diff --git a/.github/workflows/coder.yaml b/.github/workflows/coder.yaml
index a3ee273af8671..7e0b890edad9b 100644
--- a/.github/workflows/coder.yaml
+++ b/.github/workflows/coder.yaml
@@ -10,8 +10,7 @@ on:
 
   pull_request:
     branches:
-      - main
-      - "release/*"
+      - "*"
 
   workflow_dispatch:
 
diff --git a/coderd/projectparameter/projectparameter.go b/coderd/projectparameter/projectparameter.go
new file mode 100644
index 0000000000000..95975849e0ddf
--- /dev/null
+++ b/coderd/projectparameter/projectparameter.go
@@ -0,0 +1,217 @@
+package projectparameter
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+
+	"github.com/google/uuid"
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/database"
+	"github.com/coder/coder/provisionersdk/proto"
+)
+
+// Scope targets identifiers to pull parameters from.
+type Scope struct {
+	OrganizationID     string
+	ProjectID          uuid.UUID
+	ProjectHistoryID   uuid.UUID
+	UserID             string
+	WorkspaceID        uuid.UUID
+	WorkspaceHistoryID uuid.UUID
+}
+
+// Value represents a computed parameter.
+type Value struct {
+	Proto *proto.ParameterValue
+	// DefaultValue is whether a default value for the scope
+	// was consumed. This can only be true for projects.
+	DefaultValue bool
+	Scope        database.ParameterScope
+	ScopeID      string
+}
+
+// Compute accepts a scope in which parameter values are sourced.
+// These sources are iterated in a hierarchical fashion to determine
+// the runtime parameter values for a project.
+func Compute(ctx context.Context, db database.Store, scope Scope) ([]Value, error) {
+	compute := &compute{
+		db:                             db,
+		computedParameterByName:        map[string]Value{},
+		projectHistoryParametersByName: map[string]database.ProjectParameter{},
+	}
+
+	// All parameters for the project version!
+	projectHistoryParameters, err := db.GetProjectParametersByHistoryID(ctx, scope.ProjectHistoryID)
+	if errors.Is(err, sql.ErrNoRows) {
+		// This occurs when the project history has defined
+		// no parameters, so we have nothing to compute!
+		return []Value{}, nil
+	}
+	if err != nil {
+		return nil, xerrors.Errorf("get project parameters: %w", err)
+	}
+	for _, projectHistoryParameter := range projectHistoryParameters {
+		compute.projectHistoryParametersByName[projectHistoryParameter.Name] = projectHistoryParameter
+	}
+
+	// Organization parameters come first!
+	err = compute.inject(ctx, database.GetParameterValuesByScopeParams{
+		Scope:   database.ParameterScopeOrganization,
+		ScopeID: scope.OrganizationID,
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	// Default project parameter values come second!
+	for _, projectHistoryParameter := range projectHistoryParameters {
+		if !projectHistoryParameter.DefaultSourceValue.Valid {
+			continue
+		}
+		if !projectHistoryParameter.DefaultDestinationValue.Valid {
+			continue
+		}
+
+		destinationScheme, err := convertDestinationScheme(projectHistoryParameter.DefaultDestinationScheme)
+		if err != nil {
+			return nil, xerrors.Errorf("convert default destination scheme for project history parameter %q: %w", projectHistoryParameter.Name, err)
+		}
+
+		switch projectHistoryParameter.DefaultSourceScheme {
+		case database.ParameterSourceSchemeData:
+			compute.computedParameterByName[projectHistoryParameter.Name] = Value{
+				Proto: &proto.ParameterValue{
+					DestinationScheme: destinationScheme,
+					Name:              projectHistoryParameter.DefaultDestinationValue.String,
+					Value:             projectHistoryParameter.DefaultSourceValue.String,
+				},
+				DefaultValue: true,
+				Scope:        database.ParameterScopeProject,
+				ScopeID:      scope.ProjectID.String(),
+			}
+		default:
+			return nil, xerrors.Errorf("unsupported source scheme for project history parameter %q: %q", projectHistoryParameter.Name, string(projectHistoryParameter.DefaultSourceScheme))
+		}
+	}
+
+	// Project parameters come third!
+	err = compute.inject(ctx, database.GetParameterValuesByScopeParams{
+		Scope:   database.ParameterScopeProject,
+		ScopeID: scope.ProjectID.String(),
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	// User parameters come fourth!
+	err = compute.inject(ctx, database.GetParameterValuesByScopeParams{
+		Scope:   database.ParameterScopeUser,
+		ScopeID: scope.UserID,
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	// Workspace parameters come last!
+	err = compute.inject(ctx, database.GetParameterValuesByScopeParams{
+		Scope:   database.ParameterScopeWorkspace,
+		ScopeID: scope.WorkspaceID.String(),
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	for _, projectHistoryParameter := range compute.projectHistoryParametersByName {
+		if _, ok := compute.computedParameterByName[projectHistoryParameter.Name]; ok {
+			continue
+		}
+		return nil, NoValueError{
+			ParameterID:   projectHistoryParameter.ID,
+			ParameterName: projectHistoryParameter.Name,
+		}
+	}
+
+	values := make([]Value, 0, len(compute.computedParameterByName))
+	for _, value := range compute.computedParameterByName {
+		values = append(values, value)
+	}
+	return values, nil
+}
+
+type compute struct {
+	db                             database.Store
+	computedParameterByName        map[string]Value
+	projectHistoryParametersByName map[string]database.ProjectParameter
+}
+
+// Validates and computes the value for parameters; setting the value on "parameterByName".
+func (c *compute) inject(ctx context.Context, scopeParams database.GetParameterValuesByScopeParams) error {
+	scopedParameters, err := c.db.GetParameterValuesByScope(ctx, scopeParams)
+	if errors.Is(err, sql.ErrNoRows) {
+		err = nil
+	}
+	if err != nil {
+		return xerrors.Errorf("get %s parameters: %w", scopeParams.Scope, err)
+	}
+
+	for _, scopedParameter := range scopedParameters {
+		projectHistoryParameter, hasProjectHistoryParameter := c.projectHistoryParametersByName[scopedParameter.Name]
+		if !hasProjectHistoryParameter {
+			// Don't inject parameters that aren't defined by the project.
+			continue
+		}
+
+		_, hasExistingParameter := c.computedParameterByName[scopedParameter.Name]
+		if hasExistingParameter {
+			// If a parameter already exists, check if this variable can override it.
+			// Injection hierarchy is the responsibility of the caller. This check ensures
+			// project parameters cannot be overridden if already set.
+			if !projectHistoryParameter.AllowOverrideSource && scopedParameter.Scope != database.ParameterScopeProject {
+				continue
+			}
+		}
+
+		destinationScheme, err := convertDestinationScheme(scopedParameter.DestinationScheme)
+		if err != nil {
+			return xerrors.Errorf("convert destination scheme: %w", err)
+		}
+
+		switch scopedParameter.SourceScheme {
+		case database.ParameterSourceSchemeData:
+			c.computedParameterByName[projectHistoryParameter.Name] = Value{
+				Proto: &proto.ParameterValue{
+					DestinationScheme: destinationScheme,
+					Name:              scopedParameter.SourceValue,
+					Value:             scopedParameter.DestinationValue,
+				},
+			}
+		default:
+			return xerrors.Errorf("unsupported source scheme: %q", string(projectHistoryParameter.DefaultSourceScheme))
+		}
+	}
+	return nil
+}
+
+// Converts the database destination scheme to the protobuf version.
+func convertDestinationScheme(scheme database.ParameterDestinationScheme) (proto.ParameterDestination_Scheme, error) {
+	switch scheme {
+	case database.ParameterDestinationSchemeEnvironmentVariable:
+		return proto.ParameterDestination_ENVIRONMENT_VARIABLE, nil
+	case database.ParameterDestinationSchemeProvisionerVariable:
+		return proto.ParameterDestination_PROVISIONER_VARIABLE, nil
+	default:
+		return 0, xerrors.Errorf("unsupported destination scheme: %q", scheme)
+	}
+}
+
+type NoValueError struct {
+	ParameterID   uuid.UUID
+	ParameterName string
+}
+
+func (e NoValueError) Error() string {
+	return fmt.Sprintf("no value for parameter %q found", e.ParameterName)
+}
diff --git a/coderd/projectparameter/projectparameter_test.go b/coderd/projectparameter/projectparameter_test.go
new file mode 100644
index 0000000000000..5b562175497e6
--- /dev/null
+++ b/coderd/projectparameter/projectparameter_test.go
@@ -0,0 +1,205 @@
+package projectparameter_test
+
+import (
+	"context"
+	"database/sql"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/coderd/projectparameter"
+	"github.com/coder/coder/cryptorand"
+	"github.com/coder/coder/database"
+	"github.com/coder/coder/database/databasefake"
+	"github.com/coder/coder/provisionersdk/proto"
+)
+
+func TestCompute(t *testing.T) {
+	t.Parallel()
+	generateScope := func() projectparameter.Scope {
+		return projectparameter.Scope{
+			OrganizationID:   uuid.New().String(),
+			ProjectID:        uuid.New(),
+			ProjectHistoryID: uuid.New(),
+			UserID:           uuid.NewString(),
+		}
+	}
+	type projectParameterOptions struct {
+		AllowOverrideSource      bool
+		AllowOverrideDestination bool
+		DefaultDestinationScheme database.ParameterDestinationScheme
+		ProjectHistoryID         uuid.UUID
+	}
+	generateProjectParameter := func(t *testing.T, db database.Store, opts projectParameterOptions) database.ProjectParameter {
+		if opts.DefaultDestinationScheme == "" {
+			opts.DefaultDestinationScheme = database.ParameterDestinationSchemeEnvironmentVariable
+		}
+		name, err := cryptorand.String(8)
+		require.NoError(t, err)
+		sourceValue, err := cryptorand.String(8)
+		require.NoError(t, err)
+		destinationValue, err := cryptorand.String(8)
+		require.NoError(t, err)
+		param, err := db.InsertProjectParameter(context.Background(), database.InsertProjectParameterParams{
+			ID:                  uuid.New(),
+			Name:                name,
+			ProjectHistoryID:    opts.ProjectHistoryID,
+			DefaultSourceScheme: database.ParameterSourceSchemeData,
+			DefaultSourceValue: sql.NullString{
+				String: sourceValue,
+				Valid:  true,
+			},
+			DefaultDestinationValue: sql.NullString{
+				String: destinationValue,
+				Valid:  true,
+			},
+			AllowOverrideSource:      opts.AllowOverrideSource,
+			AllowOverrideDestination: opts.AllowOverrideDestination,
+			DefaultDestinationScheme: opts.DefaultDestinationScheme,
+		})
+		require.NoError(t, err)
+		return param
+	}
+
+	t.Run("NoValue", func(t *testing.T) {
+		t.Parallel()
+		db := databasefake.New()
+		scope := generateScope()
+		parameter, err := db.InsertProjectParameter(context.Background(), database.InsertProjectParameterParams{
+			ID:               uuid.New(),
+			ProjectHistoryID: scope.ProjectHistoryID,
+			Name:             "hey",
+		})
+		require.NoError(t, err)
+
+		_, err = projectparameter.Compute(context.Background(), db, scope)
+		var noValueErr projectparameter.NoValueError
+		require.ErrorAs(t, err, &noValueErr)
+		require.Equal(t, parameter.ID.String(), noValueErr.ParameterID.String())
+		require.Equal(t, parameter.Name, noValueErr.ParameterName)
+	})
+
+	t.Run("UseDefaultProjectValue", func(t *testing.T) {
+		t.Parallel()
+		db := databasefake.New()
+		scope := generateScope()
+		parameter := generateProjectParameter(t, db, projectParameterOptions{
+			ProjectHistoryID:         scope.ProjectHistoryID,
+			DefaultDestinationScheme: database.ParameterDestinationSchemeProvisionerVariable,
+		})
+		values, err := projectparameter.Compute(context.Background(), db, scope)
+		require.NoError(t, err)
+		require.Len(t, values, 1)
+		value := values[0]
+		require.True(t, value.DefaultValue)
+		require.Equal(t, database.ParameterScopeProject, value.Scope)
+		require.Equal(t, scope.ProjectID.String(), value.ScopeID)
+		require.Equal(t, value.Proto.Name, parameter.DefaultDestinationValue.String)
+		require.Equal(t, value.Proto.DestinationScheme, proto.ParameterDestination_PROVISIONER_VARIABLE)
+		require.Equal(t, value.Proto.Value, parameter.DefaultSourceValue.String)
+	})
+
+	t.Run("OverrideOrganizationWithProjectDefault", func(t *testing.T) {
+		t.Parallel()
+		db := databasefake.New()
+		scope := generateScope()
+		parameter := generateProjectParameter(t, db, projectParameterOptions{
+			ProjectHistoryID: scope.ProjectHistoryID,
+		})
+		_, err := db.InsertParameterValue(context.Background(), database.InsertParameterValueParams{
+			ID:                uuid.New(),
+			Name:              parameter.Name,
+			Scope:             database.ParameterScopeOrganization,
+			ScopeID:           scope.OrganizationID,
+			SourceScheme:      database.ParameterSourceSchemeData,
+			SourceValue:       "nop",
+			DestinationScheme: database.ParameterDestinationSchemeEnvironmentVariable,
+			DestinationValue:  "organizationvalue",
+		})
+		require.NoError(t, err)
+
+		values, err := projectparameter.Compute(context.Background(), db, scope)
+		require.NoError(t, err)
+		require.Len(t, values, 1)
+		require.Equal(t, true, values[0].DefaultValue)
+		require.Equal(t, parameter.DefaultSourceValue.String, values[0].Proto.Value)
+	})
+
+	t.Run("ProjectOverridesProjectDefault", func(t *testing.T) {
+		t.Parallel()
+		db := databasefake.New()
+		scope := generateScope()
+		parameter := generateProjectParameter(t, db, projectParameterOptions{
+			ProjectHistoryID: scope.ProjectHistoryID,
+		})
+		value, err := db.InsertParameterValue(context.Background(), database.InsertParameterValueParams{
+			ID:                uuid.New(),
+			Name:              parameter.Name,
+			Scope:             database.ParameterScopeProject,
+			ScopeID:           scope.ProjectID.String(),
+			SourceScheme:      database.ParameterSourceSchemeData,
+			SourceValue:       "nop",
+			DestinationScheme: database.ParameterDestinationSchemeEnvironmentVariable,
+			DestinationValue:  "projectvalue",
+		})
+		require.NoError(t, err)
+
+		values, err := projectparameter.Compute(context.Background(), db, scope)
+		require.NoError(t, err)
+		require.Len(t, values, 1)
+		require.Equal(t, false, values[0].DefaultValue)
+		require.Equal(t, value.DestinationValue, values[0].Proto.Value)
+	})
+
+	t.Run("WorkspaceCannotOverwriteProjectDefault", func(t *testing.T) {
+		t.Parallel()
+		db := databasefake.New()
+		scope := generateScope()
+		parameter := generateProjectParameter(t, db, projectParameterOptions{
+			ProjectHistoryID: scope.ProjectHistoryID,
+		})
+		_, err := db.InsertParameterValue(context.Background(), database.InsertParameterValueParams{
+			ID:                uuid.New(),
+			Name:              parameter.Name,
+			Scope:             database.ParameterScopeWorkspace,
+			ScopeID:           scope.WorkspaceID.String(),
+			SourceScheme:      database.ParameterSourceSchemeData,
+			SourceValue:       "nop",
+			DestinationScheme: database.ParameterDestinationSchemeEnvironmentVariable,
+			DestinationValue:  "projectvalue",
+		})
+		require.NoError(t, err)
+
+		values, err := projectparameter.Compute(context.Background(), db, scope)
+		require.NoError(t, err)
+		require.Len(t, values, 1)
+		require.Equal(t, true, values[0].DefaultValue)
+	})
+
+	t.Run("WorkspaceOverwriteProjectDefault", func(t *testing.T) {
+		t.Parallel()
+		db := databasefake.New()
+		scope := generateScope()
+		parameter := generateProjectParameter(t, db, projectParameterOptions{
+			AllowOverrideSource: true,
+			ProjectHistoryID:    scope.ProjectHistoryID,
+		})
+		_, err := db.InsertParameterValue(context.Background(), database.InsertParameterValueParams{
+			ID:                uuid.New(),
+			Name:              parameter.Name,
+			Scope:             database.ParameterScopeWorkspace,
+			ScopeID:           scope.WorkspaceID.String(),
+			SourceScheme:      database.ParameterSourceSchemeData,
+			SourceValue:       "nop",
+			DestinationScheme: database.ParameterDestinationSchemeEnvironmentVariable,
+			DestinationValue:  "projectvalue",
+		})
+		require.NoError(t, err)
+
+		values, err := projectparameter.Compute(context.Background(), db, scope)
+		require.NoError(t, err)
+		require.Len(t, values, 1)
+		require.Equal(t, false, values[0].DefaultValue)
+	})
+}
diff --git a/provisioner/terraform/parse.go b/provisioner/terraform/parse.go
index 639d1039f451c..cc92bc8f8008c 100644
--- a/provisioner/terraform/parse.go
+++ b/provisioner/terraform/parse.go
@@ -37,7 +37,7 @@ func convertVariableToParameter(variable *tfconfig.Variable) (*proto.ParameterSc
 	schema := &proto.ParameterSchema{
 		Name:                variable.Name,
 		Description:         variable.Description,
-		Sensitive:           variable.Sensitive,
+		RedisplayValue:      variable.Sensitive,
 		ValidationValueType: variable.Type,
 	}
 
@@ -46,7 +46,14 @@ func convertVariableToParameter(variable *tfconfig.Variable) (*proto.ParameterSc
 		if err != nil {
 			return nil, xerrors.Errorf("parse variable %q default: %w", variable.Name, err)
 		}
-		schema.DefaultValue = string(defaultData)
+		schema.DefaultSource = &proto.ParameterSource{
+			Scheme: proto.ParameterSource_DATA,
+			Value:  string(defaultData),
+		}
+		schema.DefaultDestination = &proto.ParameterDestination{
+			Scheme: proto.ParameterDestination_PROVISIONER_VARIABLE,
+			Value:  variable.Name,
+		}
 	}
 
 	if len(variable.Validations) > 0 && variable.Validations[0].Condition != nil {
diff --git a/provisioner/terraform/parse_test.go b/provisioner/terraform/parse_test.go
index 94af39103a308..bbfe166827851 100644
--- a/provisioner/terraform/parse_test.go
+++ b/provisioner/terraform/parse_test.go
@@ -63,8 +63,15 @@ func TestParse(t *testing.T) {
 		},
 		Response: &proto.Parse_Response{
 			ParameterSchemas: []*proto.ParameterSchema{{
-				Name:         "A",
-				DefaultValue: "\"wow\"",
+				Name: "A",
+				DefaultSource: &proto.ParameterSource{
+					Scheme: proto.ParameterSource_DATA,
+					Value:  "\"wow\"",
+				},
+				DefaultDestination: &proto.ParameterDestination{
+					Scheme: proto.ParameterDestination_PROVISIONER_VARIABLE,
+					Value:  "A",
+				},
 			}},
 		},
 	}, {
diff --git a/provisioner/terraform/provision.go b/provisioner/terraform/provision.go
index 34f57ff649192..4cf94ec0d9378 100644
--- a/provisioner/terraform/provision.go
+++ b/provisioner/terraform/provision.go
@@ -37,10 +37,23 @@ func (t *terraform) Provision(ctx context.Context, request *proto.Provision_Requ
 		return nil, xerrors.Errorf("initialize terraform: %w", err)
 	}
 
+	env := map[string]string{}
 	options := make([]tfexec.ApplyOption, 0)
-	for _, params := range request.ParameterValues {
-		options = append(options, tfexec.Var(fmt.Sprintf("%s=%s", params.Name, params.Value)))
+	for _, param := range request.ParameterValues {
+		switch param.DestinationScheme {
+		case proto.ParameterDestination_ENVIRONMENT_VARIABLE:
+			env[param.Name] = param.Value
+		case proto.ParameterDestination_PROVISIONER_VARIABLE:
+			options = append(options, tfexec.Var(fmt.Sprintf("%s=%s", param.Name, param.Value)))
+		default:
+			return nil, xerrors.Errorf("unsupported parameter type %q for %q", param.DestinationScheme, param.Name)
+		}
+	}
+	err = terraform.SetEnv(env)
+	if err != nil {
+		return nil, xerrors.Errorf("apply environment variables: %w", err)
 	}
+
 	err = terraform.Apply(ctx, options...)
 	if err != nil {
 		return nil, xerrors.Errorf("apply terraform: %w", err)
diff --git a/provisioner/terraform/provision_test.go b/provisioner/terraform/provision_test.go
index 7d193033f1e65..b596c85d0bf15 100644
--- a/provisioner/terraform/provision_test.go
+++ b/provisioner/terraform/provision_test.go
@@ -63,8 +63,9 @@ func TestProvision(t *testing.T) {
 		},
 		Request: &proto.Provision_Request{
 			ParameterValues: []*proto.ParameterValue{{
-				Name:  "A",
-				Value: "example",
+				DestinationScheme: proto.ParameterDestination_PROVISIONER_VARIABLE,
+				Name:              "A",
+				Value:             "example",
 			}},
 		},
 		Response: &proto.Provision_Response{},
diff --git a/provisionersdk/proto/provisioner.pb.go b/provisionersdk/proto/provisioner.pb.go
index 37bf884066dd4..7537f69f27c51 100644
--- a/provisionersdk/proto/provisioner.pb.go
+++ b/provisionersdk/proto/provisioner.pb.go
@@ -20,6 +20,95 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
+type ParameterSource_Scheme int32
+
+const (
+	ParameterSource_DATA ParameterSource_Scheme = 0
+)
+
+// Enum value maps for ParameterSource_Scheme.
+var (
+	ParameterSource_Scheme_name = map[int32]string{
+		0: "DATA",
+	}
+	ParameterSource_Scheme_value = map[string]int32{
+		"DATA": 0,
+	}
+)
+
+func (x ParameterSource_Scheme) Enum() *ParameterSource_Scheme {
+	p := new(ParameterSource_Scheme)
+	*p = x
+	return p
+}
+
+func (x ParameterSource_Scheme) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (ParameterSource_Scheme) Descriptor() protoreflect.EnumDescriptor {
+	return file_provisioner_proto_enumTypes[0].Descriptor()
+}
+
+func (ParameterSource_Scheme) Type() protoreflect.EnumType {
+	return &file_provisioner_proto_enumTypes[0]
+}
+
+func (x ParameterSource_Scheme) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use ParameterSource_Scheme.Descriptor instead.
+func (ParameterSource_Scheme) EnumDescriptor() ([]byte, []int) {
+	return file_provisioner_proto_rawDescGZIP(), []int{0, 0}
+}
+
+type ParameterDestination_Scheme int32
+
+const (
+	ParameterDestination_ENVIRONMENT_VARIABLE ParameterDestination_Scheme = 0
+	ParameterDestination_PROVISIONER_VARIABLE ParameterDestination_Scheme = 1
+)
+
+// Enum value maps for ParameterDestination_Scheme.
+var (
+	ParameterDestination_Scheme_name = map[int32]string{
+		0: "ENVIRONMENT_VARIABLE",
+		1: "PROVISIONER_VARIABLE",
+	}
+	ParameterDestination_Scheme_value = map[string]int32{
+		"ENVIRONMENT_VARIABLE": 0,
+		"PROVISIONER_VARIABLE": 1,
+	}
+)
+
+func (x ParameterDestination_Scheme) Enum() *ParameterDestination_Scheme {
+	p := new(ParameterDestination_Scheme)
+	*p = x
+	return p
+}
+
+func (x ParameterDestination_Scheme) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (ParameterDestination_Scheme) Descriptor() protoreflect.EnumDescriptor {
+	return file_provisioner_proto_enumTypes[1].Descriptor()
+}
+
+func (ParameterDestination_Scheme) Type() protoreflect.EnumType {
+	return &file_provisioner_proto_enumTypes[1]
+}
+
+func (x ParameterDestination_Scheme) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use ParameterDestination_Scheme.Descriptor instead.
+func (ParameterDestination_Scheme) EnumDescriptor() ([]byte, []int) {
+	return file_provisioner_proto_rawDescGZIP(), []int{1, 0}
+}
+
 type ParameterSchema_TypeSystem int32
 
 const (
@@ -47,11 +136,11 @@ func (x ParameterSchema_TypeSystem) String() string {
 }
 
 func (ParameterSchema_TypeSystem) Descriptor() protoreflect.EnumDescriptor {
-	return file_provisioner_proto_enumTypes[0].Descriptor()
+	return file_provisioner_proto_enumTypes[2].Descriptor()
 }
 
 func (ParameterSchema_TypeSystem) Type() protoreflect.EnumType {
-	return &file_provisioner_proto_enumTypes[0]
+	return &file_provisioner_proto_enumTypes[2]
 }
 
 func (x ParameterSchema_TypeSystem) Number() protoreflect.EnumNumber {
@@ -60,27 +149,21 @@ func (x ParameterSchema_TypeSystem) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use ParameterSchema_TypeSystem.Descriptor instead.
 func (ParameterSchema_TypeSystem) EnumDescriptor() ([]byte, []int) {
-	return file_provisioner_proto_rawDescGZIP(), []int{0, 0}
+	return file_provisioner_proto_rawDescGZIP(), []int{3, 0}
 }
 
-// ParameterSchema represents validation and type information for a parsed parameter.
-type ParameterSchema struct {
+// ParameterSource represents the source location for a parameter to get it's value from.
+type ParameterSource struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Name                 string                     `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
-	Description          string                     `protobuf:"bytes,2,opt,name=description,proto3" json:"description,omitempty"`
-	DefaultValue         string                     `protobuf:"bytes,3,opt,name=default_value,json=defaultValue,proto3" json:"default_value,omitempty"`
-	Sensitive            bool                       `protobuf:"varint,4,opt,name=sensitive,proto3" json:"sensitive,omitempty"`
-	ValidationTypeSystem ParameterSchema_TypeSystem `protobuf:"varint,5,opt,name=validation_type_system,json=validationTypeSystem,proto3,enum=provisioner.ParameterSchema_TypeSystem" json:"validation_type_system,omitempty"`
-	ValidationValueType  string                     `protobuf:"bytes,6,opt,name=validation_value_type,json=validationValueType,proto3" json:"validation_value_type,omitempty"`
-	ValidationError      string                     `protobuf:"bytes,7,opt,name=validation_error,json=validationError,proto3" json:"validation_error,omitempty"`
-	ValidationCondition  string                     `protobuf:"bytes,8,opt,name=validation_condition,json=validationCondition,proto3" json:"validation_condition,omitempty"`
+	Scheme ParameterSource_Scheme `protobuf:"varint,1,opt,name=scheme,proto3,enum=provisioner.ParameterSource_Scheme" json:"scheme,omitempty"`
+	Value  string                 `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
 }
 
-func (x *ParameterSchema) Reset() {
-	*x = ParameterSchema{}
+func (x *ParameterSource) Reset() {
+	*x = ParameterSource{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_provisioner_proto_msgTypes[0]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -88,13 +171,13 @@ func (x *ParameterSchema) Reset() {
 	}
 }
 
-func (x *ParameterSchema) String() string {
+func (x *ParameterSource) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*ParameterSchema) ProtoMessage() {}
+func (*ParameterSource) ProtoMessage() {}
 
-func (x *ParameterSchema) ProtoReflect() protoreflect.Message {
+func (x *ParameterSource) ProtoReflect() protoreflect.Message {
 	mi := &file_provisioner_proto_msgTypes[0]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -106,81 +189,96 @@ func (x *ParameterSchema) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use ParameterSchema.ProtoReflect.Descriptor instead.
-func (*ParameterSchema) Descriptor() ([]byte, []int) {
+// Deprecated: Use ParameterSource.ProtoReflect.Descriptor instead.
+func (*ParameterSource) Descriptor() ([]byte, []int) {
 	return file_provisioner_proto_rawDescGZIP(), []int{0}
 }
 
-func (x *ParameterSchema) GetName() string {
+func (x *ParameterSource) GetScheme() ParameterSource_Scheme {
 	if x != nil {
-		return x.Name
+		return x.Scheme
 	}
-	return ""
+	return ParameterSource_DATA
 }
 
-func (x *ParameterSchema) GetDescription() string {
+func (x *ParameterSource) GetValue() string {
 	if x != nil {
-		return x.Description
+		return x.Value
 	}
 	return ""
 }
 
-func (x *ParameterSchema) GetDefaultValue() string {
-	if x != nil {
-		return x.DefaultValue
-	}
-	return ""
+// ParameterDestination represents the target location for a provisioner to set the value.
+type ParameterDestination struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Scheme ParameterDestination_Scheme `protobuf:"varint,1,opt,name=scheme,proto3,enum=provisioner.ParameterDestination_Scheme" json:"scheme,omitempty"`
+	Value  string                      `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
 }
 
-func (x *ParameterSchema) GetSensitive() bool {
-	if x != nil {
-		return x.Sensitive
+func (x *ParameterDestination) Reset() {
+	*x = ParameterDestination{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_provisioner_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
 	}
-	return false
 }
 
-func (x *ParameterSchema) GetValidationTypeSystem() ParameterSchema_TypeSystem {
-	if x != nil {
-		return x.ValidationTypeSystem
-	}
-	return ParameterSchema_HCL
+func (x *ParameterDestination) String() string {
+	return protoimpl.X.MessageStringOf(x)
 }
 
-func (x *ParameterSchema) GetValidationValueType() string {
-	if x != nil {
-		return x.ValidationValueType
+func (*ParameterDestination) ProtoMessage() {}
+
+func (x *ParameterDestination) ProtoReflect() protoreflect.Message {
+	mi := &file_provisioner_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
 	}
-	return ""
+	return mi.MessageOf(x)
 }
 
-func (x *ParameterSchema) GetValidationError() string {
+// Deprecated: Use ParameterDestination.ProtoReflect.Descriptor instead.
+func (*ParameterDestination) Descriptor() ([]byte, []int) {
+	return file_provisioner_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *ParameterDestination) GetScheme() ParameterDestination_Scheme {
 	if x != nil {
-		return x.ValidationError
+		return x.Scheme
 	}
-	return ""
+	return ParameterDestination_ENVIRONMENT_VARIABLE
 }
 
-func (x *ParameterSchema) GetValidationCondition() string {
+func (x *ParameterDestination) GetValue() string {
 	if x != nil {
-		return x.ValidationCondition
+		return x.Value
 	}
 	return ""
 }
 
-// ParameterValue holds the value of a parameter.
+// ParameterValue represents the resolved source and destination of a parameter.
 type ParameterValue struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Name  string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
-	Value string `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
+	DestinationScheme ParameterDestination_Scheme `protobuf:"varint,1,opt,name=destination_scheme,json=destinationScheme,proto3,enum=provisioner.ParameterDestination_Scheme" json:"destination_scheme,omitempty"`
+	Name              string                      `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
+	Value             string                      `protobuf:"bytes,3,opt,name=value,proto3" json:"value,omitempty"`
 }
 
 func (x *ParameterValue) Reset() {
 	*x = ParameterValue{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_provisioner_proto_msgTypes[1]
+		mi := &file_provisioner_proto_msgTypes[2]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -193,7 +291,7 @@ func (x *ParameterValue) String() string {
 func (*ParameterValue) ProtoMessage() {}
 
 func (x *ParameterValue) ProtoReflect() protoreflect.Message {
-	mi := &file_provisioner_proto_msgTypes[1]
+	mi := &file_provisioner_proto_msgTypes[2]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -206,7 +304,14 @@ func (x *ParameterValue) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ParameterValue.ProtoReflect.Descriptor instead.
 func (*ParameterValue) Descriptor() ([]byte, []int) {
-	return file_provisioner_proto_rawDescGZIP(), []int{1}
+	return file_provisioner_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *ParameterValue) GetDestinationScheme() ParameterDestination_Scheme {
+	if x != nil {
+		return x.DestinationScheme
+	}
+	return ParameterDestination_ENVIRONMENT_VARIABLE
 }
 
 func (x *ParameterValue) GetName() string {
@@ -223,6 +328,134 @@ func (x *ParameterValue) GetValue() string {
 	return ""
 }
 
+// ParameterSchema represents validation and type information for a parsed parameter.
+type ParameterSchema struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name                     string                     `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Description              string                     `protobuf:"bytes,2,opt,name=description,proto3" json:"description,omitempty"`
+	DefaultSource            *ParameterSource           `protobuf:"bytes,3,opt,name=default_source,json=defaultSource,proto3" json:"default_source,omitempty"`
+	AllowOverrideSource      bool                       `protobuf:"varint,4,opt,name=allow_override_source,json=allowOverrideSource,proto3" json:"allow_override_source,omitempty"`
+	DefaultDestination       *ParameterDestination      `protobuf:"bytes,5,opt,name=default_destination,json=defaultDestination,proto3" json:"default_destination,omitempty"`
+	AllowOverrideDestination bool                       `protobuf:"varint,6,opt,name=allow_override_destination,json=allowOverrideDestination,proto3" json:"allow_override_destination,omitempty"`
+	RedisplayValue           bool                       `protobuf:"varint,7,opt,name=redisplay_value,json=redisplayValue,proto3" json:"redisplay_value,omitempty"`
+	ValidationTypeSystem     ParameterSchema_TypeSystem `protobuf:"varint,8,opt,name=validation_type_system,json=validationTypeSystem,proto3,enum=provisioner.ParameterSchema_TypeSystem" json:"validation_type_system,omitempty"`
+	ValidationValueType      string                     `protobuf:"bytes,9,opt,name=validation_value_type,json=validationValueType,proto3" json:"validation_value_type,omitempty"`
+	ValidationError          string                     `protobuf:"bytes,10,opt,name=validation_error,json=validationError,proto3" json:"validation_error,omitempty"`
+	ValidationCondition      string                     `protobuf:"bytes,11,opt,name=validation_condition,json=validationCondition,proto3" json:"validation_condition,omitempty"`
+}
+
+func (x *ParameterSchema) Reset() {
+	*x = ParameterSchema{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_provisioner_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ParameterSchema) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ParameterSchema) ProtoMessage() {}
+
+func (x *ParameterSchema) ProtoReflect() protoreflect.Message {
+	mi := &file_provisioner_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ParameterSchema.ProtoReflect.Descriptor instead.
+func (*ParameterSchema) Descriptor() ([]byte, []int) {
+	return file_provisioner_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *ParameterSchema) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *ParameterSchema) GetDescription() string {
+	if x != nil {
+		return x.Description
+	}
+	return ""
+}
+
+func (x *ParameterSchema) GetDefaultSource() *ParameterSource {
+	if x != nil {
+		return x.DefaultSource
+	}
+	return nil
+}
+
+func (x *ParameterSchema) GetAllowOverrideSource() bool {
+	if x != nil {
+		return x.AllowOverrideSource
+	}
+	return false
+}
+
+func (x *ParameterSchema) GetDefaultDestination() *ParameterDestination {
+	if x != nil {
+		return x.DefaultDestination
+	}
+	return nil
+}
+
+func (x *ParameterSchema) GetAllowOverrideDestination() bool {
+	if x != nil {
+		return x.AllowOverrideDestination
+	}
+	return false
+}
+
+func (x *ParameterSchema) GetRedisplayValue() bool {
+	if x != nil {
+		return x.RedisplayValue
+	}
+	return false
+}
+
+func (x *ParameterSchema) GetValidationTypeSystem() ParameterSchema_TypeSystem {
+	if x != nil {
+		return x.ValidationTypeSystem
+	}
+	return ParameterSchema_HCL
+}
+
+func (x *ParameterSchema) GetValidationValueType() string {
+	if x != nil {
+		return x.ValidationValueType
+	}
+	return ""
+}
+
+func (x *ParameterSchema) GetValidationError() string {
+	if x != nil {
+		return x.ValidationError
+	}
+	return ""
+}
+
+func (x *ParameterSchema) GetValidationCondition() string {
+	if x != nil {
+		return x.ValidationCondition
+	}
+	return ""
+}
+
 // Parse consumes source-code from a directory to produce inputs.
 type Parse struct {
 	state         protoimpl.MessageState
@@ -233,7 +466,7 @@ type Parse struct {
 func (x *Parse) Reset() {
 	*x = Parse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_provisioner_proto_msgTypes[2]
+		mi := &file_provisioner_proto_msgTypes[4]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -246,7 +479,7 @@ func (x *Parse) String() string {
 func (*Parse) ProtoMessage() {}
 
 func (x *Parse) ProtoReflect() protoreflect.Message {
-	mi := &file_provisioner_proto_msgTypes[2]
+	mi := &file_provisioner_proto_msgTypes[4]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -259,7 +492,7 @@ func (x *Parse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Parse.ProtoReflect.Descriptor instead.
 func (*Parse) Descriptor() ([]byte, []int) {
-	return file_provisioner_proto_rawDescGZIP(), []int{2}
+	return file_provisioner_proto_rawDescGZIP(), []int{4}
 }
 
 // Resource is a provisioned unit.
@@ -275,7 +508,7 @@ type Resource struct {
 func (x *Resource) Reset() {
 	*x = Resource{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_provisioner_proto_msgTypes[3]
+		mi := &file_provisioner_proto_msgTypes[5]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -288,7 +521,7 @@ func (x *Resource) String() string {
 func (*Resource) ProtoMessage() {}
 
 func (x *Resource) ProtoReflect() protoreflect.Message {
-	mi := &file_provisioner_proto_msgTypes[3]
+	mi := &file_provisioner_proto_msgTypes[5]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -301,7 +534,7 @@ func (x *Resource) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Resource.ProtoReflect.Descriptor instead.
 func (*Resource) Descriptor() ([]byte, []int) {
-	return file_provisioner_proto_rawDescGZIP(), []int{3}
+	return file_provisioner_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *Resource) GetName() string {
@@ -328,7 +561,7 @@ type Provision struct {
 func (x *Provision) Reset() {
 	*x = Provision{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_provisioner_proto_msgTypes[4]
+		mi := &file_provisioner_proto_msgTypes[6]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -341,7 +574,7 @@ func (x *Provision) String() string {
 func (*Provision) ProtoMessage() {}
 
 func (x *Provision) ProtoReflect() protoreflect.Message {
-	mi := &file_provisioner_proto_msgTypes[4]
+	mi := &file_provisioner_proto_msgTypes[6]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -354,7 +587,7 @@ func (x *Provision) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Provision.ProtoReflect.Descriptor instead.
 func (*Provision) Descriptor() ([]byte, []int) {
-	return file_provisioner_proto_rawDescGZIP(), []int{4}
+	return file_provisioner_proto_rawDescGZIP(), []int{6}
 }
 
 type Parse_Request struct {
@@ -368,7 +601,7 @@ type Parse_Request struct {
 func (x *Parse_Request) Reset() {
 	*x = Parse_Request{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_provisioner_proto_msgTypes[5]
+		mi := &file_provisioner_proto_msgTypes[7]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -381,7 +614,7 @@ func (x *Parse_Request) String() string {
 func (*Parse_Request) ProtoMessage() {}
 
 func (x *Parse_Request) ProtoReflect() protoreflect.Message {
-	mi := &file_provisioner_proto_msgTypes[5]
+	mi := &file_provisioner_proto_msgTypes[7]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -394,7 +627,7 @@ func (x *Parse_Request) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Parse_Request.ProtoReflect.Descriptor instead.
 func (*Parse_Request) Descriptor() ([]byte, []int) {
-	return file_provisioner_proto_rawDescGZIP(), []int{2, 0}
+	return file_provisioner_proto_rawDescGZIP(), []int{4, 0}
 }
 
 func (x *Parse_Request) GetDirectory() string {
@@ -415,7 +648,7 @@ type Parse_Response struct {
 func (x *Parse_Response) Reset() {
 	*x = Parse_Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_provisioner_proto_msgTypes[6]
+		mi := &file_provisioner_proto_msgTypes[8]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -428,7 +661,7 @@ func (x *Parse_Response) String() string {
 func (*Parse_Response) ProtoMessage() {}
 
 func (x *Parse_Response) ProtoReflect() protoreflect.Message {
-	mi := &file_provisioner_proto_msgTypes[6]
+	mi := &file_provisioner_proto_msgTypes[8]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -441,7 +674,7 @@ func (x *Parse_Response) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Parse_Response.ProtoReflect.Descriptor instead.
 func (*Parse_Response) Descriptor() ([]byte, []int) {
-	return file_provisioner_proto_rawDescGZIP(), []int{2, 1}
+	return file_provisioner_proto_rawDescGZIP(), []int{4, 1}
 }
 
 func (x *Parse_Response) GetParameterSchemas() []*ParameterSchema {
@@ -464,7 +697,7 @@ type Provision_Request struct {
 func (x *Provision_Request) Reset() {
 	*x = Provision_Request{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_provisioner_proto_msgTypes[7]
+		mi := &file_provisioner_proto_msgTypes[9]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -477,7 +710,7 @@ func (x *Provision_Request) String() string {
 func (*Provision_Request) ProtoMessage() {}
 
 func (x *Provision_Request) ProtoReflect() protoreflect.Message {
-	mi := &file_provisioner_proto_msgTypes[7]
+	mi := &file_provisioner_proto_msgTypes[9]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -490,7 +723,7 @@ func (x *Provision_Request) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Provision_Request.ProtoReflect.Descriptor instead.
 func (*Provision_Request) Descriptor() ([]byte, []int) {
-	return file_provisioner_proto_rawDescGZIP(), []int{4, 0}
+	return file_provisioner_proto_rawDescGZIP(), []int{6, 0}
 }
 
 func (x *Provision_Request) GetDirectory() string {
@@ -526,7 +759,7 @@ type Provision_Response struct {
 func (x *Provision_Response) Reset() {
 	*x = Provision_Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_provisioner_proto_msgTypes[8]
+		mi := &file_provisioner_proto_msgTypes[10]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -539,7 +772,7 @@ func (x *Provision_Response) String() string {
 func (*Provision_Response) ProtoMessage() {}
 
 func (x *Provision_Response) ProtoReflect() protoreflect.Message {
-	mi := &file_provisioner_proto_msgTypes[8]
+	mi := &file_provisioner_proto_msgTypes[10]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -552,7 +785,7 @@ func (x *Provision_Response) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Provision_Response.ProtoReflect.Descriptor instead.
 func (*Provision_Response) Descriptor() ([]byte, []int) {
-	return file_provisioner_proto_rawDescGZIP(), []int{4, 1}
+	return file_provisioner_proto_rawDescGZIP(), []int{6, 1}
 }
 
 func (x *Provision_Response) GetState() []byte {
@@ -574,75 +807,115 @@ var File_provisioner_proto protoreflect.FileDescriptor
 var file_provisioner_proto_rawDesc = []byte{
 	0x0a, 0x11, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x70, 0x72,
 	0x6f, 0x74, 0x6f, 0x12, 0x0b, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72,
-	0x22, 0x92, 0x03, 0x0a, 0x0f, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x53, 0x63,
-	0x68, 0x65, 0x6d, 0x61, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63,
-	0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64,
-	0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x23, 0x0a, 0x0d, 0x64, 0x65,
-	0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x0c, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12,
-	0x1c, 0x0a, 0x09, 0x73, 0x65, 0x6e, 0x73, 0x69, 0x74, 0x69, 0x76, 0x65, 0x18, 0x04, 0x20, 0x01,
-	0x28, 0x08, 0x52, 0x09, 0x73, 0x65, 0x6e, 0x73, 0x69, 0x74, 0x69, 0x76, 0x65, 0x12, 0x5d, 0x0a,
+	0x22, 0x78, 0x0a, 0x0f, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x53, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x12, 0x3b, 0x0a, 0x06, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0e, 0x32, 0x23, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65,
+	0x72, 0x2e, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x53, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x2e, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x65, 0x52, 0x06, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x65,
+	0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x12, 0x0a, 0x06, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x65,
+	0x12, 0x08, 0x0a, 0x04, 0x44, 0x41, 0x54, 0x41, 0x10, 0x00, 0x22, 0xac, 0x01, 0x0a, 0x14, 0x50,
+	0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x44, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x12, 0x40, 0x0a, 0x06, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0e, 0x32, 0x28, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65,
+	0x72, 0x2e, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x44, 0x65, 0x73, 0x74, 0x69,
+	0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x65, 0x52, 0x06, 0x73,
+	0x63, 0x68, 0x65, 0x6d, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x3c, 0x0a, 0x06, 0x53,
+	0x63, 0x68, 0x65, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x14, 0x45, 0x4e, 0x56, 0x49, 0x52, 0x4f, 0x4e,
+	0x4d, 0x45, 0x4e, 0x54, 0x5f, 0x56, 0x41, 0x52, 0x49, 0x41, 0x42, 0x4c, 0x45, 0x10, 0x00, 0x12,
+	0x18, 0x0a, 0x14, 0x50, 0x52, 0x4f, 0x56, 0x49, 0x53, 0x49, 0x4f, 0x4e, 0x45, 0x52, 0x5f, 0x56,
+	0x41, 0x52, 0x49, 0x41, 0x42, 0x4c, 0x45, 0x10, 0x01, 0x22, 0x93, 0x01, 0x0a, 0x0e, 0x50, 0x61,
+	0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x57, 0x0a, 0x12,
+	0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x73, 0x63, 0x68, 0x65,
+	0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x28, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69,
+	0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72,
+	0x44, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x53, 0x63, 0x68, 0x65,
+	0x6d, 0x65, 0x52, 0x11, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x53,
+	0x63, 0x68, 0x65, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c,
+	0x75, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22,
+	0x83, 0x05, 0x0a, 0x0f, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x53, 0x63, 0x68,
+	0x65, 0x6d, 0x61, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72,
+	0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65,
+	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x43, 0x0a, 0x0e, 0x64, 0x65, 0x66,
+	0x61, 0x75, 0x6c, 0x74, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x1c, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e,
+	0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52,
+	0x0d, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x32,
+	0x0a, 0x15, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x5f, 0x6f, 0x76, 0x65, 0x72, 0x72, 0x69, 0x64, 0x65,
+	0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x13, 0x61,
+	0x6c, 0x6c, 0x6f, 0x77, 0x4f, 0x76, 0x65, 0x72, 0x72, 0x69, 0x64, 0x65, 0x53, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x12, 0x52, 0x0a, 0x13, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x64, 0x65,
+	0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x21, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x50, 0x61,
+	0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x44, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x52, 0x12, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x44, 0x65, 0x73, 0x74, 0x69,
+	0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x3c, 0x0a, 0x1a, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x5f,
+	0x6f, 0x76, 0x65, 0x72, 0x72, 0x69, 0x64, 0x65, 0x5f, 0x64, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x18, 0x61, 0x6c, 0x6c, 0x6f,
+	0x77, 0x4f, 0x76, 0x65, 0x72, 0x72, 0x69, 0x64, 0x65, 0x44, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x12, 0x27, 0x0a, 0x0f, 0x72, 0x65, 0x64, 0x69, 0x73, 0x70, 0x6c, 0x61,
+	0x79, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0e, 0x72,
+	0x65, 0x64, 0x69, 0x73, 0x70, 0x6c, 0x61, 0x79, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x5d, 0x0a,
 	0x16, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x79, 0x70, 0x65,
-	0x5f, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x27, 0x2e,
+	0x5f, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x27, 0x2e,
 	0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x50, 0x61, 0x72, 0x61,
 	0x6d, 0x65, 0x74, 0x65, 0x72, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x54, 0x79, 0x70, 0x65,
 	0x53, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x52, 0x14, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x69,
 	0x6f, 0x6e, 0x54, 0x79, 0x70, 0x65, 0x53, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x12, 0x32, 0x0a, 0x15,
 	0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65,
-	0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x76, 0x61, 0x6c,
+	0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x76, 0x61, 0x6c,
 	0x69, 0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x54, 0x79, 0x70, 0x65,
 	0x12, 0x29, 0x0a, 0x10, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x65,
-	0x72, 0x72, 0x6f, 0x72, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x76, 0x61, 0x6c, 0x69,
+	0x72, 0x72, 0x6f, 0x72, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x76, 0x61, 0x6c, 0x69,
 	0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x12, 0x31, 0x0a, 0x14, 0x76,
 	0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74,
-	0x69, 0x6f, 0x6e, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x76, 0x61, 0x6c, 0x69, 0x64,
+	0x69, 0x6f, 0x6e, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x76, 0x61, 0x6c, 0x69, 0x64,
 	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x15,
 	0x0a, 0x0a, 0x54, 0x79, 0x70, 0x65, 0x53, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x12, 0x07, 0x0a, 0x03,
-	0x48, 0x43, 0x4c, 0x10, 0x00, 0x22, 0x3a, 0x0a, 0x0e, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74,
-	0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x76,
-	0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75,
-	0x65, 0x22, 0x87, 0x01, 0x0a, 0x05, 0x50, 0x61, 0x72, 0x73, 0x65, 0x1a, 0x27, 0x0a, 0x07, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1c, 0x0a, 0x09, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74,
-	0x6f, 0x72, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x64, 0x69, 0x72, 0x65, 0x63,
-	0x74, 0x6f, 0x72, 0x79, 0x1a, 0x55, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x12, 0x49, 0x0a, 0x11, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x5f, 0x73, 0x63,
-	0x68, 0x65, 0x6d, 0x61, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x70, 0x72,
-	0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65,
-	0x74, 0x65, 0x72, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x52, 0x10, 0x70, 0x61, 0x72, 0x61, 0x6d,
-	0x65, 0x74, 0x65, 0x72, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x73, 0x22, 0x32, 0x0a, 0x08, 0x52,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x74,
-	0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x22,
-	0xea, 0x01, 0x0a, 0x09, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x1a, 0x85, 0x01,
-	0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1c, 0x0a, 0x09, 0x64, 0x69, 0x72,
-	0x65, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x64, 0x69,
-	0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x12, 0x46, 0x0a, 0x10, 0x70, 0x61, 0x72, 0x61, 0x6d,
-	0x65, 0x74, 0x65, 0x72, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x1b, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e,
-	0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0f,
-	0x70, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x12,
-	0x14, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05,
-	0x73, 0x74, 0x61, 0x74, 0x65, 0x1a, 0x55, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c,
-	0x52, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x12, 0x33, 0x0a, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x70, 0x72, 0x6f,
-	0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x52, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x32, 0x9d, 0x01, 0x0a,
-	0x0b, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x12, 0x40, 0x0a, 0x05,
-	0x50, 0x61, 0x72, 0x73, 0x65, 0x12, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f,
-	0x6e, 0x65, 0x72, 0x2e, 0x50, 0x61, 0x72, 0x73, 0x65, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x1b, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e,
-	0x50, 0x61, 0x72, 0x73, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4c,
-	0x0a, 0x09, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x1e, 0x2e, 0x70, 0x72,
-	0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73,
-	0x69, 0x6f, 0x6e, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x70, 0x72,
-	0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73,
-	0x69, 0x6f, 0x6e, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x2a, 0x5a, 0x28,
-	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x64, 0x65, 0x72,
-	0x2f, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2f, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e,
-	0x65, 0x72, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x48, 0x43, 0x4c, 0x10, 0x00, 0x22, 0x87, 0x01, 0x0a, 0x05, 0x50, 0x61, 0x72, 0x73, 0x65, 0x1a,
+	0x27, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1c, 0x0a, 0x09, 0x64, 0x69,
+	0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x64,
+	0x69, 0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x1a, 0x55, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x49, 0x0a, 0x11, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65,
+	0x72, 0x5f, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x1c, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x50, 0x61,
+	0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x52, 0x10, 0x70,
+	0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x73, 0x22,
+	0x32, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6e,
+	0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12,
+	0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74,
+	0x79, 0x70, 0x65, 0x22, 0xea, 0x01, 0x0a, 0x09, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f,
+	0x6e, 0x1a, 0x85, 0x01, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1c, 0x0a,
+	0x09, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x09, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x12, 0x46, 0x0a, 0x10, 0x70,
+	0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x18,
+	0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f,
+	0x6e, 0x65, 0x72, 0x2e, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x56, 0x61, 0x6c,
+	0x75, 0x65, 0x52, 0x0f, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x56, 0x61, 0x6c,
+	0x75, 0x65, 0x73, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x0c, 0x52, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x1a, 0x55, 0x0a, 0x08, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x12, 0x33, 0x0a, 0x09, 0x72,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15,
+	0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x52, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73,
+	0x32, 0x9d, 0x01, 0x0a, 0x0b, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72,
+	0x12, 0x40, 0x0a, 0x05, 0x50, 0x61, 0x72, 0x73, 0x65, 0x12, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x76,
+	0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x50, 0x61, 0x72, 0x73, 0x65, 0x2e, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1b, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f,
+	0x6e, 0x65, 0x72, 0x2e, 0x50, 0x61, 0x72, 0x73, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x12, 0x4c, 0x0a, 0x09, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x12,
+	0x1e, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x50, 0x72,
+	0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x1f, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x50, 0x72,
+	0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x42, 0x2d, 0x5a, 0x2b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63,
+	0x6f, 0x64, 0x65, 0x72, 0x2f, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2f, 0x70, 0x72, 0x6f, 0x76, 0x69,
+	0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x73, 0x64, 0x6b, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
+	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -657,34 +930,43 @@ func file_provisioner_proto_rawDescGZIP() []byte {
 	return file_provisioner_proto_rawDescData
 }
 
-var file_provisioner_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
-var file_provisioner_proto_msgTypes = make([]protoimpl.MessageInfo, 9)
+var file_provisioner_proto_enumTypes = make([]protoimpl.EnumInfo, 3)
+var file_provisioner_proto_msgTypes = make([]protoimpl.MessageInfo, 11)
 var file_provisioner_proto_goTypes = []interface{}{
-	(ParameterSchema_TypeSystem)(0), // 0: provisioner.ParameterSchema.TypeSystem
-	(*ParameterSchema)(nil),         // 1: provisioner.ParameterSchema
-	(*ParameterValue)(nil),          // 2: provisioner.ParameterValue
-	(*Parse)(nil),                   // 3: provisioner.Parse
-	(*Resource)(nil),                // 4: provisioner.Resource
-	(*Provision)(nil),               // 5: provisioner.Provision
-	(*Parse_Request)(nil),           // 6: provisioner.Parse.Request
-	(*Parse_Response)(nil),          // 7: provisioner.Parse.Response
-	(*Provision_Request)(nil),       // 8: provisioner.Provision.Request
-	(*Provision_Response)(nil),      // 9: provisioner.Provision.Response
+	(ParameterSource_Scheme)(0),      // 0: provisioner.ParameterSource.Scheme
+	(ParameterDestination_Scheme)(0), // 1: provisioner.ParameterDestination.Scheme
+	(ParameterSchema_TypeSystem)(0),  // 2: provisioner.ParameterSchema.TypeSystem
+	(*ParameterSource)(nil),          // 3: provisioner.ParameterSource
+	(*ParameterDestination)(nil),     // 4: provisioner.ParameterDestination
+	(*ParameterValue)(nil),           // 5: provisioner.ParameterValue
+	(*ParameterSchema)(nil),          // 6: provisioner.ParameterSchema
+	(*Parse)(nil),                    // 7: provisioner.Parse
+	(*Resource)(nil),                 // 8: provisioner.Resource
+	(*Provision)(nil),                // 9: provisioner.Provision
+	(*Parse_Request)(nil),            // 10: provisioner.Parse.Request
+	(*Parse_Response)(nil),           // 11: provisioner.Parse.Response
+	(*Provision_Request)(nil),        // 12: provisioner.Provision.Request
+	(*Provision_Response)(nil),       // 13: provisioner.Provision.Response
 }
 var file_provisioner_proto_depIdxs = []int32{
-	0, // 0: provisioner.ParameterSchema.validation_type_system:type_name -> provisioner.ParameterSchema.TypeSystem
-	1, // 1: provisioner.Parse.Response.parameter_schemas:type_name -> provisioner.ParameterSchema
-	2, // 2: provisioner.Provision.Request.parameter_values:type_name -> provisioner.ParameterValue
-	4, // 3: provisioner.Provision.Response.resources:type_name -> provisioner.Resource
-	6, // 4: provisioner.Provisioner.Parse:input_type -> provisioner.Parse.Request
-	8, // 5: provisioner.Provisioner.Provision:input_type -> provisioner.Provision.Request
-	7, // 6: provisioner.Provisioner.Parse:output_type -> provisioner.Parse.Response
-	9, // 7: provisioner.Provisioner.Provision:output_type -> provisioner.Provision.Response
-	6, // [6:8] is the sub-list for method output_type
-	4, // [4:6] is the sub-list for method input_type
-	4, // [4:4] is the sub-list for extension type_name
-	4, // [4:4] is the sub-list for extension extendee
-	0, // [0:4] is the sub-list for field type_name
+	0,  // 0: provisioner.ParameterSource.scheme:type_name -> provisioner.ParameterSource.Scheme
+	1,  // 1: provisioner.ParameterDestination.scheme:type_name -> provisioner.ParameterDestination.Scheme
+	1,  // 2: provisioner.ParameterValue.destination_scheme:type_name -> provisioner.ParameterDestination.Scheme
+	3,  // 3: provisioner.ParameterSchema.default_source:type_name -> provisioner.ParameterSource
+	4,  // 4: provisioner.ParameterSchema.default_destination:type_name -> provisioner.ParameterDestination
+	2,  // 5: provisioner.ParameterSchema.validation_type_system:type_name -> provisioner.ParameterSchema.TypeSystem
+	6,  // 6: provisioner.Parse.Response.parameter_schemas:type_name -> provisioner.ParameterSchema
+	5,  // 7: provisioner.Provision.Request.parameter_values:type_name -> provisioner.ParameterValue
+	8,  // 8: provisioner.Provision.Response.resources:type_name -> provisioner.Resource
+	10, // 9: provisioner.Provisioner.Parse:input_type -> provisioner.Parse.Request
+	12, // 10: provisioner.Provisioner.Provision:input_type -> provisioner.Provision.Request
+	11, // 11: provisioner.Provisioner.Parse:output_type -> provisioner.Parse.Response
+	13, // 12: provisioner.Provisioner.Provision:output_type -> provisioner.Provision.Response
+	11, // [11:13] is the sub-list for method output_type
+	9,  // [9:11] is the sub-list for method input_type
+	9,  // [9:9] is the sub-list for extension type_name
+	9,  // [9:9] is the sub-list for extension extendee
+	0,  // [0:9] is the sub-list for field type_name
 }
 
 func init() { file_provisioner_proto_init() }
@@ -694,7 +976,7 @@ func file_provisioner_proto_init() {
 	}
 	if !protoimpl.UnsafeEnabled {
 		file_provisioner_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ParameterSchema); i {
+			switch v := v.(*ParameterSource); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -706,7 +988,7 @@ func file_provisioner_proto_init() {
 			}
 		}
 		file_provisioner_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ParameterValue); i {
+			switch v := v.(*ParameterDestination); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -718,7 +1000,7 @@ func file_provisioner_proto_init() {
 			}
 		}
 		file_provisioner_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Parse); i {
+			switch v := v.(*ParameterValue); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -730,7 +1012,7 @@ func file_provisioner_proto_init() {
 			}
 		}
 		file_provisioner_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Resource); i {
+			switch v := v.(*ParameterSchema); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -742,7 +1024,7 @@ func file_provisioner_proto_init() {
 			}
 		}
 		file_provisioner_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Provision); i {
+			switch v := v.(*Parse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -754,7 +1036,7 @@ func file_provisioner_proto_init() {
 			}
 		}
 		file_provisioner_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Parse_Request); i {
+			switch v := v.(*Resource); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -766,7 +1048,7 @@ func file_provisioner_proto_init() {
 			}
 		}
 		file_provisioner_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Parse_Response); i {
+			switch v := v.(*Provision); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -778,7 +1060,7 @@ func file_provisioner_proto_init() {
 			}
 		}
 		file_provisioner_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Provision_Request); i {
+			switch v := v.(*Parse_Request); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -790,6 +1072,30 @@ func file_provisioner_proto_init() {
 			}
 		}
 		file_provisioner_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Parse_Response); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_provisioner_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Provision_Request); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_provisioner_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*Provision_Response); i {
 			case 0:
 				return &v.state
@@ -807,8 +1113,8 @@ func file_provisioner_proto_init() {
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_provisioner_proto_rawDesc,
-			NumEnums:      1,
-			NumMessages:   9,
+			NumEnums:      3,
+			NumMessages:   11,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/provisionersdk/proto/provisioner.proto b/provisionersdk/proto/provisioner.proto
index 362604c27ec89..c865dced18fe9 100644
--- a/provisionersdk/proto/provisioner.proto
+++ b/provisionersdk/proto/provisioner.proto
@@ -1,29 +1,52 @@
 
 syntax = "proto3";
-option go_package = "github.com/coder/coder/provisioner/proto";
+option go_package = "github.com/coder/coder/provisionersdk/proto";
 
 package provisioner;
 
+// ParameterSource represents the source location for a parameter to get it's value from.
+message ParameterSource {
+    enum Scheme {
+        DATA = 0;
+    }
+    Scheme scheme = 1;
+    string value = 2;
+}
+
+// ParameterDestination represents the target location for a provisioner to set the value.
+message ParameterDestination {
+    enum Scheme {
+        ENVIRONMENT_VARIABLE = 0;
+        PROVISIONER_VARIABLE = 1;
+    }
+    Scheme scheme = 1;
+    string value = 2;
+}
+
+// ParameterValue represents the resolved source and destination of a parameter.
+message ParameterValue {
+    ParameterDestination.Scheme destination_scheme = 1;
+    string name = 2;
+    string value = 3;
+}
+
 // ParameterSchema represents validation and type information for a parsed parameter.
 message ParameterSchema {
     string name = 1;
     string description = 2;
-    string default_value = 3;
-    bool sensitive = 4;
+    ParameterSource default_source = 3;
+    bool allow_override_source = 4;
+    ParameterDestination default_destination = 5;
+    bool allow_override_destination = 6;
+    bool redisplay_value = 7;
 
     enum TypeSystem {
         HCL = 0;
     }
-    TypeSystem validation_type_system = 5;
-    string validation_value_type = 6;
-    string validation_error = 7;
-    string validation_condition = 8;
-}
-
-// ParameterValue holds the value of a parameter.
-message ParameterValue {
-    string name = 1;
-    string value = 2;
+    TypeSystem validation_type_system = 8;
+    string validation_value_type = 9;
+    string validation_error = 10;
+    string validation_condition = 11;
 }
 
 // Parse consumes source-code from a directory to produce inputs.
@@ -58,4 +81,4 @@ message Provision {
 service Provisioner {
     rpc Parse(Parse.Request) returns (Parse.Response);
     rpc Provision(Provision.Request) returns (Provision.Response);
-}
+}
\ No newline at end of file