InputList<ImmutableDictionary<string, object>>());
+            get => _batchInputs ?? (_batchInputs = new InputList<ImmutableDictionary<string, string>>());
             set => _batchInputs = value;
         }
 
         [Input("batchResults")]
-        private InputList<ImmutableDictionary<string, object>>? _batchResults;
+        private InputList<ImmutableDictionary<string, string>>? _batchResults;
 
         /// <summary>
         /// The result of decoding a batch.
         /// </summary>
-        public InputList<ImmutableDictionary<string, object>> BatchResults
+        public InputList<ImmutableDictionary<string, string>> BatchResults
         {
-            get => _batchResults ?? (_batchResults = new InputList<ImmutableDictionary<string, object>>());
+            get => _batchResults ?? (_batchResults = new InputList<ImmutableDictionary<string, string>>());
             set => _batchResults = value;
         }
 
@@ -285,8 +285,8 @@ public GetDecodeInvokeArgs()
     [OutputType]
     public sealed class GetDecodeResult
     {
-        public readonly ImmutableArray<ImmutableDictionary<string, object>> BatchInputs;
-        public readonly ImmutableArray<ImmutableDictionary<string, object>> BatchResults;
+        public readonly ImmutableArray<ImmutableDictionary<string, string>> BatchInputs;
+        public readonly ImmutableArray<ImmutableDictionary<string, string>> BatchResults;
         public readonly string DecodedValue;
         /// <summary>
         /// The provider-assigned unique ID for this managed resource.
@@ -301,9 +301,9 @@ public sealed class GetDecodeResult
 
         [OutputConstructor]
         private GetDecodeResult(
-            ImmutableArray<ImmutableDictionary<string, object>> batchInputs,
+            ImmutableArray<ImmutableDictionary<string, string>> batchInputs,
 
-            ImmutableArray<ImmutableDictionary<string, object>> batchResults,
+            ImmutableArray<ImmutableDictionary<string, string>> batchResults,
 
             string decodedValue,
 
diff --git a/sdk/dotnet/Transform/GetEncode.cs b/sdk/dotnet/Transform/GetEncode.cs
index 23bf6062a..26875e8fe 100644
--- a/sdk/dotnet/Transform/GetEncode.cs
+++ b/sdk/dotnet/Transform/GetEncode.cs
@@ -142,26 +142,26 @@ public static Output<GetEncodeResult> Invoke(GetEncodeInvokeArgs args, InvokeOpt
     public sealed class GetEncodeArgs : global::Pulumi.InvokeArgs
     {
         [Input("batchInputs")]
-        private List<ImmutableDictionary<string, object>>? _batchInputs;
+        private List<ImmutableDictionary<string, string>>? _batchInputs;
 
         /// <summary>
         /// Specifies a list of items to be encoded in a single batch. If this parameter is set, the parameters 'value', 'transformation' and 'tweak' will be ignored. Each batch item within the list can specify these parameters instead.
         /// </summary>
-        public List<ImmutableDictionary<string, object>> BatchInputs
+        public List<ImmutableDictionary<string, string>> BatchInputs
         {
-            get => _batchInputs ?? (_batchInputs = new List<ImmutableDictionary<string, object>>());
+            get => _batchInputs ?? (_batchInputs = new List<ImmutableDictionary<string, string>>());
             set => _batchInputs = value;
         }
 
         [Input("batchResults")]
-        private List<ImmutableDictionary<string, object>>? _batchResults;
+        private List<ImmutableDictionary<string, string>>? _batchResults;
 
         /// <summary>
         /// The result of encoding a batch.
         /// </summary>
-        public List<ImmutableDictionary<string, object>> BatchResults
+        public List<ImmutableDictionary<string, string>> BatchResults
         {
-            get => _batchResults ?? (_batchResults = new List<ImmutableDictionary<string, object>>());
+            get => _batchResults ?? (_batchResults = new List<ImmutableDictionary<string, string>>());
             set => _batchResults = value;
         }
 
@@ -219,26 +219,26 @@ public GetEncodeArgs()
     public sealed class GetEncodeInvokeArgs : global::Pulumi.InvokeArgs
     {
         [Input("batchInputs")]
-        private InputList<ImmutableDictionary<string, object>>? _batchInputs;
+        private InputList<ImmutableDictionary<string, string>>? _batchInputs;
 
         /// <summary>
         /// Specifies a list of items to be encoded in a single batch. If this parameter is set, the parameters 'value', 'transformation' and 'tweak' will be ignored. Each batch item within the list can specify these parameters instead.
         /// </summary>
-        public InputList<ImmutableDictionary<string, object>> BatchInputs
+        public InputList<ImmutableDictionary<string, string>> BatchInputs
         {
-            get => _batchInputs ?? (_batchInputs = new InputList<ImmutableDictionary<string, object>>());
+            get => _batchInputs ?? (_batchInputs = new InputList<ImmutableDictionary<string, string>>());
             set => _batchInputs = value;
         }
 
         [Input("batchResults")]
-        private InputList<ImmutableDictionary<string, object>>? _batchResults;
+        private InputList<ImmutableDictionary<string, string>>? _batchResults;
 
         /// <summary>
         /// The result of encoding a batch.
         /// </summary>
-        public InputList<ImmutableDictionary<string, object>> BatchResults
+        public InputList<ImmutableDictionary<string, string>> BatchResults
         {
-            get => _batchResults ?? (_batchResults = new InputList<ImmutableDictionary<string, object>>());
+            get => _batchResults ?? (_batchResults = new InputList<ImmutableDictionary<string, string>>());
             set => _batchResults = value;
         }
 
@@ -297,8 +297,8 @@ public GetEncodeInvokeArgs()
     [OutputType]
     public sealed class GetEncodeResult
     {
-        public readonly ImmutableArray<ImmutableDictionary<string, object>> BatchInputs;
-        public readonly ImmutableArray<ImmutableDictionary<string, object>> BatchResults;
+        public readonly ImmutableArray<ImmutableDictionary<string, string>> BatchInputs;
+        public readonly ImmutableArray<ImmutableDictionary<string, string>> BatchResults;
         public readonly string EncodedValue;
         /// <summary>
         /// The provider-assigned unique ID for this managed resource.
@@ -313,9 +313,9 @@ public sealed class GetEncodeResult
 
         [OutputConstructor]
         private GetEncodeResult(
-            ImmutableArray<ImmutableDictionary<string, object>> batchInputs,
+            ImmutableArray<ImmutableDictionary<string, string>> batchInputs,
 
-            ImmutableArray<ImmutableDictionary<string, object>> batchResults,
+            ImmutableArray<ImmutableDictionary<string, string>> batchResults,
 
             string encodedValue,
 
diff --git a/sdk/dotnet/Transform/Template.cs b/sdk/dotnet/Transform/Template.cs
index 4d7546c1b..b7d899a0c 100644
--- a/sdk/dotnet/Transform/Template.cs
+++ b/sdk/dotnet/Transform/Template.cs
@@ -79,7 +79,7 @@ public partial class Template : global::Pulumi.CustomResource
         /// the decoded output. (requires Vault Enterprise 1.9+)
         /// </summary>
         [Output("decodeFormats")]
-        public Output<ImmutableDictionary<string, object>?> DecodeFormats { get; private set; } = null!;
+        public Output<ImmutableDictionary<string, string>?> DecodeFormats { get; private set; } = null!;
 
         /// <summary>
         /// The regular expression template used to format encoded values.
@@ -174,15 +174,15 @@ public sealed class TemplateArgs : global::Pulumi.ResourceArgs
         public Input<string>? Alphabet { get; set; }
 
         [Input("decodeFormats")]
-        private InputMap<object>? _decodeFormats;
+        private InputMap<string>? _decodeFormats;
 
         /// <summary>
         /// Optional mapping of name to regular expression template, used to customize
         /// the decoded output. (requires Vault Enterprise 1.9+)
         /// </summary>
-        public InputMap<object> DecodeFormats
+        public InputMap<string> DecodeFormats
         {
-            get => _decodeFormats ?? (_decodeFormats = new InputMap<object>());
+            get => _decodeFormats ?? (_decodeFormats = new InputMap<string>());
             set => _decodeFormats = value;
         }
 
@@ -241,15 +241,15 @@ public sealed class TemplateState : global::Pulumi.ResourceArgs
         public Input<string>? Alphabet { get; set; }
 
         [Input("decodeFormats")]
-        private InputMap<object>? _decodeFormats;
+        private InputMap<string>? _decodeFormats;
 
         /// <summary>
         /// Optional mapping of name to regular expression template, used to customize
         /// the decoded output. (requires Vault Enterprise 1.9+)
         /// </summary>
-        public InputMap<object> DecodeFormats
+        public InputMap<string> DecodeFormats
         {
-            get => _decodeFormats ?? (_decodeFormats = new InputMap<object>());
+            get => _decodeFormats ?? (_decodeFormats = new InputMap<string>());
             set => _decodeFormats = value;
         }
 
diff --git a/sdk/dotnet/Transit/SecretBackendKey.cs b/sdk/dotnet/Transit/SecretBackendKey.cs
index b8b4d159e..c6a5add91 100644
--- a/sdk/dotnet/Transit/SecretBackendKey.cs
+++ b/sdk/dotnet/Transit/SecretBackendKey.cs
@@ -107,7 +107,7 @@ public partial class SecretBackendKey : global::Pulumi.CustomResource
         /// * for key types `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `rsa-2048`, `rsa-3072` and `rsa-4096`, each key version will be a map of the following:
         /// </summary>
         [Output("keys")]
-        public Output<ImmutableArray<ImmutableDictionary<string, object>>> Keys { get; private set; } = null!;
+        public Output<ImmutableArray<ImmutableDictionary<string, string>>> Keys { get; private set; } = null!;
 
         /// <summary>
         /// Latest key version available. This value is 1-indexed, so if `latest_version` is `1`, then the key's information can be referenced from `keys` by selecting element `0`
@@ -368,16 +368,16 @@ public sealed class SecretBackendKeyState : global::Pulumi.ResourceArgs
         public Input<int>? KeySize { get; set; }
 
         [Input("keys")]
-        private InputList<ImmutableDictionary<string, object>>? _keys;
+        private InputList<ImmutableDictionary<string, string>>? _keys;
 
         /// <summary>
         /// List of key versions in the keyring. This attribute is zero-indexed and will contain a map of values depending on the `type` of the encryption key.
         /// * for key types `aes128-gcm96`, `aes256-gcm96` and `chacha20-poly1305`, each key version will be a map of a single value `id` which is just a hash of the key's metadata.
         /// * for key types `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `rsa-2048`, `rsa-3072` and `rsa-4096`, each key version will be a map of the following:
         /// </summary>
-        public InputList<ImmutableDictionary<string, object>> Keys
+        public InputList<ImmutableDictionary<string, string>> Keys
         {
-            get => _keys ?? (_keys = new InputList<ImmutableDictionary<string, object>>());
+            get => _keys ?? (_keys = new InputList<ImmutableDictionary<string, string>>());
             set => _keys = value;
         }
 
diff --git a/sdk/dotnet/kv/GetSecret.cs b/sdk/dotnet/kv/GetSecret.cs
index ab1310464..99843d003 100644
--- a/sdk/dotnet/kv/GetSecret.cs
+++ b/sdk/dotnet/kv/GetSecret.cs
@@ -165,7 +165,7 @@ public sealed class GetSecretResult
         /// represent string data, so any non-string values returned from Vault are
         /// serialized as JSON.
         /// </summary>
-        public readonly ImmutableDictionary<string, object> Data;
+        public readonly ImmutableDictionary<string, string> Data;
         /// <summary>
         /// JSON-encoded string that that is
         /// read as the secret data at the given path.
@@ -194,7 +194,7 @@ public sealed class GetSecretResult
 
         [OutputConstructor]
         private GetSecretResult(
-            ImmutableDictionary<string, object> data,
+            ImmutableDictionary<string, string> data,
 
             string dataJson,
 
diff --git a/sdk/dotnet/kv/GetSecretSubkeysV2.cs b/sdk/dotnet/kv/GetSecretSubkeysV2.cs
index 572fe21a8..36d6c8d53 100644
--- a/sdk/dotnet/kv/GetSecretSubkeysV2.cs
+++ b/sdk/dotnet/kv/GetSecretSubkeysV2.cs
@@ -216,7 +216,7 @@ public sealed class GetSecretSubkeysV2Result
         /// <summary>
         /// Subkeys for the KV-V2 secret stored as a serialized map of strings.
         /// </summary>
-        public readonly ImmutableDictionary<string, object> Data;
+        public readonly ImmutableDictionary<string, string> Data;
         /// <summary>
         /// Subkeys for the KV-V2 secret read from Vault.
         /// </summary>
@@ -237,7 +237,7 @@ public sealed class GetSecretSubkeysV2Result
 
         [OutputConstructor]
         private GetSecretSubkeysV2Result(
-            ImmutableDictionary<string, object> data,
+            ImmutableDictionary<string, string> data,
 
             string dataJson,
 
diff --git a/sdk/dotnet/kv/GetSecretV2.cs b/sdk/dotnet/kv/GetSecretV2.cs
index 4667771d7..e75ccf353 100644
--- a/sdk/dotnet/kv/GetSecretV2.cs
+++ b/sdk/dotnet/kv/GetSecretV2.cs
@@ -204,14 +204,14 @@ public sealed class GetSecretV2Result
         /// <summary>
         /// Custom metadata for the secret.
         /// </summary>
-        public readonly ImmutableDictionary<string, object> CustomMetadata;
+        public readonly ImmutableDictionary<string, string> CustomMetadata;
         /// <summary>
         /// A mapping whose keys are the top-level data keys returned from
         /// Vault and whose values are the corresponding values. This map can only
         /// represent string data, so any non-string values returned from Vault are
         /// serialized as JSON.
         /// </summary>
-        public readonly ImmutableDictionary<string, object> Data;
+        public readonly ImmutableDictionary<string, string> Data;
         /// <summary>
         /// JSON-encoded string that that is
         /// read as the secret data at the given path.
@@ -245,9 +245,9 @@ public sealed class GetSecretV2Result
         private GetSecretV2Result(
             string createdTime,
 
-            ImmutableDictionary<string, object> customMetadata,
+            ImmutableDictionary<string, string> customMetadata,
 
-            ImmutableDictionary<string, object> data,
+            ImmutableDictionary<string, string> data,
 
             string dataJson,
 
diff --git a/sdk/dotnet/kv/Inputs/SecretV2CustomMetadataArgs.cs b/sdk/dotnet/kv/Inputs/SecretV2CustomMetadataArgs.cs
index 7e18654e7..e6d8cfa70 100644
--- a/sdk/dotnet/kv/Inputs/SecretV2CustomMetadataArgs.cs
+++ b/sdk/dotnet/kv/Inputs/SecretV2CustomMetadataArgs.cs
@@ -19,7 +19,7 @@ public sealed class SecretV2CustomMetadataArgs : global::Pulumi.ResourceArgs
         public Input<bool>? CasRequired { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A mapping whose keys are the top-level data keys returned from
@@ -27,9 +27,9 @@ public sealed class SecretV2CustomMetadataArgs : global::Pulumi.ResourceArgs
         /// represent string data, so any non-string values returned from Vault are
         /// serialized as JSON.
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/kv/Inputs/SecretV2CustomMetadataGetArgs.cs b/sdk/dotnet/kv/Inputs/SecretV2CustomMetadataGetArgs.cs
index 5b72cdfd9..ed2d820bd 100644
--- a/sdk/dotnet/kv/Inputs/SecretV2CustomMetadataGetArgs.cs
+++ b/sdk/dotnet/kv/Inputs/SecretV2CustomMetadataGetArgs.cs
@@ -19,7 +19,7 @@ public sealed class SecretV2CustomMetadataGetArgs : global::Pulumi.ResourceArgs
         public Input<bool>? CasRequired { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A mapping whose keys are the top-level data keys returned from
@@ -27,9 +27,9 @@ public sealed class SecretV2CustomMetadataGetArgs : global::Pulumi.ResourceArgs
         /// represent string data, so any non-string values returned from Vault are
         /// serialized as JSON.
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set => _data = value;
         }
 
diff --git a/sdk/dotnet/kv/Outputs/SecretV2CustomMetadata.cs b/sdk/dotnet/kv/Outputs/SecretV2CustomMetadata.cs
index 92a660901..46f964534 100644
--- a/sdk/dotnet/kv/Outputs/SecretV2CustomMetadata.cs
+++ b/sdk/dotnet/kv/Outputs/SecretV2CustomMetadata.cs
@@ -23,7 +23,7 @@ public sealed class SecretV2CustomMetadata
         /// represent string data, so any non-string values returned from Vault are
         /// serialized as JSON.
         /// </summary>
-        public readonly ImmutableDictionary<string, object>? Data;
+        public readonly ImmutableDictionary<string, string>? Data;
         /// <summary>
         /// If set, specifies the length of time before a version is deleted.
         /// </summary>
@@ -37,7 +37,7 @@ public sealed class SecretV2CustomMetadata
         private SecretV2CustomMetadata(
             bool? casRequired,
 
-            ImmutableDictionary<string, object>? data,
+            ImmutableDictionary<string, string>? data,
 
             int? deleteVersionAfter,
 
diff --git a/sdk/dotnet/kv/Secret.cs b/sdk/dotnet/kv/Secret.cs
index 4075b90de..f1b731ff7 100644
--- a/sdk/dotnet/kv/Secret.cs
+++ b/sdk/dotnet/kv/Secret.cs
@@ -75,7 +75,7 @@ public partial class Secret : global::Pulumi.CustomResource
         /// serialized as JSON.
         /// </summary>
         [Output("data")]
-        public Output<ImmutableDictionary<string, object>> Data { get; private set; } = null!;
+        public Output<ImmutableDictionary<string, string>> Data { get; private set; } = null!;
 
         /// <summary>
         /// JSON-encoded string that will be
@@ -191,7 +191,7 @@ public SecretArgs()
     public sealed class SecretState : global::Pulumi.ResourceArgs
     {
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A mapping whose keys are the top-level data keys returned from
@@ -199,12 +199,12 @@ public sealed class SecretState : global::Pulumi.ResourceArgs
         /// represent string data, so any non-string values returned from Vault are
         /// serialized as JSON.
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set
             {
-                var emptySecret = Output.CreateSecret(ImmutableDictionary.Create<string, object>());
+                var emptySecret = Output.CreateSecret(ImmutableDictionary.Create<string, string>());
                 _data = Output.All(value, emptySecret).Apply(v => v[0]);
             }
         }
diff --git a/sdk/dotnet/kv/SecretV2.cs b/sdk/dotnet/kv/SecretV2.cs
index cef8eb996..857769f05 100644
--- a/sdk/dotnet/kv/SecretV2.cs
+++ b/sdk/dotnet/kv/SecretV2.cs
@@ -116,7 +116,7 @@ public partial class SecretV2 : global::Pulumi.CustomResource
         /// serialized as JSON.
         /// </summary>
         [Output("data")]
-        public Output<ImmutableDictionary<string, object>> Data { get; private set; } = null!;
+        public Output<ImmutableDictionary<string, string>> Data { get; private set; } = null!;
 
         /// <summary>
         /// JSON-encoded string that will be
@@ -143,7 +143,7 @@ public partial class SecretV2 : global::Pulumi.CustomResource
         /// Metadata associated with this secret read from Vault.
         /// </summary>
         [Output("metadata")]
-        public Output<ImmutableDictionary<string, object>> Metadata { get; private set; } = null!;
+        public Output<ImmutableDictionary<string, string>> Metadata { get; private set; } = null!;
 
         /// <summary>
         /// Path where KV-V2 engine is mounted.
@@ -173,7 +173,7 @@ public partial class SecretV2 : global::Pulumi.CustomResource
         /// An object that holds option settings.
         /// </summary>
         [Output("options")]
-        public Output<ImmutableDictionary<string, object>?> Options { get; private set; } = null!;
+        public Output<ImmutableDictionary<string, string>?> Options { get; private set; } = null!;
 
         /// <summary>
         /// Full path where the KV-V2 secret will be written.
@@ -305,14 +305,14 @@ public Input<string>? DataJson
         public Input<string>? Namespace { get; set; }
 
         [Input("options")]
-        private InputMap<object>? _options;
+        private InputMap<string>? _options;
 
         /// <summary>
         /// An object that holds option settings.
         /// </summary>
-        public InputMap<object> Options
+        public InputMap<string> Options
         {
-            get => _options ?? (_options = new InputMap<object>());
+            get => _options ?? (_options = new InputMap<string>());
             set => _options = value;
         }
 
@@ -342,7 +342,7 @@ public sealed class SecretV2State : global::Pulumi.ResourceArgs
         public Input<Inputs.SecretV2CustomMetadataGetArgs>? CustomMetadata { get; set; }
 
         [Input("data")]
-        private InputMap<object>? _data;
+        private InputMap<string>? _data;
 
         /// <summary>
         /// A mapping whose keys are the top-level data keys returned from
@@ -350,12 +350,12 @@ public sealed class SecretV2State : global::Pulumi.ResourceArgs
         /// represent string data, so any non-string values returned from Vault are
         /// serialized as JSON.
         /// </summary>
-        public InputMap<object> Data
+        public InputMap<string> Data
         {
-            get => _data ?? (_data = new InputMap<object>());
+            get => _data ?? (_data = new InputMap<string>());
             set
             {
-                var emptySecret = Output.CreateSecret(ImmutableDictionary.Create<string, object>());
+                var emptySecret = Output.CreateSecret(ImmutableDictionary.Create<string, string>());
                 _data = Output.All(value, emptySecret).Apply(v => v[0]);
             }
         }
@@ -392,14 +392,14 @@ public Input<string>? DataJson
         public Input<bool>? DisableRead { get; set; }
 
         [Input("metadata")]
-        private InputMap<object>? _metadata;
+        private InputMap<string>? _metadata;
 
         /// <summary>
         /// Metadata associated with this secret read from Vault.
         /// </summary>
-        public InputMap<object> Metadata
+        public InputMap<string> Metadata
         {
-            get => _metadata ?? (_metadata = new InputMap<object>());
+            get => _metadata ?? (_metadata = new InputMap<string>());
             set => _metadata = value;
         }
 
@@ -428,14 +428,14 @@ public InputMap<object> Metadata
         public Input<string>? Namespace { get; set; }
 
         [Input("options")]
-        private InputMap<object>? _options;
+        private InputMap<string>? _options;
 
         /// <summary>
         /// An object that holds option settings.
         /// </summary>
-        public InputMap<object> Options
+        public InputMap<string> Options
         {
-            get => _options ?? (_options = new InputMap<object>());
+            get => _options ?? (_options = new InputMap<string>());
             set => _options = value;
         }
 
diff --git a/sdk/go/vault/aws/authBackendLogin.go b/sdk/go/vault/aws/authBackendLogin.go
index 2a33f2ac0..c131803eb 100644
--- a/sdk/go/vault/aws/authBackendLogin.go
+++ b/sdk/go/vault/aws/authBackendLogin.go
@@ -48,7 +48,7 @@ type AuthBackendLogin struct {
 	LeaseStartTime pulumi.StringOutput `pulumi:"leaseStartTime"`
 	// A map of information returned by the Vault server about the
 	// authentication used to generate this token.
-	Metadata pulumi.MapOutput `pulumi:"metadata"`
+	Metadata pulumi.StringMapOutput `pulumi:"metadata"`
 	// The namespace to provision the resource in.
 	// The value should not contain leading or trailing forward slashes.
 	// The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
@@ -140,7 +140,7 @@ type authBackendLoginState struct {
 	LeaseStartTime *string `pulumi:"leaseStartTime"`
 	// A map of information returned by the Vault server about the
 	// authentication used to generate this token.
-	Metadata map[string]interface{} `pulumi:"metadata"`
+	Metadata map[string]string `pulumi:"metadata"`
 	// The namespace to provision the resource in.
 	// The value should not contain leading or trailing forward slashes.
 	// The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
@@ -199,7 +199,7 @@ type AuthBackendLoginState struct {
 	LeaseStartTime pulumi.StringPtrInput
 	// A map of information returned by the Vault server about the
 	// authentication used to generate this token.
-	Metadata pulumi.MapInput
+	Metadata pulumi.StringMapInput
 	// The namespace to provision the resource in.
 	// The value should not contain leading or trailing forward slashes.
 	// The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
@@ -466,8 +466,8 @@ func (o AuthBackendLoginOutput) LeaseStartTime() pulumi.StringOutput {
 
 // A map of information returned by the Vault server about the
 // authentication used to generate this token.
-func (o AuthBackendLoginOutput) Metadata() pulumi.MapOutput {
-	return o.ApplyT(func(v *AuthBackendLogin) pulumi.MapOutput { return v.Metadata }).(pulumi.MapOutput)
+func (o AuthBackendLoginOutput) Metadata() pulumi.StringMapOutput {
+	return o.ApplyT(func(v *AuthBackendLogin) pulumi.StringMapOutput { return v.Metadata }).(pulumi.StringMapOutput)
 }
 
 // The namespace to provision the resource in.
diff --git a/sdk/go/vault/config/uiCustomMessage.go b/sdk/go/vault/config/uiCustomMessage.go
index f470d0cc2..ebbf5622d 100644
--- a/sdk/go/vault/config/uiCustomMessage.go
+++ b/sdk/go/vault/config/uiCustomMessage.go
@@ -26,7 +26,7 @@ type UiCustomMessage struct {
 	// Target namespace. (requires Enterprise)
 	Namespace pulumi.StringPtrOutput `pulumi:"namespace"`
 	// A map containing additional options for the custom message
-	Options pulumi.MapOutput `pulumi:"options"`
+	Options pulumi.StringMapOutput `pulumi:"options"`
 	// The starting time of the active period of the custom message
 	StartTime pulumi.StringOutput `pulumi:"startTime"`
 	// The title of the custom message
@@ -85,7 +85,7 @@ type uiCustomMessageState struct {
 	// Target namespace. (requires Enterprise)
 	Namespace *string `pulumi:"namespace"`
 	// A map containing additional options for the custom message
-	Options map[string]interface{} `pulumi:"options"`
+	Options map[string]string `pulumi:"options"`
 	// The starting time of the active period of the custom message
 	StartTime *string `pulumi:"startTime"`
 	// The title of the custom message
@@ -106,7 +106,7 @@ type UiCustomMessageState struct {
 	// Target namespace. (requires Enterprise)
 	Namespace pulumi.StringPtrInput
 	// A map containing additional options for the custom message
-	Options pulumi.MapInput
+	Options pulumi.StringMapInput
 	// The starting time of the active period of the custom message
 	StartTime pulumi.StringPtrInput
 	// The title of the custom message
@@ -131,7 +131,7 @@ type uiCustomMessageArgs struct {
 	// Target namespace. (requires Enterprise)
 	Namespace *string `pulumi:"namespace"`
 	// A map containing additional options for the custom message
-	Options map[string]interface{} `pulumi:"options"`
+	Options map[string]string `pulumi:"options"`
 	// The starting time of the active period of the custom message
 	StartTime string `pulumi:"startTime"`
 	// The title of the custom message
@@ -153,7 +153,7 @@ type UiCustomMessageArgs struct {
 	// Target namespace. (requires Enterprise)
 	Namespace pulumi.StringPtrInput
 	// A map containing additional options for the custom message
-	Options pulumi.MapInput
+	Options pulumi.StringMapInput
 	// The starting time of the active period of the custom message
 	StartTime pulumi.StringInput
 	// The title of the custom message
@@ -275,8 +275,8 @@ func (o UiCustomMessageOutput) Namespace() pulumi.StringPtrOutput {
 }
 
 // A map containing additional options for the custom message
-func (o UiCustomMessageOutput) Options() pulumi.MapOutput {
-	return o.ApplyT(func(v *UiCustomMessage) pulumi.MapOutput { return v.Options }).(pulumi.MapOutput)
+func (o UiCustomMessageOutput) Options() pulumi.StringMapOutput {
+	return o.ApplyT(func(v *UiCustomMessage) pulumi.StringMapOutput { return v.Options }).(pulumi.StringMapOutput)
 }
 
 // The starting time of the active period of the custom message
diff --git a/sdk/go/vault/database/pulumiTypes.go b/sdk/go/vault/database/pulumiTypes.go
index 0f4325ed8..d2616de5e 100644
--- a/sdk/go/vault/database/pulumiTypes.go
+++ b/sdk/go/vault/database/pulumiTypes.go
@@ -5053,7 +5053,7 @@ type SecretsMountCassandra struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data map[string]interface{} `pulumi:"data"`
+	Data map[string]string `pulumi:"data"`
 	// Cassandra hosts to connect to.
 	Hosts []string `pulumi:"hosts"`
 	// Whether to skip verification of the server certificate when using TLS.
@@ -5103,7 +5103,7 @@ type SecretsMountCassandraArgs struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data pulumi.MapInput `pulumi:"data"`
+	Data pulumi.StringMapInput `pulumi:"data"`
 	// Cassandra hosts to connect to.
 	Hosts pulumi.StringArrayInput `pulumi:"hosts"`
 	// Whether to skip verification of the server certificate when using TLS.
@@ -5198,8 +5198,8 @@ func (o SecretsMountCassandraOutput) ConnectTimeout() pulumi.IntPtrOutput {
 // A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 //
 // Supported list of database secrets engines that can be configured:
-func (o SecretsMountCassandraOutput) Data() pulumi.MapOutput {
-	return o.ApplyT(func(v SecretsMountCassandra) map[string]interface{} { return v.Data }).(pulumi.MapOutput)
+func (o SecretsMountCassandraOutput) Data() pulumi.StringMapOutput {
+	return o.ApplyT(func(v SecretsMountCassandra) map[string]string { return v.Data }).(pulumi.StringMapOutput)
 }
 
 // Cassandra hosts to connect to.
@@ -5299,7 +5299,7 @@ type SecretsMountCouchbase struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data map[string]interface{} `pulumi:"data"`
+	Data map[string]string `pulumi:"data"`
 	// A set of Couchbase URIs to connect to. Must use `couchbases://` scheme if `tls` is `true`.
 	Hosts []string `pulumi:"hosts"`
 	// Specifies whether to skip verification of the server certificate when using TLS.
@@ -5345,7 +5345,7 @@ type SecretsMountCouchbaseArgs struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data pulumi.MapInput `pulumi:"data"`
+	Data pulumi.StringMapInput `pulumi:"data"`
 	// A set of Couchbase URIs to connect to. Must use `couchbases://` scheme if `tls` is `true`.
 	Hosts pulumi.StringArrayInput `pulumi:"hosts"`
 	// Specifies whether to skip verification of the server certificate when using TLS.
@@ -5439,8 +5439,8 @@ func (o SecretsMountCouchbaseOutput) BucketName() pulumi.StringPtrOutput {
 // A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 //
 // Supported list of database secrets engines that can be configured:
-func (o SecretsMountCouchbaseOutput) Data() pulumi.MapOutput {
-	return o.ApplyT(func(v SecretsMountCouchbase) map[string]interface{} { return v.Data }).(pulumi.MapOutput)
+func (o SecretsMountCouchbaseOutput) Data() pulumi.StringMapOutput {
+	return o.ApplyT(func(v SecretsMountCouchbase) map[string]string { return v.Data }).(pulumi.StringMapOutput)
 }
 
 // A set of Couchbase URIs to connect to. Must use `couchbases://` scheme if `tls` is `true`.
@@ -5529,7 +5529,7 @@ type SecretsMountElasticsearch struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data map[string]interface{} `pulumi:"data"`
+	Data map[string]string `pulumi:"data"`
 	// Whether to disable certificate verification
 	Insecure *bool `pulumi:"insecure"`
 	// Name of the database connection.
@@ -5579,7 +5579,7 @@ type SecretsMountElasticsearchArgs struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data pulumi.MapInput `pulumi:"data"`
+	Data pulumi.StringMapInput `pulumi:"data"`
 	// Whether to disable certificate verification
 	Insecure pulumi.BoolPtrInput `pulumi:"insecure"`
 	// Name of the database connection.
@@ -5683,8 +5683,8 @@ func (o SecretsMountElasticsearchOutput) ClientKey() pulumi.StringPtrOutput {
 // A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 //
 // Supported list of database secrets engines that can be configured:
-func (o SecretsMountElasticsearchOutput) Data() pulumi.MapOutput {
-	return o.ApplyT(func(v SecretsMountElasticsearch) map[string]interface{} { return v.Data }).(pulumi.MapOutput)
+func (o SecretsMountElasticsearchOutput) Data() pulumi.StringMapOutput {
+	return o.ApplyT(func(v SecretsMountElasticsearch) map[string]string { return v.Data }).(pulumi.StringMapOutput)
 }
 
 // Whether to disable certificate verification
@@ -5767,7 +5767,7 @@ type SecretsMountHana struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data map[string]interface{} `pulumi:"data"`
+	Data map[string]string `pulumi:"data"`
 	// Disable special character escaping in username and password
 	DisableEscaping *bool `pulumi:"disableEscaping"`
 	// Maximum number of seconds a connection may be reused.
@@ -5811,7 +5811,7 @@ type SecretsMountHanaArgs struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data pulumi.MapInput `pulumi:"data"`
+	Data pulumi.StringMapInput `pulumi:"data"`
 	// Disable special character escaping in username and password
 	DisableEscaping pulumi.BoolPtrInput `pulumi:"disableEscaping"`
 	// Maximum number of seconds a connection may be reused.
@@ -5900,8 +5900,8 @@ func (o SecretsMountHanaOutput) ConnectionUrl() pulumi.StringPtrOutput {
 // A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 //
 // Supported list of database secrets engines that can be configured:
-func (o SecretsMountHanaOutput) Data() pulumi.MapOutput {
-	return o.ApplyT(func(v SecretsMountHana) map[string]interface{} { return v.Data }).(pulumi.MapOutput)
+func (o SecretsMountHanaOutput) Data() pulumi.StringMapOutput {
+	return o.ApplyT(func(v SecretsMountHana) map[string]string { return v.Data }).(pulumi.StringMapOutput)
 }
 
 // Disable special character escaping in username and password
@@ -5984,7 +5984,7 @@ type SecretsMountInfluxdb struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data map[string]interface{} `pulumi:"data"`
+	Data map[string]string `pulumi:"data"`
 	// Influxdb host to connect to.
 	Host string `pulumi:"host"`
 	// Whether to skip verification of the server certificate when using TLS.
@@ -6034,7 +6034,7 @@ type SecretsMountInfluxdbArgs struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data pulumi.MapInput `pulumi:"data"`
+	Data pulumi.StringMapInput `pulumi:"data"`
 	// Influxdb host to connect to.
 	Host pulumi.StringInput `pulumi:"host"`
 	// Whether to skip verification of the server certificate when using TLS.
@@ -6129,8 +6129,8 @@ func (o SecretsMountInfluxdbOutput) ConnectTimeout() pulumi.IntPtrOutput {
 // A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 //
 // Supported list of database secrets engines that can be configured:
-func (o SecretsMountInfluxdbOutput) Data() pulumi.MapOutput {
-	return o.ApplyT(func(v SecretsMountInfluxdb) map[string]interface{} { return v.Data }).(pulumi.MapOutput)
+func (o SecretsMountInfluxdbOutput) Data() pulumi.StringMapOutput {
+	return o.ApplyT(func(v SecretsMountInfluxdb) map[string]string { return v.Data }).(pulumi.StringMapOutput)
 }
 
 // Influxdb host to connect to.
@@ -6228,7 +6228,7 @@ type SecretsMountMongodb struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data map[string]interface{} `pulumi:"data"`
+	Data map[string]string `pulumi:"data"`
 	// Maximum number of seconds a connection may be reused.
 	MaxConnectionLifetime *int `pulumi:"maxConnectionLifetime"`
 	// Maximum number of idle connections to the database.
@@ -6272,7 +6272,7 @@ type SecretsMountMongodbArgs struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data pulumi.MapInput `pulumi:"data"`
+	Data pulumi.StringMapInput `pulumi:"data"`
 	// Maximum number of seconds a connection may be reused.
 	MaxConnectionLifetime pulumi.IntPtrInput `pulumi:"maxConnectionLifetime"`
 	// Maximum number of idle connections to the database.
@@ -6361,8 +6361,8 @@ func (o SecretsMountMongodbOutput) ConnectionUrl() pulumi.StringPtrOutput {
 // A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 //
 // Supported list of database secrets engines that can be configured:
-func (o SecretsMountMongodbOutput) Data() pulumi.MapOutput {
-	return o.ApplyT(func(v SecretsMountMongodb) map[string]interface{} { return v.Data }).(pulumi.MapOutput)
+func (o SecretsMountMongodbOutput) Data() pulumi.StringMapOutput {
+	return o.ApplyT(func(v SecretsMountMongodb) map[string]string { return v.Data }).(pulumi.StringMapOutput)
 }
 
 // Maximum number of seconds a connection may be reused.
@@ -6443,7 +6443,7 @@ type SecretsMountMongodbatla struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data map[string]interface{} `pulumi:"data"`
+	Data map[string]string `pulumi:"data"`
 	// Name of the database connection.
 	Name string `pulumi:"name"`
 	// Specifies the name of the plugin to use.
@@ -6479,7 +6479,7 @@ type SecretsMountMongodbatlaArgs struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data pulumi.MapInput `pulumi:"data"`
+	Data pulumi.StringMapInput `pulumi:"data"`
 	// Name of the database connection.
 	Name pulumi.StringInput `pulumi:"name"`
 	// Specifies the name of the plugin to use.
@@ -6557,8 +6557,8 @@ func (o SecretsMountMongodbatlaOutput) AllowedRoles() pulumi.StringArrayOutput {
 // A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 //
 // Supported list of database secrets engines that can be configured:
-func (o SecretsMountMongodbatlaOutput) Data() pulumi.MapOutput {
-	return o.ApplyT(func(v SecretsMountMongodbatla) map[string]interface{} { return v.Data }).(pulumi.MapOutput)
+func (o SecretsMountMongodbatlaOutput) Data() pulumi.StringMapOutput {
+	return o.ApplyT(func(v SecretsMountMongodbatla) map[string]string { return v.Data }).(pulumi.StringMapOutput)
 }
 
 // Name of the database connection.
@@ -6628,7 +6628,7 @@ type SecretsMountMssql struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data map[string]interface{} `pulumi:"data"`
+	Data map[string]string `pulumi:"data"`
 	// Disable special character escaping in username and password
 	DisableEscaping *bool `pulumi:"disableEscaping"`
 	// Maximum number of seconds a connection may be reused.
@@ -6676,7 +6676,7 @@ type SecretsMountMssqlArgs struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data pulumi.MapInput `pulumi:"data"`
+	Data pulumi.StringMapInput `pulumi:"data"`
 	// Disable special character escaping in username and password
 	DisableEscaping pulumi.BoolPtrInput `pulumi:"disableEscaping"`
 	// Maximum number of seconds a connection may be reused.
@@ -6772,8 +6772,8 @@ func (o SecretsMountMssqlOutput) ContainedDb() pulumi.BoolPtrOutput {
 // A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 //
 // Supported list of database secrets engines that can be configured:
-func (o SecretsMountMssqlOutput) Data() pulumi.MapOutput {
-	return o.ApplyT(func(v SecretsMountMssql) map[string]interface{} { return v.Data }).(pulumi.MapOutput)
+func (o SecretsMountMssqlOutput) Data() pulumi.StringMapOutput {
+	return o.ApplyT(func(v SecretsMountMssql) map[string]string { return v.Data }).(pulumi.StringMapOutput)
 }
 
 // Disable special character escaping in username and password
@@ -6863,7 +6863,7 @@ type SecretsMountMysql struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data map[string]interface{} `pulumi:"data"`
+	Data map[string]string `pulumi:"data"`
 	// Maximum number of seconds a connection may be reused.
 	MaxConnectionLifetime *int `pulumi:"maxConnectionLifetime"`
 	// Maximum number of idle connections to the database.
@@ -6915,7 +6915,7 @@ type SecretsMountMysqlArgs struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data pulumi.MapInput `pulumi:"data"`
+	Data pulumi.StringMapInput `pulumi:"data"`
 	// Maximum number of seconds a connection may be reused.
 	MaxConnectionLifetime pulumi.IntPtrInput `pulumi:"maxConnectionLifetime"`
 	// Maximum number of idle connections to the database.
@@ -7015,8 +7015,8 @@ func (o SecretsMountMysqlOutput) ConnectionUrl() pulumi.StringPtrOutput {
 // A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 //
 // Supported list of database secrets engines that can be configured:
-func (o SecretsMountMysqlOutput) Data() pulumi.MapOutput {
-	return o.ApplyT(func(v SecretsMountMysql) map[string]interface{} { return v.Data }).(pulumi.MapOutput)
+func (o SecretsMountMysqlOutput) Data() pulumi.StringMapOutput {
+	return o.ApplyT(func(v SecretsMountMysql) map[string]string { return v.Data }).(pulumi.StringMapOutput)
 }
 
 // Maximum number of seconds a connection may be reused.
@@ -7116,7 +7116,7 @@ type SecretsMountMysqlAurora struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data map[string]interface{} `pulumi:"data"`
+	Data map[string]string `pulumi:"data"`
 	// Maximum number of seconds a connection may be reused.
 	MaxConnectionLifetime *int `pulumi:"maxConnectionLifetime"`
 	// Maximum number of idle connections to the database.
@@ -7168,7 +7168,7 @@ type SecretsMountMysqlAuroraArgs struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data pulumi.MapInput `pulumi:"data"`
+	Data pulumi.StringMapInput `pulumi:"data"`
 	// Maximum number of seconds a connection may be reused.
 	MaxConnectionLifetime pulumi.IntPtrInput `pulumi:"maxConnectionLifetime"`
 	// Maximum number of idle connections to the database.
@@ -7268,8 +7268,8 @@ func (o SecretsMountMysqlAuroraOutput) ConnectionUrl() pulumi.StringPtrOutput {
 // A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 //
 // Supported list of database secrets engines that can be configured:
-func (o SecretsMountMysqlAuroraOutput) Data() pulumi.MapOutput {
-	return o.ApplyT(func(v SecretsMountMysqlAurora) map[string]interface{} { return v.Data }).(pulumi.MapOutput)
+func (o SecretsMountMysqlAuroraOutput) Data() pulumi.StringMapOutput {
+	return o.ApplyT(func(v SecretsMountMysqlAurora) map[string]string { return v.Data }).(pulumi.StringMapOutput)
 }
 
 // Maximum number of seconds a connection may be reused.
@@ -7369,7 +7369,7 @@ type SecretsMountMysqlLegacy struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data map[string]interface{} `pulumi:"data"`
+	Data map[string]string `pulumi:"data"`
 	// Maximum number of seconds a connection may be reused.
 	MaxConnectionLifetime *int `pulumi:"maxConnectionLifetime"`
 	// Maximum number of idle connections to the database.
@@ -7421,7 +7421,7 @@ type SecretsMountMysqlLegacyArgs struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data pulumi.MapInput `pulumi:"data"`
+	Data pulumi.StringMapInput `pulumi:"data"`
 	// Maximum number of seconds a connection may be reused.
 	MaxConnectionLifetime pulumi.IntPtrInput `pulumi:"maxConnectionLifetime"`
 	// Maximum number of idle connections to the database.
@@ -7521,8 +7521,8 @@ func (o SecretsMountMysqlLegacyOutput) ConnectionUrl() pulumi.StringPtrOutput {
 // A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 //
 // Supported list of database secrets engines that can be configured:
-func (o SecretsMountMysqlLegacyOutput) Data() pulumi.MapOutput {
-	return o.ApplyT(func(v SecretsMountMysqlLegacy) map[string]interface{} { return v.Data }).(pulumi.MapOutput)
+func (o SecretsMountMysqlLegacyOutput) Data() pulumi.StringMapOutput {
+	return o.ApplyT(func(v SecretsMountMysqlLegacy) map[string]string { return v.Data }).(pulumi.StringMapOutput)
 }
 
 // Maximum number of seconds a connection may be reused.
@@ -7622,7 +7622,7 @@ type SecretsMountMysqlRd struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data map[string]interface{} `pulumi:"data"`
+	Data map[string]string `pulumi:"data"`
 	// Maximum number of seconds a connection may be reused.
 	MaxConnectionLifetime *int `pulumi:"maxConnectionLifetime"`
 	// Maximum number of idle connections to the database.
@@ -7674,7 +7674,7 @@ type SecretsMountMysqlRdArgs struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data pulumi.MapInput `pulumi:"data"`
+	Data pulumi.StringMapInput `pulumi:"data"`
 	// Maximum number of seconds a connection may be reused.
 	MaxConnectionLifetime pulumi.IntPtrInput `pulumi:"maxConnectionLifetime"`
 	// Maximum number of idle connections to the database.
@@ -7774,8 +7774,8 @@ func (o SecretsMountMysqlRdOutput) ConnectionUrl() pulumi.StringPtrOutput {
 // A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 //
 // Supported list of database secrets engines that can be configured:
-func (o SecretsMountMysqlRdOutput) Data() pulumi.MapOutput {
-	return o.ApplyT(func(v SecretsMountMysqlRd) map[string]interface{} { return v.Data }).(pulumi.MapOutput)
+func (o SecretsMountMysqlRdOutput) Data() pulumi.StringMapOutput {
+	return o.ApplyT(func(v SecretsMountMysqlRd) map[string]string { return v.Data }).(pulumi.StringMapOutput)
 }
 
 // Maximum number of seconds a connection may be reused.
@@ -7873,7 +7873,7 @@ type SecretsMountOracle struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data map[string]interface{} `pulumi:"data"`
+	Data map[string]string `pulumi:"data"`
 	// Set to true to disconnect any open sessions prior to running the revocation statements.
 	DisconnectSessions *bool `pulumi:"disconnectSessions"`
 	// Maximum number of seconds a connection may be reused.
@@ -7921,7 +7921,7 @@ type SecretsMountOracleArgs struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data pulumi.MapInput `pulumi:"data"`
+	Data pulumi.StringMapInput `pulumi:"data"`
 	// Set to true to disconnect any open sessions prior to running the revocation statements.
 	DisconnectSessions pulumi.BoolPtrInput `pulumi:"disconnectSessions"`
 	// Maximum number of seconds a connection may be reused.
@@ -8014,8 +8014,8 @@ func (o SecretsMountOracleOutput) ConnectionUrl() pulumi.StringPtrOutput {
 // A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 //
 // Supported list of database secrets engines that can be configured:
-func (o SecretsMountOracleOutput) Data() pulumi.MapOutput {
-	return o.ApplyT(func(v SecretsMountOracle) map[string]interface{} { return v.Data }).(pulumi.MapOutput)
+func (o SecretsMountOracleOutput) Data() pulumi.StringMapOutput {
+	return o.ApplyT(func(v SecretsMountOracle) map[string]string { return v.Data }).(pulumi.StringMapOutput)
 }
 
 // Set to true to disconnect any open sessions prior to running the revocation statements.
@@ -8110,7 +8110,7 @@ type SecretsMountPostgresql struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data map[string]interface{} `pulumi:"data"`
+	Data map[string]string `pulumi:"data"`
 	// Disable special character escaping in username and password
 	DisableEscaping *bool `pulumi:"disableEscaping"`
 	// Maximum number of seconds a connection may be reused.
@@ -8160,7 +8160,7 @@ type SecretsMountPostgresqlArgs struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data pulumi.MapInput `pulumi:"data"`
+	Data pulumi.StringMapInput `pulumi:"data"`
 	// Disable special character escaping in username and password
 	DisableEscaping pulumi.BoolPtrInput `pulumi:"disableEscaping"`
 	// Maximum number of seconds a connection may be reused.
@@ -8258,8 +8258,8 @@ func (o SecretsMountPostgresqlOutput) ConnectionUrl() pulumi.StringPtrOutput {
 // A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 //
 // Supported list of database secrets engines that can be configured:
-func (o SecretsMountPostgresqlOutput) Data() pulumi.MapOutput {
-	return o.ApplyT(func(v SecretsMountPostgresql) map[string]interface{} { return v.Data }).(pulumi.MapOutput)
+func (o SecretsMountPostgresqlOutput) Data() pulumi.StringMapOutput {
+	return o.ApplyT(func(v SecretsMountPostgresql) map[string]string { return v.Data }).(pulumi.StringMapOutput)
 }
 
 // Disable special character escaping in username and password
@@ -8352,7 +8352,7 @@ type SecretsMountRedi struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data map[string]interface{} `pulumi:"data"`
+	Data map[string]string `pulumi:"data"`
 	// Specifies the host to connect to
 	Host string `pulumi:"host"`
 	// Specifies whether to skip verification of the server certificate when using TLS.
@@ -8396,7 +8396,7 @@ type SecretsMountRediArgs struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data pulumi.MapInput `pulumi:"data"`
+	Data pulumi.StringMapInput `pulumi:"data"`
 	// Specifies the host to connect to
 	Host pulumi.StringInput `pulumi:"host"`
 	// Specifies whether to skip verification of the server certificate when using TLS.
@@ -8485,8 +8485,8 @@ func (o SecretsMountRediOutput) CaCert() pulumi.StringPtrOutput {
 // A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 //
 // Supported list of database secrets engines that can be configured:
-func (o SecretsMountRediOutput) Data() pulumi.MapOutput {
-	return o.ApplyT(func(v SecretsMountRedi) map[string]interface{} { return v.Data }).(pulumi.MapOutput)
+func (o SecretsMountRediOutput) Data() pulumi.StringMapOutput {
+	return o.ApplyT(func(v SecretsMountRedi) map[string]string { return v.Data }).(pulumi.StringMapOutput)
 }
 
 // Specifies the host to connect to
@@ -8567,7 +8567,7 @@ type SecretsMountRedisElasticach struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data map[string]interface{} `pulumi:"data"`
+	Data map[string]string `pulumi:"data"`
 	// Name of the database connection.
 	Name string `pulumi:"name"`
 	// The AWS secret key id to use to talk to ElastiCache. If omitted the credentials chain provider is used instead.
@@ -8605,7 +8605,7 @@ type SecretsMountRedisElasticachArgs struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data pulumi.MapInput `pulumi:"data"`
+	Data pulumi.StringMapInput `pulumi:"data"`
 	// Name of the database connection.
 	Name pulumi.StringInput `pulumi:"name"`
 	// The AWS secret key id to use to talk to ElastiCache. If omitted the credentials chain provider is used instead.
@@ -8685,8 +8685,8 @@ func (o SecretsMountRedisElasticachOutput) AllowedRoles() pulumi.StringArrayOutp
 // A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 //
 // Supported list of database secrets engines that can be configured:
-func (o SecretsMountRedisElasticachOutput) Data() pulumi.MapOutput {
-	return o.ApplyT(func(v SecretsMountRedisElasticach) map[string]interface{} { return v.Data }).(pulumi.MapOutput)
+func (o SecretsMountRedisElasticachOutput) Data() pulumi.StringMapOutput {
+	return o.ApplyT(func(v SecretsMountRedisElasticach) map[string]string { return v.Data }).(pulumi.StringMapOutput)
 }
 
 // Name of the database connection.
@@ -8759,7 +8759,7 @@ type SecretsMountRedshift struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data map[string]interface{} `pulumi:"data"`
+	Data map[string]string `pulumi:"data"`
 	// Disable special character escaping in username and password
 	DisableEscaping *bool `pulumi:"disableEscaping"`
 	// Maximum number of seconds a connection may be reused.
@@ -8805,7 +8805,7 @@ type SecretsMountRedshiftArgs struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data pulumi.MapInput `pulumi:"data"`
+	Data pulumi.StringMapInput `pulumi:"data"`
 	// Disable special character escaping in username and password
 	DisableEscaping pulumi.BoolPtrInput `pulumi:"disableEscaping"`
 	// Maximum number of seconds a connection may be reused.
@@ -8896,8 +8896,8 @@ func (o SecretsMountRedshiftOutput) ConnectionUrl() pulumi.StringPtrOutput {
 // A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 //
 // Supported list of database secrets engines that can be configured:
-func (o SecretsMountRedshiftOutput) Data() pulumi.MapOutput {
-	return o.ApplyT(func(v SecretsMountRedshift) map[string]interface{} { return v.Data }).(pulumi.MapOutput)
+func (o SecretsMountRedshiftOutput) Data() pulumi.StringMapOutput {
+	return o.ApplyT(func(v SecretsMountRedshift) map[string]string { return v.Data }).(pulumi.StringMapOutput)
 }
 
 // Disable special character escaping in username and password
@@ -8985,7 +8985,7 @@ type SecretsMountSnowflake struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data map[string]interface{} `pulumi:"data"`
+	Data map[string]string `pulumi:"data"`
 	// Maximum number of seconds a connection may be reused.
 	MaxConnectionLifetime *int `pulumi:"maxConnectionLifetime"`
 	// Maximum number of idle connections to the database.
@@ -9029,7 +9029,7 @@ type SecretsMountSnowflakeArgs struct {
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 	//
 	// Supported list of database secrets engines that can be configured:
-	Data pulumi.MapInput `pulumi:"data"`
+	Data pulumi.StringMapInput `pulumi:"data"`
 	// Maximum number of seconds a connection may be reused.
 	MaxConnectionLifetime pulumi.IntPtrInput `pulumi:"maxConnectionLifetime"`
 	// Maximum number of idle connections to the database.
@@ -9118,8 +9118,8 @@ func (o SecretsMountSnowflakeOutput) ConnectionUrl() pulumi.StringPtrOutput {
 // A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 //
 // Supported list of database secrets engines that can be configured:
-func (o SecretsMountSnowflakeOutput) Data() pulumi.MapOutput {
-	return o.ApplyT(func(v SecretsMountSnowflake) map[string]interface{} { return v.Data }).(pulumi.MapOutput)
+func (o SecretsMountSnowflakeOutput) Data() pulumi.StringMapOutput {
+	return o.ApplyT(func(v SecretsMountSnowflake) map[string]string { return v.Data }).(pulumi.StringMapOutput)
 }
 
 // Maximum number of seconds a connection may be reused.
diff --git a/sdk/go/vault/database/secretBackendConnection.go b/sdk/go/vault/database/secretBackendConnection.go
index 6a44adca1..3b0c94c45 100644
--- a/sdk/go/vault/database/secretBackendConnection.go
+++ b/sdk/go/vault/database/secretBackendConnection.go
@@ -74,7 +74,7 @@ type SecretBackendConnection struct {
 	// A nested block containing configuration options for Couchbase connections.
 	Couchbase SecretBackendConnectionCouchbasePtrOutput `pulumi:"couchbase"`
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
-	Data pulumi.MapOutput `pulumi:"data"`
+	Data pulumi.StringMapOutput `pulumi:"data"`
 	// A nested block containing configuration options for Elasticsearch connections.
 	Elasticsearch SecretBackendConnectionElasticsearchPtrOutput `pulumi:"elasticsearch"`
 	// A nested block containing configuration options for SAP HanaDB connections.
@@ -168,7 +168,7 @@ type secretBackendConnectionState struct {
 	// A nested block containing configuration options for Couchbase connections.
 	Couchbase *SecretBackendConnectionCouchbase `pulumi:"couchbase"`
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
-	Data map[string]interface{} `pulumi:"data"`
+	Data map[string]string `pulumi:"data"`
 	// A nested block containing configuration options for Elasticsearch connections.
 	Elasticsearch *SecretBackendConnectionElasticsearch `pulumi:"elasticsearch"`
 	// A nested block containing configuration options for SAP HanaDB connections.
@@ -230,7 +230,7 @@ type SecretBackendConnectionState struct {
 	// A nested block containing configuration options for Couchbase connections.
 	Couchbase SecretBackendConnectionCouchbasePtrInput
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
-	Data pulumi.MapInput
+	Data pulumi.StringMapInput
 	// A nested block containing configuration options for Elasticsearch connections.
 	Elasticsearch SecretBackendConnectionElasticsearchPtrInput
 	// A nested block containing configuration options for SAP HanaDB connections.
@@ -296,7 +296,7 @@ type secretBackendConnectionArgs struct {
 	// A nested block containing configuration options for Couchbase connections.
 	Couchbase *SecretBackendConnectionCouchbase `pulumi:"couchbase"`
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
-	Data map[string]interface{} `pulumi:"data"`
+	Data map[string]string `pulumi:"data"`
 	// A nested block containing configuration options for Elasticsearch connections.
 	Elasticsearch *SecretBackendConnectionElasticsearch `pulumi:"elasticsearch"`
 	// A nested block containing configuration options for SAP HanaDB connections.
@@ -359,7 +359,7 @@ type SecretBackendConnectionArgs struct {
 	// A nested block containing configuration options for Couchbase connections.
 	Couchbase SecretBackendConnectionCouchbasePtrInput
 	// A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
-	Data pulumi.MapInput
+	Data pulumi.StringMapInput
 	// A nested block containing configuration options for Elasticsearch connections.
 	Elasticsearch SecretBackendConnectionElasticsearchPtrInput
 	// A nested block containing configuration options for SAP HanaDB connections.
@@ -519,8 +519,8 @@ func (o SecretBackendConnectionOutput) Couchbase() SecretBackendConnectionCouchb
 }
 
 // A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
-func (o SecretBackendConnectionOutput) Data() pulumi.MapOutput {
-	return o.ApplyT(func(v *SecretBackendConnection) pulumi.MapOutput { return v.Data }).(pulumi.MapOutput)
+func (o SecretBackendConnectionOutput) Data() pulumi.StringMapOutput {
+	return o.ApplyT(func(v *SecretBackendConnection) pulumi.StringMapOutput { return v.Data }).(pulumi.StringMapOutput)
 }
 
 // A nested block containing configuration options for Elasticsearch connections.
diff --git a/sdk/go/vault/database/secretBackendRole.go b/sdk/go/vault/database/secretBackendRole.go
index d45aa15ec..a15fe8dcd 100644
--- a/sdk/go/vault/database/secretBackendRole.go
+++ b/sdk/go/vault/database/secretBackendRole.go
@@ -84,7 +84,7 @@ type SecretBackendRole struct {
 	// for the given `credentialType`.
 	//
 	// The following options are available for each `credentialType` value:
-	CredentialConfig pulumi.MapOutput `pulumi:"credentialConfig"`
+	CredentialConfig pulumi.StringMapOutput `pulumi:"credentialConfig"`
 	// Specifies the type of credential that
 	// will be generated for the role. Options include: `password`, `rsaPrivateKey`, `clientCertificate`.
 	// See the plugin's API page for credential types supported by individual databases.
@@ -164,7 +164,7 @@ type secretBackendRoleState struct {
 	// for the given `credentialType`.
 	//
 	// The following options are available for each `credentialType` value:
-	CredentialConfig map[string]interface{} `pulumi:"credentialConfig"`
+	CredentialConfig map[string]string `pulumi:"credentialConfig"`
 	// Specifies the type of credential that
 	// will be generated for the role. Options include: `password`, `rsaPrivateKey`, `clientCertificate`.
 	// See the plugin's API page for credential types supported by individual databases.
@@ -206,7 +206,7 @@ type SecretBackendRoleState struct {
 	// for the given `credentialType`.
 	//
 	// The following options are available for each `credentialType` value:
-	CredentialConfig pulumi.MapInput
+	CredentialConfig pulumi.StringMapInput
 	// Specifies the type of credential that
 	// will be generated for the role. Options include: `password`, `rsaPrivateKey`, `clientCertificate`.
 	// See the plugin's API page for credential types supported by individual databases.
@@ -252,7 +252,7 @@ type secretBackendRoleArgs struct {
 	// for the given `credentialType`.
 	//
 	// The following options are available for each `credentialType` value:
-	CredentialConfig map[string]interface{} `pulumi:"credentialConfig"`
+	CredentialConfig map[string]string `pulumi:"credentialConfig"`
 	// Specifies the type of credential that
 	// will be generated for the role. Options include: `password`, `rsaPrivateKey`, `clientCertificate`.
 	// See the plugin's API page for credential types supported by individual databases.
@@ -295,7 +295,7 @@ type SecretBackendRoleArgs struct {
 	// for the given `credentialType`.
 	//
 	// The following options are available for each `credentialType` value:
-	CredentialConfig pulumi.MapInput
+	CredentialConfig pulumi.StringMapInput
 	// Specifies the type of credential that
 	// will be generated for the role. Options include: `password`, `rsaPrivateKey`, `clientCertificate`.
 	// See the plugin's API page for credential types supported by individual databases.
@@ -429,8 +429,8 @@ func (o SecretBackendRoleOutput) CreationStatements() pulumi.StringArrayOutput {
 // for the given `credentialType`.
 //
 // The following options are available for each `credentialType` value:
-func (o SecretBackendRoleOutput) CredentialConfig() pulumi.MapOutput {
-	return o.ApplyT(func(v *SecretBackendRole) pulumi.MapOutput { return v.CredentialConfig }).(pulumi.MapOutput)
+func (o SecretBackendRoleOutput) CredentialConfig() pulumi.StringMapOutput {
+	return o.ApplyT(func(v *SecretBackendRole) pulumi.StringMapOutput { return v.CredentialConfig }).(pulumi.StringMapOutput)
 }
 
 // Specifies the type of credential that
diff --git a/sdk/go/vault/database/secretsMount.go b/sdk/go/vault/database/secretsMount.go
index 440af0b58..e7bb88e84 100644
--- a/sdk/go/vault/database/secretsMount.go
+++ b/sdk/go/vault/database/secretsMount.go
@@ -169,7 +169,7 @@ type SecretsMount struct {
 	// Target namespace. (requires Enterprise)
 	Namespace pulumi.StringPtrOutput `pulumi:"namespace"`
 	// Specifies mount type specific options that are passed to the backend
-	Options pulumi.MapOutput `pulumi:"options"`
+	Options pulumi.StringMapOutput `pulumi:"options"`
 	// A nested block containing configuration options for Oracle connections.\
 	// *See Configuration Options for more info*
 	Oracles SecretsMountOracleArrayOutput `pulumi:"oracles"`
@@ -300,7 +300,7 @@ type secretsMountState struct {
 	// Target namespace. (requires Enterprise)
 	Namespace *string `pulumi:"namespace"`
 	// Specifies mount type specific options that are passed to the backend
-	Options map[string]interface{} `pulumi:"options"`
+	Options map[string]string `pulumi:"options"`
 	// A nested block containing configuration options for Oracle connections.\
 	// *See Configuration Options for more info*
 	Oracles []SecretsMountOracle `pulumi:"oracles"`
@@ -399,7 +399,7 @@ type SecretsMountState struct {
 	// Target namespace. (requires Enterprise)
 	Namespace pulumi.StringPtrInput
 	// Specifies mount type specific options that are passed to the backend
-	Options pulumi.MapInput
+	Options pulumi.StringMapInput
 	// A nested block containing configuration options for Oracle connections.\
 	// *See Configuration Options for more info*
 	Oracles SecretsMountOracleArrayInput
@@ -498,7 +498,7 @@ type secretsMountArgs struct {
 	// Target namespace. (requires Enterprise)
 	Namespace *string `pulumi:"namespace"`
 	// Specifies mount type specific options that are passed to the backend
-	Options map[string]interface{} `pulumi:"options"`
+	Options map[string]string `pulumi:"options"`
 	// A nested block containing configuration options for Oracle connections.\
 	// *See Configuration Options for more info*
 	Oracles []SecretsMountOracle `pulumi:"oracles"`
@@ -594,7 +594,7 @@ type SecretsMountArgs struct {
 	// Target namespace. (requires Enterprise)
 	Namespace pulumi.StringPtrInput
 	// Specifies mount type specific options that are passed to the backend
-	Options pulumi.MapInput
+	Options pulumi.StringMapInput
 	// A nested block containing configuration options for Oracle connections.\
 	// *See Configuration Options for more info*
 	Oracles SecretsMountOracleArrayInput
@@ -860,8 +860,8 @@ func (o SecretsMountOutput) Namespace() pulumi.StringPtrOutput {
 }
 
 // Specifies mount type specific options that are passed to the backend
-func (o SecretsMountOutput) Options() pulumi.MapOutput {
-	return o.ApplyT(func(v *SecretsMount) pulumi.MapOutput { return v.Options }).(pulumi.MapOutput)
+func (o SecretsMountOutput) Options() pulumi.StringMapOutput {
+	return o.ApplyT(func(v *SecretsMount) pulumi.StringMapOutput { return v.Options }).(pulumi.StringMapOutput)
 }
 
 // A nested block containing configuration options for Oracle connections.\
diff --git a/sdk/go/vault/generic/getSecret.go b/sdk/go/vault/generic/getSecret.go
index fc0a0ef20..85e0bcf99 100644
--- a/sdk/go/vault/generic/getSecret.go
+++ b/sdk/go/vault/generic/getSecret.go
@@ -114,7 +114,7 @@ type LookupSecretResult struct {
 	// Vault and whose values are the corresponding values. This map can only
 	// represent string data, so any non-string values returned from Vault are
 	// serialized as JSON.
-	Data map[string]interface{} `pulumi:"data"`
+	Data map[string]string `pulumi:"data"`
 	// A string containing the full data payload retrieved from
 	// Vault, serialized in JSON format.
 	DataJson string `pulumi:"dataJson"`
@@ -193,8 +193,8 @@ func (o LookupSecretResultOutput) ToLookupSecretResultOutputWithContext(ctx cont
 // Vault and whose values are the corresponding values. This map can only
 // represent string data, so any non-string values returned from Vault are
 // serialized as JSON.
-func (o LookupSecretResultOutput) Data() pulumi.MapOutput {
-	return o.ApplyT(func(v LookupSecretResult) map[string]interface{} { return v.Data }).(pulumi.MapOutput)
+func (o LookupSecretResultOutput) Data() pulumi.StringMapOutput {
+	return o.ApplyT(func(v LookupSecretResult) map[string]string { return v.Data }).(pulumi.StringMapOutput)
 }
 
 // A string containing the full data payload retrieved from
diff --git a/sdk/go/vault/generic/secret.go b/sdk/go/vault/generic/secret.go
index fe6cc3bb3..1080c29fe 100644
--- a/sdk/go/vault/generic/secret.go
+++ b/sdk/go/vault/generic/secret.go
@@ -26,7 +26,7 @@ type Secret struct {
 	// Vault and whose values are the corresponding values. This map can only
 	// represent string data, so any non-string values returned from Vault are
 	// serialized as JSON.
-	Data pulumi.MapOutput `pulumi:"data"`
+	Data pulumi.StringMapOutput `pulumi:"data"`
 	// String containing a JSON-encoded object that will be
 	// written as the secret data at the given path.
 	DataJson pulumi.StringOutput `pulumi:"dataJson"`
@@ -100,7 +100,7 @@ type secretState struct {
 	// Vault and whose values are the corresponding values. This map can only
 	// represent string data, so any non-string values returned from Vault are
 	// serialized as JSON.
-	Data map[string]interface{} `pulumi:"data"`
+	Data map[string]string `pulumi:"data"`
 	// String containing a JSON-encoded object that will be
 	// written as the secret data at the given path.
 	DataJson *string `pulumi:"dataJson"`
@@ -131,7 +131,7 @@ type SecretState struct {
 	// Vault and whose values are the corresponding values. This map can only
 	// represent string data, so any non-string values returned from Vault are
 	// serialized as JSON.
-	Data pulumi.MapInput
+	Data pulumi.StringMapInput
 	// String containing a JSON-encoded object that will be
 	// written as the secret data at the given path.
 	DataJson pulumi.StringPtrInput
@@ -305,8 +305,8 @@ func (o SecretOutput) ToSecretOutputWithContext(ctx context.Context) SecretOutpu
 // Vault and whose values are the corresponding values. This map can only
 // represent string data, so any non-string values returned from Vault are
 // serialized as JSON.
-func (o SecretOutput) Data() pulumi.MapOutput {
-	return o.ApplyT(func(v *Secret) pulumi.MapOutput { return v.Data }).(pulumi.MapOutput)
+func (o SecretOutput) Data() pulumi.StringMapOutput {
+	return o.ApplyT(func(v *Secret) pulumi.StringMapOutput { return v.Data }).(pulumi.StringMapOutput)
 }
 
 // String containing a JSON-encoded object that will be
diff --git a/sdk/go/vault/getNamespace.go b/sdk/go/vault/getNamespace.go
index 0d2ed3945..49da3620f 100644
--- a/sdk/go/vault/getNamespace.go
+++ b/sdk/go/vault/getNamespace.go
@@ -120,7 +120,7 @@ type LookupNamespaceResult struct {
 	// (Optional) A map of strings containing arbitrary metadata for the namespace.
 	// Only fetched if `path` is specified.
 	// *Requires Vault 1.12+.*
-	CustomMetadata map[string]interface{} `pulumi:"customMetadata"`
+	CustomMetadata map[string]string `pulumi:"customMetadata"`
 	// The provider-assigned unique ID for this managed resource.
 	Id        string  `pulumi:"id"`
 	Namespace *string `pulumi:"namespace"`
@@ -181,8 +181,8 @@ func (o LookupNamespaceResultOutput) ToLookupNamespaceResultOutputWithContext(ct
 // (Optional) A map of strings containing arbitrary metadata for the namespace.
 // Only fetched if `path` is specified.
 // *Requires Vault 1.12+.*
-func (o LookupNamespaceResultOutput) CustomMetadata() pulumi.MapOutput {
-	return o.ApplyT(func(v LookupNamespaceResult) map[string]interface{} { return v.CustomMetadata }).(pulumi.MapOutput)
+func (o LookupNamespaceResultOutput) CustomMetadata() pulumi.StringMapOutput {
+	return o.ApplyT(func(v LookupNamespaceResult) map[string]string { return v.CustomMetadata }).(pulumi.StringMapOutput)
 }
 
 // The provider-assigned unique ID for this managed resource.
diff --git a/sdk/go/vault/getRaftAutopilotState.go b/sdk/go/vault/getRaftAutopilotState.go
index 5aa71ec22..1ebc80630 100644
--- a/sdk/go/vault/getRaftAutopilotState.go
+++ b/sdk/go/vault/getRaftAutopilotState.go
@@ -68,15 +68,15 @@ type GetRaftAutopilotStateResult struct {
 	// The cluster-level optimistic failure tolerance.
 	OptimisticFailureTolerance int `pulumi:"optimisticFailureTolerance"`
 	// Additional output related to redundancy zones stored as a serialized map of strings.
-	RedundancyZones map[string]interface{} `pulumi:"redundancyZones"`
+	RedundancyZones map[string]string `pulumi:"redundancyZones"`
 	// Additional output related to redundancy zones.
 	RedundancyZonesJson string `pulumi:"redundancyZonesJson"`
 	// Additionaly output related to servers in the cluster stored as a serialized map of strings.
-	Servers map[string]interface{} `pulumi:"servers"`
+	Servers map[string]string `pulumi:"servers"`
 	// Additionaly output related to servers in the cluster.
 	ServersJson string `pulumi:"serversJson"`
 	// Additional output related to upgrade information stored as a serialized map of strings.
-	UpgradeInfo map[string]interface{} `pulumi:"upgradeInfo"`
+	UpgradeInfo map[string]string `pulumi:"upgradeInfo"`
 	// Additional output related to upgrade information.
 	UpgradeInfoJson string `pulumi:"upgradeInfoJson"`
 	// The voters in the Vault cluster.
@@ -154,8 +154,8 @@ func (o GetRaftAutopilotStateResultOutput) OptimisticFailureTolerance() pulumi.I
 }
 
 // Additional output related to redundancy zones stored as a serialized map of strings.
-func (o GetRaftAutopilotStateResultOutput) RedundancyZones() pulumi.MapOutput {
-	return o.ApplyT(func(v GetRaftAutopilotStateResult) map[string]interface{} { return v.RedundancyZones }).(pulumi.MapOutput)
+func (o GetRaftAutopilotStateResultOutput) RedundancyZones() pulumi.StringMapOutput {
+	return o.ApplyT(func(v GetRaftAutopilotStateResult) map[string]string { return v.RedundancyZones }).(pulumi.StringMapOutput)
 }
 
 // Additional output related to redundancy zones.
@@ -164,8 +164,8 @@ func (o GetRaftAutopilotStateResultOutput) RedundancyZonesJson() pulumi.StringOu
 }
 
 // Additionaly output related to servers in the cluster stored as a serialized map of strings.
-func (o GetRaftAutopilotStateResultOutput) Servers() pulumi.MapOutput {
-	return o.ApplyT(func(v GetRaftAutopilotStateResult) map[string]interface{} { return v.Servers }).(pulumi.MapOutput)
+func (o GetRaftAutopilotStateResultOutput) Servers() pulumi.StringMapOutput {
+	return o.ApplyT(func(v GetRaftAutopilotStateResult) map[string]string { return v.Servers }).(pulumi.StringMapOutput)
 }
 
 // Additionaly output related to servers in the cluster.
@@ -174,8 +174,8 @@ func (o GetRaftAutopilotStateResultOutput) ServersJson() pulumi.StringOutput {
 }
 
 // Additional output related to upgrade information stored as a serialized map of strings.
-func (o GetRaftAutopilotStateResultOutput) UpgradeInfo() pulumi.MapOutput {
-	return o.ApplyT(func(v GetRaftAutopilotStateResult) map[string]interface{} { return v.UpgradeInfo }).(pulumi.MapOutput)
+func (o GetRaftAutopilotStateResultOutput) UpgradeInfo() pulumi.StringMapOutput {
+	return o.ApplyT(func(v GetRaftAutopilotStateResult) map[string]string { return v.UpgradeInfo }).(pulumi.StringMapOutput)
 }
 
 // Additional output related to upgrade information.
diff --git a/sdk/go/vault/identity/getEntity.go b/sdk/go/vault/identity/getEntity.go
index 501ceb76c..a548148bc 100644
--- a/sdk/go/vault/identity/getEntity.go
+++ b/sdk/go/vault/identity/getEntity.go
@@ -103,8 +103,8 @@ type LookupEntityResult struct {
 	// Other entity IDs which is merged with this entity
 	MergedEntityIds []string `pulumi:"mergedEntityIds"`
 	// Arbitrary metadata
-	Metadata  map[string]interface{} `pulumi:"metadata"`
-	Namespace *string                `pulumi:"namespace"`
+	Metadata  map[string]string `pulumi:"metadata"`
+	Namespace *string           `pulumi:"namespace"`
 	// Namespace of which the entity is part of
 	NamespaceId string `pulumi:"namespaceId"`
 	// List of policies attached to the entity
@@ -239,8 +239,8 @@ func (o LookupEntityResultOutput) MergedEntityIds() pulumi.StringArrayOutput {
 }
 
 // Arbitrary metadata
-func (o LookupEntityResultOutput) Metadata() pulumi.MapOutput {
-	return o.ApplyT(func(v LookupEntityResult) map[string]interface{} { return v.Metadata }).(pulumi.MapOutput)
+func (o LookupEntityResultOutput) Metadata() pulumi.StringMapOutput {
+	return o.ApplyT(func(v LookupEntityResult) map[string]string { return v.Metadata }).(pulumi.StringMapOutput)
 }
 
 func (o LookupEntityResultOutput) Namespace() pulumi.StringPtrOutput {
diff --git a/sdk/go/vault/identity/getGroup.go b/sdk/go/vault/identity/getGroup.go
index 44b297aec..4f3a3f2d2 100644
--- a/sdk/go/vault/identity/getGroup.go
+++ b/sdk/go/vault/identity/getGroup.go
@@ -86,8 +86,8 @@ type LookupGroupResult struct {
 	// List of canonical IDs merged with this alias
 	AliasMergedFromCanonicalIds []string `pulumi:"aliasMergedFromCanonicalIds"`
 	// Arbitrary metadata
-	AliasMetadata      map[string]interface{} `pulumi:"aliasMetadata"`
-	AliasMountAccessor string                 `pulumi:"aliasMountAccessor"`
+	AliasMetadata      map[string]string `pulumi:"aliasMetadata"`
+	AliasMountAccessor string            `pulumi:"aliasMountAccessor"`
 	// Authentication mount path which this alias belongs to
 	AliasMountPath string `pulumi:"aliasMountPath"`
 	// Authentication mount type which this alias belongs to
@@ -109,7 +109,7 @@ type LookupGroupResult struct {
 	// List of Group IDs which are members of this group
 	MemberGroupIds []string `pulumi:"memberGroupIds"`
 	// Arbitrary metadata
-	Metadata map[string]interface{} `pulumi:"metadata"`
+	Metadata map[string]string `pulumi:"metadata"`
 	// Modify index of the group
 	ModifyIndex int     `pulumi:"modifyIndex"`
 	Namespace   *string `pulumi:"namespace"`
@@ -204,8 +204,8 @@ func (o LookupGroupResultOutput) AliasMergedFromCanonicalIds() pulumi.StringArra
 }
 
 // Arbitrary metadata
-func (o LookupGroupResultOutput) AliasMetadata() pulumi.MapOutput {
-	return o.ApplyT(func(v LookupGroupResult) map[string]interface{} { return v.AliasMetadata }).(pulumi.MapOutput)
+func (o LookupGroupResultOutput) AliasMetadata() pulumi.StringMapOutput {
+	return o.ApplyT(func(v LookupGroupResult) map[string]string { return v.AliasMetadata }).(pulumi.StringMapOutput)
 }
 
 func (o LookupGroupResultOutput) AliasMountAccessor() pulumi.StringOutput {
@@ -266,8 +266,8 @@ func (o LookupGroupResultOutput) MemberGroupIds() pulumi.StringArrayOutput {
 }
 
 // Arbitrary metadata
-func (o LookupGroupResultOutput) Metadata() pulumi.MapOutput {
-	return o.ApplyT(func(v LookupGroupResult) map[string]interface{} { return v.Metadata }).(pulumi.MapOutput)
+func (o LookupGroupResultOutput) Metadata() pulumi.StringMapOutput {
+	return o.ApplyT(func(v LookupGroupResult) map[string]string { return v.Metadata }).(pulumi.StringMapOutput)
 }
 
 // Modify index of the group
diff --git a/sdk/go/vault/identity/getOidcPublicKeys.go b/sdk/go/vault/identity/getOidcPublicKeys.go
index b509ede8d..010de707c 100644
--- a/sdk/go/vault/identity/getOidcPublicKeys.go
+++ b/sdk/go/vault/identity/getOidcPublicKeys.go
@@ -94,9 +94,9 @@ type GetOidcPublicKeysResult struct {
 	Id string `pulumi:"id"`
 	// The public portion of keys for an OIDC provider.
 	// Clients can use them to validate the authenticity of an identity token.
-	Keys      []map[string]interface{} `pulumi:"keys"`
-	Name      string                   `pulumi:"name"`
-	Namespace *string                  `pulumi:"namespace"`
+	Keys      []map[string]string `pulumi:"keys"`
+	Name      string              `pulumi:"name"`
+	Namespace *string             `pulumi:"namespace"`
 }
 
 func GetOidcPublicKeysOutput(ctx *pulumi.Context, args GetOidcPublicKeysOutputArgs, opts ...pulumi.InvokeOption) GetOidcPublicKeysResultOutput {
@@ -149,8 +149,8 @@ func (o GetOidcPublicKeysResultOutput) Id() pulumi.StringOutput {
 
 // The public portion of keys for an OIDC provider.
 // Clients can use them to validate the authenticity of an identity token.
-func (o GetOidcPublicKeysResultOutput) Keys() pulumi.MapArrayOutput {
-	return o.ApplyT(func(v GetOidcPublicKeysResult) []map[string]interface{} { return v.Keys }).(pulumi.MapArrayOutput)
+func (o GetOidcPublicKeysResultOutput) Keys() pulumi.StringMapArrayOutput {
+	return o.ApplyT(func(v GetOidcPublicKeysResult) []map[string]string { return v.Keys }).(pulumi.StringMapArrayOutput)
 }
 
 func (o GetOidcPublicKeysResultOutput) Name() pulumi.StringOutput {
diff --git a/sdk/go/vault/identity/pulumiTypes.go b/sdk/go/vault/identity/pulumiTypes.go
index c25efd68a..ff9d826b1 100644
--- a/sdk/go/vault/identity/pulumiTypes.go
+++ b/sdk/go/vault/identity/pulumiTypes.go
@@ -25,7 +25,7 @@ type GetEntityAliasType struct {
 	// List of canonical IDs merged with this alias
 	MergedFromCanonicalIds []string `pulumi:"mergedFromCanonicalIds"`
 	// Arbitrary metadata
-	Metadata map[string]interface{} `pulumi:"metadata"`
+	Metadata map[string]string `pulumi:"metadata"`
 	// Authentication mount acccessor which this alias belongs to
 	MountAccessor string `pulumi:"mountAccessor"`
 	// Authentication mount path which this alias belongs to
@@ -59,7 +59,7 @@ type GetEntityAliasTypeArgs struct {
 	// List of canonical IDs merged with this alias
 	MergedFromCanonicalIds pulumi.StringArrayInput `pulumi:"mergedFromCanonicalIds"`
 	// Arbitrary metadata
-	Metadata pulumi.MapInput `pulumi:"metadata"`
+	Metadata pulumi.StringMapInput `pulumi:"metadata"`
 	// Authentication mount acccessor which this alias belongs to
 	MountAccessor pulumi.StringInput `pulumi:"mountAccessor"`
 	// Authentication mount path which this alias belongs to
@@ -147,8 +147,8 @@ func (o GetEntityAliasTypeOutput) MergedFromCanonicalIds() pulumi.StringArrayOut
 }
 
 // Arbitrary metadata
-func (o GetEntityAliasTypeOutput) Metadata() pulumi.MapOutput {
-	return o.ApplyT(func(v GetEntityAliasType) map[string]interface{} { return v.Metadata }).(pulumi.MapOutput)
+func (o GetEntityAliasTypeOutput) Metadata() pulumi.StringMapOutput {
+	return o.ApplyT(func(v GetEntityAliasType) map[string]string { return v.Metadata }).(pulumi.StringMapOutput)
 }
 
 // Authentication mount acccessor which this alias belongs to
diff --git a/sdk/go/vault/jwt/authBackendRole.go b/sdk/go/vault/jwt/authBackendRole.go
index b9063ebc1..66983a29b 100644
--- a/sdk/go/vault/jwt/authBackendRole.go
+++ b/sdk/go/vault/jwt/authBackendRole.go
@@ -49,8 +49,8 @@ import (
 //				BoundAudiences: pulumi.StringArray{
 //					pulumi.String("https://myco.test"),
 //				},
-//				BoundClaims: pulumi.Map{
-//					"color": pulumi.Any("red,green,blue"),
+//				BoundClaims: pulumi.StringMap{
+//					"color": pulumi.String("red,green,blue"),
 //				},
 //				UserClaim: pulumi.String("https://vault/user"),
 //				RoleType:  pulumi.String("jwt"),
@@ -130,7 +130,7 @@ type AuthBackendRole struct {
 	// If set, a map of claims to values to match against.
 	// A claim's value must be a string, which may contain one value or multiple
 	// comma-separated values, e.g. `"red"` or `"red,green,blue"`.
-	BoundClaims pulumi.MapOutput `pulumi:"boundClaims"`
+	BoundClaims pulumi.StringMapOutput `pulumi:"boundClaims"`
 	// How to interpret values in the claims/values
 	// map (`boundClaims`): can be either `string` (exact match) or `glob` (wildcard
 	// match). Requires Vault 1.4.0 or above.
@@ -140,7 +140,7 @@ type AuthBackendRole struct {
 	BoundSubject pulumi.StringPtrOutput `pulumi:"boundSubject"`
 	// If set, a map of claims (keys) to be copied
 	// to specified metadata fields (values).
-	ClaimMappings pulumi.MapOutput `pulumi:"claimMappings"`
+	ClaimMappings pulumi.StringMapOutput `pulumi:"claimMappings"`
 	// The amount of leeway to add to all claims to account for clock skew, in
 	// seconds. Defaults to `60` seconds if set to `0` and can be disabled if set to `-1`.
 	// Only applicable with "jwt" roles.
@@ -256,7 +256,7 @@ type authBackendRoleState struct {
 	// If set, a map of claims to values to match against.
 	// A claim's value must be a string, which may contain one value or multiple
 	// comma-separated values, e.g. `"red"` or `"red,green,blue"`.
-	BoundClaims map[string]interface{} `pulumi:"boundClaims"`
+	BoundClaims map[string]string `pulumi:"boundClaims"`
 	// How to interpret values in the claims/values
 	// map (`boundClaims`): can be either `string` (exact match) or `glob` (wildcard
 	// match). Requires Vault 1.4.0 or above.
@@ -266,7 +266,7 @@ type authBackendRoleState struct {
 	BoundSubject *string `pulumi:"boundSubject"`
 	// If set, a map of claims (keys) to be copied
 	// to specified metadata fields (values).
-	ClaimMappings map[string]interface{} `pulumi:"claimMappings"`
+	ClaimMappings map[string]string `pulumi:"claimMappings"`
 	// The amount of leeway to add to all claims to account for clock skew, in
 	// seconds. Defaults to `60` seconds if set to `0` and can be disabled if set to `-1`.
 	// Only applicable with "jwt" roles.
@@ -347,7 +347,7 @@ type AuthBackendRoleState struct {
 	// If set, a map of claims to values to match against.
 	// A claim's value must be a string, which may contain one value or multiple
 	// comma-separated values, e.g. `"red"` or `"red,green,blue"`.
-	BoundClaims pulumi.MapInput
+	BoundClaims pulumi.StringMapInput
 	// How to interpret values in the claims/values
 	// map (`boundClaims`): can be either `string` (exact match) or `glob` (wildcard
 	// match). Requires Vault 1.4.0 or above.
@@ -357,7 +357,7 @@ type AuthBackendRoleState struct {
 	BoundSubject pulumi.StringPtrInput
 	// If set, a map of claims (keys) to be copied
 	// to specified metadata fields (values).
-	ClaimMappings pulumi.MapInput
+	ClaimMappings pulumi.StringMapInput
 	// The amount of leeway to add to all claims to account for clock skew, in
 	// seconds. Defaults to `60` seconds if set to `0` and can be disabled if set to `-1`.
 	// Only applicable with "jwt" roles.
@@ -442,7 +442,7 @@ type authBackendRoleArgs struct {
 	// If set, a map of claims to values to match against.
 	// A claim's value must be a string, which may contain one value or multiple
 	// comma-separated values, e.g. `"red"` or `"red,green,blue"`.
-	BoundClaims map[string]interface{} `pulumi:"boundClaims"`
+	BoundClaims map[string]string `pulumi:"boundClaims"`
 	// How to interpret values in the claims/values
 	// map (`boundClaims`): can be either `string` (exact match) or `glob` (wildcard
 	// match). Requires Vault 1.4.0 or above.
@@ -452,7 +452,7 @@ type authBackendRoleArgs struct {
 	BoundSubject *string `pulumi:"boundSubject"`
 	// If set, a map of claims (keys) to be copied
 	// to specified metadata fields (values).
-	ClaimMappings map[string]interface{} `pulumi:"claimMappings"`
+	ClaimMappings map[string]string `pulumi:"claimMappings"`
 	// The amount of leeway to add to all claims to account for clock skew, in
 	// seconds. Defaults to `60` seconds if set to `0` and can be disabled if set to `-1`.
 	// Only applicable with "jwt" roles.
@@ -534,7 +534,7 @@ type AuthBackendRoleArgs struct {
 	// If set, a map of claims to values to match against.
 	// A claim's value must be a string, which may contain one value or multiple
 	// comma-separated values, e.g. `"red"` or `"red,green,blue"`.
-	BoundClaims pulumi.MapInput
+	BoundClaims pulumi.StringMapInput
 	// How to interpret values in the claims/values
 	// map (`boundClaims`): can be either `string` (exact match) or `glob` (wildcard
 	// match). Requires Vault 1.4.0 or above.
@@ -544,7 +544,7 @@ type AuthBackendRoleArgs struct {
 	BoundSubject pulumi.StringPtrInput
 	// If set, a map of claims (keys) to be copied
 	// to specified metadata fields (values).
-	ClaimMappings pulumi.MapInput
+	ClaimMappings pulumi.StringMapInput
 	// The amount of leeway to add to all claims to account for clock skew, in
 	// seconds. Defaults to `60` seconds if set to `0` and can be disabled if set to `-1`.
 	// Only applicable with "jwt" roles.
@@ -720,8 +720,8 @@ func (o AuthBackendRoleOutput) BoundAudiences() pulumi.StringArrayOutput {
 // If set, a map of claims to values to match against.
 // A claim's value must be a string, which may contain one value or multiple
 // comma-separated values, e.g. `"red"` or `"red,green,blue"`.
-func (o AuthBackendRoleOutput) BoundClaims() pulumi.MapOutput {
-	return o.ApplyT(func(v *AuthBackendRole) pulumi.MapOutput { return v.BoundClaims }).(pulumi.MapOutput)
+func (o AuthBackendRoleOutput) BoundClaims() pulumi.StringMapOutput {
+	return o.ApplyT(func(v *AuthBackendRole) pulumi.StringMapOutput { return v.BoundClaims }).(pulumi.StringMapOutput)
 }
 
 // How to interpret values in the claims/values
@@ -739,8 +739,8 @@ func (o AuthBackendRoleOutput) BoundSubject() pulumi.StringPtrOutput {
 
 // If set, a map of claims (keys) to be copied
 // to specified metadata fields (values).
-func (o AuthBackendRoleOutput) ClaimMappings() pulumi.MapOutput {
-	return o.ApplyT(func(v *AuthBackendRole) pulumi.MapOutput { return v.ClaimMappings }).(pulumi.MapOutput)
+func (o AuthBackendRoleOutput) ClaimMappings() pulumi.StringMapOutput {
+	return o.ApplyT(func(v *AuthBackendRole) pulumi.StringMapOutput { return v.ClaimMappings }).(pulumi.StringMapOutput)
 }
 
 // The amount of leeway to add to all claims to account for clock skew, in
diff --git a/sdk/go/vault/kubernetes/secretBackend.go b/sdk/go/vault/kubernetes/secretBackend.go
index 552b74c07..e601c41ea 100644
--- a/sdk/go/vault/kubernetes/secretBackend.go
+++ b/sdk/go/vault/kubernetes/secretBackend.go
@@ -112,7 +112,7 @@ type SecretBackend struct {
 	// *Available only for Vault Enterprise*.
 	Namespace pulumi.StringPtrOutput `pulumi:"namespace"`
 	// Specifies mount type specific options that are passed to the backend
-	Options pulumi.MapOutput `pulumi:"options"`
+	Options pulumi.StringMapOutput `pulumi:"options"`
 	// List of headers to allow and pass from the request to the plugin
 	PassthroughRequestHeaders pulumi.StringArrayOutput `pulumi:"passthroughRequestHeaders"`
 	// Where the secret backend will be mounted
@@ -211,7 +211,7 @@ type secretBackendState struct {
 	// *Available only for Vault Enterprise*.
 	Namespace *string `pulumi:"namespace"`
 	// Specifies mount type specific options that are passed to the backend
-	Options map[string]interface{} `pulumi:"options"`
+	Options map[string]string `pulumi:"options"`
 	// List of headers to allow and pass from the request to the plugin
 	PassthroughRequestHeaders []string `pulumi:"passthroughRequestHeaders"`
 	// Where the secret backend will be mounted
@@ -271,7 +271,7 @@ type SecretBackendState struct {
 	// *Available only for Vault Enterprise*.
 	Namespace pulumi.StringPtrInput
 	// Specifies mount type specific options that are passed to the backend
-	Options pulumi.MapInput
+	Options pulumi.StringMapInput
 	// List of headers to allow and pass from the request to the plugin
 	PassthroughRequestHeaders pulumi.StringArrayInput
 	// Where the secret backend will be mounted
@@ -333,7 +333,7 @@ type secretBackendArgs struct {
 	// *Available only for Vault Enterprise*.
 	Namespace *string `pulumi:"namespace"`
 	// Specifies mount type specific options that are passed to the backend
-	Options map[string]interface{} `pulumi:"options"`
+	Options map[string]string `pulumi:"options"`
 	// List of headers to allow and pass from the request to the plugin
 	PassthroughRequestHeaders []string `pulumi:"passthroughRequestHeaders"`
 	// Where the secret backend will be mounted
@@ -392,7 +392,7 @@ type SecretBackendArgs struct {
 	// *Available only for Vault Enterprise*.
 	Namespace pulumi.StringPtrInput
 	// Specifies mount type specific options that are passed to the backend
-	Options pulumi.MapInput
+	Options pulumi.StringMapInput
 	// List of headers to allow and pass from the request to the plugin
 	PassthroughRequestHeaders pulumi.StringArrayInput
 	// Where the secret backend will be mounted
@@ -589,8 +589,8 @@ func (o SecretBackendOutput) Namespace() pulumi.StringPtrOutput {
 }
 
 // Specifies mount type specific options that are passed to the backend
-func (o SecretBackendOutput) Options() pulumi.MapOutput {
-	return o.ApplyT(func(v *SecretBackend) pulumi.MapOutput { return v.Options }).(pulumi.MapOutput)
+func (o SecretBackendOutput) Options() pulumi.StringMapOutput {
+	return o.ApplyT(func(v *SecretBackend) pulumi.StringMapOutput { return v.Options }).(pulumi.StringMapOutput)
 }
 
 // List of headers to allow and pass from the request to the plugin
diff --git a/sdk/go/vault/kv/getSecret.go b/sdk/go/vault/kv/getSecret.go
index 8caa9c89b..218e15259 100644
--- a/sdk/go/vault/kv/getSecret.go
+++ b/sdk/go/vault/kv/getSecret.go
@@ -32,8 +32,8 @@ import (
 //			kvv1, err := vault.NewMount(ctx, "kvv1", &vault.MountArgs{
 //				Path: pulumi.String("kvv1"),
 //				Type: pulumi.String("kv"),
-//				Options: pulumi.Map{
-//					"version": pulumi.Any("1"),
+//				Options: pulumi.StringMap{
+//					"version": pulumi.String("1"),
 //				},
 //				Description: pulumi.String("KV Version 1 secret engine mount"),
 //			})
@@ -96,7 +96,7 @@ type LookupSecretResult struct {
 	// Vault and whose values are the corresponding values. This map can only
 	// represent string data, so any non-string values returned from Vault are
 	// serialized as JSON.
-	Data map[string]interface{} `pulumi:"data"`
+	Data map[string]string `pulumi:"data"`
 	// JSON-encoded string that that is
 	// read as the secret data at the given path.
 	DataJson string `pulumi:"dataJson"`
@@ -161,8 +161,8 @@ func (o LookupSecretResultOutput) ToLookupSecretResultOutputWithContext(ctx cont
 // Vault and whose values are the corresponding values. This map can only
 // represent string data, so any non-string values returned from Vault are
 // serialized as JSON.
-func (o LookupSecretResultOutput) Data() pulumi.MapOutput {
-	return o.ApplyT(func(v LookupSecretResult) map[string]interface{} { return v.Data }).(pulumi.MapOutput)
+func (o LookupSecretResultOutput) Data() pulumi.StringMapOutput {
+	return o.ApplyT(func(v LookupSecretResult) map[string]string { return v.Data }).(pulumi.StringMapOutput)
 }
 
 // JSON-encoded string that that is
diff --git a/sdk/go/vault/kv/getSecretSubkeysV2.go b/sdk/go/vault/kv/getSecretSubkeysV2.go
index a97403683..b49c7f580 100644
--- a/sdk/go/vault/kv/getSecretSubkeysV2.go
+++ b/sdk/go/vault/kv/getSecretSubkeysV2.go
@@ -31,8 +31,8 @@ import (
 //			kvv2, err := vault.NewMount(ctx, "kvv2", &vault.MountArgs{
 //				Path: pulumi.String("kvv2"),
 //				Type: pulumi.String("kv"),
-//				Options: pulumi.Map{
-//					"version": pulumi.Any("2"),
+//				Options: pulumi.StringMap{
+//					"version": pulumi.String("2"),
 //				},
 //				Description: pulumi.String("KV Version 2 secret engine mount"),
 //			})
@@ -105,7 +105,7 @@ type GetSecretSubkeysV2Args struct {
 // A collection of values returned by getSecretSubkeysV2.
 type GetSecretSubkeysV2Result struct {
 	// Subkeys for the KV-V2 secret stored as a serialized map of strings.
-	Data map[string]interface{} `pulumi:"data"`
+	Data map[string]string `pulumi:"data"`
 	// Subkeys for the KV-V2 secret read from Vault.
 	DataJson string `pulumi:"dataJson"`
 	Depth    *int   `pulumi:"depth"`
@@ -176,8 +176,8 @@ func (o GetSecretSubkeysV2ResultOutput) ToGetSecretSubkeysV2ResultOutputWithCont
 }
 
 // Subkeys for the KV-V2 secret stored as a serialized map of strings.
-func (o GetSecretSubkeysV2ResultOutput) Data() pulumi.MapOutput {
-	return o.ApplyT(func(v GetSecretSubkeysV2Result) map[string]interface{} { return v.Data }).(pulumi.MapOutput)
+func (o GetSecretSubkeysV2ResultOutput) Data() pulumi.StringMapOutput {
+	return o.ApplyT(func(v GetSecretSubkeysV2Result) map[string]string { return v.Data }).(pulumi.StringMapOutput)
 }
 
 // Subkeys for the KV-V2 secret read from Vault.
diff --git a/sdk/go/vault/kv/getSecretV2.go b/sdk/go/vault/kv/getSecretV2.go
index 0a8835c95..2892c5aba 100644
--- a/sdk/go/vault/kv/getSecretV2.go
+++ b/sdk/go/vault/kv/getSecretV2.go
@@ -31,8 +31,8 @@ import (
 //			kvv2, err := vault.NewMount(ctx, "kvv2", &vault.MountArgs{
 //				Path: pulumi.String("kvv2"),
 //				Type: pulumi.String("kv"),
-//				Options: pulumi.Map{
-//					"version": pulumi.Any("2"),
+//				Options: pulumi.StringMap{
+//					"version": pulumi.String("2"),
 //				},
 //				Description: pulumi.String("KV Version 2 secret engine mount"),
 //			})
@@ -103,12 +103,12 @@ type LookupSecretV2Result struct {
 	// Time at which secret was created.
 	CreatedTime string `pulumi:"createdTime"`
 	// Custom metadata for the secret.
-	CustomMetadata map[string]interface{} `pulumi:"customMetadata"`
+	CustomMetadata map[string]string `pulumi:"customMetadata"`
 	// A mapping whose keys are the top-level data keys returned from
 	// Vault and whose values are the corresponding values. This map can only
 	// represent string data, so any non-string values returned from Vault are
 	// serialized as JSON.
-	Data map[string]interface{} `pulumi:"data"`
+	Data map[string]string `pulumi:"data"`
 	// JSON-encoded string that that is
 	// read as the secret data at the given path.
 	DataJson string `pulumi:"dataJson"`
@@ -183,16 +183,16 @@ func (o LookupSecretV2ResultOutput) CreatedTime() pulumi.StringOutput {
 }
 
 // Custom metadata for the secret.
-func (o LookupSecretV2ResultOutput) CustomMetadata() pulumi.MapOutput {
-	return o.ApplyT(func(v LookupSecretV2Result) map[string]interface{} { return v.CustomMetadata }).(pulumi.MapOutput)
+func (o LookupSecretV2ResultOutput) CustomMetadata() pulumi.StringMapOutput {
+	return o.ApplyT(func(v LookupSecretV2Result) map[string]string { return v.CustomMetadata }).(pulumi.StringMapOutput)
 }
 
 // A mapping whose keys are the top-level data keys returned from
 // Vault and whose values are the corresponding values. This map can only
 // represent string data, so any non-string values returned from Vault are
 // serialized as JSON.
-func (o LookupSecretV2ResultOutput) Data() pulumi.MapOutput {
-	return o.ApplyT(func(v LookupSecretV2Result) map[string]interface{} { return v.Data }).(pulumi.MapOutput)
+func (o LookupSecretV2ResultOutput) Data() pulumi.StringMapOutput {
+	return o.ApplyT(func(v LookupSecretV2Result) map[string]string { return v.Data }).(pulumi.StringMapOutput)
 }
 
 // JSON-encoded string that that is
diff --git a/sdk/go/vault/kv/getSecretsList.go b/sdk/go/vault/kv/getSecretsList.go
index 92d33961e..c3e9e9f67 100644
--- a/sdk/go/vault/kv/getSecretsList.go
+++ b/sdk/go/vault/kv/getSecretsList.go
@@ -32,8 +32,8 @@ import (
 //			kvv1, err := vault.NewMount(ctx, "kvv1", &vault.MountArgs{
 //				Path: pulumi.String("kvv1"),
 //				Type: pulumi.String("kv"),
-//				Options: pulumi.Map{
-//					"version": pulumi.Any("1"),
+//				Options: pulumi.StringMap{
+//					"version": pulumi.String("1"),
 //				},
 //				Description: pulumi.String("KV Version 1 secret engine mount"),
 //			})
diff --git a/sdk/go/vault/kv/getSecretsListV2.go b/sdk/go/vault/kv/getSecretsListV2.go
index 9da1e3e9c..528c16676 100644
--- a/sdk/go/vault/kv/getSecretsListV2.go
+++ b/sdk/go/vault/kv/getSecretsListV2.go
@@ -32,8 +32,8 @@ import (
 //			kvv2, err := vault.NewMount(ctx, "kvv2", &vault.MountArgs{
 //				Path: pulumi.String("kvv2"),
 //				Type: pulumi.String("kv"),
-//				Options: pulumi.Map{
-//					"version": pulumi.Any("2"),
+//				Options: pulumi.StringMap{
+//					"version": pulumi.String("2"),
 //				},
 //				Description: pulumi.String("KV Version 2 secret engine mount"),
 //			})
diff --git a/sdk/go/vault/kv/pulumiTypes.go b/sdk/go/vault/kv/pulumiTypes.go
index c95aa512f..42c5deb65 100644
--- a/sdk/go/vault/kv/pulumiTypes.go
+++ b/sdk/go/vault/kv/pulumiTypes.go
@@ -20,7 +20,7 @@ type SecretV2CustomMetadata struct {
 	// Vault and whose values are the corresponding values. This map can only
 	// represent string data, so any non-string values returned from Vault are
 	// serialized as JSON.
-	Data map[string]interface{} `pulumi:"data"`
+	Data map[string]string `pulumi:"data"`
 	// If set, specifies the length of time before a version is deleted.
 	DeleteVersionAfter *int `pulumi:"deleteVersionAfter"`
 	// The number of versions to keep per key.
@@ -45,7 +45,7 @@ type SecretV2CustomMetadataArgs struct {
 	// Vault and whose values are the corresponding values. This map can only
 	// represent string data, so any non-string values returned from Vault are
 	// serialized as JSON.
-	Data pulumi.MapInput `pulumi:"data"`
+	Data pulumi.StringMapInput `pulumi:"data"`
 	// If set, specifies the length of time before a version is deleted.
 	DeleteVersionAfter pulumi.IntPtrInput `pulumi:"deleteVersionAfter"`
 	// The number of versions to keep per key.
@@ -138,8 +138,8 @@ func (o SecretV2CustomMetadataOutput) CasRequired() pulumi.BoolPtrOutput {
 // Vault and whose values are the corresponding values. This map can only
 // represent string data, so any non-string values returned from Vault are
 // serialized as JSON.
-func (o SecretV2CustomMetadataOutput) Data() pulumi.MapOutput {
-	return o.ApplyT(func(v SecretV2CustomMetadata) map[string]interface{} { return v.Data }).(pulumi.MapOutput)
+func (o SecretV2CustomMetadataOutput) Data() pulumi.StringMapOutput {
+	return o.ApplyT(func(v SecretV2CustomMetadata) map[string]string { return v.Data }).(pulumi.StringMapOutput)
 }
 
 // If set, specifies the length of time before a version is deleted.
@@ -190,13 +190,13 @@ func (o SecretV2CustomMetadataPtrOutput) CasRequired() pulumi.BoolPtrOutput {
 // Vault and whose values are the corresponding values. This map can only
 // represent string data, so any non-string values returned from Vault are
 // serialized as JSON.
-func (o SecretV2CustomMetadataPtrOutput) Data() pulumi.MapOutput {
-	return o.ApplyT(func(v *SecretV2CustomMetadata) map[string]interface{} {
+func (o SecretV2CustomMetadataPtrOutput) Data() pulumi.StringMapOutput {
+	return o.ApplyT(func(v *SecretV2CustomMetadata) map[string]string {
 		if v == nil {
 			return nil
 		}
 		return v.Data
-	}).(pulumi.MapOutput)
+	}).(pulumi.StringMapOutput)
 }
 
 // If set, specifies the length of time before a version is deleted.
diff --git a/sdk/go/vault/kv/secret.go b/sdk/go/vault/kv/secret.go
index deb64bd60..581e13115 100644
--- a/sdk/go/vault/kv/secret.go
+++ b/sdk/go/vault/kv/secret.go
@@ -38,8 +38,8 @@ import (
 //			kvv1, err := vault.NewMount(ctx, "kvv1", &vault.MountArgs{
 //				Path: pulumi.String("kvv1"),
 //				Type: pulumi.String("kv"),
-//				Options: pulumi.Map{
-//					"version": pulumi.Any("1"),
+//				Options: pulumi.StringMap{
+//					"version": pulumi.String("1"),
 //				},
 //				Description: pulumi.String("KV Version 1 secret engine mount"),
 //			})
@@ -90,7 +90,7 @@ type Secret struct {
 	// Vault and whose values are the corresponding values. This map can only
 	// represent string data, so any non-string values returned from Vault are
 	// serialized as JSON.
-	Data pulumi.MapOutput `pulumi:"data"`
+	Data pulumi.StringMapOutput `pulumi:"data"`
 	// JSON-encoded string that will be
 	// written as the secret data at the given path.
 	DataJson pulumi.StringOutput `pulumi:"dataJson"`
@@ -151,7 +151,7 @@ type secretState struct {
 	// Vault and whose values are the corresponding values. This map can only
 	// represent string data, so any non-string values returned from Vault are
 	// serialized as JSON.
-	Data map[string]interface{} `pulumi:"data"`
+	Data map[string]string `pulumi:"data"`
 	// JSON-encoded string that will be
 	// written as the secret data at the given path.
 	DataJson *string `pulumi:"dataJson"`
@@ -169,7 +169,7 @@ type SecretState struct {
 	// Vault and whose values are the corresponding values. This map can only
 	// represent string data, so any non-string values returned from Vault are
 	// serialized as JSON.
-	Data pulumi.MapInput
+	Data pulumi.StringMapInput
 	// JSON-encoded string that will be
 	// written as the secret data at the given path.
 	DataJson pulumi.StringPtrInput
@@ -304,8 +304,8 @@ func (o SecretOutput) ToSecretOutputWithContext(ctx context.Context) SecretOutpu
 // Vault and whose values are the corresponding values. This map can only
 // represent string data, so any non-string values returned from Vault are
 // serialized as JSON.
-func (o SecretOutput) Data() pulumi.MapOutput {
-	return o.ApplyT(func(v *Secret) pulumi.MapOutput { return v.Data }).(pulumi.MapOutput)
+func (o SecretOutput) Data() pulumi.StringMapOutput {
+	return o.ApplyT(func(v *Secret) pulumi.StringMapOutput { return v.Data }).(pulumi.StringMapOutput)
 }
 
 // JSON-encoded string that will be
diff --git a/sdk/go/vault/kv/secretBackendV2.go b/sdk/go/vault/kv/secretBackendV2.go
index c6d976e2f..3b42c84a3 100644
--- a/sdk/go/vault/kv/secretBackendV2.go
+++ b/sdk/go/vault/kv/secretBackendV2.go
@@ -36,8 +36,8 @@ import (
 //			kvv2, err := vault.NewMount(ctx, "kvv2", &vault.MountArgs{
 //				Path: pulumi.String("kvv2"),
 //				Type: pulumi.String("kv"),
-//				Options: pulumi.Map{
-//					"version": pulumi.Any("2"),
+//				Options: pulumi.StringMap{
+//					"version": pulumi.String("2"),
 //				},
 //				Description: pulumi.String("KV Version 2 secret engine mount"),
 //			})
diff --git a/sdk/go/vault/kv/secretV2.go b/sdk/go/vault/kv/secretV2.go
index ea913b34c..6c80046c0 100644
--- a/sdk/go/vault/kv/secretV2.go
+++ b/sdk/go/vault/kv/secretV2.go
@@ -37,8 +37,8 @@ import (
 //			kvv2, err := vault.NewMount(ctx, "kvv2", &vault.MountArgs{
 //				Path: pulumi.String("kvv2"),
 //				Type: pulumi.String("kv"),
-//				Options: pulumi.Map{
-//					"version": pulumi.Any("2"),
+//				Options: pulumi.StringMap{
+//					"version": pulumi.String("2"),
 //				},
 //				Description: pulumi.String("KV Version 2 secret engine mount"),
 //			})
@@ -61,9 +61,9 @@ import (
 //				DataJson:          pulumi.String(json0),
 //				CustomMetadata: &kv.SecretV2CustomMetadataArgs{
 //					MaxVersions: pulumi.Int(5),
-//					Data: pulumi.Map{
-//						"foo": pulumi.Any("vault@example.com"),
-//						"bar": pulumi.Any("12345"),
+//					Data: pulumi.StringMap{
+//						"foo": pulumi.String("vault@example.com"),
+//						"bar": pulumi.String("12345"),
 //					},
 //				},
 //			})
@@ -118,7 +118,7 @@ type SecretV2 struct {
 	// Vault and whose values are the corresponding values. This map can only
 	// represent string data, so any non-string values returned from Vault are
 	// serialized as JSON.
-	Data pulumi.MapOutput `pulumi:"data"`
+	Data pulumi.StringMapOutput `pulumi:"data"`
 	// JSON-encoded string that will be
 	// written as the secret data at the given path.
 	DataJson pulumi.StringOutput `pulumi:"dataJson"`
@@ -129,7 +129,7 @@ type SecretV2 struct {
 	// note: drift won't be detected.
 	DisableRead pulumi.BoolPtrOutput `pulumi:"disableRead"`
 	// Metadata associated with this secret read from Vault.
-	Metadata pulumi.MapOutput `pulumi:"metadata"`
+	Metadata pulumi.StringMapOutput `pulumi:"metadata"`
 	// Path where KV-V2 engine is mounted.
 	Mount pulumi.StringOutput `pulumi:"mount"`
 	// Full name of the secret. For a nested secret
@@ -143,7 +143,7 @@ type SecretV2 struct {
 	// *Available only for Vault Enterprise*.
 	Namespace pulumi.StringPtrOutput `pulumi:"namespace"`
 	// An object that holds option settings.
-	Options pulumi.MapOutput `pulumi:"options"`
+	Options pulumi.StringMapOutput `pulumi:"options"`
 	// Full path where the KV-V2 secret will be written.
 	Path pulumi.StringOutput `pulumi:"path"`
 }
@@ -205,7 +205,7 @@ type secretV2State struct {
 	// Vault and whose values are the corresponding values. This map can only
 	// represent string data, so any non-string values returned from Vault are
 	// serialized as JSON.
-	Data map[string]interface{} `pulumi:"data"`
+	Data map[string]string `pulumi:"data"`
 	// JSON-encoded string that will be
 	// written as the secret data at the given path.
 	DataJson *string `pulumi:"dataJson"`
@@ -216,7 +216,7 @@ type secretV2State struct {
 	// note: drift won't be detected.
 	DisableRead *bool `pulumi:"disableRead"`
 	// Metadata associated with this secret read from Vault.
-	Metadata map[string]interface{} `pulumi:"metadata"`
+	Metadata map[string]string `pulumi:"metadata"`
 	// Path where KV-V2 engine is mounted.
 	Mount *string `pulumi:"mount"`
 	// Full name of the secret. For a nested secret
@@ -230,7 +230,7 @@ type secretV2State struct {
 	// *Available only for Vault Enterprise*.
 	Namespace *string `pulumi:"namespace"`
 	// An object that holds option settings.
-	Options map[string]interface{} `pulumi:"options"`
+	Options map[string]string `pulumi:"options"`
 	// Full path where the KV-V2 secret will be written.
 	Path *string `pulumi:"path"`
 }
@@ -249,7 +249,7 @@ type SecretV2State struct {
 	// Vault and whose values are the corresponding values. This map can only
 	// represent string data, so any non-string values returned from Vault are
 	// serialized as JSON.
-	Data pulumi.MapInput
+	Data pulumi.StringMapInput
 	// JSON-encoded string that will be
 	// written as the secret data at the given path.
 	DataJson pulumi.StringPtrInput
@@ -260,7 +260,7 @@ type SecretV2State struct {
 	// note: drift won't be detected.
 	DisableRead pulumi.BoolPtrInput
 	// Metadata associated with this secret read from Vault.
-	Metadata pulumi.MapInput
+	Metadata pulumi.StringMapInput
 	// Path where KV-V2 engine is mounted.
 	Mount pulumi.StringPtrInput
 	// Full name of the secret. For a nested secret
@@ -274,7 +274,7 @@ type SecretV2State struct {
 	// *Available only for Vault Enterprise*.
 	Namespace pulumi.StringPtrInput
 	// An object that holds option settings.
-	Options pulumi.MapInput
+	Options pulumi.StringMapInput
 	// Full path where the KV-V2 secret will be written.
 	Path pulumi.StringPtrInput
 }
@@ -315,7 +315,7 @@ type secretV2Args struct {
 	// *Available only for Vault Enterprise*.
 	Namespace *string `pulumi:"namespace"`
 	// An object that holds option settings.
-	Options map[string]interface{} `pulumi:"options"`
+	Options map[string]string `pulumi:"options"`
 }
 
 // The set of arguments for constructing a SecretV2 resource.
@@ -351,7 +351,7 @@ type SecretV2Args struct {
 	// *Available only for Vault Enterprise*.
 	Namespace pulumi.StringPtrInput
 	// An object that holds option settings.
-	Options pulumi.MapInput
+	Options pulumi.StringMapInput
 }
 
 func (SecretV2Args) ElementType() reflect.Type {
@@ -460,8 +460,8 @@ func (o SecretV2Output) CustomMetadata() SecretV2CustomMetadataOutput {
 // Vault and whose values are the corresponding values. This map can only
 // represent string data, so any non-string values returned from Vault are
 // serialized as JSON.
-func (o SecretV2Output) Data() pulumi.MapOutput {
-	return o.ApplyT(func(v *SecretV2) pulumi.MapOutput { return v.Data }).(pulumi.MapOutput)
+func (o SecretV2Output) Data() pulumi.StringMapOutput {
+	return o.ApplyT(func(v *SecretV2) pulumi.StringMapOutput { return v.Data }).(pulumi.StringMapOutput)
 }
 
 // JSON-encoded string that will be
@@ -483,8 +483,8 @@ func (o SecretV2Output) DisableRead() pulumi.BoolPtrOutput {
 }
 
 // Metadata associated with this secret read from Vault.
-func (o SecretV2Output) Metadata() pulumi.MapOutput {
-	return o.ApplyT(func(v *SecretV2) pulumi.MapOutput { return v.Metadata }).(pulumi.MapOutput)
+func (o SecretV2Output) Metadata() pulumi.StringMapOutput {
+	return o.ApplyT(func(v *SecretV2) pulumi.StringMapOutput { return v.Metadata }).(pulumi.StringMapOutput)
 }
 
 // Path where KV-V2 engine is mounted.
@@ -509,8 +509,8 @@ func (o SecretV2Output) Namespace() pulumi.StringPtrOutput {
 }
 
 // An object that holds option settings.
-func (o SecretV2Output) Options() pulumi.MapOutput {
-	return o.ApplyT(func(v *SecretV2) pulumi.MapOutput { return v.Options }).(pulumi.MapOutput)
+func (o SecretV2Output) Options() pulumi.StringMapOutput {
+	return o.ApplyT(func(v *SecretV2) pulumi.StringMapOutput { return v.Options }).(pulumi.StringMapOutput)
 }
 
 // Full path where the KV-V2 secret will be written.
diff --git a/sdk/go/vault/ldap/secretBackend.go b/sdk/go/vault/ldap/secretBackend.go
index ca9d210bc..670e720ab 100644
--- a/sdk/go/vault/ldap/secretBackend.go
+++ b/sdk/go/vault/ldap/secretBackend.go
@@ -105,7 +105,7 @@ type SecretBackend struct {
 	// *Available only for Vault Enterprise*.
 	Namespace pulumi.StringPtrOutput `pulumi:"namespace"`
 	// Specifies mount type specific options that are passed to the backend
-	Options pulumi.MapOutput `pulumi:"options"`
+	Options pulumi.StringMapOutput `pulumi:"options"`
 	// List of headers to allow and pass from the request to the plugin
 	PassthroughRequestHeaders pulumi.StringArrayOutput `pulumi:"passthroughRequestHeaders"`
 	// Name of the password policy to use to generate passwords.
@@ -241,7 +241,7 @@ type secretBackendState struct {
 	// *Available only for Vault Enterprise*.
 	Namespace *string `pulumi:"namespace"`
 	// Specifies mount type specific options that are passed to the backend
-	Options map[string]interface{} `pulumi:"options"`
+	Options map[string]string `pulumi:"options"`
 	// List of headers to allow and pass from the request to the plugin
 	PassthroughRequestHeaders []string `pulumi:"passthroughRequestHeaders"`
 	// Name of the password policy to use to generate passwords.
@@ -327,7 +327,7 @@ type SecretBackendState struct {
 	// *Available only for Vault Enterprise*.
 	Namespace pulumi.StringPtrInput
 	// Specifies mount type specific options that are passed to the backend
-	Options pulumi.MapInput
+	Options pulumi.StringMapInput
 	// List of headers to allow and pass from the request to the plugin
 	PassthroughRequestHeaders pulumi.StringArrayInput
 	// Name of the password policy to use to generate passwords.
@@ -415,7 +415,7 @@ type secretBackendArgs struct {
 	// *Available only for Vault Enterprise*.
 	Namespace *string `pulumi:"namespace"`
 	// Specifies mount type specific options that are passed to the backend
-	Options map[string]interface{} `pulumi:"options"`
+	Options map[string]string `pulumi:"options"`
 	// List of headers to allow and pass from the request to the plugin
 	PassthroughRequestHeaders []string `pulumi:"passthroughRequestHeaders"`
 	// Name of the password policy to use to generate passwords.
@@ -500,7 +500,7 @@ type SecretBackendArgs struct {
 	// *Available only for Vault Enterprise*.
 	Namespace pulumi.StringPtrInput
 	// Specifies mount type specific options that are passed to the backend
-	Options pulumi.MapInput
+	Options pulumi.StringMapInput
 	// List of headers to allow and pass from the request to the plugin
 	PassthroughRequestHeaders pulumi.StringArrayInput
 	// Name of the password policy to use to generate passwords.
@@ -738,8 +738,8 @@ func (o SecretBackendOutput) Namespace() pulumi.StringPtrOutput {
 }
 
 // Specifies mount type specific options that are passed to the backend
-func (o SecretBackendOutput) Options() pulumi.MapOutput {
-	return o.ApplyT(func(v *SecretBackend) pulumi.MapOutput { return v.Options }).(pulumi.MapOutput)
+func (o SecretBackendOutput) Options() pulumi.StringMapOutput {
+	return o.ApplyT(func(v *SecretBackend) pulumi.StringMapOutput { return v.Options }).(pulumi.StringMapOutput)
 }
 
 // List of headers to allow and pass from the request to the plugin
diff --git a/sdk/go/vault/mount.go b/sdk/go/vault/mount.go
index 4cf24281a..4d1d16074 100644
--- a/sdk/go/vault/mount.go
+++ b/sdk/go/vault/mount.go
@@ -57,9 +57,9 @@ import (
 //			_, err := vault.NewMount(ctx, "kvv2-example", &vault.MountArgs{
 //				Path: pulumi.String("version2-example"),
 //				Type: pulumi.String("kv-v2"),
-//				Options: pulumi.Map{
-//					"version": pulumi.Any("2"),
-//					"type":    pulumi.Any("kv-v2"),
+//				Options: pulumi.StringMap{
+//					"version": pulumi.String("2"),
+//					"type":    pulumi.String("kv-v2"),
 //				},
 //				Description: pulumi.String("This is an example KV Version 2 secret engine mount"),
 //			})
@@ -88,8 +88,8 @@ import (
 //				Path:        pulumi.String("transit-example"),
 //				Type:        pulumi.String("transit"),
 //				Description: pulumi.String("This is an example transit secret engine mount"),
-//				Options: pulumi.Map{
-//					"convergent_encryption": pulumi.Any(false),
+//				Options: pulumi.StringMap{
+//					"convergent_encryption": pulumi.String("false"),
 //				},
 //			})
 //			if err != nil {
@@ -175,7 +175,7 @@ type Mount struct {
 	// *Available only for Vault Enterprise*.
 	Namespace pulumi.StringPtrOutput `pulumi:"namespace"`
 	// Specifies mount type specific options that are passed to the backend
-	Options pulumi.MapOutput `pulumi:"options"`
+	Options pulumi.StringMapOutput `pulumi:"options"`
 	// List of headers to allow and pass from the request to
 	// the plugin.
 	PassthroughRequestHeaders pulumi.StringArrayOutput `pulumi:"passthroughRequestHeaders"`
@@ -263,7 +263,7 @@ type mountState struct {
 	// *Available only for Vault Enterprise*.
 	Namespace *string `pulumi:"namespace"`
 	// Specifies mount type specific options that are passed to the backend
-	Options map[string]interface{} `pulumi:"options"`
+	Options map[string]string `pulumi:"options"`
 	// List of headers to allow and pass from the request to
 	// the plugin.
 	PassthroughRequestHeaders []string `pulumi:"passthroughRequestHeaders"`
@@ -316,7 +316,7 @@ type MountState struct {
 	// *Available only for Vault Enterprise*.
 	Namespace pulumi.StringPtrInput
 	// Specifies mount type specific options that are passed to the backend
-	Options pulumi.MapInput
+	Options pulumi.StringMapInput
 	// List of headers to allow and pass from the request to
 	// the plugin.
 	PassthroughRequestHeaders pulumi.StringArrayInput
@@ -371,7 +371,7 @@ type mountArgs struct {
 	// *Available only for Vault Enterprise*.
 	Namespace *string `pulumi:"namespace"`
 	// Specifies mount type specific options that are passed to the backend
-	Options map[string]interface{} `pulumi:"options"`
+	Options map[string]string `pulumi:"options"`
 	// List of headers to allow and pass from the request to
 	// the plugin.
 	PassthroughRequestHeaders []string `pulumi:"passthroughRequestHeaders"`
@@ -423,7 +423,7 @@ type MountArgs struct {
 	// *Available only for Vault Enterprise*.
 	Namespace pulumi.StringPtrInput
 	// Specifies mount type specific options that are passed to the backend
-	Options pulumi.MapInput
+	Options pulumi.StringMapInput
 	// List of headers to allow and pass from the request to
 	// the plugin.
 	PassthroughRequestHeaders pulumi.StringArrayInput
@@ -604,8 +604,8 @@ func (o MountOutput) Namespace() pulumi.StringPtrOutput {
 }
 
 // Specifies mount type specific options that are passed to the backend
-func (o MountOutput) Options() pulumi.MapOutput {
-	return o.ApplyT(func(v *Mount) pulumi.MapOutput { return v.Options }).(pulumi.MapOutput)
+func (o MountOutput) Options() pulumi.StringMapOutput {
+	return o.ApplyT(func(v *Mount) pulumi.StringMapOutput { return v.Options }).(pulumi.StringMapOutput)
 }
 
 // List of headers to allow and pass from the request to
diff --git a/sdk/go/vault/namespace.go b/sdk/go/vault/namespace.go
index 83fd0493c..6dd0dc126 100644
--- a/sdk/go/vault/namespace.go
+++ b/sdk/go/vault/namespace.go
@@ -66,7 +66,7 @@ type Namespace struct {
 
 	// Custom metadata describing this namespace. Value type
 	// is `map[string]string`. Requires Vault version 1.12+.
-	CustomMetadata pulumi.MapOutput `pulumi:"customMetadata"`
+	CustomMetadata pulumi.StringMapOutput `pulumi:"customMetadata"`
 	// The namespace to provision the resource in.
 	// The value should not contain leading or trailing forward slashes.
 	// The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
@@ -116,7 +116,7 @@ func GetNamespace(ctx *pulumi.Context,
 type namespaceState struct {
 	// Custom metadata describing this namespace. Value type
 	// is `map[string]string`. Requires Vault version 1.12+.
-	CustomMetadata map[string]interface{} `pulumi:"customMetadata"`
+	CustomMetadata map[string]string `pulumi:"customMetadata"`
 	// The namespace to provision the resource in.
 	// The value should not contain leading or trailing forward slashes.
 	// The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
@@ -134,7 +134,7 @@ type namespaceState struct {
 type NamespaceState struct {
 	// Custom metadata describing this namespace. Value type
 	// is `map[string]string`. Requires Vault version 1.12+.
-	CustomMetadata pulumi.MapInput
+	CustomMetadata pulumi.StringMapInput
 	// The namespace to provision the resource in.
 	// The value should not contain leading or trailing forward slashes.
 	// The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
@@ -156,7 +156,7 @@ func (NamespaceState) ElementType() reflect.Type {
 type namespaceArgs struct {
 	// Custom metadata describing this namespace. Value type
 	// is `map[string]string`. Requires Vault version 1.12+.
-	CustomMetadata map[string]interface{} `pulumi:"customMetadata"`
+	CustomMetadata map[string]string `pulumi:"customMetadata"`
 	// The namespace to provision the resource in.
 	// The value should not contain leading or trailing forward slashes.
 	// The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
@@ -173,7 +173,7 @@ type namespaceArgs struct {
 type NamespaceArgs struct {
 	// Custom metadata describing this namespace. Value type
 	// is `map[string]string`. Requires Vault version 1.12+.
-	CustomMetadata pulumi.MapInput
+	CustomMetadata pulumi.StringMapInput
 	// The namespace to provision the resource in.
 	// The value should not contain leading or trailing forward slashes.
 	// The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
@@ -275,8 +275,8 @@ func (o NamespaceOutput) ToNamespaceOutputWithContext(ctx context.Context) Names
 
 // Custom metadata describing this namespace. Value type
 // is `map[string]string`. Requires Vault version 1.12+.
-func (o NamespaceOutput) CustomMetadata() pulumi.MapOutput {
-	return o.ApplyT(func(v *Namespace) pulumi.MapOutput { return v.CustomMetadata }).(pulumi.MapOutput)
+func (o NamespaceOutput) CustomMetadata() pulumi.StringMapOutput {
+	return o.ApplyT(func(v *Namespace) pulumi.StringMapOutput { return v.CustomMetadata }).(pulumi.StringMapOutput)
 }
 
 // The namespace to provision the resource in.
diff --git a/sdk/go/vault/pkisecret/backendConfigEst.go b/sdk/go/vault/pkisecret/backendConfigEst.go
index 23fdf738f..337fd96eb 100644
--- a/sdk/go/vault/pkisecret/backendConfigEst.go
+++ b/sdk/go/vault/pkisecret/backendConfigEst.go
@@ -44,7 +44,7 @@ type BackendConfigEst struct {
 	// Specifies whether EST is enabled.
 	Enabled pulumi.BoolPtrOutput `pulumi:"enabled"`
 	// Configures a pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:<role_name>. Labels must be unique across Vault cluster, and will register .well-known/est/<label> URL paths.
-	LabelToPathPolicy pulumi.MapOutput `pulumi:"labelToPathPolicy"`
+	LabelToPathPolicy pulumi.StringMapOutput `pulumi:"labelToPathPolicy"`
 	// A read-only timestamp representing the last time the configuration was updated.
 	LastUpdated pulumi.StringOutput `pulumi:"lastUpdated"`
 	// The namespace of the target resource.
@@ -105,7 +105,7 @@ type backendConfigEstState struct {
 	// Specifies whether EST is enabled.
 	Enabled *bool `pulumi:"enabled"`
 	// Configures a pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:<role_name>. Labels must be unique across Vault cluster, and will register .well-known/est/<label> URL paths.
-	LabelToPathPolicy map[string]interface{} `pulumi:"labelToPathPolicy"`
+	LabelToPathPolicy map[string]string `pulumi:"labelToPathPolicy"`
 	// A read-only timestamp representing the last time the configuration was updated.
 	LastUpdated *string `pulumi:"lastUpdated"`
 	// The namespace of the target resource.
@@ -134,7 +134,7 @@ type BackendConfigEstState struct {
 	// Specifies whether EST is enabled.
 	Enabled pulumi.BoolPtrInput
 	// Configures a pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:<role_name>. Labels must be unique across Vault cluster, and will register .well-known/est/<label> URL paths.
-	LabelToPathPolicy pulumi.MapInput
+	LabelToPathPolicy pulumi.StringMapInput
 	// A read-only timestamp representing the last time the configuration was updated.
 	LastUpdated pulumi.StringPtrInput
 	// The namespace of the target resource.
@@ -167,7 +167,7 @@ type backendConfigEstArgs struct {
 	// Specifies whether EST is enabled.
 	Enabled *bool `pulumi:"enabled"`
 	// Configures a pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:<role_name>. Labels must be unique across Vault cluster, and will register .well-known/est/<label> URL paths.
-	LabelToPathPolicy map[string]interface{} `pulumi:"labelToPathPolicy"`
+	LabelToPathPolicy map[string]string `pulumi:"labelToPathPolicy"`
 	// The namespace of the target resource.
 	// The value should not contain leading or trailing forward slashes.
 	// The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
@@ -195,7 +195,7 @@ type BackendConfigEstArgs struct {
 	// Specifies whether EST is enabled.
 	Enabled pulumi.BoolPtrInput
 	// Configures a pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:<role_name>. Labels must be unique across Vault cluster, and will register .well-known/est/<label> URL paths.
-	LabelToPathPolicy pulumi.MapInput
+	LabelToPathPolicy pulumi.StringMapInput
 	// The namespace of the target resource.
 	// The value should not contain leading or trailing forward slashes.
 	// The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
@@ -329,8 +329,8 @@ func (o BackendConfigEstOutput) Enabled() pulumi.BoolPtrOutput {
 }
 
 // Configures a pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:<role_name>. Labels must be unique across Vault cluster, and will register .well-known/est/<label> URL paths.
-func (o BackendConfigEstOutput) LabelToPathPolicy() pulumi.MapOutput {
-	return o.ApplyT(func(v *BackendConfigEst) pulumi.MapOutput { return v.LabelToPathPolicy }).(pulumi.MapOutput)
+func (o BackendConfigEstOutput) LabelToPathPolicy() pulumi.StringMapOutput {
+	return o.ApplyT(func(v *BackendConfigEst) pulumi.StringMapOutput { return v.LabelToPathPolicy }).(pulumi.StringMapOutput)
 }
 
 // A read-only timestamp representing the last time the configuration was updated.
diff --git a/sdk/go/vault/pkisecret/getBackendConfigEst.go b/sdk/go/vault/pkisecret/getBackendConfigEst.go
index 42df8d22a..47f548ad8 100644
--- a/sdk/go/vault/pkisecret/getBackendConfigEst.go
+++ b/sdk/go/vault/pkisecret/getBackendConfigEst.go
@@ -82,7 +82,7 @@ type LookupBackendConfigEstResult struct {
 	// The provider-assigned unique ID for this managed resource.
 	Id string `pulumi:"id"`
 	// A pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:<role_name>. Labels must be unique across Vault cluster, and will register .well-known/est/<label> URL paths.
-	LabelToPathPolicy map[string]interface{} `pulumi:"labelToPathPolicy"`
+	LabelToPathPolicy map[string]string `pulumi:"labelToPathPolicy"`
 	// A read-only timestamp representing the last time the configuration was updated.
 	LastUpdated string  `pulumi:"lastUpdated"`
 	Namespace   *string `pulumi:"namespace"`
@@ -172,8 +172,8 @@ func (o LookupBackendConfigEstResultOutput) Id() pulumi.StringOutput {
 }
 
 // A pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:<role_name>. Labels must be unique across Vault cluster, and will register .well-known/est/<label> URL paths.
-func (o LookupBackendConfigEstResultOutput) LabelToPathPolicy() pulumi.MapOutput {
-	return o.ApplyT(func(v LookupBackendConfigEstResult) map[string]interface{} { return v.LabelToPathPolicy }).(pulumi.MapOutput)
+func (o LookupBackendConfigEstResultOutput) LabelToPathPolicy() pulumi.StringMapOutput {
+	return o.ApplyT(func(v LookupBackendConfigEstResult) map[string]string { return v.LabelToPathPolicy }).(pulumi.StringMapOutput)
 }
 
 // A read-only timestamp representing the last time the configuration was updated.
diff --git a/sdk/go/vault/pkisecret/getBackendIssuers.go b/sdk/go/vault/pkisecret/getBackendIssuers.go
index 235cd32a5..5030babd9 100644
--- a/sdk/go/vault/pkisecret/getBackendIssuers.go
+++ b/sdk/go/vault/pkisecret/getBackendIssuers.go
@@ -80,7 +80,7 @@ type GetBackendIssuersResult struct {
 	// The provider-assigned unique ID for this managed resource.
 	Id string `pulumi:"id"`
 	// Map of issuer strings read from Vault.
-	KeyInfo map[string]interface{} `pulumi:"keyInfo"`
+	KeyInfo map[string]string `pulumi:"keyInfo"`
 	// JSON-encoded issuer data read from Vault.
 	KeyInfoJson string `pulumi:"keyInfoJson"`
 	// Keys used by issuers under the backend path.
@@ -142,8 +142,8 @@ func (o GetBackendIssuersResultOutput) Id() pulumi.StringOutput {
 }
 
 // Map of issuer strings read from Vault.
-func (o GetBackendIssuersResultOutput) KeyInfo() pulumi.MapOutput {
-	return o.ApplyT(func(v GetBackendIssuersResult) map[string]interface{} { return v.KeyInfo }).(pulumi.MapOutput)
+func (o GetBackendIssuersResultOutput) KeyInfo() pulumi.StringMapOutput {
+	return o.ApplyT(func(v GetBackendIssuersResult) map[string]string { return v.KeyInfo }).(pulumi.StringMapOutput)
 }
 
 // JSON-encoded issuer data read from Vault.
diff --git a/sdk/go/vault/pkisecret/getBackendKeys.go b/sdk/go/vault/pkisecret/getBackendKeys.go
index 4dd80d63b..8318bb906 100644
--- a/sdk/go/vault/pkisecret/getBackendKeys.go
+++ b/sdk/go/vault/pkisecret/getBackendKeys.go
@@ -80,7 +80,7 @@ type GetBackendKeysResult struct {
 	// The provider-assigned unique ID for this managed resource.
 	Id string `pulumi:"id"`
 	// Map of key strings read from Vault.
-	KeyInfo map[string]interface{} `pulumi:"keyInfo"`
+	KeyInfo map[string]string `pulumi:"keyInfo"`
 	// JSON-encoded key data read from Vault.
 	KeyInfoJson string `pulumi:"keyInfoJson"`
 	// Keys used under the backend path.
@@ -142,8 +142,8 @@ func (o GetBackendKeysResultOutput) Id() pulumi.StringOutput {
 }
 
 // Map of key strings read from Vault.
-func (o GetBackendKeysResultOutput) KeyInfo() pulumi.MapOutput {
-	return o.ApplyT(func(v GetBackendKeysResult) map[string]interface{} { return v.KeyInfo }).(pulumi.MapOutput)
+func (o GetBackendKeysResultOutput) KeyInfo() pulumi.StringMapOutput {
+	return o.ApplyT(func(v GetBackendKeysResult) map[string]string { return v.KeyInfo }).(pulumi.StringMapOutput)
 }
 
 // JSON-encoded key data read from Vault.
diff --git a/sdk/go/vault/pkisecret/pulumiTypes.go b/sdk/go/vault/pkisecret/pulumiTypes.go
index 325337432..6d519f62a 100644
--- a/sdk/go/vault/pkisecret/pulumiTypes.go
+++ b/sdk/go/vault/pkisecret/pulumiTypes.go
@@ -15,9 +15,9 @@ var _ = internal.GetEnvOrDefault
 
 type BackendConfigEstAuthenticators struct {
 	// "The accessor (required) and certRole (optional) properties for cert auth backends".
-	Cert map[string]interface{} `pulumi:"cert"`
+	Cert map[string]string `pulumi:"cert"`
 	// "The accessor (required) property for user pass auth backends".
-	Userpass map[string]interface{} `pulumi:"userpass"`
+	Userpass map[string]string `pulumi:"userpass"`
 }
 
 // BackendConfigEstAuthenticatorsInput is an input type that accepts BackendConfigEstAuthenticatorsArgs and BackendConfigEstAuthenticatorsOutput values.
@@ -33,9 +33,9 @@ type BackendConfigEstAuthenticatorsInput interface {
 
 type BackendConfigEstAuthenticatorsArgs struct {
 	// "The accessor (required) and certRole (optional) properties for cert auth backends".
-	Cert pulumi.MapInput `pulumi:"cert"`
+	Cert pulumi.StringMapInput `pulumi:"cert"`
 	// "The accessor (required) property for user pass auth backends".
-	Userpass pulumi.MapInput `pulumi:"userpass"`
+	Userpass pulumi.StringMapInput `pulumi:"userpass"`
 }
 
 func (BackendConfigEstAuthenticatorsArgs) ElementType() reflect.Type {
@@ -116,13 +116,13 @@ func (o BackendConfigEstAuthenticatorsOutput) ToBackendConfigEstAuthenticatorsPt
 }
 
 // "The accessor (required) and certRole (optional) properties for cert auth backends".
-func (o BackendConfigEstAuthenticatorsOutput) Cert() pulumi.MapOutput {
-	return o.ApplyT(func(v BackendConfigEstAuthenticators) map[string]interface{} { return v.Cert }).(pulumi.MapOutput)
+func (o BackendConfigEstAuthenticatorsOutput) Cert() pulumi.StringMapOutput {
+	return o.ApplyT(func(v BackendConfigEstAuthenticators) map[string]string { return v.Cert }).(pulumi.StringMapOutput)
 }
 
 // "The accessor (required) property for user pass auth backends".
-func (o BackendConfigEstAuthenticatorsOutput) Userpass() pulumi.MapOutput {
-	return o.ApplyT(func(v BackendConfigEstAuthenticators) map[string]interface{} { return v.Userpass }).(pulumi.MapOutput)
+func (o BackendConfigEstAuthenticatorsOutput) Userpass() pulumi.StringMapOutput {
+	return o.ApplyT(func(v BackendConfigEstAuthenticators) map[string]string { return v.Userpass }).(pulumi.StringMapOutput)
 }
 
 type BackendConfigEstAuthenticatorsPtrOutput struct{ *pulumi.OutputState }
@@ -150,23 +150,23 @@ func (o BackendConfigEstAuthenticatorsPtrOutput) Elem() BackendConfigEstAuthenti
 }
 
 // "The accessor (required) and certRole (optional) properties for cert auth backends".
-func (o BackendConfigEstAuthenticatorsPtrOutput) Cert() pulumi.MapOutput {
-	return o.ApplyT(func(v *BackendConfigEstAuthenticators) map[string]interface{} {
+func (o BackendConfigEstAuthenticatorsPtrOutput) Cert() pulumi.StringMapOutput {
+	return o.ApplyT(func(v *BackendConfigEstAuthenticators) map[string]string {
 		if v == nil {
 			return nil
 		}
 		return v.Cert
-	}).(pulumi.MapOutput)
+	}).(pulumi.StringMapOutput)
 }
 
 // "The accessor (required) property for user pass auth backends".
-func (o BackendConfigEstAuthenticatorsPtrOutput) Userpass() pulumi.MapOutput {
-	return o.ApplyT(func(v *BackendConfigEstAuthenticators) map[string]interface{} {
+func (o BackendConfigEstAuthenticatorsPtrOutput) Userpass() pulumi.StringMapOutput {
+	return o.ApplyT(func(v *BackendConfigEstAuthenticators) map[string]string {
 		if v == nil {
 			return nil
 		}
 		return v.Userpass
-	}).(pulumi.MapOutput)
+	}).(pulumi.StringMapOutput)
 }
 
 type SecretBackendRolePolicyIdentifier struct {
@@ -292,9 +292,9 @@ func (o SecretBackendRolePolicyIdentifierArrayOutput) Index(i pulumi.IntInput) S
 
 type GetBackendConfigEstAuthenticator struct {
 	// "The accessor and certRole properties for cert auth backends".
-	Cert map[string]interface{} `pulumi:"cert"`
+	Cert map[string]string `pulumi:"cert"`
 	// "The accessor property for user pass auth backends".
-	Userpass map[string]interface{} `pulumi:"userpass"`
+	Userpass map[string]string `pulumi:"userpass"`
 }
 
 // GetBackendConfigEstAuthenticatorInput is an input type that accepts GetBackendConfigEstAuthenticatorArgs and GetBackendConfigEstAuthenticatorOutput values.
@@ -310,9 +310,9 @@ type GetBackendConfigEstAuthenticatorInput interface {
 
 type GetBackendConfigEstAuthenticatorArgs struct {
 	// "The accessor and certRole properties for cert auth backends".
-	Cert pulumi.MapInput `pulumi:"cert"`
+	Cert pulumi.StringMapInput `pulumi:"cert"`
 	// "The accessor property for user pass auth backends".
-	Userpass pulumi.MapInput `pulumi:"userpass"`
+	Userpass pulumi.StringMapInput `pulumi:"userpass"`
 }
 
 func (GetBackendConfigEstAuthenticatorArgs) ElementType() reflect.Type {
@@ -367,13 +367,13 @@ func (o GetBackendConfigEstAuthenticatorOutput) ToGetBackendConfigEstAuthenticat
 }
 
 // "The accessor and certRole properties for cert auth backends".
-func (o GetBackendConfigEstAuthenticatorOutput) Cert() pulumi.MapOutput {
-	return o.ApplyT(func(v GetBackendConfigEstAuthenticator) map[string]interface{} { return v.Cert }).(pulumi.MapOutput)
+func (o GetBackendConfigEstAuthenticatorOutput) Cert() pulumi.StringMapOutput {
+	return o.ApplyT(func(v GetBackendConfigEstAuthenticator) map[string]string { return v.Cert }).(pulumi.StringMapOutput)
 }
 
 // "The accessor property for user pass auth backends".
-func (o GetBackendConfigEstAuthenticatorOutput) Userpass() pulumi.MapOutput {
-	return o.ApplyT(func(v GetBackendConfigEstAuthenticator) map[string]interface{} { return v.Userpass }).(pulumi.MapOutput)
+func (o GetBackendConfigEstAuthenticatorOutput) Userpass() pulumi.StringMapOutput {
+	return o.ApplyT(func(v GetBackendConfigEstAuthenticator) map[string]string { return v.Userpass }).(pulumi.StringMapOutput)
 }
 
 type GetBackendConfigEstAuthenticatorArrayOutput struct{ *pulumi.OutputState }
diff --git a/sdk/go/vault/saml/authBackendRole.go b/sdk/go/vault/saml/authBackendRole.go
index adb359ad8..021cbeb17 100644
--- a/sdk/go/vault/saml/authBackendRole.go
+++ b/sdk/go/vault/saml/authBackendRole.go
@@ -46,8 +46,8 @@ import (
 //				Path:            example.Path,
 //				Name:            pulumi.String("my-role"),
 //				GroupsAttribute: pulumi.String("groups"),
-//				BoundAttributes: pulumi.Map{
-//					"group": pulumi.Any("admin"),
+//				BoundAttributes: pulumi.StringMap{
+//					"group": pulumi.String("admin"),
 //				},
 //				BoundSubjects: pulumi.StringArray{
 //					pulumi.String("*example.com"),
@@ -78,7 +78,7 @@ type AuthBackendRole struct {
 
 	// Mapping of attribute names to values that are expected to
 	// exist in the SAML assertion.
-	BoundAttributes pulumi.MapOutput `pulumi:"boundAttributes"`
+	BoundAttributes pulumi.StringMapOutput `pulumi:"boundAttributes"`
 	// The type of matching assertion to perform on
 	// `boundAttributesType`.
 	BoundAttributesType pulumi.StringOutput `pulumi:"boundAttributesType"`
@@ -153,7 +153,7 @@ func GetAuthBackendRole(ctx *pulumi.Context,
 type authBackendRoleState struct {
 	// Mapping of attribute names to values that are expected to
 	// exist in the SAML assertion.
-	BoundAttributes map[string]interface{} `pulumi:"boundAttributes"`
+	BoundAttributes map[string]string `pulumi:"boundAttributes"`
 	// The type of matching assertion to perform on
 	// `boundAttributesType`.
 	BoundAttributesType *string `pulumi:"boundAttributesType"`
@@ -196,7 +196,7 @@ type authBackendRoleState struct {
 type AuthBackendRoleState struct {
 	// Mapping of attribute names to values that are expected to
 	// exist in the SAML assertion.
-	BoundAttributes pulumi.MapInput
+	BoundAttributes pulumi.StringMapInput
 	// The type of matching assertion to perform on
 	// `boundAttributesType`.
 	BoundAttributesType pulumi.StringPtrInput
@@ -243,7 +243,7 @@ func (AuthBackendRoleState) ElementType() reflect.Type {
 type authBackendRoleArgs struct {
 	// Mapping of attribute names to values that are expected to
 	// exist in the SAML assertion.
-	BoundAttributes map[string]interface{} `pulumi:"boundAttributes"`
+	BoundAttributes map[string]string `pulumi:"boundAttributes"`
 	// The type of matching assertion to perform on
 	// `boundAttributesType`.
 	BoundAttributesType *string `pulumi:"boundAttributesType"`
@@ -287,7 +287,7 @@ type authBackendRoleArgs struct {
 type AuthBackendRoleArgs struct {
 	// Mapping of attribute names to values that are expected to
 	// exist in the SAML assertion.
-	BoundAttributes pulumi.MapInput
+	BoundAttributes pulumi.StringMapInput
 	// The type of matching assertion to perform on
 	// `boundAttributesType`.
 	BoundAttributesType pulumi.StringPtrInput
@@ -416,8 +416,8 @@ func (o AuthBackendRoleOutput) ToAuthBackendRoleOutputWithContext(ctx context.Co
 
 // Mapping of attribute names to values that are expected to
 // exist in the SAML assertion.
-func (o AuthBackendRoleOutput) BoundAttributes() pulumi.MapOutput {
-	return o.ApplyT(func(v *AuthBackendRole) pulumi.MapOutput { return v.BoundAttributes }).(pulumi.MapOutput)
+func (o AuthBackendRoleOutput) BoundAttributes() pulumi.StringMapOutput {
+	return o.ApplyT(func(v *AuthBackendRole) pulumi.StringMapOutput { return v.BoundAttributes }).(pulumi.StringMapOutput)
 }
 
 // The type of matching assertion to perform on
diff --git a/sdk/go/vault/secrets/syncAssociation.go b/sdk/go/vault/secrets/syncAssociation.go
index 33902d6b3..4a2638578 100644
--- a/sdk/go/vault/secrets/syncAssociation.go
+++ b/sdk/go/vault/secrets/syncAssociation.go
@@ -33,8 +33,8 @@ import (
 //			kvv2, err := vault.NewMount(ctx, "kvv2", &vault.MountArgs{
 //				Path: pulumi.String("kvv2"),
 //				Type: pulumi.String("kv"),
-//				Options: pulumi.Map{
-//					"version": pulumi.Any("2"),
+//				Options: pulumi.StringMap{
+//					"version": pulumi.String("2"),
 //				},
 //				Description: pulumi.String("KV Version 2 secret engine mount"),
 //			})
diff --git a/sdk/go/vault/secrets/syncAwsDestination.go b/sdk/go/vault/secrets/syncAwsDestination.go
index 2a214c90a..45a431eb1 100644
--- a/sdk/go/vault/secrets/syncAwsDestination.go
+++ b/sdk/go/vault/secrets/syncAwsDestination.go
@@ -33,8 +33,8 @@ import (
 //				RoleArn:            pulumi.String("role-arn"),
 //				ExternalId:         pulumi.String("external-id"),
 //				SecretNameTemplate: pulumi.String("vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}"),
-//				CustomTags: pulumi.Map{
-//					"foo": pulumi.Any("bar"),
+//				CustomTags: pulumi.StringMap{
+//					"foo": pulumi.String("bar"),
 //				},
 //			})
 //			if err != nil {
@@ -61,7 +61,7 @@ type SyncAwsDestination struct {
 	// variable.
 	AccessKeyId pulumi.StringPtrOutput `pulumi:"accessKeyId"`
 	// Custom tags to set on the secret managed at the destination.
-	CustomTags pulumi.MapOutput `pulumi:"customTags"`
+	CustomTags pulumi.StringMapOutput `pulumi:"customTags"`
 	// Optional extra protection that must match the trust policy granting access to the
 	// AWS IAM role ARN. We recommend using a different random UUID per destination. The value is generated by users.
 	// The field is mutable with no special condition, but users must be careful that the new value fits with the trust
@@ -140,7 +140,7 @@ type syncAwsDestinationState struct {
 	// variable.
 	AccessKeyId *string `pulumi:"accessKeyId"`
 	// Custom tags to set on the secret managed at the destination.
-	CustomTags map[string]interface{} `pulumi:"customTags"`
+	CustomTags map[string]string `pulumi:"customTags"`
 	// Optional extra protection that must match the trust policy granting access to the
 	// AWS IAM role ARN. We recommend using a different random UUID per destination. The value is generated by users.
 	// The field is mutable with no special condition, but users must be careful that the new value fits with the trust
@@ -183,7 +183,7 @@ type SyncAwsDestinationState struct {
 	// variable.
 	AccessKeyId pulumi.StringPtrInput
 	// Custom tags to set on the secret managed at the destination.
-	CustomTags pulumi.MapInput
+	CustomTags pulumi.StringMapInput
 	// Optional extra protection that must match the trust policy granting access to the
 	// AWS IAM role ARN. We recommend using a different random UUID per destination. The value is generated by users.
 	// The field is mutable with no special condition, but users must be careful that the new value fits with the trust
@@ -230,7 +230,7 @@ type syncAwsDestinationArgs struct {
 	// variable.
 	AccessKeyId *string `pulumi:"accessKeyId"`
 	// Custom tags to set on the secret managed at the destination.
-	CustomTags map[string]interface{} `pulumi:"customTags"`
+	CustomTags map[string]string `pulumi:"customTags"`
 	// Optional extra protection that must match the trust policy granting access to the
 	// AWS IAM role ARN. We recommend using a different random UUID per destination. The value is generated by users.
 	// The field is mutable with no special condition, but users must be careful that the new value fits with the trust
@@ -272,7 +272,7 @@ type SyncAwsDestinationArgs struct {
 	// variable.
 	AccessKeyId pulumi.StringPtrInput
 	// Custom tags to set on the secret managed at the destination.
-	CustomTags pulumi.MapInput
+	CustomTags pulumi.StringMapInput
 	// Optional extra protection that must match the trust policy granting access to the
 	// AWS IAM role ARN. We recommend using a different random UUID per destination. The value is generated by users.
 	// The field is mutable with no special condition, but users must be careful that the new value fits with the trust
@@ -402,8 +402,8 @@ func (o SyncAwsDestinationOutput) AccessKeyId() pulumi.StringPtrOutput {
 }
 
 // Custom tags to set on the secret managed at the destination.
-func (o SyncAwsDestinationOutput) CustomTags() pulumi.MapOutput {
-	return o.ApplyT(func(v *SyncAwsDestination) pulumi.MapOutput { return v.CustomTags }).(pulumi.MapOutput)
+func (o SyncAwsDestinationOutput) CustomTags() pulumi.StringMapOutput {
+	return o.ApplyT(func(v *SyncAwsDestination) pulumi.StringMapOutput { return v.CustomTags }).(pulumi.StringMapOutput)
 }
 
 // Optional extra protection that must match the trust policy granting access to the
diff --git a/sdk/go/vault/secrets/syncAzureDestination.go b/sdk/go/vault/secrets/syncAzureDestination.go
index 3658411c0..34cc594e1 100644
--- a/sdk/go/vault/secrets/syncAzureDestination.go
+++ b/sdk/go/vault/secrets/syncAzureDestination.go
@@ -32,8 +32,8 @@ import (
 //				ClientSecret:       pulumi.Any(clientSecret),
 //				TenantId:           pulumi.Any(tenantId),
 //				SecretNameTemplate: pulumi.String("vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}"),
-//				CustomTags: pulumi.Map{
-//					"foo": pulumi.Any("bar"),
+//				CustomTags: pulumi.StringMap{
+//					"foo": pulumi.String("bar"),
 //				},
 //			})
 //			if err != nil {
@@ -66,7 +66,7 @@ type SyncAzureDestination struct {
 	// Specifies a cloud for the client. The default is Azure Public Cloud.
 	Cloud pulumi.StringPtrOutput `pulumi:"cloud"`
 	// Custom tags to set on the secret managed at the destination.
-	CustomTags pulumi.MapOutput `pulumi:"customTags"`
+	CustomTags pulumi.StringMapOutput `pulumi:"customTags"`
 	// Determines what level of information is synced as a distinct resource
 	// at the destination. Supports `secret-path` and `secret-key`.
 	Granularity pulumi.StringPtrOutput `pulumi:"granularity"`
@@ -139,7 +139,7 @@ type syncAzureDestinationState struct {
 	// Specifies a cloud for the client. The default is Azure Public Cloud.
 	Cloud *string `pulumi:"cloud"`
 	// Custom tags to set on the secret managed at the destination.
-	CustomTags map[string]interface{} `pulumi:"customTags"`
+	CustomTags map[string]string `pulumi:"customTags"`
 	// Determines what level of information is synced as a distinct resource
 	// at the destination. Supports `secret-path` and `secret-key`.
 	Granularity *string `pulumi:"granularity"`
@@ -176,7 +176,7 @@ type SyncAzureDestinationState struct {
 	// Specifies a cloud for the client. The default is Azure Public Cloud.
 	Cloud pulumi.StringPtrInput
 	// Custom tags to set on the secret managed at the destination.
-	CustomTags pulumi.MapInput
+	CustomTags pulumi.StringMapInput
 	// Determines what level of information is synced as a distinct resource
 	// at the destination. Supports `secret-path` and `secret-key`.
 	Granularity pulumi.StringPtrInput
@@ -217,7 +217,7 @@ type syncAzureDestinationArgs struct {
 	// Specifies a cloud for the client. The default is Azure Public Cloud.
 	Cloud *string `pulumi:"cloud"`
 	// Custom tags to set on the secret managed at the destination.
-	CustomTags map[string]interface{} `pulumi:"customTags"`
+	CustomTags map[string]string `pulumi:"customTags"`
 	// Determines what level of information is synced as a distinct resource
 	// at the destination. Supports `secret-path` and `secret-key`.
 	Granularity *string `pulumi:"granularity"`
@@ -253,7 +253,7 @@ type SyncAzureDestinationArgs struct {
 	// Specifies a cloud for the client. The default is Azure Public Cloud.
 	Cloud pulumi.StringPtrInput
 	// Custom tags to set on the secret managed at the destination.
-	CustomTags pulumi.MapInput
+	CustomTags pulumi.StringMapInput
 	// Determines what level of information is synced as a distinct resource
 	// at the destination. Supports `secret-path` and `secret-key`.
 	Granularity pulumi.StringPtrInput
@@ -383,8 +383,8 @@ func (o SyncAzureDestinationOutput) Cloud() pulumi.StringPtrOutput {
 }
 
 // Custom tags to set on the secret managed at the destination.
-func (o SyncAzureDestinationOutput) CustomTags() pulumi.MapOutput {
-	return o.ApplyT(func(v *SyncAzureDestination) pulumi.MapOutput { return v.CustomTags }).(pulumi.MapOutput)
+func (o SyncAzureDestinationOutput) CustomTags() pulumi.StringMapOutput {
+	return o.ApplyT(func(v *SyncAzureDestination) pulumi.StringMapOutput { return v.CustomTags }).(pulumi.StringMapOutput)
 }
 
 // Determines what level of information is synced as a distinct resource
diff --git a/sdk/go/vault/secrets/syncGcpDestination.go b/sdk/go/vault/secrets/syncGcpDestination.go
index 753692866..027d7f776 100644
--- a/sdk/go/vault/secrets/syncGcpDestination.go
+++ b/sdk/go/vault/secrets/syncGcpDestination.go
@@ -37,8 +37,8 @@ import (
 //				ProjectId:          pulumi.String("gcp-project-id"),
 //				Credentials:        pulumi.String(invokeFile.Result),
 //				SecretNameTemplate: pulumi.String("vault_{{ .MountAccessor | lowercase }}_{{ .SecretPath | lowercase }}"),
-//				CustomTags: pulumi.Map{
-//					"foo": pulumi.Any("bar"),
+//				CustomTags: pulumi.StringMap{
+//					"foo": pulumi.String("bar"),
 //				},
 //			})
 //			if err != nil {
@@ -65,7 +65,7 @@ type SyncGcpDestination struct {
 	// variable.
 	Credentials pulumi.StringPtrOutput `pulumi:"credentials"`
 	// Custom tags to set on the secret managed at the destination.
-	CustomTags pulumi.MapOutput `pulumi:"customTags"`
+	CustomTags pulumi.StringMapOutput `pulumi:"customTags"`
 	// Determines what level of information is synced as a distinct resource
 	// at the destination. Supports `secret-path` and `secret-key`.
 	Granularity pulumi.StringPtrOutput `pulumi:"granularity"`
@@ -129,7 +129,7 @@ type syncGcpDestinationState struct {
 	// variable.
 	Credentials *string `pulumi:"credentials"`
 	// Custom tags to set on the secret managed at the destination.
-	CustomTags map[string]interface{} `pulumi:"customTags"`
+	CustomTags map[string]string `pulumi:"customTags"`
 	// Determines what level of information is synced as a distinct resource
 	// at the destination. Supports `secret-path` and `secret-key`.
 	Granularity *string `pulumi:"granularity"`
@@ -157,7 +157,7 @@ type SyncGcpDestinationState struct {
 	// variable.
 	Credentials pulumi.StringPtrInput
 	// Custom tags to set on the secret managed at the destination.
-	CustomTags pulumi.MapInput
+	CustomTags pulumi.StringMapInput
 	// Determines what level of information is synced as a distinct resource
 	// at the destination. Supports `secret-path` and `secret-key`.
 	Granularity pulumi.StringPtrInput
@@ -189,7 +189,7 @@ type syncGcpDestinationArgs struct {
 	// variable.
 	Credentials *string `pulumi:"credentials"`
 	// Custom tags to set on the secret managed at the destination.
-	CustomTags map[string]interface{} `pulumi:"customTags"`
+	CustomTags map[string]string `pulumi:"customTags"`
 	// Determines what level of information is synced as a distinct resource
 	// at the destination. Supports `secret-path` and `secret-key`.
 	Granularity *string `pulumi:"granularity"`
@@ -216,7 +216,7 @@ type SyncGcpDestinationArgs struct {
 	// variable.
 	Credentials pulumi.StringPtrInput
 	// Custom tags to set on the secret managed at the destination.
-	CustomTags pulumi.MapInput
+	CustomTags pulumi.StringMapInput
 	// Determines what level of information is synced as a distinct resource
 	// at the destination. Supports `secret-path` and `secret-key`.
 	Granularity pulumi.StringPtrInput
@@ -331,8 +331,8 @@ func (o SyncGcpDestinationOutput) Credentials() pulumi.StringPtrOutput {
 }
 
 // Custom tags to set on the secret managed at the destination.
-func (o SyncGcpDestinationOutput) CustomTags() pulumi.MapOutput {
-	return o.ApplyT(func(v *SyncGcpDestination) pulumi.MapOutput { return v.CustomTags }).(pulumi.MapOutput)
+func (o SyncGcpDestinationOutput) CustomTags() pulumi.StringMapOutput {
+	return o.ApplyT(func(v *SyncGcpDestination) pulumi.StringMapOutput { return v.CustomTags }).(pulumi.StringMapOutput)
 }
 
 // Determines what level of information is synced as a distinct resource
diff --git a/sdk/go/vault/ssh/secretBackendRole.go b/sdk/go/vault/ssh/secretBackendRole.go
index 4e4aee265..60ca9b763 100644
--- a/sdk/go/vault/ssh/secretBackendRole.go
+++ b/sdk/go/vault/ssh/secretBackendRole.go
@@ -106,9 +106,9 @@ type SecretBackendRole struct {
 	// The comma-separated string of CIDR blocks for which this role is applicable.
 	CidrList pulumi.StringPtrOutput `pulumi:"cidrList"`
 	// Specifies a map of critical options that certificates have when signed.
-	DefaultCriticalOptions pulumi.MapOutput `pulumi:"defaultCriticalOptions"`
+	DefaultCriticalOptions pulumi.StringMapOutput `pulumi:"defaultCriticalOptions"`
 	// Specifies a map of extensions that certificates have when signed.
-	DefaultExtensions pulumi.MapOutput `pulumi:"defaultExtensions"`
+	DefaultExtensions pulumi.StringMapOutput `pulumi:"defaultExtensions"`
 	// Specifies the default username for which a credential will be generated.
 	DefaultUser pulumi.StringPtrOutput `pulumi:"defaultUser"`
 	// If set, `defaultUsers` can be specified using identity template values. A non-templated user is also permitted.
@@ -202,9 +202,9 @@ type secretBackendRoleState struct {
 	// The comma-separated string of CIDR blocks for which this role is applicable.
 	CidrList *string `pulumi:"cidrList"`
 	// Specifies a map of critical options that certificates have when signed.
-	DefaultCriticalOptions map[string]interface{} `pulumi:"defaultCriticalOptions"`
+	DefaultCriticalOptions map[string]string `pulumi:"defaultCriticalOptions"`
 	// Specifies a map of extensions that certificates have when signed.
-	DefaultExtensions map[string]interface{} `pulumi:"defaultExtensions"`
+	DefaultExtensions map[string]string `pulumi:"defaultExtensions"`
 	// Specifies the default username for which a credential will be generated.
 	DefaultUser *string `pulumi:"defaultUser"`
 	// If set, `defaultUsers` can be specified using identity template values. A non-templated user is also permitted.
@@ -263,9 +263,9 @@ type SecretBackendRoleState struct {
 	// The comma-separated string of CIDR blocks for which this role is applicable.
 	CidrList pulumi.StringPtrInput
 	// Specifies a map of critical options that certificates have when signed.
-	DefaultCriticalOptions pulumi.MapInput
+	DefaultCriticalOptions pulumi.StringMapInput
 	// Specifies a map of extensions that certificates have when signed.
-	DefaultExtensions pulumi.MapInput
+	DefaultExtensions pulumi.StringMapInput
 	// Specifies the default username for which a credential will be generated.
 	DefaultUser pulumi.StringPtrInput
 	// If set, `defaultUsers` can be specified using identity template values. A non-templated user is also permitted.
@@ -328,9 +328,9 @@ type secretBackendRoleArgs struct {
 	// The comma-separated string of CIDR blocks for which this role is applicable.
 	CidrList *string `pulumi:"cidrList"`
 	// Specifies a map of critical options that certificates have when signed.
-	DefaultCriticalOptions map[string]interface{} `pulumi:"defaultCriticalOptions"`
+	DefaultCriticalOptions map[string]string `pulumi:"defaultCriticalOptions"`
 	// Specifies a map of extensions that certificates have when signed.
-	DefaultExtensions map[string]interface{} `pulumi:"defaultExtensions"`
+	DefaultExtensions map[string]string `pulumi:"defaultExtensions"`
 	// Specifies the default username for which a credential will be generated.
 	DefaultUser *string `pulumi:"defaultUser"`
 	// If set, `defaultUsers` can be specified using identity template values. A non-templated user is also permitted.
@@ -390,9 +390,9 @@ type SecretBackendRoleArgs struct {
 	// The comma-separated string of CIDR blocks for which this role is applicable.
 	CidrList pulumi.StringPtrInput
 	// Specifies a map of critical options that certificates have when signed.
-	DefaultCriticalOptions pulumi.MapInput
+	DefaultCriticalOptions pulumi.StringMapInput
 	// Specifies a map of extensions that certificates have when signed.
-	DefaultExtensions pulumi.MapInput
+	DefaultExtensions pulumi.StringMapInput
 	// Specifies the default username for which a credential will be generated.
 	DefaultUser pulumi.StringPtrInput
 	// If set, `defaultUsers` can be specified using identity template values. A non-templated user is also permitted.
@@ -584,13 +584,13 @@ func (o SecretBackendRoleOutput) CidrList() pulumi.StringPtrOutput {
 }
 
 // Specifies a map of critical options that certificates have when signed.
-func (o SecretBackendRoleOutput) DefaultCriticalOptions() pulumi.MapOutput {
-	return o.ApplyT(func(v *SecretBackendRole) pulumi.MapOutput { return v.DefaultCriticalOptions }).(pulumi.MapOutput)
+func (o SecretBackendRoleOutput) DefaultCriticalOptions() pulumi.StringMapOutput {
+	return o.ApplyT(func(v *SecretBackendRole) pulumi.StringMapOutput { return v.DefaultCriticalOptions }).(pulumi.StringMapOutput)
 }
 
 // Specifies a map of extensions that certificates have when signed.
-func (o SecretBackendRoleOutput) DefaultExtensions() pulumi.MapOutput {
-	return o.ApplyT(func(v *SecretBackendRole) pulumi.MapOutput { return v.DefaultExtensions }).(pulumi.MapOutput)
+func (o SecretBackendRoleOutput) DefaultExtensions() pulumi.StringMapOutput {
+	return o.ApplyT(func(v *SecretBackendRole) pulumi.StringMapOutput { return v.DefaultExtensions }).(pulumi.StringMapOutput)
 }
 
 // Specifies the default username for which a credential will be generated.
diff --git a/sdk/go/vault/transform/getDecode.go b/sdk/go/vault/transform/getDecode.go
index 940f9bbfd..cd46ec39b 100644
--- a/sdk/go/vault/transform/getDecode.go
+++ b/sdk/go/vault/transform/getDecode.go
@@ -83,9 +83,9 @@ func GetDecode(ctx *pulumi.Context, args *GetDecodeArgs, opts ...pulumi.InvokeOp
 // A collection of arguments for invoking getDecode.
 type GetDecodeArgs struct {
 	// Specifies a list of items to be decoded in a single batch. If this parameter is set, the top-level parameters 'value', 'transformation' and 'tweak' will be ignored. Each batch item within the list can specify these parameters instead.
-	BatchInputs []map[string]interface{} `pulumi:"batchInputs"`
+	BatchInputs []map[string]string `pulumi:"batchInputs"`
 	// The result of decoding a batch.
-	BatchResults []map[string]interface{} `pulumi:"batchResults"`
+	BatchResults []map[string]string `pulumi:"batchResults"`
 	// The result of decoding a value.
 	DecodedValue *string `pulumi:"decodedValue"`
 	// The namespace of the target resource.
@@ -107,9 +107,9 @@ type GetDecodeArgs struct {
 
 // A collection of values returned by getDecode.
 type GetDecodeResult struct {
-	BatchInputs  []map[string]interface{} `pulumi:"batchInputs"`
-	BatchResults []map[string]interface{} `pulumi:"batchResults"`
-	DecodedValue string                   `pulumi:"decodedValue"`
+	BatchInputs  []map[string]string `pulumi:"batchInputs"`
+	BatchResults []map[string]string `pulumi:"batchResults"`
+	DecodedValue string              `pulumi:"decodedValue"`
 	// The provider-assigned unique ID for this managed resource.
 	Id             string  `pulumi:"id"`
 	Namespace      *string `pulumi:"namespace"`
@@ -136,9 +136,9 @@ func GetDecodeOutput(ctx *pulumi.Context, args GetDecodeOutputArgs, opts ...pulu
 // A collection of arguments for invoking getDecode.
 type GetDecodeOutputArgs struct {
 	// Specifies a list of items to be decoded in a single batch. If this parameter is set, the top-level parameters 'value', 'transformation' and 'tweak' will be ignored. Each batch item within the list can specify these parameters instead.
-	BatchInputs pulumi.MapArrayInput `pulumi:"batchInputs"`
+	BatchInputs pulumi.StringMapArrayInput `pulumi:"batchInputs"`
 	// The result of decoding a batch.
-	BatchResults pulumi.MapArrayInput `pulumi:"batchResults"`
+	BatchResults pulumi.StringMapArrayInput `pulumi:"batchResults"`
 	// The result of decoding a value.
 	DecodedValue pulumi.StringPtrInput `pulumi:"decodedValue"`
 	// The namespace of the target resource.
@@ -177,12 +177,12 @@ func (o GetDecodeResultOutput) ToGetDecodeResultOutputWithContext(ctx context.Co
 	return o
 }
 
-func (o GetDecodeResultOutput) BatchInputs() pulumi.MapArrayOutput {
-	return o.ApplyT(func(v GetDecodeResult) []map[string]interface{} { return v.BatchInputs }).(pulumi.MapArrayOutput)
+func (o GetDecodeResultOutput) BatchInputs() pulumi.StringMapArrayOutput {
+	return o.ApplyT(func(v GetDecodeResult) []map[string]string { return v.BatchInputs }).(pulumi.StringMapArrayOutput)
 }
 
-func (o GetDecodeResultOutput) BatchResults() pulumi.MapArrayOutput {
-	return o.ApplyT(func(v GetDecodeResult) []map[string]interface{} { return v.BatchResults }).(pulumi.MapArrayOutput)
+func (o GetDecodeResultOutput) BatchResults() pulumi.StringMapArrayOutput {
+	return o.ApplyT(func(v GetDecodeResult) []map[string]string { return v.BatchResults }).(pulumi.StringMapArrayOutput)
 }
 
 func (o GetDecodeResultOutput) DecodedValue() pulumi.StringOutput {
diff --git a/sdk/go/vault/transform/getEncode.go b/sdk/go/vault/transform/getEncode.go
index 50617a520..91d47c8d0 100644
--- a/sdk/go/vault/transform/getEncode.go
+++ b/sdk/go/vault/transform/getEncode.go
@@ -63,9 +63,9 @@ import (
 //			_ = transform.GetEncodeOutput(ctx, transform.GetEncodeOutputArgs{
 //				Path:     payments.Path,
 //				RoleName: pulumi.String("payments"),
-//				BatchInputs: pulumi.MapArray{
-//					pulumi.Map{
-//						"value": pulumi.Any("1111-2222-3333-4444"),
+//				BatchInputs: pulumi.StringMapArray{
+//					pulumi.StringMap{
+//						"value": pulumi.String("1111-2222-3333-4444"),
 //					},
 //				},
 //			}, nil)
@@ -87,9 +87,9 @@ func GetEncode(ctx *pulumi.Context, args *GetEncodeArgs, opts ...pulumi.InvokeOp
 // A collection of arguments for invoking getEncode.
 type GetEncodeArgs struct {
 	// Specifies a list of items to be encoded in a single batch. If this parameter is set, the parameters 'value', 'transformation' and 'tweak' will be ignored. Each batch item within the list can specify these parameters instead.
-	BatchInputs []map[string]interface{} `pulumi:"batchInputs"`
+	BatchInputs []map[string]string `pulumi:"batchInputs"`
 	// The result of encoding a batch.
-	BatchResults []map[string]interface{} `pulumi:"batchResults"`
+	BatchResults []map[string]string `pulumi:"batchResults"`
 	// The result of encoding a value.
 	EncodedValue *string `pulumi:"encodedValue"`
 	// The namespace of the target resource.
@@ -111,9 +111,9 @@ type GetEncodeArgs struct {
 
 // A collection of values returned by getEncode.
 type GetEncodeResult struct {
-	BatchInputs  []map[string]interface{} `pulumi:"batchInputs"`
-	BatchResults []map[string]interface{} `pulumi:"batchResults"`
-	EncodedValue string                   `pulumi:"encodedValue"`
+	BatchInputs  []map[string]string `pulumi:"batchInputs"`
+	BatchResults []map[string]string `pulumi:"batchResults"`
+	EncodedValue string              `pulumi:"encodedValue"`
 	// The provider-assigned unique ID for this managed resource.
 	Id             string  `pulumi:"id"`
 	Namespace      *string `pulumi:"namespace"`
@@ -140,9 +140,9 @@ func GetEncodeOutput(ctx *pulumi.Context, args GetEncodeOutputArgs, opts ...pulu
 // A collection of arguments for invoking getEncode.
 type GetEncodeOutputArgs struct {
 	// Specifies a list of items to be encoded in a single batch. If this parameter is set, the parameters 'value', 'transformation' and 'tweak' will be ignored. Each batch item within the list can specify these parameters instead.
-	BatchInputs pulumi.MapArrayInput `pulumi:"batchInputs"`
+	BatchInputs pulumi.StringMapArrayInput `pulumi:"batchInputs"`
 	// The result of encoding a batch.
-	BatchResults pulumi.MapArrayInput `pulumi:"batchResults"`
+	BatchResults pulumi.StringMapArrayInput `pulumi:"batchResults"`
 	// The result of encoding a value.
 	EncodedValue pulumi.StringPtrInput `pulumi:"encodedValue"`
 	// The namespace of the target resource.
@@ -181,12 +181,12 @@ func (o GetEncodeResultOutput) ToGetEncodeResultOutputWithContext(ctx context.Co
 	return o
 }
 
-func (o GetEncodeResultOutput) BatchInputs() pulumi.MapArrayOutput {
-	return o.ApplyT(func(v GetEncodeResult) []map[string]interface{} { return v.BatchInputs }).(pulumi.MapArrayOutput)
+func (o GetEncodeResultOutput) BatchInputs() pulumi.StringMapArrayOutput {
+	return o.ApplyT(func(v GetEncodeResult) []map[string]string { return v.BatchInputs }).(pulumi.StringMapArrayOutput)
 }
 
-func (o GetEncodeResultOutput) BatchResults() pulumi.MapArrayOutput {
-	return o.ApplyT(func(v GetEncodeResult) []map[string]interface{} { return v.BatchResults }).(pulumi.MapArrayOutput)
+func (o GetEncodeResultOutput) BatchResults() pulumi.StringMapArrayOutput {
+	return o.ApplyT(func(v GetEncodeResult) []map[string]string { return v.BatchResults }).(pulumi.StringMapArrayOutput)
 }
 
 func (o GetEncodeResultOutput) EncodedValue() pulumi.StringOutput {
diff --git a/sdk/go/vault/transform/template.go b/sdk/go/vault/transform/template.go
index 0307b7ba4..60c4fce5e 100644
--- a/sdk/go/vault/transform/template.go
+++ b/sdk/go/vault/transform/template.go
@@ -64,8 +64,8 @@ import (
 //				Pattern:      pulumi.String("(\\d{4})[- ](\\d{4})[- ](\\d{4})[- ](\\d{4})"),
 //				Alphabet:     pulumi.String("numerics"),
 //				EncodeFormat: pulumi.String("$1-$2-$3-$4"),
-//				DecodeFormats: pulumi.Map{
-//					"last-four-digits": pulumi.Any("$4"),
+//				DecodeFormats: pulumi.StringMap{
+//					"last-four-digits": pulumi.String("$4"),
 //				},
 //			})
 //			if err != nil {
@@ -83,7 +83,7 @@ type Template struct {
 	Alphabet pulumi.StringPtrOutput `pulumi:"alphabet"`
 	// Optional mapping of name to regular expression template, used to customize
 	// the decoded output. (requires Vault Enterprise 1.9+)
-	DecodeFormats pulumi.MapOutput `pulumi:"decodeFormats"`
+	DecodeFormats pulumi.StringMapOutput `pulumi:"decodeFormats"`
 	// The regular expression template used to format encoded values.
 	// (requires Vault Enterprise 1.9+)
 	EncodeFormat pulumi.StringPtrOutput `pulumi:"encodeFormat"`
@@ -139,7 +139,7 @@ type templateState struct {
 	Alphabet *string `pulumi:"alphabet"`
 	// Optional mapping of name to regular expression template, used to customize
 	// the decoded output. (requires Vault Enterprise 1.9+)
-	DecodeFormats map[string]interface{} `pulumi:"decodeFormats"`
+	DecodeFormats map[string]string `pulumi:"decodeFormats"`
 	// The regular expression template used to format encoded values.
 	// (requires Vault Enterprise 1.9+)
 	EncodeFormat *string `pulumi:"encodeFormat"`
@@ -163,7 +163,7 @@ type TemplateState struct {
 	Alphabet pulumi.StringPtrInput
 	// Optional mapping of name to regular expression template, used to customize
 	// the decoded output. (requires Vault Enterprise 1.9+)
-	DecodeFormats pulumi.MapInput
+	DecodeFormats pulumi.StringMapInput
 	// The regular expression template used to format encoded values.
 	// (requires Vault Enterprise 1.9+)
 	EncodeFormat pulumi.StringPtrInput
@@ -191,7 +191,7 @@ type templateArgs struct {
 	Alphabet *string `pulumi:"alphabet"`
 	// Optional mapping of name to regular expression template, used to customize
 	// the decoded output. (requires Vault Enterprise 1.9+)
-	DecodeFormats map[string]interface{} `pulumi:"decodeFormats"`
+	DecodeFormats map[string]string `pulumi:"decodeFormats"`
 	// The regular expression template used to format encoded values.
 	// (requires Vault Enterprise 1.9+)
 	EncodeFormat *string `pulumi:"encodeFormat"`
@@ -216,7 +216,7 @@ type TemplateArgs struct {
 	Alphabet pulumi.StringPtrInput
 	// Optional mapping of name to regular expression template, used to customize
 	// the decoded output. (requires Vault Enterprise 1.9+)
-	DecodeFormats pulumi.MapInput
+	DecodeFormats pulumi.StringMapInput
 	// The regular expression template used to format encoded values.
 	// (requires Vault Enterprise 1.9+)
 	EncodeFormat pulumi.StringPtrInput
@@ -329,8 +329,8 @@ func (o TemplateOutput) Alphabet() pulumi.StringPtrOutput {
 
 // Optional mapping of name to regular expression template, used to customize
 // the decoded output. (requires Vault Enterprise 1.9+)
-func (o TemplateOutput) DecodeFormats() pulumi.MapOutput {
-	return o.ApplyT(func(v *Template) pulumi.MapOutput { return v.DecodeFormats }).(pulumi.MapOutput)
+func (o TemplateOutput) DecodeFormats() pulumi.StringMapOutput {
+	return o.ApplyT(func(v *Template) pulumi.StringMapOutput { return v.DecodeFormats }).(pulumi.StringMapOutput)
 }
 
 // The regular expression template used to format encoded values.
diff --git a/sdk/go/vault/transit/secretBackendKey.go b/sdk/go/vault/transit/secretBackendKey.go
index 251a41dc7..5e21def19 100644
--- a/sdk/go/vault/transit/secretBackendKey.go
+++ b/sdk/go/vault/transit/secretBackendKey.go
@@ -83,7 +83,7 @@ type SecretBackendKey struct {
 	// List of key versions in the keyring. This attribute is zero-indexed and will contain a map of values depending on the `type` of the encryption key.
 	// * for key types `aes128-gcm96`, `aes256-gcm96` and `chacha20-poly1305`, each key version will be a map of a single value `id` which is just a hash of the key's metadata.
 	// * for key types `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `rsa-2048`, `rsa-3072` and `rsa-4096`, each key version will be a map of the following:
-	Keys pulumi.MapArrayOutput `pulumi:"keys"`
+	Keys pulumi.StringMapArrayOutput `pulumi:"keys"`
 	// Latest key version available. This value is 1-indexed, so if `latestVersion` is `1`, then the key's information can be referenced from `keys` by selecting element `0`
 	LatestVersion pulumi.IntOutput `pulumi:"latestVersion"`
 	// Minimum key version available for use. If keys have been archived by increasing `minDecryptionVersion`, this attribute will reflect that change.
@@ -166,7 +166,7 @@ type secretBackendKeyState struct {
 	// List of key versions in the keyring. This attribute is zero-indexed and will contain a map of values depending on the `type` of the encryption key.
 	// * for key types `aes128-gcm96`, `aes256-gcm96` and `chacha20-poly1305`, each key version will be a map of a single value `id` which is just a hash of the key's metadata.
 	// * for key types `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `rsa-2048`, `rsa-3072` and `rsa-4096`, each key version will be a map of the following:
-	Keys []map[string]interface{} `pulumi:"keys"`
+	Keys []map[string]string `pulumi:"keys"`
 	// Latest key version available. This value is 1-indexed, so if `latestVersion` is `1`, then the key's information can be referenced from `keys` by selecting element `0`
 	LatestVersion *int `pulumi:"latestVersion"`
 	// Minimum key version available for use. If keys have been archived by increasing `minDecryptionVersion`, this attribute will reflect that change.
@@ -217,7 +217,7 @@ type SecretBackendKeyState struct {
 	// List of key versions in the keyring. This attribute is zero-indexed and will contain a map of values depending on the `type` of the encryption key.
 	// * for key types `aes128-gcm96`, `aes256-gcm96` and `chacha20-poly1305`, each key version will be a map of a single value `id` which is just a hash of the key's metadata.
 	// * for key types `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `rsa-2048`, `rsa-3072` and `rsa-4096`, each key version will be a map of the following:
-	Keys pulumi.MapArrayInput
+	Keys pulumi.StringMapArrayInput
 	// Latest key version available. This value is 1-indexed, so if `latestVersion` is `1`, then the key's information can be referenced from `keys` by selecting element `0`
 	LatestVersion pulumi.IntPtrInput
 	// Minimum key version available for use. If keys have been archived by increasing `minDecryptionVersion`, this attribute will reflect that change.
@@ -453,8 +453,8 @@ func (o SecretBackendKeyOutput) KeySize() pulumi.IntPtrOutput {
 // List of key versions in the keyring. This attribute is zero-indexed and will contain a map of values depending on the `type` of the encryption key.
 // * for key types `aes128-gcm96`, `aes256-gcm96` and `chacha20-poly1305`, each key version will be a map of a single value `id` which is just a hash of the key's metadata.
 // * for key types `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `rsa-2048`, `rsa-3072` and `rsa-4096`, each key version will be a map of the following:
-func (o SecretBackendKeyOutput) Keys() pulumi.MapArrayOutput {
-	return o.ApplyT(func(v *SecretBackendKey) pulumi.MapArrayOutput { return v.Keys }).(pulumi.MapArrayOutput)
+func (o SecretBackendKeyOutput) Keys() pulumi.StringMapArrayOutput {
+	return o.ApplyT(func(v *SecretBackendKey) pulumi.StringMapArrayOutput { return v.Keys }).(pulumi.StringMapArrayOutput)
 }
 
 // Latest key version available. This value is 1-indexed, so if `latestVersion` is `1`, then the key's information can be referenced from `keys` by selecting element `0`
diff --git a/sdk/java/build.gradle b/sdk/java/build.gradle
index 8c6f77f6b..6a3811c74 100644
--- a/sdk/java/build.gradle
+++ b/sdk/java/build.gradle
@@ -44,7 +44,7 @@ repositories {
 dependencies {
     implementation("com.google.code.findbugs:jsr305:3.0.2")
     implementation("com.google.code.gson:gson:2.8.9")
-    implementation("com.pulumi:pulumi:0.14.0")
+    implementation("com.pulumi:pulumi:0.15.0")
 }
 
 task sourcesJar(type: Jar) {
diff --git a/sdk/java/src/main/java/com/pulumi/vault/Mount.java b/sdk/java/src/main/java/com/pulumi/vault/Mount.java
index 6a456e9b2..63a4e186d 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/Mount.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/Mount.java
@@ -12,7 +12,6 @@
 import com.pulumi.vault.inputs.MountState;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -396,14 +395,14 @@ public Output<Optional<String>> namespace() {
      * Specifies mount type specific options that are passed to the backend
      * 
      */
-    @Export(name="options", refs={Map.class,String.class,Object.class}, tree="[0,1,2]")
-    private Output</* @Nullable */ Map<String,Object>> options;
+    @Export(name="options", refs={Map.class,String.class}, tree="[0,1,1]")
+    private Output</* @Nullable */ Map<String,String>> options;
 
     /**
      * @return Specifies mount type specific options that are passed to the backend
      * 
      */
-    public Output<Optional<Map<String,Object>>> options() {
+    public Output<Optional<Map<String,String>>> options() {
         return Codegen.optional(this.options);
     }
     /**
diff --git a/sdk/java/src/main/java/com/pulumi/vault/MountArgs.java b/sdk/java/src/main/java/com/pulumi/vault/MountArgs.java
index 3c8e6074d..6c31f34e2 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/MountArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/MountArgs.java
@@ -8,7 +8,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -235,13 +234,13 @@ public Optional<Output<String>> namespace() {
      * 
      */
     @Import(name="options")
-    private @Nullable Output<Map<String,Object>> options;
+    private @Nullable Output<Map<String,String>> options;
 
     /**
      * @return Specifies mount type specific options that are passed to the backend
      * 
      */
-    public Optional<Output<Map<String,Object>>> options() {
+    public Optional<Output<Map<String,String>>> options() {
         return Optional.ofNullable(this.options);
     }
 
@@ -713,7 +712,7 @@ public Builder namespace(String namespace) {
          * @return builder
          * 
          */
-        public Builder options(@Nullable Output<Map<String,Object>> options) {
+        public Builder options(@Nullable Output<Map<String,String>> options) {
             $.options = options;
             return this;
         }
@@ -724,7 +723,7 @@ public Builder options(@Nullable Output<Map<String,Object>> options) {
          * @return builder
          * 
          */
-        public Builder options(Map<String,Object> options) {
+        public Builder options(Map<String,String> options) {
             return options(Output.of(options));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/Namespace.java b/sdk/java/src/main/java/com/pulumi/vault/Namespace.java
index 34abcc694..234918232 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/Namespace.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/Namespace.java
@@ -10,7 +10,6 @@
 import com.pulumi.vault.NamespaceArgs;
 import com.pulumi.vault.Utilities;
 import com.pulumi.vault.inputs.NamespaceState;
-import java.lang.Object;
 import java.lang.String;
 import java.util.Map;
 import java.util.Optional;
@@ -75,15 +74,15 @@ public class Namespace extends com.pulumi.resources.CustomResource {
      * is `map[string]string`. Requires Vault version 1.12+.
      * 
      */
-    @Export(name="customMetadata", refs={Map.class,String.class,Object.class}, tree="[0,1,2]")
-    private Output<Map<String,Object>> customMetadata;
+    @Export(name="customMetadata", refs={Map.class,String.class}, tree="[0,1,1]")
+    private Output<Map<String,String>> customMetadata;
 
     /**
      * @return Custom metadata describing this namespace. Value type
      * is `map[string]string`. Requires Vault version 1.12+.
      * 
      */
-    public Output<Map<String,Object>> customMetadata() {
+    public Output<Map<String,String>> customMetadata() {
         return this.customMetadata;
     }
     /**
diff --git a/sdk/java/src/main/java/com/pulumi/vault/NamespaceArgs.java b/sdk/java/src/main/java/com/pulumi/vault/NamespaceArgs.java
index afa2719c6..7416b3d98 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/NamespaceArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/NamespaceArgs.java
@@ -6,7 +6,6 @@
 import com.pulumi.core.Output;
 import com.pulumi.core.annotations.Import;
 import com.pulumi.exceptions.MissingRequiredPropertyException;
-import java.lang.Object;
 import java.lang.String;
 import java.util.Map;
 import java.util.Objects;
@@ -24,14 +23,14 @@ public final class NamespaceArgs extends com.pulumi.resources.ResourceArgs {
      * 
      */
     @Import(name="customMetadata")
-    private @Nullable Output<Map<String,Object>> customMetadata;
+    private @Nullable Output<Map<String,String>> customMetadata;
 
     /**
      * @return Custom metadata describing this namespace. Value type
      * is `map[string]string`. Requires Vault version 1.12+.
      * 
      */
-    public Optional<Output<Map<String,Object>>> customMetadata() {
+    public Optional<Output<Map<String,String>>> customMetadata() {
         return Optional.ofNullable(this.customMetadata);
     }
 
@@ -122,7 +121,7 @@ public Builder(NamespaceArgs defaults) {
          * @return builder
          * 
          */
-        public Builder customMetadata(@Nullable Output<Map<String,Object>> customMetadata) {
+        public Builder customMetadata(@Nullable Output<Map<String,String>> customMetadata) {
             $.customMetadata = customMetadata;
             return this;
         }
@@ -134,7 +133,7 @@ public Builder customMetadata(@Nullable Output<Map<String,Object>> customMetadat
          * @return builder
          * 
          */
-        public Builder customMetadata(Map<String,Object> customMetadata) {
+        public Builder customMetadata(Map<String,String> customMetadata) {
             return customMetadata(Output.of(customMetadata));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/aws/AuthBackendLogin.java b/sdk/java/src/main/java/com/pulumi/vault/aws/AuthBackendLogin.java
index 8be60f98b..39a96db4c 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/aws/AuthBackendLogin.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/aws/AuthBackendLogin.java
@@ -12,7 +12,6 @@
 import com.pulumi.vault.aws.inputs.AuthBackendLoginState;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -198,15 +197,15 @@ public Output<String> leaseStartTime() {
      * authentication used to generate this token.
      * 
      */
-    @Export(name="metadata", refs={Map.class,String.class,Object.class}, tree="[0,1,2]")
-    private Output<Map<String,Object>> metadata;
+    @Export(name="metadata", refs={Map.class,String.class}, tree="[0,1,1]")
+    private Output<Map<String,String>> metadata;
 
     /**
      * @return A map of information returned by the Vault server about the
      * authentication used to generate this token.
      * 
      */
-    public Output<Map<String,Object>> metadata() {
+    public Output<Map<String,String>> metadata() {
         return this.metadata;
     }
     /**
diff --git a/sdk/java/src/main/java/com/pulumi/vault/aws/inputs/AuthBackendLoginState.java b/sdk/java/src/main/java/com/pulumi/vault/aws/inputs/AuthBackendLoginState.java
index d6df2c5a0..fffac8146 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/aws/inputs/AuthBackendLoginState.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/aws/inputs/AuthBackendLoginState.java
@@ -7,7 +7,6 @@
 import com.pulumi.core.annotations.Import;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -197,14 +196,14 @@ public Optional<Output<String>> leaseStartTime() {
      * 
      */
     @Import(name="metadata")
-    private @Nullable Output<Map<String,Object>> metadata;
+    private @Nullable Output<Map<String,String>> metadata;
 
     /**
      * @return A map of information returned by the Vault server about the
      * authentication used to generate this token.
      * 
      */
-    public Optional<Output<Map<String,Object>>> metadata() {
+    public Optional<Output<Map<String,String>>> metadata() {
         return Optional.ofNullable(this.metadata);
     }
 
@@ -617,7 +616,7 @@ public Builder leaseStartTime(String leaseStartTime) {
          * @return builder
          * 
          */
-        public Builder metadata(@Nullable Output<Map<String,Object>> metadata) {
+        public Builder metadata(@Nullable Output<Map<String,String>> metadata) {
             $.metadata = metadata;
             return this;
         }
@@ -629,7 +628,7 @@ public Builder metadata(@Nullable Output<Map<String,Object>> metadata) {
          * @return builder
          * 
          */
-        public Builder metadata(Map<String,Object> metadata) {
+        public Builder metadata(Map<String,String> metadata) {
             return metadata(Output.of(metadata));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/config/UiCustomMessage.java b/sdk/java/src/main/java/com/pulumi/vault/config/UiCustomMessage.java
index e10b1173f..6b21b9dd6 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/config/UiCustomMessage.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/config/UiCustomMessage.java
@@ -12,7 +12,6 @@
 import com.pulumi.vault.config.inputs.UiCustomMessageState;
 import com.pulumi.vault.config.outputs.UiCustomMessageLink;
 import java.lang.Boolean;
-import java.lang.Object;
 import java.lang.String;
 import java.util.Map;
 import java.util.Optional;
@@ -94,14 +93,14 @@ public Output<Optional<String>> namespace() {
      * A map containing additional options for the custom message
      * 
      */
-    @Export(name="options", refs={Map.class,String.class,Object.class}, tree="[0,1,2]")
-    private Output</* @Nullable */ Map<String,Object>> options;
+    @Export(name="options", refs={Map.class,String.class}, tree="[0,1,1]")
+    private Output</* @Nullable */ Map<String,String>> options;
 
     /**
      * @return A map containing additional options for the custom message
      * 
      */
-    public Output<Optional<Map<String,Object>>> options() {
+    public Output<Optional<Map<String,String>>> options() {
         return Codegen.optional(this.options);
     }
     /**
diff --git a/sdk/java/src/main/java/com/pulumi/vault/config/UiCustomMessageArgs.java b/sdk/java/src/main/java/com/pulumi/vault/config/UiCustomMessageArgs.java
index 41ab920d2..73d130ee8 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/config/UiCustomMessageArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/config/UiCustomMessageArgs.java
@@ -8,7 +8,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import com.pulumi.vault.config.inputs.UiCustomMessageLinkArgs;
 import java.lang.Boolean;
-import java.lang.Object;
 import java.lang.String;
 import java.util.Map;
 import java.util.Objects;
@@ -100,13 +99,13 @@ public Optional<Output<String>> namespace() {
      * 
      */
     @Import(name="options")
-    private @Nullable Output<Map<String,Object>> options;
+    private @Nullable Output<Map<String,String>> options;
 
     /**
      * @return A map containing additional options for the custom message
      * 
      */
-    public Optional<Output<Map<String,Object>>> options() {
+    public Optional<Output<Map<String,String>>> options() {
         return Optional.ofNullable(this.options);
     }
 
@@ -298,7 +297,7 @@ public Builder namespace(String namespace) {
          * @return builder
          * 
          */
-        public Builder options(@Nullable Output<Map<String,Object>> options) {
+        public Builder options(@Nullable Output<Map<String,String>> options) {
             $.options = options;
             return this;
         }
@@ -309,7 +308,7 @@ public Builder options(@Nullable Output<Map<String,Object>> options) {
          * @return builder
          * 
          */
-        public Builder options(Map<String,Object> options) {
+        public Builder options(Map<String,String> options) {
             return options(Output.of(options));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/config/inputs/UiCustomMessageState.java b/sdk/java/src/main/java/com/pulumi/vault/config/inputs/UiCustomMessageState.java
index 2bf6c9324..d51dea778 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/config/inputs/UiCustomMessageState.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/config/inputs/UiCustomMessageState.java
@@ -7,7 +7,6 @@
 import com.pulumi.core.annotations.Import;
 import com.pulumi.vault.config.inputs.UiCustomMessageLinkArgs;
 import java.lang.Boolean;
-import java.lang.Object;
 import java.lang.String;
 import java.util.Map;
 import java.util.Objects;
@@ -99,13 +98,13 @@ public Optional<Output<String>> namespace() {
      * 
      */
     @Import(name="options")
-    private @Nullable Output<Map<String,Object>> options;
+    private @Nullable Output<Map<String,String>> options;
 
     /**
      * @return A map containing additional options for the custom message
      * 
      */
-    public Optional<Output<Map<String,Object>>> options() {
+    public Optional<Output<Map<String,String>>> options() {
         return Optional.ofNullable(this.options);
     }
 
@@ -297,7 +296,7 @@ public Builder namespace(String namespace) {
          * @return builder
          * 
          */
-        public Builder options(@Nullable Output<Map<String,Object>> options) {
+        public Builder options(@Nullable Output<Map<String,String>> options) {
             $.options = options;
             return this;
         }
@@ -308,7 +307,7 @@ public Builder options(@Nullable Output<Map<String,Object>> options) {
          * @return builder
          * 
          */
-        public Builder options(Map<String,Object> options) {
+        public Builder options(Map<String,String> options) {
             return options(Output.of(options));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/SecretBackendConnection.java b/sdk/java/src/main/java/com/pulumi/vault/database/SecretBackendConnection.java
index 27fdb25b0..963346b7f 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/SecretBackendConnection.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/SecretBackendConnection.java
@@ -29,7 +29,6 @@
 import com.pulumi.vault.database.outputs.SecretBackendConnectionRedshift;
 import com.pulumi.vault.database.outputs.SecretBackendConnectionSnowflake;
 import java.lang.Boolean;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -160,14 +159,14 @@ public Output<Optional<SecretBackendConnectionCouchbase>> couchbase() {
      * A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
      * 
      */
-    @Export(name="data", refs={Map.class,String.class,Object.class}, tree="[0,1,2]")
-    private Output</* @Nullable */ Map<String,Object>> data;
+    @Export(name="data", refs={Map.class,String.class}, tree="[0,1,1]")
+    private Output</* @Nullable */ Map<String,String>> data;
 
     /**
      * @return A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
      * 
      */
-    public Output<Optional<Map<String,Object>>> data() {
+    public Output<Optional<Map<String,String>>> data() {
         return Codegen.optional(this.data);
     }
     /**
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/SecretBackendConnectionArgs.java b/sdk/java/src/main/java/com/pulumi/vault/database/SecretBackendConnectionArgs.java
index c39490a01..713d4a647 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/SecretBackendConnectionArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/SecretBackendConnectionArgs.java
@@ -25,7 +25,6 @@
 import com.pulumi.vault.database.inputs.SecretBackendConnectionRedshiftArgs;
 import com.pulumi.vault.database.inputs.SecretBackendConnectionSnowflakeArgs;
 import java.lang.Boolean;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -105,13 +104,13 @@ public Optional<Output<SecretBackendConnectionCouchbaseArgs>> couchbase() {
      * 
      */
     @Import(name="data")
-    private @Nullable Output<Map<String,Object>> data;
+    private @Nullable Output<Map<String,String>> data;
 
     /**
      * @return A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
      * 
      */
-    public Optional<Output<Map<String,Object>>> data() {
+    public Optional<Output<Map<String,String>>> data() {
         return Optional.ofNullable(this.data);
     }
 
@@ -594,7 +593,7 @@ public Builder couchbase(SecretBackendConnectionCouchbaseArgs couchbase) {
          * @return builder
          * 
          */
-        public Builder data(@Nullable Output<Map<String,Object>> data) {
+        public Builder data(@Nullable Output<Map<String,String>> data) {
             $.data = data;
             return this;
         }
@@ -605,7 +604,7 @@ public Builder data(@Nullable Output<Map<String,Object>> data) {
          * @return builder
          * 
          */
-        public Builder data(Map<String,Object> data) {
+        public Builder data(Map<String,String> data) {
             return data(Output.of(data));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/SecretBackendRole.java b/sdk/java/src/main/java/com/pulumi/vault/database/SecretBackendRole.java
index 8440ed306..cad56bd0c 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/SecretBackendRole.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/SecretBackendRole.java
@@ -11,7 +11,6 @@
 import com.pulumi.vault.database.SecretBackendRoleArgs;
 import com.pulumi.vault.database.inputs.SecretBackendRoleState;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -126,8 +125,8 @@ public Output<List<String>> creationStatements() {
      * The following options are available for each `credential_type` value:
      * 
      */
-    @Export(name="credentialConfig", refs={Map.class,String.class,Object.class}, tree="[0,1,2]")
-    private Output</* @Nullable */ Map<String,Object>> credentialConfig;
+    @Export(name="credentialConfig", refs={Map.class,String.class}, tree="[0,1,1]")
+    private Output</* @Nullable */ Map<String,String>> credentialConfig;
 
     /**
      * @return Specifies the configuration
@@ -136,7 +135,7 @@ public Output<List<String>> creationStatements() {
      * The following options are available for each `credential_type` value:
      * 
      */
-    public Output<Optional<Map<String,Object>>> credentialConfig() {
+    public Output<Optional<Map<String,String>>> credentialConfig() {
         return Codegen.optional(this.credentialConfig);
     }
     /**
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/SecretBackendRoleArgs.java b/sdk/java/src/main/java/com/pulumi/vault/database/SecretBackendRoleArgs.java
index d81c59254..463a6fadb 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/SecretBackendRoleArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/SecretBackendRoleArgs.java
@@ -7,7 +7,6 @@
 import com.pulumi.core.annotations.Import;
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -60,7 +59,7 @@ public Output<List<String>> creationStatements() {
      * 
      */
     @Import(name="credentialConfig")
-    private @Nullable Output<Map<String,Object>> credentialConfig;
+    private @Nullable Output<Map<String,String>> credentialConfig;
 
     /**
      * @return Specifies the configuration
@@ -69,7 +68,7 @@ public Output<List<String>> creationStatements() {
      * The following options are available for each `credential_type` value:
      * 
      */
-    public Optional<Output<Map<String,Object>>> credentialConfig() {
+    public Optional<Output<Map<String,String>>> credentialConfig() {
         return Optional.ofNullable(this.credentialConfig);
     }
 
@@ -329,7 +328,7 @@ public Builder creationStatements(String... creationStatements) {
          * @return builder
          * 
          */
-        public Builder credentialConfig(@Nullable Output<Map<String,Object>> credentialConfig) {
+        public Builder credentialConfig(@Nullable Output<Map<String,String>> credentialConfig) {
             $.credentialConfig = credentialConfig;
             return this;
         }
@@ -343,7 +342,7 @@ public Builder credentialConfig(@Nullable Output<Map<String,Object>> credentialC
          * @return builder
          * 
          */
-        public Builder credentialConfig(Map<String,Object> credentialConfig) {
+        public Builder credentialConfig(Map<String,String> credentialConfig) {
             return credentialConfig(Output.of(credentialConfig));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/SecretsMount.java b/sdk/java/src/main/java/com/pulumi/vault/database/SecretsMount.java
index 672f69cbd..72459add0 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/SecretsMount.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/SecretsMount.java
@@ -30,7 +30,6 @@
 import com.pulumi.vault.database.outputs.SecretsMountSnowflake;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -532,14 +531,14 @@ public Output<Optional<String>> namespace() {
      * Specifies mount type specific options that are passed to the backend
      * 
      */
-    @Export(name="options", refs={Map.class,String.class,Object.class}, tree="[0,1,2]")
-    private Output</* @Nullable */ Map<String,Object>> options;
+    @Export(name="options", refs={Map.class,String.class}, tree="[0,1,1]")
+    private Output</* @Nullable */ Map<String,String>> options;
 
     /**
      * @return Specifies mount type specific options that are passed to the backend
      * 
      */
-    public Output<Optional<Map<String,Object>>> options() {
+    public Output<Optional<Map<String,String>>> options() {
         return Codegen.optional(this.options);
     }
     /**
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/SecretsMountArgs.java b/sdk/java/src/main/java/com/pulumi/vault/database/SecretsMountArgs.java
index fe2a9738d..c5fd8c3a6 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/SecretsMountArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/SecretsMountArgs.java
@@ -26,7 +26,6 @@
 import com.pulumi.vault.database.inputs.SecretsMountSnowflakeArgs;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -447,13 +446,13 @@ public Optional<Output<String>> namespace() {
      * 
      */
     @Import(name="options")
-    private @Nullable Output<Map<String,Object>> options;
+    private @Nullable Output<Map<String,String>> options;
 
     /**
      * @return Specifies mount type specific options that are passed to the backend
      * 
      */
-    public Optional<Output<Map<String,Object>>> options() {
+    public Optional<Output<Map<String,String>>> options() {
         return Optional.ofNullable(this.options);
     }
 
@@ -1421,7 +1420,7 @@ public Builder namespace(String namespace) {
          * @return builder
          * 
          */
-        public Builder options(@Nullable Output<Map<String,Object>> options) {
+        public Builder options(@Nullable Output<Map<String,String>> options) {
             $.options = options;
             return this;
         }
@@ -1432,7 +1431,7 @@ public Builder options(@Nullable Output<Map<String,Object>> options) {
          * @return builder
          * 
          */
-        public Builder options(Map<String,Object> options) {
+        public Builder options(Map<String,String> options) {
             return options(Output.of(options));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretBackendConnectionState.java b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretBackendConnectionState.java
index 348eca8bc..e8161db05 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretBackendConnectionState.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretBackendConnectionState.java
@@ -24,7 +24,6 @@
 import com.pulumi.vault.database.inputs.SecretBackendConnectionRedshiftArgs;
 import com.pulumi.vault.database.inputs.SecretBackendConnectionSnowflakeArgs;
 import java.lang.Boolean;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -104,13 +103,13 @@ public Optional<Output<SecretBackendConnectionCouchbaseArgs>> couchbase() {
      * 
      */
     @Import(name="data")
-    private @Nullable Output<Map<String,Object>> data;
+    private @Nullable Output<Map<String,String>> data;
 
     /**
      * @return A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
      * 
      */
-    public Optional<Output<Map<String,Object>>> data() {
+    public Optional<Output<Map<String,String>>> data() {
         return Optional.ofNullable(this.data);
     }
 
@@ -593,7 +592,7 @@ public Builder couchbase(SecretBackendConnectionCouchbaseArgs couchbase) {
          * @return builder
          * 
          */
-        public Builder data(@Nullable Output<Map<String,Object>> data) {
+        public Builder data(@Nullable Output<Map<String,String>> data) {
             $.data = data;
             return this;
         }
@@ -604,7 +603,7 @@ public Builder data(@Nullable Output<Map<String,Object>> data) {
          * @return builder
          * 
          */
-        public Builder data(Map<String,Object> data) {
+        public Builder data(Map<String,String> data) {
             return data(Output.of(data));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretBackendRoleState.java b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretBackendRoleState.java
index d0aad4df8..6ff2f6fda 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretBackendRoleState.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretBackendRoleState.java
@@ -6,7 +6,6 @@
 import com.pulumi.core.Output;
 import com.pulumi.core.annotations.Import;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -59,7 +58,7 @@ public Optional<Output<List<String>>> creationStatements() {
      * 
      */
     @Import(name="credentialConfig")
-    private @Nullable Output<Map<String,Object>> credentialConfig;
+    private @Nullable Output<Map<String,String>> credentialConfig;
 
     /**
      * @return Specifies the configuration
@@ -68,7 +67,7 @@ public Optional<Output<List<String>>> creationStatements() {
      * The following options are available for each `credential_type` value:
      * 
      */
-    public Optional<Output<Map<String,Object>>> credentialConfig() {
+    public Optional<Output<Map<String,String>>> credentialConfig() {
         return Optional.ofNullable(this.credentialConfig);
     }
 
@@ -328,7 +327,7 @@ public Builder creationStatements(String... creationStatements) {
          * @return builder
          * 
          */
-        public Builder credentialConfig(@Nullable Output<Map<String,Object>> credentialConfig) {
+        public Builder credentialConfig(@Nullable Output<Map<String,String>> credentialConfig) {
             $.credentialConfig = credentialConfig;
             return this;
         }
@@ -342,7 +341,7 @@ public Builder credentialConfig(@Nullable Output<Map<String,Object>> credentialC
          * @return builder
          * 
          */
-        public Builder credentialConfig(Map<String,Object> credentialConfig) {
+        public Builder credentialConfig(Map<String,String> credentialConfig) {
             return credentialConfig(Output.of(credentialConfig));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountCassandraArgs.java b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountCassandraArgs.java
index 7ed12e405..713211c0c 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountCassandraArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountCassandraArgs.java
@@ -8,7 +8,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -60,7 +59,7 @@ public Optional<Output<Integer>> connectTimeout() {
      * 
      */
     @Import(name="data")
-    private @Nullable Output<Map<String,Object>> data;
+    private @Nullable Output<Map<String,String>> data;
 
     /**
      * @return A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
@@ -68,7 +67,7 @@ public Optional<Output<Integer>> connectTimeout() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Optional<Output<Map<String,Object>>> data() {
+    public Optional<Output<Map<String,String>>> data() {
         return Optional.ofNullable(this.data);
     }
 
@@ -371,7 +370,7 @@ public Builder connectTimeout(Integer connectTimeout) {
          * @return builder
          * 
          */
-        public Builder data(@Nullable Output<Map<String,Object>> data) {
+        public Builder data(@Nullable Output<Map<String,String>> data) {
             $.data = data;
             return this;
         }
@@ -384,7 +383,7 @@ public Builder data(@Nullable Output<Map<String,Object>> data) {
          * @return builder
          * 
          */
-        public Builder data(Map<String,Object> data) {
+        public Builder data(Map<String,String> data) {
             return data(Output.of(data));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountCouchbaseArgs.java b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountCouchbaseArgs.java
index 9f4a54949..9e09c8bea 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountCouchbaseArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountCouchbaseArgs.java
@@ -7,7 +7,6 @@
 import com.pulumi.core.annotations.Import;
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -74,7 +73,7 @@ public Optional<Output<String>> bucketName() {
      * 
      */
     @Import(name="data")
-    private @Nullable Output<Map<String,Object>> data;
+    private @Nullable Output<Map<String,String>> data;
 
     /**
      * @return A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
@@ -82,7 +81,7 @@ public Optional<Output<String>> bucketName() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Optional<Output<Map<String,Object>>> data() {
+    public Optional<Output<Map<String,String>>> data() {
         return Optional.ofNullable(this.data);
     }
 
@@ -359,7 +358,7 @@ public Builder bucketName(String bucketName) {
          * @return builder
          * 
          */
-        public Builder data(@Nullable Output<Map<String,Object>> data) {
+        public Builder data(@Nullable Output<Map<String,String>> data) {
             $.data = data;
             return this;
         }
@@ -372,7 +371,7 @@ public Builder data(@Nullable Output<Map<String,Object>> data) {
          * @return builder
          * 
          */
-        public Builder data(Map<String,Object> data) {
+        public Builder data(Map<String,String> data) {
             return data(Output.of(data));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountElasticsearchArgs.java b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountElasticsearchArgs.java
index e2b5f787c..8d6ccbe9f 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountElasticsearchArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountElasticsearchArgs.java
@@ -7,7 +7,6 @@
 import com.pulumi.core.annotations.Import;
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -104,7 +103,7 @@ public Optional<Output<String>> clientKey() {
      * 
      */
     @Import(name="data")
-    private @Nullable Output<Map<String,Object>> data;
+    private @Nullable Output<Map<String,String>> data;
 
     /**
      * @return A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
@@ -112,7 +111,7 @@ public Optional<Output<String>> clientKey() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Optional<Output<Map<String,Object>>> data() {
+    public Optional<Output<Map<String,String>>> data() {
         return Optional.ofNullable(this.data);
     }
 
@@ -433,7 +432,7 @@ public Builder clientKey(String clientKey) {
          * @return builder
          * 
          */
-        public Builder data(@Nullable Output<Map<String,Object>> data) {
+        public Builder data(@Nullable Output<Map<String,String>> data) {
             $.data = data;
             return this;
         }
@@ -446,7 +445,7 @@ public Builder data(@Nullable Output<Map<String,Object>> data) {
          * @return builder
          * 
          */
-        public Builder data(Map<String,Object> data) {
+        public Builder data(Map<String,String> data) {
             return data(Output.of(data));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountHanaArgs.java b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountHanaArgs.java
index acaa9460a..a819cdf18 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountHanaArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountHanaArgs.java
@@ -8,7 +8,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -60,7 +59,7 @@ public Optional<Output<String>> connectionUrl() {
      * 
      */
     @Import(name="data")
-    private @Nullable Output<Map<String,Object>> data;
+    private @Nullable Output<Map<String,String>> data;
 
     /**
      * @return A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
@@ -68,7 +67,7 @@ public Optional<Output<String>> connectionUrl() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Optional<Output<Map<String,Object>>> data() {
+    public Optional<Output<Map<String,String>>> data() {
         return Optional.ofNullable(this.data);
     }
 
@@ -323,7 +322,7 @@ public Builder connectionUrl(String connectionUrl) {
          * @return builder
          * 
          */
-        public Builder data(@Nullable Output<Map<String,Object>> data) {
+        public Builder data(@Nullable Output<Map<String,String>> data) {
             $.data = data;
             return this;
         }
@@ -336,7 +335,7 @@ public Builder data(@Nullable Output<Map<String,Object>> data) {
          * @return builder
          * 
          */
-        public Builder data(Map<String,Object> data) {
+        public Builder data(Map<String,String> data) {
             return data(Output.of(data));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountInfluxdbArgs.java b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountInfluxdbArgs.java
index 47a250648..d0f8feed7 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountInfluxdbArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountInfluxdbArgs.java
@@ -8,7 +8,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -60,7 +59,7 @@ public Optional<Output<Integer>> connectTimeout() {
      * 
      */
     @Import(name="data")
-    private @Nullable Output<Map<String,Object>> data;
+    private @Nullable Output<Map<String,String>> data;
 
     /**
      * @return A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
@@ -68,7 +67,7 @@ public Optional<Output<Integer>> connectTimeout() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Optional<Output<Map<String,Object>>> data() {
+    public Optional<Output<Map<String,String>>> data() {
         return Optional.ofNullable(this.data);
     }
 
@@ -371,7 +370,7 @@ public Builder connectTimeout(Integer connectTimeout) {
          * @return builder
          * 
          */
-        public Builder data(@Nullable Output<Map<String,Object>> data) {
+        public Builder data(@Nullable Output<Map<String,String>> data) {
             $.data = data;
             return this;
         }
@@ -384,7 +383,7 @@ public Builder data(@Nullable Output<Map<String,Object>> data) {
          * @return builder
          * 
          */
-        public Builder data(Map<String,Object> data) {
+        public Builder data(Map<String,String> data) {
             return data(Output.of(data));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountMongodbArgs.java b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountMongodbArgs.java
index a806265c4..2f960d08d 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountMongodbArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountMongodbArgs.java
@@ -8,7 +8,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -60,7 +59,7 @@ public Optional<Output<String>> connectionUrl() {
      * 
      */
     @Import(name="data")
-    private @Nullable Output<Map<String,Object>> data;
+    private @Nullable Output<Map<String,String>> data;
 
     /**
      * @return A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
@@ -68,7 +67,7 @@ public Optional<Output<String>> connectionUrl() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Optional<Output<Map<String,Object>>> data() {
+    public Optional<Output<Map<String,String>>> data() {
         return Optional.ofNullable(this.data);
     }
 
@@ -323,7 +322,7 @@ public Builder connectionUrl(String connectionUrl) {
          * @return builder
          * 
          */
-        public Builder data(@Nullable Output<Map<String,Object>> data) {
+        public Builder data(@Nullable Output<Map<String,String>> data) {
             $.data = data;
             return this;
         }
@@ -336,7 +335,7 @@ public Builder data(@Nullable Output<Map<String,Object>> data) {
          * @return builder
          * 
          */
-        public Builder data(Map<String,Object> data) {
+        public Builder data(Map<String,String> data) {
             return data(Output.of(data));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountMongodbatlaArgs.java b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountMongodbatlaArgs.java
index 7837832ca..17801dd27 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountMongodbatlaArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountMongodbatlaArgs.java
@@ -7,7 +7,6 @@
 import com.pulumi.core.annotations.Import;
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -44,7 +43,7 @@ public Optional<Output<List<String>>> allowedRoles() {
      * 
      */
     @Import(name="data")
-    private @Nullable Output<Map<String,Object>> data;
+    private @Nullable Output<Map<String,String>> data;
 
     /**
      * @return A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
@@ -52,7 +51,7 @@ public Optional<Output<List<String>>> allowedRoles() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Optional<Output<Map<String,Object>>> data() {
+    public Optional<Output<Map<String,String>>> data() {
         return Optional.ofNullable(this.data);
     }
 
@@ -237,7 +236,7 @@ public Builder allowedRoles(String... allowedRoles) {
          * @return builder
          * 
          */
-        public Builder data(@Nullable Output<Map<String,Object>> data) {
+        public Builder data(@Nullable Output<Map<String,String>> data) {
             $.data = data;
             return this;
         }
@@ -250,7 +249,7 @@ public Builder data(@Nullable Output<Map<String,Object>> data) {
          * @return builder
          * 
          */
-        public Builder data(Map<String,Object> data) {
+        public Builder data(Map<String,String> data) {
             return data(Output.of(data));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountMssqlArgs.java b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountMssqlArgs.java
index cb214d185..44d8c66db 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountMssqlArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountMssqlArgs.java
@@ -8,7 +8,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -75,7 +74,7 @@ public Optional<Output<Boolean>> containedDb() {
      * 
      */
     @Import(name="data")
-    private @Nullable Output<Map<String,Object>> data;
+    private @Nullable Output<Map<String,String>> data;
 
     /**
      * @return A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
@@ -83,7 +82,7 @@ public Optional<Output<Boolean>> containedDb() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Optional<Output<Map<String,Object>>> data() {
+    public Optional<Output<Map<String,String>>> data() {
         return Optional.ofNullable(this.data);
     }
 
@@ -376,7 +375,7 @@ public Builder containedDb(Boolean containedDb) {
          * @return builder
          * 
          */
-        public Builder data(@Nullable Output<Map<String,Object>> data) {
+        public Builder data(@Nullable Output<Map<String,String>> data) {
             $.data = data;
             return this;
         }
@@ -389,7 +388,7 @@ public Builder data(@Nullable Output<Map<String,Object>> data) {
          * @return builder
          * 
          */
-        public Builder data(Map<String,Object> data) {
+        public Builder data(Map<String,String> data) {
             return data(Output.of(data));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountMysqlArgs.java b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountMysqlArgs.java
index 2c27040ff..20826b4b8 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountMysqlArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountMysqlArgs.java
@@ -8,7 +8,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -75,7 +74,7 @@ public Optional<Output<String>> connectionUrl() {
      * 
      */
     @Import(name="data")
-    private @Nullable Output<Map<String,Object>> data;
+    private @Nullable Output<Map<String,String>> data;
 
     /**
      * @return A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
@@ -83,7 +82,7 @@ public Optional<Output<String>> connectionUrl() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Optional<Output<Map<String,Object>>> data() {
+    public Optional<Output<Map<String,String>>> data() {
         return Optional.ofNullable(this.data);
     }
 
@@ -408,7 +407,7 @@ public Builder connectionUrl(String connectionUrl) {
          * @return builder
          * 
          */
-        public Builder data(@Nullable Output<Map<String,Object>> data) {
+        public Builder data(@Nullable Output<Map<String,String>> data) {
             $.data = data;
             return this;
         }
@@ -421,7 +420,7 @@ public Builder data(@Nullable Output<Map<String,Object>> data) {
          * @return builder
          * 
          */
-        public Builder data(Map<String,Object> data) {
+        public Builder data(Map<String,String> data) {
             return data(Output.of(data));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountMysqlAuroraArgs.java b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountMysqlAuroraArgs.java
index cd9b4906d..2bca89d32 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountMysqlAuroraArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountMysqlAuroraArgs.java
@@ -8,7 +8,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -75,7 +74,7 @@ public Optional<Output<String>> connectionUrl() {
      * 
      */
     @Import(name="data")
-    private @Nullable Output<Map<String,Object>> data;
+    private @Nullable Output<Map<String,String>> data;
 
     /**
      * @return A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
@@ -83,7 +82,7 @@ public Optional<Output<String>> connectionUrl() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Optional<Output<Map<String,Object>>> data() {
+    public Optional<Output<Map<String,String>>> data() {
         return Optional.ofNullable(this.data);
     }
 
@@ -408,7 +407,7 @@ public Builder connectionUrl(String connectionUrl) {
          * @return builder
          * 
          */
-        public Builder data(@Nullable Output<Map<String,Object>> data) {
+        public Builder data(@Nullable Output<Map<String,String>> data) {
             $.data = data;
             return this;
         }
@@ -421,7 +420,7 @@ public Builder data(@Nullable Output<Map<String,Object>> data) {
          * @return builder
          * 
          */
-        public Builder data(Map<String,Object> data) {
+        public Builder data(Map<String,String> data) {
             return data(Output.of(data));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountMysqlLegacyArgs.java b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountMysqlLegacyArgs.java
index 9dd99a0e5..86c398abc 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountMysqlLegacyArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountMysqlLegacyArgs.java
@@ -8,7 +8,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -75,7 +74,7 @@ public Optional<Output<String>> connectionUrl() {
      * 
      */
     @Import(name="data")
-    private @Nullable Output<Map<String,Object>> data;
+    private @Nullable Output<Map<String,String>> data;
 
     /**
      * @return A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
@@ -83,7 +82,7 @@ public Optional<Output<String>> connectionUrl() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Optional<Output<Map<String,Object>>> data() {
+    public Optional<Output<Map<String,String>>> data() {
         return Optional.ofNullable(this.data);
     }
 
@@ -408,7 +407,7 @@ public Builder connectionUrl(String connectionUrl) {
          * @return builder
          * 
          */
-        public Builder data(@Nullable Output<Map<String,Object>> data) {
+        public Builder data(@Nullable Output<Map<String,String>> data) {
             $.data = data;
             return this;
         }
@@ -421,7 +420,7 @@ public Builder data(@Nullable Output<Map<String,Object>> data) {
          * @return builder
          * 
          */
-        public Builder data(Map<String,Object> data) {
+        public Builder data(Map<String,String> data) {
             return data(Output.of(data));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountMysqlRdArgs.java b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountMysqlRdArgs.java
index ff6450fd0..fffde2feb 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountMysqlRdArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountMysqlRdArgs.java
@@ -8,7 +8,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -75,7 +74,7 @@ public Optional<Output<String>> connectionUrl() {
      * 
      */
     @Import(name="data")
-    private @Nullable Output<Map<String,Object>> data;
+    private @Nullable Output<Map<String,String>> data;
 
     /**
      * @return A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
@@ -83,7 +82,7 @@ public Optional<Output<String>> connectionUrl() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Optional<Output<Map<String,Object>>> data() {
+    public Optional<Output<Map<String,String>>> data() {
         return Optional.ofNullable(this.data);
     }
 
@@ -408,7 +407,7 @@ public Builder connectionUrl(String connectionUrl) {
          * @return builder
          * 
          */
-        public Builder data(@Nullable Output<Map<String,Object>> data) {
+        public Builder data(@Nullable Output<Map<String,String>> data) {
             $.data = data;
             return this;
         }
@@ -421,7 +420,7 @@ public Builder data(@Nullable Output<Map<String,Object>> data) {
          * @return builder
          * 
          */
-        public Builder data(Map<String,Object> data) {
+        public Builder data(Map<String,String> data) {
             return data(Output.of(data));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountOracleArgs.java b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountOracleArgs.java
index 8e7f3eedb..f6ac0d9c7 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountOracleArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountOracleArgs.java
@@ -8,7 +8,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -60,7 +59,7 @@ public Optional<Output<String>> connectionUrl() {
      * 
      */
     @Import(name="data")
-    private @Nullable Output<Map<String,Object>> data;
+    private @Nullable Output<Map<String,String>> data;
 
     /**
      * @return A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
@@ -68,7 +67,7 @@ public Optional<Output<String>> connectionUrl() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Optional<Output<Map<String,Object>>> data() {
+    public Optional<Output<Map<String,String>>> data() {
         return Optional.ofNullable(this.data);
     }
 
@@ -355,7 +354,7 @@ public Builder connectionUrl(String connectionUrl) {
          * @return builder
          * 
          */
-        public Builder data(@Nullable Output<Map<String,Object>> data) {
+        public Builder data(@Nullable Output<Map<String,String>> data) {
             $.data = data;
             return this;
         }
@@ -368,7 +367,7 @@ public Builder data(@Nullable Output<Map<String,Object>> data) {
          * @return builder
          * 
          */
-        public Builder data(Map<String,Object> data) {
+        public Builder data(Map<String,String> data) {
             return data(Output.of(data));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountPostgresqlArgs.java b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountPostgresqlArgs.java
index 853621617..68837e37a 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountPostgresqlArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountPostgresqlArgs.java
@@ -8,7 +8,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -75,7 +74,7 @@ public Optional<Output<String>> connectionUrl() {
      * 
      */
     @Import(name="data")
-    private @Nullable Output<Map<String,Object>> data;
+    private @Nullable Output<Map<String,String>> data;
 
     /**
      * @return A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
@@ -83,7 +82,7 @@ public Optional<Output<String>> connectionUrl() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Optional<Output<Map<String,Object>>> data() {
+    public Optional<Output<Map<String,String>>> data() {
         return Optional.ofNullable(this.data);
     }
 
@@ -392,7 +391,7 @@ public Builder connectionUrl(String connectionUrl) {
          * @return builder
          * 
          */
-        public Builder data(@Nullable Output<Map<String,Object>> data) {
+        public Builder data(@Nullable Output<Map<String,String>> data) {
             $.data = data;
             return this;
         }
@@ -405,7 +404,7 @@ public Builder data(@Nullable Output<Map<String,Object>> data) {
          * @return builder
          * 
          */
-        public Builder data(Map<String,Object> data) {
+        public Builder data(Map<String,String> data) {
             return data(Output.of(data));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountRediArgs.java b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountRediArgs.java
index 1d852c0c2..911ba8d9b 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountRediArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountRediArgs.java
@@ -8,7 +8,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -60,7 +59,7 @@ public Optional<Output<String>> caCert() {
      * 
      */
     @Import(name="data")
-    private @Nullable Output<Map<String,Object>> data;
+    private @Nullable Output<Map<String,String>> data;
 
     /**
      * @return A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
@@ -68,7 +67,7 @@ public Optional<Output<String>> caCert() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Optional<Output<Map<String,Object>>> data() {
+    public Optional<Output<Map<String,String>>> data() {
         return Optional.ofNullable(this.data);
     }
 
@@ -323,7 +322,7 @@ public Builder caCert(String caCert) {
          * @return builder
          * 
          */
-        public Builder data(@Nullable Output<Map<String,Object>> data) {
+        public Builder data(@Nullable Output<Map<String,String>> data) {
             $.data = data;
             return this;
         }
@@ -336,7 +335,7 @@ public Builder data(@Nullable Output<Map<String,Object>> data) {
          * @return builder
          * 
          */
-        public Builder data(Map<String,Object> data) {
+        public Builder data(Map<String,String> data) {
             return data(Output.of(data));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountRedisElasticachArgs.java b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountRedisElasticachArgs.java
index 5b0540732..a425fa8e3 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountRedisElasticachArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountRedisElasticachArgs.java
@@ -7,7 +7,6 @@
 import com.pulumi.core.annotations.Import;
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -44,7 +43,7 @@ public Optional<Output<List<String>>> allowedRoles() {
      * 
      */
     @Import(name="data")
-    private @Nullable Output<Map<String,Object>> data;
+    private @Nullable Output<Map<String,String>> data;
 
     /**
      * @return A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
@@ -52,7 +51,7 @@ public Optional<Output<List<String>>> allowedRoles() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Optional<Output<Map<String,Object>>> data() {
+    public Optional<Output<Map<String,String>>> data() {
         return Optional.ofNullable(this.data);
     }
 
@@ -253,7 +252,7 @@ public Builder allowedRoles(String... allowedRoles) {
          * @return builder
          * 
          */
-        public Builder data(@Nullable Output<Map<String,Object>> data) {
+        public Builder data(@Nullable Output<Map<String,String>> data) {
             $.data = data;
             return this;
         }
@@ -266,7 +265,7 @@ public Builder data(@Nullable Output<Map<String,Object>> data) {
          * @return builder
          * 
          */
-        public Builder data(Map<String,Object> data) {
+        public Builder data(Map<String,String> data) {
             return data(Output.of(data));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountRedshiftArgs.java b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountRedshiftArgs.java
index 8fe4db813..33905581b 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountRedshiftArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountRedshiftArgs.java
@@ -8,7 +8,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -60,7 +59,7 @@ public Optional<Output<String>> connectionUrl() {
      * 
      */
     @Import(name="data")
-    private @Nullable Output<Map<String,Object>> data;
+    private @Nullable Output<Map<String,String>> data;
 
     /**
      * @return A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
@@ -68,7 +67,7 @@ public Optional<Output<String>> connectionUrl() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Optional<Output<Map<String,Object>>> data() {
+    public Optional<Output<Map<String,String>>> data() {
         return Optional.ofNullable(this.data);
     }
 
@@ -339,7 +338,7 @@ public Builder connectionUrl(String connectionUrl) {
          * @return builder
          * 
          */
-        public Builder data(@Nullable Output<Map<String,Object>> data) {
+        public Builder data(@Nullable Output<Map<String,String>> data) {
             $.data = data;
             return this;
         }
@@ -352,7 +351,7 @@ public Builder data(@Nullable Output<Map<String,Object>> data) {
          * @return builder
          * 
          */
-        public Builder data(Map<String,Object> data) {
+        public Builder data(Map<String,String> data) {
             return data(Output.of(data));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountSnowflakeArgs.java b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountSnowflakeArgs.java
index 100fa0ebd..99a27acfc 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountSnowflakeArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountSnowflakeArgs.java
@@ -8,7 +8,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -60,7 +59,7 @@ public Optional<Output<String>> connectionUrl() {
      * 
      */
     @Import(name="data")
-    private @Nullable Output<Map<String,Object>> data;
+    private @Nullable Output<Map<String,String>> data;
 
     /**
      * @return A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
@@ -68,7 +67,7 @@ public Optional<Output<String>> connectionUrl() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Optional<Output<Map<String,Object>>> data() {
+    public Optional<Output<Map<String,String>>> data() {
         return Optional.ofNullable(this.data);
     }
 
@@ -323,7 +322,7 @@ public Builder connectionUrl(String connectionUrl) {
          * @return builder
          * 
          */
-        public Builder data(@Nullable Output<Map<String,Object>> data) {
+        public Builder data(@Nullable Output<Map<String,String>> data) {
             $.data = data;
             return this;
         }
@@ -336,7 +335,7 @@ public Builder data(@Nullable Output<Map<String,Object>> data) {
          * @return builder
          * 
          */
-        public Builder data(Map<String,Object> data) {
+        public Builder data(Map<String,String> data) {
             return data(Output.of(data));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountState.java b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountState.java
index c5a1174c1..5ab54cdfc 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountState.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/inputs/SecretsMountState.java
@@ -25,7 +25,6 @@
 import com.pulumi.vault.database.inputs.SecretsMountSnowflakeArgs;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -476,13 +475,13 @@ public Optional<Output<String>> namespace() {
      * 
      */
     @Import(name="options")
-    private @Nullable Output<Map<String,Object>> options;
+    private @Nullable Output<Map<String,String>> options;
 
     /**
      * @return Specifies mount type specific options that are passed to the backend
      * 
      */
-    public Optional<Output<Map<String,Object>>> options() {
+    public Optional<Output<Map<String,String>>> options() {
         return Optional.ofNullable(this.options);
     }
 
@@ -1494,7 +1493,7 @@ public Builder namespace(String namespace) {
          * @return builder
          * 
          */
-        public Builder options(@Nullable Output<Map<String,Object>> options) {
+        public Builder options(@Nullable Output<Map<String,String>> options) {
             $.options = options;
             return this;
         }
@@ -1505,7 +1504,7 @@ public Builder options(@Nullable Output<Map<String,Object>> options) {
          * @return builder
          * 
          */
-        public Builder options(Map<String,Object> options) {
+        public Builder options(Map<String,String> options) {
             return options(Output.of(options));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountCassandra.java b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountCassandra.java
index 8606d46c1..bd2200cb7 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountCassandra.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountCassandra.java
@@ -7,7 +7,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -34,7 +33,7 @@ public final class SecretsMountCassandra {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    private @Nullable Map<String,Object> data;
+    private @Nullable Map<String,String> data;
     /**
      * @return Cassandra hosts to connect to.
      * 
@@ -124,7 +123,7 @@ public Optional<Integer> connectTimeout() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Map<String,Object> data() {
+    public Map<String,String> data() {
         return this.data == null ? Map.of() : this.data;
     }
     /**
@@ -231,7 +230,7 @@ public static Builder builder(SecretsMountCassandra defaults) {
     public static final class Builder {
         private @Nullable List<String> allowedRoles;
         private @Nullable Integer connectTimeout;
-        private @Nullable Map<String,Object> data;
+        private @Nullable Map<String,String> data;
         private @Nullable List<String> hosts;
         private @Nullable Boolean insecureTls;
         private String name;
@@ -282,7 +281,7 @@ public Builder connectTimeout(@Nullable Integer connectTimeout) {
             return this;
         }
         @CustomType.Setter
-        public Builder data(@Nullable Map<String,Object> data) {
+        public Builder data(@Nullable Map<String,String> data) {
 
             this.data = data;
             return this;
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountCouchbase.java b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountCouchbase.java
index c6017e66c..58723f14b 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountCouchbase.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountCouchbase.java
@@ -6,7 +6,6 @@
 import com.pulumi.core.annotations.CustomType;
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -38,7 +37,7 @@ public final class SecretsMountCouchbase {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    private @Nullable Map<String,Object> data;
+    private @Nullable Map<String,String> data;
     /**
      * @return A set of Couchbase URIs to connect to. Must use `couchbases://` scheme if `tls` is `true`.
      * 
@@ -120,7 +119,7 @@ public Optional<String> bucketName() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Map<String,Object> data() {
+    public Map<String,String> data() {
         return this.data == null ? Map.of() : this.data;
     }
     /**
@@ -207,7 +206,7 @@ public static final class Builder {
         private @Nullable List<String> allowedRoles;
         private @Nullable String base64Pem;
         private @Nullable String bucketName;
-        private @Nullable Map<String,Object> data;
+        private @Nullable Map<String,String> data;
         private List<String> hosts;
         private @Nullable Boolean insecureTls;
         private String name;
@@ -259,7 +258,7 @@ public Builder bucketName(@Nullable String bucketName) {
             return this;
         }
         @CustomType.Setter
-        public Builder data(@Nullable Map<String,Object> data) {
+        public Builder data(@Nullable Map<String,String> data) {
 
             this.data = data;
             return this;
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountElasticsearch.java b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountElasticsearch.java
index 00d3aaa5d..a06759992 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountElasticsearch.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountElasticsearch.java
@@ -6,7 +6,6 @@
 import com.pulumi.core.annotations.CustomType;
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -48,7 +47,7 @@ public final class SecretsMountElasticsearch {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    private @Nullable Map<String,Object> data;
+    private @Nullable Map<String,String> data;
     /**
      * @return Whether to disable certificate verification
      * 
@@ -144,7 +143,7 @@ public Optional<String> clientKey() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Map<String,Object> data() {
+    public Map<String,String> data() {
         return this.data == null ? Map.of() : this.data;
     }
     /**
@@ -233,7 +232,7 @@ public static final class Builder {
         private @Nullable String caPath;
         private @Nullable String clientCert;
         private @Nullable String clientKey;
-        private @Nullable Map<String,Object> data;
+        private @Nullable Map<String,String> data;
         private @Nullable Boolean insecure;
         private String name;
         private String password;
@@ -299,7 +298,7 @@ public Builder clientKey(@Nullable String clientKey) {
             return this;
         }
         @CustomType.Setter
-        public Builder data(@Nullable Map<String,Object> data) {
+        public Builder data(@Nullable Map<String,String> data) {
 
             this.data = data;
             return this;
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountHana.java b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountHana.java
index 606e927a9..d753217fc 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountHana.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountHana.java
@@ -7,7 +7,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -34,7 +33,7 @@ public final class SecretsMountHana {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    private @Nullable Map<String,Object> data;
+    private @Nullable Map<String,String> data;
     /**
      * @return Disable special character escaping in username and password
      * 
@@ -109,7 +108,7 @@ public Optional<String> connectionUrl() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Map<String,Object> data() {
+    public Map<String,String> data() {
         return this.data == null ? Map.of() : this.data;
     }
     /**
@@ -195,7 +194,7 @@ public static Builder builder(SecretsMountHana defaults) {
     public static final class Builder {
         private @Nullable List<String> allowedRoles;
         private @Nullable String connectionUrl;
-        private @Nullable Map<String,Object> data;
+        private @Nullable Map<String,String> data;
         private @Nullable Boolean disableEscaping;
         private @Nullable Integer maxConnectionLifetime;
         private @Nullable Integer maxIdleConnections;
@@ -240,7 +239,7 @@ public Builder connectionUrl(@Nullable String connectionUrl) {
             return this;
         }
         @CustomType.Setter
-        public Builder data(@Nullable Map<String,Object> data) {
+        public Builder data(@Nullable Map<String,String> data) {
 
             this.data = data;
             return this;
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountInfluxdb.java b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountInfluxdb.java
index 0afb0b7b6..a0149c4f2 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountInfluxdb.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountInfluxdb.java
@@ -7,7 +7,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -34,7 +33,7 @@ public final class SecretsMountInfluxdb {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    private @Nullable Map<String,Object> data;
+    private @Nullable Map<String,String> data;
     /**
      * @return Influxdb host to connect to.
      * 
@@ -124,7 +123,7 @@ public Optional<Integer> connectTimeout() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Map<String,Object> data() {
+    public Map<String,String> data() {
         return this.data == null ? Map.of() : this.data;
     }
     /**
@@ -231,7 +230,7 @@ public static Builder builder(SecretsMountInfluxdb defaults) {
     public static final class Builder {
         private @Nullable List<String> allowedRoles;
         private @Nullable Integer connectTimeout;
-        private @Nullable Map<String,Object> data;
+        private @Nullable Map<String,String> data;
         private String host;
         private @Nullable Boolean insecureTls;
         private String name;
@@ -282,7 +281,7 @@ public Builder connectTimeout(@Nullable Integer connectTimeout) {
             return this;
         }
         @CustomType.Setter
-        public Builder data(@Nullable Map<String,Object> data) {
+        public Builder data(@Nullable Map<String,String> data) {
 
             this.data = data;
             return this;
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountMongodb.java b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountMongodb.java
index fc1dbeb16..91a800914 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountMongodb.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountMongodb.java
@@ -7,7 +7,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -34,7 +33,7 @@ public final class SecretsMountMongodb {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    private @Nullable Map<String,Object> data;
+    private @Nullable Map<String,String> data;
     /**
      * @return Maximum number of seconds a connection may be reused.
      * 
@@ -109,7 +108,7 @@ public Optional<String> connectionUrl() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Map<String,Object> data() {
+    public Map<String,String> data() {
         return this.data == null ? Map.of() : this.data;
     }
     /**
@@ -195,7 +194,7 @@ public static Builder builder(SecretsMountMongodb defaults) {
     public static final class Builder {
         private @Nullable List<String> allowedRoles;
         private @Nullable String connectionUrl;
-        private @Nullable Map<String,Object> data;
+        private @Nullable Map<String,String> data;
         private @Nullable Integer maxConnectionLifetime;
         private @Nullable Integer maxIdleConnections;
         private @Nullable Integer maxOpenConnections;
@@ -240,7 +239,7 @@ public Builder connectionUrl(@Nullable String connectionUrl) {
             return this;
         }
         @CustomType.Setter
-        public Builder data(@Nullable Map<String,Object> data) {
+        public Builder data(@Nullable Map<String,String> data) {
 
             this.data = data;
             return this;
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountMongodbatla.java b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountMongodbatla.java
index a07764d14..d942588ff 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountMongodbatla.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountMongodbatla.java
@@ -6,7 +6,6 @@
 import com.pulumi.core.annotations.CustomType;
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -28,7 +27,7 @@ public final class SecretsMountMongodbatla {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    private @Nullable Map<String,Object> data;
+    private @Nullable Map<String,String> data;
     /**
      * @return Name of the database connection.
      * 
@@ -81,7 +80,7 @@ public List<String> allowedRoles() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Map<String,Object> data() {
+    public Map<String,String> data() {
         return this.data == null ? Map.of() : this.data;
     }
     /**
@@ -145,7 +144,7 @@ public static Builder builder(SecretsMountMongodbatla defaults) {
     @CustomType.Builder
     public static final class Builder {
         private @Nullable List<String> allowedRoles;
-        private @Nullable Map<String,Object> data;
+        private @Nullable Map<String,String> data;
         private String name;
         private @Nullable String pluginName;
         private String privateKey;
@@ -177,7 +176,7 @@ public Builder allowedRoles(String... allowedRoles) {
             return allowedRoles(List.of(allowedRoles));
         }
         @CustomType.Setter
-        public Builder data(@Nullable Map<String,Object> data) {
+        public Builder data(@Nullable Map<String,String> data) {
 
             this.data = data;
             return this;
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountMssql.java b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountMssql.java
index 90324d699..4cae3f1a7 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountMssql.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountMssql.java
@@ -7,7 +7,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -39,7 +38,7 @@ public final class SecretsMountMssql {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    private @Nullable Map<String,Object> data;
+    private @Nullable Map<String,String> data;
     /**
      * @return Disable special character escaping in username and password
      * 
@@ -126,7 +125,7 @@ public Optional<Boolean> containedDb() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Map<String,Object> data() {
+    public Map<String,String> data() {
         return this.data == null ? Map.of() : this.data;
     }
     /**
@@ -220,7 +219,7 @@ public static final class Builder {
         private @Nullable List<String> allowedRoles;
         private @Nullable String connectionUrl;
         private @Nullable Boolean containedDb;
-        private @Nullable Map<String,Object> data;
+        private @Nullable Map<String,String> data;
         private @Nullable Boolean disableEscaping;
         private @Nullable Integer maxConnectionLifetime;
         private @Nullable Integer maxIdleConnections;
@@ -274,7 +273,7 @@ public Builder containedDb(@Nullable Boolean containedDb) {
             return this;
         }
         @CustomType.Setter
-        public Builder data(@Nullable Map<String,Object> data) {
+        public Builder data(@Nullable Map<String,String> data) {
 
             this.data = data;
             return this;
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountMysql.java b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountMysql.java
index 7522085b8..d8b4f93c2 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountMysql.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountMysql.java
@@ -7,7 +7,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -39,7 +38,7 @@ public final class SecretsMountMysql {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    private @Nullable Map<String,Object> data;
+    private @Nullable Map<String,String> data;
     /**
      * @return Maximum number of seconds a connection may be reused.
      * 
@@ -136,7 +135,7 @@ public Optional<String> connectionUrl() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Map<String,Object> data() {
+    public Map<String,String> data() {
         return this.data == null ? Map.of() : this.data;
     }
     /**
@@ -244,7 +243,7 @@ public static final class Builder {
         private @Nullable List<String> allowedRoles;
         private @Nullable String authType;
         private @Nullable String connectionUrl;
-        private @Nullable Map<String,Object> data;
+        private @Nullable Map<String,String> data;
         private @Nullable Integer maxConnectionLifetime;
         private @Nullable Integer maxIdleConnections;
         private @Nullable Integer maxOpenConnections;
@@ -302,7 +301,7 @@ public Builder connectionUrl(@Nullable String connectionUrl) {
             return this;
         }
         @CustomType.Setter
-        public Builder data(@Nullable Map<String,Object> data) {
+        public Builder data(@Nullable Map<String,String> data) {
 
             this.data = data;
             return this;
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountMysqlAurora.java b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountMysqlAurora.java
index 401112946..5bc303683 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountMysqlAurora.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountMysqlAurora.java
@@ -7,7 +7,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -39,7 +38,7 @@ public final class SecretsMountMysqlAurora {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    private @Nullable Map<String,Object> data;
+    private @Nullable Map<String,String> data;
     /**
      * @return Maximum number of seconds a connection may be reused.
      * 
@@ -136,7 +135,7 @@ public Optional<String> connectionUrl() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Map<String,Object> data() {
+    public Map<String,String> data() {
         return this.data == null ? Map.of() : this.data;
     }
     /**
@@ -244,7 +243,7 @@ public static final class Builder {
         private @Nullable List<String> allowedRoles;
         private @Nullable String authType;
         private @Nullable String connectionUrl;
-        private @Nullable Map<String,Object> data;
+        private @Nullable Map<String,String> data;
         private @Nullable Integer maxConnectionLifetime;
         private @Nullable Integer maxIdleConnections;
         private @Nullable Integer maxOpenConnections;
@@ -302,7 +301,7 @@ public Builder connectionUrl(@Nullable String connectionUrl) {
             return this;
         }
         @CustomType.Setter
-        public Builder data(@Nullable Map<String,Object> data) {
+        public Builder data(@Nullable Map<String,String> data) {
 
             this.data = data;
             return this;
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountMysqlLegacy.java b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountMysqlLegacy.java
index 46ce1c5dd..b0c4c45a4 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountMysqlLegacy.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountMysqlLegacy.java
@@ -7,7 +7,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -39,7 +38,7 @@ public final class SecretsMountMysqlLegacy {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    private @Nullable Map<String,Object> data;
+    private @Nullable Map<String,String> data;
     /**
      * @return Maximum number of seconds a connection may be reused.
      * 
@@ -136,7 +135,7 @@ public Optional<String> connectionUrl() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Map<String,Object> data() {
+    public Map<String,String> data() {
         return this.data == null ? Map.of() : this.data;
     }
     /**
@@ -244,7 +243,7 @@ public static final class Builder {
         private @Nullable List<String> allowedRoles;
         private @Nullable String authType;
         private @Nullable String connectionUrl;
-        private @Nullable Map<String,Object> data;
+        private @Nullable Map<String,String> data;
         private @Nullable Integer maxConnectionLifetime;
         private @Nullable Integer maxIdleConnections;
         private @Nullable Integer maxOpenConnections;
@@ -302,7 +301,7 @@ public Builder connectionUrl(@Nullable String connectionUrl) {
             return this;
         }
         @CustomType.Setter
-        public Builder data(@Nullable Map<String,Object> data) {
+        public Builder data(@Nullable Map<String,String> data) {
 
             this.data = data;
             return this;
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountMysqlRd.java b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountMysqlRd.java
index f0c9fdd1a..cbc3bacc7 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountMysqlRd.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountMysqlRd.java
@@ -7,7 +7,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -39,7 +38,7 @@ public final class SecretsMountMysqlRd {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    private @Nullable Map<String,Object> data;
+    private @Nullable Map<String,String> data;
     /**
      * @return Maximum number of seconds a connection may be reused.
      * 
@@ -136,7 +135,7 @@ public Optional<String> connectionUrl() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Map<String,Object> data() {
+    public Map<String,String> data() {
         return this.data == null ? Map.of() : this.data;
     }
     /**
@@ -244,7 +243,7 @@ public static final class Builder {
         private @Nullable List<String> allowedRoles;
         private @Nullable String authType;
         private @Nullable String connectionUrl;
-        private @Nullable Map<String,Object> data;
+        private @Nullable Map<String,String> data;
         private @Nullable Integer maxConnectionLifetime;
         private @Nullable Integer maxIdleConnections;
         private @Nullable Integer maxOpenConnections;
@@ -302,7 +301,7 @@ public Builder connectionUrl(@Nullable String connectionUrl) {
             return this;
         }
         @CustomType.Setter
-        public Builder data(@Nullable Map<String,Object> data) {
+        public Builder data(@Nullable Map<String,String> data) {
 
             this.data = data;
             return this;
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountOracle.java b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountOracle.java
index d38c1668c..245b51671 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountOracle.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountOracle.java
@@ -7,7 +7,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -34,7 +33,7 @@ public final class SecretsMountOracle {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    private @Nullable Map<String,Object> data;
+    private @Nullable Map<String,String> data;
     /**
      * @return Set to true to disconnect any open sessions prior to running the revocation statements.
      * 
@@ -119,7 +118,7 @@ public Optional<String> connectionUrl() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Map<String,Object> data() {
+    public Map<String,String> data() {
         return this.data == null ? Map.of() : this.data;
     }
     /**
@@ -219,7 +218,7 @@ public static Builder builder(SecretsMountOracle defaults) {
     public static final class Builder {
         private @Nullable List<String> allowedRoles;
         private @Nullable String connectionUrl;
-        private @Nullable Map<String,Object> data;
+        private @Nullable Map<String,String> data;
         private @Nullable Boolean disconnectSessions;
         private @Nullable Integer maxConnectionLifetime;
         private @Nullable Integer maxIdleConnections;
@@ -268,7 +267,7 @@ public Builder connectionUrl(@Nullable String connectionUrl) {
             return this;
         }
         @CustomType.Setter
-        public Builder data(@Nullable Map<String,Object> data) {
+        public Builder data(@Nullable Map<String,String> data) {
 
             this.data = data;
             return this;
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountPostgresql.java b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountPostgresql.java
index fbf84c608..3e225c4df 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountPostgresql.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountPostgresql.java
@@ -7,7 +7,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -39,7 +38,7 @@ public final class SecretsMountPostgresql {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    private @Nullable Map<String,Object> data;
+    private @Nullable Map<String,String> data;
     /**
      * @return Disable special character escaping in username and password
      * 
@@ -131,7 +130,7 @@ public Optional<String> connectionUrl() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Map<String,Object> data() {
+    public Map<String,String> data() {
         return this.data == null ? Map.of() : this.data;
     }
     /**
@@ -232,7 +231,7 @@ public static final class Builder {
         private @Nullable List<String> allowedRoles;
         private @Nullable String authType;
         private @Nullable String connectionUrl;
-        private @Nullable Map<String,Object> data;
+        private @Nullable Map<String,String> data;
         private @Nullable Boolean disableEscaping;
         private @Nullable Integer maxConnectionLifetime;
         private @Nullable Integer maxIdleConnections;
@@ -288,7 +287,7 @@ public Builder connectionUrl(@Nullable String connectionUrl) {
             return this;
         }
         @CustomType.Setter
-        public Builder data(@Nullable Map<String,Object> data) {
+        public Builder data(@Nullable Map<String,String> data) {
 
             this.data = data;
             return this;
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountRedi.java b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountRedi.java
index b253c1033..e2c951173 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountRedi.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountRedi.java
@@ -7,7 +7,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -34,7 +33,7 @@ public final class SecretsMountRedi {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    private @Nullable Map<String,Object> data;
+    private @Nullable Map<String,String> data;
     /**
      * @return Specifies the host to connect to
      * 
@@ -109,7 +108,7 @@ public Optional<String> caCert() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Map<String,Object> data() {
+    public Map<String,String> data() {
         return this.data == null ? Map.of() : this.data;
     }
     /**
@@ -195,7 +194,7 @@ public static Builder builder(SecretsMountRedi defaults) {
     public static final class Builder {
         private @Nullable List<String> allowedRoles;
         private @Nullable String caCert;
-        private @Nullable Map<String,Object> data;
+        private @Nullable Map<String,String> data;
         private String host;
         private @Nullable Boolean insecureTls;
         private String name;
@@ -240,7 +239,7 @@ public Builder caCert(@Nullable String caCert) {
             return this;
         }
         @CustomType.Setter
-        public Builder data(@Nullable Map<String,Object> data) {
+        public Builder data(@Nullable Map<String,String> data) {
 
             this.data = data;
             return this;
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountRedisElasticach.java b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountRedisElasticach.java
index 3abe3d6dd..19d495ea0 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountRedisElasticach.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountRedisElasticach.java
@@ -6,7 +6,6 @@
 import com.pulumi.core.annotations.CustomType;
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -28,7 +27,7 @@ public final class SecretsMountRedisElasticach {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    private @Nullable Map<String,Object> data;
+    private @Nullable Map<String,String> data;
     /**
      * @return Name of the database connection.
      * 
@@ -86,7 +85,7 @@ public List<String> allowedRoles() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Map<String,Object> data() {
+    public Map<String,String> data() {
         return this.data == null ? Map.of() : this.data;
     }
     /**
@@ -157,7 +156,7 @@ public static Builder builder(SecretsMountRedisElasticach defaults) {
     @CustomType.Builder
     public static final class Builder {
         private @Nullable List<String> allowedRoles;
-        private @Nullable Map<String,Object> data;
+        private @Nullable Map<String,String> data;
         private String name;
         private @Nullable String password;
         private @Nullable String pluginName;
@@ -191,7 +190,7 @@ public Builder allowedRoles(String... allowedRoles) {
             return allowedRoles(List.of(allowedRoles));
         }
         @CustomType.Setter
-        public Builder data(@Nullable Map<String,Object> data) {
+        public Builder data(@Nullable Map<String,String> data) {
 
             this.data = data;
             return this;
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountRedshift.java b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountRedshift.java
index 422e0e6f2..a3823093a 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountRedshift.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountRedshift.java
@@ -7,7 +7,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -34,7 +33,7 @@ public final class SecretsMountRedshift {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    private @Nullable Map<String,Object> data;
+    private @Nullable Map<String,String> data;
     /**
      * @return Disable special character escaping in username and password
      * 
@@ -114,7 +113,7 @@ public Optional<String> connectionUrl() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Map<String,Object> data() {
+    public Map<String,String> data() {
         return this.data == null ? Map.of() : this.data;
     }
     /**
@@ -207,7 +206,7 @@ public static Builder builder(SecretsMountRedshift defaults) {
     public static final class Builder {
         private @Nullable List<String> allowedRoles;
         private @Nullable String connectionUrl;
-        private @Nullable Map<String,Object> data;
+        private @Nullable Map<String,String> data;
         private @Nullable Boolean disableEscaping;
         private @Nullable Integer maxConnectionLifetime;
         private @Nullable Integer maxIdleConnections;
@@ -254,7 +253,7 @@ public Builder connectionUrl(@Nullable String connectionUrl) {
             return this;
         }
         @CustomType.Setter
-        public Builder data(@Nullable Map<String,Object> data) {
+        public Builder data(@Nullable Map<String,String> data) {
 
             this.data = data;
             return this;
diff --git a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountSnowflake.java b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountSnowflake.java
index 50f8cad4a..58aa283f6 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountSnowflake.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/database/outputs/SecretsMountSnowflake.java
@@ -7,7 +7,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -34,7 +33,7 @@ public final class SecretsMountSnowflake {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    private @Nullable Map<String,Object> data;
+    private @Nullable Map<String,String> data;
     /**
      * @return Maximum number of seconds a connection may be reused.
      * 
@@ -109,7 +108,7 @@ public Optional<String> connectionUrl() {
      * Supported list of database secrets engines that can be configured:
      * 
      */
-    public Map<String,Object> data() {
+    public Map<String,String> data() {
         return this.data == null ? Map.of() : this.data;
     }
     /**
@@ -195,7 +194,7 @@ public static Builder builder(SecretsMountSnowflake defaults) {
     public static final class Builder {
         private @Nullable List<String> allowedRoles;
         private @Nullable String connectionUrl;
-        private @Nullable Map<String,Object> data;
+        private @Nullable Map<String,String> data;
         private @Nullable Integer maxConnectionLifetime;
         private @Nullable Integer maxIdleConnections;
         private @Nullable Integer maxOpenConnections;
@@ -240,7 +239,7 @@ public Builder connectionUrl(@Nullable String connectionUrl) {
             return this;
         }
         @CustomType.Setter
-        public Builder data(@Nullable Map<String,Object> data) {
+        public Builder data(@Nullable Map<String,String> data) {
 
             this.data = data;
             return this;
diff --git a/sdk/java/src/main/java/com/pulumi/vault/generic/Secret.java b/sdk/java/src/main/java/com/pulumi/vault/generic/Secret.java
index 3c594b027..801e89813 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/generic/Secret.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/generic/Secret.java
@@ -11,7 +11,6 @@
 import com.pulumi.vault.generic.SecretArgs;
 import com.pulumi.vault.generic.inputs.SecretState;
 import java.lang.Boolean;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -37,8 +36,8 @@ public class Secret extends com.pulumi.resources.CustomResource {
      * serialized as JSON.
      * 
      */
-    @Export(name="data", refs={Map.class,String.class,Object.class}, tree="[0,1,2]")
-    private Output<Map<String,Object>> data;
+    @Export(name="data", refs={Map.class,String.class}, tree="[0,1,1]")
+    private Output<Map<String,String>> data;
 
     /**
      * @return A mapping whose keys are the top-level data keys returned from
@@ -47,7 +46,7 @@ public class Secret extends com.pulumi.resources.CustomResource {
      * serialized as JSON.
      * 
      */
-    public Output<Map<String,Object>> data() {
+    public Output<Map<String,String>> data() {
         return this.data;
     }
     /**
diff --git a/sdk/java/src/main/java/com/pulumi/vault/generic/inputs/SecretState.java b/sdk/java/src/main/java/com/pulumi/vault/generic/inputs/SecretState.java
index ad73f0f5e..3e96a3c16 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/generic/inputs/SecretState.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/generic/inputs/SecretState.java
@@ -6,7 +6,6 @@
 import com.pulumi.core.Output;
 import com.pulumi.core.annotations.Import;
 import java.lang.Boolean;
-import java.lang.Object;
 import java.lang.String;
 import java.util.Map;
 import java.util.Objects;
@@ -26,7 +25,7 @@ public final class SecretState extends com.pulumi.resources.ResourceArgs {
      * 
      */
     @Import(name="data")
-    private @Nullable Output<Map<String,Object>> data;
+    private @Nullable Output<Map<String,String>> data;
 
     /**
      * @return A mapping whose keys are the top-level data keys returned from
@@ -35,7 +34,7 @@ public final class SecretState extends com.pulumi.resources.ResourceArgs {
      * serialized as JSON.
      * 
      */
-    public Optional<Output<Map<String,Object>>> data() {
+    public Optional<Output<Map<String,String>>> data() {
         return Optional.ofNullable(this.data);
     }
 
@@ -178,7 +177,7 @@ public Builder(SecretState defaults) {
          * @return builder
          * 
          */
-        public Builder data(@Nullable Output<Map<String,Object>> data) {
+        public Builder data(@Nullable Output<Map<String,String>> data) {
             $.data = data;
             return this;
         }
@@ -192,7 +191,7 @@ public Builder data(@Nullable Output<Map<String,Object>> data) {
          * @return builder
          * 
          */
-        public Builder data(Map<String,Object> data) {
+        public Builder data(Map<String,String> data) {
             return data(Output.of(data));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/generic/outputs/GetSecretResult.java b/sdk/java/src/main/java/com/pulumi/vault/generic/outputs/GetSecretResult.java
index 15b9d37f5..982966f8c 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/generic/outputs/GetSecretResult.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/generic/outputs/GetSecretResult.java
@@ -7,7 +7,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.Map;
 import java.util.Objects;
@@ -23,7 +22,7 @@ public final class GetSecretResult {
      * serialized as JSON.
      * 
      */
-    private Map<String,Object> data;
+    private Map<String,String> data;
     /**
      * @return A string containing the full data payload retrieved from
      * Vault, serialized in JSON format.
@@ -62,7 +61,7 @@ private GetSecretResult() {}
      * serialized as JSON.
      * 
      */
-    public Map<String,Object> data() {
+    public Map<String,String> data() {
         return this.data;
     }
     /**
@@ -124,7 +123,7 @@ public static Builder builder(GetSecretResult defaults) {
     }
     @CustomType.Builder
     public static final class Builder {
-        private Map<String,Object> data;
+        private Map<String,String> data;
         private String dataJson;
         private String id;
         private Integer leaseDuration;
@@ -152,7 +151,7 @@ public Builder(GetSecretResult defaults) {
         }
 
         @CustomType.Setter
-        public Builder data(Map<String,Object> data) {
+        public Builder data(Map<String,String> data) {
             if (data == null) {
               throw new MissingRequiredPropertyException("GetSecretResult", "data");
             }
diff --git a/sdk/java/src/main/java/com/pulumi/vault/identity/outputs/GetEntityAlias.java b/sdk/java/src/main/java/com/pulumi/vault/identity/outputs/GetEntityAlias.java
index f98ec47e6..0443116d3 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/identity/outputs/GetEntityAlias.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/identity/outputs/GetEntityAlias.java
@@ -5,7 +5,6 @@
 
 import com.pulumi.core.annotations.CustomType;
 import com.pulumi.exceptions.MissingRequiredPropertyException;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -42,7 +41,7 @@ public final class GetEntityAlias {
      * @return Arbitrary metadata
      * 
      */
-    private Map<String,Object> metadata;
+    private Map<String,String> metadata;
     /**
      * @return Authentication mount acccessor which this alias belongs to
      * 
@@ -104,7 +103,7 @@ public List<String> mergedFromCanonicalIds() {
      * @return Arbitrary metadata
      * 
      */
-    public Map<String,Object> metadata() {
+    public Map<String,String> metadata() {
         return this.metadata;
     }
     /**
@@ -150,7 +149,7 @@ public static final class Builder {
         private String id;
         private String lastUpdateTime;
         private List<String> mergedFromCanonicalIds;
-        private Map<String,Object> metadata;
+        private Map<String,String> metadata;
         private String mountAccessor;
         private String mountPath;
         private String mountType;
@@ -214,7 +213,7 @@ public Builder mergedFromCanonicalIds(String... mergedFromCanonicalIds) {
             return mergedFromCanonicalIds(List.of(mergedFromCanonicalIds));
         }
         @CustomType.Setter
-        public Builder metadata(Map<String,Object> metadata) {
+        public Builder metadata(Map<String,String> metadata) {
             if (metadata == null) {
               throw new MissingRequiredPropertyException("GetEntityAlias", "metadata");
             }
diff --git a/sdk/java/src/main/java/com/pulumi/vault/identity/outputs/GetEntityResult.java b/sdk/java/src/main/java/com/pulumi/vault/identity/outputs/GetEntityResult.java
index 900a59541..074d7ceeb 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/identity/outputs/GetEntityResult.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/identity/outputs/GetEntityResult.java
@@ -7,7 +7,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import com.pulumi.vault.identity.outputs.GetEntityAlias;
 import java.lang.Boolean;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -77,7 +76,7 @@ public final class GetEntityResult {
      * @return Arbitrary metadata
      * 
      */
-    private Map<String,Object> metadata;
+    private Map<String,String> metadata;
     private @Nullable String namespace;
     /**
      * @return Namespace of which the entity is part of
@@ -181,7 +180,7 @@ public List<String> mergedEntityIds() {
      * @return Arbitrary metadata
      * 
      */
-    public Map<String,Object> metadata() {
+    public Map<String,String> metadata() {
         return this.metadata;
     }
     public Optional<String> namespace() {
@@ -226,7 +225,7 @@ public static final class Builder {
         private List<String> inheritedGroupIds;
         private String lastUpdateTime;
         private List<String> mergedEntityIds;
-        private Map<String,Object> metadata;
+        private Map<String,String> metadata;
         private @Nullable String namespace;
         private String namespaceId;
         private List<String> policies;
@@ -390,7 +389,7 @@ public Builder mergedEntityIds(String... mergedEntityIds) {
             return mergedEntityIds(List.of(mergedEntityIds));
         }
         @CustomType.Setter
-        public Builder metadata(Map<String,Object> metadata) {
+        public Builder metadata(Map<String,String> metadata) {
             if (metadata == null) {
               throw new MissingRequiredPropertyException("GetEntityResult", "metadata");
             }
diff --git a/sdk/java/src/main/java/com/pulumi/vault/identity/outputs/GetGroupResult.java b/sdk/java/src/main/java/com/pulumi/vault/identity/outputs/GetGroupResult.java
index 38b5403c7..09451bc94 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/identity/outputs/GetGroupResult.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/identity/outputs/GetGroupResult.java
@@ -6,7 +6,6 @@
 import com.pulumi.core.annotations.CustomType;
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -41,7 +40,7 @@ public final class GetGroupResult {
      * @return Arbitrary metadata
      * 
      */
-    private Map<String,Object> aliasMetadata;
+    private Map<String,String> aliasMetadata;
     private String aliasMountAccessor;
     /**
      * @return Authentication mount path which this alias belongs to
@@ -91,7 +90,7 @@ public final class GetGroupResult {
      * @return Arbitrary metadata
      * 
      */
-    private Map<String,Object> metadata;
+    private Map<String,String> metadata;
     /**
      * @return Modify index of the group
      * 
@@ -155,7 +154,7 @@ public List<String> aliasMergedFromCanonicalIds() {
      * @return Arbitrary metadata
      * 
      */
-    public Map<String,Object> aliasMetadata() {
+    public Map<String,String> aliasMetadata() {
         return this.aliasMetadata;
     }
     public String aliasMountAccessor() {
@@ -231,7 +230,7 @@ public List<String> memberGroupIds() {
      * @return Arbitrary metadata
      * 
      */
-    public Map<String,Object> metadata() {
+    public Map<String,String> metadata() {
         return this.metadata;
     }
     /**
@@ -287,7 +286,7 @@ public static final class Builder {
         private String aliasId;
         private String aliasLastUpdateTime;
         private List<String> aliasMergedFromCanonicalIds;
-        private Map<String,Object> aliasMetadata;
+        private Map<String,String> aliasMetadata;
         private String aliasMountAccessor;
         private String aliasMountPath;
         private String aliasMountType;
@@ -300,7 +299,7 @@ public static final class Builder {
         private String lastUpdateTime;
         private List<String> memberEntityIds;
         private List<String> memberGroupIds;
-        private Map<String,Object> metadata;
+        private Map<String,String> metadata;
         private Integer modifyIndex;
         private @Nullable String namespace;
         private String namespaceId;
@@ -381,7 +380,7 @@ public Builder aliasMergedFromCanonicalIds(String... aliasMergedFromCanonicalIds
             return aliasMergedFromCanonicalIds(List.of(aliasMergedFromCanonicalIds));
         }
         @CustomType.Setter
-        public Builder aliasMetadata(Map<String,Object> aliasMetadata) {
+        public Builder aliasMetadata(Map<String,String> aliasMetadata) {
             if (aliasMetadata == null) {
               throw new MissingRequiredPropertyException("GetGroupResult", "aliasMetadata");
             }
@@ -491,7 +490,7 @@ public Builder memberGroupIds(String... memberGroupIds) {
             return memberGroupIds(List.of(memberGroupIds));
         }
         @CustomType.Setter
-        public Builder metadata(Map<String,Object> metadata) {
+        public Builder metadata(Map<String,String> metadata) {
             if (metadata == null) {
               throw new MissingRequiredPropertyException("GetGroupResult", "metadata");
             }
diff --git a/sdk/java/src/main/java/com/pulumi/vault/identity/outputs/GetOidcPublicKeysResult.java b/sdk/java/src/main/java/com/pulumi/vault/identity/outputs/GetOidcPublicKeysResult.java
index 42a65f4d1..3f19636c1 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/identity/outputs/GetOidcPublicKeysResult.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/identity/outputs/GetOidcPublicKeysResult.java
@@ -5,7 +5,6 @@
 
 import com.pulumi.core.annotations.CustomType;
 import com.pulumi.exceptions.MissingRequiredPropertyException;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -25,7 +24,7 @@ public final class GetOidcPublicKeysResult {
      * Clients can use them to validate the authenticity of an identity token.
      * 
      */
-    private List<Map<String,Object>> keys;
+    private List<Map<String,String>> keys;
     private String name;
     private @Nullable String namespace;
 
@@ -42,7 +41,7 @@ public String id() {
      * Clients can use them to validate the authenticity of an identity token.
      * 
      */
-    public List<Map<String,Object>> keys() {
+    public List<Map<String,String>> keys() {
         return this.keys;
     }
     public String name() {
@@ -62,7 +61,7 @@ public static Builder builder(GetOidcPublicKeysResult defaults) {
     @CustomType.Builder
     public static final class Builder {
         private String id;
-        private List<Map<String,Object>> keys;
+        private List<Map<String,String>> keys;
         private String name;
         private @Nullable String namespace;
         public Builder() {}
@@ -83,7 +82,7 @@ public Builder id(String id) {
             return this;
         }
         @CustomType.Setter
-        public Builder keys(List<Map<String,Object>> keys) {
+        public Builder keys(List<Map<String,String>> keys) {
             if (keys == null) {
               throw new MissingRequiredPropertyException("GetOidcPublicKeysResult", "keys");
             }
diff --git a/sdk/java/src/main/java/com/pulumi/vault/inputs/MountState.java b/sdk/java/src/main/java/com/pulumi/vault/inputs/MountState.java
index 89ad7630b..4fd8c3401 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/inputs/MountState.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/inputs/MountState.java
@@ -7,7 +7,6 @@
 import com.pulumi.core.annotations.Import;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -249,13 +248,13 @@ public Optional<Output<String>> namespace() {
      * 
      */
     @Import(name="options")
-    private @Nullable Output<Map<String,Object>> options;
+    private @Nullable Output<Map<String,String>> options;
 
     /**
      * @return Specifies mount type specific options that are passed to the backend
      * 
      */
-    public Optional<Output<Map<String,Object>>> options() {
+    public Optional<Output<Map<String,String>>> options() {
         return Optional.ofNullable(this.options);
     }
 
@@ -749,7 +748,7 @@ public Builder namespace(String namespace) {
          * @return builder
          * 
          */
-        public Builder options(@Nullable Output<Map<String,Object>> options) {
+        public Builder options(@Nullable Output<Map<String,String>> options) {
             $.options = options;
             return this;
         }
@@ -760,7 +759,7 @@ public Builder options(@Nullable Output<Map<String,Object>> options) {
          * @return builder
          * 
          */
-        public Builder options(Map<String,Object> options) {
+        public Builder options(Map<String,String> options) {
             return options(Output.of(options));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/inputs/NamespaceState.java b/sdk/java/src/main/java/com/pulumi/vault/inputs/NamespaceState.java
index 9e36809d4..a7fd1eb23 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/inputs/NamespaceState.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/inputs/NamespaceState.java
@@ -5,7 +5,6 @@
 
 import com.pulumi.core.Output;
 import com.pulumi.core.annotations.Import;
-import java.lang.Object;
 import java.lang.String;
 import java.util.Map;
 import java.util.Objects;
@@ -23,14 +22,14 @@ public final class NamespaceState extends com.pulumi.resources.ResourceArgs {
      * 
      */
     @Import(name="customMetadata")
-    private @Nullable Output<Map<String,Object>> customMetadata;
+    private @Nullable Output<Map<String,String>> customMetadata;
 
     /**
      * @return Custom metadata describing this namespace. Value type
      * is `map[string]string`. Requires Vault version 1.12+.
      * 
      */
-    public Optional<Output<Map<String,Object>>> customMetadata() {
+    public Optional<Output<Map<String,String>>> customMetadata() {
         return Optional.ofNullable(this.customMetadata);
     }
 
@@ -137,7 +136,7 @@ public Builder(NamespaceState defaults) {
          * @return builder
          * 
          */
-        public Builder customMetadata(@Nullable Output<Map<String,Object>> customMetadata) {
+        public Builder customMetadata(@Nullable Output<Map<String,String>> customMetadata) {
             $.customMetadata = customMetadata;
             return this;
         }
@@ -149,7 +148,7 @@ public Builder customMetadata(@Nullable Output<Map<String,Object>> customMetadat
          * @return builder
          * 
          */
-        public Builder customMetadata(Map<String,Object> customMetadata) {
+        public Builder customMetadata(Map<String,String> customMetadata) {
             return customMetadata(Output.of(customMetadata));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/jwt/AuthBackendRole.java b/sdk/java/src/main/java/com/pulumi/vault/jwt/AuthBackendRole.java
index df22ffdd9..36f36cde0 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/jwt/AuthBackendRole.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/jwt/AuthBackendRole.java
@@ -12,7 +12,6 @@
 import com.pulumi.vault.jwt.inputs.AuthBackendRoleState;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -191,8 +190,8 @@ public Output<Optional<List<String>>> boundAudiences() {
      * comma-separated values, e.g. `&#34;red&#34;` or `&#34;red,green,blue&#34;`.
      * 
      */
-    @Export(name="boundClaims", refs={Map.class,String.class,Object.class}, tree="[0,1,2]")
-    private Output</* @Nullable */ Map<String,Object>> boundClaims;
+    @Export(name="boundClaims", refs={Map.class,String.class}, tree="[0,1,1]")
+    private Output</* @Nullable */ Map<String,String>> boundClaims;
 
     /**
      * @return If set, a map of claims to values to match against.
@@ -200,7 +199,7 @@ public Output<Optional<List<String>>> boundAudiences() {
      * comma-separated values, e.g. `&#34;red&#34;` or `&#34;red,green,blue&#34;`.
      * 
      */
-    public Output<Optional<Map<String,Object>>> boundClaims() {
+    public Output<Optional<Map<String,String>>> boundClaims() {
         return Codegen.optional(this.boundClaims);
     }
     /**
@@ -242,15 +241,15 @@ public Output<Optional<String>> boundSubject() {
      * to specified metadata fields (values).
      * 
      */
-    @Export(name="claimMappings", refs={Map.class,String.class,Object.class}, tree="[0,1,2]")
-    private Output</* @Nullable */ Map<String,Object>> claimMappings;
+    @Export(name="claimMappings", refs={Map.class,String.class}, tree="[0,1,1]")
+    private Output</* @Nullable */ Map<String,String>> claimMappings;
 
     /**
      * @return If set, a map of claims (keys) to be copied
      * to specified metadata fields (values).
      * 
      */
-    public Output<Optional<Map<String,Object>>> claimMappings() {
+    public Output<Optional<Map<String,String>>> claimMappings() {
         return Codegen.optional(this.claimMappings);
     }
     /**
diff --git a/sdk/java/src/main/java/com/pulumi/vault/jwt/AuthBackendRoleArgs.java b/sdk/java/src/main/java/com/pulumi/vault/jwt/AuthBackendRoleArgs.java
index d6faa3a5f..8959ef713 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/jwt/AuthBackendRoleArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/jwt/AuthBackendRoleArgs.java
@@ -8,7 +8,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -79,7 +78,7 @@ public Optional<Output<List<String>>> boundAudiences() {
      * 
      */
     @Import(name="boundClaims")
-    private @Nullable Output<Map<String,Object>> boundClaims;
+    private @Nullable Output<Map<String,String>> boundClaims;
 
     /**
      * @return If set, a map of claims to values to match against.
@@ -87,7 +86,7 @@ public Optional<Output<List<String>>> boundAudiences() {
      * comma-separated values, e.g. `&#34;red&#34;` or `&#34;red,green,blue&#34;`.
      * 
      */
-    public Optional<Output<Map<String,Object>>> boundClaims() {
+    public Optional<Output<Map<String,String>>> boundClaims() {
         return Optional.ofNullable(this.boundClaims);
     }
 
@@ -133,14 +132,14 @@ public Optional<Output<String>> boundSubject() {
      * 
      */
     @Import(name="claimMappings")
-    private @Nullable Output<Map<String,Object>> claimMappings;
+    private @Nullable Output<Map<String,String>> claimMappings;
 
     /**
      * @return If set, a map of claims (keys) to be copied
      * to specified metadata fields (values).
      * 
      */
-    public Optional<Output<Map<String,Object>>> claimMappings() {
+    public Optional<Output<Map<String,String>>> claimMappings() {
         return Optional.ofNullable(this.claimMappings);
     }
 
@@ -667,7 +666,7 @@ public Builder boundAudiences(String... boundAudiences) {
          * @return builder
          * 
          */
-        public Builder boundClaims(@Nullable Output<Map<String,Object>> boundClaims) {
+        public Builder boundClaims(@Nullable Output<Map<String,String>> boundClaims) {
             $.boundClaims = boundClaims;
             return this;
         }
@@ -680,7 +679,7 @@ public Builder boundClaims(@Nullable Output<Map<String,Object>> boundClaims) {
          * @return builder
          * 
          */
-        public Builder boundClaims(Map<String,Object> boundClaims) {
+        public Builder boundClaims(Map<String,String> boundClaims) {
             return boundClaims(Output.of(boundClaims));
         }
 
@@ -739,7 +738,7 @@ public Builder boundSubject(String boundSubject) {
          * @return builder
          * 
          */
-        public Builder claimMappings(@Nullable Output<Map<String,Object>> claimMappings) {
+        public Builder claimMappings(@Nullable Output<Map<String,String>> claimMappings) {
             $.claimMappings = claimMappings;
             return this;
         }
@@ -751,7 +750,7 @@ public Builder claimMappings(@Nullable Output<Map<String,Object>> claimMappings)
          * @return builder
          * 
          */
-        public Builder claimMappings(Map<String,Object> claimMappings) {
+        public Builder claimMappings(Map<String,String> claimMappings) {
             return claimMappings(Output.of(claimMappings));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/jwt/inputs/AuthBackendRoleState.java b/sdk/java/src/main/java/com/pulumi/vault/jwt/inputs/AuthBackendRoleState.java
index 330218ebc..8183e3c5f 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/jwt/inputs/AuthBackendRoleState.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/jwt/inputs/AuthBackendRoleState.java
@@ -7,7 +7,6 @@
 import com.pulumi.core.annotations.Import;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -78,7 +77,7 @@ public Optional<Output<List<String>>> boundAudiences() {
      * 
      */
     @Import(name="boundClaims")
-    private @Nullable Output<Map<String,Object>> boundClaims;
+    private @Nullable Output<Map<String,String>> boundClaims;
 
     /**
      * @return If set, a map of claims to values to match against.
@@ -86,7 +85,7 @@ public Optional<Output<List<String>>> boundAudiences() {
      * comma-separated values, e.g. `&#34;red&#34;` or `&#34;red,green,blue&#34;`.
      * 
      */
-    public Optional<Output<Map<String,Object>>> boundClaims() {
+    public Optional<Output<Map<String,String>>> boundClaims() {
         return Optional.ofNullable(this.boundClaims);
     }
 
@@ -132,14 +131,14 @@ public Optional<Output<String>> boundSubject() {
      * 
      */
     @Import(name="claimMappings")
-    private @Nullable Output<Map<String,Object>> claimMappings;
+    private @Nullable Output<Map<String,String>> claimMappings;
 
     /**
      * @return If set, a map of claims (keys) to be copied
      * to specified metadata fields (values).
      * 
      */
-    public Optional<Output<Map<String,Object>>> claimMappings() {
+    public Optional<Output<Map<String,String>>> claimMappings() {
         return Optional.ofNullable(this.claimMappings);
     }
 
@@ -666,7 +665,7 @@ public Builder boundAudiences(String... boundAudiences) {
          * @return builder
          * 
          */
-        public Builder boundClaims(@Nullable Output<Map<String,Object>> boundClaims) {
+        public Builder boundClaims(@Nullable Output<Map<String,String>> boundClaims) {
             $.boundClaims = boundClaims;
             return this;
         }
@@ -679,7 +678,7 @@ public Builder boundClaims(@Nullable Output<Map<String,Object>> boundClaims) {
          * @return builder
          * 
          */
-        public Builder boundClaims(Map<String,Object> boundClaims) {
+        public Builder boundClaims(Map<String,String> boundClaims) {
             return boundClaims(Output.of(boundClaims));
         }
 
@@ -738,7 +737,7 @@ public Builder boundSubject(String boundSubject) {
          * @return builder
          * 
          */
-        public Builder claimMappings(@Nullable Output<Map<String,Object>> claimMappings) {
+        public Builder claimMappings(@Nullable Output<Map<String,String>> claimMappings) {
             $.claimMappings = claimMappings;
             return this;
         }
@@ -750,7 +749,7 @@ public Builder claimMappings(@Nullable Output<Map<String,Object>> claimMappings)
          * @return builder
          * 
          */
-        public Builder claimMappings(Map<String,Object> claimMappings) {
+        public Builder claimMappings(Map<String,String> claimMappings) {
             return claimMappings(Output.of(claimMappings));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/kubernetes/SecretBackend.java b/sdk/java/src/main/java/com/pulumi/vault/kubernetes/SecretBackend.java
index b9445109b..3ada4a859 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/kubernetes/SecretBackend.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/kubernetes/SecretBackend.java
@@ -12,7 +12,6 @@
 import com.pulumi.vault.kubernetes.inputs.SecretBackendState;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -337,14 +336,14 @@ public Output<Optional<String>> namespace() {
      * Specifies mount type specific options that are passed to the backend
      * 
      */
-    @Export(name="options", refs={Map.class,String.class,Object.class}, tree="[0,1,2]")
-    private Output</* @Nullable */ Map<String,Object>> options;
+    @Export(name="options", refs={Map.class,String.class}, tree="[0,1,1]")
+    private Output</* @Nullable */ Map<String,String>> options;
 
     /**
      * @return Specifies mount type specific options that are passed to the backend
      * 
      */
-    public Output<Optional<Map<String,Object>>> options() {
+    public Output<Optional<Map<String,String>>> options() {
         return Codegen.optional(this.options);
     }
     /**
diff --git a/sdk/java/src/main/java/com/pulumi/vault/kubernetes/SecretBackendArgs.java b/sdk/java/src/main/java/com/pulumi/vault/kubernetes/SecretBackendArgs.java
index 40ec45c21..5460aeca0 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/kubernetes/SecretBackendArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/kubernetes/SecretBackendArgs.java
@@ -8,7 +8,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -284,13 +283,13 @@ public Optional<Output<String>> namespace() {
      * 
      */
     @Import(name="options")
-    private @Nullable Output<Map<String,Object>> options;
+    private @Nullable Output<Map<String,String>> options;
 
     /**
      * @return Specifies mount type specific options that are passed to the backend
      * 
      */
-    public Optional<Output<Map<String,Object>>> options() {
+    public Optional<Output<Map<String,String>>> options() {
         return Optional.ofNullable(this.options);
     }
 
@@ -828,7 +827,7 @@ public Builder namespace(String namespace) {
          * @return builder
          * 
          */
-        public Builder options(@Nullable Output<Map<String,Object>> options) {
+        public Builder options(@Nullable Output<Map<String,String>> options) {
             $.options = options;
             return this;
         }
@@ -839,7 +838,7 @@ public Builder options(@Nullable Output<Map<String,Object>> options) {
          * @return builder
          * 
          */
-        public Builder options(Map<String,Object> options) {
+        public Builder options(Map<String,String> options) {
             return options(Output.of(options));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/kubernetes/inputs/SecretBackendState.java b/sdk/java/src/main/java/com/pulumi/vault/kubernetes/inputs/SecretBackendState.java
index 19db68ad2..26e7b7cd0 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/kubernetes/inputs/SecretBackendState.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/kubernetes/inputs/SecretBackendState.java
@@ -7,7 +7,6 @@
 import com.pulumi.core.annotations.Import;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -298,13 +297,13 @@ public Optional<Output<String>> namespace() {
      * 
      */
     @Import(name="options")
-    private @Nullable Output<Map<String,Object>> options;
+    private @Nullable Output<Map<String,String>> options;
 
     /**
      * @return Specifies mount type specific options that are passed to the backend
      * 
      */
-    public Optional<Output<Map<String,Object>>> options() {
+    public Optional<Output<Map<String,String>>> options() {
         return Optional.ofNullable(this.options);
     }
 
@@ -864,7 +863,7 @@ public Builder namespace(String namespace) {
          * @return builder
          * 
          */
-        public Builder options(@Nullable Output<Map<String,Object>> options) {
+        public Builder options(@Nullable Output<Map<String,String>> options) {
             $.options = options;
             return this;
         }
@@ -875,7 +874,7 @@ public Builder options(@Nullable Output<Map<String,Object>> options) {
          * @return builder
          * 
          */
-        public Builder options(Map<String,Object> options) {
+        public Builder options(Map<String,String> options) {
             return options(Output.of(options));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/kv/Secret.java b/sdk/java/src/main/java/com/pulumi/vault/kv/Secret.java
index 6bd36a485..3c49be6cc 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/kv/Secret.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/kv/Secret.java
@@ -10,7 +10,6 @@
 import com.pulumi.vault.Utilities;
 import com.pulumi.vault.kv.SecretArgs;
 import com.pulumi.vault.kv.inputs.SecretState;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -98,8 +97,8 @@ public class Secret extends com.pulumi.resources.CustomResource {
      * serialized as JSON.
      * 
      */
-    @Export(name="data", refs={Map.class,String.class,Object.class}, tree="[0,1,2]")
-    private Output<Map<String,Object>> data;
+    @Export(name="data", refs={Map.class,String.class}, tree="[0,1,1]")
+    private Output<Map<String,String>> data;
 
     /**
      * @return A mapping whose keys are the top-level data keys returned from
@@ -108,7 +107,7 @@ public class Secret extends com.pulumi.resources.CustomResource {
      * serialized as JSON.
      * 
      */
-    public Output<Map<String,Object>> data() {
+    public Output<Map<String,String>> data() {
         return this.data;
     }
     /**
diff --git a/sdk/java/src/main/java/com/pulumi/vault/kv/SecretV2.java b/sdk/java/src/main/java/com/pulumi/vault/kv/SecretV2.java
index 6c3856758..df4abbe6a 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/kv/SecretV2.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/kv/SecretV2.java
@@ -13,7 +13,6 @@
 import com.pulumi.vault.kv.outputs.SecretV2CustomMetadata;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -162,8 +161,8 @@ public Output<SecretV2CustomMetadata> customMetadata() {
      * serialized as JSON.
      * 
      */
-    @Export(name="data", refs={Map.class,String.class,Object.class}, tree="[0,1,2]")
-    private Output<Map<String,Object>> data;
+    @Export(name="data", refs={Map.class,String.class}, tree="[0,1,1]")
+    private Output<Map<String,String>> data;
 
     /**
      * @return A mapping whose keys are the top-level data keys returned from
@@ -172,7 +171,7 @@ public Output<SecretV2CustomMetadata> customMetadata() {
      * serialized as JSON.
      * 
      */
-    public Output<Map<String,Object>> data() {
+    public Output<Map<String,String>> data() {
         return this.data;
     }
     /**
@@ -227,14 +226,14 @@ public Output<Optional<Boolean>> disableRead() {
      * Metadata associated with this secret read from Vault.
      * 
      */
-    @Export(name="metadata", refs={Map.class,String.class,Object.class}, tree="[0,1,2]")
-    private Output<Map<String,Object>> metadata;
+    @Export(name="metadata", refs={Map.class,String.class}, tree="[0,1,1]")
+    private Output<Map<String,String>> metadata;
 
     /**
      * @return Metadata associated with this secret read from Vault.
      * 
      */
-    public Output<Map<String,Object>> metadata() {
+    public Output<Map<String,String>> metadata() {
         return this.metadata;
     }
     /**
@@ -295,14 +294,14 @@ public Output<Optional<String>> namespace() {
      * An object that holds option settings.
      * 
      */
-    @Export(name="options", refs={Map.class,String.class,Object.class}, tree="[0,1,2]")
-    private Output</* @Nullable */ Map<String,Object>> options;
+    @Export(name="options", refs={Map.class,String.class}, tree="[0,1,1]")
+    private Output</* @Nullable */ Map<String,String>> options;
 
     /**
      * @return An object that holds option settings.
      * 
      */
-    public Output<Optional<Map<String,Object>>> options() {
+    public Output<Optional<Map<String,String>>> options() {
         return Codegen.optional(this.options);
     }
     /**
diff --git a/sdk/java/src/main/java/com/pulumi/vault/kv/SecretV2Args.java b/sdk/java/src/main/java/com/pulumi/vault/kv/SecretV2Args.java
index 473453c55..7220724ff 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/kv/SecretV2Args.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/kv/SecretV2Args.java
@@ -9,7 +9,6 @@
 import com.pulumi.vault.kv.inputs.SecretV2CustomMetadataArgs;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.Map;
 import java.util.Objects;
@@ -174,13 +173,13 @@ public Optional<Output<String>> namespace() {
      * 
      */
     @Import(name="options")
-    private @Nullable Output<Map<String,Object>> options;
+    private @Nullable Output<Map<String,String>> options;
 
     /**
      * @return An object that holds option settings.
      * 
      */
-    public Optional<Output<Map<String,Object>>> options() {
+    public Optional<Output<Map<String,String>>> options() {
         return Optional.ofNullable(this.options);
     }
 
@@ -418,7 +417,7 @@ public Builder namespace(String namespace) {
          * @return builder
          * 
          */
-        public Builder options(@Nullable Output<Map<String,Object>> options) {
+        public Builder options(@Nullable Output<Map<String,String>> options) {
             $.options = options;
             return this;
         }
@@ -429,7 +428,7 @@ public Builder options(@Nullable Output<Map<String,Object>> options) {
          * @return builder
          * 
          */
-        public Builder options(Map<String,Object> options) {
+        public Builder options(Map<String,String> options) {
             return options(Output.of(options));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/kv/inputs/SecretState.java b/sdk/java/src/main/java/com/pulumi/vault/kv/inputs/SecretState.java
index d7b6db46e..0d6466f6e 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/kv/inputs/SecretState.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/kv/inputs/SecretState.java
@@ -5,7 +5,6 @@
 
 import com.pulumi.core.Output;
 import com.pulumi.core.annotations.Import;
-import java.lang.Object;
 import java.lang.String;
 import java.util.Map;
 import java.util.Objects;
@@ -25,7 +24,7 @@ public final class SecretState extends com.pulumi.resources.ResourceArgs {
      * 
      */
     @Import(name="data")
-    private @Nullable Output<Map<String,Object>> data;
+    private @Nullable Output<Map<String,String>> data;
 
     /**
      * @return A mapping whose keys are the top-level data keys returned from
@@ -34,7 +33,7 @@ public final class SecretState extends com.pulumi.resources.ResourceArgs {
      * serialized as JSON.
      * 
      */
-    public Optional<Output<Map<String,Object>>> data() {
+    public Optional<Output<Map<String,String>>> data() {
         return Optional.ofNullable(this.data);
     }
 
@@ -127,7 +126,7 @@ public Builder(SecretState defaults) {
          * @return builder
          * 
          */
-        public Builder data(@Nullable Output<Map<String,Object>> data) {
+        public Builder data(@Nullable Output<Map<String,String>> data) {
             $.data = data;
             return this;
         }
@@ -141,7 +140,7 @@ public Builder data(@Nullable Output<Map<String,Object>> data) {
          * @return builder
          * 
          */
-        public Builder data(Map<String,Object> data) {
+        public Builder data(Map<String,String> data) {
             return data(Output.of(data));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/kv/inputs/SecretV2CustomMetadataArgs.java b/sdk/java/src/main/java/com/pulumi/vault/kv/inputs/SecretV2CustomMetadataArgs.java
index 8cf9bab45..ba3dc5db3 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/kv/inputs/SecretV2CustomMetadataArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/kv/inputs/SecretV2CustomMetadataArgs.java
@@ -7,7 +7,6 @@
 import com.pulumi.core.annotations.Import;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.Map;
 import java.util.Objects;
@@ -42,7 +41,7 @@ public Optional<Output<Boolean>> casRequired() {
      * 
      */
     @Import(name="data")
-    private @Nullable Output<Map<String,Object>> data;
+    private @Nullable Output<Map<String,String>> data;
 
     /**
      * @return A mapping whose keys are the top-level data keys returned from
@@ -51,7 +50,7 @@ public Optional<Output<Boolean>> casRequired() {
      * serialized as JSON.
      * 
      */
-    public Optional<Output<Map<String,Object>>> data() {
+    public Optional<Output<Map<String,String>>> data() {
         return Optional.ofNullable(this.data);
     }
 
@@ -142,7 +141,7 @@ public Builder casRequired(Boolean casRequired) {
          * @return builder
          * 
          */
-        public Builder data(@Nullable Output<Map<String,Object>> data) {
+        public Builder data(@Nullable Output<Map<String,String>> data) {
             $.data = data;
             return this;
         }
@@ -156,7 +155,7 @@ public Builder data(@Nullable Output<Map<String,Object>> data) {
          * @return builder
          * 
          */
-        public Builder data(Map<String,Object> data) {
+        public Builder data(Map<String,String> data) {
             return data(Output.of(data));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/kv/inputs/SecretV2State.java b/sdk/java/src/main/java/com/pulumi/vault/kv/inputs/SecretV2State.java
index d4272b2d4..1372281b4 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/kv/inputs/SecretV2State.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/kv/inputs/SecretV2State.java
@@ -8,7 +8,6 @@
 import com.pulumi.vault.kv.inputs.SecretV2CustomMetadataArgs;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.Map;
 import java.util.Objects;
@@ -68,7 +67,7 @@ public Optional<Output<SecretV2CustomMetadataArgs>> customMetadata() {
      * 
      */
     @Import(name="data")
-    private @Nullable Output<Map<String,Object>> data;
+    private @Nullable Output<Map<String,String>> data;
 
     /**
      * @return A mapping whose keys are the top-level data keys returned from
@@ -77,7 +76,7 @@ public Optional<Output<SecretV2CustomMetadataArgs>> customMetadata() {
      * serialized as JSON.
      * 
      */
-    public Optional<Output<Map<String,Object>>> data() {
+    public Optional<Output<Map<String,String>>> data() {
         return Optional.ofNullable(this.data);
     }
 
@@ -137,13 +136,13 @@ public Optional<Output<Boolean>> disableRead() {
      * 
      */
     @Import(name="metadata")
-    private @Nullable Output<Map<String,Object>> metadata;
+    private @Nullable Output<Map<String,String>> metadata;
 
     /**
      * @return Metadata associated with this secret read from Vault.
      * 
      */
-    public Optional<Output<Map<String,Object>>> metadata() {
+    public Optional<Output<Map<String,String>>> metadata() {
         return Optional.ofNullable(this.metadata);
     }
 
@@ -209,13 +208,13 @@ public Optional<Output<String>> namespace() {
      * 
      */
     @Import(name="options")
-    private @Nullable Output<Map<String,Object>> options;
+    private @Nullable Output<Map<String,String>> options;
 
     /**
      * @return An object that holds option settings.
      * 
      */
-    public Optional<Output<Map<String,Object>>> options() {
+    public Optional<Output<Map<String,String>>> options() {
         return Optional.ofNullable(this.options);
     }
 
@@ -330,7 +329,7 @@ public Builder customMetadata(SecretV2CustomMetadataArgs customMetadata) {
          * @return builder
          * 
          */
-        public Builder data(@Nullable Output<Map<String,Object>> data) {
+        public Builder data(@Nullable Output<Map<String,String>> data) {
             $.data = data;
             return this;
         }
@@ -344,7 +343,7 @@ public Builder data(@Nullable Output<Map<String,Object>> data) {
          * @return builder
          * 
          */
-        public Builder data(Map<String,Object> data) {
+        public Builder data(Map<String,String> data) {
             return data(Output.of(data));
         }
 
@@ -423,7 +422,7 @@ public Builder disableRead(Boolean disableRead) {
          * @return builder
          * 
          */
-        public Builder metadata(@Nullable Output<Map<String,Object>> metadata) {
+        public Builder metadata(@Nullable Output<Map<String,String>> metadata) {
             $.metadata = metadata;
             return this;
         }
@@ -434,7 +433,7 @@ public Builder metadata(@Nullable Output<Map<String,Object>> metadata) {
          * @return builder
          * 
          */
-        public Builder metadata(Map<String,Object> metadata) {
+        public Builder metadata(Map<String,String> metadata) {
             return metadata(Output.of(metadata));
         }
 
@@ -519,7 +518,7 @@ public Builder namespace(String namespace) {
          * @return builder
          * 
          */
-        public Builder options(@Nullable Output<Map<String,Object>> options) {
+        public Builder options(@Nullable Output<Map<String,String>> options) {
             $.options = options;
             return this;
         }
@@ -530,7 +529,7 @@ public Builder options(@Nullable Output<Map<String,Object>> options) {
          * @return builder
          * 
          */
-        public Builder options(Map<String,Object> options) {
+        public Builder options(Map<String,String> options) {
             return options(Output.of(options));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/kv/outputs/GetSecretResult.java b/sdk/java/src/main/java/com/pulumi/vault/kv/outputs/GetSecretResult.java
index 10271a0ff..1fd84660f 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/kv/outputs/GetSecretResult.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/kv/outputs/GetSecretResult.java
@@ -7,7 +7,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.Map;
 import java.util.Objects;
@@ -23,7 +22,7 @@ public final class GetSecretResult {
      * serialized as JSON.
      * 
      */
-    private Map<String,Object> data;
+    private Map<String,String> data;
     /**
      * @return JSON-encoded string that that is
      * read as the secret data at the given path.
@@ -63,7 +62,7 @@ private GetSecretResult() {}
      * serialized as JSON.
      * 
      */
-    public Map<String,Object> data() {
+    public Map<String,String> data() {
         return this.data;
     }
     /**
@@ -120,7 +119,7 @@ public static Builder builder(GetSecretResult defaults) {
     }
     @CustomType.Builder
     public static final class Builder {
-        private Map<String,Object> data;
+        private Map<String,String> data;
         private String dataJson;
         private String id;
         private Integer leaseDuration;
@@ -142,7 +141,7 @@ public Builder(GetSecretResult defaults) {
         }
 
         @CustomType.Setter
-        public Builder data(Map<String,Object> data) {
+        public Builder data(Map<String,String> data) {
             if (data == null) {
               throw new MissingRequiredPropertyException("GetSecretResult", "data");
             }
diff --git a/sdk/java/src/main/java/com/pulumi/vault/kv/outputs/GetSecretSubkeysV2Result.java b/sdk/java/src/main/java/com/pulumi/vault/kv/outputs/GetSecretSubkeysV2Result.java
index 20aea94f4..1d425b247 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/kv/outputs/GetSecretSubkeysV2Result.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/kv/outputs/GetSecretSubkeysV2Result.java
@@ -6,7 +6,6 @@
 import com.pulumi.core.annotations.CustomType;
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.Map;
 import java.util.Objects;
@@ -19,7 +18,7 @@ public final class GetSecretSubkeysV2Result {
      * @return Subkeys for the KV-V2 secret stored as a serialized map of strings.
      * 
      */
-    private Map<String,Object> data;
+    private Map<String,String> data;
     /**
      * @return Subkeys for the KV-V2 secret read from Vault.
      * 
@@ -46,7 +45,7 @@ private GetSecretSubkeysV2Result() {}
      * @return Subkeys for the KV-V2 secret stored as a serialized map of strings.
      * 
      */
-    public Map<String,Object> data() {
+    public Map<String,String> data() {
         return this.data;
     }
     /**
@@ -95,7 +94,7 @@ public static Builder builder(GetSecretSubkeysV2Result defaults) {
     }
     @CustomType.Builder
     public static final class Builder {
-        private Map<String,Object> data;
+        private Map<String,String> data;
         private String dataJson;
         private @Nullable Integer depth;
         private String id;
@@ -119,7 +118,7 @@ public Builder(GetSecretSubkeysV2Result defaults) {
         }
 
         @CustomType.Setter
-        public Builder data(Map<String,Object> data) {
+        public Builder data(Map<String,String> data) {
             if (data == null) {
               throw new MissingRequiredPropertyException("GetSecretSubkeysV2Result", "data");
             }
diff --git a/sdk/java/src/main/java/com/pulumi/vault/kv/outputs/GetSecretV2Result.java b/sdk/java/src/main/java/com/pulumi/vault/kv/outputs/GetSecretV2Result.java
index 0e6e6539a..b1e250ef9 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/kv/outputs/GetSecretV2Result.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/kv/outputs/GetSecretV2Result.java
@@ -7,7 +7,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.Map;
 import java.util.Objects;
@@ -25,7 +24,7 @@ public final class GetSecretV2Result {
      * @return Custom metadata for the secret.
      * 
      */
-    private Map<String,Object> customMetadata;
+    private Map<String,String> customMetadata;
     /**
      * @return A mapping whose keys are the top-level data keys returned from
      * Vault and whose values are the corresponding values. This map can only
@@ -33,7 +32,7 @@ public final class GetSecretV2Result {
      * serialized as JSON.
      * 
      */
-    private Map<String,Object> data;
+    private Map<String,String> data;
     /**
      * @return JSON-encoded string that that is
      * read as the secret data at the given path.
@@ -81,7 +80,7 @@ public String createdTime() {
      * @return Custom metadata for the secret.
      * 
      */
-    public Map<String,Object> customMetadata() {
+    public Map<String,String> customMetadata() {
         return this.customMetadata;
     }
     /**
@@ -91,7 +90,7 @@ public Map<String,Object> customMetadata() {
      * serialized as JSON.
      * 
      */
-    public Map<String,Object> data() {
+    public Map<String,String> data() {
         return this.data;
     }
     /**
@@ -157,8 +156,8 @@ public static Builder builder(GetSecretV2Result defaults) {
     @CustomType.Builder
     public static final class Builder {
         private String createdTime;
-        private Map<String,Object> customMetadata;
-        private Map<String,Object> data;
+        private Map<String,String> customMetadata;
+        private Map<String,String> data;
         private String dataJson;
         private String deletionTime;
         private Boolean destroyed;
@@ -194,7 +193,7 @@ public Builder createdTime(String createdTime) {
             return this;
         }
         @CustomType.Setter
-        public Builder customMetadata(Map<String,Object> customMetadata) {
+        public Builder customMetadata(Map<String,String> customMetadata) {
             if (customMetadata == null) {
               throw new MissingRequiredPropertyException("GetSecretV2Result", "customMetadata");
             }
@@ -202,7 +201,7 @@ public Builder customMetadata(Map<String,Object> customMetadata) {
             return this;
         }
         @CustomType.Setter
-        public Builder data(Map<String,Object> data) {
+        public Builder data(Map<String,String> data) {
             if (data == null) {
               throw new MissingRequiredPropertyException("GetSecretV2Result", "data");
             }
diff --git a/sdk/java/src/main/java/com/pulumi/vault/kv/outputs/SecretV2CustomMetadata.java b/sdk/java/src/main/java/com/pulumi/vault/kv/outputs/SecretV2CustomMetadata.java
index 0c71742c6..084559dbe 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/kv/outputs/SecretV2CustomMetadata.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/kv/outputs/SecretV2CustomMetadata.java
@@ -6,7 +6,6 @@
 import com.pulumi.core.annotations.CustomType;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.Map;
 import java.util.Objects;
@@ -27,7 +26,7 @@ public final class SecretV2CustomMetadata {
      * serialized as JSON.
      * 
      */
-    private @Nullable Map<String,Object> data;
+    private @Nullable Map<String,String> data;
     /**
      * @return If set, specifies the length of time before a version is deleted.
      * 
@@ -54,7 +53,7 @@ public Optional<Boolean> casRequired() {
      * serialized as JSON.
      * 
      */
-    public Map<String,Object> data() {
+    public Map<String,String> data() {
         return this.data == null ? Map.of() : this.data;
     }
     /**
@@ -82,7 +81,7 @@ public static Builder builder(SecretV2CustomMetadata defaults) {
     @CustomType.Builder
     public static final class Builder {
         private @Nullable Boolean casRequired;
-        private @Nullable Map<String,Object> data;
+        private @Nullable Map<String,String> data;
         private @Nullable Integer deleteVersionAfter;
         private @Nullable Integer maxVersions;
         public Builder() {}
@@ -101,7 +100,7 @@ public Builder casRequired(@Nullable Boolean casRequired) {
             return this;
         }
         @CustomType.Setter
-        public Builder data(@Nullable Map<String,Object> data) {
+        public Builder data(@Nullable Map<String,String> data) {
 
             this.data = data;
             return this;
diff --git a/sdk/java/src/main/java/com/pulumi/vault/ldap/SecretBackend.java b/sdk/java/src/main/java/com/pulumi/vault/ldap/SecretBackend.java
index 8f6636d74..20ed7c3c6 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/ldap/SecretBackend.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/ldap/SecretBackend.java
@@ -12,7 +12,6 @@
 import com.pulumi.vault.ldap.inputs.SecretBackendState;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -397,14 +396,14 @@ public Output<Optional<String>> namespace() {
      * Specifies mount type specific options that are passed to the backend
      * 
      */
-    @Export(name="options", refs={Map.class,String.class,Object.class}, tree="[0,1,2]")
-    private Output</* @Nullable */ Map<String,Object>> options;
+    @Export(name="options", refs={Map.class,String.class}, tree="[0,1,1]")
+    private Output</* @Nullable */ Map<String,String>> options;
 
     /**
      * @return Specifies mount type specific options that are passed to the backend
      * 
      */
-    public Output<Optional<Map<String,Object>>> options() {
+    public Output<Optional<Map<String,String>>> options() {
         return Codegen.optional(this.options);
     }
     /**
diff --git a/sdk/java/src/main/java/com/pulumi/vault/ldap/SecretBackendArgs.java b/sdk/java/src/main/java/com/pulumi/vault/ldap/SecretBackendArgs.java
index f13014288..547e87871 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/ldap/SecretBackendArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/ldap/SecretBackendArgs.java
@@ -8,7 +8,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -355,13 +354,13 @@ public Optional<Output<String>> namespace() {
      * 
      */
     @Import(name="options")
-    private @Nullable Output<Map<String,Object>> options;
+    private @Nullable Output<Map<String,String>> options;
 
     /**
      * @return Specifies mount type specific options that are passed to the backend
      * 
      */
-    public Optional<Output<Map<String,Object>>> options() {
+    public Optional<Output<Map<String,String>>> options() {
         return Optional.ofNullable(this.options);
     }
 
@@ -1137,7 +1136,7 @@ public Builder namespace(String namespace) {
          * @return builder
          * 
          */
-        public Builder options(@Nullable Output<Map<String,Object>> options) {
+        public Builder options(@Nullable Output<Map<String,String>> options) {
             $.options = options;
             return this;
         }
@@ -1148,7 +1147,7 @@ public Builder options(@Nullable Output<Map<String,Object>> options) {
          * @return builder
          * 
          */
-        public Builder options(Map<String,Object> options) {
+        public Builder options(Map<String,String> options) {
             return options(Output.of(options));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/ldap/inputs/SecretBackendState.java b/sdk/java/src/main/java/com/pulumi/vault/ldap/inputs/SecretBackendState.java
index 6febd0109..b5b1d5792 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/ldap/inputs/SecretBackendState.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/ldap/inputs/SecretBackendState.java
@@ -7,7 +7,6 @@
 import com.pulumi.core.annotations.Import;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -369,13 +368,13 @@ public Optional<Output<String>> namespace() {
      * 
      */
     @Import(name="options")
-    private @Nullable Output<Map<String,Object>> options;
+    private @Nullable Output<Map<String,String>> options;
 
     /**
      * @return Specifies mount type specific options that are passed to the backend
      * 
      */
-    public Optional<Output<Map<String,Object>>> options() {
+    public Optional<Output<Map<String,String>>> options() {
         return Optional.ofNullable(this.options);
     }
 
@@ -1173,7 +1172,7 @@ public Builder namespace(String namespace) {
          * @return builder
          * 
          */
-        public Builder options(@Nullable Output<Map<String,Object>> options) {
+        public Builder options(@Nullable Output<Map<String,String>> options) {
             $.options = options;
             return this;
         }
@@ -1184,7 +1183,7 @@ public Builder options(@Nullable Output<Map<String,Object>> options) {
          * @return builder
          * 
          */
-        public Builder options(Map<String,Object> options) {
+        public Builder options(Map<String,String> options) {
             return options(Output.of(options));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/outputs/GetNamespaceResult.java b/sdk/java/src/main/java/com/pulumi/vault/outputs/GetNamespaceResult.java
index 042831cd8..02e273df9 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/outputs/GetNamespaceResult.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/outputs/GetNamespaceResult.java
@@ -5,7 +5,6 @@
 
 import com.pulumi.core.annotations.CustomType;
 import com.pulumi.exceptions.MissingRequiredPropertyException;
-import java.lang.Object;
 import java.lang.String;
 import java.util.Map;
 import java.util.Objects;
@@ -20,7 +19,7 @@ public final class GetNamespaceResult {
      * *Requires Vault 1.12+.*
      * 
      */
-    private Map<String,Object> customMetadata;
+    private Map<String,String> customMetadata;
     /**
      * @return The provider-assigned unique ID for this managed resource.
      * 
@@ -48,7 +47,7 @@ private GetNamespaceResult() {}
      * *Requires Vault 1.12+.*
      * 
      */
-    public Map<String,Object> customMetadata() {
+    public Map<String,String> customMetadata() {
         return this.customMetadata;
     }
     /**
@@ -90,7 +89,7 @@ public static Builder builder(GetNamespaceResult defaults) {
     }
     @CustomType.Builder
     public static final class Builder {
-        private Map<String,Object> customMetadata;
+        private Map<String,String> customMetadata;
         private String id;
         private @Nullable String namespace;
         private String namespaceId;
@@ -108,7 +107,7 @@ public Builder(GetNamespaceResult defaults) {
         }
 
         @CustomType.Setter
-        public Builder customMetadata(Map<String,Object> customMetadata) {
+        public Builder customMetadata(Map<String,String> customMetadata) {
             if (customMetadata == null) {
               throw new MissingRequiredPropertyException("GetNamespaceResult", "customMetadata");
             }
diff --git a/sdk/java/src/main/java/com/pulumi/vault/outputs/GetRaftAutopilotStateResult.java b/sdk/java/src/main/java/com/pulumi/vault/outputs/GetRaftAutopilotStateResult.java
index 0471b9306..862005fff 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/outputs/GetRaftAutopilotStateResult.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/outputs/GetRaftAutopilotStateResult.java
@@ -7,7 +7,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -47,7 +46,7 @@ public final class GetRaftAutopilotStateResult {
      * @return Additional output related to redundancy zones stored as a serialized map of strings.
      * 
      */
-    private Map<String,Object> redundancyZones;
+    private Map<String,String> redundancyZones;
     /**
      * @return Additional output related to redundancy zones.
      * 
@@ -57,7 +56,7 @@ public final class GetRaftAutopilotStateResult {
      * @return Additionaly output related to servers in the cluster stored as a serialized map of strings.
      * 
      */
-    private Map<String,Object> servers;
+    private Map<String,String> servers;
     /**
      * @return Additionaly output related to servers in the cluster.
      * 
@@ -67,7 +66,7 @@ public final class GetRaftAutopilotStateResult {
      * @return Additional output related to upgrade information stored as a serialized map of strings.
      * 
      */
-    private Map<String,Object> upgradeInfo;
+    private Map<String,String> upgradeInfo;
     /**
      * @return Additional output related to upgrade information.
      * 
@@ -122,7 +121,7 @@ public Integer optimisticFailureTolerance() {
      * @return Additional output related to redundancy zones stored as a serialized map of strings.
      * 
      */
-    public Map<String,Object> redundancyZones() {
+    public Map<String,String> redundancyZones() {
         return this.redundancyZones;
     }
     /**
@@ -136,7 +135,7 @@ public String redundancyZonesJson() {
      * @return Additionaly output related to servers in the cluster stored as a serialized map of strings.
      * 
      */
-    public Map<String,Object> servers() {
+    public Map<String,String> servers() {
         return this.servers;
     }
     /**
@@ -150,7 +149,7 @@ public String serversJson() {
      * @return Additional output related to upgrade information stored as a serialized map of strings.
      * 
      */
-    public Map<String,Object> upgradeInfo() {
+    public Map<String,String> upgradeInfo() {
         return this.upgradeInfo;
     }
     /**
@@ -183,11 +182,11 @@ public static final class Builder {
         private String leader;
         private @Nullable String namespace;
         private Integer optimisticFailureTolerance;
-        private Map<String,Object> redundancyZones;
+        private Map<String,String> redundancyZones;
         private String redundancyZonesJson;
-        private Map<String,Object> servers;
+        private Map<String,String> servers;
         private String serversJson;
-        private Map<String,Object> upgradeInfo;
+        private Map<String,String> upgradeInfo;
         private String upgradeInfoJson;
         private List<String> voters;
         public Builder() {}
@@ -255,7 +254,7 @@ public Builder optimisticFailureTolerance(Integer optimisticFailureTolerance) {
             return this;
         }
         @CustomType.Setter
-        public Builder redundancyZones(Map<String,Object> redundancyZones) {
+        public Builder redundancyZones(Map<String,String> redundancyZones) {
             if (redundancyZones == null) {
               throw new MissingRequiredPropertyException("GetRaftAutopilotStateResult", "redundancyZones");
             }
@@ -271,7 +270,7 @@ public Builder redundancyZonesJson(String redundancyZonesJson) {
             return this;
         }
         @CustomType.Setter
-        public Builder servers(Map<String,Object> servers) {
+        public Builder servers(Map<String,String> servers) {
             if (servers == null) {
               throw new MissingRequiredPropertyException("GetRaftAutopilotStateResult", "servers");
             }
@@ -287,7 +286,7 @@ public Builder serversJson(String serversJson) {
             return this;
         }
         @CustomType.Setter
-        public Builder upgradeInfo(Map<String,Object> upgradeInfo) {
+        public Builder upgradeInfo(Map<String,String> upgradeInfo) {
             if (upgradeInfo == null) {
               throw new MissingRequiredPropertyException("GetRaftAutopilotStateResult", "upgradeInfo");
             }
diff --git a/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/BackendConfigEst.java b/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/BackendConfigEst.java
index ac9d3924b..eaf3fc769 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/BackendConfigEst.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/BackendConfigEst.java
@@ -12,7 +12,6 @@
 import com.pulumi.vault.pkiSecret.inputs.BackendConfigEstState;
 import com.pulumi.vault.pkiSecret.outputs.BackendConfigEstAuthenticators;
 import java.lang.Boolean;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -143,14 +142,14 @@ public Output<Optional<Boolean>> enabled() {
      * Configures a pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:&lt;role_name&gt;. Labels must be unique across Vault cluster, and will register .well-known/est/&lt;label&gt; URL paths.
      * 
      */
-    @Export(name="labelToPathPolicy", refs={Map.class,String.class,Object.class}, tree="[0,1,2]")
-    private Output</* @Nullable */ Map<String,Object>> labelToPathPolicy;
+    @Export(name="labelToPathPolicy", refs={Map.class,String.class}, tree="[0,1,1]")
+    private Output</* @Nullable */ Map<String,String>> labelToPathPolicy;
 
     /**
      * @return Configures a pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:&lt;role_name&gt;. Labels must be unique across Vault cluster, and will register .well-known/est/&lt;label&gt; URL paths.
      * 
      */
-    public Output<Optional<Map<String,Object>>> labelToPathPolicy() {
+    public Output<Optional<Map<String,String>>> labelToPathPolicy() {
         return Codegen.optional(this.labelToPathPolicy);
     }
     /**
diff --git a/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/BackendConfigEstArgs.java b/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/BackendConfigEstArgs.java
index 051be1004..98ff40b00 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/BackendConfigEstArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/BackendConfigEstArgs.java
@@ -8,7 +8,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import com.pulumi.vault.pkiSecret.inputs.BackendConfigEstAuthenticatorsArgs;
 import java.lang.Boolean;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -137,13 +136,13 @@ public Optional<Output<Boolean>> enabled() {
      * 
      */
     @Import(name="labelToPathPolicy")
-    private @Nullable Output<Map<String,Object>> labelToPathPolicy;
+    private @Nullable Output<Map<String,String>> labelToPathPolicy;
 
     /**
      * @return Configures a pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:&lt;role_name&gt;. Labels must be unique across Vault cluster, and will register .well-known/est/&lt;label&gt; URL paths.
      * 
      */
-    public Optional<Output<Map<String,Object>>> labelToPathPolicy() {
+    public Optional<Output<Map<String,String>>> labelToPathPolicy() {
         return Optional.ofNullable(this.labelToPathPolicy);
     }
 
@@ -371,7 +370,7 @@ public Builder enabled(Boolean enabled) {
          * @return builder
          * 
          */
-        public Builder labelToPathPolicy(@Nullable Output<Map<String,Object>> labelToPathPolicy) {
+        public Builder labelToPathPolicy(@Nullable Output<Map<String,String>> labelToPathPolicy) {
             $.labelToPathPolicy = labelToPathPolicy;
             return this;
         }
@@ -382,7 +381,7 @@ public Builder labelToPathPolicy(@Nullable Output<Map<String,Object>> labelToPat
          * @return builder
          * 
          */
-        public Builder labelToPathPolicy(Map<String,Object> labelToPathPolicy) {
+        public Builder labelToPathPolicy(Map<String,String> labelToPathPolicy) {
             return labelToPathPolicy(Output.of(labelToPathPolicy));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/inputs/BackendConfigEstAuthenticatorsArgs.java b/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/inputs/BackendConfigEstAuthenticatorsArgs.java
index 516e7f2df..6e120fe14 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/inputs/BackendConfigEstAuthenticatorsArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/inputs/BackendConfigEstAuthenticatorsArgs.java
@@ -5,7 +5,6 @@
 
 import com.pulumi.core.Output;
 import com.pulumi.core.annotations.Import;
-import java.lang.Object;
 import java.lang.String;
 import java.util.Map;
 import java.util.Objects;
@@ -22,13 +21,13 @@ public final class BackendConfigEstAuthenticatorsArgs extends com.pulumi.resourc
      * 
      */
     @Import(name="cert")
-    private @Nullable Output<Map<String,Object>> cert;
+    private @Nullable Output<Map<String,String>> cert;
 
     /**
      * @return &#34;The accessor (required) and cert_role (optional) properties for cert auth backends&#34;.
      * 
      */
-    public Optional<Output<Map<String,Object>>> cert() {
+    public Optional<Output<Map<String,String>>> cert() {
         return Optional.ofNullable(this.cert);
     }
 
@@ -37,13 +36,13 @@ public Optional<Output<Map<String,Object>>> cert() {
      * 
      */
     @Import(name="userpass")
-    private @Nullable Output<Map<String,Object>> userpass;
+    private @Nullable Output<Map<String,String>> userpass;
 
     /**
      * @return &#34;The accessor (required) property for user pass auth backends&#34;.
      * 
      */
-    public Optional<Output<Map<String,Object>>> userpass() {
+    public Optional<Output<Map<String,String>>> userpass() {
         return Optional.ofNullable(this.userpass);
     }
 
@@ -78,7 +77,7 @@ public Builder(BackendConfigEstAuthenticatorsArgs defaults) {
          * @return builder
          * 
          */
-        public Builder cert(@Nullable Output<Map<String,Object>> cert) {
+        public Builder cert(@Nullable Output<Map<String,String>> cert) {
             $.cert = cert;
             return this;
         }
@@ -89,7 +88,7 @@ public Builder cert(@Nullable Output<Map<String,Object>> cert) {
          * @return builder
          * 
          */
-        public Builder cert(Map<String,Object> cert) {
+        public Builder cert(Map<String,String> cert) {
             return cert(Output.of(cert));
         }
 
@@ -99,7 +98,7 @@ public Builder cert(Map<String,Object> cert) {
          * @return builder
          * 
          */
-        public Builder userpass(@Nullable Output<Map<String,Object>> userpass) {
+        public Builder userpass(@Nullable Output<Map<String,String>> userpass) {
             $.userpass = userpass;
             return this;
         }
@@ -110,7 +109,7 @@ public Builder userpass(@Nullable Output<Map<String,Object>> userpass) {
          * @return builder
          * 
          */
-        public Builder userpass(Map<String,Object> userpass) {
+        public Builder userpass(Map<String,String> userpass) {
             return userpass(Output.of(userpass));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/inputs/BackendConfigEstState.java b/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/inputs/BackendConfigEstState.java
index 633319574..551cb2c0b 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/inputs/BackendConfigEstState.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/inputs/BackendConfigEstState.java
@@ -7,7 +7,6 @@
 import com.pulumi.core.annotations.Import;
 import com.pulumi.vault.pkiSecret.inputs.BackendConfigEstAuthenticatorsArgs;
 import java.lang.Boolean;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -136,13 +135,13 @@ public Optional<Output<Boolean>> enabled() {
      * 
      */
     @Import(name="labelToPathPolicy")
-    private @Nullable Output<Map<String,Object>> labelToPathPolicy;
+    private @Nullable Output<Map<String,String>> labelToPathPolicy;
 
     /**
      * @return Configures a pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:&lt;role_name&gt;. Labels must be unique across Vault cluster, and will register .well-known/est/&lt;label&gt; URL paths.
      * 
      */
-    public Optional<Output<Map<String,Object>>> labelToPathPolicy() {
+    public Optional<Output<Map<String,String>>> labelToPathPolicy() {
         return Optional.ofNullable(this.labelToPathPolicy);
     }
 
@@ -386,7 +385,7 @@ public Builder enabled(Boolean enabled) {
          * @return builder
          * 
          */
-        public Builder labelToPathPolicy(@Nullable Output<Map<String,Object>> labelToPathPolicy) {
+        public Builder labelToPathPolicy(@Nullable Output<Map<String,String>> labelToPathPolicy) {
             $.labelToPathPolicy = labelToPathPolicy;
             return this;
         }
@@ -397,7 +396,7 @@ public Builder labelToPathPolicy(@Nullable Output<Map<String,Object>> labelToPat
          * @return builder
          * 
          */
-        public Builder labelToPathPolicy(Map<String,Object> labelToPathPolicy) {
+        public Builder labelToPathPolicy(Map<String,String> labelToPathPolicy) {
             return labelToPathPolicy(Output.of(labelToPathPolicy));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/outputs/BackendConfigEstAuthenticators.java b/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/outputs/BackendConfigEstAuthenticators.java
index 01cf8f1e5..00b4ed1f6 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/outputs/BackendConfigEstAuthenticators.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/outputs/BackendConfigEstAuthenticators.java
@@ -4,7 +4,6 @@
 package com.pulumi.vault.pkiSecret.outputs;
 
 import com.pulumi.core.annotations.CustomType;
-import java.lang.Object;
 import java.lang.String;
 import java.util.Map;
 import java.util.Objects;
@@ -16,26 +15,26 @@ public final class BackendConfigEstAuthenticators {
      * @return &#34;The accessor (required) and cert_role (optional) properties for cert auth backends&#34;.
      * 
      */
-    private @Nullable Map<String,Object> cert;
+    private @Nullable Map<String,String> cert;
     /**
      * @return &#34;The accessor (required) property for user pass auth backends&#34;.
      * 
      */
-    private @Nullable Map<String,Object> userpass;
+    private @Nullable Map<String,String> userpass;
 
     private BackendConfigEstAuthenticators() {}
     /**
      * @return &#34;The accessor (required) and cert_role (optional) properties for cert auth backends&#34;.
      * 
      */
-    public Map<String,Object> cert() {
+    public Map<String,String> cert() {
         return this.cert == null ? Map.of() : this.cert;
     }
     /**
      * @return &#34;The accessor (required) property for user pass auth backends&#34;.
      * 
      */
-    public Map<String,Object> userpass() {
+    public Map<String,String> userpass() {
         return this.userpass == null ? Map.of() : this.userpass;
     }
 
@@ -48,8 +47,8 @@ public static Builder builder(BackendConfigEstAuthenticators defaults) {
     }
     @CustomType.Builder
     public static final class Builder {
-        private @Nullable Map<String,Object> cert;
-        private @Nullable Map<String,Object> userpass;
+        private @Nullable Map<String,String> cert;
+        private @Nullable Map<String,String> userpass;
         public Builder() {}
         public Builder(BackendConfigEstAuthenticators defaults) {
     	      Objects.requireNonNull(defaults);
@@ -58,13 +57,13 @@ public Builder(BackendConfigEstAuthenticators defaults) {
         }
 
         @CustomType.Setter
-        public Builder cert(@Nullable Map<String,Object> cert) {
+        public Builder cert(@Nullable Map<String,String> cert) {
 
             this.cert = cert;
             return this;
         }
         @CustomType.Setter
-        public Builder userpass(@Nullable Map<String,Object> userpass) {
+        public Builder userpass(@Nullable Map<String,String> userpass) {
 
             this.userpass = userpass;
             return this;
diff --git a/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/outputs/GetBackendConfigEstAuthenticator.java b/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/outputs/GetBackendConfigEstAuthenticator.java
index 082e51f5f..ba22ae24e 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/outputs/GetBackendConfigEstAuthenticator.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/outputs/GetBackendConfigEstAuthenticator.java
@@ -4,7 +4,6 @@
 package com.pulumi.vault.pkiSecret.outputs;
 
 import com.pulumi.core.annotations.CustomType;
-import java.lang.Object;
 import java.lang.String;
 import java.util.Map;
 import java.util.Objects;
@@ -16,26 +15,26 @@ public final class GetBackendConfigEstAuthenticator {
      * @return &#34;The accessor and cert_role properties for cert auth backends&#34;.
      * 
      */
-    private @Nullable Map<String,Object> cert;
+    private @Nullable Map<String,String> cert;
     /**
      * @return &#34;The accessor property for user pass auth backends&#34;.
      * 
      */
-    private @Nullable Map<String,Object> userpass;
+    private @Nullable Map<String,String> userpass;
 
     private GetBackendConfigEstAuthenticator() {}
     /**
      * @return &#34;The accessor and cert_role properties for cert auth backends&#34;.
      * 
      */
-    public Map<String,Object> cert() {
+    public Map<String,String> cert() {
         return this.cert == null ? Map.of() : this.cert;
     }
     /**
      * @return &#34;The accessor property for user pass auth backends&#34;.
      * 
      */
-    public Map<String,Object> userpass() {
+    public Map<String,String> userpass() {
         return this.userpass == null ? Map.of() : this.userpass;
     }
 
@@ -48,8 +47,8 @@ public static Builder builder(GetBackendConfigEstAuthenticator defaults) {
     }
     @CustomType.Builder
     public static final class Builder {
-        private @Nullable Map<String,Object> cert;
-        private @Nullable Map<String,Object> userpass;
+        private @Nullable Map<String,String> cert;
+        private @Nullable Map<String,String> userpass;
         public Builder() {}
         public Builder(GetBackendConfigEstAuthenticator defaults) {
     	      Objects.requireNonNull(defaults);
@@ -58,13 +57,13 @@ public Builder(GetBackendConfigEstAuthenticator defaults) {
         }
 
         @CustomType.Setter
-        public Builder cert(@Nullable Map<String,Object> cert) {
+        public Builder cert(@Nullable Map<String,String> cert) {
 
             this.cert = cert;
             return this;
         }
         @CustomType.Setter
-        public Builder userpass(@Nullable Map<String,Object> userpass) {
+        public Builder userpass(@Nullable Map<String,String> userpass) {
 
             this.userpass = userpass;
             return this;
diff --git a/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/outputs/GetBackendConfigEstResult.java b/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/outputs/GetBackendConfigEstResult.java
index 57a897022..2597ff4de 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/outputs/GetBackendConfigEstResult.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/outputs/GetBackendConfigEstResult.java
@@ -7,7 +7,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import com.pulumi.vault.pkiSecret.outputs.GetBackendConfigEstAuthenticator;
 import java.lang.Boolean;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -57,7 +56,7 @@ public final class GetBackendConfigEstResult {
      * @return A pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:&lt;role_name&gt;. Labels must be unique across Vault cluster, and will register .well-known/est/&lt;label&gt; URL paths.
      * 
      */
-    private Map<String,Object> labelToPathPolicy;
+    private Map<String,String> labelToPathPolicy;
     /**
      * @return A read-only timestamp representing the last time the configuration was updated.
      * 
@@ -122,7 +121,7 @@ public String id() {
      * @return A pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:&lt;role_name&gt;. Labels must be unique across Vault cluster, and will register .well-known/est/&lt;label&gt; URL paths.
      * 
      */
-    public Map<String,Object> labelToPathPolicy() {
+    public Map<String,String> labelToPathPolicy() {
         return this.labelToPathPolicy;
     }
     /**
@@ -153,7 +152,7 @@ public static final class Builder {
         private Boolean enableSentinelParsing;
         private Boolean enabled;
         private String id;
-        private Map<String,Object> labelToPathPolicy;
+        private Map<String,String> labelToPathPolicy;
         private String lastUpdated;
         private @Nullable String namespace;
         public Builder() {}
@@ -243,7 +242,7 @@ public Builder id(String id) {
             return this;
         }
         @CustomType.Setter
-        public Builder labelToPathPolicy(Map<String,Object> labelToPathPolicy) {
+        public Builder labelToPathPolicy(Map<String,String> labelToPathPolicy) {
             if (labelToPathPolicy == null) {
               throw new MissingRequiredPropertyException("GetBackendConfigEstResult", "labelToPathPolicy");
             }
diff --git a/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/outputs/GetBackendIssuersResult.java b/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/outputs/GetBackendIssuersResult.java
index 303bc2b6b..4c51b6a94 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/outputs/GetBackendIssuersResult.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/outputs/GetBackendIssuersResult.java
@@ -5,7 +5,6 @@
 
 import com.pulumi.core.annotations.CustomType;
 import com.pulumi.exceptions.MissingRequiredPropertyException;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -25,7 +24,7 @@ public final class GetBackendIssuersResult {
      * @return Map of issuer strings read from Vault.
      * 
      */
-    private Map<String,Object> keyInfo;
+    private Map<String,String> keyInfo;
     /**
      * @return JSON-encoded issuer data read from Vault.
      * 
@@ -53,7 +52,7 @@ public String id() {
      * @return Map of issuer strings read from Vault.
      * 
      */
-    public Map<String,Object> keyInfo() {
+    public Map<String,String> keyInfo() {
         return this.keyInfo;
     }
     /**
@@ -85,7 +84,7 @@ public static Builder builder(GetBackendIssuersResult defaults) {
     public static final class Builder {
         private String backend;
         private String id;
-        private Map<String,Object> keyInfo;
+        private Map<String,String> keyInfo;
         private String keyInfoJson;
         private List<String> keys;
         private @Nullable String namespace;
@@ -117,7 +116,7 @@ public Builder id(String id) {
             return this;
         }
         @CustomType.Setter
-        public Builder keyInfo(Map<String,Object> keyInfo) {
+        public Builder keyInfo(Map<String,String> keyInfo) {
             if (keyInfo == null) {
               throw new MissingRequiredPropertyException("GetBackendIssuersResult", "keyInfo");
             }
diff --git a/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/outputs/GetBackendKeysResult.java b/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/outputs/GetBackendKeysResult.java
index c230b777d..2f2f41bca 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/outputs/GetBackendKeysResult.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/pkiSecret/outputs/GetBackendKeysResult.java
@@ -5,7 +5,6 @@
 
 import com.pulumi.core.annotations.CustomType;
 import com.pulumi.exceptions.MissingRequiredPropertyException;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -25,7 +24,7 @@ public final class GetBackendKeysResult {
      * @return Map of key strings read from Vault.
      * 
      */
-    private Map<String,Object> keyInfo;
+    private Map<String,String> keyInfo;
     /**
      * @return JSON-encoded key data read from Vault.
      * 
@@ -53,7 +52,7 @@ public String id() {
      * @return Map of key strings read from Vault.
      * 
      */
-    public Map<String,Object> keyInfo() {
+    public Map<String,String> keyInfo() {
         return this.keyInfo;
     }
     /**
@@ -85,7 +84,7 @@ public static Builder builder(GetBackendKeysResult defaults) {
     public static final class Builder {
         private String backend;
         private String id;
-        private Map<String,Object> keyInfo;
+        private Map<String,String> keyInfo;
         private String keyInfoJson;
         private List<String> keys;
         private @Nullable String namespace;
@@ -117,7 +116,7 @@ public Builder id(String id) {
             return this;
         }
         @CustomType.Setter
-        public Builder keyInfo(Map<String,Object> keyInfo) {
+        public Builder keyInfo(Map<String,String> keyInfo) {
             if (keyInfo == null) {
               throw new MissingRequiredPropertyException("GetBackendKeysResult", "keyInfo");
             }
diff --git a/sdk/java/src/main/java/com/pulumi/vault/saml/AuthBackendRole.java b/sdk/java/src/main/java/com/pulumi/vault/saml/AuthBackendRole.java
index 1fd9093fb..18196ffe6 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/saml/AuthBackendRole.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/saml/AuthBackendRole.java
@@ -12,7 +12,6 @@
 import com.pulumi.vault.saml.inputs.AuthBackendRoleState;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -91,15 +90,15 @@ public class AuthBackendRole extends com.pulumi.resources.CustomResource {
      * exist in the SAML assertion.
      * 
      */
-    @Export(name="boundAttributes", refs={Map.class,String.class,Object.class}, tree="[0,1,2]")
-    private Output</* @Nullable */ Map<String,Object>> boundAttributes;
+    @Export(name="boundAttributes", refs={Map.class,String.class}, tree="[0,1,1]")
+    private Output</* @Nullable */ Map<String,String>> boundAttributes;
 
     /**
      * @return Mapping of attribute names to values that are expected to
      * exist in the SAML assertion.
      * 
      */
-    public Output<Optional<Map<String,Object>>> boundAttributes() {
+    public Output<Optional<Map<String,String>>> boundAttributes() {
         return Codegen.optional(this.boundAttributes);
     }
     /**
diff --git a/sdk/java/src/main/java/com/pulumi/vault/saml/AuthBackendRoleArgs.java b/sdk/java/src/main/java/com/pulumi/vault/saml/AuthBackendRoleArgs.java
index 0913cf763..f8bb2f330 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/saml/AuthBackendRoleArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/saml/AuthBackendRoleArgs.java
@@ -8,7 +8,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -27,14 +26,14 @@ public final class AuthBackendRoleArgs extends com.pulumi.resources.ResourceArgs
      * 
      */
     @Import(name="boundAttributes")
-    private @Nullable Output<Map<String,Object>> boundAttributes;
+    private @Nullable Output<Map<String,String>> boundAttributes;
 
     /**
      * @return Mapping of attribute names to values that are expected to
      * exist in the SAML assertion.
      * 
      */
-    public Optional<Output<Map<String,Object>>> boundAttributes() {
+    public Optional<Output<Map<String,String>>> boundAttributes() {
         return Optional.ofNullable(this.boundAttributes);
     }
 
@@ -335,7 +334,7 @@ public Builder(AuthBackendRoleArgs defaults) {
          * @return builder
          * 
          */
-        public Builder boundAttributes(@Nullable Output<Map<String,Object>> boundAttributes) {
+        public Builder boundAttributes(@Nullable Output<Map<String,String>> boundAttributes) {
             $.boundAttributes = boundAttributes;
             return this;
         }
@@ -347,7 +346,7 @@ public Builder boundAttributes(@Nullable Output<Map<String,Object>> boundAttribu
          * @return builder
          * 
          */
-        public Builder boundAttributes(Map<String,Object> boundAttributes) {
+        public Builder boundAttributes(Map<String,String> boundAttributes) {
             return boundAttributes(Output.of(boundAttributes));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/saml/inputs/AuthBackendRoleState.java b/sdk/java/src/main/java/com/pulumi/vault/saml/inputs/AuthBackendRoleState.java
index 0fc01ea0e..2a9f7d9b5 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/saml/inputs/AuthBackendRoleState.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/saml/inputs/AuthBackendRoleState.java
@@ -7,7 +7,6 @@
 import com.pulumi.core.annotations.Import;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -26,14 +25,14 @@ public final class AuthBackendRoleState extends com.pulumi.resources.ResourceArg
      * 
      */
     @Import(name="boundAttributes")
-    private @Nullable Output<Map<String,Object>> boundAttributes;
+    private @Nullable Output<Map<String,String>> boundAttributes;
 
     /**
      * @return Mapping of attribute names to values that are expected to
      * exist in the SAML assertion.
      * 
      */
-    public Optional<Output<Map<String,Object>>> boundAttributes() {
+    public Optional<Output<Map<String,String>>> boundAttributes() {
         return Optional.ofNullable(this.boundAttributes);
     }
 
@@ -334,7 +333,7 @@ public Builder(AuthBackendRoleState defaults) {
          * @return builder
          * 
          */
-        public Builder boundAttributes(@Nullable Output<Map<String,Object>> boundAttributes) {
+        public Builder boundAttributes(@Nullable Output<Map<String,String>> boundAttributes) {
             $.boundAttributes = boundAttributes;
             return this;
         }
@@ -346,7 +345,7 @@ public Builder boundAttributes(@Nullable Output<Map<String,Object>> boundAttribu
          * @return builder
          * 
          */
-        public Builder boundAttributes(Map<String,Object> boundAttributes) {
+        public Builder boundAttributes(Map<String,String> boundAttributes) {
             return boundAttributes(Output.of(boundAttributes));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/secrets/SyncAwsDestination.java b/sdk/java/src/main/java/com/pulumi/vault/secrets/SyncAwsDestination.java
index 405e600b5..02c39cd1b 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/secrets/SyncAwsDestination.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/secrets/SyncAwsDestination.java
@@ -10,7 +10,6 @@
 import com.pulumi.vault.Utilities;
 import com.pulumi.vault.secrets.SyncAwsDestinationArgs;
 import com.pulumi.vault.secrets.inputs.SyncAwsDestinationState;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -93,14 +92,14 @@ public Output<Optional<String>> accessKeyId() {
      * Custom tags to set on the secret managed at the destination.
      * 
      */
-    @Export(name="customTags", refs={Map.class,String.class,Object.class}, tree="[0,1,2]")
-    private Output</* @Nullable */ Map<String,Object>> customTags;
+    @Export(name="customTags", refs={Map.class,String.class}, tree="[0,1,1]")
+    private Output</* @Nullable */ Map<String,String>> customTags;
 
     /**
      * @return Custom tags to set on the secret managed at the destination.
      * 
      */
-    public Output<Optional<Map<String,Object>>> customTags() {
+    public Output<Optional<Map<String,String>>> customTags() {
         return Codegen.optional(this.customTags);
     }
     /**
diff --git a/sdk/java/src/main/java/com/pulumi/vault/secrets/SyncAwsDestinationArgs.java b/sdk/java/src/main/java/com/pulumi/vault/secrets/SyncAwsDestinationArgs.java
index e73e05319..2c39299de 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/secrets/SyncAwsDestinationArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/secrets/SyncAwsDestinationArgs.java
@@ -5,7 +5,6 @@
 
 import com.pulumi.core.Output;
 import com.pulumi.core.annotations.Import;
-import java.lang.Object;
 import java.lang.String;
 import java.util.Map;
 import java.util.Objects;
@@ -41,13 +40,13 @@ public Optional<Output<String>> accessKeyId() {
      * 
      */
     @Import(name="customTags")
-    private @Nullable Output<Map<String,Object>> customTags;
+    private @Nullable Output<Map<String,String>> customTags;
 
     /**
      * @return Custom tags to set on the secret managed at the destination.
      * 
      */
-    public Optional<Output<Map<String,Object>>> customTags() {
+    public Optional<Output<Map<String,String>>> customTags() {
         return Optional.ofNullable(this.customTags);
     }
 
@@ -267,7 +266,7 @@ public Builder accessKeyId(String accessKeyId) {
          * @return builder
          * 
          */
-        public Builder customTags(@Nullable Output<Map<String,Object>> customTags) {
+        public Builder customTags(@Nullable Output<Map<String,String>> customTags) {
             $.customTags = customTags;
             return this;
         }
@@ -278,7 +277,7 @@ public Builder customTags(@Nullable Output<Map<String,Object>> customTags) {
          * @return builder
          * 
          */
-        public Builder customTags(Map<String,Object> customTags) {
+        public Builder customTags(Map<String,String> customTags) {
             return customTags(Output.of(customTags));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/secrets/SyncAzureDestination.java b/sdk/java/src/main/java/com/pulumi/vault/secrets/SyncAzureDestination.java
index 04b51866e..8264cc8bf 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/secrets/SyncAzureDestination.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/secrets/SyncAzureDestination.java
@@ -10,7 +10,6 @@
 import com.pulumi.vault.Utilities;
 import com.pulumi.vault.secrets.SyncAzureDestinationArgs;
 import com.pulumi.vault.secrets.inputs.SyncAzureDestinationState;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -124,14 +123,14 @@ public Output<Optional<String>> cloud() {
      * Custom tags to set on the secret managed at the destination.
      * 
      */
-    @Export(name="customTags", refs={Map.class,String.class,Object.class}, tree="[0,1,2]")
-    private Output</* @Nullable */ Map<String,Object>> customTags;
+    @Export(name="customTags", refs={Map.class,String.class}, tree="[0,1,1]")
+    private Output</* @Nullable */ Map<String,String>> customTags;
 
     /**
      * @return Custom tags to set on the secret managed at the destination.
      * 
      */
-    public Output<Optional<Map<String,Object>>> customTags() {
+    public Output<Optional<Map<String,String>>> customTags() {
         return Codegen.optional(this.customTags);
     }
     /**
diff --git a/sdk/java/src/main/java/com/pulumi/vault/secrets/SyncAzureDestinationArgs.java b/sdk/java/src/main/java/com/pulumi/vault/secrets/SyncAzureDestinationArgs.java
index 956cbd953..8d063a07e 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/secrets/SyncAzureDestinationArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/secrets/SyncAzureDestinationArgs.java
@@ -5,7 +5,6 @@
 
 import com.pulumi.core.Output;
 import com.pulumi.core.annotations.Import;
-import java.lang.Object;
 import java.lang.String;
 import java.util.Map;
 import java.util.Objects;
@@ -75,13 +74,13 @@ public Optional<Output<String>> cloud() {
      * 
      */
     @Import(name="customTags")
-    private @Nullable Output<Map<String,Object>> customTags;
+    private @Nullable Output<Map<String,String>> customTags;
 
     /**
      * @return Custom tags to set on the secret managed at the destination.
      * 
      */
-    public Optional<Output<Map<String,Object>>> customTags() {
+    public Optional<Output<Map<String,String>>> customTags() {
         return Optional.ofNullable(this.customTags);
     }
 
@@ -301,7 +300,7 @@ public Builder cloud(String cloud) {
          * @return builder
          * 
          */
-        public Builder customTags(@Nullable Output<Map<String,Object>> customTags) {
+        public Builder customTags(@Nullable Output<Map<String,String>> customTags) {
             $.customTags = customTags;
             return this;
         }
@@ -312,7 +311,7 @@ public Builder customTags(@Nullable Output<Map<String,Object>> customTags) {
          * @return builder
          * 
          */
-        public Builder customTags(Map<String,Object> customTags) {
+        public Builder customTags(Map<String,String> customTags) {
             return customTags(Output.of(customTags));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/secrets/SyncGcpDestination.java b/sdk/java/src/main/java/com/pulumi/vault/secrets/SyncGcpDestination.java
index aab1f19c4..e1a869474 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/secrets/SyncGcpDestination.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/secrets/SyncGcpDestination.java
@@ -10,7 +10,6 @@
 import com.pulumi.vault.Utilities;
 import com.pulumi.vault.secrets.SyncGcpDestinationArgs;
 import com.pulumi.vault.secrets.inputs.SyncGcpDestinationState;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -92,14 +91,14 @@ public Output<Optional<String>> credentials() {
      * Custom tags to set on the secret managed at the destination.
      * 
      */
-    @Export(name="customTags", refs={Map.class,String.class,Object.class}, tree="[0,1,2]")
-    private Output</* @Nullable */ Map<String,Object>> customTags;
+    @Export(name="customTags", refs={Map.class,String.class}, tree="[0,1,1]")
+    private Output</* @Nullable */ Map<String,String>> customTags;
 
     /**
      * @return Custom tags to set on the secret managed at the destination.
      * 
      */
-    public Output<Optional<Map<String,Object>>> customTags() {
+    public Output<Optional<Map<String,String>>> customTags() {
         return Codegen.optional(this.customTags);
     }
     /**
diff --git a/sdk/java/src/main/java/com/pulumi/vault/secrets/SyncGcpDestinationArgs.java b/sdk/java/src/main/java/com/pulumi/vault/secrets/SyncGcpDestinationArgs.java
index 17199ae58..65693fe59 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/secrets/SyncGcpDestinationArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/secrets/SyncGcpDestinationArgs.java
@@ -5,7 +5,6 @@
 
 import com.pulumi.core.Output;
 import com.pulumi.core.annotations.Import;
-import java.lang.Object;
 import java.lang.String;
 import java.util.Map;
 import java.util.Objects;
@@ -41,13 +40,13 @@ public Optional<Output<String>> credentials() {
      * 
      */
     @Import(name="customTags")
-    private @Nullable Output<Map<String,Object>> customTags;
+    private @Nullable Output<Map<String,String>> customTags;
 
     /**
      * @return Custom tags to set on the secret managed at the destination.
      * 
      */
-    public Optional<Output<Map<String,Object>>> customTags() {
+    public Optional<Output<Map<String,String>>> customTags() {
         return Optional.ofNullable(this.customTags);
     }
 
@@ -201,7 +200,7 @@ public Builder credentials(String credentials) {
          * @return builder
          * 
          */
-        public Builder customTags(@Nullable Output<Map<String,Object>> customTags) {
+        public Builder customTags(@Nullable Output<Map<String,String>> customTags) {
             $.customTags = customTags;
             return this;
         }
@@ -212,7 +211,7 @@ public Builder customTags(@Nullable Output<Map<String,Object>> customTags) {
          * @return builder
          * 
          */
-        public Builder customTags(Map<String,Object> customTags) {
+        public Builder customTags(Map<String,String> customTags) {
             return customTags(Output.of(customTags));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/secrets/inputs/SyncAwsDestinationState.java b/sdk/java/src/main/java/com/pulumi/vault/secrets/inputs/SyncAwsDestinationState.java
index d275c636e..a002e0f06 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/secrets/inputs/SyncAwsDestinationState.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/secrets/inputs/SyncAwsDestinationState.java
@@ -5,7 +5,6 @@
 
 import com.pulumi.core.Output;
 import com.pulumi.core.annotations.Import;
-import java.lang.Object;
 import java.lang.String;
 import java.util.Map;
 import java.util.Objects;
@@ -41,13 +40,13 @@ public Optional<Output<String>> accessKeyId() {
      * 
      */
     @Import(name="customTags")
-    private @Nullable Output<Map<String,Object>> customTags;
+    private @Nullable Output<Map<String,String>> customTags;
 
     /**
      * @return Custom tags to set on the secret managed at the destination.
      * 
      */
-    public Optional<Output<Map<String,Object>>> customTags() {
+    public Optional<Output<Map<String,String>>> customTags() {
         return Optional.ofNullable(this.customTags);
     }
 
@@ -283,7 +282,7 @@ public Builder accessKeyId(String accessKeyId) {
          * @return builder
          * 
          */
-        public Builder customTags(@Nullable Output<Map<String,Object>> customTags) {
+        public Builder customTags(@Nullable Output<Map<String,String>> customTags) {
             $.customTags = customTags;
             return this;
         }
@@ -294,7 +293,7 @@ public Builder customTags(@Nullable Output<Map<String,Object>> customTags) {
          * @return builder
          * 
          */
-        public Builder customTags(Map<String,Object> customTags) {
+        public Builder customTags(Map<String,String> customTags) {
             return customTags(Output.of(customTags));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/secrets/inputs/SyncAzureDestinationState.java b/sdk/java/src/main/java/com/pulumi/vault/secrets/inputs/SyncAzureDestinationState.java
index 1b57aa839..ca5437f74 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/secrets/inputs/SyncAzureDestinationState.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/secrets/inputs/SyncAzureDestinationState.java
@@ -5,7 +5,6 @@
 
 import com.pulumi.core.Output;
 import com.pulumi.core.annotations.Import;
-import java.lang.Object;
 import java.lang.String;
 import java.util.Map;
 import java.util.Objects;
@@ -75,13 +74,13 @@ public Optional<Output<String>> cloud() {
      * 
      */
     @Import(name="customTags")
-    private @Nullable Output<Map<String,Object>> customTags;
+    private @Nullable Output<Map<String,String>> customTags;
 
     /**
      * @return Custom tags to set on the secret managed at the destination.
      * 
      */
-    public Optional<Output<Map<String,Object>>> customTags() {
+    public Optional<Output<Map<String,String>>> customTags() {
         return Optional.ofNullable(this.customTags);
     }
 
@@ -317,7 +316,7 @@ public Builder cloud(String cloud) {
          * @return builder
          * 
          */
-        public Builder customTags(@Nullable Output<Map<String,Object>> customTags) {
+        public Builder customTags(@Nullable Output<Map<String,String>> customTags) {
             $.customTags = customTags;
             return this;
         }
@@ -328,7 +327,7 @@ public Builder customTags(@Nullable Output<Map<String,Object>> customTags) {
          * @return builder
          * 
          */
-        public Builder customTags(Map<String,Object> customTags) {
+        public Builder customTags(Map<String,String> customTags) {
             return customTags(Output.of(customTags));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/secrets/inputs/SyncGcpDestinationState.java b/sdk/java/src/main/java/com/pulumi/vault/secrets/inputs/SyncGcpDestinationState.java
index a61bb5906..570c916dd 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/secrets/inputs/SyncGcpDestinationState.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/secrets/inputs/SyncGcpDestinationState.java
@@ -5,7 +5,6 @@
 
 import com.pulumi.core.Output;
 import com.pulumi.core.annotations.Import;
-import java.lang.Object;
 import java.lang.String;
 import java.util.Map;
 import java.util.Objects;
@@ -41,13 +40,13 @@ public Optional<Output<String>> credentials() {
      * 
      */
     @Import(name="customTags")
-    private @Nullable Output<Map<String,Object>> customTags;
+    private @Nullable Output<Map<String,String>> customTags;
 
     /**
      * @return Custom tags to set on the secret managed at the destination.
      * 
      */
-    public Optional<Output<Map<String,Object>>> customTags() {
+    public Optional<Output<Map<String,String>>> customTags() {
         return Optional.ofNullable(this.customTags);
     }
 
@@ -217,7 +216,7 @@ public Builder credentials(String credentials) {
          * @return builder
          * 
          */
-        public Builder customTags(@Nullable Output<Map<String,Object>> customTags) {
+        public Builder customTags(@Nullable Output<Map<String,String>> customTags) {
             $.customTags = customTags;
             return this;
         }
@@ -228,7 +227,7 @@ public Builder customTags(@Nullable Output<Map<String,Object>> customTags) {
          * @return builder
          * 
          */
-        public Builder customTags(Map<String,Object> customTags) {
+        public Builder customTags(Map<String,String> customTags) {
             return customTags(Output.of(customTags));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/ssh/SecretBackendRole.java b/sdk/java/src/main/java/com/pulumi/vault/ssh/SecretBackendRole.java
index 93b8c7c16..c976de293 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/ssh/SecretBackendRole.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/ssh/SecretBackendRole.java
@@ -12,7 +12,6 @@
 import com.pulumi.vault.ssh.inputs.SecretBackendRoleState;
 import com.pulumi.vault.ssh.outputs.SecretBackendRoleAllowedUserKeyConfig;
 import java.lang.Boolean;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -307,28 +306,28 @@ public Output<Optional<String>> cidrList() {
      * Specifies a map of critical options that certificates have when signed.
      * 
      */
-    @Export(name="defaultCriticalOptions", refs={Map.class,String.class,Object.class}, tree="[0,1,2]")
-    private Output</* @Nullable */ Map<String,Object>> defaultCriticalOptions;
+    @Export(name="defaultCriticalOptions", refs={Map.class,String.class}, tree="[0,1,1]")
+    private Output</* @Nullable */ Map<String,String>> defaultCriticalOptions;
 
     /**
      * @return Specifies a map of critical options that certificates have when signed.
      * 
      */
-    public Output<Optional<Map<String,Object>>> defaultCriticalOptions() {
+    public Output<Optional<Map<String,String>>> defaultCriticalOptions() {
         return Codegen.optional(this.defaultCriticalOptions);
     }
     /**
      * Specifies a map of extensions that certificates have when signed.
      * 
      */
-    @Export(name="defaultExtensions", refs={Map.class,String.class,Object.class}, tree="[0,1,2]")
-    private Output</* @Nullable */ Map<String,Object>> defaultExtensions;
+    @Export(name="defaultExtensions", refs={Map.class,String.class}, tree="[0,1,1]")
+    private Output</* @Nullable */ Map<String,String>> defaultExtensions;
 
     /**
      * @return Specifies a map of extensions that certificates have when signed.
      * 
      */
-    public Output<Optional<Map<String,Object>>> defaultExtensions() {
+    public Output<Optional<Map<String,String>>> defaultExtensions() {
         return Codegen.optional(this.defaultExtensions);
     }
     /**
diff --git a/sdk/java/src/main/java/com/pulumi/vault/ssh/SecretBackendRoleArgs.java b/sdk/java/src/main/java/com/pulumi/vault/ssh/SecretBackendRoleArgs.java
index 3a6a2b5a0..4579c427c 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/ssh/SecretBackendRoleArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/ssh/SecretBackendRoleArgs.java
@@ -8,7 +8,6 @@
 import com.pulumi.exceptions.MissingRequiredPropertyException;
 import com.pulumi.vault.ssh.inputs.SecretBackendRoleAllowedUserKeyConfigArgs;
 import java.lang.Boolean;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -257,13 +256,13 @@ public Optional<Output<String>> cidrList() {
      * 
      */
     @Import(name="defaultCriticalOptions")
-    private @Nullable Output<Map<String,Object>> defaultCriticalOptions;
+    private @Nullable Output<Map<String,String>> defaultCriticalOptions;
 
     /**
      * @return Specifies a map of critical options that certificates have when signed.
      * 
      */
-    public Optional<Output<Map<String,Object>>> defaultCriticalOptions() {
+    public Optional<Output<Map<String,String>>> defaultCriticalOptions() {
         return Optional.ofNullable(this.defaultCriticalOptions);
     }
 
@@ -272,13 +271,13 @@ public Optional<Output<Map<String,Object>>> defaultCriticalOptions() {
      * 
      */
     @Import(name="defaultExtensions")
-    private @Nullable Output<Map<String,Object>> defaultExtensions;
+    private @Nullable Output<Map<String,String>> defaultExtensions;
 
     /**
      * @return Specifies a map of extensions that certificates have when signed.
      * 
      */
-    public Optional<Output<Map<String,Object>>> defaultExtensions() {
+    public Optional<Output<Map<String,String>>> defaultExtensions() {
         return Optional.ofNullable(this.defaultExtensions);
     }
 
@@ -811,7 +810,7 @@ public Builder cidrList(String cidrList) {
          * @return builder
          * 
          */
-        public Builder defaultCriticalOptions(@Nullable Output<Map<String,Object>> defaultCriticalOptions) {
+        public Builder defaultCriticalOptions(@Nullable Output<Map<String,String>> defaultCriticalOptions) {
             $.defaultCriticalOptions = defaultCriticalOptions;
             return this;
         }
@@ -822,7 +821,7 @@ public Builder defaultCriticalOptions(@Nullable Output<Map<String,Object>> defau
          * @return builder
          * 
          */
-        public Builder defaultCriticalOptions(Map<String,Object> defaultCriticalOptions) {
+        public Builder defaultCriticalOptions(Map<String,String> defaultCriticalOptions) {
             return defaultCriticalOptions(Output.of(defaultCriticalOptions));
         }
 
@@ -832,7 +831,7 @@ public Builder defaultCriticalOptions(Map<String,Object> defaultCriticalOptions)
          * @return builder
          * 
          */
-        public Builder defaultExtensions(@Nullable Output<Map<String,Object>> defaultExtensions) {
+        public Builder defaultExtensions(@Nullable Output<Map<String,String>> defaultExtensions) {
             $.defaultExtensions = defaultExtensions;
             return this;
         }
@@ -843,7 +842,7 @@ public Builder defaultExtensions(@Nullable Output<Map<String,Object>> defaultExt
          * @return builder
          * 
          */
-        public Builder defaultExtensions(Map<String,Object> defaultExtensions) {
+        public Builder defaultExtensions(Map<String,String> defaultExtensions) {
             return defaultExtensions(Output.of(defaultExtensions));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/ssh/inputs/SecretBackendRoleState.java b/sdk/java/src/main/java/com/pulumi/vault/ssh/inputs/SecretBackendRoleState.java
index 8cbc580a4..87bca598b 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/ssh/inputs/SecretBackendRoleState.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/ssh/inputs/SecretBackendRoleState.java
@@ -7,7 +7,6 @@
 import com.pulumi.core.annotations.Import;
 import com.pulumi.vault.ssh.inputs.SecretBackendRoleAllowedUserKeyConfigArgs;
 import java.lang.Boolean;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -256,13 +255,13 @@ public Optional<Output<String>> cidrList() {
      * 
      */
     @Import(name="defaultCriticalOptions")
-    private @Nullable Output<Map<String,Object>> defaultCriticalOptions;
+    private @Nullable Output<Map<String,String>> defaultCriticalOptions;
 
     /**
      * @return Specifies a map of critical options that certificates have when signed.
      * 
      */
-    public Optional<Output<Map<String,Object>>> defaultCriticalOptions() {
+    public Optional<Output<Map<String,String>>> defaultCriticalOptions() {
         return Optional.ofNullable(this.defaultCriticalOptions);
     }
 
@@ -271,13 +270,13 @@ public Optional<Output<Map<String,Object>>> defaultCriticalOptions() {
      * 
      */
     @Import(name="defaultExtensions")
-    private @Nullable Output<Map<String,Object>> defaultExtensions;
+    private @Nullable Output<Map<String,String>> defaultExtensions;
 
     /**
      * @return Specifies a map of extensions that certificates have when signed.
      * 
      */
-    public Optional<Output<Map<String,Object>>> defaultExtensions() {
+    public Optional<Output<Map<String,String>>> defaultExtensions() {
         return Optional.ofNullable(this.defaultExtensions);
     }
 
@@ -810,7 +809,7 @@ public Builder cidrList(String cidrList) {
          * @return builder
          * 
          */
-        public Builder defaultCriticalOptions(@Nullable Output<Map<String,Object>> defaultCriticalOptions) {
+        public Builder defaultCriticalOptions(@Nullable Output<Map<String,String>> defaultCriticalOptions) {
             $.defaultCriticalOptions = defaultCriticalOptions;
             return this;
         }
@@ -821,7 +820,7 @@ public Builder defaultCriticalOptions(@Nullable Output<Map<String,Object>> defau
          * @return builder
          * 
          */
-        public Builder defaultCriticalOptions(Map<String,Object> defaultCriticalOptions) {
+        public Builder defaultCriticalOptions(Map<String,String> defaultCriticalOptions) {
             return defaultCriticalOptions(Output.of(defaultCriticalOptions));
         }
 
@@ -831,7 +830,7 @@ public Builder defaultCriticalOptions(Map<String,Object> defaultCriticalOptions)
          * @return builder
          * 
          */
-        public Builder defaultExtensions(@Nullable Output<Map<String,Object>> defaultExtensions) {
+        public Builder defaultExtensions(@Nullable Output<Map<String,String>> defaultExtensions) {
             $.defaultExtensions = defaultExtensions;
             return this;
         }
@@ -842,7 +841,7 @@ public Builder defaultExtensions(@Nullable Output<Map<String,Object>> defaultExt
          * @return builder
          * 
          */
-        public Builder defaultExtensions(Map<String,Object> defaultExtensions) {
+        public Builder defaultExtensions(Map<String,String> defaultExtensions) {
             return defaultExtensions(Output.of(defaultExtensions));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/transform/Template.java b/sdk/java/src/main/java/com/pulumi/vault/transform/Template.java
index dfdcd71ed..b30db43a6 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/transform/Template.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/transform/Template.java
@@ -10,7 +10,6 @@
 import com.pulumi.vault.Utilities;
 import com.pulumi.vault.transform.TemplateArgs;
 import com.pulumi.vault.transform.inputs.TemplateState;
-import java.lang.Object;
 import java.lang.String;
 import java.util.Map;
 import java.util.Optional;
@@ -110,15 +109,15 @@ public Output<Optional<String>> alphabet() {
      * the decoded output. (requires Vault Enterprise 1.9+)
      * 
      */
-    @Export(name="decodeFormats", refs={Map.class,String.class,Object.class}, tree="[0,1,2]")
-    private Output</* @Nullable */ Map<String,Object>> decodeFormats;
+    @Export(name="decodeFormats", refs={Map.class,String.class}, tree="[0,1,1]")
+    private Output</* @Nullable */ Map<String,String>> decodeFormats;
 
     /**
      * @return Optional mapping of name to regular expression template, used to customize
      * the decoded output. (requires Vault Enterprise 1.9+)
      * 
      */
-    public Output<Optional<Map<String,Object>>> decodeFormats() {
+    public Output<Optional<Map<String,String>>> decodeFormats() {
         return Codegen.optional(this.decodeFormats);
     }
     /**
diff --git a/sdk/java/src/main/java/com/pulumi/vault/transform/TemplateArgs.java b/sdk/java/src/main/java/com/pulumi/vault/transform/TemplateArgs.java
index fd860f590..c667aa2c8 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/transform/TemplateArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/transform/TemplateArgs.java
@@ -6,7 +6,6 @@
 import com.pulumi.core.Output;
 import com.pulumi.core.annotations.Import;
 import com.pulumi.exceptions.MissingRequiredPropertyException;
-import java.lang.Object;
 import java.lang.String;
 import java.util.Map;
 import java.util.Objects;
@@ -39,14 +38,14 @@ public Optional<Output<String>> alphabet() {
      * 
      */
     @Import(name="decodeFormats")
-    private @Nullable Output<Map<String,Object>> decodeFormats;
+    private @Nullable Output<Map<String,String>> decodeFormats;
 
     /**
      * @return Optional mapping of name to regular expression template, used to customize
      * the decoded output. (requires Vault Enterprise 1.9+)
      * 
      */
-    public Optional<Output<Map<String,Object>>> decodeFormats() {
+    public Optional<Output<Map<String,String>>> decodeFormats() {
         return Optional.ofNullable(this.decodeFormats);
     }
 
@@ -207,7 +206,7 @@ public Builder alphabet(String alphabet) {
          * @return builder
          * 
          */
-        public Builder decodeFormats(@Nullable Output<Map<String,Object>> decodeFormats) {
+        public Builder decodeFormats(@Nullable Output<Map<String,String>> decodeFormats) {
             $.decodeFormats = decodeFormats;
             return this;
         }
@@ -219,7 +218,7 @@ public Builder decodeFormats(@Nullable Output<Map<String,Object>> decodeFormats)
          * @return builder
          * 
          */
-        public Builder decodeFormats(Map<String,Object> decodeFormats) {
+        public Builder decodeFormats(Map<String,String> decodeFormats) {
             return decodeFormats(Output.of(decodeFormats));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/transform/inputs/GetDecodeArgs.java b/sdk/java/src/main/java/com/pulumi/vault/transform/inputs/GetDecodeArgs.java
index a4d4a6dd2..e1a47d749 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/transform/inputs/GetDecodeArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/transform/inputs/GetDecodeArgs.java
@@ -6,7 +6,6 @@
 import com.pulumi.core.Output;
 import com.pulumi.core.annotations.Import;
 import com.pulumi.exceptions.MissingRequiredPropertyException;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -24,13 +23,13 @@ public final class GetDecodeArgs extends com.pulumi.resources.InvokeArgs {
      * 
      */
     @Import(name="batchInputs")
-    private @Nullable Output<List<Map<String,Object>>> batchInputs;
+    private @Nullable Output<List<Map<String,String>>> batchInputs;
 
     /**
      * @return Specifies a list of items to be decoded in a single batch. If this parameter is set, the top-level parameters &#39;value&#39;, &#39;transformation&#39; and &#39;tweak&#39; will be ignored. Each batch item within the list can specify these parameters instead.
      * 
      */
-    public Optional<Output<List<Map<String,Object>>>> batchInputs() {
+    public Optional<Output<List<Map<String,String>>>> batchInputs() {
         return Optional.ofNullable(this.batchInputs);
     }
 
@@ -39,13 +38,13 @@ public Optional<Output<List<Map<String,Object>>>> batchInputs() {
      * 
      */
     @Import(name="batchResults")
-    private @Nullable Output<List<Map<String,Object>>> batchResults;
+    private @Nullable Output<List<Map<String,String>>> batchResults;
 
     /**
      * @return The result of decoding a batch.
      * 
      */
-    public Optional<Output<List<Map<String,Object>>>> batchResults() {
+    public Optional<Output<List<Map<String,String>>>> batchResults() {
         return Optional.ofNullable(this.batchResults);
     }
 
@@ -198,7 +197,7 @@ public Builder(GetDecodeArgs defaults) {
          * @return builder
          * 
          */
-        public Builder batchInputs(@Nullable Output<List<Map<String,Object>>> batchInputs) {
+        public Builder batchInputs(@Nullable Output<List<Map<String,String>>> batchInputs) {
             $.batchInputs = batchInputs;
             return this;
         }
@@ -209,7 +208,7 @@ public Builder batchInputs(@Nullable Output<List<Map<String,Object>>> batchInput
          * @return builder
          * 
          */
-        public Builder batchInputs(List<Map<String,Object>> batchInputs) {
+        public Builder batchInputs(List<Map<String,String>> batchInputs) {
             return batchInputs(Output.of(batchInputs));
         }
 
@@ -219,7 +218,7 @@ public Builder batchInputs(List<Map<String,Object>> batchInputs) {
          * @return builder
          * 
          */
-        public Builder batchInputs(Map<String,Object>... batchInputs) {
+        public Builder batchInputs(Map<String,String>... batchInputs) {
             return batchInputs(List.of(batchInputs));
         }
 
@@ -229,7 +228,7 @@ public Builder batchInputs(Map<String,Object>... batchInputs) {
          * @return builder
          * 
          */
-        public Builder batchResults(@Nullable Output<List<Map<String,Object>>> batchResults) {
+        public Builder batchResults(@Nullable Output<List<Map<String,String>>> batchResults) {
             $.batchResults = batchResults;
             return this;
         }
@@ -240,7 +239,7 @@ public Builder batchResults(@Nullable Output<List<Map<String,Object>>> batchResu
          * @return builder
          * 
          */
-        public Builder batchResults(List<Map<String,Object>> batchResults) {
+        public Builder batchResults(List<Map<String,String>> batchResults) {
             return batchResults(Output.of(batchResults));
         }
 
@@ -250,7 +249,7 @@ public Builder batchResults(List<Map<String,Object>> batchResults) {
          * @return builder
          * 
          */
-        public Builder batchResults(Map<String,Object>... batchResults) {
+        public Builder batchResults(Map<String,String>... batchResults) {
             return batchResults(List.of(batchResults));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/transform/inputs/GetDecodePlainArgs.java b/sdk/java/src/main/java/com/pulumi/vault/transform/inputs/GetDecodePlainArgs.java
index f58e803fb..c53c6ebcf 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/transform/inputs/GetDecodePlainArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/transform/inputs/GetDecodePlainArgs.java
@@ -5,7 +5,6 @@
 
 import com.pulumi.core.annotations.Import;
 import com.pulumi.exceptions.MissingRequiredPropertyException;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -23,13 +22,13 @@ public final class GetDecodePlainArgs extends com.pulumi.resources.InvokeArgs {
      * 
      */
     @Import(name="batchInputs")
-    private @Nullable List<Map<String,Object>> batchInputs;
+    private @Nullable List<Map<String,String>> batchInputs;
 
     /**
      * @return Specifies a list of items to be decoded in a single batch. If this parameter is set, the top-level parameters &#39;value&#39;, &#39;transformation&#39; and &#39;tweak&#39; will be ignored. Each batch item within the list can specify these parameters instead.
      * 
      */
-    public Optional<List<Map<String,Object>>> batchInputs() {
+    public Optional<List<Map<String,String>>> batchInputs() {
         return Optional.ofNullable(this.batchInputs);
     }
 
@@ -38,13 +37,13 @@ public Optional<List<Map<String,Object>>> batchInputs() {
      * 
      */
     @Import(name="batchResults")
-    private @Nullable List<Map<String,Object>> batchResults;
+    private @Nullable List<Map<String,String>> batchResults;
 
     /**
      * @return The result of decoding a batch.
      * 
      */
-    public Optional<List<Map<String,Object>>> batchResults() {
+    public Optional<List<Map<String,String>>> batchResults() {
         return Optional.ofNullable(this.batchResults);
     }
 
@@ -197,7 +196,7 @@ public Builder(GetDecodePlainArgs defaults) {
          * @return builder
          * 
          */
-        public Builder batchInputs(@Nullable List<Map<String,Object>> batchInputs) {
+        public Builder batchInputs(@Nullable List<Map<String,String>> batchInputs) {
             $.batchInputs = batchInputs;
             return this;
         }
@@ -208,7 +207,7 @@ public Builder batchInputs(@Nullable List<Map<String,Object>> batchInputs) {
          * @return builder
          * 
          */
-        public Builder batchInputs(Map<String,Object>... batchInputs) {
+        public Builder batchInputs(Map<String,String>... batchInputs) {
             return batchInputs(List.of(batchInputs));
         }
 
@@ -218,7 +217,7 @@ public Builder batchInputs(Map<String,Object>... batchInputs) {
          * @return builder
          * 
          */
-        public Builder batchResults(@Nullable List<Map<String,Object>> batchResults) {
+        public Builder batchResults(@Nullable List<Map<String,String>> batchResults) {
             $.batchResults = batchResults;
             return this;
         }
@@ -229,7 +228,7 @@ public Builder batchResults(@Nullable List<Map<String,Object>> batchResults) {
          * @return builder
          * 
          */
-        public Builder batchResults(Map<String,Object>... batchResults) {
+        public Builder batchResults(Map<String,String>... batchResults) {
             return batchResults(List.of(batchResults));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/transform/inputs/GetEncodeArgs.java b/sdk/java/src/main/java/com/pulumi/vault/transform/inputs/GetEncodeArgs.java
index 2a57350c2..d947182f0 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/transform/inputs/GetEncodeArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/transform/inputs/GetEncodeArgs.java
@@ -6,7 +6,6 @@
 import com.pulumi.core.Output;
 import com.pulumi.core.annotations.Import;
 import com.pulumi.exceptions.MissingRequiredPropertyException;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -24,13 +23,13 @@ public final class GetEncodeArgs extends com.pulumi.resources.InvokeArgs {
      * 
      */
     @Import(name="batchInputs")
-    private @Nullable Output<List<Map<String,Object>>> batchInputs;
+    private @Nullable Output<List<Map<String,String>>> batchInputs;
 
     /**
      * @return Specifies a list of items to be encoded in a single batch. If this parameter is set, the parameters &#39;value&#39;, &#39;transformation&#39; and &#39;tweak&#39; will be ignored. Each batch item within the list can specify these parameters instead.
      * 
      */
-    public Optional<Output<List<Map<String,Object>>>> batchInputs() {
+    public Optional<Output<List<Map<String,String>>>> batchInputs() {
         return Optional.ofNullable(this.batchInputs);
     }
 
@@ -39,13 +38,13 @@ public Optional<Output<List<Map<String,Object>>>> batchInputs() {
      * 
      */
     @Import(name="batchResults")
-    private @Nullable Output<List<Map<String,Object>>> batchResults;
+    private @Nullable Output<List<Map<String,String>>> batchResults;
 
     /**
      * @return The result of encoding a batch.
      * 
      */
-    public Optional<Output<List<Map<String,Object>>>> batchResults() {
+    public Optional<Output<List<Map<String,String>>>> batchResults() {
         return Optional.ofNullable(this.batchResults);
     }
 
@@ -198,7 +197,7 @@ public Builder(GetEncodeArgs defaults) {
          * @return builder
          * 
          */
-        public Builder batchInputs(@Nullable Output<List<Map<String,Object>>> batchInputs) {
+        public Builder batchInputs(@Nullable Output<List<Map<String,String>>> batchInputs) {
             $.batchInputs = batchInputs;
             return this;
         }
@@ -209,7 +208,7 @@ public Builder batchInputs(@Nullable Output<List<Map<String,Object>>> batchInput
          * @return builder
          * 
          */
-        public Builder batchInputs(List<Map<String,Object>> batchInputs) {
+        public Builder batchInputs(List<Map<String,String>> batchInputs) {
             return batchInputs(Output.of(batchInputs));
         }
 
@@ -219,7 +218,7 @@ public Builder batchInputs(List<Map<String,Object>> batchInputs) {
          * @return builder
          * 
          */
-        public Builder batchInputs(Map<String,Object>... batchInputs) {
+        public Builder batchInputs(Map<String,String>... batchInputs) {
             return batchInputs(List.of(batchInputs));
         }
 
@@ -229,7 +228,7 @@ public Builder batchInputs(Map<String,Object>... batchInputs) {
          * @return builder
          * 
          */
-        public Builder batchResults(@Nullable Output<List<Map<String,Object>>> batchResults) {
+        public Builder batchResults(@Nullable Output<List<Map<String,String>>> batchResults) {
             $.batchResults = batchResults;
             return this;
         }
@@ -240,7 +239,7 @@ public Builder batchResults(@Nullable Output<List<Map<String,Object>>> batchResu
          * @return builder
          * 
          */
-        public Builder batchResults(List<Map<String,Object>> batchResults) {
+        public Builder batchResults(List<Map<String,String>> batchResults) {
             return batchResults(Output.of(batchResults));
         }
 
@@ -250,7 +249,7 @@ public Builder batchResults(List<Map<String,Object>> batchResults) {
          * @return builder
          * 
          */
-        public Builder batchResults(Map<String,Object>... batchResults) {
+        public Builder batchResults(Map<String,String>... batchResults) {
             return batchResults(List.of(batchResults));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/transform/inputs/GetEncodePlainArgs.java b/sdk/java/src/main/java/com/pulumi/vault/transform/inputs/GetEncodePlainArgs.java
index a32518cc6..887cdfc1e 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/transform/inputs/GetEncodePlainArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/transform/inputs/GetEncodePlainArgs.java
@@ -5,7 +5,6 @@
 
 import com.pulumi.core.annotations.Import;
 import com.pulumi.exceptions.MissingRequiredPropertyException;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -23,13 +22,13 @@ public final class GetEncodePlainArgs extends com.pulumi.resources.InvokeArgs {
      * 
      */
     @Import(name="batchInputs")
-    private @Nullable List<Map<String,Object>> batchInputs;
+    private @Nullable List<Map<String,String>> batchInputs;
 
     /**
      * @return Specifies a list of items to be encoded in a single batch. If this parameter is set, the parameters &#39;value&#39;, &#39;transformation&#39; and &#39;tweak&#39; will be ignored. Each batch item within the list can specify these parameters instead.
      * 
      */
-    public Optional<List<Map<String,Object>>> batchInputs() {
+    public Optional<List<Map<String,String>>> batchInputs() {
         return Optional.ofNullable(this.batchInputs);
     }
 
@@ -38,13 +37,13 @@ public Optional<List<Map<String,Object>>> batchInputs() {
      * 
      */
     @Import(name="batchResults")
-    private @Nullable List<Map<String,Object>> batchResults;
+    private @Nullable List<Map<String,String>> batchResults;
 
     /**
      * @return The result of encoding a batch.
      * 
      */
-    public Optional<List<Map<String,Object>>> batchResults() {
+    public Optional<List<Map<String,String>>> batchResults() {
         return Optional.ofNullable(this.batchResults);
     }
 
@@ -197,7 +196,7 @@ public Builder(GetEncodePlainArgs defaults) {
          * @return builder
          * 
          */
-        public Builder batchInputs(@Nullable List<Map<String,Object>> batchInputs) {
+        public Builder batchInputs(@Nullable List<Map<String,String>> batchInputs) {
             $.batchInputs = batchInputs;
             return this;
         }
@@ -208,7 +207,7 @@ public Builder batchInputs(@Nullable List<Map<String,Object>> batchInputs) {
          * @return builder
          * 
          */
-        public Builder batchInputs(Map<String,Object>... batchInputs) {
+        public Builder batchInputs(Map<String,String>... batchInputs) {
             return batchInputs(List.of(batchInputs));
         }
 
@@ -218,7 +217,7 @@ public Builder batchInputs(Map<String,Object>... batchInputs) {
          * @return builder
          * 
          */
-        public Builder batchResults(@Nullable List<Map<String,Object>> batchResults) {
+        public Builder batchResults(@Nullable List<Map<String,String>> batchResults) {
             $.batchResults = batchResults;
             return this;
         }
@@ -229,7 +228,7 @@ public Builder batchResults(@Nullable List<Map<String,Object>> batchResults) {
          * @return builder
          * 
          */
-        public Builder batchResults(Map<String,Object>... batchResults) {
+        public Builder batchResults(Map<String,String>... batchResults) {
             return batchResults(List.of(batchResults));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/transform/inputs/TemplateState.java b/sdk/java/src/main/java/com/pulumi/vault/transform/inputs/TemplateState.java
index 85fdcba8f..65b44f7e7 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/transform/inputs/TemplateState.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/transform/inputs/TemplateState.java
@@ -5,7 +5,6 @@
 
 import com.pulumi.core.Output;
 import com.pulumi.core.annotations.Import;
-import java.lang.Object;
 import java.lang.String;
 import java.util.Map;
 import java.util.Objects;
@@ -38,14 +37,14 @@ public Optional<Output<String>> alphabet() {
      * 
      */
     @Import(name="decodeFormats")
-    private @Nullable Output<Map<String,Object>> decodeFormats;
+    private @Nullable Output<Map<String,String>> decodeFormats;
 
     /**
      * @return Optional mapping of name to regular expression template, used to customize
      * the decoded output. (requires Vault Enterprise 1.9+)
      * 
      */
-    public Optional<Output<Map<String,Object>>> decodeFormats() {
+    public Optional<Output<Map<String,String>>> decodeFormats() {
         return Optional.ofNullable(this.decodeFormats);
     }
 
@@ -206,7 +205,7 @@ public Builder alphabet(String alphabet) {
          * @return builder
          * 
          */
-        public Builder decodeFormats(@Nullable Output<Map<String,Object>> decodeFormats) {
+        public Builder decodeFormats(@Nullable Output<Map<String,String>> decodeFormats) {
             $.decodeFormats = decodeFormats;
             return this;
         }
@@ -218,7 +217,7 @@ public Builder decodeFormats(@Nullable Output<Map<String,Object>> decodeFormats)
          * @return builder
          * 
          */
-        public Builder decodeFormats(Map<String,Object> decodeFormats) {
+        public Builder decodeFormats(Map<String,String> decodeFormats) {
             return decodeFormats(Output.of(decodeFormats));
         }
 
diff --git a/sdk/java/src/main/java/com/pulumi/vault/transform/outputs/GetDecodeResult.java b/sdk/java/src/main/java/com/pulumi/vault/transform/outputs/GetDecodeResult.java
index 18006eb75..4e125992a 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/transform/outputs/GetDecodeResult.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/transform/outputs/GetDecodeResult.java
@@ -5,7 +5,6 @@
 
 import com.pulumi.core.annotations.CustomType;
 import com.pulumi.exceptions.MissingRequiredPropertyException;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -15,8 +14,8 @@
 
 @CustomType
 public final class GetDecodeResult {
-    private @Nullable List<Map<String,Object>> batchInputs;
-    private List<Map<String,Object>> batchResults;
+    private @Nullable List<Map<String,String>> batchInputs;
+    private List<Map<String,String>> batchResults;
     private String decodedValue;
     /**
      * @return The provider-assigned unique ID for this managed resource.
@@ -31,10 +30,10 @@ public final class GetDecodeResult {
     private @Nullable String value;
 
     private GetDecodeResult() {}
-    public List<Map<String,Object>> batchInputs() {
+    public List<Map<String,String>> batchInputs() {
         return this.batchInputs == null ? List.of() : this.batchInputs;
     }
-    public List<Map<String,Object>> batchResults() {
+    public List<Map<String,String>> batchResults() {
         return this.batchResults;
     }
     public String decodedValue() {
@@ -75,8 +74,8 @@ public static Builder builder(GetDecodeResult defaults) {
     }
     @CustomType.Builder
     public static final class Builder {
-        private @Nullable List<Map<String,Object>> batchInputs;
-        private List<Map<String,Object>> batchResults;
+        private @Nullable List<Map<String,String>> batchInputs;
+        private List<Map<String,String>> batchResults;
         private String decodedValue;
         private String id;
         private @Nullable String namespace;
@@ -101,13 +100,13 @@ public Builder(GetDecodeResult defaults) {
         }
 
         @CustomType.Setter
-        public Builder batchInputs(@Nullable List<Map<String,Object>> batchInputs) {
+        public Builder batchInputs(@Nullable List<Map<String,String>> batchInputs) {
 
             this.batchInputs = batchInputs;
             return this;
         }
         @CustomType.Setter
-        public Builder batchResults(List<Map<String,Object>> batchResults) {
+        public Builder batchResults(List<Map<String,String>> batchResults) {
             if (batchResults == null) {
               throw new MissingRequiredPropertyException("GetDecodeResult", "batchResults");
             }
diff --git a/sdk/java/src/main/java/com/pulumi/vault/transform/outputs/GetEncodeResult.java b/sdk/java/src/main/java/com/pulumi/vault/transform/outputs/GetEncodeResult.java
index 2a81f0217..ae2eea1ab 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/transform/outputs/GetEncodeResult.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/transform/outputs/GetEncodeResult.java
@@ -5,7 +5,6 @@
 
 import com.pulumi.core.annotations.CustomType;
 import com.pulumi.exceptions.MissingRequiredPropertyException;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -15,8 +14,8 @@
 
 @CustomType
 public final class GetEncodeResult {
-    private @Nullable List<Map<String,Object>> batchInputs;
-    private List<Map<String,Object>> batchResults;
+    private @Nullable List<Map<String,String>> batchInputs;
+    private List<Map<String,String>> batchResults;
     private String encodedValue;
     /**
      * @return The provider-assigned unique ID for this managed resource.
@@ -31,10 +30,10 @@ public final class GetEncodeResult {
     private @Nullable String value;
 
     private GetEncodeResult() {}
-    public List<Map<String,Object>> batchInputs() {
+    public List<Map<String,String>> batchInputs() {
         return this.batchInputs == null ? List.of() : this.batchInputs;
     }
-    public List<Map<String,Object>> batchResults() {
+    public List<Map<String,String>> batchResults() {
         return this.batchResults;
     }
     public String encodedValue() {
@@ -75,8 +74,8 @@ public static Builder builder(GetEncodeResult defaults) {
     }
     @CustomType.Builder
     public static final class Builder {
-        private @Nullable List<Map<String,Object>> batchInputs;
-        private List<Map<String,Object>> batchResults;
+        private @Nullable List<Map<String,String>> batchInputs;
+        private List<Map<String,String>> batchResults;
         private String encodedValue;
         private String id;
         private @Nullable String namespace;
@@ -101,13 +100,13 @@ public Builder(GetEncodeResult defaults) {
         }
 
         @CustomType.Setter
-        public Builder batchInputs(@Nullable List<Map<String,Object>> batchInputs) {
+        public Builder batchInputs(@Nullable List<Map<String,String>> batchInputs) {
 
             this.batchInputs = batchInputs;
             return this;
         }
         @CustomType.Setter
-        public Builder batchResults(List<Map<String,Object>> batchResults) {
+        public Builder batchResults(List<Map<String,String>> batchResults) {
             if (batchResults == null) {
               throw new MissingRequiredPropertyException("GetEncodeResult", "batchResults");
             }
diff --git a/sdk/java/src/main/java/com/pulumi/vault/transit/SecretBackendKey.java b/sdk/java/src/main/java/com/pulumi/vault/transit/SecretBackendKey.java
index 55c4daf94..c1fa108fc 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/transit/SecretBackendKey.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/transit/SecretBackendKey.java
@@ -12,7 +12,6 @@
 import com.pulumi.vault.transit.inputs.SecretBackendKeyState;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -201,8 +200,8 @@ public Output<Optional<Integer>> keySize() {
      * * for key types `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `rsa-2048`, `rsa-3072` and `rsa-4096`, each key version will be a map of the following:
      * 
      */
-    @Export(name="keys", refs={List.class,Map.class,String.class,Object.class}, tree="[0,[1,2,3]]")
-    private Output<List<Map<String,Object>>> keys;
+    @Export(name="keys", refs={List.class,Map.class,String.class}, tree="[0,[1,2,2]]")
+    private Output<List<Map<String,String>>> keys;
 
     /**
      * @return List of key versions in the keyring. This attribute is zero-indexed and will contain a map of values depending on the `type` of the encryption key.
@@ -210,7 +209,7 @@ public Output<Optional<Integer>> keySize() {
      * * for key types `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `rsa-2048`, `rsa-3072` and `rsa-4096`, each key version will be a map of the following:
      * 
      */
-    public Output<List<Map<String,Object>>> keys() {
+    public Output<List<Map<String,String>>> keys() {
         return this.keys;
     }
     /**
diff --git a/sdk/java/src/main/java/com/pulumi/vault/transit/inputs/SecretBackendKeyState.java b/sdk/java/src/main/java/com/pulumi/vault/transit/inputs/SecretBackendKeyState.java
index a0005aaff..70647568a 100644
--- a/sdk/java/src/main/java/com/pulumi/vault/transit/inputs/SecretBackendKeyState.java
+++ b/sdk/java/src/main/java/com/pulumi/vault/transit/inputs/SecretBackendKeyState.java
@@ -7,7 +7,6 @@
 import com.pulumi.core.annotations.Import;
 import java.lang.Boolean;
 import java.lang.Integer;
-import java.lang.Object;
 import java.lang.String;
 import java.util.List;
 import java.util.Map;
@@ -151,7 +150,7 @@ public Optional<Output<Integer>> keySize() {
      * 
      */
     @Import(name="keys")
-    private @Nullable Output<List<Map<String,Object>>> keys;
+    private @Nullable Output<List<Map<String,String>>> keys;
 
     /**
      * @return List of key versions in the keyring. This attribute is zero-indexed and will contain a map of values depending on the `type` of the encryption key.
@@ -159,7 +158,7 @@ public Optional<Output<Integer>> keySize() {
      * * for key types `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `rsa-2048`, `rsa-3072` and `rsa-4096`, each key version will be a map of the following:
      * 
      */
-    public Optional<Output<List<Map<String,Object>>>> keys() {
+    public Optional<Output<List<Map<String,String>>>> keys() {
         return Optional.ofNullable(this.keys);
     }
 
@@ -559,7 +558,7 @@ public Builder keySize(Integer keySize) {
          * @return builder
          * 
          */
-        public Builder keys(@Nullable Output<List<Map<String,Object>>> keys) {
+        public Builder keys(@Nullable Output<List<Map<String,String>>> keys) {
             $.keys = keys;
             return this;
         }
@@ -572,7 +571,7 @@ public Builder keys(@Nullable Output<List<Map<String,Object>>> keys) {
          * @return builder
          * 
          */
-        public Builder keys(List<Map<String,Object>> keys) {
+        public Builder keys(List<Map<String,String>> keys) {
             return keys(Output.of(keys));
         }
 
@@ -584,7 +583,7 @@ public Builder keys(List<Map<String,Object>> keys) {
          * @return builder
          * 
          */
-        public Builder keys(Map<String,Object>... keys) {
+        public Builder keys(Map<String,String>... keys) {
             return keys(List.of(keys));
         }
 
diff --git a/sdk/nodejs/aws/authBackendLogin.ts b/sdk/nodejs/aws/authBackendLogin.ts
index b6159eff8..877b35fdc 100644
--- a/sdk/nodejs/aws/authBackendLogin.ts
+++ b/sdk/nodejs/aws/authBackendLogin.ts
@@ -90,7 +90,7 @@ export class AuthBackendLogin extends pulumi.CustomResource {
      * A map of information returned by the Vault server about the
      * authentication used to generate this token.
      */
-    public /*out*/ readonly metadata!: pulumi.Output<{[key: string]: any}>;
+    public /*out*/ readonly metadata!: pulumi.Output<{[key: string]: string}>;
     /**
      * The namespace to provision the resource in.
      * The value should not contain leading or trailing forward slashes.
@@ -248,7 +248,7 @@ export interface AuthBackendLoginState {
      * A map of information returned by the Vault server about the
      * authentication used to generate this token.
      */
-    metadata?: pulumi.Input<{[key: string]: any}>;
+    metadata?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * The namespace to provision the resource in.
      * The value should not contain leading or trailing forward slashes.
diff --git a/sdk/nodejs/config/uiCustomMessage.ts b/sdk/nodejs/config/uiCustomMessage.ts
index 00a108591..54ea0c77e 100644
--- a/sdk/nodejs/config/uiCustomMessage.ts
+++ b/sdk/nodejs/config/uiCustomMessage.ts
@@ -57,7 +57,7 @@ export class UiCustomMessage extends pulumi.CustomResource {
     /**
      * A map containing additional options for the custom message
      */
-    public readonly options!: pulumi.Output<{[key: string]: any} | undefined>;
+    public readonly options!: pulumi.Output<{[key: string]: string} | undefined>;
     /**
      * The starting time of the active period of the custom message
      */
@@ -146,7 +146,7 @@ export interface UiCustomMessageState {
     /**
      * A map containing additional options for the custom message
      */
-    options?: pulumi.Input<{[key: string]: any}>;
+    options?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * The starting time of the active period of the custom message
      */
@@ -188,7 +188,7 @@ export interface UiCustomMessageArgs {
     /**
      * A map containing additional options for the custom message
      */
-    options?: pulumi.Input<{[key: string]: any}>;
+    options?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * The starting time of the active period of the custom message
      */
diff --git a/sdk/nodejs/database/secretBackendConnection.ts b/sdk/nodejs/database/secretBackendConnection.ts
index 0d6c51a87..c76e70597 100644
--- a/sdk/nodejs/database/secretBackendConnection.ts
+++ b/sdk/nodejs/database/secretBackendConnection.ts
@@ -86,7 +86,7 @@ export class SecretBackendConnection extends pulumi.CustomResource {
     /**
      * A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
      */
-    public readonly data!: pulumi.Output<{[key: string]: any} | undefined>;
+    public readonly data!: pulumi.Output<{[key: string]: string} | undefined>;
     /**
      * A nested block containing configuration options for Elasticsearch connections.
      */
@@ -278,7 +278,7 @@ export interface SecretBackendConnectionState {
     /**
      * A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
      */
-    data?: pulumi.Input<{[key: string]: any}>;
+    data?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * A nested block containing configuration options for Elasticsearch connections.
      */
@@ -395,7 +395,7 @@ export interface SecretBackendConnectionArgs {
     /**
      * A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
      */
-    data?: pulumi.Input<{[key: string]: any}>;
+    data?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * A nested block containing configuration options for Elasticsearch connections.
      */
diff --git a/sdk/nodejs/database/secretBackendRole.ts b/sdk/nodejs/database/secretBackendRole.ts
index 4cde3e963..2907f4b44 100644
--- a/sdk/nodejs/database/secretBackendRole.ts
+++ b/sdk/nodejs/database/secretBackendRole.ts
@@ -85,7 +85,7 @@ export class SecretBackendRole extends pulumi.CustomResource {
      *
      * The following options are available for each `credentialType` value:
      */
-    public readonly credentialConfig!: pulumi.Output<{[key: string]: any} | undefined>;
+    public readonly credentialConfig!: pulumi.Output<{[key: string]: string} | undefined>;
     /**
      * Specifies the type of credential that
      * will be generated for the role. Options include: `password`, `rsaPrivateKey`, `clientCertificate`.
@@ -207,7 +207,7 @@ export interface SecretBackendRoleState {
      *
      * The following options are available for each `credentialType` value:
      */
-    credentialConfig?: pulumi.Input<{[key: string]: any}>;
+    credentialConfig?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * Specifies the type of credential that
      * will be generated for the role. Options include: `password`, `rsaPrivateKey`, `clientCertificate`.
@@ -276,7 +276,7 @@ export interface SecretBackendRoleArgs {
      *
      * The following options are available for each `credentialType` value:
      */
-    credentialConfig?: pulumi.Input<{[key: string]: any}>;
+    credentialConfig?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * Specifies the type of credential that
      * will be generated for the role. Options include: `password`, `rsaPrivateKey`, `clientCertificate`.
diff --git a/sdk/nodejs/database/secretsMount.ts b/sdk/nodejs/database/secretsMount.ts
index 8d0d78710..6859e18e8 100644
--- a/sdk/nodejs/database/secretsMount.ts
+++ b/sdk/nodejs/database/secretsMount.ts
@@ -213,7 +213,7 @@ export class SecretsMount extends pulumi.CustomResource {
     /**
      * Specifies mount type specific options that are passed to the backend
      */
-    public readonly options!: pulumi.Output<{[key: string]: any} | undefined>;
+    public readonly options!: pulumi.Output<{[key: string]: string} | undefined>;
     /**
      * A nested block containing configuration options for Oracle connections.  
      * *See Configuration Options for more info*
@@ -490,7 +490,7 @@ export interface SecretsMountState {
     /**
      * Specifies mount type specific options that are passed to the backend
      */
-    options?: pulumi.Input<{[key: string]: any}>;
+    options?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * A nested block containing configuration options for Oracle connections.  
      * *See Configuration Options for more info*
@@ -660,7 +660,7 @@ export interface SecretsMountArgs {
     /**
      * Specifies mount type specific options that are passed to the backend
      */
-    options?: pulumi.Input<{[key: string]: any}>;
+    options?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * A nested block containing configuration options for Oracle connections.  
      * *See Configuration Options for more info*
diff --git a/sdk/nodejs/generic/getSecret.ts b/sdk/nodejs/generic/getSecret.ts
index f4ab340e1..2e22b234c 100644
--- a/sdk/nodejs/generic/getSecret.ts
+++ b/sdk/nodejs/generic/getSecret.ts
@@ -94,7 +94,7 @@ export interface GetSecretResult {
      * represent string data, so any non-string values returned from Vault are
      * serialized as JSON.
      */
-    readonly data: {[key: string]: any};
+    readonly data: {[key: string]: string};
     /**
      * A string containing the full data payload retrieved from
      * Vault, serialized in JSON format.
diff --git a/sdk/nodejs/generic/secret.ts b/sdk/nodejs/generic/secret.ts
index cea938847..b7e3c79f7 100644
--- a/sdk/nodejs/generic/secret.ts
+++ b/sdk/nodejs/generic/secret.ts
@@ -47,7 +47,7 @@ export class Secret extends pulumi.CustomResource {
      * represent string data, so any non-string values returned from Vault are
      * serialized as JSON.
      */
-    public /*out*/ readonly data!: pulumi.Output<{[key: string]: any}>;
+    public /*out*/ readonly data!: pulumi.Output<{[key: string]: string}>;
     /**
      * String containing a JSON-encoded object that will be
      * written as the secret data at the given path.
@@ -133,7 +133,7 @@ export interface SecretState {
      * represent string data, so any non-string values returned from Vault are
      * serialized as JSON.
      */
-    data?: pulumi.Input<{[key: string]: any}>;
+    data?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * String containing a JSON-encoded object that will be
      * written as the secret data at the given path.
diff --git a/sdk/nodejs/getNamespace.ts b/sdk/nodejs/getNamespace.ts
index 78f81a2c7..a024e1b61 100644
--- a/sdk/nodejs/getNamespace.ts
+++ b/sdk/nodejs/getNamespace.ts
@@ -80,7 +80,7 @@ export interface GetNamespaceResult {
      * Only fetched if `path` is specified.
      * *Requires Vault 1.12+.*
      */
-    readonly customMetadata: {[key: string]: any};
+    readonly customMetadata: {[key: string]: string};
     /**
      * The provider-assigned unique ID for this managed resource.
      */
diff --git a/sdk/nodejs/getRaftAutopilotState.ts b/sdk/nodejs/getRaftAutopilotState.ts
index e7744e164..194fafa47 100644
--- a/sdk/nodejs/getRaftAutopilotState.ts
+++ b/sdk/nodejs/getRaftAutopilotState.ts
@@ -69,7 +69,7 @@ export interface GetRaftAutopilotStateResult {
     /**
      * Additional output related to redundancy zones stored as a serialized map of strings.
      */
-    readonly redundancyZones: {[key: string]: any};
+    readonly redundancyZones: {[key: string]: string};
     /**
      * Additional output related to redundancy zones.
      */
@@ -77,7 +77,7 @@ export interface GetRaftAutopilotStateResult {
     /**
      * Additionaly output related to servers in the cluster stored as a serialized map of strings.
      */
-    readonly servers: {[key: string]: any};
+    readonly servers: {[key: string]: string};
     /**
      * Additionaly output related to servers in the cluster.
      */
@@ -85,7 +85,7 @@ export interface GetRaftAutopilotStateResult {
     /**
      * Additional output related to upgrade information stored as a serialized map of strings.
      */
-    readonly upgradeInfo: {[key: string]: any};
+    readonly upgradeInfo: {[key: string]: string};
     /**
      * Additional output related to upgrade information.
      */
diff --git a/sdk/nodejs/identity/getEntity.ts b/sdk/nodejs/identity/getEntity.ts
index 7f7a8dc90..198aa2112 100644
--- a/sdk/nodejs/identity/getEntity.ts
+++ b/sdk/nodejs/identity/getEntity.ts
@@ -127,7 +127,7 @@ export interface GetEntityResult {
     /**
      * Arbitrary metadata
      */
-    readonly metadata: {[key: string]: any};
+    readonly metadata: {[key: string]: string};
     readonly namespace?: string;
     /**
      * Namespace of which the entity is part of
diff --git a/sdk/nodejs/identity/getGroup.ts b/sdk/nodejs/identity/getGroup.ts
index 81552e4ba..650edf66d 100644
--- a/sdk/nodejs/identity/getGroup.ts
+++ b/sdk/nodejs/identity/getGroup.ts
@@ -96,7 +96,7 @@ export interface GetGroupResult {
     /**
      * Arbitrary metadata
      */
-    readonly aliasMetadata: {[key: string]: any};
+    readonly aliasMetadata: {[key: string]: string};
     readonly aliasMountAccessor: string;
     /**
      * Authentication mount path which this alias belongs to
@@ -137,7 +137,7 @@ export interface GetGroupResult {
     /**
      * Arbitrary metadata
      */
-    readonly metadata: {[key: string]: any};
+    readonly metadata: {[key: string]: string};
     /**
      * Modify index of the group
      */
diff --git a/sdk/nodejs/identity/getOidcPublicKeys.ts b/sdk/nodejs/identity/getOidcPublicKeys.ts
index 2ef8ac09f..f5846708a 100644
--- a/sdk/nodejs/identity/getOidcPublicKeys.ts
+++ b/sdk/nodejs/identity/getOidcPublicKeys.ts
@@ -75,7 +75,7 @@ export interface GetOidcPublicKeysResult {
      * The public portion of keys for an OIDC provider. 
      * Clients can use them to validate the authenticity of an identity token.
      */
-    readonly keys: {[key: string]: any}[];
+    readonly keys: {[key: string]: string}[];
     readonly name: string;
     readonly namespace?: string;
 }
diff --git a/sdk/nodejs/jwt/authBackendRole.ts b/sdk/nodejs/jwt/authBackendRole.ts
index 4a273c738..0a1e2ca05 100644
--- a/sdk/nodejs/jwt/authBackendRole.ts
+++ b/sdk/nodejs/jwt/authBackendRole.ts
@@ -115,7 +115,7 @@ export class AuthBackendRole extends pulumi.CustomResource {
      * A claim's value must be a string, which may contain one value or multiple
      * comma-separated values, e.g. `"red"` or `"red,green,blue"`.
      */
-    public readonly boundClaims!: pulumi.Output<{[key: string]: any} | undefined>;
+    public readonly boundClaims!: pulumi.Output<{[key: string]: string} | undefined>;
     /**
      * How to interpret values in the claims/values
      * map (`boundClaims`): can be either `string` (exact match) or `glob` (wildcard
@@ -131,7 +131,7 @@ export class AuthBackendRole extends pulumi.CustomResource {
      * If set, a map of claims (keys) to be copied
      * to specified metadata fields (values).
      */
-    public readonly claimMappings!: pulumi.Output<{[key: string]: any} | undefined>;
+    public readonly claimMappings!: pulumi.Output<{[key: string]: string} | undefined>;
     /**
      * The amount of leeway to add to all claims to account for clock skew, in
      * seconds. Defaults to `60` seconds if set to `0` and can be disabled if set to `-1`.
@@ -351,7 +351,7 @@ export interface AuthBackendRoleState {
      * A claim's value must be a string, which may contain one value or multiple
      * comma-separated values, e.g. `"red"` or `"red,green,blue"`.
      */
-    boundClaims?: pulumi.Input<{[key: string]: any}>;
+    boundClaims?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * How to interpret values in the claims/values
      * map (`boundClaims`): can be either `string` (exact match) or `glob` (wildcard
@@ -367,7 +367,7 @@ export interface AuthBackendRoleState {
      * If set, a map of claims (keys) to be copied
      * to specified metadata fields (values).
      */
-    claimMappings?: pulumi.Input<{[key: string]: any}>;
+    claimMappings?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * The amount of leeway to add to all claims to account for clock skew, in
      * seconds. Defaults to `60` seconds if set to `0` and can be disabled if set to `-1`.
@@ -503,7 +503,7 @@ export interface AuthBackendRoleArgs {
      * A claim's value must be a string, which may contain one value or multiple
      * comma-separated values, e.g. `"red"` or `"red,green,blue"`.
      */
-    boundClaims?: pulumi.Input<{[key: string]: any}>;
+    boundClaims?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * How to interpret values in the claims/values
      * map (`boundClaims`): can be either `string` (exact match) or `glob` (wildcard
@@ -519,7 +519,7 @@ export interface AuthBackendRoleArgs {
      * If set, a map of claims (keys) to be copied
      * to specified metadata fields (values).
      */
-    claimMappings?: pulumi.Input<{[key: string]: any}>;
+    claimMappings?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * The amount of leeway to add to all claims to account for clock skew, in
      * seconds. Defaults to `60` seconds if set to `0` and can be disabled if set to `-1`.
diff --git a/sdk/nodejs/kubernetes/secretBackend.ts b/sdk/nodejs/kubernetes/secretBackend.ts
index 5cf4870ee..e0bad213e 100644
--- a/sdk/nodejs/kubernetes/secretBackend.ts
+++ b/sdk/nodejs/kubernetes/secretBackend.ts
@@ -144,7 +144,7 @@ export class SecretBackend extends pulumi.CustomResource {
     /**
      * Specifies mount type specific options that are passed to the backend
      */
-    public readonly options!: pulumi.Output<{[key: string]: any} | undefined>;
+    public readonly options!: pulumi.Output<{[key: string]: string} | undefined>;
     /**
      * List of headers to allow and pass from the request to the plugin
      */
@@ -324,7 +324,7 @@ export interface SecretBackendState {
     /**
      * Specifies mount type specific options that are passed to the backend
      */
-    options?: pulumi.Input<{[key: string]: any}>;
+    options?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * List of headers to allow and pass from the request to the plugin
      */
@@ -429,7 +429,7 @@ export interface SecretBackendArgs {
     /**
      * Specifies mount type specific options that are passed to the backend
      */
-    options?: pulumi.Input<{[key: string]: any}>;
+    options?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * List of headers to allow and pass from the request to the plugin
      */
diff --git a/sdk/nodejs/kv/getSecret.ts b/sdk/nodejs/kv/getSecret.ts
index fc4ed03a9..2aa434db7 100644
--- a/sdk/nodejs/kv/getSecret.ts
+++ b/sdk/nodejs/kv/getSecret.ts
@@ -71,7 +71,7 @@ export interface GetSecretResult {
      * represent string data, so any non-string values returned from Vault are
      * serialized as JSON.
      */
-    readonly data: {[key: string]: any};
+    readonly data: {[key: string]: string};
     /**
      * JSON-encoded string that that is
      * read as the secret data at the given path.
diff --git a/sdk/nodejs/kv/getSecretSubkeysV2.ts b/sdk/nodejs/kv/getSecretSubkeysV2.ts
index 3906c8026..b9e00cc9d 100644
--- a/sdk/nodejs/kv/getSecretSubkeysV2.ts
+++ b/sdk/nodejs/kv/getSecretSubkeysV2.ts
@@ -92,7 +92,7 @@ export interface GetSecretSubkeysV2Result {
     /**
      * Subkeys for the KV-V2 secret stored as a serialized map of strings.
      */
-    readonly data: {[key: string]: any};
+    readonly data: {[key: string]: string};
     /**
      * Subkeys for the KV-V2 secret read from Vault.
      */
diff --git a/sdk/nodejs/kv/getSecretV2.ts b/sdk/nodejs/kv/getSecretV2.ts
index 5cea429ba..4a3a619fb 100644
--- a/sdk/nodejs/kv/getSecretV2.ts
+++ b/sdk/nodejs/kv/getSecretV2.ts
@@ -89,14 +89,14 @@ export interface GetSecretV2Result {
     /**
      * Custom metadata for the secret.
      */
-    readonly customMetadata: {[key: string]: any};
+    readonly customMetadata: {[key: string]: string};
     /**
      * A mapping whose keys are the top-level data keys returned from
      * Vault and whose values are the corresponding values. This map can only
      * represent string data, so any non-string values returned from Vault are
      * serialized as JSON.
      */
-    readonly data: {[key: string]: any};
+    readonly data: {[key: string]: string};
     /**
      * JSON-encoded string that that is
      * read as the secret data at the given path.
diff --git a/sdk/nodejs/kv/secret.ts b/sdk/nodejs/kv/secret.ts
index 7c9cc2b8f..9f1dae27a 100644
--- a/sdk/nodejs/kv/secret.ts
+++ b/sdk/nodejs/kv/secret.ts
@@ -82,7 +82,7 @@ export class Secret extends pulumi.CustomResource {
      * represent string data, so any non-string values returned from Vault are
      * serialized as JSON.
      */
-    public /*out*/ readonly data!: pulumi.Output<{[key: string]: any}>;
+    public /*out*/ readonly data!: pulumi.Output<{[key: string]: string}>;
     /**
      * JSON-encoded string that will be
      * written as the secret data at the given path.
@@ -147,7 +147,7 @@ export interface SecretState {
      * represent string data, so any non-string values returned from Vault are
      * serialized as JSON.
      */
-    data?: pulumi.Input<{[key: string]: any}>;
+    data?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * JSON-encoded string that will be
      * written as the secret data at the given path.
diff --git a/sdk/nodejs/kv/secretV2.ts b/sdk/nodejs/kv/secretV2.ts
index 76ff0bbe6..9d5640af6 100644
--- a/sdk/nodejs/kv/secretV2.ts
+++ b/sdk/nodejs/kv/secretV2.ts
@@ -119,7 +119,7 @@ export class SecretV2 extends pulumi.CustomResource {
      * represent string data, so any non-string values returned from Vault are
      * serialized as JSON.
      */
-    public /*out*/ readonly data!: pulumi.Output<{[key: string]: any}>;
+    public /*out*/ readonly data!: pulumi.Output<{[key: string]: string}>;
     /**
      * JSON-encoded string that will be
      * written as the secret data at the given path.
@@ -138,7 +138,7 @@ export class SecretV2 extends pulumi.CustomResource {
     /**
      * Metadata associated with this secret read from Vault.
      */
-    public /*out*/ readonly metadata!: pulumi.Output<{[key: string]: any}>;
+    public /*out*/ readonly metadata!: pulumi.Output<{[key: string]: string}>;
     /**
      * Path where KV-V2 engine is mounted.
      */
@@ -160,7 +160,7 @@ export class SecretV2 extends pulumi.CustomResource {
     /**
      * An object that holds option settings.
      */
-    public readonly options!: pulumi.Output<{[key: string]: any} | undefined>;
+    public readonly options!: pulumi.Output<{[key: string]: string} | undefined>;
     /**
      * Full path where the KV-V2 secret will be written.
      */
@@ -242,7 +242,7 @@ export interface SecretV2State {
      * represent string data, so any non-string values returned from Vault are
      * serialized as JSON.
      */
-    data?: pulumi.Input<{[key: string]: any}>;
+    data?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * JSON-encoded string that will be
      * written as the secret data at the given path.
@@ -261,7 +261,7 @@ export interface SecretV2State {
     /**
      * Metadata associated with this secret read from Vault.
      */
-    metadata?: pulumi.Input<{[key: string]: any}>;
+    metadata?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * Path where KV-V2 engine is mounted.
      */
@@ -283,7 +283,7 @@ export interface SecretV2State {
     /**
      * An object that holds option settings.
      */
-    options?: pulumi.Input<{[key: string]: any}>;
+    options?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * Full path where the KV-V2 secret will be written.
      */
@@ -343,5 +343,5 @@ export interface SecretV2Args {
     /**
      * An object that holds option settings.
      */
-    options?: pulumi.Input<{[key: string]: any}>;
+    options?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
 }
diff --git a/sdk/nodejs/ldap/secretBackend.ts b/sdk/nodejs/ldap/secretBackend.ts
index 8f84fc131..9740db8f1 100644
--- a/sdk/nodejs/ldap/secretBackend.ts
+++ b/sdk/nodejs/ldap/secretBackend.ts
@@ -155,7 +155,7 @@ export class SecretBackend extends pulumi.CustomResource {
     /**
      * Specifies mount type specific options that are passed to the backend
      */
-    public readonly options!: pulumi.Output<{[key: string]: any} | undefined>;
+    public readonly options!: pulumi.Output<{[key: string]: string} | undefined>;
     /**
      * List of headers to allow and pass from the request to the plugin
      */
@@ -416,7 +416,7 @@ export interface SecretBackendState {
     /**
      * Specifies mount type specific options that are passed to the backend
      */
-    options?: pulumi.Input<{[key: string]: any}>;
+    options?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * List of headers to allow and pass from the request to the plugin
      */
@@ -573,7 +573,7 @@ export interface SecretBackendArgs {
     /**
      * Specifies mount type specific options that are passed to the backend
      */
-    options?: pulumi.Input<{[key: string]: any}>;
+    options?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * List of headers to allow and pass from the request to the plugin
      */
diff --git a/sdk/nodejs/mount.ts b/sdk/nodejs/mount.ts
index 3bb869665..4b0a5390c 100644
--- a/sdk/nodejs/mount.ts
+++ b/sdk/nodejs/mount.ts
@@ -44,7 +44,7 @@ import * as utilities from "./utilities";
  *     type: "transit",
  *     description: "This is an example transit secret engine mount",
  *     options: {
- *         convergent_encryption: false,
+ *         convergent_encryption: "false",
  *     },
  * });
  * ```
@@ -164,7 +164,7 @@ export class Mount extends pulumi.CustomResource {
     /**
      * Specifies mount type specific options that are passed to the backend
      */
-    public readonly options!: pulumi.Output<{[key: string]: any} | undefined>;
+    public readonly options!: pulumi.Output<{[key: string]: string} | undefined>;
     /**
      * List of headers to allow and pass from the request to
      * the plugin.
@@ -326,7 +326,7 @@ export interface MountState {
     /**
      * Specifies mount type specific options that are passed to the backend
      */
-    options?: pulumi.Input<{[key: string]: any}>;
+    options?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * List of headers to allow and pass from the request to
      * the plugin.
@@ -418,7 +418,7 @@ export interface MountArgs {
     /**
      * Specifies mount type specific options that are passed to the backend
      */
-    options?: pulumi.Input<{[key: string]: any}>;
+    options?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * List of headers to allow and pass from the request to
      * the plugin.
diff --git a/sdk/nodejs/namespace.ts b/sdk/nodejs/namespace.ts
index 089eebf83..bee05317e 100644
--- a/sdk/nodejs/namespace.ts
+++ b/sdk/nodejs/namespace.ts
@@ -87,7 +87,7 @@ export class Namespace extends pulumi.CustomResource {
      * Custom metadata describing this namespace. Value type
      * is `map[string]string`. Requires Vault version 1.12+.
      */
-    public readonly customMetadata!: pulumi.Output<{[key: string]: any}>;
+    public readonly customMetadata!: pulumi.Output<{[key: string]: string}>;
     /**
      * The namespace to provision the resource in.
      * The value should not contain leading or trailing forward slashes.
@@ -151,7 +151,7 @@ export interface NamespaceState {
      * Custom metadata describing this namespace. Value type
      * is `map[string]string`. Requires Vault version 1.12+.
      */
-    customMetadata?: pulumi.Input<{[key: string]: any}>;
+    customMetadata?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * The namespace to provision the resource in.
      * The value should not contain leading or trailing forward slashes.
@@ -182,7 +182,7 @@ export interface NamespaceArgs {
      * Custom metadata describing this namespace. Value type
      * is `map[string]string`. Requires Vault version 1.12+.
      */
-    customMetadata?: pulumi.Input<{[key: string]: any}>;
+    customMetadata?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * The namespace to provision the resource in.
      * The value should not contain leading or trailing forward slashes.
diff --git a/sdk/nodejs/pkisecret/backendConfigEst.ts b/sdk/nodejs/pkisecret/backendConfigEst.ts
index 83c0259c2..ed14d6ccb 100644
--- a/sdk/nodejs/pkisecret/backendConfigEst.ts
+++ b/sdk/nodejs/pkisecret/backendConfigEst.ts
@@ -81,7 +81,7 @@ export class BackendConfigEst extends pulumi.CustomResource {
     /**
      * Configures a pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:<role_name>. Labels must be unique across Vault cluster, and will register .well-known/est/<label> URL paths.
      */
-    public readonly labelToPathPolicy!: pulumi.Output<{[key: string]: any} | undefined>;
+    public readonly labelToPathPolicy!: pulumi.Output<{[key: string]: string} | undefined>;
     /**
      * A read-only timestamp representing the last time the configuration was updated.
      */
@@ -176,7 +176,7 @@ export interface BackendConfigEstState {
     /**
      * Configures a pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:<role_name>. Labels must be unique across Vault cluster, and will register .well-known/est/<label> URL paths.
      */
-    labelToPathPolicy?: pulumi.Input<{[key: string]: any}>;
+    labelToPathPolicy?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * A read-only timestamp representing the last time the configuration was updated.
      */
@@ -228,7 +228,7 @@ export interface BackendConfigEstArgs {
     /**
      * Configures a pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:<role_name>. Labels must be unique across Vault cluster, and will register .well-known/est/<label> URL paths.
      */
-    labelToPathPolicy?: pulumi.Input<{[key: string]: any}>;
+    labelToPathPolicy?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * The namespace of the target resource.
      * The value should not contain leading or trailing forward slashes.
diff --git a/sdk/nodejs/pkisecret/getBackendConfigEst.ts b/sdk/nodejs/pkisecret/getBackendConfigEst.ts
index c89affd6f..398cb0136 100644
--- a/sdk/nodejs/pkisecret/getBackendConfigEst.ts
+++ b/sdk/nodejs/pkisecret/getBackendConfigEst.ts
@@ -86,7 +86,7 @@ export interface GetBackendConfigEstResult {
     /**
      * A pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:<role_name>. Labels must be unique across Vault cluster, and will register .well-known/est/<label> URL paths.
      */
-    readonly labelToPathPolicy: {[key: string]: any};
+    readonly labelToPathPolicy: {[key: string]: string};
     /**
      * A read-only timestamp representing the last time the configuration was updated.
      */
diff --git a/sdk/nodejs/pkisecret/getBackendIssuers.ts b/sdk/nodejs/pkisecret/getBackendIssuers.ts
index f73d59042..01ab5a43f 100644
--- a/sdk/nodejs/pkisecret/getBackendIssuers.ts
+++ b/sdk/nodejs/pkisecret/getBackendIssuers.ts
@@ -67,7 +67,7 @@ export interface GetBackendIssuersResult {
     /**
      * Map of issuer strings read from Vault.
      */
-    readonly keyInfo: {[key: string]: any};
+    readonly keyInfo: {[key: string]: string};
     /**
      * JSON-encoded issuer data read from Vault.
      */
diff --git a/sdk/nodejs/pkisecret/getBackendKeys.ts b/sdk/nodejs/pkisecret/getBackendKeys.ts
index 88c7b2e07..a721ddd20 100644
--- a/sdk/nodejs/pkisecret/getBackendKeys.ts
+++ b/sdk/nodejs/pkisecret/getBackendKeys.ts
@@ -67,7 +67,7 @@ export interface GetBackendKeysResult {
     /**
      * Map of key strings read from Vault.
      */
-    readonly keyInfo: {[key: string]: any};
+    readonly keyInfo: {[key: string]: string};
     /**
      * JSON-encoded key data read from Vault.
      */
diff --git a/sdk/nodejs/saml/authBackendRole.ts b/sdk/nodejs/saml/authBackendRole.ts
index e24b9a437..d5d72490f 100644
--- a/sdk/nodejs/saml/authBackendRole.ts
+++ b/sdk/nodejs/saml/authBackendRole.ts
@@ -75,7 +75,7 @@ export class AuthBackendRole extends pulumi.CustomResource {
      * Mapping of attribute names to values that are expected to
      * exist in the SAML assertion.
      */
-    public readonly boundAttributes!: pulumi.Output<{[key: string]: any} | undefined>;
+    public readonly boundAttributes!: pulumi.Output<{[key: string]: string} | undefined>;
     /**
      * The type of matching assertion to perform on
      * `boundAttributesType`.
@@ -212,7 +212,7 @@ export interface AuthBackendRoleState {
      * Mapping of attribute names to values that are expected to
      * exist in the SAML assertion.
      */
-    boundAttributes?: pulumi.Input<{[key: string]: any}>;
+    boundAttributes?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * The type of matching assertion to perform on
      * `boundAttributesType`.
@@ -292,7 +292,7 @@ export interface AuthBackendRoleArgs {
      * Mapping of attribute names to values that are expected to
      * exist in the SAML assertion.
      */
-    boundAttributes?: pulumi.Input<{[key: string]: any}>;
+    boundAttributes?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * The type of matching assertion to perform on
      * `boundAttributesType`.
diff --git a/sdk/nodejs/secrets/syncAwsDestination.ts b/sdk/nodejs/secrets/syncAwsDestination.ts
index 4c40a5b0f..364ff75b6 100644
--- a/sdk/nodejs/secrets/syncAwsDestination.ts
+++ b/sdk/nodejs/secrets/syncAwsDestination.ts
@@ -70,7 +70,7 @@ export class SyncAwsDestination extends pulumi.CustomResource {
     /**
      * Custom tags to set on the secret managed at the destination.
      */
-    public readonly customTags!: pulumi.Output<{[key: string]: any} | undefined>;
+    public readonly customTags!: pulumi.Output<{[key: string]: string} | undefined>;
     /**
      * Optional extra protection that must match the trust policy granting access to the
      * AWS IAM role ARN. We recommend using a different random UUID per destination. The value is generated by users.
@@ -182,7 +182,7 @@ export interface SyncAwsDestinationState {
     /**
      * Custom tags to set on the secret managed at the destination.
      */
-    customTags?: pulumi.Input<{[key: string]: any}>;
+    customTags?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * Optional extra protection that must match the trust policy granting access to the
      * AWS IAM role ARN. We recommend using a different random UUID per destination. The value is generated by users.
@@ -250,7 +250,7 @@ export interface SyncAwsDestinationArgs {
     /**
      * Custom tags to set on the secret managed at the destination.
      */
-    customTags?: pulumi.Input<{[key: string]: any}>;
+    customTags?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * Optional extra protection that must match the trust policy granting access to the
      * AWS IAM role ARN. We recommend using a different random UUID per destination. The value is generated by users.
diff --git a/sdk/nodejs/secrets/syncAzureDestination.ts b/sdk/nodejs/secrets/syncAzureDestination.ts
index 11f96e8b4..efdeacb67 100644
--- a/sdk/nodejs/secrets/syncAzureDestination.ts
+++ b/sdk/nodejs/secrets/syncAzureDestination.ts
@@ -79,7 +79,7 @@ export class SyncAzureDestination extends pulumi.CustomResource {
     /**
      * Custom tags to set on the secret managed at the destination.
      */
-    public readonly customTags!: pulumi.Output<{[key: string]: any} | undefined>;
+    public readonly customTags!: pulumi.Output<{[key: string]: string} | undefined>;
     /**
      * Determines what level of information is synced as a distinct resource
      * at the destination. Supports `secret-path` and `secret-key`.
@@ -185,7 +185,7 @@ export interface SyncAzureDestinationState {
     /**
      * Custom tags to set on the secret managed at the destination.
      */
-    customTags?: pulumi.Input<{[key: string]: any}>;
+    customTags?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * Determines what level of information is synced as a distinct resource
      * at the destination. Supports `secret-path` and `secret-key`.
@@ -247,7 +247,7 @@ export interface SyncAzureDestinationArgs {
     /**
      * Custom tags to set on the secret managed at the destination.
      */
-    customTags?: pulumi.Input<{[key: string]: any}>;
+    customTags?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * Determines what level of information is synced as a distinct resource
      * at the destination. Supports `secret-path` and `secret-key`.
diff --git a/sdk/nodejs/secrets/syncGcpDestination.ts b/sdk/nodejs/secrets/syncGcpDestination.ts
index f8bf16a60..baa02b7b6 100644
--- a/sdk/nodejs/secrets/syncGcpDestination.ts
+++ b/sdk/nodejs/secrets/syncGcpDestination.ts
@@ -70,7 +70,7 @@ export class SyncGcpDestination extends pulumi.CustomResource {
     /**
      * Custom tags to set on the secret managed at the destination.
      */
-    public readonly customTags!: pulumi.Output<{[key: string]: any} | undefined>;
+    public readonly customTags!: pulumi.Output<{[key: string]: string} | undefined>;
     /**
      * Determines what level of information is synced as a distinct resource
      * at the destination. Supports `secret-path` and `secret-key`.
@@ -155,7 +155,7 @@ export interface SyncGcpDestinationState {
     /**
      * Custom tags to set on the secret managed at the destination.
      */
-    customTags?: pulumi.Input<{[key: string]: any}>;
+    customTags?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * Determines what level of information is synced as a distinct resource
      * at the destination. Supports `secret-path` and `secret-key`.
@@ -202,7 +202,7 @@ export interface SyncGcpDestinationArgs {
     /**
      * Custom tags to set on the secret managed at the destination.
      */
-    customTags?: pulumi.Input<{[key: string]: any}>;
+    customTags?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * Determines what level of information is synced as a distinct resource
      * at the destination. Supports `secret-path` and `secret-key`.
diff --git a/sdk/nodejs/ssh/secretBackendRole.ts b/sdk/nodejs/ssh/secretBackendRole.ts
index ec465cd69..97c6c2768 100644
--- a/sdk/nodejs/ssh/secretBackendRole.ts
+++ b/sdk/nodejs/ssh/secretBackendRole.ts
@@ -135,11 +135,11 @@ export class SecretBackendRole extends pulumi.CustomResource {
     /**
      * Specifies a map of critical options that certificates have when signed.
      */
-    public readonly defaultCriticalOptions!: pulumi.Output<{[key: string]: any} | undefined>;
+    public readonly defaultCriticalOptions!: pulumi.Output<{[key: string]: string} | undefined>;
     /**
      * Specifies a map of extensions that certificates have when signed.
      */
-    public readonly defaultExtensions!: pulumi.Output<{[key: string]: any} | undefined>;
+    public readonly defaultExtensions!: pulumi.Output<{[key: string]: string} | undefined>;
     /**
      * Specifies the default username for which a credential will be generated.
      */
@@ -329,11 +329,11 @@ export interface SecretBackendRoleState {
     /**
      * Specifies a map of critical options that certificates have when signed.
      */
-    defaultCriticalOptions?: pulumi.Input<{[key: string]: any}>;
+    defaultCriticalOptions?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * Specifies a map of extensions that certificates have when signed.
      */
-    defaultExtensions?: pulumi.Input<{[key: string]: any}>;
+    defaultExtensions?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * Specifies the default username for which a credential will be generated.
      */
@@ -445,11 +445,11 @@ export interface SecretBackendRoleArgs {
     /**
      * Specifies a map of critical options that certificates have when signed.
      */
-    defaultCriticalOptions?: pulumi.Input<{[key: string]: any}>;
+    defaultCriticalOptions?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * Specifies a map of extensions that certificates have when signed.
      */
-    defaultExtensions?: pulumi.Input<{[key: string]: any}>;
+    defaultExtensions?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * Specifies the default username for which a credential will be generated.
      */
diff --git a/sdk/nodejs/transform/getDecode.ts b/sdk/nodejs/transform/getDecode.ts
index c562f8dfb..b4124f494 100644
--- a/sdk/nodejs/transform/getDecode.ts
+++ b/sdk/nodejs/transform/getDecode.ts
@@ -62,11 +62,11 @@ export interface GetDecodeArgs {
     /**
      * Specifies a list of items to be decoded in a single batch. If this parameter is set, the top-level parameters 'value', 'transformation' and 'tweak' will be ignored. Each batch item within the list can specify these parameters instead.
      */
-    batchInputs?: {[key: string]: any}[];
+    batchInputs?: {[key: string]: string}[];
     /**
      * The result of decoding a batch.
      */
-    batchResults?: {[key: string]: any}[];
+    batchResults?: {[key: string]: string}[];
     /**
      * The result of decoding a value.
      */
@@ -104,8 +104,8 @@ export interface GetDecodeArgs {
  * A collection of values returned by getDecode.
  */
 export interface GetDecodeResult {
-    readonly batchInputs?: {[key: string]: any}[];
-    readonly batchResults: {[key: string]: any}[];
+    readonly batchInputs?: {[key: string]: string}[];
+    readonly batchResults: {[key: string]: string}[];
     readonly decodedValue: string;
     /**
      * The provider-assigned unique ID for this managed resource.
@@ -164,11 +164,11 @@ export interface GetDecodeOutputArgs {
     /**
      * Specifies a list of items to be decoded in a single batch. If this parameter is set, the top-level parameters 'value', 'transformation' and 'tweak' will be ignored. Each batch item within the list can specify these parameters instead.
      */
-    batchInputs?: pulumi.Input<pulumi.Input<{[key: string]: any}>[]>;
+    batchInputs?: pulumi.Input<pulumi.Input<{[key: string]: pulumi.Input<string>}>[]>;
     /**
      * The result of decoding a batch.
      */
-    batchResults?: pulumi.Input<pulumi.Input<{[key: string]: any}>[]>;
+    batchResults?: pulumi.Input<pulumi.Input<{[key: string]: pulumi.Input<string>}>[]>;
     /**
      * The result of decoding a value.
      */
diff --git a/sdk/nodejs/transform/getEncode.ts b/sdk/nodejs/transform/getEncode.ts
index 2d5e9584c..6670967cd 100644
--- a/sdk/nodejs/transform/getEncode.ts
+++ b/sdk/nodejs/transform/getEncode.ts
@@ -64,11 +64,11 @@ export interface GetEncodeArgs {
     /**
      * Specifies a list of items to be encoded in a single batch. If this parameter is set, the parameters 'value', 'transformation' and 'tweak' will be ignored. Each batch item within the list can specify these parameters instead.
      */
-    batchInputs?: {[key: string]: any}[];
+    batchInputs?: {[key: string]: string}[];
     /**
      * The result of encoding a batch.
      */
-    batchResults?: {[key: string]: any}[];
+    batchResults?: {[key: string]: string}[];
     /**
      * The result of encoding a value.
      */
@@ -106,8 +106,8 @@ export interface GetEncodeArgs {
  * A collection of values returned by getEncode.
  */
 export interface GetEncodeResult {
-    readonly batchInputs?: {[key: string]: any}[];
-    readonly batchResults: {[key: string]: any}[];
+    readonly batchInputs?: {[key: string]: string}[];
+    readonly batchResults: {[key: string]: string}[];
     readonly encodedValue: string;
     /**
      * The provider-assigned unique ID for this managed resource.
@@ -168,11 +168,11 @@ export interface GetEncodeOutputArgs {
     /**
      * Specifies a list of items to be encoded in a single batch. If this parameter is set, the parameters 'value', 'transformation' and 'tweak' will be ignored. Each batch item within the list can specify these parameters instead.
      */
-    batchInputs?: pulumi.Input<pulumi.Input<{[key: string]: any}>[]>;
+    batchInputs?: pulumi.Input<pulumi.Input<{[key: string]: pulumi.Input<string>}>[]>;
     /**
      * The result of encoding a batch.
      */
-    batchResults?: pulumi.Input<pulumi.Input<{[key: string]: any}>[]>;
+    batchResults?: pulumi.Input<pulumi.Input<{[key: string]: pulumi.Input<string>}>[]>;
     /**
      * The result of encoding a value.
      */
diff --git a/sdk/nodejs/transform/template.ts b/sdk/nodejs/transform/template.ts
index 155cd6ce6..249103f77 100644
--- a/sdk/nodejs/transform/template.ts
+++ b/sdk/nodejs/transform/template.ts
@@ -84,7 +84,7 @@ export class Template extends pulumi.CustomResource {
      * Optional mapping of name to regular expression template, used to customize
      * the decoded output. (requires Vault Enterprise 1.9+)
      */
-    public readonly decodeFormats!: pulumi.Output<{[key: string]: any} | undefined>;
+    public readonly decodeFormats!: pulumi.Output<{[key: string]: string} | undefined>;
     /**
      * The regular expression template used to format encoded values.
      * (requires Vault Enterprise 1.9+)
@@ -166,7 +166,7 @@ export interface TemplateState {
      * Optional mapping of name to regular expression template, used to customize
      * the decoded output. (requires Vault Enterprise 1.9+)
      */
-    decodeFormats?: pulumi.Input<{[key: string]: any}>;
+    decodeFormats?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * The regular expression template used to format encoded values.
      * (requires Vault Enterprise 1.9+)
@@ -209,7 +209,7 @@ export interface TemplateArgs {
      * Optional mapping of name to regular expression template, used to customize
      * the decoded output. (requires Vault Enterprise 1.9+)
      */
-    decodeFormats?: pulumi.Input<{[key: string]: any}>;
+    decodeFormats?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     /**
      * The regular expression template used to format encoded values.
      * (requires Vault Enterprise 1.9+)
diff --git a/sdk/nodejs/transit/secretBackendKey.ts b/sdk/nodejs/transit/secretBackendKey.ts
index 7d3e53e69..07c3c7931 100644
--- a/sdk/nodejs/transit/secretBackendKey.ts
+++ b/sdk/nodejs/transit/secretBackendKey.ts
@@ -101,7 +101,7 @@ export class SecretBackendKey extends pulumi.CustomResource {
      * * for key types `aes128-gcm96`, `aes256-gcm96` and `chacha20-poly1305`, each key version will be a map of a single value `id` which is just a hash of the key's metadata.
      * * for key types `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `rsa-2048`, `rsa-3072` and `rsa-4096`, each key version will be a map of the following:
      */
-    public /*out*/ readonly keys!: pulumi.Output<{[key: string]: any}[]>;
+    public /*out*/ readonly keys!: pulumi.Output<{[key: string]: string}[]>;
     /**
      * Latest key version available. This value is 1-indexed, so if `latestVersion` is `1`, then the key's information can be referenced from `keys` by selecting element `0`
      */
@@ -258,7 +258,7 @@ export interface SecretBackendKeyState {
      * * for key types `aes128-gcm96`, `aes256-gcm96` and `chacha20-poly1305`, each key version will be a map of a single value `id` which is just a hash of the key's metadata.
      * * for key types `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `rsa-2048`, `rsa-3072` and `rsa-4096`, each key version will be a map of the following:
      */
-    keys?: pulumi.Input<pulumi.Input<{[key: string]: any}>[]>;
+    keys?: pulumi.Input<pulumi.Input<{[key: string]: pulumi.Input<string>}>[]>;
     /**
      * Latest key version available. This value is 1-indexed, so if `latestVersion` is `1`, then the key's information can be referenced from `keys` by selecting element `0`
      */
diff --git a/sdk/nodejs/types/input.ts b/sdk/nodejs/types/input.ts
index 98ac8b5c1..31ae319be 100644
--- a/sdk/nodejs/types/input.ts
+++ b/sdk/nodejs/types/input.ts
@@ -1268,7 +1268,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: pulumi.Input<{[key: string]: any}>;
+        data?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
         /**
          * Cassandra hosts to connect to.
          */
@@ -1343,7 +1343,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: pulumi.Input<{[key: string]: any}>;
+        data?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
         /**
          * A set of Couchbase URIs to connect to. Must use `couchbases://` scheme if `tls` is `true`.
          */
@@ -1414,7 +1414,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: pulumi.Input<{[key: string]: any}>;
+        data?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
         /**
          * Whether to disable certificate verification
          */
@@ -1473,7 +1473,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: pulumi.Input<{[key: string]: any}>;
+        data?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
         /**
          * Disable special character escaping in username and password
          */
@@ -1532,7 +1532,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: pulumi.Input<{[key: string]: any}>;
+        data?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
         /**
          * Influxdb host to connect to.
          */
@@ -1603,7 +1603,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: pulumi.Input<{[key: string]: any}>;
+        data?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
         /**
          * Maximum number of seconds a connection may be reused.
          */
@@ -1658,7 +1658,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: pulumi.Input<{[key: string]: any}>;
+        data?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
         /**
          * Name of the database connection.
          */
@@ -1709,7 +1709,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: pulumi.Input<{[key: string]: any}>;
+        data?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
         /**
          * Disable special character escaping in username and password
          */
@@ -1776,7 +1776,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: pulumi.Input<{[key: string]: any}>;
+        data?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
         /**
          * Maximum number of seconds a connection may be reused.
          */
@@ -1851,7 +1851,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: pulumi.Input<{[key: string]: any}>;
+        data?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
         /**
          * Maximum number of seconds a connection may be reused.
          */
@@ -1926,7 +1926,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: pulumi.Input<{[key: string]: any}>;
+        data?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
         /**
          * Maximum number of seconds a connection may be reused.
          */
@@ -2001,7 +2001,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: pulumi.Input<{[key: string]: any}>;
+        data?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
         /**
          * Maximum number of seconds a connection may be reused.
          */
@@ -2072,7 +2072,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: pulumi.Input<{[key: string]: any}>;
+        data?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
         /**
          * Set to true to disconnect any open sessions prior to running the revocation statements.
          */
@@ -2143,7 +2143,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: pulumi.Input<{[key: string]: any}>;
+        data?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
         /**
          * Disable special character escaping in username and password
          */
@@ -2210,7 +2210,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: pulumi.Input<{[key: string]: any}>;
+        data?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
         /**
          * Specifies the host to connect to
          */
@@ -2265,7 +2265,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: pulumi.Input<{[key: string]: any}>;
+        data?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
         /**
          * Name of the database connection.
          */
@@ -2316,7 +2316,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: pulumi.Input<{[key: string]: any}>;
+        data?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
         /**
          * Disable special character escaping in username and password
          */
@@ -2379,7 +2379,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: pulumi.Input<{[key: string]: any}>;
+        data?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
         /**
          * Maximum number of seconds a connection may be reused.
          */
@@ -2627,7 +2627,7 @@ export namespace kv {
          * represent string data, so any non-string values returned from Vault are
          * serialized as JSON.
          */
-        data?: pulumi.Input<{[key: string]: any}>;
+        data?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
         /**
          * If set, specifies the length of time before a version is deleted.
          */
@@ -2863,11 +2863,11 @@ export namespace pkiSecret {
         /**
          * "The accessor (required) and certRole (optional) properties for cert auth backends".
          */
-        cert?: pulumi.Input<{[key: string]: any}>;
+        cert?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
         /**
          * "The accessor (required) property for user pass auth backends".
          */
-        userpass?: pulumi.Input<{[key: string]: any}>;
+        userpass?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
     }
 
     export interface SecretBackendRolePolicyIdentifier {
diff --git a/sdk/nodejs/types/output.ts b/sdk/nodejs/types/output.ts
index b9216c6ed..d18cdd908 100644
--- a/sdk/nodejs/types/output.ts
+++ b/sdk/nodejs/types/output.ts
@@ -1214,7 +1214,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: {[key: string]: any};
+        data?: {[key: string]: string};
         /**
          * Cassandra hosts to connect to.
          */
@@ -1289,7 +1289,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: {[key: string]: any};
+        data?: {[key: string]: string};
         /**
          * A set of Couchbase URIs to connect to. Must use `couchbases://` scheme if `tls` is `true`.
          */
@@ -1360,7 +1360,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: {[key: string]: any};
+        data?: {[key: string]: string};
         /**
          * Whether to disable certificate verification
          */
@@ -1419,7 +1419,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: {[key: string]: any};
+        data?: {[key: string]: string};
         /**
          * Disable special character escaping in username and password
          */
@@ -1478,7 +1478,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: {[key: string]: any};
+        data?: {[key: string]: string};
         /**
          * Influxdb host to connect to.
          */
@@ -1549,7 +1549,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: {[key: string]: any};
+        data?: {[key: string]: string};
         /**
          * Maximum number of seconds a connection may be reused.
          */
@@ -1604,7 +1604,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: {[key: string]: any};
+        data?: {[key: string]: string};
         /**
          * Name of the database connection.
          */
@@ -1655,7 +1655,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: {[key: string]: any};
+        data?: {[key: string]: string};
         /**
          * Disable special character escaping in username and password
          */
@@ -1722,7 +1722,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: {[key: string]: any};
+        data?: {[key: string]: string};
         /**
          * Maximum number of seconds a connection may be reused.
          */
@@ -1797,7 +1797,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: {[key: string]: any};
+        data?: {[key: string]: string};
         /**
          * Maximum number of seconds a connection may be reused.
          */
@@ -1872,7 +1872,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: {[key: string]: any};
+        data?: {[key: string]: string};
         /**
          * Maximum number of seconds a connection may be reused.
          */
@@ -1947,7 +1947,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: {[key: string]: any};
+        data?: {[key: string]: string};
         /**
          * Maximum number of seconds a connection may be reused.
          */
@@ -2018,7 +2018,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: {[key: string]: any};
+        data?: {[key: string]: string};
         /**
          * Set to true to disconnect any open sessions prior to running the revocation statements.
          */
@@ -2089,7 +2089,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: {[key: string]: any};
+        data?: {[key: string]: string};
         /**
          * Disable special character escaping in username and password
          */
@@ -2156,7 +2156,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: {[key: string]: any};
+        data?: {[key: string]: string};
         /**
          * Specifies the host to connect to
          */
@@ -2211,7 +2211,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: {[key: string]: any};
+        data?: {[key: string]: string};
         /**
          * Name of the database connection.
          */
@@ -2262,7 +2262,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: {[key: string]: any};
+        data?: {[key: string]: string};
         /**
          * Disable special character escaping in username and password
          */
@@ -2325,7 +2325,7 @@ export namespace database {
          *
          * Supported list of database secrets engines that can be configured:
          */
-        data?: {[key: string]: any};
+        data?: {[key: string]: string};
         /**
          * Maximum number of seconds a connection may be reused.
          */
@@ -2539,7 +2539,7 @@ export namespace identity {
         /**
          * Arbitrary metadata
          */
-        metadata: {[key: string]: any};
+        metadata: {[key: string]: string};
         /**
          * Authentication mount acccessor which this alias belongs to
          */
@@ -2620,7 +2620,7 @@ export namespace kv {
          * represent string data, so any non-string values returned from Vault are
          * serialized as JSON.
          */
-        data?: {[key: string]: any};
+        data?: {[key: string]: string};
         /**
          * If set, specifies the length of time before a version is deleted.
          */
@@ -2859,22 +2859,22 @@ export namespace pkiSecret {
         /**
          * "The accessor (required) and certRole (optional) properties for cert auth backends".
          */
-        cert?: {[key: string]: any};
+        cert?: {[key: string]: string};
         /**
          * "The accessor (required) property for user pass auth backends".
          */
-        userpass?: {[key: string]: any};
+        userpass?: {[key: string]: string};
     }
 
     export interface GetBackendConfigEstAuthenticator {
         /**
          * "The accessor and certRole properties for cert auth backends".
          */
-        cert?: {[key: string]: any};
+        cert?: {[key: string]: string};
         /**
          * "The accessor property for user pass auth backends".
          */
-        userpass?: {[key: string]: any};
+        userpass?: {[key: string]: string};
     }
 
     export interface SecretBackendRolePolicyIdentifier {
diff --git a/sdk/python/pulumi_vault/aws/auth_backend_login.py b/sdk/python/pulumi_vault/aws/auth_backend_login.py
index 2bb00402f..809fe9b54 100644
--- a/sdk/python/pulumi_vault/aws/auth_backend_login.py
+++ b/sdk/python/pulumi_vault/aws/auth_backend_login.py
@@ -243,7 +243,7 @@ def __init__(__self__, *,
                  identity: Optional[pulumi.Input[str]] = None,
                  lease_duration: Optional[pulumi.Input[int]] = None,
                  lease_start_time: Optional[pulumi.Input[str]] = None,
-                 metadata: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 metadata: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
                  nonce: Optional[pulumi.Input[str]] = None,
                  pkcs7: Optional[pulumi.Input[str]] = None,
@@ -270,7 +270,7 @@ def __init__(__self__, *,
                authenticate with. Can be retrieved from the EC2 metadata server.
         :param pulumi.Input[int] lease_duration: The duration in seconds the token will be valid, relative
                to the time in `lease_start_time`.
-        :param pulumi.Input[Mapping[str, Any]] metadata: A map of information returned by the Vault server about the
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] metadata: A map of information returned by the Vault server about the
                authentication used to generate this token.
         :param pulumi.Input[str] namespace: The namespace to provision the resource in.
                The value should not contain leading or trailing forward slashes.
@@ -468,7 +468,7 @@ def lease_start_time(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter
-    def metadata(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def metadata(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         A map of information returned by the Vault server about the
         authentication used to generate this token.
@@ -476,7 +476,7 @@ def metadata(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "metadata")
 
     @metadata.setter
-    def metadata(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def metadata(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "metadata", value)
 
     @property
@@ -718,7 +718,7 @@ def get(resource_name: str,
             identity: Optional[pulumi.Input[str]] = None,
             lease_duration: Optional[pulumi.Input[int]] = None,
             lease_start_time: Optional[pulumi.Input[str]] = None,
-            metadata: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+            metadata: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
             namespace: Optional[pulumi.Input[str]] = None,
             nonce: Optional[pulumi.Input[str]] = None,
             pkcs7: Optional[pulumi.Input[str]] = None,
@@ -750,7 +750,7 @@ def get(resource_name: str,
                authenticate with. Can be retrieved from the EC2 metadata server.
         :param pulumi.Input[int] lease_duration: The duration in seconds the token will be valid, relative
                to the time in `lease_start_time`.
-        :param pulumi.Input[Mapping[str, Any]] metadata: A map of information returned by the Vault server about the
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] metadata: A map of information returned by the Vault server about the
                authentication used to generate this token.
         :param pulumi.Input[str] namespace: The namespace to provision the resource in.
                The value should not contain leading or trailing forward slashes.
@@ -890,7 +890,7 @@ def lease_start_time(self) -> pulumi.Output[str]:
 
     @property
     @pulumi.getter
-    def metadata(self) -> pulumi.Output[Mapping[str, Any]]:
+    def metadata(self) -> pulumi.Output[Mapping[str, str]]:
         """
         A map of information returned by the Vault server about the
         authentication used to generate this token.
diff --git a/sdk/python/pulumi_vault/config/ui_custom_message.py b/sdk/python/pulumi_vault/config/ui_custom_message.py
index e37415b88..db53326ae 100644
--- a/sdk/python/pulumi_vault/config/ui_custom_message.py
+++ b/sdk/python/pulumi_vault/config/ui_custom_message.py
@@ -23,7 +23,7 @@ def __init__(__self__, *,
                  end_time: Optional[pulumi.Input[str]] = None,
                  link: Optional[pulumi.Input['UiCustomMessageLinkArgs']] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
-                 options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  type: Optional[pulumi.Input[str]] = None):
         """
         The set of arguments for constructing a UiCustomMessage resource.
@@ -34,7 +34,7 @@ def __init__(__self__, *,
         :param pulumi.Input[str] end_time: The ending time of the active period of the custom message. Can be omitted for non-expiring message
         :param pulumi.Input['UiCustomMessageLinkArgs'] link: A block containing a hyperlink associated with the custom message
         :param pulumi.Input[str] namespace: Target namespace. (requires Enterprise)
-        :param pulumi.Input[Mapping[str, Any]] options: A map containing additional options for the custom message
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] options: A map containing additional options for the custom message
         :param pulumi.Input[str] type: The display type of custom message. Allowed values are banner and modal
         """
         pulumi.set(__self__, "message_base64", message_base64)
@@ -139,14 +139,14 @@ def namespace(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter
-    def options(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def options(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         A map containing additional options for the custom message
         """
         return pulumi.get(self, "options")
 
     @options.setter
-    def options(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def options(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "options", value)
 
     @property
@@ -170,7 +170,7 @@ def __init__(__self__, *,
                  link: Optional[pulumi.Input['UiCustomMessageLinkArgs']] = None,
                  message_base64: Optional[pulumi.Input[str]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
-                 options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  start_time: Optional[pulumi.Input[str]] = None,
                  title: Optional[pulumi.Input[str]] = None,
                  type: Optional[pulumi.Input[str]] = None):
@@ -181,7 +181,7 @@ def __init__(__self__, *,
         :param pulumi.Input['UiCustomMessageLinkArgs'] link: A block containing a hyperlink associated with the custom message
         :param pulumi.Input[str] message_base64: The base64-encoded content of the custom message
         :param pulumi.Input[str] namespace: Target namespace. (requires Enterprise)
-        :param pulumi.Input[Mapping[str, Any]] options: A map containing additional options for the custom message
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] options: A map containing additional options for the custom message
         :param pulumi.Input[str] start_time: The starting time of the active period of the custom message
         :param pulumi.Input[str] title: The title of the custom message
         :param pulumi.Input[str] type: The display type of custom message. Allowed values are banner and modal
@@ -267,14 +267,14 @@ def namespace(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter
-    def options(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def options(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         A map containing additional options for the custom message
         """
         return pulumi.get(self, "options")
 
     @options.setter
-    def options(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def options(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "options", value)
 
     @property
@@ -324,7 +324,7 @@ def __init__(__self__,
                  link: Optional[pulumi.Input[Union['UiCustomMessageLinkArgs', 'UiCustomMessageLinkArgsDict']]] = None,
                  message_base64: Optional[pulumi.Input[str]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
-                 options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  start_time: Optional[pulumi.Input[str]] = None,
                  title: Optional[pulumi.Input[str]] = None,
                  type: Optional[pulumi.Input[str]] = None,
@@ -338,7 +338,7 @@ def __init__(__self__,
         :param pulumi.Input[Union['UiCustomMessageLinkArgs', 'UiCustomMessageLinkArgsDict']] link: A block containing a hyperlink associated with the custom message
         :param pulumi.Input[str] message_base64: The base64-encoded content of the custom message
         :param pulumi.Input[str] namespace: Target namespace. (requires Enterprise)
-        :param pulumi.Input[Mapping[str, Any]] options: A map containing additional options for the custom message
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] options: A map containing additional options for the custom message
         :param pulumi.Input[str] start_time: The starting time of the active period of the custom message
         :param pulumi.Input[str] title: The title of the custom message
         :param pulumi.Input[str] type: The display type of custom message. Allowed values are banner and modal
@@ -371,7 +371,7 @@ def _internal_init(__self__,
                  link: Optional[pulumi.Input[Union['UiCustomMessageLinkArgs', 'UiCustomMessageLinkArgsDict']]] = None,
                  message_base64: Optional[pulumi.Input[str]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
-                 options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  start_time: Optional[pulumi.Input[str]] = None,
                  title: Optional[pulumi.Input[str]] = None,
                  type: Optional[pulumi.Input[str]] = None,
@@ -414,7 +414,7 @@ def get(resource_name: str,
             link: Optional[pulumi.Input[Union['UiCustomMessageLinkArgs', 'UiCustomMessageLinkArgsDict']]] = None,
             message_base64: Optional[pulumi.Input[str]] = None,
             namespace: Optional[pulumi.Input[str]] = None,
-            options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+            options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
             start_time: Optional[pulumi.Input[str]] = None,
             title: Optional[pulumi.Input[str]] = None,
             type: Optional[pulumi.Input[str]] = None) -> 'UiCustomMessage':
@@ -430,7 +430,7 @@ def get(resource_name: str,
         :param pulumi.Input[Union['UiCustomMessageLinkArgs', 'UiCustomMessageLinkArgsDict']] link: A block containing a hyperlink associated with the custom message
         :param pulumi.Input[str] message_base64: The base64-encoded content of the custom message
         :param pulumi.Input[str] namespace: Target namespace. (requires Enterprise)
-        :param pulumi.Input[Mapping[str, Any]] options: A map containing additional options for the custom message
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] options: A map containing additional options for the custom message
         :param pulumi.Input[str] start_time: The starting time of the active period of the custom message
         :param pulumi.Input[str] title: The title of the custom message
         :param pulumi.Input[str] type: The display type of custom message. Allowed values are banner and modal
@@ -492,7 +492,7 @@ def namespace(self) -> pulumi.Output[Optional[str]]:
 
     @property
     @pulumi.getter
-    def options(self) -> pulumi.Output[Optional[Mapping[str, Any]]]:
+    def options(self) -> pulumi.Output[Optional[Mapping[str, str]]]:
         """
         A map containing additional options for the custom message
         """
diff --git a/sdk/python/pulumi_vault/database/_inputs.py b/sdk/python/pulumi_vault/database/_inputs.py
index 76a751311..1cca3d089 100644
--- a/sdk/python/pulumi_vault/database/_inputs.py
+++ b/sdk/python/pulumi_vault/database/_inputs.py
@@ -2612,7 +2612,7 @@ def __init__(__self__, *,
                  name: pulumi.Input[str],
                  allowed_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  connect_timeout: Optional[pulumi.Input[int]] = None,
-                 data: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 data: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  hosts: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  insecure_tls: Optional[pulumi.Input[bool]] = None,
                  password: Optional[pulumi.Input[str]] = None,
@@ -2630,7 +2630,7 @@ def __init__(__self__, *,
         :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_roles: A list of roles that are allowed to use this
                connection.
         :param pulumi.Input[int] connect_timeout: The number of seconds to use as a connection timeout.
-        :param pulumi.Input[Mapping[str, Any]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param pulumi.Input[Sequence[pulumi.Input[str]]] hosts: Cassandra hosts to connect to.
@@ -2718,7 +2718,7 @@ def connect_timeout(self, value: Optional[pulumi.Input[int]]):
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def data(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -2727,7 +2727,7 @@ def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "data")
 
     @data.setter
-    def data(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def data(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "data", value)
 
     @property
@@ -2886,7 +2886,7 @@ def __init__(__self__, *,
                  allowed_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  base64_pem: Optional[pulumi.Input[str]] = None,
                  bucket_name: Optional[pulumi.Input[str]] = None,
-                 data: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 data: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  insecure_tls: Optional[pulumi.Input[bool]] = None,
                  plugin_name: Optional[pulumi.Input[str]] = None,
                  root_rotation_statements: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
@@ -2902,7 +2902,7 @@ def __init__(__self__, *,
                connection.
         :param pulumi.Input[str] base64_pem: Required if `tls` is `true`. Specifies the certificate authority of the Couchbase server, as a PEM certificate that has been base64 encoded.
         :param pulumi.Input[str] bucket_name: Required for Couchbase versions prior to 6.5.0. This is only used to verify vault's connection to the server.
-        :param pulumi.Input[Mapping[str, Any]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param pulumi.Input[bool] insecure_tls: Specifies whether to skip verification of the server certificate when using TLS.
@@ -3025,7 +3025,7 @@ def bucket_name(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def data(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -3034,7 +3034,7 @@ def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "data")
 
     @data.setter
-    def data(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def data(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "data", value)
 
     @property
@@ -3123,7 +3123,7 @@ def __init__(__self__, *,
                  ca_path: Optional[pulumi.Input[str]] = None,
                  client_cert: Optional[pulumi.Input[str]] = None,
                  client_key: Optional[pulumi.Input[str]] = None,
-                 data: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 data: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  insecure: Optional[pulumi.Input[bool]] = None,
                  plugin_name: Optional[pulumi.Input[str]] = None,
                  root_rotation_statements: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
@@ -3141,7 +3141,7 @@ def __init__(__self__, *,
         :param pulumi.Input[str] ca_path: The path to a directory of PEM-encoded CA cert files to use to verify the Elasticsearch server's identity
         :param pulumi.Input[str] client_cert: The path to the certificate for the Elasticsearch client to present for communication
         :param pulumi.Input[str] client_key: The path to the key for the Elasticsearch client to use for communication
-        :param pulumi.Input[Mapping[str, Any]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param pulumi.Input[bool] insecure: Whether to disable certificate verification
@@ -3292,7 +3292,7 @@ def client_key(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def data(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -3301,7 +3301,7 @@ def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "data")
 
     @data.setter
-    def data(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def data(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "data", value)
 
     @property
@@ -3384,7 +3384,7 @@ def __init__(__self__, *,
                  name: pulumi.Input[str],
                  allowed_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  connection_url: Optional[pulumi.Input[str]] = None,
-                 data: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 data: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  disable_escaping: Optional[pulumi.Input[bool]] = None,
                  max_connection_lifetime: Optional[pulumi.Input[int]] = None,
                  max_idle_connections: Optional[pulumi.Input[int]] = None,
@@ -3399,7 +3399,7 @@ def __init__(__self__, *,
         :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_roles: A list of roles that are allowed to use this
                connection.
         :param pulumi.Input[str] connection_url: Connection string to use to connect to the database.
-        :param pulumi.Input[Mapping[str, Any]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param pulumi.Input[bool] disable_escaping: Disable special character escaping in username and password
@@ -3478,7 +3478,7 @@ def connection_url(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def data(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -3487,7 +3487,7 @@ def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "data")
 
     @data.setter
-    def data(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def data(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "data", value)
 
     @property
@@ -3609,7 +3609,7 @@ def __init__(__self__, *,
                  username: pulumi.Input[str],
                  allowed_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  connect_timeout: Optional[pulumi.Input[int]] = None,
-                 data: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 data: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  insecure_tls: Optional[pulumi.Input[bool]] = None,
                  pem_bundle: Optional[pulumi.Input[str]] = None,
                  pem_json: Optional[pulumi.Input[str]] = None,
@@ -3627,7 +3627,7 @@ def __init__(__self__, *,
         :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_roles: A list of roles that are allowed to use this
                connection.
         :param pulumi.Input[int] connect_timeout: The number of seconds to use as a connection timeout.
-        :param pulumi.Input[Mapping[str, Any]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param pulumi.Input[bool] insecure_tls: Whether to skip verification of the server certificate when using TLS.
@@ -3745,7 +3745,7 @@ def connect_timeout(self, value: Optional[pulumi.Input[int]]):
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def data(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -3754,7 +3754,7 @@ def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "data")
 
     @data.setter
-    def data(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def data(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "data", value)
 
     @property
@@ -3873,7 +3873,7 @@ def __init__(__self__, *,
                  name: pulumi.Input[str],
                  allowed_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  connection_url: Optional[pulumi.Input[str]] = None,
-                 data: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 data: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  max_connection_lifetime: Optional[pulumi.Input[int]] = None,
                  max_idle_connections: Optional[pulumi.Input[int]] = None,
                  max_open_connections: Optional[pulumi.Input[int]] = None,
@@ -3888,7 +3888,7 @@ def __init__(__self__, *,
         :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_roles: A list of roles that are allowed to use this
                connection.
         :param pulumi.Input[str] connection_url: Connection string to use to connect to the database.
-        :param pulumi.Input[Mapping[str, Any]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param pulumi.Input[int] max_connection_lifetime: Maximum number of seconds a connection may be reused.
@@ -3967,7 +3967,7 @@ def connection_url(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def data(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -3976,7 +3976,7 @@ def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "data")
 
     @data.setter
-    def data(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def data(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "data", value)
 
     @property
@@ -4097,7 +4097,7 @@ def __init__(__self__, *,
                  project_id: pulumi.Input[str],
                  public_key: pulumi.Input[str],
                  allowed_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 data: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 data: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  plugin_name: Optional[pulumi.Input[str]] = None,
                  root_rotation_statements: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  verify_connection: Optional[pulumi.Input[bool]] = None):
@@ -4108,7 +4108,7 @@ def __init__(__self__, *,
         :param pulumi.Input[str] public_key: The Public Programmatic API Key used to authenticate with the MongoDB Atlas API.
         :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_roles: A list of roles that are allowed to use this
                connection.
-        :param pulumi.Input[Mapping[str, Any]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param pulumi.Input[str] plugin_name: Specifies the name of the plugin to use.
@@ -4194,7 +4194,7 @@ def allowed_roles(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def data(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -4203,7 +4203,7 @@ def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "data")
 
     @data.setter
-    def data(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def data(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "data", value)
 
     @property
@@ -4251,7 +4251,7 @@ def __init__(__self__, *,
                  allowed_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  connection_url: Optional[pulumi.Input[str]] = None,
                  contained_db: Optional[pulumi.Input[bool]] = None,
-                 data: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 data: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  disable_escaping: Optional[pulumi.Input[bool]] = None,
                  max_connection_lifetime: Optional[pulumi.Input[int]] = None,
                  max_idle_connections: Optional[pulumi.Input[int]] = None,
@@ -4268,7 +4268,7 @@ def __init__(__self__, *,
                connection.
         :param pulumi.Input[str] connection_url: Connection string to use to connect to the database.
         :param pulumi.Input[bool] contained_db: Set to true when the target is a Contained Database, e.g. AzureSQL.
-        :param pulumi.Input[Mapping[str, Any]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param pulumi.Input[bool] disable_escaping: Disable special character escaping in username and password
@@ -4364,7 +4364,7 @@ def contained_db(self, value: Optional[pulumi.Input[bool]]):
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def data(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -4373,7 +4373,7 @@ def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "data")
 
     @data.setter
-    def data(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def data(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "data", value)
 
     @property
@@ -4505,7 +4505,7 @@ def __init__(__self__, *,
                  allowed_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  auth_type: Optional[pulumi.Input[str]] = None,
                  connection_url: Optional[pulumi.Input[str]] = None,
-                 data: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 data: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  max_connection_lifetime: Optional[pulumi.Input[int]] = None,
                  max_idle_connections: Optional[pulumi.Input[int]] = None,
                  max_open_connections: Optional[pulumi.Input[int]] = None,
@@ -4524,7 +4524,7 @@ def __init__(__self__, *,
                connection.
         :param pulumi.Input[str] auth_type: Specify alternative authorization type. (Only 'gcp_iam' is valid currently)
         :param pulumi.Input[str] connection_url: Connection string to use to connect to the database.
-        :param pulumi.Input[Mapping[str, Any]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param pulumi.Input[int] max_connection_lifetime: Maximum number of seconds a connection may be reused.
@@ -4626,7 +4626,7 @@ def connection_url(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def data(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -4635,7 +4635,7 @@ def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "data")
 
     @data.setter
-    def data(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def data(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "data", value)
 
     @property
@@ -4791,7 +4791,7 @@ def __init__(__self__, *,
                  allowed_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  auth_type: Optional[pulumi.Input[str]] = None,
                  connection_url: Optional[pulumi.Input[str]] = None,
-                 data: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 data: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  max_connection_lifetime: Optional[pulumi.Input[int]] = None,
                  max_idle_connections: Optional[pulumi.Input[int]] = None,
                  max_open_connections: Optional[pulumi.Input[int]] = None,
@@ -4810,7 +4810,7 @@ def __init__(__self__, *,
                connection.
         :param pulumi.Input[str] auth_type: Specify alternative authorization type. (Only 'gcp_iam' is valid currently)
         :param pulumi.Input[str] connection_url: Connection string to use to connect to the database.
-        :param pulumi.Input[Mapping[str, Any]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param pulumi.Input[int] max_connection_lifetime: Maximum number of seconds a connection may be reused.
@@ -4912,7 +4912,7 @@ def connection_url(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def data(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -4921,7 +4921,7 @@ def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "data")
 
     @data.setter
-    def data(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def data(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "data", value)
 
     @property
@@ -5077,7 +5077,7 @@ def __init__(__self__, *,
                  allowed_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  auth_type: Optional[pulumi.Input[str]] = None,
                  connection_url: Optional[pulumi.Input[str]] = None,
-                 data: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 data: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  max_connection_lifetime: Optional[pulumi.Input[int]] = None,
                  max_idle_connections: Optional[pulumi.Input[int]] = None,
                  max_open_connections: Optional[pulumi.Input[int]] = None,
@@ -5096,7 +5096,7 @@ def __init__(__self__, *,
                connection.
         :param pulumi.Input[str] auth_type: Specify alternative authorization type. (Only 'gcp_iam' is valid currently)
         :param pulumi.Input[str] connection_url: Connection string to use to connect to the database.
-        :param pulumi.Input[Mapping[str, Any]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param pulumi.Input[int] max_connection_lifetime: Maximum number of seconds a connection may be reused.
@@ -5198,7 +5198,7 @@ def connection_url(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def data(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -5207,7 +5207,7 @@ def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "data")
 
     @data.setter
-    def data(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def data(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "data", value)
 
     @property
@@ -5363,7 +5363,7 @@ def __init__(__self__, *,
                  allowed_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  auth_type: Optional[pulumi.Input[str]] = None,
                  connection_url: Optional[pulumi.Input[str]] = None,
-                 data: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 data: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  max_connection_lifetime: Optional[pulumi.Input[int]] = None,
                  max_idle_connections: Optional[pulumi.Input[int]] = None,
                  max_open_connections: Optional[pulumi.Input[int]] = None,
@@ -5382,7 +5382,7 @@ def __init__(__self__, *,
                connection.
         :param pulumi.Input[str] auth_type: Specify alternative authorization type. (Only 'gcp_iam' is valid currently)
         :param pulumi.Input[str] connection_url: Connection string to use to connect to the database.
-        :param pulumi.Input[Mapping[str, Any]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param pulumi.Input[int] max_connection_lifetime: Maximum number of seconds a connection may be reused.
@@ -5484,7 +5484,7 @@ def connection_url(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def data(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -5493,7 +5493,7 @@ def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "data")
 
     @data.setter
-    def data(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def data(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "data", value)
 
     @property
@@ -5648,7 +5648,7 @@ def __init__(__self__, *,
                  name: pulumi.Input[str],
                  allowed_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  connection_url: Optional[pulumi.Input[str]] = None,
-                 data: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 data: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  disconnect_sessions: Optional[pulumi.Input[bool]] = None,
                  max_connection_lifetime: Optional[pulumi.Input[int]] = None,
                  max_idle_connections: Optional[pulumi.Input[int]] = None,
@@ -5665,7 +5665,7 @@ def __init__(__self__, *,
         :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_roles: A list of roles that are allowed to use this
                connection.
         :param pulumi.Input[str] connection_url: Connection string to use to connect to the database.
-        :param pulumi.Input[Mapping[str, Any]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param pulumi.Input[bool] disconnect_sessions: Set to true to disconnect any open sessions prior to running the revocation statements.
@@ -5750,7 +5750,7 @@ def connection_url(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def data(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -5759,7 +5759,7 @@ def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "data")
 
     @data.setter
-    def data(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def data(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "data", value)
 
     @property
@@ -5903,7 +5903,7 @@ def __init__(__self__, *,
                  allowed_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  auth_type: Optional[pulumi.Input[str]] = None,
                  connection_url: Optional[pulumi.Input[str]] = None,
-                 data: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 data: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  disable_escaping: Optional[pulumi.Input[bool]] = None,
                  max_connection_lifetime: Optional[pulumi.Input[int]] = None,
                  max_idle_connections: Optional[pulumi.Input[int]] = None,
@@ -5921,7 +5921,7 @@ def __init__(__self__, *,
                connection.
         :param pulumi.Input[str] auth_type: Specify alternative authorization type. (Only 'gcp_iam' is valid currently)
         :param pulumi.Input[str] connection_url: Connection string to use to connect to the database.
-        :param pulumi.Input[Mapping[str, Any]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param pulumi.Input[bool] disable_escaping: Disable special character escaping in username and password
@@ -6020,7 +6020,7 @@ def connection_url(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def data(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -6029,7 +6029,7 @@ def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "data")
 
     @data.setter
-    def data(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def data(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "data", value)
 
     @property
@@ -6175,7 +6175,7 @@ def __init__(__self__, *,
                  username: pulumi.Input[str],
                  allowed_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  ca_cert: Optional[pulumi.Input[str]] = None,
-                 data: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 data: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  insecure_tls: Optional[pulumi.Input[bool]] = None,
                  plugin_name: Optional[pulumi.Input[str]] = None,
                  port: Optional[pulumi.Input[int]] = None,
@@ -6190,7 +6190,7 @@ def __init__(__self__, *,
         :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_roles: A list of roles that are allowed to use this
                connection.
         :param pulumi.Input[str] ca_cert: The contents of a PEM-encoded CA cert file to use to verify the Redis server's identity.
-        :param pulumi.Input[Mapping[str, Any]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param pulumi.Input[bool] insecure_tls: Specifies whether to skip verification of the server certificate when using TLS.
@@ -6299,7 +6299,7 @@ def ca_cert(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def data(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -6308,7 +6308,7 @@ def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "data")
 
     @data.setter
-    def data(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def data(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "data", value)
 
     @property
@@ -6391,7 +6391,7 @@ def __init__(__self__, *,
                  name: pulumi.Input[str],
                  url: pulumi.Input[str],
                  allowed_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 data: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 data: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  password: Optional[pulumi.Input[str]] = None,
                  plugin_name: Optional[pulumi.Input[str]] = None,
                  region: Optional[pulumi.Input[str]] = None,
@@ -6403,7 +6403,7 @@ def __init__(__self__, *,
         :param pulumi.Input[str] url: The configuration endpoint for the ElastiCache cluster to connect to.
         :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_roles: A list of roles that are allowed to use this
                connection.
-        :param pulumi.Input[Mapping[str, Any]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param pulumi.Input[str] password: The AWS secret key id to use to talk to ElastiCache. If omitted the credentials chain provider is used instead.
@@ -6472,7 +6472,7 @@ def allowed_roles(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def data(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -6481,7 +6481,7 @@ def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "data")
 
     @data.setter
-    def data(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def data(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "data", value)
 
     @property
@@ -6564,7 +6564,7 @@ def __init__(__self__, *,
                  name: pulumi.Input[str],
                  allowed_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  connection_url: Optional[pulumi.Input[str]] = None,
-                 data: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 data: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  disable_escaping: Optional[pulumi.Input[bool]] = None,
                  max_connection_lifetime: Optional[pulumi.Input[int]] = None,
                  max_idle_connections: Optional[pulumi.Input[int]] = None,
@@ -6580,7 +6580,7 @@ def __init__(__self__, *,
         :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_roles: A list of roles that are allowed to use this
                connection.
         :param pulumi.Input[str] connection_url: Connection string to use to connect to the database.
-        :param pulumi.Input[Mapping[str, Any]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param pulumi.Input[bool] disable_escaping: Disable special character escaping in username and password
@@ -6662,7 +6662,7 @@ def connection_url(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def data(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -6671,7 +6671,7 @@ def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "data")
 
     @data.setter
-    def data(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def data(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "data", value)
 
     @property
@@ -6802,7 +6802,7 @@ def __init__(__self__, *,
                  name: pulumi.Input[str],
                  allowed_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  connection_url: Optional[pulumi.Input[str]] = None,
-                 data: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 data: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  max_connection_lifetime: Optional[pulumi.Input[int]] = None,
                  max_idle_connections: Optional[pulumi.Input[int]] = None,
                  max_open_connections: Optional[pulumi.Input[int]] = None,
@@ -6817,7 +6817,7 @@ def __init__(__self__, *,
         :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_roles: A list of roles that are allowed to use this
                connection.
         :param pulumi.Input[str] connection_url: Connection string to use to connect to the database.
-        :param pulumi.Input[Mapping[str, Any]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param pulumi.Input[int] max_connection_lifetime: Maximum number of seconds a connection may be reused.
@@ -6896,7 +6896,7 @@ def connection_url(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def data(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -6905,7 +6905,7 @@ def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "data")
 
     @data.setter
-    def data(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def data(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "data", value)
 
     @property
diff --git a/sdk/python/pulumi_vault/database/outputs.py b/sdk/python/pulumi_vault/database/outputs.py
index 92bbe7c60..1131a8ccc 100644
--- a/sdk/python/pulumi_vault/database/outputs.py
+++ b/sdk/python/pulumi_vault/database/outputs.py
@@ -2496,7 +2496,7 @@ def __init__(__self__, *,
                  name: str,
                  allowed_roles: Optional[Sequence[str]] = None,
                  connect_timeout: Optional[int] = None,
-                 data: Optional[Mapping[str, Any]] = None,
+                 data: Optional[Mapping[str, str]] = None,
                  hosts: Optional[Sequence[str]] = None,
                  insecure_tls: Optional[bool] = None,
                  password: Optional[str] = None,
@@ -2514,7 +2514,7 @@ def __init__(__self__, *,
         :param Sequence[str] allowed_roles: A list of roles that are allowed to use this
                connection.
         :param int connect_timeout: The number of seconds to use as a connection timeout.
-        :param Mapping[str, Any] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param Mapping[str, str] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param Sequence[str] hosts: Cassandra hosts to connect to.
@@ -2590,7 +2590,7 @@ def connect_timeout(self) -> Optional[int]:
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[Mapping[str, Any]]:
+    def data(self) -> Optional[Mapping[str, str]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -2737,7 +2737,7 @@ def __init__(__self__, *,
                  allowed_roles: Optional[Sequence[str]] = None,
                  base64_pem: Optional[str] = None,
                  bucket_name: Optional[str] = None,
-                 data: Optional[Mapping[str, Any]] = None,
+                 data: Optional[Mapping[str, str]] = None,
                  insecure_tls: Optional[bool] = None,
                  plugin_name: Optional[str] = None,
                  root_rotation_statements: Optional[Sequence[str]] = None,
@@ -2753,7 +2753,7 @@ def __init__(__self__, *,
                connection.
         :param str base64_pem: Required if `tls` is `true`. Specifies the certificate authority of the Couchbase server, as a PEM certificate that has been base64 encoded.
         :param str bucket_name: Required for Couchbase versions prior to 6.5.0. This is only used to verify vault's connection to the server.
-        :param Mapping[str, Any] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param Mapping[str, str] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param bool insecure_tls: Specifies whether to skip verification of the server certificate when using TLS.
@@ -2848,7 +2848,7 @@ def bucket_name(self) -> Optional[str]:
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[Mapping[str, Any]]:
+    def data(self) -> Optional[Mapping[str, str]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -2953,7 +2953,7 @@ def __init__(__self__, *,
                  ca_path: Optional[str] = None,
                  client_cert: Optional[str] = None,
                  client_key: Optional[str] = None,
-                 data: Optional[Mapping[str, Any]] = None,
+                 data: Optional[Mapping[str, str]] = None,
                  insecure: Optional[bool] = None,
                  plugin_name: Optional[str] = None,
                  root_rotation_statements: Optional[Sequence[str]] = None,
@@ -2971,7 +2971,7 @@ def __init__(__self__, *,
         :param str ca_path: The path to a directory of PEM-encoded CA cert files to use to verify the Elasticsearch server's identity
         :param str client_cert: The path to the certificate for the Elasticsearch client to present for communication
         :param str client_key: The path to the key for the Elasticsearch client to use for communication
-        :param Mapping[str, Any] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param Mapping[str, str] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param bool insecure: Whether to disable certificate verification
@@ -3086,7 +3086,7 @@ def client_key(self) -> Optional[str]:
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[Mapping[str, Any]]:
+    def data(self) -> Optional[Mapping[str, str]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -3183,7 +3183,7 @@ def __init__(__self__, *,
                  name: str,
                  allowed_roles: Optional[Sequence[str]] = None,
                  connection_url: Optional[str] = None,
-                 data: Optional[Mapping[str, Any]] = None,
+                 data: Optional[Mapping[str, str]] = None,
                  disable_escaping: Optional[bool] = None,
                  max_connection_lifetime: Optional[int] = None,
                  max_idle_connections: Optional[int] = None,
@@ -3198,7 +3198,7 @@ def __init__(__self__, *,
         :param Sequence[str] allowed_roles: A list of roles that are allowed to use this
                connection.
         :param str connection_url: Connection string to use to connect to the database.
-        :param Mapping[str, Any] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param Mapping[str, str] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param bool disable_escaping: Disable special character escaping in username and password
@@ -3265,7 +3265,7 @@ def connection_url(self) -> Optional[str]:
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[Mapping[str, Any]]:
+    def data(self) -> Optional[Mapping[str, str]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -3389,7 +3389,7 @@ def __init__(__self__, *,
                  username: str,
                  allowed_roles: Optional[Sequence[str]] = None,
                  connect_timeout: Optional[int] = None,
-                 data: Optional[Mapping[str, Any]] = None,
+                 data: Optional[Mapping[str, str]] = None,
                  insecure_tls: Optional[bool] = None,
                  pem_bundle: Optional[str] = None,
                  pem_json: Optional[str] = None,
@@ -3407,7 +3407,7 @@ def __init__(__self__, *,
         :param Sequence[str] allowed_roles: A list of roles that are allowed to use this
                connection.
         :param int connect_timeout: The number of seconds to use as a connection timeout.
-        :param Mapping[str, Any] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param Mapping[str, str] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param bool insecure_tls: Whether to skip verification of the server certificate when using TLS.
@@ -3501,7 +3501,7 @@ def connect_timeout(self) -> Optional[int]:
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[Mapping[str, Any]]:
+    def data(self) -> Optional[Mapping[str, str]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -3622,7 +3622,7 @@ def __init__(__self__, *,
                  name: str,
                  allowed_roles: Optional[Sequence[str]] = None,
                  connection_url: Optional[str] = None,
-                 data: Optional[Mapping[str, Any]] = None,
+                 data: Optional[Mapping[str, str]] = None,
                  max_connection_lifetime: Optional[int] = None,
                  max_idle_connections: Optional[int] = None,
                  max_open_connections: Optional[int] = None,
@@ -3637,7 +3637,7 @@ def __init__(__self__, *,
         :param Sequence[str] allowed_roles: A list of roles that are allowed to use this
                connection.
         :param str connection_url: Connection string to use to connect to the database.
-        :param Mapping[str, Any] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param Mapping[str, str] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param int max_connection_lifetime: Maximum number of seconds a connection may be reused.
@@ -3704,7 +3704,7 @@ def connection_url(self) -> Optional[str]:
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[Mapping[str, Any]]:
+    def data(self) -> Optional[Mapping[str, str]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -3823,7 +3823,7 @@ def __init__(__self__, *,
                  project_id: str,
                  public_key: str,
                  allowed_roles: Optional[Sequence[str]] = None,
-                 data: Optional[Mapping[str, Any]] = None,
+                 data: Optional[Mapping[str, str]] = None,
                  plugin_name: Optional[str] = None,
                  root_rotation_statements: Optional[Sequence[str]] = None,
                  verify_connection: Optional[bool] = None):
@@ -3834,7 +3834,7 @@ def __init__(__self__, *,
         :param str public_key: The Public Programmatic API Key used to authenticate with the MongoDB Atlas API.
         :param Sequence[str] allowed_roles: A list of roles that are allowed to use this
                connection.
-        :param Mapping[str, Any] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param Mapping[str, str] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param str plugin_name: Specifies the name of the plugin to use.
@@ -3900,7 +3900,7 @@ def allowed_roles(self) -> Optional[Sequence[str]]:
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[Mapping[str, Any]]:
+    def data(self) -> Optional[Mapping[str, str]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -3978,7 +3978,7 @@ def __init__(__self__, *,
                  allowed_roles: Optional[Sequence[str]] = None,
                  connection_url: Optional[str] = None,
                  contained_db: Optional[bool] = None,
-                 data: Optional[Mapping[str, Any]] = None,
+                 data: Optional[Mapping[str, str]] = None,
                  disable_escaping: Optional[bool] = None,
                  max_connection_lifetime: Optional[int] = None,
                  max_idle_connections: Optional[int] = None,
@@ -3995,7 +3995,7 @@ def __init__(__self__, *,
                connection.
         :param str connection_url: Connection string to use to connect to the database.
         :param bool contained_db: Set to true when the target is a Contained Database, e.g. AzureSQL.
-        :param Mapping[str, Any] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param Mapping[str, str] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param bool disable_escaping: Disable special character escaping in username and password
@@ -4075,7 +4075,7 @@ def contained_db(self) -> Optional[bool]:
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[Mapping[str, Any]]:
+    def data(self) -> Optional[Mapping[str, str]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -4213,7 +4213,7 @@ def __init__(__self__, *,
                  allowed_roles: Optional[Sequence[str]] = None,
                  auth_type: Optional[str] = None,
                  connection_url: Optional[str] = None,
-                 data: Optional[Mapping[str, Any]] = None,
+                 data: Optional[Mapping[str, str]] = None,
                  max_connection_lifetime: Optional[int] = None,
                  max_idle_connections: Optional[int] = None,
                  max_open_connections: Optional[int] = None,
@@ -4232,7 +4232,7 @@ def __init__(__self__, *,
                connection.
         :param str auth_type: Specify alternative authorization type. (Only 'gcp_iam' is valid currently)
         :param str connection_url: Connection string to use to connect to the database.
-        :param Mapping[str, Any] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param Mapping[str, str] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param int max_connection_lifetime: Maximum number of seconds a connection may be reused.
@@ -4318,7 +4318,7 @@ def connection_url(self) -> Optional[str]:
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[Mapping[str, Any]]:
+    def data(self) -> Optional[Mapping[str, str]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -4472,7 +4472,7 @@ def __init__(__self__, *,
                  allowed_roles: Optional[Sequence[str]] = None,
                  auth_type: Optional[str] = None,
                  connection_url: Optional[str] = None,
-                 data: Optional[Mapping[str, Any]] = None,
+                 data: Optional[Mapping[str, str]] = None,
                  max_connection_lifetime: Optional[int] = None,
                  max_idle_connections: Optional[int] = None,
                  max_open_connections: Optional[int] = None,
@@ -4491,7 +4491,7 @@ def __init__(__self__, *,
                connection.
         :param str auth_type: Specify alternative authorization type. (Only 'gcp_iam' is valid currently)
         :param str connection_url: Connection string to use to connect to the database.
-        :param Mapping[str, Any] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param Mapping[str, str] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param int max_connection_lifetime: Maximum number of seconds a connection may be reused.
@@ -4577,7 +4577,7 @@ def connection_url(self) -> Optional[str]:
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[Mapping[str, Any]]:
+    def data(self) -> Optional[Mapping[str, str]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -4731,7 +4731,7 @@ def __init__(__self__, *,
                  allowed_roles: Optional[Sequence[str]] = None,
                  auth_type: Optional[str] = None,
                  connection_url: Optional[str] = None,
-                 data: Optional[Mapping[str, Any]] = None,
+                 data: Optional[Mapping[str, str]] = None,
                  max_connection_lifetime: Optional[int] = None,
                  max_idle_connections: Optional[int] = None,
                  max_open_connections: Optional[int] = None,
@@ -4750,7 +4750,7 @@ def __init__(__self__, *,
                connection.
         :param str auth_type: Specify alternative authorization type. (Only 'gcp_iam' is valid currently)
         :param str connection_url: Connection string to use to connect to the database.
-        :param Mapping[str, Any] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param Mapping[str, str] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param int max_connection_lifetime: Maximum number of seconds a connection may be reused.
@@ -4836,7 +4836,7 @@ def connection_url(self) -> Optional[str]:
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[Mapping[str, Any]]:
+    def data(self) -> Optional[Mapping[str, str]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -4990,7 +4990,7 @@ def __init__(__self__, *,
                  allowed_roles: Optional[Sequence[str]] = None,
                  auth_type: Optional[str] = None,
                  connection_url: Optional[str] = None,
-                 data: Optional[Mapping[str, Any]] = None,
+                 data: Optional[Mapping[str, str]] = None,
                  max_connection_lifetime: Optional[int] = None,
                  max_idle_connections: Optional[int] = None,
                  max_open_connections: Optional[int] = None,
@@ -5009,7 +5009,7 @@ def __init__(__self__, *,
                connection.
         :param str auth_type: Specify alternative authorization type. (Only 'gcp_iam' is valid currently)
         :param str connection_url: Connection string to use to connect to the database.
-        :param Mapping[str, Any] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param Mapping[str, str] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param int max_connection_lifetime: Maximum number of seconds a connection may be reused.
@@ -5095,7 +5095,7 @@ def connection_url(self) -> Optional[str]:
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[Mapping[str, Any]]:
+    def data(self) -> Optional[Mapping[str, str]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -5244,7 +5244,7 @@ def __init__(__self__, *,
                  name: str,
                  allowed_roles: Optional[Sequence[str]] = None,
                  connection_url: Optional[str] = None,
-                 data: Optional[Mapping[str, Any]] = None,
+                 data: Optional[Mapping[str, str]] = None,
                  disconnect_sessions: Optional[bool] = None,
                  max_connection_lifetime: Optional[int] = None,
                  max_idle_connections: Optional[int] = None,
@@ -5261,7 +5261,7 @@ def __init__(__self__, *,
         :param Sequence[str] allowed_roles: A list of roles that are allowed to use this
                connection.
         :param str connection_url: Connection string to use to connect to the database.
-        :param Mapping[str, Any] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param Mapping[str, str] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param bool disconnect_sessions: Set to true to disconnect any open sessions prior to running the revocation statements.
@@ -5334,7 +5334,7 @@ def connection_url(self) -> Optional[str]:
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[Mapping[str, Any]]:
+    def data(self) -> Optional[Mapping[str, str]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -5478,7 +5478,7 @@ def __init__(__self__, *,
                  allowed_roles: Optional[Sequence[str]] = None,
                  auth_type: Optional[str] = None,
                  connection_url: Optional[str] = None,
-                 data: Optional[Mapping[str, Any]] = None,
+                 data: Optional[Mapping[str, str]] = None,
                  disable_escaping: Optional[bool] = None,
                  max_connection_lifetime: Optional[int] = None,
                  max_idle_connections: Optional[int] = None,
@@ -5496,7 +5496,7 @@ def __init__(__self__, *,
                connection.
         :param str auth_type: Specify alternative authorization type. (Only 'gcp_iam' is valid currently)
         :param str connection_url: Connection string to use to connect to the database.
-        :param Mapping[str, Any] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param Mapping[str, str] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param bool disable_escaping: Disable special character escaping in username and password
@@ -5579,7 +5579,7 @@ def connection_url(self) -> Optional[str]:
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[Mapping[str, Any]]:
+    def data(self) -> Optional[Mapping[str, str]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -5713,7 +5713,7 @@ def __init__(__self__, *,
                  username: str,
                  allowed_roles: Optional[Sequence[str]] = None,
                  ca_cert: Optional[str] = None,
-                 data: Optional[Mapping[str, Any]] = None,
+                 data: Optional[Mapping[str, str]] = None,
                  insecure_tls: Optional[bool] = None,
                  plugin_name: Optional[str] = None,
                  port: Optional[int] = None,
@@ -5728,7 +5728,7 @@ def __init__(__self__, *,
         :param Sequence[str] allowed_roles: A list of roles that are allowed to use this
                connection.
         :param str ca_cert: The contents of a PEM-encoded CA cert file to use to verify the Redis server's identity.
-        :param Mapping[str, Any] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param Mapping[str, str] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param bool insecure_tls: Specifies whether to skip verification of the server certificate when using TLS.
@@ -5813,7 +5813,7 @@ def ca_cert(self) -> Optional[str]:
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[Mapping[str, Any]]:
+    def data(self) -> Optional[Mapping[str, str]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -5900,7 +5900,7 @@ def __init__(__self__, *,
                  name: str,
                  url: str,
                  allowed_roles: Optional[Sequence[str]] = None,
-                 data: Optional[Mapping[str, Any]] = None,
+                 data: Optional[Mapping[str, str]] = None,
                  password: Optional[str] = None,
                  plugin_name: Optional[str] = None,
                  region: Optional[str] = None,
@@ -5912,7 +5912,7 @@ def __init__(__self__, *,
         :param str url: The configuration endpoint for the ElastiCache cluster to connect to.
         :param Sequence[str] allowed_roles: A list of roles that are allowed to use this
                connection.
-        :param Mapping[str, Any] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param Mapping[str, str] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param str password: The AWS secret key id to use to talk to ElastiCache. If omitted the credentials chain provider is used instead.
@@ -5969,7 +5969,7 @@ def allowed_roles(self) -> Optional[Sequence[str]]:
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[Mapping[str, Any]]:
+    def data(self) -> Optional[Mapping[str, str]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -6068,7 +6068,7 @@ def __init__(__self__, *,
                  name: str,
                  allowed_roles: Optional[Sequence[str]] = None,
                  connection_url: Optional[str] = None,
-                 data: Optional[Mapping[str, Any]] = None,
+                 data: Optional[Mapping[str, str]] = None,
                  disable_escaping: Optional[bool] = None,
                  max_connection_lifetime: Optional[int] = None,
                  max_idle_connections: Optional[int] = None,
@@ -6084,7 +6084,7 @@ def __init__(__self__, *,
         :param Sequence[str] allowed_roles: A list of roles that are allowed to use this
                connection.
         :param str connection_url: Connection string to use to connect to the database.
-        :param Mapping[str, Any] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param Mapping[str, str] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param bool disable_escaping: Disable special character escaping in username and password
@@ -6154,7 +6154,7 @@ def connection_url(self) -> Optional[str]:
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[Mapping[str, Any]]:
+    def data(self) -> Optional[Mapping[str, str]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
@@ -6283,7 +6283,7 @@ def __init__(__self__, *,
                  name: str,
                  allowed_roles: Optional[Sequence[str]] = None,
                  connection_url: Optional[str] = None,
-                 data: Optional[Mapping[str, Any]] = None,
+                 data: Optional[Mapping[str, str]] = None,
                  max_connection_lifetime: Optional[int] = None,
                  max_idle_connections: Optional[int] = None,
                  max_open_connections: Optional[int] = None,
@@ -6298,7 +6298,7 @@ def __init__(__self__, *,
         :param Sequence[str] allowed_roles: A list of roles that are allowed to use this
                connection.
         :param str connection_url: Connection string to use to connect to the database.
-        :param Mapping[str, Any] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param Mapping[str, str] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
                
                Supported list of database secrets engines that can be configured:
         :param int max_connection_lifetime: Maximum number of seconds a connection may be reused.
@@ -6365,7 +6365,7 @@ def connection_url(self) -> Optional[str]:
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[Mapping[str, Any]]:
+    def data(self) -> Optional[Mapping[str, str]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
 
diff --git a/sdk/python/pulumi_vault/database/secret_backend_connection.py b/sdk/python/pulumi_vault/database/secret_backend_connection.py
index e0d30a134..972e7eedf 100644
--- a/sdk/python/pulumi_vault/database/secret_backend_connection.py
+++ b/sdk/python/pulumi_vault/database/secret_backend_connection.py
@@ -20,7 +20,7 @@ def __init__(__self__, *,
                  allowed_roles: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  cassandra: Optional[pulumi.Input['SecretBackendConnectionCassandraArgs']] = None,
                  couchbase: Optional[pulumi.Input['SecretBackendConnectionCouchbaseArgs']] = None,
-                 data: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 data: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  elasticsearch: Optional[pulumi.Input['SecretBackendConnectionElasticsearchArgs']] = None,
                  hana: Optional[pulumi.Input['SecretBackendConnectionHanaArgs']] = None,
                  influxdb: Optional[pulumi.Input['SecretBackendConnectionInfluxdbArgs']] = None,
@@ -49,7 +49,7 @@ def __init__(__self__, *,
                connection.
         :param pulumi.Input['SecretBackendConnectionCassandraArgs'] cassandra: A nested block containing configuration options for Cassandra connections.
         :param pulumi.Input['SecretBackendConnectionCouchbaseArgs'] couchbase: A nested block containing configuration options for Couchbase connections.
-        :param pulumi.Input[Mapping[str, Any]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         :param pulumi.Input['SecretBackendConnectionElasticsearchArgs'] elasticsearch: A nested block containing configuration options for Elasticsearch connections.
         :param pulumi.Input['SecretBackendConnectionHanaArgs'] hana: A nested block containing configuration options for SAP HanaDB connections.
         :param pulumi.Input['SecretBackendConnectionInfluxdbArgs'] influxdb: A nested block containing configuration options for InfluxDB connections.
@@ -181,14 +181,14 @@ def couchbase(self, value: Optional[pulumi.Input['SecretBackendConnectionCouchba
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def data(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         """
         return pulumi.get(self, "data")
 
     @data.setter
-    def data(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def data(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "data", value)
 
     @property
@@ -457,7 +457,7 @@ def __init__(__self__, *,
                  backend: Optional[pulumi.Input[str]] = None,
                  cassandra: Optional[pulumi.Input['SecretBackendConnectionCassandraArgs']] = None,
                  couchbase: Optional[pulumi.Input['SecretBackendConnectionCouchbaseArgs']] = None,
-                 data: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 data: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  elasticsearch: Optional[pulumi.Input['SecretBackendConnectionElasticsearchArgs']] = None,
                  hana: Optional[pulumi.Input['SecretBackendConnectionHanaArgs']] = None,
                  influxdb: Optional[pulumi.Input['SecretBackendConnectionInfluxdbArgs']] = None,
@@ -486,7 +486,7 @@ def __init__(__self__, *,
         :param pulumi.Input[str] backend: The unique name of the Vault mount to configure.
         :param pulumi.Input['SecretBackendConnectionCassandraArgs'] cassandra: A nested block containing configuration options for Cassandra connections.
         :param pulumi.Input['SecretBackendConnectionCouchbaseArgs'] couchbase: A nested block containing configuration options for Couchbase connections.
-        :param pulumi.Input[Mapping[str, Any]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         :param pulumi.Input['SecretBackendConnectionElasticsearchArgs'] elasticsearch: A nested block containing configuration options for Elasticsearch connections.
         :param pulumi.Input['SecretBackendConnectionHanaArgs'] hana: A nested block containing configuration options for SAP HanaDB connections.
         :param pulumi.Input['SecretBackendConnectionInfluxdbArgs'] influxdb: A nested block containing configuration options for InfluxDB connections.
@@ -619,14 +619,14 @@ def couchbase(self, value: Optional[pulumi.Input['SecretBackendConnectionCouchba
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def data(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         """
         return pulumi.get(self, "data")
 
     @data.setter
-    def data(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def data(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "data", value)
 
     @property
@@ -897,7 +897,7 @@ def __init__(__self__,
                  backend: Optional[pulumi.Input[str]] = None,
                  cassandra: Optional[pulumi.Input[Union['SecretBackendConnectionCassandraArgs', 'SecretBackendConnectionCassandraArgsDict']]] = None,
                  couchbase: Optional[pulumi.Input[Union['SecretBackendConnectionCouchbaseArgs', 'SecretBackendConnectionCouchbaseArgsDict']]] = None,
-                 data: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 data: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  elasticsearch: Optional[pulumi.Input[Union['SecretBackendConnectionElasticsearchArgs', 'SecretBackendConnectionElasticsearchArgsDict']]] = None,
                  hana: Optional[pulumi.Input[Union['SecretBackendConnectionHanaArgs', 'SecretBackendConnectionHanaArgsDict']]] = None,
                  influxdb: Optional[pulumi.Input[Union['SecretBackendConnectionInfluxdbArgs', 'SecretBackendConnectionInfluxdbArgsDict']]] = None,
@@ -957,7 +957,7 @@ def __init__(__self__,
         :param pulumi.Input[str] backend: The unique name of the Vault mount to configure.
         :param pulumi.Input[Union['SecretBackendConnectionCassandraArgs', 'SecretBackendConnectionCassandraArgsDict']] cassandra: A nested block containing configuration options for Cassandra connections.
         :param pulumi.Input[Union['SecretBackendConnectionCouchbaseArgs', 'SecretBackendConnectionCouchbaseArgsDict']] couchbase: A nested block containing configuration options for Couchbase connections.
-        :param pulumi.Input[Mapping[str, Any]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         :param pulumi.Input[Union['SecretBackendConnectionElasticsearchArgs', 'SecretBackendConnectionElasticsearchArgsDict']] elasticsearch: A nested block containing configuration options for Elasticsearch connections.
         :param pulumi.Input[Union['SecretBackendConnectionHanaArgs', 'SecretBackendConnectionHanaArgsDict']] hana: A nested block containing configuration options for SAP HanaDB connections.
         :param pulumi.Input[Union['SecretBackendConnectionInfluxdbArgs', 'SecretBackendConnectionInfluxdbArgsDict']] influxdb: A nested block containing configuration options for InfluxDB connections.
@@ -1041,7 +1041,7 @@ def _internal_init(__self__,
                  backend: Optional[pulumi.Input[str]] = None,
                  cassandra: Optional[pulumi.Input[Union['SecretBackendConnectionCassandraArgs', 'SecretBackendConnectionCassandraArgsDict']]] = None,
                  couchbase: Optional[pulumi.Input[Union['SecretBackendConnectionCouchbaseArgs', 'SecretBackendConnectionCouchbaseArgsDict']]] = None,
-                 data: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 data: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  elasticsearch: Optional[pulumi.Input[Union['SecretBackendConnectionElasticsearchArgs', 'SecretBackendConnectionElasticsearchArgsDict']]] = None,
                  hana: Optional[pulumi.Input[Union['SecretBackendConnectionHanaArgs', 'SecretBackendConnectionHanaArgsDict']]] = None,
                  influxdb: Optional[pulumi.Input[Union['SecretBackendConnectionInfluxdbArgs', 'SecretBackendConnectionInfluxdbArgsDict']]] = None,
@@ -1114,7 +1114,7 @@ def get(resource_name: str,
             backend: Optional[pulumi.Input[str]] = None,
             cassandra: Optional[pulumi.Input[Union['SecretBackendConnectionCassandraArgs', 'SecretBackendConnectionCassandraArgsDict']]] = None,
             couchbase: Optional[pulumi.Input[Union['SecretBackendConnectionCouchbaseArgs', 'SecretBackendConnectionCouchbaseArgsDict']]] = None,
-            data: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+            data: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
             elasticsearch: Optional[pulumi.Input[Union['SecretBackendConnectionElasticsearchArgs', 'SecretBackendConnectionElasticsearchArgsDict']]] = None,
             hana: Optional[pulumi.Input[Union['SecretBackendConnectionHanaArgs', 'SecretBackendConnectionHanaArgsDict']]] = None,
             influxdb: Optional[pulumi.Input[Union['SecretBackendConnectionInfluxdbArgs', 'SecretBackendConnectionInfluxdbArgsDict']]] = None,
@@ -1148,7 +1148,7 @@ def get(resource_name: str,
         :param pulumi.Input[str] backend: The unique name of the Vault mount to configure.
         :param pulumi.Input[Union['SecretBackendConnectionCassandraArgs', 'SecretBackendConnectionCassandraArgsDict']] cassandra: A nested block containing configuration options for Cassandra connections.
         :param pulumi.Input[Union['SecretBackendConnectionCouchbaseArgs', 'SecretBackendConnectionCouchbaseArgsDict']] couchbase: A nested block containing configuration options for Couchbase connections.
-        :param pulumi.Input[Mapping[str, Any]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] data: A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         :param pulumi.Input[Union['SecretBackendConnectionElasticsearchArgs', 'SecretBackendConnectionElasticsearchArgsDict']] elasticsearch: A nested block containing configuration options for Elasticsearch connections.
         :param pulumi.Input[Union['SecretBackendConnectionHanaArgs', 'SecretBackendConnectionHanaArgsDict']] hana: A nested block containing configuration options for SAP HanaDB connections.
         :param pulumi.Input[Union['SecretBackendConnectionInfluxdbArgs', 'SecretBackendConnectionInfluxdbArgsDict']] influxdb: A nested block containing configuration options for InfluxDB connections.
@@ -1244,7 +1244,7 @@ def couchbase(self) -> pulumi.Output[Optional['outputs.SecretBackendConnectionCo
 
     @property
     @pulumi.getter
-    def data(self) -> pulumi.Output[Optional[Mapping[str, Any]]]:
+    def data(self) -> pulumi.Output[Optional[Mapping[str, str]]]:
         """
         A map of sensitive data to pass to the endpoint. Useful for templated connection strings.
         """
diff --git a/sdk/python/pulumi_vault/database/secret_backend_role.py b/sdk/python/pulumi_vault/database/secret_backend_role.py
index d1c53f945..0c1da6046 100644
--- a/sdk/python/pulumi_vault/database/secret_backend_role.py
+++ b/sdk/python/pulumi_vault/database/secret_backend_role.py
@@ -17,7 +17,7 @@ def __init__(__self__, *,
                  backend: pulumi.Input[str],
                  creation_statements: pulumi.Input[Sequence[pulumi.Input[str]]],
                  db_name: pulumi.Input[str],
-                 credential_config: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 credential_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  credential_type: Optional[pulumi.Input[str]] = None,
                  default_ttl: Optional[pulumi.Input[int]] = None,
                  max_ttl: Optional[pulumi.Input[int]] = None,
@@ -33,7 +33,7 @@ def __init__(__self__, *,
                creating a user.
         :param pulumi.Input[str] db_name: The unique name of the database connection to use for
                the role.
-        :param pulumi.Input[Mapping[str, Any]] credential_config: Specifies the configuration
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] credential_config: Specifies the configuration
                for the given `credential_type`.
                
                The following options are available for each `credential_type` value:
@@ -118,7 +118,7 @@ def db_name(self, value: pulumi.Input[str]):
 
     @property
     @pulumi.getter(name="credentialConfig")
-    def credential_config(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def credential_config(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         Specifies the configuration
         for the given `credential_type`.
@@ -128,7 +128,7 @@ def credential_config(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "credential_config")
 
     @credential_config.setter
-    def credential_config(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def credential_config(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "credential_config", value)
 
     @property
@@ -243,7 +243,7 @@ class _SecretBackendRoleState:
     def __init__(__self__, *,
                  backend: Optional[pulumi.Input[str]] = None,
                  creation_statements: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 credential_config: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 credential_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  credential_type: Optional[pulumi.Input[str]] = None,
                  db_name: Optional[pulumi.Input[str]] = None,
                  default_ttl: Optional[pulumi.Input[int]] = None,
@@ -258,7 +258,7 @@ def __init__(__self__, *,
         :param pulumi.Input[str] backend: The unique name of the Vault mount to configure.
         :param pulumi.Input[Sequence[pulumi.Input[str]]] creation_statements: The database statements to execute when
                creating a user.
-        :param pulumi.Input[Mapping[str, Any]] credential_config: Specifies the configuration
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] credential_config: Specifies the configuration
                for the given `credential_type`.
                
                The following options are available for each `credential_type` value:
@@ -335,7 +335,7 @@ def creation_statements(self, value: Optional[pulumi.Input[Sequence[pulumi.Input
 
     @property
     @pulumi.getter(name="credentialConfig")
-    def credential_config(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def credential_config(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         Specifies the configuration
         for the given `credential_type`.
@@ -345,7 +345,7 @@ def credential_config(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "credential_config")
 
     @credential_config.setter
-    def credential_config(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def credential_config(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "credential_config", value)
 
     @property
@@ -475,7 +475,7 @@ def __init__(__self__,
                  opts: Optional[pulumi.ResourceOptions] = None,
                  backend: Optional[pulumi.Input[str]] = None,
                  creation_statements: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 credential_config: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 credential_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  credential_type: Optional[pulumi.Input[str]] = None,
                  db_name: Optional[pulumi.Input[str]] = None,
                  default_ttl: Optional[pulumi.Input[int]] = None,
@@ -526,7 +526,7 @@ def __init__(__self__,
         :param pulumi.Input[str] backend: The unique name of the Vault mount to configure.
         :param pulumi.Input[Sequence[pulumi.Input[str]]] creation_statements: The database statements to execute when
                creating a user.
-        :param pulumi.Input[Mapping[str, Any]] credential_config: Specifies the configuration
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] credential_config: Specifies the configuration
                for the given `credential_type`.
                
                The following options are available for each `credential_type` value:
@@ -609,7 +609,7 @@ def _internal_init(__self__,
                  opts: Optional[pulumi.ResourceOptions] = None,
                  backend: Optional[pulumi.Input[str]] = None,
                  creation_statements: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 credential_config: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 credential_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  credential_type: Optional[pulumi.Input[str]] = None,
                  db_name: Optional[pulumi.Input[str]] = None,
                  default_ttl: Optional[pulumi.Input[int]] = None,
@@ -658,7 +658,7 @@ def get(resource_name: str,
             opts: Optional[pulumi.ResourceOptions] = None,
             backend: Optional[pulumi.Input[str]] = None,
             creation_statements: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-            credential_config: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+            credential_config: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
             credential_type: Optional[pulumi.Input[str]] = None,
             db_name: Optional[pulumi.Input[str]] = None,
             default_ttl: Optional[pulumi.Input[int]] = None,
@@ -678,7 +678,7 @@ def get(resource_name: str,
         :param pulumi.Input[str] backend: The unique name of the Vault mount to configure.
         :param pulumi.Input[Sequence[pulumi.Input[str]]] creation_statements: The database statements to execute when
                creating a user.
-        :param pulumi.Input[Mapping[str, Any]] credential_config: Specifies the configuration
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] credential_config: Specifies the configuration
                for the given `credential_type`.
                
                The following options are available for each `credential_type` value:
@@ -740,7 +740,7 @@ def creation_statements(self) -> pulumi.Output[Sequence[str]]:
 
     @property
     @pulumi.getter(name="credentialConfig")
-    def credential_config(self) -> pulumi.Output[Optional[Mapping[str, Any]]]:
+    def credential_config(self) -> pulumi.Output[Optional[Mapping[str, str]]]:
         """
         Specifies the configuration
         for the given `credential_type`.
diff --git a/sdk/python/pulumi_vault/database/secrets_mount.py b/sdk/python/pulumi_vault/database/secrets_mount.py
index 4f7917645..fea240e31 100644
--- a/sdk/python/pulumi_vault/database/secrets_mount.py
+++ b/sdk/python/pulumi_vault/database/secrets_mount.py
@@ -42,7 +42,7 @@ def __init__(__self__, *,
                  mysql_rds: Optional[pulumi.Input[Sequence[pulumi.Input['SecretsMountMysqlRdArgs']]]] = None,
                  mysqls: Optional[pulumi.Input[Sequence[pulumi.Input['SecretsMountMysqlArgs']]]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
-                 options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  oracles: Optional[pulumi.Input[Sequence[pulumi.Input['SecretsMountOracleArgs']]]] = None,
                  passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  plugin_version: Optional[pulumi.Input[str]] = None,
@@ -94,7 +94,7 @@ def __init__(__self__, *,
         :param pulumi.Input[Sequence[pulumi.Input['SecretsMountMysqlArgs']]] mysqls: A nested block containing configuration options for MySQL connections.  
                *See Configuration Options for more info*
         :param pulumi.Input[str] namespace: Target namespace. (requires Enterprise)
-        :param pulumi.Input[Mapping[str, Any]] options: Specifies mount type specific options that are passed to the backend
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] options: Specifies mount type specific options that are passed to the backend
         :param pulumi.Input[Sequence[pulumi.Input['SecretsMountOracleArgs']]] oracles: A nested block containing configuration options for Oracle connections.  
                *See Configuration Options for more info*
         :param pulumi.Input[Sequence[pulumi.Input[str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
@@ -511,14 +511,14 @@ def namespace(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter
-    def options(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def options(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         Specifies mount type specific options that are passed to the backend
         """
         return pulumi.get(self, "options")
 
     @options.setter
-    def options(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def options(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "options", value)
 
     @property
@@ -666,7 +666,7 @@ def __init__(__self__, *,
                  mysql_rds: Optional[pulumi.Input[Sequence[pulumi.Input['SecretsMountMysqlRdArgs']]]] = None,
                  mysqls: Optional[pulumi.Input[Sequence[pulumi.Input['SecretsMountMysqlArgs']]]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
-                 options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  oracles: Optional[pulumi.Input[Sequence[pulumi.Input['SecretsMountOracleArgs']]]] = None,
                  passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  path: Optional[pulumi.Input[str]] = None,
@@ -720,7 +720,7 @@ def __init__(__self__, *,
         :param pulumi.Input[Sequence[pulumi.Input['SecretsMountMysqlArgs']]] mysqls: A nested block containing configuration options for MySQL connections.  
                *See Configuration Options for more info*
         :param pulumi.Input[str] namespace: Target namespace. (requires Enterprise)
-        :param pulumi.Input[Mapping[str, Any]] options: Specifies mount type specific options that are passed to the backend
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] options: Specifies mount type specific options that are passed to the backend
         :param pulumi.Input[Sequence[pulumi.Input['SecretsMountOracleArgs']]] oracles: A nested block containing configuration options for Oracle connections.  
                *See Configuration Options for more info*
         :param pulumi.Input[Sequence[pulumi.Input[str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
@@ -1155,14 +1155,14 @@ def namespace(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter
-    def options(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def options(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         Specifies mount type specific options that are passed to the backend
         """
         return pulumi.get(self, "options")
 
     @options.setter
-    def options(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def options(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "options", value)
 
     @property
@@ -1322,7 +1322,7 @@ def __init__(__self__,
                  mysql_rds: Optional[pulumi.Input[Sequence[pulumi.Input[Union['SecretsMountMysqlRdArgs', 'SecretsMountMysqlRdArgsDict']]]]] = None,
                  mysqls: Optional[pulumi.Input[Sequence[pulumi.Input[Union['SecretsMountMysqlArgs', 'SecretsMountMysqlArgsDict']]]]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
-                 options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  oracles: Optional[pulumi.Input[Sequence[pulumi.Input[Union['SecretsMountOracleArgs', 'SecretsMountOracleArgsDict']]]]] = None,
                  passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  path: Optional[pulumi.Input[str]] = None,
@@ -1426,7 +1426,7 @@ def __init__(__self__,
         :param pulumi.Input[Sequence[pulumi.Input[Union['SecretsMountMysqlArgs', 'SecretsMountMysqlArgsDict']]]] mysqls: A nested block containing configuration options for MySQL connections.  
                *See Configuration Options for more info*
         :param pulumi.Input[str] namespace: Target namespace. (requires Enterprise)
-        :param pulumi.Input[Mapping[str, Any]] options: Specifies mount type specific options that are passed to the backend
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] options: Specifies mount type specific options that are passed to the backend
         :param pulumi.Input[Sequence[pulumi.Input[Union['SecretsMountOracleArgs', 'SecretsMountOracleArgsDict']]]] oracles: A nested block containing configuration options for Oracle connections.  
                *See Configuration Options for more info*
         :param pulumi.Input[Sequence[pulumi.Input[str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
@@ -1541,7 +1541,7 @@ def _internal_init(__self__,
                  mysql_rds: Optional[pulumi.Input[Sequence[pulumi.Input[Union['SecretsMountMysqlRdArgs', 'SecretsMountMysqlRdArgsDict']]]]] = None,
                  mysqls: Optional[pulumi.Input[Sequence[pulumi.Input[Union['SecretsMountMysqlArgs', 'SecretsMountMysqlArgsDict']]]]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
-                 options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  oracles: Optional[pulumi.Input[Sequence[pulumi.Input[Union['SecretsMountOracleArgs', 'SecretsMountOracleArgsDict']]]]] = None,
                  passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  path: Optional[pulumi.Input[str]] = None,
@@ -1638,7 +1638,7 @@ def get(resource_name: str,
             mysql_rds: Optional[pulumi.Input[Sequence[pulumi.Input[Union['SecretsMountMysqlRdArgs', 'SecretsMountMysqlRdArgsDict']]]]] = None,
             mysqls: Optional[pulumi.Input[Sequence[pulumi.Input[Union['SecretsMountMysqlArgs', 'SecretsMountMysqlArgsDict']]]]] = None,
             namespace: Optional[pulumi.Input[str]] = None,
-            options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+            options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
             oracles: Optional[pulumi.Input[Sequence[pulumi.Input[Union['SecretsMountOracleArgs', 'SecretsMountOracleArgsDict']]]]] = None,
             passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
             path: Optional[pulumi.Input[str]] = None,
@@ -1697,7 +1697,7 @@ def get(resource_name: str,
         :param pulumi.Input[Sequence[pulumi.Input[Union['SecretsMountMysqlArgs', 'SecretsMountMysqlArgsDict']]]] mysqls: A nested block containing configuration options for MySQL connections.  
                *See Configuration Options for more info*
         :param pulumi.Input[str] namespace: Target namespace. (requires Enterprise)
-        :param pulumi.Input[Mapping[str, Any]] options: Specifies mount type specific options that are passed to the backend
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] options: Specifies mount type specific options that are passed to the backend
         :param pulumi.Input[Sequence[pulumi.Input[Union['SecretsMountOracleArgs', 'SecretsMountOracleArgsDict']]]] oracles: A nested block containing configuration options for Oracle connections.  
                *See Configuration Options for more info*
         :param pulumi.Input[Sequence[pulumi.Input[str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
@@ -1991,7 +1991,7 @@ def namespace(self) -> pulumi.Output[Optional[str]]:
 
     @property
     @pulumi.getter
-    def options(self) -> pulumi.Output[Optional[Mapping[str, Any]]]:
+    def options(self) -> pulumi.Output[Optional[Mapping[str, str]]]:
         """
         Specifies mount type specific options that are passed to the backend
         """
diff --git a/sdk/python/pulumi_vault/generic/get_secret.py b/sdk/python/pulumi_vault/generic/get_secret.py
index 314623d83..c3d1fee4f 100644
--- a/sdk/python/pulumi_vault/generic/get_secret.py
+++ b/sdk/python/pulumi_vault/generic/get_secret.py
@@ -58,7 +58,7 @@ def __init__(__self__, data=None, data_json=None, id=None, lease_duration=None,
 
     @property
     @pulumi.getter
-    def data(self) -> Mapping[str, Any]:
+    def data(self) -> Mapping[str, str]:
         """
         A mapping whose keys are the top-level data keys returned from
         Vault and whose values are the corresponding values. This map can only
diff --git a/sdk/python/pulumi_vault/generic/secret.py b/sdk/python/pulumi_vault/generic/secret.py
index 3671cad0a..f486d564b 100644
--- a/sdk/python/pulumi_vault/generic/secret.py
+++ b/sdk/python/pulumi_vault/generic/secret.py
@@ -126,7 +126,7 @@ def namespace(self, value: Optional[pulumi.Input[str]]):
 @pulumi.input_type
 class _SecretState:
     def __init__(__self__, *,
-                 data: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 data: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  data_json: Optional[pulumi.Input[str]] = None,
                  delete_all_versions: Optional[pulumi.Input[bool]] = None,
                  disable_read: Optional[pulumi.Input[bool]] = None,
@@ -134,7 +134,7 @@ def __init__(__self__, *,
                  path: Optional[pulumi.Input[str]] = None):
         """
         Input properties used for looking up and filtering Secret resources.
-        :param pulumi.Input[Mapping[str, Any]] data: A mapping whose keys are the top-level data keys returned from
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] data: A mapping whose keys are the top-level data keys returned from
                Vault and whose values are the corresponding values. This map can only
                represent string data, so any non-string values returned from Vault are
                serialized as JSON.
@@ -172,7 +172,7 @@ def __init__(__self__, *,
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def data(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         A mapping whose keys are the top-level data keys returned from
         Vault and whose values are the corresponding values. This map can only
@@ -182,7 +182,7 @@ def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "data")
 
     @data.setter
-    def data(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def data(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "data", value)
 
     @property
@@ -366,7 +366,7 @@ def _internal_init(__self__,
     def get(resource_name: str,
             id: pulumi.Input[str],
             opts: Optional[pulumi.ResourceOptions] = None,
-            data: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+            data: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
             data_json: Optional[pulumi.Input[str]] = None,
             delete_all_versions: Optional[pulumi.Input[bool]] = None,
             disable_read: Optional[pulumi.Input[bool]] = None,
@@ -379,7 +379,7 @@ def get(resource_name: str,
         :param str resource_name: The unique name of the resulting resource.
         :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
         :param pulumi.ResourceOptions opts: Options for the resource.
-        :param pulumi.Input[Mapping[str, Any]] data: A mapping whose keys are the top-level data keys returned from
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] data: A mapping whose keys are the top-level data keys returned from
                Vault and whose values are the corresponding values. This map can only
                represent string data, so any non-string values returned from Vault are
                serialized as JSON.
@@ -416,7 +416,7 @@ def get(resource_name: str,
 
     @property
     @pulumi.getter
-    def data(self) -> pulumi.Output[Mapping[str, Any]]:
+    def data(self) -> pulumi.Output[Mapping[str, str]]:
         """
         A mapping whose keys are the top-level data keys returned from
         Vault and whose values are the corresponding values. This map can only
diff --git a/sdk/python/pulumi_vault/get_namespace.py b/sdk/python/pulumi_vault/get_namespace.py
index 1ad4cbf2d..e63d2e825 100644
--- a/sdk/python/pulumi_vault/get_namespace.py
+++ b/sdk/python/pulumi_vault/get_namespace.py
@@ -43,7 +43,7 @@ def __init__(__self__, custom_metadata=None, id=None, namespace=None, namespace_
 
     @property
     @pulumi.getter(name="customMetadata")
-    def custom_metadata(self) -> Mapping[str, Any]:
+    def custom_metadata(self) -> Mapping[str, str]:
         """
         (Optional) A map of strings containing arbitrary metadata for the namespace.
         Only fetched if `path` is specified.
diff --git a/sdk/python/pulumi_vault/get_nomad_access_token.py b/sdk/python/pulumi_vault/get_nomad_access_token.py
index f7810ad4a..430677027 100644
--- a/sdk/python/pulumi_vault/get_nomad_access_token.py
+++ b/sdk/python/pulumi_vault/get_nomad_access_token.py
@@ -119,8 +119,11 @@ def get_nomad_access_token(backend: Optional[str] = None,
         role="test",
         type="client",
         policies=["readonly"])
-    token = pulumi.Output.all(config.backend, test.role).apply(lambda backend, role: vault.get_nomad_access_token_output(backend=backend,
-        role=role))
+    token = pulumi.Output.all(
+        backend=config.backend,
+        role=test.role
+    ).apply(lambda resolved_outputs: vault.get_nomad_access_token_output(backend=resolved_outputs['backend'],
+        role=resolved_outputs['role']))
     ```
 
 
@@ -173,8 +176,11 @@ def get_nomad_access_token_output(backend: Optional[pulumi.Input[str]] = None,
         role="test",
         type="client",
         policies=["readonly"])
-    token = pulumi.Output.all(config.backend, test.role).apply(lambda backend, role: vault.get_nomad_access_token_output(backend=backend,
-        role=role))
+    token = pulumi.Output.all(
+        backend=config.backend,
+        role=test.role
+    ).apply(lambda resolved_outputs: vault.get_nomad_access_token_output(backend=resolved_outputs['backend'],
+        role=resolved_outputs['role']))
     ```
 
 
diff --git a/sdk/python/pulumi_vault/get_raft_autopilot_state.py b/sdk/python/pulumi_vault/get_raft_autopilot_state.py
index 70152c4ba..adc8a0734 100644
--- a/sdk/python/pulumi_vault/get_raft_autopilot_state.py
+++ b/sdk/python/pulumi_vault/get_raft_autopilot_state.py
@@ -109,7 +109,7 @@ def optimistic_failure_tolerance(self) -> int:
 
     @property
     @pulumi.getter(name="redundancyZones")
-    def redundancy_zones(self) -> Mapping[str, Any]:
+    def redundancy_zones(self) -> Mapping[str, str]:
         """
         Additional output related to redundancy zones stored as a serialized map of strings.
         """
@@ -125,7 +125,7 @@ def redundancy_zones_json(self) -> str:
 
     @property
     @pulumi.getter
-    def servers(self) -> Mapping[str, Any]:
+    def servers(self) -> Mapping[str, str]:
         """
         Additionaly output related to servers in the cluster stored as a serialized map of strings.
         """
@@ -141,7 +141,7 @@ def servers_json(self) -> str:
 
     @property
     @pulumi.getter(name="upgradeInfo")
-    def upgrade_info(self) -> Mapping[str, Any]:
+    def upgrade_info(self) -> Mapping[str, str]:
         """
         Additional output related to upgrade information stored as a serialized map of strings.
         """
diff --git a/sdk/python/pulumi_vault/identity/get_entity.py b/sdk/python/pulumi_vault/identity/get_entity.py
index a9123df95..9d4e7f0d3 100644
--- a/sdk/python/pulumi_vault/identity/get_entity.py
+++ b/sdk/python/pulumi_vault/identity/get_entity.py
@@ -189,7 +189,7 @@ def merged_entity_ids(self) -> Sequence[str]:
 
     @property
     @pulumi.getter
-    def metadata(self) -> Mapping[str, Any]:
+    def metadata(self) -> Mapping[str, str]:
         """
         Arbitrary metadata
         """
diff --git a/sdk/python/pulumi_vault/identity/get_group.py b/sdk/python/pulumi_vault/identity/get_group.py
index aecf2128c..58f933ba4 100644
--- a/sdk/python/pulumi_vault/identity/get_group.py
+++ b/sdk/python/pulumi_vault/identity/get_group.py
@@ -137,7 +137,7 @@ def alias_merged_from_canonical_ids(self) -> Sequence[str]:
 
     @property
     @pulumi.getter(name="aliasMetadata")
-    def alias_metadata(self) -> Mapping[str, Any]:
+    def alias_metadata(self) -> Mapping[str, str]:
         """
         Arbitrary metadata
         """
@@ -230,7 +230,7 @@ def member_group_ids(self) -> Sequence[str]:
 
     @property
     @pulumi.getter
-    def metadata(self) -> Mapping[str, Any]:
+    def metadata(self) -> Mapping[str, str]:
         """
         Arbitrary metadata
         """
diff --git a/sdk/python/pulumi_vault/identity/get_oidc_public_keys.py b/sdk/python/pulumi_vault/identity/get_oidc_public_keys.py
index e85fa5141..882413859 100644
--- a/sdk/python/pulumi_vault/identity/get_oidc_public_keys.py
+++ b/sdk/python/pulumi_vault/identity/get_oidc_public_keys.py
@@ -45,7 +45,7 @@ def id(self) -> str:
 
     @property
     @pulumi.getter
-    def keys(self) -> Sequence[Mapping[str, Any]]:
+    def keys(self) -> Sequence[Mapping[str, str]]:
         """
         The public portion of keys for an OIDC provider. 
         Clients can use them to validate the authenticity of an identity token.
diff --git a/sdk/python/pulumi_vault/identity/outputs.py b/sdk/python/pulumi_vault/identity/outputs.py
index b5684b6a9..2ba5b1927 100644
--- a/sdk/python/pulumi_vault/identity/outputs.py
+++ b/sdk/python/pulumi_vault/identity/outputs.py
@@ -21,7 +21,7 @@ def __init__(__self__, *,
                  id: str,
                  last_update_time: str,
                  merged_from_canonical_ids: Sequence[str],
-                 metadata: Mapping[str, Any],
+                 metadata: Mapping[str, str],
                  mount_accessor: str,
                  mount_path: str,
                  mount_type: str,
@@ -32,7 +32,7 @@ def __init__(__self__, *,
         :param str id: ID of the alias
         :param str last_update_time: Last update time of the alias
         :param Sequence[str] merged_from_canonical_ids: List of canonical IDs merged with this alias
-        :param Mapping[str, Any] metadata: Arbitrary metadata
+        :param Mapping[str, str] metadata: Arbitrary metadata
         :param str mount_accessor: Authentication mount acccessor which this alias belongs to
         :param str mount_path: Authentication mount path which this alias belongs to
         :param str mount_type: Authentication mount type which this alias belongs to
@@ -91,7 +91,7 @@ def merged_from_canonical_ids(self) -> Sequence[str]:
 
     @property
     @pulumi.getter
-    def metadata(self) -> Mapping[str, Any]:
+    def metadata(self) -> Mapping[str, str]:
         """
         Arbitrary metadata
         """
diff --git a/sdk/python/pulumi_vault/jwt/auth_backend_role.py b/sdk/python/pulumi_vault/jwt/auth_backend_role.py
index 36ce384e2..60efef198 100644
--- a/sdk/python/pulumi_vault/jwt/auth_backend_role.py
+++ b/sdk/python/pulumi_vault/jwt/auth_backend_role.py
@@ -19,10 +19,10 @@ def __init__(__self__, *,
                  allowed_redirect_uris: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  backend: Optional[pulumi.Input[str]] = None,
                  bound_audiences: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 bound_claims: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 bound_claims: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  bound_claims_type: Optional[pulumi.Input[str]] = None,
                  bound_subject: Optional[pulumi.Input[str]] = None,
-                 claim_mappings: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 claim_mappings: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  clock_skew_leeway: Optional[pulumi.Input[int]] = None,
                  disable_bound_claims_parsing: Optional[pulumi.Input[bool]] = None,
                  expiration_leeway: Optional[pulumi.Input[int]] = None,
@@ -55,7 +55,7 @@ def __init__(__self__, *,
                Defaults to `jwt`.
         :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_audiences: (Required for roles of type `jwt`, optional for roles of
                type `oidc`) List of `aud` claims to match against. Any match is sufficient.
-        :param pulumi.Input[Mapping[str, Any]] bound_claims: If set, a map of claims to values to match against.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] bound_claims: If set, a map of claims to values to match against.
                A claim's value must be a string, which may contain one value or multiple
                comma-separated values, e.g. `"red"` or `"red,green,blue"`.
         :param pulumi.Input[str] bound_claims_type: How to interpret values in the claims/values
@@ -63,7 +63,7 @@ def __init__(__self__, *,
                match). Requires Vault 1.4.0 or above.
         :param pulumi.Input[str] bound_subject: If set, requires that the `sub` claim matches
                this value.
-        :param pulumi.Input[Mapping[str, Any]] claim_mappings: If set, a map of claims (keys) to be copied
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] claim_mappings: If set, a map of claims (keys) to be copied
                to specified metadata fields (values).
         :param pulumi.Input[int] clock_skew_leeway: The amount of leeway to add to all claims to account for clock skew, in
                seconds. Defaults to `60` seconds if set to `0` and can be disabled if set to `-1`.
@@ -229,7 +229,7 @@ def bound_audiences(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str
 
     @property
     @pulumi.getter(name="boundClaims")
-    def bound_claims(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def bound_claims(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         If set, a map of claims to values to match against.
         A claim's value must be a string, which may contain one value or multiple
@@ -238,7 +238,7 @@ def bound_claims(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "bound_claims")
 
     @bound_claims.setter
-    def bound_claims(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def bound_claims(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "bound_claims", value)
 
     @property
@@ -270,7 +270,7 @@ def bound_subject(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter(name="claimMappings")
-    def claim_mappings(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def claim_mappings(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         If set, a map of claims (keys) to be copied
         to specified metadata fields (values).
@@ -278,7 +278,7 @@ def claim_mappings(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "claim_mappings")
 
     @claim_mappings.setter
-    def claim_mappings(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def claim_mappings(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "claim_mappings", value)
 
     @property
@@ -547,10 +547,10 @@ def __init__(__self__, *,
                  allowed_redirect_uris: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  backend: Optional[pulumi.Input[str]] = None,
                  bound_audiences: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 bound_claims: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 bound_claims: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  bound_claims_type: Optional[pulumi.Input[str]] = None,
                  bound_subject: Optional[pulumi.Input[str]] = None,
-                 claim_mappings: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 claim_mappings: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  clock_skew_leeway: Optional[pulumi.Input[int]] = None,
                  disable_bound_claims_parsing: Optional[pulumi.Input[bool]] = None,
                  expiration_leeway: Optional[pulumi.Input[int]] = None,
@@ -581,7 +581,7 @@ def __init__(__self__, *,
                Defaults to `jwt`.
         :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_audiences: (Required for roles of type `jwt`, optional for roles of
                type `oidc`) List of `aud` claims to match against. Any match is sufficient.
-        :param pulumi.Input[Mapping[str, Any]] bound_claims: If set, a map of claims to values to match against.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] bound_claims: If set, a map of claims to values to match against.
                A claim's value must be a string, which may contain one value or multiple
                comma-separated values, e.g. `"red"` or `"red,green,blue"`.
         :param pulumi.Input[str] bound_claims_type: How to interpret values in the claims/values
@@ -589,7 +589,7 @@ def __init__(__self__, *,
                match). Requires Vault 1.4.0 or above.
         :param pulumi.Input[str] bound_subject: If set, requires that the `sub` claim matches
                this value.
-        :param pulumi.Input[Mapping[str, Any]] claim_mappings: If set, a map of claims (keys) to be copied
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] claim_mappings: If set, a map of claims (keys) to be copied
                to specified metadata fields (values).
         :param pulumi.Input[int] clock_skew_leeway: The amount of leeway to add to all claims to account for clock skew, in
                seconds. Defaults to `60` seconds if set to `0` and can be disabled if set to `-1`.
@@ -735,7 +735,7 @@ def bound_audiences(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str
 
     @property
     @pulumi.getter(name="boundClaims")
-    def bound_claims(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def bound_claims(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         If set, a map of claims to values to match against.
         A claim's value must be a string, which may contain one value or multiple
@@ -744,7 +744,7 @@ def bound_claims(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "bound_claims")
 
     @bound_claims.setter
-    def bound_claims(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def bound_claims(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "bound_claims", value)
 
     @property
@@ -776,7 +776,7 @@ def bound_subject(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter(name="claimMappings")
-    def claim_mappings(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def claim_mappings(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         If set, a map of claims (keys) to be copied
         to specified metadata fields (values).
@@ -784,7 +784,7 @@ def claim_mappings(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "claim_mappings")
 
     @claim_mappings.setter
-    def claim_mappings(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def claim_mappings(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "claim_mappings", value)
 
     @property
@@ -1081,10 +1081,10 @@ def __init__(__self__,
                  allowed_redirect_uris: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  backend: Optional[pulumi.Input[str]] = None,
                  bound_audiences: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 bound_claims: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 bound_claims: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  bound_claims_type: Optional[pulumi.Input[str]] = None,
                  bound_subject: Optional[pulumi.Input[str]] = None,
-                 claim_mappings: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 claim_mappings: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  clock_skew_leeway: Optional[pulumi.Input[int]] = None,
                  disable_bound_claims_parsing: Optional[pulumi.Input[bool]] = None,
                  expiration_leeway: Optional[pulumi.Input[int]] = None,
@@ -1176,7 +1176,7 @@ def __init__(__self__,
                Defaults to `jwt`.
         :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_audiences: (Required for roles of type `jwt`, optional for roles of
                type `oidc`) List of `aud` claims to match against. Any match is sufficient.
-        :param pulumi.Input[Mapping[str, Any]] bound_claims: If set, a map of claims to values to match against.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] bound_claims: If set, a map of claims to values to match against.
                A claim's value must be a string, which may contain one value or multiple
                comma-separated values, e.g. `"red"` or `"red,green,blue"`.
         :param pulumi.Input[str] bound_claims_type: How to interpret values in the claims/values
@@ -1184,7 +1184,7 @@ def __init__(__self__,
                match). Requires Vault 1.4.0 or above.
         :param pulumi.Input[str] bound_subject: If set, requires that the `sub` claim matches
                this value.
-        :param pulumi.Input[Mapping[str, Any]] claim_mappings: If set, a map of claims (keys) to be copied
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] claim_mappings: If set, a map of claims (keys) to be copied
                to specified metadata fields (values).
         :param pulumi.Input[int] clock_skew_leeway: The amount of leeway to add to all claims to account for clock skew, in
                seconds. Defaults to `60` seconds if set to `0` and can be disabled if set to `-1`.
@@ -1314,10 +1314,10 @@ def _internal_init(__self__,
                  allowed_redirect_uris: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  backend: Optional[pulumi.Input[str]] = None,
                  bound_audiences: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-                 bound_claims: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 bound_claims: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  bound_claims_type: Optional[pulumi.Input[str]] = None,
                  bound_subject: Optional[pulumi.Input[str]] = None,
-                 claim_mappings: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 claim_mappings: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  clock_skew_leeway: Optional[pulumi.Input[int]] = None,
                  disable_bound_claims_parsing: Optional[pulumi.Input[bool]] = None,
                  expiration_leeway: Optional[pulumi.Input[int]] = None,
@@ -1395,10 +1395,10 @@ def get(resource_name: str,
             allowed_redirect_uris: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
             backend: Optional[pulumi.Input[str]] = None,
             bound_audiences: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
-            bound_claims: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+            bound_claims: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
             bound_claims_type: Optional[pulumi.Input[str]] = None,
             bound_subject: Optional[pulumi.Input[str]] = None,
-            claim_mappings: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+            claim_mappings: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
             clock_skew_leeway: Optional[pulumi.Input[int]] = None,
             disable_bound_claims_parsing: Optional[pulumi.Input[bool]] = None,
             expiration_leeway: Optional[pulumi.Input[int]] = None,
@@ -1434,7 +1434,7 @@ def get(resource_name: str,
                Defaults to `jwt`.
         :param pulumi.Input[Sequence[pulumi.Input[str]]] bound_audiences: (Required for roles of type `jwt`, optional for roles of
                type `oidc`) List of `aud` claims to match against. Any match is sufficient.
-        :param pulumi.Input[Mapping[str, Any]] bound_claims: If set, a map of claims to values to match against.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] bound_claims: If set, a map of claims to values to match against.
                A claim's value must be a string, which may contain one value or multiple
                comma-separated values, e.g. `"red"` or `"red,green,blue"`.
         :param pulumi.Input[str] bound_claims_type: How to interpret values in the claims/values
@@ -1442,7 +1442,7 @@ def get(resource_name: str,
                match). Requires Vault 1.4.0 or above.
         :param pulumi.Input[str] bound_subject: If set, requires that the `sub` claim matches
                this value.
-        :param pulumi.Input[Mapping[str, Any]] claim_mappings: If set, a map of claims (keys) to be copied
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] claim_mappings: If set, a map of claims (keys) to be copied
                to specified metadata fields (values).
         :param pulumi.Input[int] clock_skew_leeway: The amount of leeway to add to all claims to account for clock skew, in
                seconds. Defaults to `60` seconds if set to `0` and can be disabled if set to `-1`.
@@ -1552,7 +1552,7 @@ def bound_audiences(self) -> pulumi.Output[Optional[Sequence[str]]]:
 
     @property
     @pulumi.getter(name="boundClaims")
-    def bound_claims(self) -> pulumi.Output[Optional[Mapping[str, Any]]]:
+    def bound_claims(self) -> pulumi.Output[Optional[Mapping[str, str]]]:
         """
         If set, a map of claims to values to match against.
         A claim's value must be a string, which may contain one value or multiple
@@ -1581,7 +1581,7 @@ def bound_subject(self) -> pulumi.Output[Optional[str]]:
 
     @property
     @pulumi.getter(name="claimMappings")
-    def claim_mappings(self) -> pulumi.Output[Optional[Mapping[str, Any]]]:
+    def claim_mappings(self) -> pulumi.Output[Optional[Mapping[str, str]]]:
         """
         If set, a map of claims (keys) to be copied
         to specified metadata fields (values).
diff --git a/sdk/python/pulumi_vault/kubernetes/secret_backend.py b/sdk/python/pulumi_vault/kubernetes/secret_backend.py
index d38003c55..d20705a03 100644
--- a/sdk/python/pulumi_vault/kubernetes/secret_backend.py
+++ b/sdk/python/pulumi_vault/kubernetes/secret_backend.py
@@ -31,7 +31,7 @@ def __init__(__self__, *,
                  local: Optional[pulumi.Input[bool]] = None,
                  max_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
-                 options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  plugin_version: Optional[pulumi.Input[str]] = None,
                  seal_wrap: Optional[pulumi.Input[bool]] = None,
@@ -64,7 +64,7 @@ def __init__(__self__, *,
                The value should not contain leading or trailing forward slashes.
                The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
                *Available only for Vault Enterprise*.
-        :param pulumi.Input[Mapping[str, Any]] options: Specifies mount type specific options that are passed to the backend
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] options: Specifies mount type specific options that are passed to the backend
         :param pulumi.Input[Sequence[pulumi.Input[str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
         :param pulumi.Input[str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
         :param pulumi.Input[bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
@@ -331,14 +331,14 @@ def namespace(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter
-    def options(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def options(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         Specifies mount type specific options that are passed to the backend
         """
         return pulumi.get(self, "options")
 
     @options.setter
-    def options(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def options(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "options", value)
 
     @property
@@ -412,7 +412,7 @@ def __init__(__self__, *,
                  local: Optional[pulumi.Input[bool]] = None,
                  max_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
-                 options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  path: Optional[pulumi.Input[str]] = None,
                  plugin_version: Optional[pulumi.Input[str]] = None,
@@ -446,7 +446,7 @@ def __init__(__self__, *,
                The value should not contain leading or trailing forward slashes.
                The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
                *Available only for Vault Enterprise*.
-        :param pulumi.Input[Mapping[str, Any]] options: Specifies mount type specific options that are passed to the backend
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] options: Specifies mount type specific options that are passed to the backend
         :param pulumi.Input[Sequence[pulumi.Input[str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
         :param pulumi.Input[str] path: Where the secret backend will be mounted
         :param pulumi.Input[str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
@@ -717,14 +717,14 @@ def namespace(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter
-    def options(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def options(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         Specifies mount type specific options that are passed to the backend
         """
         return pulumi.get(self, "options")
 
     @options.setter
-    def options(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def options(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "options", value)
 
     @property
@@ -811,7 +811,7 @@ def __init__(__self__,
                  local: Optional[pulumi.Input[bool]] = None,
                  max_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
-                 options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  path: Optional[pulumi.Input[str]] = None,
                  plugin_version: Optional[pulumi.Input[str]] = None,
@@ -872,7 +872,7 @@ def __init__(__self__,
                The value should not contain leading or trailing forward slashes.
                The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
                *Available only for Vault Enterprise*.
-        :param pulumi.Input[Mapping[str, Any]] options: Specifies mount type specific options that are passed to the backend
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] options: Specifies mount type specific options that are passed to the backend
         :param pulumi.Input[Sequence[pulumi.Input[str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
         :param pulumi.Input[str] path: Where the secret backend will be mounted
         :param pulumi.Input[str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
@@ -945,7 +945,7 @@ def _internal_init(__self__,
                  local: Optional[pulumi.Input[bool]] = None,
                  max_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
-                 options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  path: Optional[pulumi.Input[str]] = None,
                  plugin_version: Optional[pulumi.Input[str]] = None,
@@ -1014,7 +1014,7 @@ def get(resource_name: str,
             local: Optional[pulumi.Input[bool]] = None,
             max_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
             namespace: Optional[pulumi.Input[str]] = None,
-            options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+            options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
             passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
             path: Optional[pulumi.Input[str]] = None,
             plugin_version: Optional[pulumi.Input[str]] = None,
@@ -1053,7 +1053,7 @@ def get(resource_name: str,
                The value should not contain leading or trailing forward slashes.
                The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
                *Available only for Vault Enterprise*.
-        :param pulumi.Input[Mapping[str, Any]] options: Specifies mount type specific options that are passed to the backend
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] options: Specifies mount type specific options that are passed to the backend
         :param pulumi.Input[Sequence[pulumi.Input[str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
         :param pulumi.Input[str] path: Where the secret backend will be mounted
         :param pulumi.Input[str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
@@ -1238,7 +1238,7 @@ def namespace(self) -> pulumi.Output[Optional[str]]:
 
     @property
     @pulumi.getter
-    def options(self) -> pulumi.Output[Optional[Mapping[str, Any]]]:
+    def options(self) -> pulumi.Output[Optional[Mapping[str, str]]]:
         """
         Specifies mount type specific options that are passed to the backend
         """
diff --git a/sdk/python/pulumi_vault/kv/_inputs.py b/sdk/python/pulumi_vault/kv/_inputs.py
index 9dfb0de76..649c0d275 100644
--- a/sdk/python/pulumi_vault/kv/_inputs.py
+++ b/sdk/python/pulumi_vault/kv/_inputs.py
@@ -17,12 +17,12 @@
 class SecretV2CustomMetadataArgs:
     def __init__(__self__, *,
                  cas_required: Optional[pulumi.Input[bool]] = None,
-                 data: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 data: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  delete_version_after: Optional[pulumi.Input[int]] = None,
                  max_versions: Optional[pulumi.Input[int]] = None):
         """
         :param pulumi.Input[bool] cas_required: If true, all keys will require the cas parameter to be set on all write requests.
-        :param pulumi.Input[Mapping[str, Any]] data: A mapping whose keys are the top-level data keys returned from
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] data: A mapping whose keys are the top-level data keys returned from
                Vault and whose values are the corresponding values. This map can only
                represent string data, so any non-string values returned from Vault are
                serialized as JSON.
@@ -52,7 +52,7 @@ def cas_required(self, value: Optional[pulumi.Input[bool]]):
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def data(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         A mapping whose keys are the top-level data keys returned from
         Vault and whose values are the corresponding values. This map can only
@@ -62,7 +62,7 @@ def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "data")
 
     @data.setter
-    def data(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def data(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "data", value)
 
     @property
diff --git a/sdk/python/pulumi_vault/kv/get_secret.py b/sdk/python/pulumi_vault/kv/get_secret.py
index 58c506734..5b0504bda 100644
--- a/sdk/python/pulumi_vault/kv/get_secret.py
+++ b/sdk/python/pulumi_vault/kv/get_secret.py
@@ -49,7 +49,7 @@ def __init__(__self__, data=None, data_json=None, id=None, lease_duration=None,
 
     @property
     @pulumi.getter
-    def data(self) -> Mapping[str, Any]:
+    def data(self) -> Mapping[str, str]:
         """
         A mapping whose keys are the top-level data keys returned from
         Vault and whose values are the corresponding values. This map can only
diff --git a/sdk/python/pulumi_vault/kv/get_secret_subkeys_v2.py b/sdk/python/pulumi_vault/kv/get_secret_subkeys_v2.py
index 5296c5f90..bb335b0cb 100644
--- a/sdk/python/pulumi_vault/kv/get_secret_subkeys_v2.py
+++ b/sdk/python/pulumi_vault/kv/get_secret_subkeys_v2.py
@@ -52,7 +52,7 @@ def __init__(__self__, data=None, data_json=None, depth=None, id=None, mount=Non
 
     @property
     @pulumi.getter
-    def data(self) -> Mapping[str, Any]:
+    def data(self) -> Mapping[str, str]:
         """
         Subkeys for the KV-V2 secret stored as a serialized map of strings.
         """
diff --git a/sdk/python/pulumi_vault/kv/get_secret_v2.py b/sdk/python/pulumi_vault/kv/get_secret_v2.py
index 0dc70a21c..48aec0061 100644
--- a/sdk/python/pulumi_vault/kv/get_secret_v2.py
+++ b/sdk/python/pulumi_vault/kv/get_secret_v2.py
@@ -69,7 +69,7 @@ def created_time(self) -> str:
 
     @property
     @pulumi.getter(name="customMetadata")
-    def custom_metadata(self) -> Mapping[str, Any]:
+    def custom_metadata(self) -> Mapping[str, str]:
         """
         Custom metadata for the secret.
         """
@@ -77,7 +77,7 @@ def custom_metadata(self) -> Mapping[str, Any]:
 
     @property
     @pulumi.getter
-    def data(self) -> Mapping[str, Any]:
+    def data(self) -> Mapping[str, str]:
         """
         A mapping whose keys are the top-level data keys returned from
         Vault and whose values are the corresponding values. This map can only
diff --git a/sdk/python/pulumi_vault/kv/outputs.py b/sdk/python/pulumi_vault/kv/outputs.py
index f5380f749..61d371663 100644
--- a/sdk/python/pulumi_vault/kv/outputs.py
+++ b/sdk/python/pulumi_vault/kv/outputs.py
@@ -38,12 +38,12 @@ def get(self, key: str, default = None) -> Any:
 
     def __init__(__self__, *,
                  cas_required: Optional[bool] = None,
-                 data: Optional[Mapping[str, Any]] = None,
+                 data: Optional[Mapping[str, str]] = None,
                  delete_version_after: Optional[int] = None,
                  max_versions: Optional[int] = None):
         """
         :param bool cas_required: If true, all keys will require the cas parameter to be set on all write requests.
-        :param Mapping[str, Any] data: A mapping whose keys are the top-level data keys returned from
+        :param Mapping[str, str] data: A mapping whose keys are the top-level data keys returned from
                Vault and whose values are the corresponding values. This map can only
                represent string data, so any non-string values returned from Vault are
                serialized as JSON.
@@ -69,7 +69,7 @@ def cas_required(self) -> Optional[bool]:
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[Mapping[str, Any]]:
+    def data(self) -> Optional[Mapping[str, str]]:
         """
         A mapping whose keys are the top-level data keys returned from
         Vault and whose values are the corresponding values. This map can only
diff --git a/sdk/python/pulumi_vault/kv/secret.py b/sdk/python/pulumi_vault/kv/secret.py
index d8904410f..7b28fff15 100644
--- a/sdk/python/pulumi_vault/kv/secret.py
+++ b/sdk/python/pulumi_vault/kv/secret.py
@@ -76,13 +76,13 @@ def namespace(self, value: Optional[pulumi.Input[str]]):
 @pulumi.input_type
 class _SecretState:
     def __init__(__self__, *,
-                 data: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 data: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  data_json: Optional[pulumi.Input[str]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
                  path: Optional[pulumi.Input[str]] = None):
         """
         Input properties used for looking up and filtering Secret resources.
-        :param pulumi.Input[Mapping[str, Any]] data: A mapping whose keys are the top-level data keys returned from
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] data: A mapping whose keys are the top-level data keys returned from
                Vault and whose values are the corresponding values. This map can only
                represent string data, so any non-string values returned from Vault are
                serialized as JSON.
@@ -105,7 +105,7 @@ def __init__(__self__, *,
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def data(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         A mapping whose keys are the top-level data keys returned from
         Vault and whose values are the corresponding values. This map can only
@@ -115,7 +115,7 @@ def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "data")
 
     @data.setter
-    def data(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def data(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "data", value)
 
     @property
@@ -317,7 +317,7 @@ def _internal_init(__self__,
     def get(resource_name: str,
             id: pulumi.Input[str],
             opts: Optional[pulumi.ResourceOptions] = None,
-            data: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+            data: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
             data_json: Optional[pulumi.Input[str]] = None,
             namespace: Optional[pulumi.Input[str]] = None,
             path: Optional[pulumi.Input[str]] = None) -> 'Secret':
@@ -328,7 +328,7 @@ def get(resource_name: str,
         :param str resource_name: The unique name of the resulting resource.
         :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
         :param pulumi.ResourceOptions opts: Options for the resource.
-        :param pulumi.Input[Mapping[str, Any]] data: A mapping whose keys are the top-level data keys returned from
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] data: A mapping whose keys are the top-level data keys returned from
                Vault and whose values are the corresponding values. This map can only
                represent string data, so any non-string values returned from Vault are
                serialized as JSON.
@@ -352,7 +352,7 @@ def get(resource_name: str,
 
     @property
     @pulumi.getter
-    def data(self) -> pulumi.Output[Mapping[str, Any]]:
+    def data(self) -> pulumi.Output[Mapping[str, str]]:
         """
         A mapping whose keys are the top-level data keys returned from
         Vault and whose values are the corresponding values. This map can only
diff --git a/sdk/python/pulumi_vault/kv/secret_v2.py b/sdk/python/pulumi_vault/kv/secret_v2.py
index b6db6db3f..3aff9b704 100644
--- a/sdk/python/pulumi_vault/kv/secret_v2.py
+++ b/sdk/python/pulumi_vault/kv/secret_v2.py
@@ -24,7 +24,7 @@ def __init__(__self__, *,
                  disable_read: Optional[pulumi.Input[bool]] = None,
                  name: Optional[pulumi.Input[str]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
-                 options: Optional[pulumi.Input[Mapping[str, Any]]] = None):
+                 options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None):
         """
         The set of arguments for constructing a SecretV2 resource.
         :param pulumi.Input[str] data_json: JSON-encoded string that will be
@@ -49,7 +49,7 @@ def __init__(__self__, *,
                The value should not contain leading or trailing forward slashes.
                The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
                *Available only for Vault Enterprise*.
-        :param pulumi.Input[Mapping[str, Any]] options: An object that holds option settings.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] options: An object that holds option settings.
         """
         pulumi.set(__self__, "data_json", data_json)
         pulumi.set(__self__, "mount", mount)
@@ -180,14 +180,14 @@ def namespace(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter
-    def options(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def options(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         An object that holds option settings.
         """
         return pulumi.get(self, "options")
 
     @options.setter
-    def options(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def options(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "options", value)
 
 
@@ -196,15 +196,15 @@ class _SecretV2State:
     def __init__(__self__, *,
                  cas: Optional[pulumi.Input[int]] = None,
                  custom_metadata: Optional[pulumi.Input['SecretV2CustomMetadataArgs']] = None,
-                 data: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 data: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  data_json: Optional[pulumi.Input[str]] = None,
                  delete_all_versions: Optional[pulumi.Input[bool]] = None,
                  disable_read: Optional[pulumi.Input[bool]] = None,
-                 metadata: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 metadata: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  mount: Optional[pulumi.Input[str]] = None,
                  name: Optional[pulumi.Input[str]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
-                 options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  path: Optional[pulumi.Input[str]] = None):
         """
         Input properties used for looking up and filtering SecretV2 resources.
@@ -215,7 +215,7 @@ def __init__(__self__, *,
         :param pulumi.Input['SecretV2CustomMetadataArgs'] custom_metadata: A nested block that allows configuring metadata for the
                KV secret. Refer to the
                Configuration Options for more info.
-        :param pulumi.Input[Mapping[str, Any]] data: A mapping whose keys are the top-level data keys returned from
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] data: A mapping whose keys are the top-level data keys returned from
                Vault and whose values are the corresponding values. This map can only
                represent string data, so any non-string values returned from Vault are
                serialized as JSON.
@@ -225,7 +225,7 @@ def __init__(__self__, *,
                versions for the specified key.
         :param pulumi.Input[bool] disable_read: If set to true, disables reading secret from Vault;
                note: drift won't be detected.
-        :param pulumi.Input[Mapping[str, Any]] metadata: Metadata associated with this secret read from Vault.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] metadata: Metadata associated with this secret read from Vault.
         :param pulumi.Input[str] mount: Path where KV-V2 engine is mounted.
         :param pulumi.Input[str] name: Full name of the secret. For a nested secret
                the name is the nested path excluding the mount and data
@@ -235,7 +235,7 @@ def __init__(__self__, *,
                The value should not contain leading or trailing forward slashes.
                The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
                *Available only for Vault Enterprise*.
-        :param pulumi.Input[Mapping[str, Any]] options: An object that holds option settings.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] options: An object that holds option settings.
         :param pulumi.Input[str] path: Full path where the KV-V2 secret will be written.
         """
         if cas is not None:
@@ -294,7 +294,7 @@ def custom_metadata(self, value: Optional[pulumi.Input['SecretV2CustomMetadataAr
 
     @property
     @pulumi.getter
-    def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def data(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         A mapping whose keys are the top-level data keys returned from
         Vault and whose values are the corresponding values. This map can only
@@ -304,7 +304,7 @@ def data(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "data")
 
     @data.setter
-    def data(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def data(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "data", value)
 
     @property
@@ -348,14 +348,14 @@ def disable_read(self, value: Optional[pulumi.Input[bool]]):
 
     @property
     @pulumi.getter
-    def metadata(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def metadata(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         Metadata associated with this secret read from Vault.
         """
         return pulumi.get(self, "metadata")
 
     @metadata.setter
-    def metadata(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def metadata(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "metadata", value)
 
     @property
@@ -402,14 +402,14 @@ def namespace(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter
-    def options(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def options(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         An object that holds option settings.
         """
         return pulumi.get(self, "options")
 
     @options.setter
-    def options(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def options(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "options", value)
 
     @property
@@ -438,7 +438,7 @@ def __init__(__self__,
                  mount: Optional[pulumi.Input[str]] = None,
                  name: Optional[pulumi.Input[str]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
-                 options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  __props__=None):
         """
         Writes a KV-V2 secret to a given path in Vault.
@@ -529,7 +529,7 @@ def __init__(__self__,
                The value should not contain leading or trailing forward slashes.
                The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
                *Available only for Vault Enterprise*.
-        :param pulumi.Input[Mapping[str, Any]] options: An object that holds option settings.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] options: An object that holds option settings.
         """
         ...
     @overload
@@ -625,7 +625,7 @@ def _internal_init(__self__,
                  mount: Optional[pulumi.Input[str]] = None,
                  name: Optional[pulumi.Input[str]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
-                 options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  __props__=None):
         opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
         if not isinstance(opts, pulumi.ResourceOptions):
@@ -665,15 +665,15 @@ def get(resource_name: str,
             opts: Optional[pulumi.ResourceOptions] = None,
             cas: Optional[pulumi.Input[int]] = None,
             custom_metadata: Optional[pulumi.Input[Union['SecretV2CustomMetadataArgs', 'SecretV2CustomMetadataArgsDict']]] = None,
-            data: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+            data: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
             data_json: Optional[pulumi.Input[str]] = None,
             delete_all_versions: Optional[pulumi.Input[bool]] = None,
             disable_read: Optional[pulumi.Input[bool]] = None,
-            metadata: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+            metadata: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
             mount: Optional[pulumi.Input[str]] = None,
             name: Optional[pulumi.Input[str]] = None,
             namespace: Optional[pulumi.Input[str]] = None,
-            options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+            options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
             path: Optional[pulumi.Input[str]] = None) -> 'SecretV2':
         """
         Get an existing SecretV2 resource's state with the given name, id, and optional extra
@@ -689,7 +689,7 @@ def get(resource_name: str,
         :param pulumi.Input[Union['SecretV2CustomMetadataArgs', 'SecretV2CustomMetadataArgsDict']] custom_metadata: A nested block that allows configuring metadata for the
                KV secret. Refer to the
                Configuration Options for more info.
-        :param pulumi.Input[Mapping[str, Any]] data: A mapping whose keys are the top-level data keys returned from
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] data: A mapping whose keys are the top-level data keys returned from
                Vault and whose values are the corresponding values. This map can only
                represent string data, so any non-string values returned from Vault are
                serialized as JSON.
@@ -699,7 +699,7 @@ def get(resource_name: str,
                versions for the specified key.
         :param pulumi.Input[bool] disable_read: If set to true, disables reading secret from Vault;
                note: drift won't be detected.
-        :param pulumi.Input[Mapping[str, Any]] metadata: Metadata associated with this secret read from Vault.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] metadata: Metadata associated with this secret read from Vault.
         :param pulumi.Input[str] mount: Path where KV-V2 engine is mounted.
         :param pulumi.Input[str] name: Full name of the secret. For a nested secret
                the name is the nested path excluding the mount and data
@@ -709,7 +709,7 @@ def get(resource_name: str,
                The value should not contain leading or trailing forward slashes.
                The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
                *Available only for Vault Enterprise*.
-        :param pulumi.Input[Mapping[str, Any]] options: An object that holds option settings.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] options: An object that holds option settings.
         :param pulumi.Input[str] path: Full path where the KV-V2 secret will be written.
         """
         opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
@@ -753,7 +753,7 @@ def custom_metadata(self) -> pulumi.Output['outputs.SecretV2CustomMetadata']:
 
     @property
     @pulumi.getter
-    def data(self) -> pulumi.Output[Mapping[str, Any]]:
+    def data(self) -> pulumi.Output[Mapping[str, str]]:
         """
         A mapping whose keys are the top-level data keys returned from
         Vault and whose values are the corresponding values. This map can only
@@ -791,7 +791,7 @@ def disable_read(self) -> pulumi.Output[Optional[bool]]:
 
     @property
     @pulumi.getter
-    def metadata(self) -> pulumi.Output[Mapping[str, Any]]:
+    def metadata(self) -> pulumi.Output[Mapping[str, str]]:
         """
         Metadata associated with this secret read from Vault.
         """
@@ -829,7 +829,7 @@ def namespace(self) -> pulumi.Output[Optional[str]]:
 
     @property
     @pulumi.getter
-    def options(self) -> pulumi.Output[Optional[Mapping[str, Any]]]:
+    def options(self) -> pulumi.Output[Optional[Mapping[str, str]]]:
         """
         An object that holds option settings.
         """
diff --git a/sdk/python/pulumi_vault/ldap/secret_backend.py b/sdk/python/pulumi_vault/ldap/secret_backend.py
index b1e7ca8d8..26c0a24a0 100644
--- a/sdk/python/pulumi_vault/ldap/secret_backend.py
+++ b/sdk/python/pulumi_vault/ldap/secret_backend.py
@@ -35,7 +35,7 @@ def __init__(__self__, *,
                  local: Optional[pulumi.Input[bool]] = None,
                  max_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
-                 options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  password_policy: Optional[pulumi.Input[str]] = None,
                  path: Optional[pulumi.Input[str]] = None,
@@ -79,7 +79,7 @@ def __init__(__self__, *,
                The value should not contain leading or trailing forward slashes.
                The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
                *Available only for Vault Enterprise*.
-        :param pulumi.Input[Mapping[str, Any]] options: Specifies mount type specific options that are passed to the backend
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] options: Specifies mount type specific options that are passed to the backend
         :param pulumi.Input[Sequence[pulumi.Input[str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
         :param pulumi.Input[str] password_policy: Name of the password policy to use to generate passwords.
         :param pulumi.Input[str] path: The unique path this backend should be mounted at. Must
@@ -428,14 +428,14 @@ def namespace(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter
-    def options(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def options(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         Specifies mount type specific options that are passed to the backend
         """
         return pulumi.get(self, "options")
 
     @options.setter
-    def options(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def options(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "options", value)
 
     @property
@@ -624,7 +624,7 @@ def __init__(__self__, *,
                  local: Optional[pulumi.Input[bool]] = None,
                  max_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
-                 options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  password_policy: Optional[pulumi.Input[str]] = None,
                  path: Optional[pulumi.Input[str]] = None,
@@ -669,7 +669,7 @@ def __init__(__self__, *,
                The value should not contain leading or trailing forward slashes.
                The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
                *Available only for Vault Enterprise*.
-        :param pulumi.Input[Mapping[str, Any]] options: Specifies mount type specific options that are passed to the backend
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] options: Specifies mount type specific options that are passed to the backend
         :param pulumi.Input[Sequence[pulumi.Input[str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
         :param pulumi.Input[str] password_policy: Name of the password policy to use to generate passwords.
         :param pulumi.Input[str] path: The unique path this backend should be mounted at. Must
@@ -1034,14 +1034,14 @@ def namespace(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter
-    def options(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def options(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         Specifies mount type specific options that are passed to the backend
         """
         return pulumi.get(self, "options")
 
     @options.setter
-    def options(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def options(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "options", value)
 
     @property
@@ -1231,7 +1231,7 @@ def __init__(__self__,
                  local: Optional[pulumi.Input[bool]] = None,
                  max_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
-                 options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  password_policy: Optional[pulumi.Input[str]] = None,
                  path: Optional[pulumi.Input[str]] = None,
@@ -1300,7 +1300,7 @@ def __init__(__self__,
                The value should not contain leading or trailing forward slashes.
                The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
                *Available only for Vault Enterprise*.
-        :param pulumi.Input[Mapping[str, Any]] options: Specifies mount type specific options that are passed to the backend
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] options: Specifies mount type specific options that are passed to the backend
         :param pulumi.Input[Sequence[pulumi.Input[str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
         :param pulumi.Input[str] password_policy: Name of the password policy to use to generate passwords.
         :param pulumi.Input[str] path: The unique path this backend should be mounted at. Must
@@ -1385,7 +1385,7 @@ def _internal_init(__self__,
                  local: Optional[pulumi.Input[bool]] = None,
                  max_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
-                 options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  password_policy: Optional[pulumi.Input[str]] = None,
                  path: Optional[pulumi.Input[str]] = None,
@@ -1482,7 +1482,7 @@ def get(resource_name: str,
             local: Optional[pulumi.Input[bool]] = None,
             max_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
             namespace: Optional[pulumi.Input[str]] = None,
-            options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+            options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
             passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
             password_policy: Optional[pulumi.Input[str]] = None,
             path: Optional[pulumi.Input[str]] = None,
@@ -1532,7 +1532,7 @@ def get(resource_name: str,
                The value should not contain leading or trailing forward slashes.
                The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
                *Available only for Vault Enterprise*.
-        :param pulumi.Input[Mapping[str, Any]] options: Specifies mount type specific options that are passed to the backend
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] options: Specifies mount type specific options that are passed to the backend
         :param pulumi.Input[Sequence[pulumi.Input[str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
         :param pulumi.Input[str] password_policy: Name of the password policy to use to generate passwords.
         :param pulumi.Input[str] path: The unique path this backend should be mounted at. Must
@@ -1778,7 +1778,7 @@ def namespace(self) -> pulumi.Output[Optional[str]]:
 
     @property
     @pulumi.getter
-    def options(self) -> pulumi.Output[Optional[Mapping[str, Any]]]:
+    def options(self) -> pulumi.Output[Optional[Mapping[str, str]]]:
         """
         Specifies mount type specific options that are passed to the backend
         """
diff --git a/sdk/python/pulumi_vault/mount.py b/sdk/python/pulumi_vault/mount.py
index 961857265..70825760f 100644
--- a/sdk/python/pulumi_vault/mount.py
+++ b/sdk/python/pulumi_vault/mount.py
@@ -29,7 +29,7 @@ def __init__(__self__, *,
                  local: Optional[pulumi.Input[bool]] = None,
                  max_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
-                 options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  plugin_version: Optional[pulumi.Input[str]] = None,
                  seal_wrap: Optional[pulumi.Input[bool]] = None):
@@ -57,7 +57,7 @@ def __init__(__self__, *,
                The value should not contain leading or trailing forward slashes.
                The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
                *Available only for Vault Enterprise*.
-        :param pulumi.Input[Mapping[str, Any]] options: Specifies mount type specific options that are passed to the backend
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] options: Specifies mount type specific options that are passed to the backend
         :param pulumi.Input[Sequence[pulumi.Input[str]]] passthrough_request_headers: List of headers to allow and pass from the request to
                the plugin.
         :param pulumi.Input[str] plugin_version: Specifies the semantic version of the plugin to use, e.g. "v1.0.0".
@@ -291,14 +291,14 @@ def namespace(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter
-    def options(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def options(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         Specifies mount type specific options that are passed to the backend
         """
         return pulumi.get(self, "options")
 
     @options.setter
-    def options(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def options(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "options", value)
 
     @property
@@ -358,7 +358,7 @@ def __init__(__self__, *,
                  local: Optional[pulumi.Input[bool]] = None,
                  max_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
-                 options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  path: Optional[pulumi.Input[str]] = None,
                  plugin_version: Optional[pulumi.Input[str]] = None,
@@ -387,7 +387,7 @@ def __init__(__self__, *,
                The value should not contain leading or trailing forward slashes.
                The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
                *Available only for Vault Enterprise*.
-        :param pulumi.Input[Mapping[str, Any]] options: Specifies mount type specific options that are passed to the backend
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] options: Specifies mount type specific options that are passed to the backend
         :param pulumi.Input[Sequence[pulumi.Input[str]]] passthrough_request_headers: List of headers to allow and pass from the request to
                the plugin.
         :param pulumi.Input[str] path: Where the secret backend will be mounted
@@ -615,14 +615,14 @@ def namespace(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter
-    def options(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def options(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         Specifies mount type specific options that are passed to the backend
         """
         return pulumi.get(self, "options")
 
     @options.setter
-    def options(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def options(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "options", value)
 
     @property
@@ -707,7 +707,7 @@ def __init__(__self__,
                  local: Optional[pulumi.Input[bool]] = None,
                  max_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
-                 options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  path: Optional[pulumi.Input[str]] = None,
                  plugin_version: Optional[pulumi.Input[str]] = None,
@@ -752,7 +752,7 @@ def __init__(__self__,
             type="transit",
             description="This is an example transit secret engine mount",
             options={
-                "convergent_encryption": False,
+                "convergent_encryption": "false",
             })
         ```
 
@@ -798,7 +798,7 @@ def __init__(__self__,
                The value should not contain leading or trailing forward slashes.
                The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
                *Available only for Vault Enterprise*.
-        :param pulumi.Input[Mapping[str, Any]] options: Specifies mount type specific options that are passed to the backend
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] options: Specifies mount type specific options that are passed to the backend
         :param pulumi.Input[Sequence[pulumi.Input[str]]] passthrough_request_headers: List of headers to allow and pass from the request to
                the plugin.
         :param pulumi.Input[str] path: Where the secret backend will be mounted
@@ -852,7 +852,7 @@ def __init__(__self__,
             type="transit",
             description="This is an example transit secret engine mount",
             options={
-                "convergent_encryption": False,
+                "convergent_encryption": "false",
             })
         ```
 
@@ -904,7 +904,7 @@ def _internal_init(__self__,
                  local: Optional[pulumi.Input[bool]] = None,
                  max_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
-                 options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  path: Optional[pulumi.Input[str]] = None,
                  plugin_version: Optional[pulumi.Input[str]] = None,
@@ -967,7 +967,7 @@ def get(resource_name: str,
             local: Optional[pulumi.Input[bool]] = None,
             max_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
             namespace: Optional[pulumi.Input[str]] = None,
-            options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+            options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
             passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
             path: Optional[pulumi.Input[str]] = None,
             plugin_version: Optional[pulumi.Input[str]] = None,
@@ -1001,7 +1001,7 @@ def get(resource_name: str,
                The value should not contain leading or trailing forward slashes.
                The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
                *Available only for Vault Enterprise*.
-        :param pulumi.Input[Mapping[str, Any]] options: Specifies mount type specific options that are passed to the backend
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] options: Specifies mount type specific options that are passed to the backend
         :param pulumi.Input[Sequence[pulumi.Input[str]]] passthrough_request_headers: List of headers to allow and pass from the request to
                the plugin.
         :param pulumi.Input[str] path: Where the secret backend will be mounted
@@ -1158,7 +1158,7 @@ def namespace(self) -> pulumi.Output[Optional[str]]:
 
     @property
     @pulumi.getter
-    def options(self) -> pulumi.Output[Optional[Mapping[str, Any]]]:
+    def options(self) -> pulumi.Output[Optional[Mapping[str, str]]]:
         """
         Specifies mount type specific options that are passed to the backend
         """
diff --git a/sdk/python/pulumi_vault/namespace.py b/sdk/python/pulumi_vault/namespace.py
index e3639a5c5..e7a5b46e2 100644
--- a/sdk/python/pulumi_vault/namespace.py
+++ b/sdk/python/pulumi_vault/namespace.py
@@ -15,13 +15,13 @@
 class NamespaceArgs:
     def __init__(__self__, *,
                  path: pulumi.Input[str],
-                 custom_metadata: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 custom_metadata: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
                  path_fq: Optional[pulumi.Input[str]] = None):
         """
         The set of arguments for constructing a Namespace resource.
         :param pulumi.Input[str] path: The path of the namespace. Must not have a trailing `/`.
-        :param pulumi.Input[Mapping[str, Any]] custom_metadata: Custom metadata describing this namespace. Value type
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] custom_metadata: Custom metadata describing this namespace. Value type
                is `map[string]string`. Requires Vault version 1.12+.
         :param pulumi.Input[str] namespace: The namespace to provision the resource in.
                The value should not contain leading or trailing forward slashes.
@@ -52,7 +52,7 @@ def path(self, value: pulumi.Input[str]):
 
     @property
     @pulumi.getter(name="customMetadata")
-    def custom_metadata(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def custom_metadata(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         Custom metadata describing this namespace. Value type
         is `map[string]string`. Requires Vault version 1.12+.
@@ -60,7 +60,7 @@ def custom_metadata(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "custom_metadata")
 
     @custom_metadata.setter
-    def custom_metadata(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def custom_metadata(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "custom_metadata", value)
 
     @property
@@ -95,14 +95,14 @@ def path_fq(self, value: Optional[pulumi.Input[str]]):
 @pulumi.input_type
 class _NamespaceState:
     def __init__(__self__, *,
-                 custom_metadata: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 custom_metadata: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
                  namespace_id: Optional[pulumi.Input[str]] = None,
                  path: Optional[pulumi.Input[str]] = None,
                  path_fq: Optional[pulumi.Input[str]] = None):
         """
         Input properties used for looking up and filtering Namespace resources.
-        :param pulumi.Input[Mapping[str, Any]] custom_metadata: Custom metadata describing this namespace. Value type
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] custom_metadata: Custom metadata describing this namespace. Value type
                is `map[string]string`. Requires Vault version 1.12+.
         :param pulumi.Input[str] namespace: The namespace to provision the resource in.
                The value should not contain leading or trailing forward slashes.
@@ -126,7 +126,7 @@ def __init__(__self__, *,
 
     @property
     @pulumi.getter(name="customMetadata")
-    def custom_metadata(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def custom_metadata(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         Custom metadata describing this namespace. Value type
         is `map[string]string`. Requires Vault version 1.12+.
@@ -134,7 +134,7 @@ def custom_metadata(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "custom_metadata")
 
     @custom_metadata.setter
-    def custom_metadata(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def custom_metadata(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "custom_metadata", value)
 
     @property
@@ -195,7 +195,7 @@ class Namespace(pulumi.CustomResource):
     def __init__(__self__,
                  resource_name: str,
                  opts: Optional[pulumi.ResourceOptions] = None,
-                 custom_metadata: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 custom_metadata: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
                  path: Optional[pulumi.Input[str]] = None,
                  path_fq: Optional[pulumi.Input[str]] = None,
@@ -253,7 +253,7 @@ def __init__(__self__,
 
         :param str resource_name: The name of the resource.
         :param pulumi.ResourceOptions opts: Options for the resource.
-        :param pulumi.Input[Mapping[str, Any]] custom_metadata: Custom metadata describing this namespace. Value type
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] custom_metadata: Custom metadata describing this namespace. Value type
                is `map[string]string`. Requires Vault version 1.12+.
         :param pulumi.Input[str] namespace: The namespace to provision the resource in.
                The value should not contain leading or trailing forward slashes.
@@ -335,7 +335,7 @@ def __init__(__self__, resource_name: str, *args, **kwargs):
     def _internal_init(__self__,
                  resource_name: str,
                  opts: Optional[pulumi.ResourceOptions] = None,
-                 custom_metadata: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 custom_metadata: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
                  path: Optional[pulumi.Input[str]] = None,
                  path_fq: Optional[pulumi.Input[str]] = None,
@@ -365,7 +365,7 @@ def _internal_init(__self__,
     def get(resource_name: str,
             id: pulumi.Input[str],
             opts: Optional[pulumi.ResourceOptions] = None,
-            custom_metadata: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+            custom_metadata: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
             namespace: Optional[pulumi.Input[str]] = None,
             namespace_id: Optional[pulumi.Input[str]] = None,
             path: Optional[pulumi.Input[str]] = None,
@@ -377,7 +377,7 @@ def get(resource_name: str,
         :param str resource_name: The unique name of the resulting resource.
         :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
         :param pulumi.ResourceOptions opts: Options for the resource.
-        :param pulumi.Input[Mapping[str, Any]] custom_metadata: Custom metadata describing this namespace. Value type
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] custom_metadata: Custom metadata describing this namespace. Value type
                is `map[string]string`. Requires Vault version 1.12+.
         :param pulumi.Input[str] namespace: The namespace to provision the resource in.
                The value should not contain leading or trailing forward slashes.
@@ -401,7 +401,7 @@ def get(resource_name: str,
 
     @property
     @pulumi.getter(name="customMetadata")
-    def custom_metadata(self) -> pulumi.Output[Mapping[str, Any]]:
+    def custom_metadata(self) -> pulumi.Output[Mapping[str, str]]:
         """
         Custom metadata describing this namespace. Value type
         is `map[string]string`. Requires Vault version 1.12+.
diff --git a/sdk/python/pulumi_vault/pkisecret/_inputs.py b/sdk/python/pulumi_vault/pkisecret/_inputs.py
index 295ccc154..be1cde35c 100644
--- a/sdk/python/pulumi_vault/pkisecret/_inputs.py
+++ b/sdk/python/pulumi_vault/pkisecret/_inputs.py
@@ -17,11 +17,11 @@
 @pulumi.input_type
 class BackendConfigEstAuthenticatorsArgs:
     def __init__(__self__, *,
-                 cert: Optional[pulumi.Input[Mapping[str, Any]]] = None,
-                 userpass: Optional[pulumi.Input[Mapping[str, Any]]] = None):
+                 cert: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
+                 userpass: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None):
         """
-        :param pulumi.Input[Mapping[str, Any]] cert: "The accessor (required) and cert_role (optional) properties for cert auth backends".
-        :param pulumi.Input[Mapping[str, Any]] userpass: "The accessor (required) property for user pass auth backends".
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] cert: "The accessor (required) and cert_role (optional) properties for cert auth backends".
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] userpass: "The accessor (required) property for user pass auth backends".
         """
         if cert is not None:
             pulumi.set(__self__, "cert", cert)
@@ -30,26 +30,26 @@ def __init__(__self__, *,
 
     @property
     @pulumi.getter
-    def cert(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def cert(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         "The accessor (required) and cert_role (optional) properties for cert auth backends".
         """
         return pulumi.get(self, "cert")
 
     @cert.setter
-    def cert(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def cert(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "cert", value)
 
     @property
     @pulumi.getter
-    def userpass(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def userpass(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         "The accessor (required) property for user pass auth backends".
         """
         return pulumi.get(self, "userpass")
 
     @userpass.setter
-    def userpass(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def userpass(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "userpass", value)
 
 
diff --git a/sdk/python/pulumi_vault/pkisecret/backend_config_est.py b/sdk/python/pulumi_vault/pkisecret/backend_config_est.py
index fb679f82f..372bd3a26 100644
--- a/sdk/python/pulumi_vault/pkisecret/backend_config_est.py
+++ b/sdk/python/pulumi_vault/pkisecret/backend_config_est.py
@@ -23,7 +23,7 @@ def __init__(__self__, *,
                  default_path_policy: Optional[pulumi.Input[str]] = None,
                  enable_sentinel_parsing: Optional[pulumi.Input[bool]] = None,
                  enabled: Optional[pulumi.Input[bool]] = None,
-                 label_to_path_policy: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 label_to_path_policy: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  namespace: Optional[pulumi.Input[str]] = None):
         """
         The set of arguments for constructing a BackendConfigEst resource.
@@ -37,7 +37,7 @@ def __init__(__self__, *,
         :param pulumi.Input[str] default_path_policy: Required to be set if default_mount is enabled. Specifies the behavior for requests using the default EST label. Can be sign-verbatim or a role given by role:<role_name>.
         :param pulumi.Input[bool] enable_sentinel_parsing: If set, parse out fields from the provided CSR making them available for Sentinel policies.
         :param pulumi.Input[bool] enabled: Specifies whether EST is enabled.
-        :param pulumi.Input[Mapping[str, Any]] label_to_path_policy: Configures a pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:<role_name>. Labels must be unique across Vault cluster, and will register .well-known/est/<label> URL paths.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] label_to_path_policy: Configures a pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:<role_name>. Labels must be unique across Vault cluster, and will register .well-known/est/<label> URL paths.
         :param pulumi.Input[str] namespace: The namespace of the target resource.
                The value should not contain leading or trailing forward slashes.
                The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
@@ -150,14 +150,14 @@ def enabled(self, value: Optional[pulumi.Input[bool]]):
 
     @property
     @pulumi.getter(name="labelToPathPolicy")
-    def label_to_path_policy(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def label_to_path_policy(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         Configures a pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:<role_name>. Labels must be unique across Vault cluster, and will register .well-known/est/<label> URL paths.
         """
         return pulumi.get(self, "label_to_path_policy")
 
     @label_to_path_policy.setter
-    def label_to_path_policy(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def label_to_path_policy(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "label_to_path_policy", value)
 
     @property
@@ -186,7 +186,7 @@ def __init__(__self__, *,
                  default_path_policy: Optional[pulumi.Input[str]] = None,
                  enable_sentinel_parsing: Optional[pulumi.Input[bool]] = None,
                  enabled: Optional[pulumi.Input[bool]] = None,
-                 label_to_path_policy: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 label_to_path_policy: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  last_updated: Optional[pulumi.Input[str]] = None,
                  namespace: Optional[pulumi.Input[str]] = None):
         """
@@ -201,7 +201,7 @@ def __init__(__self__, *,
         :param pulumi.Input[str] default_path_policy: Required to be set if default_mount is enabled. Specifies the behavior for requests using the default EST label. Can be sign-verbatim or a role given by role:<role_name>.
         :param pulumi.Input[bool] enable_sentinel_parsing: If set, parse out fields from the provided CSR making them available for Sentinel policies.
         :param pulumi.Input[bool] enabled: Specifies whether EST is enabled.
-        :param pulumi.Input[Mapping[str, Any]] label_to_path_policy: Configures a pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:<role_name>. Labels must be unique across Vault cluster, and will register .well-known/est/<label> URL paths.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] label_to_path_policy: Configures a pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:<role_name>. Labels must be unique across Vault cluster, and will register .well-known/est/<label> URL paths.
         :param pulumi.Input[str] last_updated: A read-only timestamp representing the last time the configuration was updated.
         :param pulumi.Input[str] namespace: The namespace of the target resource.
                The value should not contain leading or trailing forward slashes.
@@ -318,14 +318,14 @@ def enabled(self, value: Optional[pulumi.Input[bool]]):
 
     @property
     @pulumi.getter(name="labelToPathPolicy")
-    def label_to_path_policy(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def label_to_path_policy(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         Configures a pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:<role_name>. Labels must be unique across Vault cluster, and will register .well-known/est/<label> URL paths.
         """
         return pulumi.get(self, "label_to_path_policy")
 
     @label_to_path_policy.setter
-    def label_to_path_policy(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def label_to_path_policy(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "label_to_path_policy", value)
 
     @property
@@ -368,7 +368,7 @@ def __init__(__self__,
                  default_path_policy: Optional[pulumi.Input[str]] = None,
                  enable_sentinel_parsing: Optional[pulumi.Input[bool]] = None,
                  enabled: Optional[pulumi.Input[bool]] = None,
-                 label_to_path_policy: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 label_to_path_policy: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
                  __props__=None):
         """
@@ -396,7 +396,7 @@ def __init__(__self__,
         :param pulumi.Input[str] default_path_policy: Required to be set if default_mount is enabled. Specifies the behavior for requests using the default EST label. Can be sign-verbatim or a role given by role:<role_name>.
         :param pulumi.Input[bool] enable_sentinel_parsing: If set, parse out fields from the provided CSR making them available for Sentinel policies.
         :param pulumi.Input[bool] enabled: Specifies whether EST is enabled.
-        :param pulumi.Input[Mapping[str, Any]] label_to_path_policy: Configures a pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:<role_name>. Labels must be unique across Vault cluster, and will register .well-known/est/<label> URL paths.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] label_to_path_policy: Configures a pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:<role_name>. Labels must be unique across Vault cluster, and will register .well-known/est/<label> URL paths.
         :param pulumi.Input[str] namespace: The namespace of the target resource.
                The value should not contain leading or trailing forward slashes.
                The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
@@ -443,7 +443,7 @@ def _internal_init(__self__,
                  default_path_policy: Optional[pulumi.Input[str]] = None,
                  enable_sentinel_parsing: Optional[pulumi.Input[bool]] = None,
                  enabled: Optional[pulumi.Input[bool]] = None,
-                 label_to_path_policy: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 label_to_path_policy: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
                  __props__=None):
         opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
@@ -483,7 +483,7 @@ def get(resource_name: str,
             default_path_policy: Optional[pulumi.Input[str]] = None,
             enable_sentinel_parsing: Optional[pulumi.Input[bool]] = None,
             enabled: Optional[pulumi.Input[bool]] = None,
-            label_to_path_policy: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+            label_to_path_policy: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
             last_updated: Optional[pulumi.Input[str]] = None,
             namespace: Optional[pulumi.Input[str]] = None) -> 'BackendConfigEst':
         """
@@ -503,7 +503,7 @@ def get(resource_name: str,
         :param pulumi.Input[str] default_path_policy: Required to be set if default_mount is enabled. Specifies the behavior for requests using the default EST label. Can be sign-verbatim or a role given by role:<role_name>.
         :param pulumi.Input[bool] enable_sentinel_parsing: If set, parse out fields from the provided CSR making them available for Sentinel policies.
         :param pulumi.Input[bool] enabled: Specifies whether EST is enabled.
-        :param pulumi.Input[Mapping[str, Any]] label_to_path_policy: Configures a pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:<role_name>. Labels must be unique across Vault cluster, and will register .well-known/est/<label> URL paths.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] label_to_path_policy: Configures a pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:<role_name>. Labels must be unique across Vault cluster, and will register .well-known/est/<label> URL paths.
         :param pulumi.Input[str] last_updated: A read-only timestamp representing the last time the configuration was updated.
         :param pulumi.Input[str] namespace: The namespace of the target resource.
                The value should not contain leading or trailing forward slashes.
@@ -587,7 +587,7 @@ def enabled(self) -> pulumi.Output[Optional[bool]]:
 
     @property
     @pulumi.getter(name="labelToPathPolicy")
-    def label_to_path_policy(self) -> pulumi.Output[Optional[Mapping[str, Any]]]:
+    def label_to_path_policy(self) -> pulumi.Output[Optional[Mapping[str, str]]]:
         """
         Configures a pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:<role_name>. Labels must be unique across Vault cluster, and will register .well-known/est/<label> URL paths.
         """
diff --git a/sdk/python/pulumi_vault/pkisecret/get_backend_config_est.py b/sdk/python/pulumi_vault/pkisecret/get_backend_config_est.py
index d93072dac..6680c3b6e 100644
--- a/sdk/python/pulumi_vault/pkisecret/get_backend_config_est.py
+++ b/sdk/python/pulumi_vault/pkisecret/get_backend_config_est.py
@@ -120,7 +120,7 @@ def id(self) -> str:
 
     @property
     @pulumi.getter(name="labelToPathPolicy")
-    def label_to_path_policy(self) -> Mapping[str, Any]:
+    def label_to_path_policy(self) -> Mapping[str, str]:
         """
         A pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:<role_name>. Labels must be unique across Vault cluster, and will register .well-known/est/<label> URL paths.
         """
diff --git a/sdk/python/pulumi_vault/pkisecret/get_backend_issuers.py b/sdk/python/pulumi_vault/pkisecret/get_backend_issuers.py
index 6c585be50..330ab1415 100644
--- a/sdk/python/pulumi_vault/pkisecret/get_backend_issuers.py
+++ b/sdk/python/pulumi_vault/pkisecret/get_backend_issuers.py
@@ -56,7 +56,7 @@ def id(self) -> str:
 
     @property
     @pulumi.getter(name="keyInfo")
-    def key_info(self) -> Mapping[str, Any]:
+    def key_info(self) -> Mapping[str, str]:
         """
         Map of issuer strings read from Vault.
         """
diff --git a/sdk/python/pulumi_vault/pkisecret/get_backend_keys.py b/sdk/python/pulumi_vault/pkisecret/get_backend_keys.py
index 2daae2efc..c56577b2d 100644
--- a/sdk/python/pulumi_vault/pkisecret/get_backend_keys.py
+++ b/sdk/python/pulumi_vault/pkisecret/get_backend_keys.py
@@ -56,7 +56,7 @@ def id(self) -> str:
 
     @property
     @pulumi.getter(name="keyInfo")
-    def key_info(self) -> Mapping[str, Any]:
+    def key_info(self) -> Mapping[str, str]:
         """
         Map of key strings read from Vault.
         """
diff --git a/sdk/python/pulumi_vault/pkisecret/outputs.py b/sdk/python/pulumi_vault/pkisecret/outputs.py
index a71c411cd..e674012e3 100644
--- a/sdk/python/pulumi_vault/pkisecret/outputs.py
+++ b/sdk/python/pulumi_vault/pkisecret/outputs.py
@@ -18,11 +18,11 @@
 @pulumi.output_type
 class BackendConfigEstAuthenticators(dict):
     def __init__(__self__, *,
-                 cert: Optional[Mapping[str, Any]] = None,
-                 userpass: Optional[Mapping[str, Any]] = None):
+                 cert: Optional[Mapping[str, str]] = None,
+                 userpass: Optional[Mapping[str, str]] = None):
         """
-        :param Mapping[str, Any] cert: "The accessor (required) and cert_role (optional) properties for cert auth backends".
-        :param Mapping[str, Any] userpass: "The accessor (required) property for user pass auth backends".
+        :param Mapping[str, str] cert: "The accessor (required) and cert_role (optional) properties for cert auth backends".
+        :param Mapping[str, str] userpass: "The accessor (required) property for user pass auth backends".
         """
         if cert is not None:
             pulumi.set(__self__, "cert", cert)
@@ -31,7 +31,7 @@ def __init__(__self__, *,
 
     @property
     @pulumi.getter
-    def cert(self) -> Optional[Mapping[str, Any]]:
+    def cert(self) -> Optional[Mapping[str, str]]:
         """
         "The accessor (required) and cert_role (optional) properties for cert auth backends".
         """
@@ -39,7 +39,7 @@ def cert(self) -> Optional[Mapping[str, Any]]:
 
     @property
     @pulumi.getter
-    def userpass(self) -> Optional[Mapping[str, Any]]:
+    def userpass(self) -> Optional[Mapping[str, str]]:
         """
         "The accessor (required) property for user pass auth backends".
         """
@@ -95,11 +95,11 @@ def notice(self) -> Optional[str]:
 @pulumi.output_type
 class GetBackendConfigEstAuthenticatorResult(dict):
     def __init__(__self__, *,
-                 cert: Optional[Mapping[str, Any]] = None,
-                 userpass: Optional[Mapping[str, Any]] = None):
+                 cert: Optional[Mapping[str, str]] = None,
+                 userpass: Optional[Mapping[str, str]] = None):
         """
-        :param Mapping[str, Any] cert: "The accessor and cert_role properties for cert auth backends".
-        :param Mapping[str, Any] userpass: "The accessor property for user pass auth backends".
+        :param Mapping[str, str] cert: "The accessor and cert_role properties for cert auth backends".
+        :param Mapping[str, str] userpass: "The accessor property for user pass auth backends".
         """
         if cert is not None:
             pulumi.set(__self__, "cert", cert)
@@ -108,7 +108,7 @@ def __init__(__self__, *,
 
     @property
     @pulumi.getter
-    def cert(self) -> Optional[Mapping[str, Any]]:
+    def cert(self) -> Optional[Mapping[str, str]]:
         """
         "The accessor and cert_role properties for cert auth backends".
         """
@@ -116,7 +116,7 @@ def cert(self) -> Optional[Mapping[str, Any]]:
 
     @property
     @pulumi.getter
-    def userpass(self) -> Optional[Mapping[str, Any]]:
+    def userpass(self) -> Optional[Mapping[str, str]]:
         """
         "The accessor property for user pass auth backends".
         """
diff --git a/sdk/python/pulumi_vault/saml/auth_backend_role.py b/sdk/python/pulumi_vault/saml/auth_backend_role.py
index b6ea8bd78..1c75bba51 100644
--- a/sdk/python/pulumi_vault/saml/auth_backend_role.py
+++ b/sdk/python/pulumi_vault/saml/auth_backend_role.py
@@ -15,7 +15,7 @@
 class AuthBackendRoleArgs:
     def __init__(__self__, *,
                  path: pulumi.Input[str],
-                 bound_attributes: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 bound_attributes: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  bound_attributes_type: Optional[pulumi.Input[str]] = None,
                  bound_subjects: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  bound_subjects_type: Optional[pulumi.Input[str]] = None,
@@ -34,7 +34,7 @@ def __init__(__self__, *,
         """
         The set of arguments for constructing a AuthBackendRole resource.
         :param pulumi.Input[str] path: Path where the auth backend is mounted.
-        :param pulumi.Input[Mapping[str, Any]] bound_attributes: Mapping of attribute names to values that are expected to
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] bound_attributes: Mapping of attribute names to values that are expected to
                exist in the SAML assertion.
         :param pulumi.Input[str] bound_attributes_type: The type of matching assertion to perform on
                `bound_attributes_type`.
@@ -105,7 +105,7 @@ def path(self, value: pulumi.Input[str]):
 
     @property
     @pulumi.getter(name="boundAttributes")
-    def bound_attributes(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def bound_attributes(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         Mapping of attribute names to values that are expected to
         exist in the SAML assertion.
@@ -113,7 +113,7 @@ def bound_attributes(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "bound_attributes")
 
     @bound_attributes.setter
-    def bound_attributes(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def bound_attributes(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "bound_attributes", value)
 
     @property
@@ -305,7 +305,7 @@ def token_type(self, value: Optional[pulumi.Input[str]]):
 @pulumi.input_type
 class _AuthBackendRoleState:
     def __init__(__self__, *,
-                 bound_attributes: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 bound_attributes: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  bound_attributes_type: Optional[pulumi.Input[str]] = None,
                  bound_subjects: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  bound_subjects_type: Optional[pulumi.Input[str]] = None,
@@ -324,7 +324,7 @@ def __init__(__self__, *,
                  token_type: Optional[pulumi.Input[str]] = None):
         """
         Input properties used for looking up and filtering AuthBackendRole resources.
-        :param pulumi.Input[Mapping[str, Any]] bound_attributes: Mapping of attribute names to values that are expected to
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] bound_attributes: Mapping of attribute names to values that are expected to
                exist in the SAML assertion.
         :param pulumi.Input[str] bound_attributes_type: The type of matching assertion to perform on
                `bound_attributes_type`.
@@ -385,7 +385,7 @@ def __init__(__self__, *,
 
     @property
     @pulumi.getter(name="boundAttributes")
-    def bound_attributes(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def bound_attributes(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         Mapping of attribute names to values that are expected to
         exist in the SAML assertion.
@@ -393,7 +393,7 @@ def bound_attributes(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "bound_attributes")
 
     @bound_attributes.setter
-    def bound_attributes(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def bound_attributes(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "bound_attributes", value)
 
     @property
@@ -599,7 +599,7 @@ class AuthBackendRole(pulumi.CustomResource):
     def __init__(__self__,
                  resource_name: str,
                  opts: Optional[pulumi.ResourceOptions] = None,
-                 bound_attributes: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 bound_attributes: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  bound_attributes_type: Optional[pulumi.Input[str]] = None,
                  bound_subjects: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  bound_subjects_type: Optional[pulumi.Input[str]] = None,
@@ -656,7 +656,7 @@ def __init__(__self__,
 
         :param str resource_name: The name of the resource.
         :param pulumi.ResourceOptions opts: Options for the resource.
-        :param pulumi.Input[Mapping[str, Any]] bound_attributes: Mapping of attribute names to values that are expected to
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] bound_attributes: Mapping of attribute names to values that are expected to
                exist in the SAML assertion.
         :param pulumi.Input[str] bound_attributes_type: The type of matching assertion to perform on
                `bound_attributes_type`.
@@ -738,7 +738,7 @@ def __init__(__self__, resource_name: str, *args, **kwargs):
     def _internal_init(__self__,
                  resource_name: str,
                  opts: Optional[pulumi.ResourceOptions] = None,
-                 bound_attributes: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 bound_attributes: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  bound_attributes_type: Optional[pulumi.Input[str]] = None,
                  bound_subjects: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                  bound_subjects_type: Optional[pulumi.Input[str]] = None,
@@ -793,7 +793,7 @@ def _internal_init(__self__,
     def get(resource_name: str,
             id: pulumi.Input[str],
             opts: Optional[pulumi.ResourceOptions] = None,
-            bound_attributes: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+            bound_attributes: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
             bound_attributes_type: Optional[pulumi.Input[str]] = None,
             bound_subjects: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
             bound_subjects_type: Optional[pulumi.Input[str]] = None,
@@ -817,7 +817,7 @@ def get(resource_name: str,
         :param str resource_name: The unique name of the resulting resource.
         :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
         :param pulumi.ResourceOptions opts: Options for the resource.
-        :param pulumi.Input[Mapping[str, Any]] bound_attributes: Mapping of attribute names to values that are expected to
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] bound_attributes: Mapping of attribute names to values that are expected to
                exist in the SAML assertion.
         :param pulumi.Input[str] bound_attributes_type: The type of matching assertion to perform on
                `bound_attributes_type`.
@@ -866,7 +866,7 @@ def get(resource_name: str,
 
     @property
     @pulumi.getter(name="boundAttributes")
-    def bound_attributes(self) -> pulumi.Output[Optional[Mapping[str, Any]]]:
+    def bound_attributes(self) -> pulumi.Output[Optional[Mapping[str, str]]]:
         """
         Mapping of attribute names to values that are expected to
         exist in the SAML assertion.
diff --git a/sdk/python/pulumi_vault/secrets/sync_aws_destination.py b/sdk/python/pulumi_vault/secrets/sync_aws_destination.py
index db32dde44..b3932cebb 100644
--- a/sdk/python/pulumi_vault/secrets/sync_aws_destination.py
+++ b/sdk/python/pulumi_vault/secrets/sync_aws_destination.py
@@ -15,7 +15,7 @@
 class SyncAwsDestinationArgs:
     def __init__(__self__, *,
                  access_key_id: Optional[pulumi.Input[str]] = None,
-                 custom_tags: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 custom_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  external_id: Optional[pulumi.Input[str]] = None,
                  granularity: Optional[pulumi.Input[str]] = None,
                  name: Optional[pulumi.Input[str]] = None,
@@ -29,7 +29,7 @@ def __init__(__self__, *,
         :param pulumi.Input[str] access_key_id: Access key id to authenticate against the AWS secrets manager.
                Can be omitted and directly provided to Vault using the `AWS_ACCESS_KEY_ID` environment
                variable.
-        :param pulumi.Input[Mapping[str, Any]] custom_tags: Custom tags to set on the secret managed at the destination.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] custom_tags: Custom tags to set on the secret managed at the destination.
         :param pulumi.Input[str] external_id: Optional extra protection that must match the trust policy granting access to the
                AWS IAM role ARN. We recommend using a different random UUID per destination. The value is generated by users.
                The field is mutable with no special condition, but users must be careful that the new value fits with the trust
@@ -92,14 +92,14 @@ def access_key_id(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter(name="customTags")
-    def custom_tags(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def custom_tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         Custom tags to set on the secret managed at the destination.
         """
         return pulumi.get(self, "custom_tags")
 
     @custom_tags.setter
-    def custom_tags(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def custom_tags(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "custom_tags", value)
 
     @property
@@ -219,7 +219,7 @@ def secret_name_template(self, value: Optional[pulumi.Input[str]]):
 class _SyncAwsDestinationState:
     def __init__(__self__, *,
                  access_key_id: Optional[pulumi.Input[str]] = None,
-                 custom_tags: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 custom_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  external_id: Optional[pulumi.Input[str]] = None,
                  granularity: Optional[pulumi.Input[str]] = None,
                  name: Optional[pulumi.Input[str]] = None,
@@ -234,7 +234,7 @@ def __init__(__self__, *,
         :param pulumi.Input[str] access_key_id: Access key id to authenticate against the AWS secrets manager.
                Can be omitted and directly provided to Vault using the `AWS_ACCESS_KEY_ID` environment
                variable.
-        :param pulumi.Input[Mapping[str, Any]] custom_tags: Custom tags to set on the secret managed at the destination.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] custom_tags: Custom tags to set on the secret managed at the destination.
         :param pulumi.Input[str] external_id: Optional extra protection that must match the trust policy granting access to the
                AWS IAM role ARN. We recommend using a different random UUID per destination. The value is generated by users.
                The field is mutable with no special condition, but users must be careful that the new value fits with the trust
@@ -300,14 +300,14 @@ def access_key_id(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter(name="customTags")
-    def custom_tags(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def custom_tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         Custom tags to set on the secret managed at the destination.
         """
         return pulumi.get(self, "custom_tags")
 
     @custom_tags.setter
-    def custom_tags(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def custom_tags(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "custom_tags", value)
 
     @property
@@ -441,7 +441,7 @@ def __init__(__self__,
                  resource_name: str,
                  opts: Optional[pulumi.ResourceOptions] = None,
                  access_key_id: Optional[pulumi.Input[str]] = None,
-                 custom_tags: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 custom_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  external_id: Optional[pulumi.Input[str]] = None,
                  granularity: Optional[pulumi.Input[str]] = None,
                  name: Optional[pulumi.Input[str]] = None,
@@ -484,7 +484,7 @@ def __init__(__self__,
         :param pulumi.Input[str] access_key_id: Access key id to authenticate against the AWS secrets manager.
                Can be omitted and directly provided to Vault using the `AWS_ACCESS_KEY_ID` environment
                variable.
-        :param pulumi.Input[Mapping[str, Any]] custom_tags: Custom tags to set on the secret managed at the destination.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] custom_tags: Custom tags to set on the secret managed at the destination.
         :param pulumi.Input[str] external_id: Optional extra protection that must match the trust policy granting access to the
                AWS IAM role ARN. We recommend using a different random UUID per destination. The value is generated by users.
                The field is mutable with no special condition, but users must be careful that the new value fits with the trust
@@ -560,7 +560,7 @@ def _internal_init(__self__,
                  resource_name: str,
                  opts: Optional[pulumi.ResourceOptions] = None,
                  access_key_id: Optional[pulumi.Input[str]] = None,
-                 custom_tags: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 custom_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  external_id: Optional[pulumi.Input[str]] = None,
                  granularity: Optional[pulumi.Input[str]] = None,
                  name: Optional[pulumi.Input[str]] = None,
@@ -602,7 +602,7 @@ def get(resource_name: str,
             id: pulumi.Input[str],
             opts: Optional[pulumi.ResourceOptions] = None,
             access_key_id: Optional[pulumi.Input[str]] = None,
-            custom_tags: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+            custom_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
             external_id: Optional[pulumi.Input[str]] = None,
             granularity: Optional[pulumi.Input[str]] = None,
             name: Optional[pulumi.Input[str]] = None,
@@ -622,7 +622,7 @@ def get(resource_name: str,
         :param pulumi.Input[str] access_key_id: Access key id to authenticate against the AWS secrets manager.
                Can be omitted and directly provided to Vault using the `AWS_ACCESS_KEY_ID` environment
                variable.
-        :param pulumi.Input[Mapping[str, Any]] custom_tags: Custom tags to set on the secret managed at the destination.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] custom_tags: Custom tags to set on the secret managed at the destination.
         :param pulumi.Input[str] external_id: Optional extra protection that must match the trust policy granting access to the
                AWS IAM role ARN. We recommend using a different random UUID per destination. The value is generated by users.
                The field is mutable with no special condition, but users must be careful that the new value fits with the trust
@@ -678,7 +678,7 @@ def access_key_id(self) -> pulumi.Output[Optional[str]]:
 
     @property
     @pulumi.getter(name="customTags")
-    def custom_tags(self) -> pulumi.Output[Optional[Mapping[str, Any]]]:
+    def custom_tags(self) -> pulumi.Output[Optional[Mapping[str, str]]]:
         """
         Custom tags to set on the secret managed at the destination.
         """
diff --git a/sdk/python/pulumi_vault/secrets/sync_azure_destination.py b/sdk/python/pulumi_vault/secrets/sync_azure_destination.py
index c4d0f70c8..f2a7a1b59 100644
--- a/sdk/python/pulumi_vault/secrets/sync_azure_destination.py
+++ b/sdk/python/pulumi_vault/secrets/sync_azure_destination.py
@@ -17,7 +17,7 @@ def __init__(__self__, *,
                  client_id: Optional[pulumi.Input[str]] = None,
                  client_secret: Optional[pulumi.Input[str]] = None,
                  cloud: Optional[pulumi.Input[str]] = None,
-                 custom_tags: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 custom_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  granularity: Optional[pulumi.Input[str]] = None,
                  key_vault_uri: Optional[pulumi.Input[str]] = None,
                  name: Optional[pulumi.Input[str]] = None,
@@ -33,7 +33,7 @@ def __init__(__self__, *,
                Can be omitted and directly provided to Vault using the `AZURE_CLIENT_SECRET` environment
                variable.
         :param pulumi.Input[str] cloud: Specifies a cloud for the client. The default is Azure Public Cloud.
-        :param pulumi.Input[Mapping[str, Any]] custom_tags: Custom tags to set on the secret managed at the destination.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] custom_tags: Custom tags to set on the secret managed at the destination.
         :param pulumi.Input[str] granularity: Determines what level of information is synced as a distinct resource
                at the destination. Supports `secret-path` and `secret-key`.
         :param pulumi.Input[str] key_vault_uri: URI of an existing Azure Key Vault instance.
@@ -112,14 +112,14 @@ def cloud(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter(name="customTags")
-    def custom_tags(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def custom_tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         Custom tags to set on the secret managed at the destination.
         """
         return pulumi.get(self, "custom_tags")
 
     @custom_tags.setter
-    def custom_tags(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def custom_tags(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "custom_tags", value)
 
     @property
@@ -209,7 +209,7 @@ def __init__(__self__, *,
                  client_id: Optional[pulumi.Input[str]] = None,
                  client_secret: Optional[pulumi.Input[str]] = None,
                  cloud: Optional[pulumi.Input[str]] = None,
-                 custom_tags: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 custom_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  granularity: Optional[pulumi.Input[str]] = None,
                  key_vault_uri: Optional[pulumi.Input[str]] = None,
                  name: Optional[pulumi.Input[str]] = None,
@@ -226,7 +226,7 @@ def __init__(__self__, *,
                Can be omitted and directly provided to Vault using the `AZURE_CLIENT_SECRET` environment
                variable.
         :param pulumi.Input[str] cloud: Specifies a cloud for the client. The default is Azure Public Cloud.
-        :param pulumi.Input[Mapping[str, Any]] custom_tags: Custom tags to set on the secret managed at the destination.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] custom_tags: Custom tags to set on the secret managed at the destination.
         :param pulumi.Input[str] granularity: Determines what level of information is synced as a distinct resource
                at the destination. Supports `secret-path` and `secret-key`.
         :param pulumi.Input[str] key_vault_uri: URI of an existing Azure Key Vault instance.
@@ -308,14 +308,14 @@ def cloud(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter(name="customTags")
-    def custom_tags(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def custom_tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         Custom tags to set on the secret managed at the destination.
         """
         return pulumi.get(self, "custom_tags")
 
     @custom_tags.setter
-    def custom_tags(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def custom_tags(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "custom_tags", value)
 
     @property
@@ -419,7 +419,7 @@ def __init__(__self__,
                  client_id: Optional[pulumi.Input[str]] = None,
                  client_secret: Optional[pulumi.Input[str]] = None,
                  cloud: Optional[pulumi.Input[str]] = None,
-                 custom_tags: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 custom_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  granularity: Optional[pulumi.Input[str]] = None,
                  key_vault_uri: Optional[pulumi.Input[str]] = None,
                  name: Optional[pulumi.Input[str]] = None,
@@ -463,7 +463,7 @@ def __init__(__self__,
                Can be omitted and directly provided to Vault using the `AZURE_CLIENT_SECRET` environment
                variable.
         :param pulumi.Input[str] cloud: Specifies a cloud for the client. The default is Azure Public Cloud.
-        :param pulumi.Input[Mapping[str, Any]] custom_tags: Custom tags to set on the secret managed at the destination.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] custom_tags: Custom tags to set on the secret managed at the destination.
         :param pulumi.Input[str] granularity: Determines what level of information is synced as a distinct resource
                at the destination. Supports `secret-path` and `secret-key`.
         :param pulumi.Input[str] key_vault_uri: URI of an existing Azure Key Vault instance.
@@ -530,7 +530,7 @@ def _internal_init(__self__,
                  client_id: Optional[pulumi.Input[str]] = None,
                  client_secret: Optional[pulumi.Input[str]] = None,
                  cloud: Optional[pulumi.Input[str]] = None,
-                 custom_tags: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 custom_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  granularity: Optional[pulumi.Input[str]] = None,
                  key_vault_uri: Optional[pulumi.Input[str]] = None,
                  name: Optional[pulumi.Input[str]] = None,
@@ -572,7 +572,7 @@ def get(resource_name: str,
             client_id: Optional[pulumi.Input[str]] = None,
             client_secret: Optional[pulumi.Input[str]] = None,
             cloud: Optional[pulumi.Input[str]] = None,
-            custom_tags: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+            custom_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
             granularity: Optional[pulumi.Input[str]] = None,
             key_vault_uri: Optional[pulumi.Input[str]] = None,
             name: Optional[pulumi.Input[str]] = None,
@@ -594,7 +594,7 @@ def get(resource_name: str,
                Can be omitted and directly provided to Vault using the `AZURE_CLIENT_SECRET` environment
                variable.
         :param pulumi.Input[str] cloud: Specifies a cloud for the client. The default is Azure Public Cloud.
-        :param pulumi.Input[Mapping[str, Any]] custom_tags: Custom tags to set on the secret managed at the destination.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] custom_tags: Custom tags to set on the secret managed at the destination.
         :param pulumi.Input[str] granularity: Determines what level of information is synced as a distinct resource
                at the destination. Supports `secret-path` and `secret-key`.
         :param pulumi.Input[str] key_vault_uri: URI of an existing Azure Key Vault instance.
@@ -658,7 +658,7 @@ def cloud(self) -> pulumi.Output[Optional[str]]:
 
     @property
     @pulumi.getter(name="customTags")
-    def custom_tags(self) -> pulumi.Output[Optional[Mapping[str, Any]]]:
+    def custom_tags(self) -> pulumi.Output[Optional[Mapping[str, str]]]:
         """
         Custom tags to set on the secret managed at the destination.
         """
diff --git a/sdk/python/pulumi_vault/secrets/sync_gcp_destination.py b/sdk/python/pulumi_vault/secrets/sync_gcp_destination.py
index 83c8a3531..cc2aa025e 100644
--- a/sdk/python/pulumi_vault/secrets/sync_gcp_destination.py
+++ b/sdk/python/pulumi_vault/secrets/sync_gcp_destination.py
@@ -15,7 +15,7 @@
 class SyncGcpDestinationArgs:
     def __init__(__self__, *,
                  credentials: Optional[pulumi.Input[str]] = None,
-                 custom_tags: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 custom_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  granularity: Optional[pulumi.Input[str]] = None,
                  name: Optional[pulumi.Input[str]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
@@ -26,7 +26,7 @@ def __init__(__self__, *,
         :param pulumi.Input[str] credentials: JSON-encoded credentials to use to connect to GCP.
                Can be omitted and directly provided to Vault using the `GOOGLE_APPLICATION_CREDENTIALS` environment
                variable.
-        :param pulumi.Input[Mapping[str, Any]] custom_tags: Custom tags to set on the secret managed at the destination.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] custom_tags: Custom tags to set on the secret managed at the destination.
         :param pulumi.Input[str] granularity: Determines what level of information is synced as a distinct resource
                at the destination. Supports `secret-path` and `secret-key`.
         :param pulumi.Input[str] name: Unique name of the GCP destination.
@@ -71,14 +71,14 @@ def credentials(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter(name="customTags")
-    def custom_tags(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def custom_tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         Custom tags to set on the secret managed at the destination.
         """
         return pulumi.get(self, "custom_tags")
 
     @custom_tags.setter
-    def custom_tags(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def custom_tags(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "custom_tags", value)
 
     @property
@@ -153,7 +153,7 @@ def secret_name_template(self, value: Optional[pulumi.Input[str]]):
 class _SyncGcpDestinationState:
     def __init__(__self__, *,
                  credentials: Optional[pulumi.Input[str]] = None,
-                 custom_tags: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 custom_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  granularity: Optional[pulumi.Input[str]] = None,
                  name: Optional[pulumi.Input[str]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
@@ -165,7 +165,7 @@ def __init__(__self__, *,
         :param pulumi.Input[str] credentials: JSON-encoded credentials to use to connect to GCP.
                Can be omitted and directly provided to Vault using the `GOOGLE_APPLICATION_CREDENTIALS` environment
                variable.
-        :param pulumi.Input[Mapping[str, Any]] custom_tags: Custom tags to set on the secret managed at the destination.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] custom_tags: Custom tags to set on the secret managed at the destination.
         :param pulumi.Input[str] granularity: Determines what level of information is synced as a distinct resource
                at the destination. Supports `secret-path` and `secret-key`.
         :param pulumi.Input[str] name: Unique name of the GCP destination.
@@ -213,14 +213,14 @@ def credentials(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter(name="customTags")
-    def custom_tags(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def custom_tags(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         Custom tags to set on the secret managed at the destination.
         """
         return pulumi.get(self, "custom_tags")
 
     @custom_tags.setter
-    def custom_tags(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def custom_tags(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "custom_tags", value)
 
     @property
@@ -309,7 +309,7 @@ def __init__(__self__,
                  resource_name: str,
                  opts: Optional[pulumi.ResourceOptions] = None,
                  credentials: Optional[pulumi.Input[str]] = None,
-                 custom_tags: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 custom_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  granularity: Optional[pulumi.Input[str]] = None,
                  name: Optional[pulumi.Input[str]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
@@ -347,7 +347,7 @@ def __init__(__self__,
         :param pulumi.Input[str] credentials: JSON-encoded credentials to use to connect to GCP.
                Can be omitted and directly provided to Vault using the `GOOGLE_APPLICATION_CREDENTIALS` environment
                variable.
-        :param pulumi.Input[Mapping[str, Any]] custom_tags: Custom tags to set on the secret managed at the destination.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] custom_tags: Custom tags to set on the secret managed at the destination.
         :param pulumi.Input[str] granularity: Determines what level of information is synced as a distinct resource
                at the destination. Supports `secret-path` and `secret-key`.
         :param pulumi.Input[str] name: Unique name of the GCP destination.
@@ -409,7 +409,7 @@ def _internal_init(__self__,
                  resource_name: str,
                  opts: Optional[pulumi.ResourceOptions] = None,
                  credentials: Optional[pulumi.Input[str]] = None,
-                 custom_tags: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 custom_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  granularity: Optional[pulumi.Input[str]] = None,
                  name: Optional[pulumi.Input[str]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
@@ -445,7 +445,7 @@ def get(resource_name: str,
             id: pulumi.Input[str],
             opts: Optional[pulumi.ResourceOptions] = None,
             credentials: Optional[pulumi.Input[str]] = None,
-            custom_tags: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+            custom_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
             granularity: Optional[pulumi.Input[str]] = None,
             name: Optional[pulumi.Input[str]] = None,
             namespace: Optional[pulumi.Input[str]] = None,
@@ -462,7 +462,7 @@ def get(resource_name: str,
         :param pulumi.Input[str] credentials: JSON-encoded credentials to use to connect to GCP.
                Can be omitted and directly provided to Vault using the `GOOGLE_APPLICATION_CREDENTIALS` environment
                variable.
-        :param pulumi.Input[Mapping[str, Any]] custom_tags: Custom tags to set on the secret managed at the destination.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] custom_tags: Custom tags to set on the secret managed at the destination.
         :param pulumi.Input[str] granularity: Determines what level of information is synced as a distinct resource
                at the destination. Supports `secret-path` and `secret-key`.
         :param pulumi.Input[str] name: Unique name of the GCP destination.
@@ -503,7 +503,7 @@ def credentials(self) -> pulumi.Output[Optional[str]]:
 
     @property
     @pulumi.getter(name="customTags")
-    def custom_tags(self) -> pulumi.Output[Optional[Mapping[str, Any]]]:
+    def custom_tags(self) -> pulumi.Output[Optional[Mapping[str, str]]]:
         """
         Custom tags to set on the secret managed at the destination.
         """
diff --git a/sdk/python/pulumi_vault/ssh/secret_backend_role.py b/sdk/python/pulumi_vault/ssh/secret_backend_role.py
index 0a304f099..73e14b723 100644
--- a/sdk/python/pulumi_vault/ssh/secret_backend_role.py
+++ b/sdk/python/pulumi_vault/ssh/secret_backend_role.py
@@ -32,8 +32,8 @@ def __init__(__self__, *,
                  allowed_users: Optional[pulumi.Input[str]] = None,
                  allowed_users_template: Optional[pulumi.Input[bool]] = None,
                  cidr_list: Optional[pulumi.Input[str]] = None,
-                 default_critical_options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
-                 default_extensions: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 default_critical_options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
+                 default_extensions: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  default_user: Optional[pulumi.Input[str]] = None,
                  default_user_template: Optional[pulumi.Input[bool]] = None,
                  key_id_format: Optional[pulumi.Input[str]] = None,
@@ -63,8 +63,8 @@ def __init__(__self__, *,
         :param pulumi.Input[str] allowed_users: Specifies a comma-separated list of usernames that are to be allowed, only if certain usernames are to be allowed.
         :param pulumi.Input[bool] allowed_users_template: Specifies if `allowed_users` can be declared using identity template policies. Non-templated users are also permitted.
         :param pulumi.Input[str] cidr_list: The comma-separated string of CIDR blocks for which this role is applicable.
-        :param pulumi.Input[Mapping[str, Any]] default_critical_options: Specifies a map of critical options that certificates have when signed.
-        :param pulumi.Input[Mapping[str, Any]] default_extensions: Specifies a map of extensions that certificates have when signed.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] default_critical_options: Specifies a map of critical options that certificates have when signed.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] default_extensions: Specifies a map of extensions that certificates have when signed.
         :param pulumi.Input[str] default_user: Specifies the default username for which a credential will be generated.
         :param pulumi.Input[bool] default_user_template: If set, `default_users` can be specified using identity template values. A non-templated user is also permitted.
         :param pulumi.Input[str] key_id_format: Specifies a custom format for the key id of a signed certificate.
@@ -325,26 +325,26 @@ def cidr_list(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter(name="defaultCriticalOptions")
-    def default_critical_options(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def default_critical_options(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         Specifies a map of critical options that certificates have when signed.
         """
         return pulumi.get(self, "default_critical_options")
 
     @default_critical_options.setter
-    def default_critical_options(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def default_critical_options(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "default_critical_options", value)
 
     @property
     @pulumi.getter(name="defaultExtensions")
-    def default_extensions(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def default_extensions(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         Specifies a map of extensions that certificates have when signed.
         """
         return pulumi.get(self, "default_extensions")
 
     @default_extensions.setter
-    def default_extensions(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def default_extensions(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "default_extensions", value)
 
     @property
@@ -465,8 +465,8 @@ def __init__(__self__, *,
                  allowed_users_template: Optional[pulumi.Input[bool]] = None,
                  backend: Optional[pulumi.Input[str]] = None,
                  cidr_list: Optional[pulumi.Input[str]] = None,
-                 default_critical_options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
-                 default_extensions: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 default_critical_options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
+                 default_extensions: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  default_user: Optional[pulumi.Input[str]] = None,
                  default_user_template: Optional[pulumi.Input[bool]] = None,
                  key_id_format: Optional[pulumi.Input[str]] = None,
@@ -496,8 +496,8 @@ def __init__(__self__, *,
         :param pulumi.Input[bool] allowed_users_template: Specifies if `allowed_users` can be declared using identity template policies. Non-templated users are also permitted.
         :param pulumi.Input[str] backend: The path where the SSH secret backend is mounted.
         :param pulumi.Input[str] cidr_list: The comma-separated string of CIDR blocks for which this role is applicable.
-        :param pulumi.Input[Mapping[str, Any]] default_critical_options: Specifies a map of critical options that certificates have when signed.
-        :param pulumi.Input[Mapping[str, Any]] default_extensions: Specifies a map of extensions that certificates have when signed.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] default_critical_options: Specifies a map of critical options that certificates have when signed.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] default_extensions: Specifies a map of extensions that certificates have when signed.
         :param pulumi.Input[str] default_user: Specifies the default username for which a credential will be generated.
         :param pulumi.Input[bool] default_user_template: If set, `default_users` can be specified using identity template values. A non-templated user is also permitted.
         :param pulumi.Input[str] key_id_format: Specifies a custom format for the key id of a signed certificate.
@@ -749,26 +749,26 @@ def cidr_list(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter(name="defaultCriticalOptions")
-    def default_critical_options(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def default_critical_options(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         Specifies a map of critical options that certificates have when signed.
         """
         return pulumi.get(self, "default_critical_options")
 
     @default_critical_options.setter
-    def default_critical_options(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def default_critical_options(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "default_critical_options", value)
 
     @property
     @pulumi.getter(name="defaultExtensions")
-    def default_extensions(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def default_extensions(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         Specifies a map of extensions that certificates have when signed.
         """
         return pulumi.get(self, "default_extensions")
 
     @default_extensions.setter
-    def default_extensions(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def default_extensions(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "default_extensions", value)
 
     @property
@@ -903,8 +903,8 @@ def __init__(__self__,
                  allowed_users_template: Optional[pulumi.Input[bool]] = None,
                  backend: Optional[pulumi.Input[str]] = None,
                  cidr_list: Optional[pulumi.Input[str]] = None,
-                 default_critical_options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
-                 default_extensions: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 default_critical_options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
+                 default_extensions: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  default_user: Optional[pulumi.Input[str]] = None,
                  default_user_template: Optional[pulumi.Input[bool]] = None,
                  key_id_format: Optional[pulumi.Input[str]] = None,
@@ -968,8 +968,8 @@ def __init__(__self__,
         :param pulumi.Input[bool] allowed_users_template: Specifies if `allowed_users` can be declared using identity template policies. Non-templated users are also permitted.
         :param pulumi.Input[str] backend: The path where the SSH secret backend is mounted.
         :param pulumi.Input[str] cidr_list: The comma-separated string of CIDR blocks for which this role is applicable.
-        :param pulumi.Input[Mapping[str, Any]] default_critical_options: Specifies a map of critical options that certificates have when signed.
-        :param pulumi.Input[Mapping[str, Any]] default_extensions: Specifies a map of extensions that certificates have when signed.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] default_critical_options: Specifies a map of critical options that certificates have when signed.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] default_extensions: Specifies a map of extensions that certificates have when signed.
         :param pulumi.Input[str] default_user: Specifies the default username for which a credential will be generated.
         :param pulumi.Input[bool] default_user_template: If set, `default_users` can be specified using identity template values. A non-templated user is also permitted.
         :param pulumi.Input[str] key_id_format: Specifies a custom format for the key id of a signed certificate.
@@ -1052,8 +1052,8 @@ def _internal_init(__self__,
                  allowed_users_template: Optional[pulumi.Input[bool]] = None,
                  backend: Optional[pulumi.Input[str]] = None,
                  cidr_list: Optional[pulumi.Input[str]] = None,
-                 default_critical_options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
-                 default_extensions: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 default_critical_options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
+                 default_extensions: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  default_user: Optional[pulumi.Input[str]] = None,
                  default_user_template: Optional[pulumi.Input[bool]] = None,
                  key_id_format: Optional[pulumi.Input[str]] = None,
@@ -1127,8 +1127,8 @@ def get(resource_name: str,
             allowed_users_template: Optional[pulumi.Input[bool]] = None,
             backend: Optional[pulumi.Input[str]] = None,
             cidr_list: Optional[pulumi.Input[str]] = None,
-            default_critical_options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
-            default_extensions: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+            default_critical_options: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
+            default_extensions: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
             default_user: Optional[pulumi.Input[str]] = None,
             default_user_template: Optional[pulumi.Input[bool]] = None,
             key_id_format: Optional[pulumi.Input[str]] = None,
@@ -1163,8 +1163,8 @@ def get(resource_name: str,
         :param pulumi.Input[bool] allowed_users_template: Specifies if `allowed_users` can be declared using identity template policies. Non-templated users are also permitted.
         :param pulumi.Input[str] backend: The path where the SSH secret backend is mounted.
         :param pulumi.Input[str] cidr_list: The comma-separated string of CIDR blocks for which this role is applicable.
-        :param pulumi.Input[Mapping[str, Any]] default_critical_options: Specifies a map of critical options that certificates have when signed.
-        :param pulumi.Input[Mapping[str, Any]] default_extensions: Specifies a map of extensions that certificates have when signed.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] default_critical_options: Specifies a map of critical options that certificates have when signed.
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] default_extensions: Specifies a map of extensions that certificates have when signed.
         :param pulumi.Input[str] default_user: Specifies the default username for which a credential will be generated.
         :param pulumi.Input[bool] default_user_template: If set, `default_users` can be specified using identity template values. A non-templated user is also permitted.
         :param pulumi.Input[str] key_id_format: Specifies a custom format for the key id of a signed certificate.
@@ -1335,7 +1335,7 @@ def cidr_list(self) -> pulumi.Output[Optional[str]]:
 
     @property
     @pulumi.getter(name="defaultCriticalOptions")
-    def default_critical_options(self) -> pulumi.Output[Optional[Mapping[str, Any]]]:
+    def default_critical_options(self) -> pulumi.Output[Optional[Mapping[str, str]]]:
         """
         Specifies a map of critical options that certificates have when signed.
         """
@@ -1343,7 +1343,7 @@ def default_critical_options(self) -> pulumi.Output[Optional[Mapping[str, Any]]]
 
     @property
     @pulumi.getter(name="defaultExtensions")
-    def default_extensions(self) -> pulumi.Output[Optional[Mapping[str, Any]]]:
+    def default_extensions(self) -> pulumi.Output[Optional[Mapping[str, str]]]:
         """
         Specifies a map of extensions that certificates have when signed.
         """
diff --git a/sdk/python/pulumi_vault/transform/get_decode.py b/sdk/python/pulumi_vault/transform/get_decode.py
index 23ca90f47..8a80a3427 100644
--- a/sdk/python/pulumi_vault/transform/get_decode.py
+++ b/sdk/python/pulumi_vault/transform/get_decode.py
@@ -55,12 +55,12 @@ def __init__(__self__, batch_inputs=None, batch_results=None, decoded_value=None
 
     @property
     @pulumi.getter(name="batchInputs")
-    def batch_inputs(self) -> Optional[Sequence[Mapping[str, Any]]]:
+    def batch_inputs(self) -> Optional[Sequence[Mapping[str, str]]]:
         return pulumi.get(self, "batch_inputs")
 
     @property
     @pulumi.getter(name="batchResults")
-    def batch_results(self) -> Sequence[Mapping[str, Any]]:
+    def batch_results(self) -> Sequence[Mapping[str, str]]:
         return pulumi.get(self, "batch_results")
 
     @property
@@ -125,8 +125,8 @@ def __await__(self):
             value=self.value)
 
 
-def get_decode(batch_inputs: Optional[Sequence[Mapping[str, Any]]] = None,
-               batch_results: Optional[Sequence[Mapping[str, Any]]] = None,
+def get_decode(batch_inputs: Optional[Sequence[Mapping[str, str]]] = None,
+               batch_results: Optional[Sequence[Mapping[str, str]]] = None,
                decoded_value: Optional[str] = None,
                namespace: Optional[str] = None,
                path: Optional[str] = None,
@@ -166,8 +166,8 @@ def get_decode(batch_inputs: Optional[Sequence[Mapping[str, Any]]] = None,
     ```
 
 
-    :param Sequence[Mapping[str, Any]] batch_inputs: Specifies a list of items to be decoded in a single batch. If this parameter is set, the top-level parameters 'value', 'transformation' and 'tweak' will be ignored. Each batch item within the list can specify these parameters instead.
-    :param Sequence[Mapping[str, Any]] batch_results: The result of decoding a batch.
+    :param Sequence[Mapping[str, str]] batch_inputs: Specifies a list of items to be decoded in a single batch. If this parameter is set, the top-level parameters 'value', 'transformation' and 'tweak' will be ignored. Each batch item within the list can specify these parameters instead.
+    :param Sequence[Mapping[str, str]] batch_results: The result of decoding a batch.
     :param str decoded_value: The result of decoding a value.
     :param str namespace: The namespace of the target resource.
            The value should not contain leading or trailing forward slashes.
@@ -206,8 +206,8 @@ def get_decode(batch_inputs: Optional[Sequence[Mapping[str, Any]]] = None,
 
 
 @_utilities.lift_output_func(get_decode)
-def get_decode_output(batch_inputs: Optional[pulumi.Input[Optional[Sequence[Mapping[str, Any]]]]] = None,
-                      batch_results: Optional[pulumi.Input[Optional[Sequence[Mapping[str, Any]]]]] = None,
+def get_decode_output(batch_inputs: Optional[pulumi.Input[Optional[Sequence[Mapping[str, str]]]]] = None,
+                      batch_results: Optional[pulumi.Input[Optional[Sequence[Mapping[str, str]]]]] = None,
                       decoded_value: Optional[pulumi.Input[Optional[str]]] = None,
                       namespace: Optional[pulumi.Input[Optional[str]]] = None,
                       path: Optional[pulumi.Input[str]] = None,
@@ -247,8 +247,8 @@ def get_decode_output(batch_inputs: Optional[pulumi.Input[Optional[Sequence[Mapp
     ```
 
 
-    :param Sequence[Mapping[str, Any]] batch_inputs: Specifies a list of items to be decoded in a single batch. If this parameter is set, the top-level parameters 'value', 'transformation' and 'tweak' will be ignored. Each batch item within the list can specify these parameters instead.
-    :param Sequence[Mapping[str, Any]] batch_results: The result of decoding a batch.
+    :param Sequence[Mapping[str, str]] batch_inputs: Specifies a list of items to be decoded in a single batch. If this parameter is set, the top-level parameters 'value', 'transformation' and 'tweak' will be ignored. Each batch item within the list can specify these parameters instead.
+    :param Sequence[Mapping[str, str]] batch_results: The result of decoding a batch.
     :param str decoded_value: The result of decoding a value.
     :param str namespace: The namespace of the target resource.
            The value should not contain leading or trailing forward slashes.
diff --git a/sdk/python/pulumi_vault/transform/get_encode.py b/sdk/python/pulumi_vault/transform/get_encode.py
index 4d56c367e..ea68adac4 100644
--- a/sdk/python/pulumi_vault/transform/get_encode.py
+++ b/sdk/python/pulumi_vault/transform/get_encode.py
@@ -55,12 +55,12 @@ def __init__(__self__, batch_inputs=None, batch_results=None, encoded_value=None
 
     @property
     @pulumi.getter(name="batchInputs")
-    def batch_inputs(self) -> Optional[Sequence[Mapping[str, Any]]]:
+    def batch_inputs(self) -> Optional[Sequence[Mapping[str, str]]]:
         return pulumi.get(self, "batch_inputs")
 
     @property
     @pulumi.getter(name="batchResults")
-    def batch_results(self) -> Sequence[Mapping[str, Any]]:
+    def batch_results(self) -> Sequence[Mapping[str, str]]:
         return pulumi.get(self, "batch_results")
 
     @property
@@ -125,8 +125,8 @@ def __await__(self):
             value=self.value)
 
 
-def get_encode(batch_inputs: Optional[Sequence[Mapping[str, Any]]] = None,
-               batch_results: Optional[Sequence[Mapping[str, Any]]] = None,
+def get_encode(batch_inputs: Optional[Sequence[Mapping[str, str]]] = None,
+               batch_results: Optional[Sequence[Mapping[str, str]]] = None,
                encoded_value: Optional[str] = None,
                namespace: Optional[str] = None,
                path: Optional[str] = None,
@@ -168,8 +168,8 @@ def get_encode(batch_inputs: Optional[Sequence[Mapping[str, Any]]] = None,
     ```
 
 
-    :param Sequence[Mapping[str, Any]] batch_inputs: Specifies a list of items to be encoded in a single batch. If this parameter is set, the parameters 'value', 'transformation' and 'tweak' will be ignored. Each batch item within the list can specify these parameters instead.
-    :param Sequence[Mapping[str, Any]] batch_results: The result of encoding a batch.
+    :param Sequence[Mapping[str, str]] batch_inputs: Specifies a list of items to be encoded in a single batch. If this parameter is set, the parameters 'value', 'transformation' and 'tweak' will be ignored. Each batch item within the list can specify these parameters instead.
+    :param Sequence[Mapping[str, str]] batch_results: The result of encoding a batch.
     :param str encoded_value: The result of encoding a value.
     :param str namespace: The namespace of the target resource.
            The value should not contain leading or trailing forward slashes.
@@ -208,8 +208,8 @@ def get_encode(batch_inputs: Optional[Sequence[Mapping[str, Any]]] = None,
 
 
 @_utilities.lift_output_func(get_encode)
-def get_encode_output(batch_inputs: Optional[pulumi.Input[Optional[Sequence[Mapping[str, Any]]]]] = None,
-                      batch_results: Optional[pulumi.Input[Optional[Sequence[Mapping[str, Any]]]]] = None,
+def get_encode_output(batch_inputs: Optional[pulumi.Input[Optional[Sequence[Mapping[str, str]]]]] = None,
+                      batch_results: Optional[pulumi.Input[Optional[Sequence[Mapping[str, str]]]]] = None,
                       encoded_value: Optional[pulumi.Input[Optional[str]]] = None,
                       namespace: Optional[pulumi.Input[Optional[str]]] = None,
                       path: Optional[pulumi.Input[str]] = None,
@@ -251,8 +251,8 @@ def get_encode_output(batch_inputs: Optional[pulumi.Input[Optional[Sequence[Mapp
     ```
 
 
-    :param Sequence[Mapping[str, Any]] batch_inputs: Specifies a list of items to be encoded in a single batch. If this parameter is set, the parameters 'value', 'transformation' and 'tweak' will be ignored. Each batch item within the list can specify these parameters instead.
-    :param Sequence[Mapping[str, Any]] batch_results: The result of encoding a batch.
+    :param Sequence[Mapping[str, str]] batch_inputs: Specifies a list of items to be encoded in a single batch. If this parameter is set, the parameters 'value', 'transformation' and 'tweak' will be ignored. Each batch item within the list can specify these parameters instead.
+    :param Sequence[Mapping[str, str]] batch_results: The result of encoding a batch.
     :param str encoded_value: The result of encoding a value.
     :param str namespace: The namespace of the target resource.
            The value should not contain leading or trailing forward slashes.
diff --git a/sdk/python/pulumi_vault/transform/template.py b/sdk/python/pulumi_vault/transform/template.py
index 9061d029e..f7160d90a 100644
--- a/sdk/python/pulumi_vault/transform/template.py
+++ b/sdk/python/pulumi_vault/transform/template.py
@@ -16,7 +16,7 @@ class TemplateArgs:
     def __init__(__self__, *,
                  path: pulumi.Input[str],
                  alphabet: Optional[pulumi.Input[str]] = None,
-                 decode_formats: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 decode_formats: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  encode_format: Optional[pulumi.Input[str]] = None,
                  name: Optional[pulumi.Input[str]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
@@ -26,7 +26,7 @@ def __init__(__self__, *,
         The set of arguments for constructing a Template resource.
         :param pulumi.Input[str] path: Path to where the back-end is mounted within Vault.
         :param pulumi.Input[str] alphabet: The alphabet to use for this template. This is only used during FPE transformations.
-        :param pulumi.Input[Mapping[str, Any]] decode_formats: Optional mapping of name to regular expression template, used to customize
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] decode_formats: Optional mapping of name to regular expression template, used to customize
                the decoded output. (requires Vault Enterprise 1.9+)
         :param pulumi.Input[str] encode_format: The regular expression template used to format encoded values.
                (requires Vault Enterprise 1.9+)
@@ -80,7 +80,7 @@ def alphabet(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter(name="decodeFormats")
-    def decode_formats(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def decode_formats(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         Optional mapping of name to regular expression template, used to customize
         the decoded output. (requires Vault Enterprise 1.9+)
@@ -88,7 +88,7 @@ def decode_formats(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "decode_formats")
 
     @decode_formats.setter
-    def decode_formats(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def decode_formats(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "decode_formats", value)
 
     @property
@@ -160,7 +160,7 @@ def type(self, value: Optional[pulumi.Input[str]]):
 class _TemplateState:
     def __init__(__self__, *,
                  alphabet: Optional[pulumi.Input[str]] = None,
-                 decode_formats: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 decode_formats: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  encode_format: Optional[pulumi.Input[str]] = None,
                  name: Optional[pulumi.Input[str]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
@@ -170,7 +170,7 @@ def __init__(__self__, *,
         """
         Input properties used for looking up and filtering Template resources.
         :param pulumi.Input[str] alphabet: The alphabet to use for this template. This is only used during FPE transformations.
-        :param pulumi.Input[Mapping[str, Any]] decode_formats: Optional mapping of name to regular expression template, used to customize
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] decode_formats: Optional mapping of name to regular expression template, used to customize
                the decoded output. (requires Vault Enterprise 1.9+)
         :param pulumi.Input[str] encode_format: The regular expression template used to format encoded values.
                (requires Vault Enterprise 1.9+)
@@ -214,7 +214,7 @@ def alphabet(self, value: Optional[pulumi.Input[str]]):
 
     @property
     @pulumi.getter(name="decodeFormats")
-    def decode_formats(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
+    def decode_formats(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
         """
         Optional mapping of name to regular expression template, used to customize
         the decoded output. (requires Vault Enterprise 1.9+)
@@ -222,7 +222,7 @@ def decode_formats(self) -> Optional[pulumi.Input[Mapping[str, Any]]]:
         return pulumi.get(self, "decode_formats")
 
     @decode_formats.setter
-    def decode_formats(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
+    def decode_formats(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]):
         pulumi.set(self, "decode_formats", value)
 
     @property
@@ -308,7 +308,7 @@ def __init__(__self__,
                  resource_name: str,
                  opts: Optional[pulumi.ResourceOptions] = None,
                  alphabet: Optional[pulumi.Input[str]] = None,
-                 decode_formats: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 decode_formats: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  encode_format: Optional[pulumi.Input[str]] = None,
                  name: Optional[pulumi.Input[str]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
@@ -360,7 +360,7 @@ def __init__(__self__,
         :param str resource_name: The name of the resource.
         :param pulumi.ResourceOptions opts: Options for the resource.
         :param pulumi.Input[str] alphabet: The alphabet to use for this template. This is only used during FPE transformations.
-        :param pulumi.Input[Mapping[str, Any]] decode_formats: Optional mapping of name to regular expression template, used to customize
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] decode_formats: Optional mapping of name to regular expression template, used to customize
                the decoded output. (requires Vault Enterprise 1.9+)
         :param pulumi.Input[str] encode_format: The regular expression template used to format encoded values.
                (requires Vault Enterprise 1.9+)
@@ -436,7 +436,7 @@ def _internal_init(__self__,
                  resource_name: str,
                  opts: Optional[pulumi.ResourceOptions] = None,
                  alphabet: Optional[pulumi.Input[str]] = None,
-                 decode_formats: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+                 decode_formats: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
                  encode_format: Optional[pulumi.Input[str]] = None,
                  name: Optional[pulumi.Input[str]] = None,
                  namespace: Optional[pulumi.Input[str]] = None,
@@ -473,7 +473,7 @@ def get(resource_name: str,
             id: pulumi.Input[str],
             opts: Optional[pulumi.ResourceOptions] = None,
             alphabet: Optional[pulumi.Input[str]] = None,
-            decode_formats: Optional[pulumi.Input[Mapping[str, Any]]] = None,
+            decode_formats: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
             encode_format: Optional[pulumi.Input[str]] = None,
             name: Optional[pulumi.Input[str]] = None,
             namespace: Optional[pulumi.Input[str]] = None,
@@ -488,7 +488,7 @@ def get(resource_name: str,
         :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
         :param pulumi.ResourceOptions opts: Options for the resource.
         :param pulumi.Input[str] alphabet: The alphabet to use for this template. This is only used during FPE transformations.
-        :param pulumi.Input[Mapping[str, Any]] decode_formats: Optional mapping of name to regular expression template, used to customize
+        :param pulumi.Input[Mapping[str, pulumi.Input[str]]] decode_formats: Optional mapping of name to regular expression template, used to customize
                the decoded output. (requires Vault Enterprise 1.9+)
         :param pulumi.Input[str] encode_format: The regular expression template used to format encoded values.
                (requires Vault Enterprise 1.9+)
@@ -525,7 +525,7 @@ def alphabet(self) -> pulumi.Output[Optional[str]]:
 
     @property
     @pulumi.getter(name="decodeFormats")
-    def decode_formats(self) -> pulumi.Output[Optional[Mapping[str, Any]]]:
+    def decode_formats(self) -> pulumi.Output[Optional[Mapping[str, str]]]:
         """
         Optional mapping of name to regular expression template, used to customize
         the decoded output. (requires Vault Enterprise 1.9+)
diff --git a/sdk/python/pulumi_vault/transit/secret_backend_key.py b/sdk/python/pulumi_vault/transit/secret_backend_key.py
index 174ffb622..94ad0cc90 100644
--- a/sdk/python/pulumi_vault/transit/secret_backend_key.py
+++ b/sdk/python/pulumi_vault/transit/secret_backend_key.py
@@ -249,7 +249,7 @@ def __init__(__self__, *,
                  derived: Optional[pulumi.Input[bool]] = None,
                  exportable: Optional[pulumi.Input[bool]] = None,
                  key_size: Optional[pulumi.Input[int]] = None,
-                 keys: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, Any]]]]] = None,
+                 keys: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[str]]]]]] = None,
                  latest_version: Optional[pulumi.Input[int]] = None,
                  min_available_version: Optional[pulumi.Input[int]] = None,
                  min_decryption_version: Optional[pulumi.Input[int]] = None,
@@ -273,7 +273,7 @@ def __init__(__self__, *,
         :param pulumi.Input[bool] derived: Specifies if key derivation is to be used. If enabled, all encrypt/decrypt requests to this key must provide a context which is used for key derivation.
         :param pulumi.Input[bool] exportable: Enables keys to be exportable. This allows for all valid private keys in the keyring to be exported. Once set, this cannot be disabled.
         :param pulumi.Input[int] key_size: The key size in bytes for algorithms that allow variable key sizes. Currently only applicable to HMAC, where it must be between 32 and 512 bytes.
-        :param pulumi.Input[Sequence[pulumi.Input[Mapping[str, Any]]]] keys: List of key versions in the keyring. This attribute is zero-indexed and will contain a map of values depending on the `type` of the encryption key.
+        :param pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[str]]]]] keys: List of key versions in the keyring. This attribute is zero-indexed and will contain a map of values depending on the `type` of the encryption key.
                * for key types `aes128-gcm96`, `aes256-gcm96` and `chacha20-poly1305`, each key version will be a map of a single value `id` which is just a hash of the key's metadata.
                * for key types `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `rsa-2048`, `rsa-3072` and `rsa-4096`, each key version will be a map of the following:
         :param pulumi.Input[int] latest_version: Latest key version available. This value is 1-indexed, so if `latest_version` is `1`, then the key's information can be referenced from `keys` by selecting element `0`
@@ -433,7 +433,7 @@ def key_size(self, value: Optional[pulumi.Input[int]]):
 
     @property
     @pulumi.getter
-    def keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, Any]]]]]:
+    def keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[str]]]]]]:
         """
         List of key versions in the keyring. This attribute is zero-indexed and will contain a map of values depending on the `type` of the encryption key.
         * for key types `aes128-gcm96`, `aes256-gcm96` and `chacha20-poly1305`, each key version will be a map of a single value `id` which is just a hash of the key's metadata.
@@ -442,7 +442,7 @@ def keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, Any]]
         return pulumi.get(self, "keys")
 
     @keys.setter
-    def keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, Any]]]]]):
+    def keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[str]]]]]]):
         pulumi.set(self, "keys", value)
 
     @property
@@ -762,7 +762,7 @@ def get(resource_name: str,
             derived: Optional[pulumi.Input[bool]] = None,
             exportable: Optional[pulumi.Input[bool]] = None,
             key_size: Optional[pulumi.Input[int]] = None,
-            keys: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, Any]]]]] = None,
+            keys: Optional[pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[str]]]]]] = None,
             latest_version: Optional[pulumi.Input[int]] = None,
             min_available_version: Optional[pulumi.Input[int]] = None,
             min_decryption_version: Optional[pulumi.Input[int]] = None,
@@ -791,7 +791,7 @@ def get(resource_name: str,
         :param pulumi.Input[bool] derived: Specifies if key derivation is to be used. If enabled, all encrypt/decrypt requests to this key must provide a context which is used for key derivation.
         :param pulumi.Input[bool] exportable: Enables keys to be exportable. This allows for all valid private keys in the keyring to be exported. Once set, this cannot be disabled.
         :param pulumi.Input[int] key_size: The key size in bytes for algorithms that allow variable key sizes. Currently only applicable to HMAC, where it must be between 32 and 512 bytes.
-        :param pulumi.Input[Sequence[pulumi.Input[Mapping[str, Any]]]] keys: List of key versions in the keyring. This attribute is zero-indexed and will contain a map of values depending on the `type` of the encryption key.
+        :param pulumi.Input[Sequence[pulumi.Input[Mapping[str, pulumi.Input[str]]]]] keys: List of key versions in the keyring. This attribute is zero-indexed and will contain a map of values depending on the `type` of the encryption key.
                * for key types `aes128-gcm96`, `aes256-gcm96` and `chacha20-poly1305`, each key version will be a map of a single value `id` which is just a hash of the key's metadata.
                * for key types `ed25519`, `ecdsa-p256`, `ecdsa-p384`, `ecdsa-p521`, `rsa-2048`, `rsa-3072` and `rsa-4096`, each key version will be a map of the following:
         :param pulumi.Input[int] latest_version: Latest key version available. This value is 1-indexed, so if `latest_version` is `1`, then the key's information can be referenced from `keys` by selecting element `0`
@@ -904,7 +904,7 @@ def key_size(self) -> pulumi.Output[Optional[int]]:
 
     @property
     @pulumi.getter
-    def keys(self) -> pulumi.Output[Sequence[Mapping[str, Any]]]:
+    def keys(self) -> pulumi.Output[Sequence[Mapping[str, str]]]:
         """
         List of key versions in the keyring. This attribute is zero-indexed and will contain a map of values depending on the `type` of the encryption key.
         * for key types `aes128-gcm96`, `aes256-gcm96` and `chacha20-poly1305`, each key version will be a map of a single value `id` which is just a hash of the key's metadata.