How to default resource's credentials to the ones in a provider

In our custom provider we have 2 sets of credentials involved in the creation of our service. They may come from environment or file under the user-profile. We use different credentials for the management of different resources, and we need to be able to override some of the credentials per resource.

Right now we are passing all credentials to the API client-wrapper and then using Go code to default to them if not specified in the resource. This is non-declarative, opaque to the users and overall feels like we shouldn’t be doing it.

Is there a way to declare in the resource schema that a resource parameter defaults to its provider parameter? Or is there a way to access the resolved provider data when we register the resources?

On a related note, is there a way to set a provisioner connection’s parameters from the resource’s Init or Create-function?