function Resolve-ConfigurationDataProviderSecureString {
    [CmdletBinding()]
    Param(
        [Parameter(Mandatory=$true)]
        $Value
    )

    if($Value -is [System.Security.SecureString]){
        return $Value
    }

    if($Value -is [string]){
        return ConvertTo-SecureString -String $Value -AsPlainText -Force
    }

    if(-not (Test-ConfigurationDataMap -Value $Value)){
        throw "Provider secure string value must be a SecureString, string, or hashtable."
    }

    if(Test-ConfigurationDataMapContainsKey -Map $Value -Key "EnvironmentVariable"){
        $VariableName = [string](Get-ConfigurationDataMapValue -Map $Value -Key "EnvironmentVariable")
        $EnvironmentValue = [Environment]::GetEnvironmentVariable($VariableName)
        if([string]::IsNullOrEmpty($EnvironmentValue)){
            throw "Environment variable [$VariableName] is not defined or empty."
        }

        return ConvertTo-SecureString -String $EnvironmentValue -AsPlainText -Force
    }

    if(Test-ConfigurationDataMapContainsKey -Map $Value -Key "ProtectedValue"){
        $ProtectedValue = [string](Get-ConfigurationDataMapValue -Map $Value -Key "ProtectedValue")
        $Key = $null

        if(Test-ConfigurationDataMapContainsKey -Map $Value -Key "Key"){
            $Key = [Convert]::FromBase64String([string](Get-ConfigurationDataMapValue -Map $Value -Key "Key"))
        }elseif(Test-ConfigurationDataMapContainsKey -Map $Value -Key "KeyPath"){
            $KeyPath = [string](Get-ConfigurationDataMapValue -Map $Value -Key "KeyPath")
            if(-not (Test-Path -Path $KeyPath -PathType Leaf)){
                throw "Secure string key file [$KeyPath] was not found."
            }

            $Key = [Convert]::FromBase64String((Get-Content -Path $KeyPath -Raw).Trim())
        }else{
            throw "Protected provider secure string requires [Key] or [KeyPath]."
        }

        return ConvertTo-SecureString -String $ProtectedValue -Key $Key
    }

    throw "Unsupported provider secure string reference."
}