diff --git a/docs/resources/migrate.md b/docs/resources/migrate.md
new file mode 100644
index 0000000..0910fc7
--- /dev/null
+++ b/docs/resources/migrate.md
@@ -0,0 +1,68 @@
+---
+page_title: "sql_migrate Resource - terraform-provider-sql"
+subcategory: ""
+description: |-
+  
+---
+
+# Resource `sql_migrate`
+
+
+
+## Example Usage
+
+```terraform
+resource "sql_migrate" "users" {
+  migration {
+    up = <<SQL
+CREATE TABLE users (
+	user_id integer unique,
+	name    varchar(40),
+	email   varchar(40)
+);
+SQL
+
+    down = "DROP TABLE IF EXISTS users;"
+  }
+
+  migration {
+    up   = "INSERT INTO users VALUES (1, 'Paul Tyng', 'paul@example.com');"
+    down = "DELETE FROM users WHERE user_id = 1;"
+  }
+}
+
+data "sql_query" "users" {
+  # run this query after the migration
+  depends_on = [sql_migrate.users]
+
+  query = "select * from users"
+}
+
+output "rowcount" {
+  value = length(data.sql_query.users.result)
+}
+```
+
+## Schema
+
+### Optional
+
+- **migration** (Block List) (see [below for nested schema](#nestedblock--migration))
+
+### Read-only
+
+- **id** (String, Read-only, Deprecated) The ID of this resource.
+
+<a id="nestedblock--migration"></a>
+### Nested Schema for `migration`
+
+Required:
+
+- **down** (String, Required)
+- **up** (String, Required)
+
+Optional:
+
+- **id** (String, Optional) Identifier can be any string to help identifying the migration in the source.
+
+
diff --git a/examples/resources/sql_migrate/main.tf b/examples/resources/sql_migrate/main.tf
new file mode 100644
index 0000000..1fdd2d4
--- /dev/null
+++ b/examples/resources/sql_migrate/main.tf
@@ -0,0 +1,11 @@
+terraform {
+  required_providers {
+    sql = {
+      source = "paultyng/sql"
+    }
+  }
+}
+
+provider "sql" {
+  url = "postgres://postgres:tf@localhost:5432/tftest?sslmode=disable"
+}
diff --git a/examples/resources/sql_migrate/resource.tf b/examples/resources/sql_migrate/resource.tf
new file mode 100644
index 0000000..30889f3
--- /dev/null
+++ b/examples/resources/sql_migrate/resource.tf
@@ -0,0 +1,29 @@
+resource "sql_migrate" "users" {
+  migration {
+    up = <<SQL
+CREATE TABLE users (
+	user_id integer unique,
+	name    varchar(40),
+	email   varchar(40)
+);
+SQL
+
+    down = "DROP TABLE IF EXISTS users;"
+  }
+
+  migration {
+    up   = "INSERT INTO users VALUES (1, 'Paul Tyng', 'paul@example.com');"
+    down = "DELETE FROM users WHERE user_id = 1;"
+  }
+}
+
+data "sql_query" "users" {
+  # run this query after the migration
+  depends_on = [sql_migrate.users]
+
+  query = "select * from users"
+}
+
+output "rowcount" {
+  value = length(data.sql_query.users.result)
+}
diff --git a/go.mod b/go.mod
index 59ab417..a4c6c8f 100644
--- a/go.mod
+++ b/go.mod
@@ -21,7 +21,6 @@ require (
 	github.com/opencontainers/image-spec v1.0.1 // indirect
 	github.com/opencontainers/runc v0.1.1 // indirect
 	github.com/ory/dockertest v3.3.5+incompatible
-	golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208
 	golang.org/x/sys v0.0.0-20200826173525-f9321e4c35a6 // indirect
 	gopkg.in/yaml.v2 v2.2.8 // indirect
 	gotest.tools v2.2.0+incompatible // indirect
diff --git a/internal/provider/resource_migrate.go b/internal/provider/resource_migrate.go
new file mode 100644
index 0000000..e9dd440
--- /dev/null
+++ b/internal/provider/resource_migrate.go
@@ -0,0 +1,309 @@
+package provider
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/hashicorp/terraform-plugin-go/tfprotov5"
+	"github.com/hashicorp/terraform-plugin-go/tfprotov5/tftypes"
+)
+
+type resourceMigrate struct {
+	p *provider
+}
+
+func (r *resourceMigrate) Schema(ctx context.Context) *tfprotov5.Schema {
+	return &tfprotov5.Schema{
+		Block: &tfprotov5.SchemaBlock{
+			BlockTypes: []*tfprotov5.SchemaNestedBlock{
+				{
+					TypeName: "migration",
+					Nesting:  tfprotov5.SchemaNestedBlockNestingModeList,
+					Block: &tfprotov5.SchemaBlock{
+						Attributes: []*tfprotov5.SchemaAttribute{
+							{
+								Name:            "id",
+								Optional:        true,
+								Computed:        true,
+								Description:     "Identifier can be any string to help identifying the migration in the source.",
+								DescriptionKind: tfprotov5.StringKindMarkdown,
+								Type:            tftypes.String,
+							},
+							{
+								Name:            "up",
+								Required:        true,
+								DescriptionKind: tfprotov5.StringKindMarkdown,
+								Type:            tftypes.String,
+							},
+							{
+								Name:            "down",
+								Required:        true,
+								DescriptionKind: tfprotov5.StringKindMarkdown,
+								Type:            tftypes.String,
+							},
+						},
+					},
+				},
+				// {
+				// 	TypeName: "files",
+				// 	Nesting:  tfprotov5.SchemaNestedBlockNestingModeSingle,
+				// 	MaxItems: 1,
+				// 	Block: &tfprotov5.SchemaBlock{
+				// 		Attributes: []*tfprotov5.SchemaAttribute{
+				// 			{
+				// 				Name:            "directory",
+				// 				Optional:        true,
+				// 				DescriptionKind: tfprotov5.StringKindMarkdown,
+				// 				Type:            tftypes.String,
+				// 			},
+				// 			{
+				// 				// standard, shmig
+				// 				Name:            "mode",
+				// 				Optional:        true,
+				// 				Computed:        true,
+				// 				DescriptionKind: tfprotov5.StringKindMarkdown,
+				// 				Type:            tftypes.String,
+				// 			},
+				// 		},
+				// 	},
+				// },
+			},
+			Attributes: []*tfprotov5.SchemaAttribute{
+				// {
+				// 	Name:            "complete_migration_ids",
+				// 	Computed:        true,
+				// 	DescriptionKind: tfprotov5.StringKindMarkdown,
+				// 	Type: tftypes.List{
+				// 		ElementType: tftypes.String,
+				// 	},
+				// },
+
+				// TODO: remove this once its not needed by testing
+				{
+					Name:            "id",
+					Computed:        true,
+					Deprecated:      true,
+					DescriptionKind: tfprotov5.StringKindMarkdown,
+					Type:            tftypes.String,
+				},
+			},
+		},
+	}
+}
+
+func (r *resourceMigrate) Validate(ctx context.Context, config map[string]tftypes.Value) ([]*tfprotov5.Diagnostic, error) {
+	if migrationValue, ok := config["migration"]; ok {
+		if !migrationValue.IsFullyKnown() {
+			return nil, nil
+		}
+
+		var migrations []tftypes.Value
+		err := migrationValue.As(&migrations)
+		if err != nil {
+			return nil, err
+		}
+
+		if len(migrations) == 0 {
+			return []*tfprotov5.Diagnostic{
+				{
+					Severity: tfprotov5.DiagnosticSeverityError,
+					Summary:  "At least one migration is required.",
+				},
+			}, nil
+		}
+	} else {
+		return []*tfprotov5.Diagnostic{
+			{
+				Severity: tfprotov5.DiagnosticSeverityError,
+				Summary:  "At least one migration is required.",
+			},
+		}, nil
+	}
+
+	return nil, nil
+}
+
+func (r *resourceMigrate) Read(ctx context.Context, current map[string]tftypes.Value) (map[string]tftypes.Value, []*tfprotov5.Diagnostic, error) {
+	// just roundtrip state here
+	return current, nil, nil
+}
+
+func (r *resourceMigrate) Plan(ctx context.Context, proposed map[string]tftypes.Value, config map[string]tftypes.Value, prior map[string]tftypes.Value) (map[string]tftypes.Value, []*tfprotov5.Diagnostic, error) {
+	var migrations []tftypes.Value
+	err := proposed["migration"].As(&migrations)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	migrationType := schemaAsObject(r.Schema(ctx)).AttributeTypes["migration"]
+
+	for i, mObj := range migrations {
+		var m map[string]tftypes.Value
+		err := mObj.As(&m)
+		if err != nil {
+			return nil, nil, err
+		}
+
+		if !m["id"].IsFullyKnown() {
+			m["id"] = tftypes.NewValue(tftypes.String, fmt.Sprintf("migration%d", i))
+		}
+		migrations[i] = tftypes.NewValue(migrationType, m)
+	}
+
+	return map[string]tftypes.Value{
+		"id": tftypes.NewValue(tftypes.String, "static-id"),
+		"migration": tftypes.NewValue(tftypes.List{
+			ElementType: migrationType,
+		}, migrations),
+	}, nil, nil
+}
+
+func (r *resourceMigrate) Create(ctx context.Context, planned map[string]tftypes.Value, config map[string]tftypes.Value, prior map[string]tftypes.Value) (map[string]tftypes.Value, []*tfprotov5.Diagnostic, error) {
+	migrations, err := valueAsMigrationSlice(planned["migration"])
+	if err != nil {
+		return nil, nil, err
+	}
+
+	err = r.runMigrations(ctx, migrations, true, nil)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return map[string]tftypes.Value{
+		"id":        planned["id"],
+		"migration": planned["migration"],
+	}, nil, nil
+}
+
+func (r *resourceMigrate) Update(ctx context.Context, planned map[string]tftypes.Value, config map[string]tftypes.Value, prior map[string]tftypes.Value) (map[string]tftypes.Value, []*tfprotov5.Diagnostic, error) {
+	priorMigrations, err := valueAsMigrationSlice(prior["migration"])
+	if err != nil {
+		return nil, nil, err
+	}
+
+	priorMigrationIDs := map[string]bool{}
+	for _, m := range priorMigrations {
+		priorMigrationIDs[m.ID] = true
+	}
+
+	migrations, err := valueAsMigrationSlice(planned["migration"])
+	if err != nil {
+		return nil, nil, err
+	}
+
+	err = r.runMigrations(ctx, migrations, true, priorMigrationIDs)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	// TODO: handle running down any removed migrations in proper ordering?
+
+	return map[string]tftypes.Value{
+		"id":        planned["id"],
+		"migration": planned["migration"],
+	}, nil, nil
+}
+
+func (r *resourceMigrate) Destroy(ctx context.Context, prior map[string]tftypes.Value) ([]*tfprotov5.Diagnostic, error) {
+	priorMigrations, err := valueAsMigrationSlice(prior["migration"])
+	if err != nil {
+		return nil, err
+	}
+
+	priorMigrationIDs := map[string]bool{}
+	for _, m := range priorMigrations {
+		priorMigrationIDs[m.ID] = true
+	}
+
+	err = r.runMigrations(ctx, priorMigrations, false, priorMigrationIDs)
+	if err != nil {
+		return nil, err
+	}
+
+	return nil, nil
+}
+
+type migration struct {
+	ID   string
+	Up   string
+	Down string
+}
+
+func valueAsMigration(v tftypes.Value) (migration, error) {
+	m := migration{}
+
+	var valueMap map[string]tftypes.Value
+	err := v.As(&valueMap)
+	if err != nil {
+		return m, err
+	}
+
+	err = valueMap["id"].As(&m.ID)
+	if err != nil {
+		return m, err
+	}
+
+	err = valueMap["up"].As(&m.Up)
+	if err != nil {
+		return m, err
+	}
+
+	err = valueMap["down"].As(&m.Down)
+	if err != nil {
+		return m, err
+	}
+
+	return m, nil
+}
+
+func valueAsMigrationSlice(v tftypes.Value) ([]migration, error) {
+	var migrationValues []tftypes.Value
+	err := v.As(&migrationValues)
+	if err != nil {
+		return nil, err
+	}
+
+	migrations := []migration{}
+	for _, mValue := range migrationValues {
+		m, err := valueAsMigration(mValue)
+		if err != nil {
+			return nil, err
+		}
+		migrations = append(migrations, m)
+	}
+
+	return migrations, nil
+}
+
+func (r *resourceMigrate) runMigrations(ctx context.Context, migrations []migration, up bool, alreadyRun map[string]bool) error {
+	// TODO: add diagnostics to track down specific migration at error
+
+	if up {
+		for _, m := range migrations {
+			// TODO: should probably filter this somewhere else...
+			if alreadyRun[m.ID] {
+				continue
+			}
+
+			_, err := r.p.db.ExecContext(ctx, m.Up)
+			if err != nil {
+				return err
+			}
+		}
+	} else {
+		for i := len(migrations) - 1; i >= 0; i-- {
+			m := migrations[i]
+
+			if !alreadyRun[m.ID] {
+				continue
+			}
+
+			_, err := r.p.db.ExecContext(ctx, m.Down)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
diff --git a/internal/provider/resource_migrate_test.go b/internal/provider/resource_migrate_test.go
new file mode 100644
index 0000000..6f07bfd
--- /dev/null
+++ b/internal/provider/resource_migrate_test.go
@@ -0,0 +1,115 @@
+package provider
+
+import (
+	"fmt"
+	"testing"
+
+	helperresource "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+)
+
+func TestResourceMigrate(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping long test")
+	}
+
+	for k, url := range testURLs {
+		t.Run(k, func(t *testing.T) {
+			_, err := schemeFromURL(url)
+			if err != nil {
+				t.Fatalf("unable to determine driver scheme for %s: %s", k, err)
+			}
+
+			helperresource.UnitTest(t, helperresource.TestCase{
+				ProtoV5ProviderFactories: protoV5ProviderFactories,
+				Steps: []helperresource.TestStep{
+					{
+						Config: fmt.Sprintf(`
+provider "sql" {
+	url = %q
+
+	max_idle_conns = 0
+}
+
+resource "sql_migrate" "users" {
+	migration {
+		id = "create table"
+
+		up = <<SQL
+CREATE TABLE users (
+	user_id integer unique,
+	name    varchar(40),
+	email   varchar(40)
+);
+SQL
+
+		down = <<SQL
+DROP TABLE users;
+SQL
+	}
+}
+
+data "sql_query" "users" {
+	depends_on = [sql_migrate.users]
+
+	query = "select * from users"
+}
+
+output "rowcount" {
+	value = length(data.sql_query.users.result)
+}
+				`, url),
+						Check: helperresource.ComposeTestCheckFunc(
+							helperresource.TestCheckOutput("rowcount", "0"),
+						),
+					},
+					{
+						Config: fmt.Sprintf(`
+provider "sql" {
+	url = %q
+
+	max_idle_conns = 0
+}
+
+resource "sql_migrate" "users" {
+	migration {
+		id = "create table"
+
+		up = <<SQL
+CREATE TABLE users (
+	user_id integer unique,
+	name    varchar(40),
+	email   varchar(40)
+);
+SQL
+
+		down = <<SQL
+DROP TABLE users;
+SQL
+	}
+
+	migration {
+		id   = "insert row"
+		up   = "INSERT INTO users VALUES (1, 'Paul Tyng', 'paul@example.com');"
+		down = "DELETE FROM users WHERE user_id = 1;"
+	}
+}
+
+data "sql_query" "users" {
+	depends_on = [sql_migrate.users]
+
+	query = "select * from users"
+}
+
+output "rowcount" {
+	value = length(data.sql_query.users.result)
+}
+				`, url),
+						Check: helperresource.ComposeTestCheckFunc(
+							helperresource.TestCheckOutput("rowcount", "1"),
+						),
+					},
+				},
+			})
+		})
+	}
+}
diff --git a/internal/provider/server.go b/internal/provider/server.go
index 9129954..1b73474 100644
--- a/internal/provider/server.go
+++ b/internal/provider/server.go
@@ -66,6 +66,30 @@ func (p *provider) NewDataSource(typeName string) (dataSource, error) {
 	return nil, fmt.Errorf("unexpected data source type %q", typeName)
 }
 
+type resource interface {
+	Schema(context.Context) *tfprotov5.Schema
+	Validate(context.Context, map[string]tftypes.Value) ([]*tfprotov5.Diagnostic, error)
+	Read(ctx context.Context, current map[string]tftypes.Value) (map[string]tftypes.Value, []*tfprotov5.Diagnostic, error)
+	Plan(ctx context.Context, proposed map[string]tftypes.Value, config map[string]tftypes.Value, prior map[string]tftypes.Value) (map[string]tftypes.Value, []*tfprotov5.Diagnostic, error)
+	Destroy(context.Context, map[string]tftypes.Value) ([]*tfprotov5.Diagnostic, error)
+	Create(ctx context.Context, planned map[string]tftypes.Value, config map[string]tftypes.Value, prior map[string]tftypes.Value) (map[string]tftypes.Value, []*tfprotov5.Diagnostic, error)
+	// Read(context.Context, map[string]tftypes.Value) (map[string]tftypes.Value, []*tfprotov5.Diagnostic, error)
+}
+
+type resourceUpdater interface {
+	Update(ctx context.Context, planned map[string]tftypes.Value, config map[string]tftypes.Value, prior map[string]tftypes.Value) (map[string]tftypes.Value, []*tfprotov5.Diagnostic, error)
+}
+
+func (p *provider) NewResource(typeName string) (resource, error) {
+	switch typeName {
+	case "sql_migrate":
+		return &resourceMigrate{
+			p: p,
+		}, nil
+	}
+	return nil, fmt.Errorf("unexpected resource type %q", typeName)
+}
+
 func New(version string) func() tfprotov5.ProviderServer {
 	return func() tfprotov5.ProviderServer {
 		return &provider{}
@@ -89,7 +113,13 @@ func (p *provider) GetProviderSchema(ctx context.Context, req *tfprotov5.GetProv
 		resp.DataSourceSchemas[typeName] = ds.Schema(ctx)
 	}
 
-	// TODO: resources
+	for _, typeName := range []string{"sql_migrate"} {
+		ds, err := p.NewResource(typeName)
+		if err != nil {
+			return nil, err
+		}
+		resp.ResourceSchemas[typeName] = ds.Schema(ctx)
+	}
 
 	return resp, nil
 }
@@ -110,15 +140,9 @@ func (p *provider) ConfigureProvider(ctx context.Context, req *tfprotov5.Configu
 
 	schemaObjectType := schemaAsObject(p.Schema(ctx))
 
-	configObject, err := req.Config.Unmarshal(schemaObjectType)
+	_, config, err := unmarshalDynamicValueObject(req.Config, schemaObjectType)
 	if err != nil {
-		return nil, fmt.Errorf("error req.Config.Unmarshal: %w", err)
-	}
-
-	config := map[string]tftypes.Value{}
-	err = configObject.As(&config)
-	if err != nil {
-		return nil, fmt.Errorf("error configObject.As: %w", err)
+		return nil, fmt.Errorf("ConfigureProvider - unmarshalDynamicValueObject(req.Config): %w", err)
 	}
 
 	var (
@@ -132,7 +156,7 @@ func (p *provider) ConfigureProvider(ctx context.Context, req *tfprotov5.Configu
 		err = config["url"].As(&url)
 		if err != nil {
 			// TODO: diag with path
-			return nil, fmt.Errorf("unable to read url: %w", err)
+			return nil, fmt.Errorf("ConfigureProvider - unable to read url: %w", err)
 		}
 	}
 
@@ -158,7 +182,7 @@ func (p *provider) ConfigureProvider(ctx context.Context, req *tfprotov5.Configu
 		err = config["max_open_conns"].As(&maxOpenConns)
 		if err != nil {
 			// TODO: diag with path
-			return nil, fmt.Errorf("unable to read max_open_conns: %w", err)
+			return nil, fmt.Errorf("ConfigureProvider - unable to read max_open_conns: %w", err)
 		}
 	}
 
@@ -169,19 +193,19 @@ func (p *provider) ConfigureProvider(ctx context.Context, req *tfprotov5.Configu
 		err = v.As(&maxIdleConns)
 		if err != nil {
 			// TODO: diag with path
-			return nil, fmt.Errorf("unable to read max_idle_conns: %w", err)
+			return nil, fmt.Errorf("ConfigureProvider - unable to read max_idle_conns: %w", err)
 		}
 	}
 
 	p.db, err = newDB(url, func(db *sql.DB) error {
 		maxOpen, acc := maxOpenConns.Int64()
 		if acc != big.Exact {
-			return fmt.Errorf("results for max_open_conns is not exact")
+			return fmt.Errorf("ConfigureProvider - results for max_open_conns is not exact")
 		}
 
 		maxIdle, acc := maxIdleConns.Int64()
 		if acc != big.Exact {
-			return fmt.Errorf("results for max_open_conns is not exact")
+			return fmt.Errorf("ConfigureProvider - results for max_open_conns is not exact")
 		}
 
 		db.SetMaxOpenConns(int(maxOpen))
@@ -189,12 +213,12 @@ func (p *provider) ConfigureProvider(ctx context.Context, req *tfprotov5.Configu
 		return nil
 	})
 	if err != nil {
-		return nil, fmt.Errorf("unable to open database: %w", err)
+		return nil, fmt.Errorf("ConfigureProvider - unable to open database: %w", err)
 	}
 
 	err = p.db.PingContext(ctx)
 	if err != nil {
-		return nil, fmt.Errorf("unable to ping database: %w", err)
+		return nil, fmt.Errorf("ConfigureProvider - unable to ping database: %w", err)
 	}
 
 	return &tfprotov5.ConfigureProviderResponse{}, nil
@@ -208,23 +232,239 @@ func (p *provider) StopProvider(ctx context.Context, req *tfprotov5.StopProvider
 // ResourceServer methods
 
 func (p *provider) ValidateResourceTypeConfig(ctx context.Context, req *tfprotov5.ValidateResourceTypeConfigRequest) (*tfprotov5.ValidateResourceTypeConfigResponse, error) {
-	panic("not implemented")
+	r, err := p.NewResource(req.TypeName)
+	if err != nil {
+		return nil, err
+	}
+
+	schemaObjectType := schemaAsObject(r.Schema(ctx))
+
+	_, config, err := unmarshalDynamicValueObject(req.Config, schemaObjectType)
+	if err != nil {
+		return nil, fmt.Errorf("ValidateResourceTypeConfig - unmarshalDynamicValueObject(req.Config): %w", err)
+	}
+
+	diags, err := r.Validate(ctx, config)
+	if err != nil {
+		return nil, err
+	}
+	return &tfprotov5.ValidateResourceTypeConfigResponse{
+		Diagnostics: diags,
+	}, nil
 }
 
 func (p *provider) UpgradeResourceState(ctx context.Context, req *tfprotov5.UpgradeResourceStateRequest) (*tfprotov5.UpgradeResourceStateResponse, error) {
-	panic("not implemented")
+	r, err := p.NewResource(req.TypeName)
+	if err != nil {
+		return nil, err
+	}
+
+	schemaObjectType := schemaAsObject(r.Schema(ctx))
+
+	rawStateObject, err := req.RawState.Unmarshal(schemaObjectType)
+	if err != nil {
+		return nil, err
+	}
+
+	rawStateValue, err := tfprotov5.NewDynamicValue(schemaObjectType, rawStateObject)
+	if err != nil {
+		return nil, err
+	}
+
+	return &tfprotov5.UpgradeResourceStateResponse{
+		UpgradedState: &rawStateValue,
+	}, nil
 }
 
 func (p *provider) ReadResource(ctx context.Context, req *tfprotov5.ReadResourceRequest) (*tfprotov5.ReadResourceResponse, error) {
-	panic("not implemented")
+	r, err := p.NewResource(req.TypeName)
+	if err != nil {
+		return nil, err
+	}
+
+	schemaObjectType := schemaAsObject(r.Schema(ctx))
+
+	_, currentState, err := unmarshalDynamicValueObject(req.CurrentState, schemaObjectType)
+	if err != nil {
+		return nil, fmt.Errorf("ReadResource - unmarshalDynamicValueObject(req.CurrentState): %w", err)
+	}
+
+	newState, diags, err := r.Read(ctx, currentState)
+	if err != nil {
+		return nil, err
+	}
+
+	if diagsHaveError(diags) {
+		return &tfprotov5.ReadResourceResponse{
+			Diagnostics: diags,
+		}, nil
+	}
+
+	newStateValue, err := tfprotov5.NewDynamicValue(schemaObjectType, tftypes.NewValue(schemaObjectType, newState))
+	if err != nil {
+		return nil, fmt.Errorf("ApplyResourceChange - error NewDynamicValue: %w", err)
+	}
+
+	return &tfprotov5.ReadResourceResponse{
+		NewState:    &newStateValue,
+		Diagnostics: diags,
+	}, nil
 }
 
 func (p *provider) PlanResourceChange(ctx context.Context, req *tfprotov5.PlanResourceChangeRequest) (*tfprotov5.PlanResourceChangeResponse, error) {
-	panic("not implemented")
+	r, err := p.NewResource(req.TypeName)
+	if err != nil {
+		return nil, err
+	}
+
+	schemaObjectType := schemaAsObject(r.Schema(ctx))
+
+	proposedObject, proposed, err := unmarshalDynamicValueObject(req.ProposedNewState, schemaObjectType)
+	if err != nil {
+		return nil, fmt.Errorf("PlanResourceChange - unmarshalDynamicValueObject(req.ProposedNewState): %w", err)
+	}
+
+	if proposedObject.IsNull() {
+		// short circuit, this is a destroy
+		return &tfprotov5.PlanResourceChangeResponse{
+			PlannedState: req.ProposedNewState,
+		}, nil
+	}
+
+	_, config, err := unmarshalDynamicValueObject(req.Config, schemaObjectType)
+	if err != nil {
+		return nil, fmt.Errorf("PlanResourceChange - unmarshalDynamicValueObject(req.Config): %w", err)
+	}
+
+	diags, err := r.Validate(ctx, config)
+	if err != nil {
+		return nil, err
+	}
+
+	if diagsHaveError(diags) {
+		return &tfprotov5.PlanResourceChangeResponse{
+			Diagnostics: diags,
+		}, nil
+	}
+
+	_, prior, err := unmarshalDynamicValueObject(req.PriorState, schemaObjectType)
+	if err != nil {
+		return nil, fmt.Errorf("PlanResourceChange - unmarshalDynamicValueObject(req.PriorState): %w", err)
+	}
+
+	state, planDiags, err := r.Plan(ctx, proposed, config, prior)
+	if err != nil {
+		return nil, err
+	}
+	diags = append(diags, planDiags...)
+
+	if diagsHaveError(diags) {
+		return &tfprotov5.PlanResourceChangeResponse{
+			Diagnostics: diags,
+		}, nil
+	}
+
+	stateValue, err := tfprotov5.NewDynamicValue(schemaObjectType, tftypes.NewValue(schemaObjectType, state))
+	if err != nil {
+		return nil, fmt.Errorf("ApplyResourceChange - error NewDynamicValue: %w", err)
+	}
+
+	return &tfprotov5.PlanResourceChangeResponse{
+		PlannedState: &stateValue,
+		Diagnostics:  diags,
+	}, nil
 }
 
 func (p *provider) ApplyResourceChange(ctx context.Context, req *tfprotov5.ApplyResourceChangeRequest) (*tfprotov5.ApplyResourceChangeResponse, error) {
-	panic("not implemented")
+	r, err := p.NewResource(req.TypeName)
+	if err != nil {
+		return nil, err
+	}
+
+	schemaObjectType := schemaAsObject(r.Schema(ctx))
+
+	plannedObject, planned, err := unmarshalDynamicValueObject(req.PlannedState, schemaObjectType)
+	if err != nil {
+		return nil, fmt.Errorf("ApplyResourceChange - unmarshalDynamicValueObject(req.PlannedState): %w", err)
+	}
+
+	priorObject, prior, err := unmarshalDynamicValueObject(req.PriorState, schemaObjectType)
+	if err != nil {
+		return nil, fmt.Errorf("ApplyResourceChange - unmarshalDynamicValueObject(req.PriorState): %w", err)
+	}
+
+	if plannedObject.IsNull() {
+
+		// short circuit, this is a destroy
+		diags, err := r.Destroy(ctx, prior)
+		if err != nil {
+			return nil, err
+		}
+
+		if diagsHaveError(diags) {
+			return &tfprotov5.ApplyResourceChangeResponse{
+				Diagnostics: diags,
+			}, nil
+		}
+
+		return &tfprotov5.ApplyResourceChangeResponse{
+			Diagnostics: diags,
+			NewState:    req.PlannedState,
+		}, nil
+	}
+
+	_, config, err := unmarshalDynamicValueObject(req.Config, schemaObjectType)
+	if err != nil {
+		return nil, fmt.Errorf("ApplyResourceChange - unmarshalDynamicValueObject(req.Config): %w", err)
+	}
+
+	diags, err := r.Validate(ctx, config)
+	if err != nil {
+		return nil, err
+	}
+
+	if diagsHaveError(diags) {
+		return &tfprotov5.ApplyResourceChangeResponse{
+			Diagnostics: diags,
+		}, nil
+	}
+
+	var state map[string]tftypes.Value
+	if priorObject.IsNull() {
+		var createDiags []*tfprotov5.Diagnostic
+		state, createDiags, err = r.Create(ctx, planned, config, prior)
+		if err != nil {
+			return nil, err
+		}
+		diags = append(diags, createDiags...)
+	} else {
+		updater, ok := r.(resourceUpdater)
+		if !ok {
+			return nil, fmt.Errorf("attempting to update resource with no Update implementation")
+		}
+		var updateDiags []*tfprotov5.Diagnostic
+		state, updateDiags, err = updater.Update(ctx, planned, config, prior)
+		if err != nil {
+			return nil, err
+		}
+		diags = append(diags, updateDiags...)
+	}
+
+	if diagsHaveError(diags) {
+		return &tfprotov5.ApplyResourceChangeResponse{
+			Diagnostics: diags,
+		}, nil
+	}
+
+	stateValue, err := tfprotov5.NewDynamicValue(schemaObjectType, tftypes.NewValue(schemaObjectType, state))
+	if err != nil {
+		return nil, fmt.Errorf("ApplyResourceChange - error NewDynamicValue: %w", err)
+	}
+
+	return &tfprotov5.ApplyResourceChangeResponse{
+		NewState:    &stateValue,
+		Diagnostics: diags,
+	}, nil
 }
 
 func (p *provider) ImportResourceState(ctx context.Context, req *tfprotov5.ImportResourceStateRequest) (*tfprotov5.ImportResourceStateResponse, error) {
@@ -241,15 +481,9 @@ func (p *provider) ValidateDataSourceConfig(ctx context.Context, req *tfprotov5.
 
 	schemaObjectType := schemaAsObject(ds.Schema(ctx))
 
-	configObject, err := req.Config.Unmarshal(schemaObjectType)
-	if err != nil {
-		return nil, fmt.Errorf("error req.Config.Unmarshal: %w", err)
-	}
-
-	config := map[string]tftypes.Value{}
-	err = configObject.As(&config)
+	_, config, err := unmarshalDynamicValueObject(req.Config, schemaObjectType)
 	if err != nil {
-		return nil, fmt.Errorf("error configObject.As: %w", err)
+		return nil, fmt.Errorf("ValidateDataSourceConfig - unmarshalDynamicValueObject(req.Config): %w", err)
 	}
 
 	diags, err := ds.Validate(ctx, config)
@@ -265,26 +499,19 @@ func (p *provider) ValidateDataSourceConfig(ctx context.Context, req *tfprotov5.
 func (p *provider) ReadDataSource(ctx context.Context, req *tfprotov5.ReadDataSourceRequest) (*tfprotov5.ReadDataSourceResponse, error) {
 	ds, err := p.NewDataSource(req.TypeName)
 	if err != nil {
-		// TODO: diags?
 		return nil, err
 	}
 
 	schemaObjectType := schemaAsObject(ds.Schema(ctx))
 
-	configObject, err := req.Config.Unmarshal(schemaObjectType)
-	if err != nil {
-		return nil, fmt.Errorf("error req.Config.Unmarshal: %w", err)
-	}
-
-	config := map[string]tftypes.Value{}
-	err = configObject.As(&config)
+	_, config, err := unmarshalDynamicValueObject(req.Config, schemaObjectType)
 	if err != nil {
-		return nil, fmt.Errorf("error configObject.As: %w", err)
+		return nil, fmt.Errorf("ReadDataSource - unmarshalDynamicValueObject(req.Config): %w", err)
 	}
 
 	diags, err := ds.Validate(ctx, config)
 	if err != nil {
-		return nil, fmt.Errorf("error ds.Validate: %w", err)
+		return nil, fmt.Errorf("ReadDataSource - error ds.Validate: %w", err)
 	}
 	if diagsHaveError(diags) {
 		return &tfprotov5.ReadDataSourceResponse{
@@ -293,7 +520,7 @@ func (p *provider) ReadDataSource(ctx context.Context, req *tfprotov5.ReadDataSo
 	}
 	state, diags, err := ds.Read(ctx, config)
 	if err != nil {
-		return nil, fmt.Errorf("error ds.Read: %w", err)
+		return nil, fmt.Errorf("ReadDataSource - error ds.Read: %w", err)
 	}
 	if diagsHaveError(diags) {
 		return &tfprotov5.ReadDataSourceResponse{
@@ -304,7 +531,7 @@ func (p *provider) ReadDataSource(ctx context.Context, req *tfprotov5.ReadDataSo
 	// TODO: should NewDynamicValue return a pointer?
 	stateValue, err := tfprotov5.NewDynamicValue(schemaObjectType, tftypes.NewValue(schemaObjectType, state))
 	if err != nil {
-		return nil, fmt.Errorf("error NewDynamicValue: %w", err)
+		return nil, fmt.Errorf("ReadDataSource - error NewDynamicValue: %w", err)
 	}
 
 	return &tfprotov5.ReadDataSourceResponse{
diff --git a/internal/provider/util.go b/internal/provider/util.go
index c9b2c72..f80e509 100644
--- a/internal/provider/util.go
+++ b/internal/provider/util.go
@@ -28,6 +28,20 @@ func unquoteIfQuoted(value interface{}) (string, error) {
 }
 
 // potential terraform-plugin-go convenience funcs
+func unmarshalDynamicValueObject(dv *tfprotov5.DynamicValue, ty tftypes.Object) (tftypes.Value, map[string]tftypes.Value, error) {
+	obj, err := dv.Unmarshal(ty)
+	if err != nil {
+		return tftypes.Value{}, nil, fmt.Errorf("error dv.Unmarshal: %w", err)
+	}
+
+	objMap := map[string]tftypes.Value{}
+	err = obj.As(&objMap)
+	if err != nil {
+		return tftypes.Value{}, nil, fmt.Errorf("error obj.As: %w", err)
+	}
+
+	return obj, objMap, nil
+}
 
 func diagsHaveError(diags []*tfprotov5.Diagnostic) bool {
 	for _, diag := range diags {
@@ -40,15 +54,34 @@ func diagsHaveError(diags []*tfprotov5.Diagnostic) bool {
 }
 
 func schemaAsObject(schema *tfprotov5.Schema) tftypes.Object {
+	return blockAsObject(schema.Block)
+}
+
+func blockAsObject(block *tfprotov5.SchemaBlock) tftypes.Object {
 	o := tftypes.Object{
 		AttributeTypes: map[string]tftypes.Type{},
 	}
 
-	// TODO: block types
+	for _, b := range block.BlockTypes {
+		o.AttributeTypes[b.TypeName] = nestedBlockAsObject(b)
+	}
 
-	for _, s := range schema.Block.Attributes {
+	for _, s := range block.Attributes {
 		o.AttributeTypes[s.Name] = s.Type
 	}
 
 	return o
 }
+
+func nestedBlockAsObject(nestedBlock *tfprotov5.SchemaNestedBlock) tftypes.Type {
+	switch nestedBlock.Nesting {
+	case tfprotov5.SchemaNestedBlockNestingModeSingle:
+		return blockAsObject(nestedBlock.Block)
+	case tfprotov5.SchemaNestedBlockNestingModeList:
+		return tftypes.List{
+			ElementType: blockAsObject(nestedBlock.Block),
+		}
+	}
+
+	panic(fmt.Sprintf("nested type of %s for %s not supported", nestedBlock.Nesting, nestedBlock.TypeName))
+}