Upgrade to 0.12

19 files changed, 1090 insertions, 175 deletions

diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/backend.go b/vendor/github.com/hashicorp/terraform/helper/schema/backend.go
index 57fbba7..c8d8ae2 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/backend.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/backend.go
@@ -2,8 +2,15 @@ package schema
 
 import (
         "context"
+        "fmt"
 
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/hashicorp/terraform/terraform"
+        ctyconvert "github.com/zclconf/go-cty/cty/convert"
 )
 
 // Backend represents a partial backend.Backend implementation and simplifies
@@ -38,41 +45,123 @@ func FromContextBackendConfig(ctx context.Context) *ResourceData {
         return ctx.Value(backendConfigKey).(*ResourceData)
 }
 
-func (b *Backend) Input(
-        input terraform.UIInput,
-        c *terraform.ResourceConfig) (*terraform.ResourceConfig, error) {
+func (b *Backend) ConfigSchema() *configschema.Block {
+        // This is an alias of CoreConfigSchema just to implement the
+        // backend.Backend interface.
+        return b.CoreConfigSchema()
+}
+
+func (b *Backend) PrepareConfig(configVal cty.Value) (cty.Value, tfdiags.Diagnostics) {
         if b == nil {
-                return c, nil
+                return configVal, nil
         }
+        var diags tfdiags.Diagnostics
+        var err error
 
-        return schemaMap(b.Schema).Input(input, c)
-}
+        // In order to use Transform below, this needs to be filled out completely
+        // according the schema.
+        configVal, err = b.CoreConfigSchema().CoerceValue(configVal)
+        if err != nil {
+                return configVal, diags.Append(err)
+        }
 
-func (b *Backend) Validate(c *terraform.ResourceConfig) ([]string, []error) {
-        if b == nil {
-                return nil, nil
+        // lookup any required, top-level attributes that are Null, and see if we
+        // have a Default value available.
+        configVal, err = cty.Transform(configVal, func(path cty.Path, val cty.Value) (cty.Value, error) {
+                // we're only looking for top-level attributes
+                if len(path) != 1 {
+                        return val, nil
+                }
+
+                // nothing to do if we already have a value
+                if !val.IsNull() {
+                        return val, nil
+                }
+
+                // get the Schema definition for this attribute
+                getAttr, ok := path[0].(cty.GetAttrStep)
+                // these should all exist, but just ignore anything strange
+                if !ok {
+                        return val, nil
+                }
+
+                attrSchema := b.Schema[getAttr.Name]
+                // continue to ignore anything that doesn't match
+                if attrSchema == nil {
+                        return val, nil
+                }
+
+                // this is deprecated, so don't set it
+                if attrSchema.Deprecated != "" || attrSchema.Removed != "" {
+                        return val, nil
+                }
+
+                // find a default value if it exists
+                def, err := attrSchema.DefaultValue()
+                if err != nil {
+                        diags = diags.Append(fmt.Errorf("error getting default for %q: %s", getAttr.Name, err))
+                        return val, err
+                }
+
+                // no default
+                if def == nil {
+                        return val, nil
+                }
+
+                // create a cty.Value and make sure it's the correct type
+                tmpVal := hcl2shim.HCL2ValueFromConfigValue(def)
+
+                // helper/schema used to allow setting "" to a bool
+                if val.Type() == cty.Bool && tmpVal.RawEquals(cty.StringVal("")) {
+                        // return a warning about the conversion
+                        diags = diags.Append("provider set empty string as default value for bool " + getAttr.Name)
+                        tmpVal = cty.False
+                }
+
+                val, err = ctyconvert.Convert(tmpVal, val.Type())
+                if err != nil {
+                        diags = diags.Append(fmt.Errorf("error setting default for %q: %s", getAttr.Name, err))
+                }
+
+                return val, err
+        })
+        if err != nil {
+                // any error here was already added to the diagnostics
+                return configVal, diags
         }
 
-        return schemaMap(b.Schema).Validate(c)
+        shimRC := b.shimConfig(configVal)
+        warns, errs := schemaMap(b.Schema).Validate(shimRC)
+        for _, warn := range warns {
+                diags = diags.Append(tfdiags.SimpleWarning(warn))
+        }
+        for _, err := range errs {
+                diags = diags.Append(err)
+        }
+        return configVal, diags
 }
 
-func (b *Backend) Configure(c *terraform.ResourceConfig) error {
+func (b *Backend) Configure(obj cty.Value) tfdiags.Diagnostics {
         if b == nil {
                 return nil
         }
 
+        var diags tfdiags.Diagnostics
         sm := schemaMap(b.Schema)
+        shimRC := b.shimConfig(obj)
 
         // Get a ResourceData for this configuration. To do this, we actually
         // generate an intermediary "diff" although that is never exposed.
-        diff, err := sm.Diff(nil, c, nil, nil)
+        diff, err := sm.Diff(nil, shimRC, nil, nil, true)
         if err != nil {
-                return err
+                diags = diags.Append(err)
+                return diags
         }
 
         data, err := sm.Data(nil, diff)
         if err != nil {
-                return err
+                diags = diags.Append(err)
+                return diags
         }
         b.config = data
 
@@ -80,11 +169,28 @@ func (b *Backend) Configure(c *terraform.ResourceConfig) error {
                 err = b.ConfigureFunc(context.WithValue(
                         context.Background(), backendConfigKey, data))
                 if err != nil {
-                        return err
+                        diags = diags.Append(err)
+                        return diags
                 }
         }
 
-        return nil
+        return diags
+}
+
+// shimConfig turns a new-style cty.Value configuration (which must be of
+// an object type) into a minimal old-style *terraform.ResourceConfig object
+// that should be populated enough to appease the not-yet-updated functionality
+// in this package. This should be removed once everything is updated.
+func (b *Backend) shimConfig(obj cty.Value) *terraform.ResourceConfig {
+        shimMap, ok := hcl2shim.ConfigValueFromHCL2(obj).(map[string]interface{})
+        if !ok {
+                // If the configVal was nil, we still want a non-nil map here.
+                shimMap = map[string]interface{}{}
+        }
+        return &terraform.ResourceConfig{
+                Config: shimMap,
+                Raw:    shimMap,
+        }
 }
 
 // Config returns the configuration. This is available after Configure is
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go b/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go
index bf952f6..875677e 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go
@@ -3,7 +3,7 @@ package schema
 import (
         "fmt"
 
-        "github.com/hashicorp/terraform/config/configschema"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/zclconf/go-cty/cty"
 )
 
@@ -39,14 +39,42 @@ func (m schemaMap) CoreConfigSchema() *configschema.Block {
                         ret.Attributes[name] = schema.coreConfigSchemaAttribute()
                         continue
                 }
-                switch schema.Elem.(type) {
-                case *Schema:
+                if schema.Type == TypeMap {
+                        // For TypeMap in particular, it isn't valid for Elem to be a
+                        // *Resource (since that would be ambiguous in flatmap) and
+                        // so Elem is treated as a TypeString schema if so. This matches
+                        // how the field readers treat this situation, for compatibility
+                        // with configurations targeting Terraform 0.11 and earlier.
+                        if _, isResource := schema.Elem.(*Resource); isResource {
+                                sch := *schema // shallow copy
+                                sch.Elem = &Schema{
+                                        Type: TypeString,
+                                }
+                                ret.Attributes[name] = sch.coreConfigSchemaAttribute()
+                                continue
+                        }
+                }
+                switch schema.ConfigMode {
+                case SchemaConfigModeAttr:
                         ret.Attributes[name] = schema.coreConfigSchemaAttribute()
-                case *Resource:
+                case SchemaConfigModeBlock:
                         ret.BlockTypes[name] = schema.coreConfigSchemaBlock()
-                default:
-                        // Should never happen for a valid schema
-                        panic(fmt.Errorf("invalid Schema.Elem %#v; need *Schema or *Resource", schema.Elem))
+                default: // SchemaConfigModeAuto, or any other invalid value
+                        if schema.Computed && !schema.Optional {
+                                // Computed-only schemas are always handled as attributes,
+                                // because they never appear in configuration.
+                                ret.Attributes[name] = schema.coreConfigSchemaAttribute()
+                                continue
+                        }
+                        switch schema.Elem.(type) {
+                        case *Schema, ValueType:
+                                ret.Attributes[name] = schema.coreConfigSchemaAttribute()
+                        case *Resource:
+                                ret.BlockTypes[name] = schema.coreConfigSchemaBlock()
+                        default:
+                                // Should never happen for a valid schema
+                                panic(fmt.Errorf("invalid Schema.Elem %#v; need *Schema or *Resource", schema.Elem))
+                        }
                 }
         }
 
@@ -58,12 +86,42 @@ func (m schemaMap) CoreConfigSchema() *configschema.Block {
 // Elem is an instance of Schema. Use coreConfigSchemaBlock for collections
 // whose elem is a whole resource.
 func (s *Schema) coreConfigSchemaAttribute() *configschema.Attribute {
+        // The Schema.DefaultFunc capability adds some extra weirdness here since
+        // it can be combined with "Required: true" to create a sitution where
+        // required-ness is conditional. Terraform Core doesn't share this concept,
+        // so we must sniff for this possibility here and conditionally turn
+        // off the "Required" flag if it looks like the DefaultFunc is going
+        // to provide a value.
+        // This is not 100% true to the original interface of DefaultFunc but
+        // works well enough for the EnvDefaultFunc and MultiEnvDefaultFunc
+        // situations, which are the main cases we care about.
+        //
+        // Note that this also has a consequence for commands that return schema
+        // information for documentation purposes: running those for certain
+        // providers will produce different results depending on which environment
+        // variables are set. We accept that weirdness in order to keep this
+        // interface to core otherwise simple.
+        reqd := s.Required
+        opt := s.Optional
+        if reqd && s.DefaultFunc != nil {
+                v, err := s.DefaultFunc()
+                // We can't report errors from here, so we'll instead just force
+                // "Required" to false and let the provider try calling its
+                // DefaultFunc again during the validate step, where it can then
+                // return the error.
+                if err != nil || (err == nil && v != nil) {
+                        reqd = false
+                        opt = true
+                }
+        }
+
         return &configschema.Attribute{
-                Type:      s.coreConfigSchemaType(),
-                Optional:  s.Optional,
-                Required:  s.Required,
-                Computed:  s.Computed,
-                Sensitive: s.Sensitive,
+                Type:        s.coreConfigSchemaType(),
+                Optional:    opt,
+                Required:    reqd,
+                Computed:    s.Computed,
+                Sensitive:   s.Sensitive,
+                Description: s.Description,
         }
 }
 
@@ -72,7 +130,7 @@ func (s *Schema) coreConfigSchemaAttribute() *configschema.Attribute {
 // of Resource, and will panic otherwise.
 func (s *Schema) coreConfigSchemaBlock() *configschema.NestedBlock {
         ret := &configschema.NestedBlock{}
-        if nested := s.Elem.(*Resource).CoreConfigSchema(); nested != nil {
+        if nested := s.Elem.(*Resource).coreConfigSchema(); nested != nil {
                 ret.Block = *nested
         }
         switch s.Type {
@@ -95,6 +153,20 @@ func (s *Schema) coreConfigSchemaBlock() *configschema.NestedBlock {
                 // blocks, but we can fake it by requiring at least one item.
                 ret.MinItems = 1
         }
+        if s.Optional && s.MinItems > 0 {
+                // Historically helper/schema would ignore MinItems if Optional were
+                // set, so we must mimic this behavior here to ensure that providers
+                // relying on that undocumented behavior can continue to operate as
+                // they did before.
+                ret.MinItems = 0
+        }
+        if s.Computed && !s.Optional {
+                // MinItems/MaxItems are meaningless for computed nested blocks, since
+                // they are never set by the user anyway. This ensures that we'll never
+                // generate weird errors about them.
+                ret.MinItems = 0
+                ret.MaxItems = 0
+        }
 
         return ret
 }
@@ -117,11 +189,16 @@ func (s *Schema) coreConfigSchemaType() cty.Type {
                 switch set := s.Elem.(type) {
                 case *Schema:
                         elemType = set.coreConfigSchemaType()
+                case ValueType:
+                        // This represents a mistake in the provider code, but it's a
+                        // common one so we'll just shim it.
+                        elemType = (&Schema{Type: set}).coreConfigSchemaType()
                 case *Resource:
-                        // In practice we don't actually use this for normal schema
-                        // construction because we construct a NestedBlock in that
-                        // case instead. See schemaMap.CoreConfigSchema.
-                        elemType = set.CoreConfigSchema().ImpliedType()
+                        // By default we construct a NestedBlock in this case, but this
+                        // behavior is selected either for computed-only schemas or
+                        // when ConfigMode is explicitly SchemaConfigModeBlock.
+                        // See schemaMap.CoreConfigSchema for the exact rules.
+                        elemType = set.coreConfigSchema().ImpliedType()
                 default:
                         if set != nil {
                                 // Should never happen for a valid schema
@@ -148,8 +225,85 @@ func (s *Schema) coreConfigSchemaType() cty.Type {
         }
 }
 
-// CoreConfigSchema is a convenient shortcut for calling CoreConfigSchema
-// on the resource's schema.
+// CoreConfigSchema is a convenient shortcut for calling CoreConfigSchema on
+// the resource's schema. CoreConfigSchema adds the implicitly required "id"
+// attribute for top level resources if it doesn't exist.
 func (r *Resource) CoreConfigSchema() *configschema.Block {
+        block := r.coreConfigSchema()
+
+        if block.Attributes == nil {
+                block.Attributes = map[string]*configschema.Attribute{}
+        }
+
+        // Add the implicitly required "id" field if it doesn't exist
+        if block.Attributes["id"] == nil {
+                block.Attributes["id"] = &configschema.Attribute{
+                        Type:     cty.String,
+                        Optional: true,
+                        Computed: true,
+                }
+        }
+
+        _, timeoutsAttr := block.Attributes[TimeoutsConfigKey]
+        _, timeoutsBlock := block.BlockTypes[TimeoutsConfigKey]
+
+        // Insert configured timeout values into the schema, as long as the schema
+        // didn't define anything else by that name.
+        if r.Timeouts != nil && !timeoutsAttr && !timeoutsBlock {
+                timeouts := configschema.Block{
+                        Attributes: map[string]*configschema.Attribute{},
+                }
+
+                if r.Timeouts.Create != nil {
+                        timeouts.Attributes[TimeoutCreate] = &configschema.Attribute{
+                                Type:     cty.String,
+                                Optional: true,
+                        }
+                }
+
+                if r.Timeouts.Read != nil {
+                        timeouts.Attributes[TimeoutRead] = &configschema.Attribute{
+                                Type:     cty.String,
+                                Optional: true,
+                        }
+                }
+
+                if r.Timeouts.Update != nil {
+                        timeouts.Attributes[TimeoutUpdate] = &configschema.Attribute{
+                                Type:     cty.String,
+                                Optional: true,
+                        }
+                }
+
+                if r.Timeouts.Delete != nil {
+                        timeouts.Attributes[TimeoutDelete] = &configschema.Attribute{
+                                Type:     cty.String,
+                                Optional: true,
+                        }
+                }
+
+                if r.Timeouts.Default != nil {
+                        timeouts.Attributes[TimeoutDefault] = &configschema.Attribute{
+                                Type:     cty.String,
+                                Optional: true,
+                        }
+                }
+
+                block.BlockTypes[TimeoutsConfigKey] = &configschema.NestedBlock{
+                        Nesting: configschema.NestingSingle,
+                        Block:   timeouts,
+                }
+        }
+
+        return block
+}
+
+func (r *Resource) coreConfigSchema() *configschema.Block {
+        return schemaMap(r.Schema).CoreConfigSchema()
+}
+
+// CoreConfigSchema is a convenient shortcut for calling CoreConfigSchema
+// on the backends's schema.
+func (r *Backend) CoreConfigSchema() *configschema.Block {
         return schemaMap(r.Schema).CoreConfigSchema()
 }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go
index b80b223..2a66a06 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go
@@ -3,6 +3,7 @@ package schema
 import (
         "fmt"
         "strconv"
+        "strings"
 )
 
 // FieldReaders are responsible for decoding fields out of data into
@@ -41,6 +42,13 @@ func (r *FieldReadResult) ValueOrZero(s *Schema) interface{} {
         return s.ZeroValue()
 }
 
+// SchemasForFlatmapPath tries its best to find a sequence of schemas that
+// the given dot-delimited attribute path traverses through.
+func SchemasForFlatmapPath(path string, schemaMap map[string]*Schema) []*Schema {
+        parts := strings.Split(path, ".")
+        return addrToSchema(parts, schemaMap)
+}
+
 // addrToSchema finds the final element schema for the given address
 // and the given schema. It returns all the schemas that led to the final
 // schema. These are in order of the address (out to in).
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go
index 55a301d..808375c 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go
@@ -2,6 +2,7 @@ package schema
 
 import (
         "fmt"
+        "log"
         "strconv"
         "strings"
         "sync"
@@ -93,6 +94,22 @@ func (r *ConfigFieldReader) readField(
                 }
         }
 
+        if protoVersion5 {
+                switch schema.Type {
+                case TypeList, TypeSet, TypeMap, typeObject:
+                        // Check if the value itself is unknown.
+                        // The new protocol shims will add unknown values to this list of
+                        // ComputedKeys. This is the only way we have to indicate that a
+                        // collection is unknown in the config
+                        for _, unknown := range r.Config.ComputedKeys {
+                                if k == unknown {
+                                        log.Printf("[DEBUG] setting computed for %q from ComputedKeys", k)
+                                        return FieldReadResult{Computed: true, Exists: true}, nil
+                                }
+                        }
+                }
+        }
+
         switch schema.Type {
         case TypeBool, TypeFloat, TypeInt, TypeString:
                 return r.readPrimitive(k, schema)
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go
index d558a5b..ae35b4a 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go
@@ -174,6 +174,9 @@ func (r *DiffFieldReader) readPrimitive(
 
 func (r *DiffFieldReader) readSet(
         address []string, schema *Schema) (FieldReadResult, error) {
+        // copy address to ensure we don't modify the argument
+        address = append([]string(nil), address...)
+
         prefix := strings.Join(address, ".") + "."
 
         // Create the set that will be our result
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go
index 054efe0..53f73b7 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go
@@ -98,6 +98,9 @@ func (r *MapFieldReader) readPrimitive(
 
 func (r *MapFieldReader) readSet(
         address []string, schema *Schema) (FieldReadResult, error) {
+        // copy address to ensure we don't modify the argument
+        address = append([]string(nil), address...)
+
         // Get the number of elements in the list
         countRaw, err := r.readPrimitive(
                 append(address, "#"), &Schema{Type: TypeInt})
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go
index 814c7ba..c09358b 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go
@@ -297,13 +297,14 @@ func (w *MapFieldWriter) setSet(
         // we get the proper order back based on the hash code.
         if v := reflect.ValueOf(value); v.Kind() == reflect.Slice {
                 // Build a temp *ResourceData to use for the conversion
+                tempAddr := addr[len(addr)-1:]
                 tempSchema := *schema
                 tempSchema.Type = TypeList
-                tempSchemaMap := map[string]*Schema{addr[0]: &tempSchema}
+                tempSchemaMap := map[string]*Schema{tempAddr[0]: &tempSchema}
                 tempW := &MapFieldWriter{Schema: tempSchemaMap}
 
                 // Set the entire list, this lets us get sane values out of it
-                if err := tempW.WriteField(addr, value); err != nil {
+                if err := tempW.WriteField(tempAddr, value); err != nil {
                         return err
                 }
 
@@ -319,7 +320,7 @@ func (w *MapFieldWriter) setSet(
                 }
                 for i := 0; i < v.Len(); i++ {
                         is := strconv.FormatInt(int64(i), 10)
-                        result, err := tempR.ReadField(append(addrCopy, is))
+                        result, err := tempR.ReadField(append(tempAddr, is))
                         if err != nil {
                                 return err
                         }
@@ -340,6 +341,11 @@ func (w *MapFieldWriter) setSet(
         // problems when the old data isn't wiped first.
         w.clearTree(addr)
 
+        if value.(*Set) == nil {
+                w.result[k+".#"] = "0"
+                return nil
+        }
+
         for code, elem := range value.(*Set).m {
                 if err := w.set(append(addrCopy, code), elem); err != nil {
                         return err
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go b/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go
index 38cd8c7..0184d7b 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go
@@ -4,6 +4,18 @@ package schema
 
 import "strconv"
 
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[getSourceState-1]
+        _ = x[getSourceConfig-2]
+        _ = x[getSourceDiff-4]
+        _ = x[getSourceSet-8]
+        _ = x[getSourceExact-16]
+        _ = x[getSourceLevelMask-15]
+}
+
 const (
         _getSource_name_0 = "getSourceStategetSourceConfig"
         _getSource_name_1 = "getSourceDiff"
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/provider.go b/vendor/github.com/hashicorp/terraform/helper/schema/provider.go
index 6cd325d..9702447 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/provider.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/provider.go
@@ -9,7 +9,7 @@ import (
 
         "github.com/hashicorp/go-multierror"
         "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/configschema"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/hashicorp/terraform/terraform"
 )
 
@@ -64,6 +64,8 @@ type Provider struct {
         stopCtx       context.Context
         stopCtxCancel context.CancelFunc
         stopOnce      sync.Once
+
+        TerraformVersion string
 }
 
 // ConfigureFunc is the function used to configure a Provider.
@@ -251,7 +253,7 @@ func (p *Provider) Configure(c *terraform.ResourceConfig) error {
 
         // Get a ResourceData for this configuration. To do this, we actually
         // generate an intermediary "diff" although that is never exposed.
-        diff, err := sm.Diff(nil, c, nil, p.meta)
+        diff, err := sm.Diff(nil, c, nil, p.meta, true)
         if err != nil {
                 return err
         }
@@ -296,6 +298,20 @@ func (p *Provider) Diff(
         return r.Diff(s, c, p.meta)
 }
 
+// SimpleDiff is used by the new protocol wrappers to get a diff that doesn't
+// attempt to calculate ignore_changes.
+func (p *Provider) SimpleDiff(
+        info *terraform.InstanceInfo,
+        s *terraform.InstanceState,
+        c *terraform.ResourceConfig) (*terraform.InstanceDiff, error) {
+        r, ok := p.ResourcesMap[info.Type]
+        if !ok {
+                return nil, fmt.Errorf("unknown resource type: %s", info.Type)
+        }
+
+        return r.simpleDiff(s, c, p.meta)
+}
+
 // Refresh implementation of terraform.ResourceProvider interface.
 func (p *Provider) Refresh(
         info *terraform.InstanceInfo,
@@ -311,7 +327,7 @@ func (p *Provider) Refresh(
 // Resources implementation of terraform.ResourceProvider interface.
 func (p *Provider) Resources() []terraform.ResourceType {
         keys := make([]string, 0, len(p.ResourcesMap))
-        for k, _ := range p.ResourcesMap {
+        for k := range p.ResourcesMap {
                 keys = append(keys, k)
         }
         sort.Strings(keys)
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go b/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go
index a8d42db..637e221 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go
@@ -8,6 +8,7 @@ import (
 
         "github.com/hashicorp/go-multierror"
         "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/hashicorp/terraform/terraform"
 )
 
@@ -121,6 +122,11 @@ func (p *Provisioner) Stop() error {
         return nil
 }
 
+// GetConfigSchema implementation of terraform.ResourceProvisioner interface.
+func (p *Provisioner) GetConfigSchema() (*configschema.Block, error) {
+        return schemaMap(p.Schema).CoreConfigSchema(), nil
+}
+
 // Apply implementation of terraform.ResourceProvisioner interface.
 func (p *Provisioner) Apply(
         o terraform.UIOutput,
@@ -146,7 +152,7 @@ func (p *Provisioner) Apply(
                 }
 
                 sm := schemaMap(p.ConnSchema)
-                diff, err := sm.Diff(nil, terraform.NewResourceConfig(c), nil, nil)
+                diff, err := sm.Diff(nil, terraform.NewResourceConfig(c), nil, nil, true)
                 if err != nil {
                         return err
                 }
@@ -160,7 +166,7 @@ func (p *Provisioner) Apply(
                 // Build the configuration data. Doing this requires making a "diff"
                 // even though that's never used. We use that just to get the correct types.
                 configMap := schemaMap(p.Schema)
-                diff, err := configMap.Diff(nil, c, nil, nil)
+                diff, err := configMap.Diff(nil, c, nil, nil, true)
                 if err != nil {
                         return err
                 }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
index d3be2d6..b5e3065 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
@@ -8,6 +8,7 @@ import (
 
         "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/terraform"
+        "github.com/zclconf/go-cty/cty"
 )
 
 // Resource represents a thing in Terraform that has a set of configurable
@@ -44,6 +45,12 @@ type Resource struct {
         // their Versioning at any integer >= 1
         SchemaVersion int
 
+        // MigrateState is deprecated and any new changes to a resource's schema
+        // should be handled by StateUpgraders. Existing MigrateState implementations
+        // should remain for compatibility with existing state. MigrateState will
+        // still be called if the stored SchemaVersion is less than the
+        // first version of the StateUpgraders.
+        //
         // MigrateState is responsible for updating an InstanceState with an old
         // version to the format expected by the current version of the Schema.
         //
@@ -56,6 +63,18 @@ type Resource struct {
         // needs to make any remote API calls.
         MigrateState StateMigrateFunc
 
+        // StateUpgraders contains the functions responsible for upgrading an
+        // existing state with an old schema version to a newer schema. It is
+        // called specifically by Terraform when the stored schema version is less
+        // than the current SchemaVersion of the Resource.
+        //
+        // StateUpgraders map specific schema versions to a StateUpgrader
+        // function. The registered versions are expected to be ordered,
+        // consecutive values. The initial value may be greater than 0 to account
+        // for legacy schemas that weren't recorded and can be handled by
+        // MigrateState.
+        StateUpgraders []StateUpgrader
+
         // The functions below are the CRUD operations for this resource.
         //
         // The only optional operation is Update. If Update is not implemented,
@@ -136,6 +155,27 @@ type Resource struct {
         Timeouts *ResourceTimeout
 }
 
+// ShimInstanceStateFromValue converts a cty.Value to a
+// terraform.InstanceState.
+func (r *Resource) ShimInstanceStateFromValue(state cty.Value) (*terraform.InstanceState, error) {
+        // Get the raw shimmed value. While this is correct, the set hashes don't
+        // match those from the Schema.
+        s := terraform.NewInstanceStateShimmedFromValue(state, r.SchemaVersion)
+
+        // We now rebuild the state through the ResourceData, so that the set indexes
+        // match what helper/schema expects.
+        data, err := schemaMap(r.Schema).Data(s, nil)
+        if err != nil {
+                return nil, err
+        }
+
+        s = data.State()
+        if s == nil {
+                s = &terraform.InstanceState{}
+        }
+        return s, nil
+}
+
 // See Resource documentation.
 type CreateFunc func(*ResourceData, interface{}) error
 
@@ -155,6 +195,27 @@ type ExistsFunc func(*ResourceData, interface{}) (bool, error)
 type StateMigrateFunc func(
         int, *terraform.InstanceState, interface{}) (*terraform.InstanceState, error)
 
+type StateUpgrader struct {
+        // Version is the version schema that this Upgrader will handle, converting
+        // it to Version+1.
+        Version int
+
+        // Type describes the schema that this function can upgrade. Type is
+        // required to decode the schema if the state was stored in a legacy
+        // flatmap format.
+        Type cty.Type
+
+        // Upgrade takes the JSON encoded state and the provider meta value, and
+        // upgrades the state one single schema version. The provided state is
+        // deocded into the default json types using a map[string]interface{}. It
+        // is up to the StateUpgradeFunc to ensure that the returned value can be
+        // encoded using the new schema.
+        Upgrade StateUpgradeFunc
+}
+
+// See StateUpgrader
+type StateUpgradeFunc func(rawState map[string]interface{}, meta interface{}) (map[string]interface{}, error)
+
 // See Resource documentation.
 type CustomizeDiffFunc func(*ResourceDiff, interface{}) error
 
@@ -247,7 +308,7 @@ func (r *Resource) Diff(
                 return nil, fmt.Errorf("[ERR] Error decoding timeout: %s", err)
         }
 
-        instanceDiff, err := schemaMap(r.Schema).Diff(s, c, r.CustomizeDiff, meta)
+        instanceDiff, err := schemaMap(r.Schema).Diff(s, c, r.CustomizeDiff, meta, true)
         if err != nil {
                 return instanceDiff, err
         }
@@ -263,6 +324,45 @@ func (r *Resource) Diff(
         return instanceDiff, err
 }
 
+func (r *Resource) simpleDiff(
+        s *terraform.InstanceState,
+        c *terraform.ResourceConfig,
+        meta interface{}) (*terraform.InstanceDiff, error) {
+
+        t := &ResourceTimeout{}
+        err := t.ConfigDecode(r, c)
+
+        if err != nil {
+                return nil, fmt.Errorf("[ERR] Error decoding timeout: %s", err)
+        }
+
+        instanceDiff, err := schemaMap(r.Schema).Diff(s, c, r.CustomizeDiff, meta, false)
+        if err != nil {
+                return instanceDiff, err
+        }
+
+        if instanceDiff == nil {
+                log.Printf("[DEBUG] Instance Diff is nil in SimpleDiff()")
+                return nil, err
+        }
+
+        // Make sure the old value is set in each of the instance diffs.
+        // This was done by the RequiresNew logic in the full legacy Diff.
+        for k, attr := range instanceDiff.Attributes {
+                if attr == nil {
+                        continue
+                }
+                if s != nil {
+                        attr.Old = s.Attributes[k]
+                }
+        }
+
+        if err := t.DiffEncode(instanceDiff); err != nil {
+                log.Printf("[ERR] Error encoding timeout to instance diff: %s", err)
+        }
+        return instanceDiff, err
+}
+
 // Validate validates the resource configuration against the schema.
 func (r *Resource) Validate(c *terraform.ResourceConfig) ([]string, []error) {
         warns, errs := schemaMap(r.Schema).Validate(c)
@@ -300,8 +400,11 @@ func (r *Resource) ReadDataApply(
         return r.recordCurrentSchemaVersion(state), err
 }
 
-// Refresh refreshes the state of the resource.
-func (r *Resource) Refresh(
+// RefreshWithoutUpgrade reads the instance state, but does not call
+// MigrateState or the StateUpgraders, since those are now invoked in a
+// separate API call.
+// RefreshWithoutUpgrade is part of the new plugin shims.
+func (r *Resource) RefreshWithoutUpgrade(
         s *terraform.InstanceState,
         meta interface{}) (*terraform.InstanceState, error) {
         // If the ID is already somehow blank, it doesn't exist
@@ -335,12 +438,60 @@ func (r *Resource) Refresh(
                 }
         }
 
-        needsMigration, stateSchemaVersion := r.checkSchemaVersion(s)
-        if needsMigration && r.MigrateState != nil {
-                s, err := r.MigrateState(stateSchemaVersion, s, meta)
+        data, err := schemaMap(r.Schema).Data(s, nil)
+        data.timeouts = &rt
+        if err != nil {
+                return s, err
+        }
+
+        err = r.Read(data, meta)
+        state := data.State()
+        if state != nil && state.ID == "" {
+                state = nil
+        }
+
+        return r.recordCurrentSchemaVersion(state), err
+}
+
+// Refresh refreshes the state of the resource.
+func (r *Resource) Refresh(
+        s *terraform.InstanceState,
+        meta interface{}) (*terraform.InstanceState, error) {
+        // If the ID is already somehow blank, it doesn't exist
+        if s.ID == "" {
+                return nil, nil
+        }
+
+        rt := ResourceTimeout{}
+        if _, ok := s.Meta[TimeoutKey]; ok {
+                if err := rt.StateDecode(s); err != nil {
+                        log.Printf("[ERR] Error decoding ResourceTimeout: %s", err)
+                }
+        }
+
+        if r.Exists != nil {
+                // Make a copy of data so that if it is modified it doesn't
+                // affect our Read later.
+                data, err := schemaMap(r.Schema).Data(s, nil)
+                data.timeouts = &rt
+
                 if err != nil {
                         return s, err
                 }
+
+                exists, err := r.Exists(data, meta)
+                if err != nil {
+                        return s, err
+                }
+                if !exists {
+                        return nil, nil
+                }
+        }
+
+        // there may be new StateUpgraders that need to be run
+        s, err := r.upgradeState(s, meta)
+        if err != nil {
+                return s, err
         }
 
         data, err := schemaMap(r.Schema).Data(s, nil)
@@ -358,6 +509,71 @@ func (r *Resource) Refresh(
         return r.recordCurrentSchemaVersion(state), err
 }
 
+func (r *Resource) upgradeState(s *terraform.InstanceState, meta interface{}) (*terraform.InstanceState, error) {
+        var err error
+
+        needsMigration, stateSchemaVersion := r.checkSchemaVersion(s)
+        migrate := needsMigration && r.MigrateState != nil
+
+        if migrate {
+                s, err = r.MigrateState(stateSchemaVersion, s, meta)
+                if err != nil {
+                        return s, err
+                }
+        }
+
+        if len(r.StateUpgraders) == 0 {
+                return s, nil
+        }
+
+        // If we ran MigrateState, then the stateSchemaVersion value is no longer
+        // correct. We can expect the first upgrade function to be the correct
+        // schema type version.
+        if migrate {
+                stateSchemaVersion = r.StateUpgraders[0].Version
+        }
+
+        schemaType := r.CoreConfigSchema().ImpliedType()
+        // find the expected type to convert the state
+        for _, upgrader := range r.StateUpgraders {
+                if stateSchemaVersion == upgrader.Version {
+                        schemaType = upgrader.Type
+                }
+        }
+
+        // StateUpgraders only operate on the new JSON format state, so the state
+        // need to be converted.
+        stateVal, err := StateValueFromInstanceState(s, schemaType)
+        if err != nil {
+                return nil, err
+        }
+
+        jsonState, err := StateValueToJSONMap(stateVal, schemaType)
+        if err != nil {
+                return nil, err
+        }
+
+        for _, upgrader := range r.StateUpgraders {
+                if stateSchemaVersion != upgrader.Version {
+                        continue
+                }
+
+                jsonState, err = upgrader.Upgrade(jsonState, meta)
+                if err != nil {
+                        return nil, err
+                }
+                stateSchemaVersion++
+        }
+
+        // now we need to re-flatmap the new state
+        stateVal, err = JSONMapToStateValue(jsonState, r.CoreConfigSchema())
+        if err != nil {
+                return nil, err
+        }
+
+        return r.ShimInstanceStateFromValue(stateVal)
+}
+
 // InternalValidate should be called to validate the structure
 // of the resource.
 //
@@ -437,6 +653,31 @@ func (r *Resource) InternalValidate(topSchemaMap schemaMap, writable bool) error
                 }
         }
 
+        lastVersion := -1
+        for _, u := range r.StateUpgraders {
+                if lastVersion >= 0 && u.Version-lastVersion > 1 {
+                        return fmt.Errorf("missing schema version between %d and %d", lastVersion, u.Version)
+                }
+
+                if u.Version >= r.SchemaVersion {
+                        return fmt.Errorf("StateUpgrader version %d is >= current version %d", u.Version, r.SchemaVersion)
+                }
+
+                if !u.Type.IsObjectType() {
+                        return fmt.Errorf("StateUpgrader %d type is not cty.Object", u.Version)
+                }
+
+                if u.Upgrade == nil {
+                        return fmt.Errorf("StateUpgrader %d missing StateUpgradeFunc", u.Version)
+                }
+
+                lastVersion = u.Version
+        }
+
+        if lastVersion >= 0 && lastVersion != r.SchemaVersion-1 {
+                return fmt.Errorf("missing StateUpgrader between %d and %d", lastVersion, r.SchemaVersion)
+        }
+
         // Data source
         if r.isTopLevel() && !writable {
                 tsm = schemaMap(r.Schema)
@@ -513,6 +754,13 @@ func (r *Resource) TestResourceData() *ResourceData {
         }
 }
 
+// SchemasForFlatmapPath tries its best to find a sequence of schemas that
+// the given dot-delimited attribute path traverses through in the schema
+// of the receiving Resource.
+func (r *Resource) SchemasForFlatmapPath(path string) []*Schema {
+        return SchemasForFlatmapPath(path, r.Schema)
+}
+
 // Returns true if the resource is "top level" i.e. not a sub-resource.
 func (r *Resource) isTopLevel() bool {
         // TODO: This is a heuristic; replace with a definitive attribute?
@@ -538,7 +786,15 @@ func (r *Resource) checkSchemaVersion(is *terraform.InstanceState) (bool, int) {
         }
 
         stateSchemaVersion, _ := strconv.Atoi(rawString)
-        return stateSchemaVersion < r.SchemaVersion, stateSchemaVersion
+
+        // Don't run MigrateState if the version is handled by a StateUpgrader,
+        // since StateMigrateFuncs are not required to handle unknown versions
+        maxVersion := r.SchemaVersion
+        if len(r.StateUpgraders) > 0 {
+                maxVersion = r.StateUpgraders[0].Version
+        }
+
+        return stateSchemaVersion < maxVersion, stateSchemaVersion
 }
 
 func (r *Resource) recordCurrentSchemaVersion(
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go
index 6cc01ee..1c39070 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go
@@ -52,6 +52,8 @@ type getResult struct {
 // UnsafeSetFieldRaw allows setting arbitrary values in state to arbitrary
 // values, bypassing schema. This MUST NOT be used in normal circumstances -
 // it exists only to support the remote_state data source.
+//
+// Deprecated: Fully define schema attributes and use Set() instead.
 func (d *ResourceData) UnsafeSetFieldRaw(key string, value string) {
         d.once.Do(d.init)
 
@@ -219,10 +221,16 @@ func (d *ResourceData) Id() string {
 
         if d.state != nil {
                 result = d.state.ID
+                if result == "" {
+                        result = d.state.Attributes["id"]
+                }
         }
 
         if d.newState != nil {
                 result = d.newState.ID
+                if result == "" {
+                        result = d.newState.Attributes["id"]
+                }
         }
 
         return result
@@ -246,6 +254,18 @@ func (d *ResourceData) ConnInfo() map[string]string {
 func (d *ResourceData) SetId(v string) {
         d.once.Do(d.init)
         d.newState.ID = v
+
+        // once we transition away from the legacy state types, "id" will no longer
+        // be a special field, and will become a normal attribute.
+        // set the attribute normally
+        d.setWriter.unsafeWriteField("id", v)
+
+        // Make sure the newState is also set, otherwise the old value
+        // may get precedence.
+        if d.newState.Attributes == nil {
+                d.newState.Attributes = map[string]string{}
+        }
+        d.newState.Attributes["id"] = v
 }
 
 // SetConnInfo sets the connection info for a resource.
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go
index 7db3dec..47b5481 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go
@@ -367,7 +367,7 @@ func (d *ResourceDiff) Get(key string) interface{} {
 }
 
 // GetChange gets the change between the state and diff, checking first to see
-// if a overridden diff exists.
+// if an overridden diff exists.
 //
 // This implementation differs from ResourceData's in the way that we first get
 // results from the exact levels for the new diff, then from state and diff as
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource_timeout.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource_timeout.go
index 445819f..9e422c1 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/resource_timeout.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource_timeout.go
@@ -5,6 +5,7 @@ import (
         "log"
         "time"
 
+        "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/terraform"
         "github.com/mitchellh/copystructure"
 )
@@ -62,55 +63,70 @@ func (t *ResourceTimeout) ConfigDecode(s *Resource, c *terraform.ResourceConfig)
         }
 
         if raw, ok := c.Config[TimeoutsConfigKey]; ok {
-                if configTimeouts, ok := raw.([]map[string]interface{}); ok {
-                        for _, timeoutValues := range configTimeouts {
-                                // loop through each Timeout given in the configuration and validate they
-                                // the Timeout defined in the resource
-                                for timeKey, timeValue := range timeoutValues {
-                                        // validate that we're dealing with the normal CRUD actions
-                                        var found bool
-                                        for _, key := range timeoutKeys() {
-                                                if timeKey == key {
-                                                        found = true
-                                                        break
-                                                }
-                                        }
+                var rawTimeouts []map[string]interface{}
+                switch raw := raw.(type) {
+                case map[string]interface{}:
+                        rawTimeouts = append(rawTimeouts, raw)
+                case []map[string]interface{}:
+                        rawTimeouts = raw
+                case string:
+                        if raw == config.UnknownVariableValue {
+                                // Timeout is not defined in the config
+                                // Defaults will be used instead
+                                return nil
+                        } else {
+                                log.Printf("[ERROR] Invalid timeout value: %q", raw)
+                                return fmt.Errorf("Invalid Timeout value found")
+                        }
+                default:
+                        log.Printf("[ERROR] Invalid timeout structure: %#v", raw)
+                        return fmt.Errorf("Invalid Timeout structure found")
+                }
 
-                                        if !found {
-                                                return fmt.Errorf("Unsupported Timeout configuration key found (%s)", timeKey)
+                for _, timeoutValues := range rawTimeouts {
+                        for timeKey, timeValue := range timeoutValues {
+                                // validate that we're dealing with the normal CRUD actions
+                                var found bool
+                                for _, key := range timeoutKeys() {
+                                        if timeKey == key {
+                                                found = true
+                                                break
                                         }
+                                }
 
-                                        // Get timeout
-                                        rt, err := time.ParseDuration(timeValue.(string))
-                                        if err != nil {
-                                                return fmt.Errorf("Error parsing Timeout for (%s): %s", timeKey, err)
-                                        }
+                                if !found {
+                                        return fmt.Errorf("Unsupported Timeout configuration key found (%s)", timeKey)
+                                }
 
-                                        var timeout *time.Duration
-                                        switch timeKey {
-                                        case TimeoutCreate:
-                                                timeout = t.Create
-                                        case TimeoutUpdate:
-                                                timeout = t.Update
-                                        case TimeoutRead:
-                                                timeout = t.Read
-                                        case TimeoutDelete:
-                                                timeout = t.Delete
-                                        case TimeoutDefault:
-                                                timeout = t.Default
-                                        }
+                                // Get timeout
+                                rt, err := time.ParseDuration(timeValue.(string))
+                                if err != nil {
+                                        return fmt.Errorf("Error parsing %q timeout: %s", timeKey, err)
+                                }
 
-                                        // If the resource has not delcared this in the definition, then error
-                                        // with an unsupported message
-                                        if timeout == nil {
-                                                return unsupportedTimeoutKeyError(timeKey)
-                                        }
+                                var timeout *time.Duration
+                                switch timeKey {
+                                case TimeoutCreate:
+                                        timeout = t.Create
+                                case TimeoutUpdate:
+                                        timeout = t.Update
+                                case TimeoutRead:
+                                        timeout = t.Read
+                                case TimeoutDelete:
+                                        timeout = t.Delete
+                                case TimeoutDefault:
+                                        timeout = t.Default
+                                }
 
-                                        *timeout = rt
+                                // If the resource has not delcared this in the definition, then error
+                                // with an unsupported message
+                                if timeout == nil {
+                                        return unsupportedTimeoutKeyError(timeKey)
                                 }
+
+                                *timeout = rt
                         }
-                } else {
-                        log.Printf("[WARN] Invalid Timeout structure found, skipping timeouts")
+                        return nil
                 }
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/schema.go b/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
index 0ea5aad..6a3c15a 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
@@ -12,6 +12,7 @@
 package schema
 
 import (
+        "context"
         "fmt"
         "os"
         "reflect"
@@ -19,7 +20,9 @@ import (
         "sort"
         "strconv"
         "strings"
+        "sync"
 
+        "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/terraform"
         "github.com/mitchellh/copystructure"
         "github.com/mitchellh/mapstructure"
@@ -31,6 +34,27 @@ const PanicOnErr = "TF_SCHEMA_PANIC_ON_ERROR"
 // type used for schema package context keys
 type contextKey string
 
+var (
+        protoVersionMu sync.Mutex
+        protoVersion5  = false
+)
+
+func isProto5() bool {
+        protoVersionMu.Lock()
+        defer protoVersionMu.Unlock()
+        return protoVersion5
+
+}
+
+// SetProto5 enables a feature flag for any internal changes required required
+// to work with the new plugin protocol.  This should not be called by
+// provider.
+func SetProto5() {
+        protoVersionMu.Lock()
+        defer protoVersionMu.Unlock()
+        protoVersion5 = true
+}
+
 // Schema is used to describe the structure of a value.
 //
 // Read the documentation of the struct elements for important details.
@@ -51,6 +75,26 @@ type Schema struct {
         //
         Type ValueType
 
+        // ConfigMode allows for overriding the default behaviors for mapping
+        // schema entries onto configuration constructs.
+        //
+        // By default, the Elem field is used to choose whether a particular
+        // schema is represented in configuration as an attribute or as a nested
+        // block; if Elem is a *schema.Resource then it's a block and it's an
+        // attribute otherwise.
+        //
+        // If Elem is *schema.Resource then setting ConfigMode to
+        // SchemaConfigModeAttr will force it to be represented in configuration
+        // as an attribute, which means that the Computed flag can be used to
+        // provide default elements when the argument isn't set at all, while still
+        // allowing the user to force zero elements by explicitly assigning an
+        // empty list.
+        //
+        // When Computed is set without Optional, the attribute is not settable
+        // in configuration at all and so SchemaConfigModeAttr is the automatic
+        // behavior, and SchemaConfigModeBlock is not permitted.
+        ConfigMode SchemaConfigMode
+
         // If one of these is set, then this item can come from the configuration.
         // Both cannot be set. If Optional is set, the value is optional. If
         // Required is set, the value is required.
@@ -123,7 +167,8 @@ type Schema struct {
         // The following fields are only set for a TypeList, TypeSet, or TypeMap.
         //
         // Elem represents the element type. For a TypeMap, it must be a *Schema
-        // with a Type of TypeString, otherwise it may be either a *Schema or a
+        // with a Type that is one of the primitives: TypeString, TypeBool,
+        // TypeInt, or TypeFloat. Otherwise it may be either a *Schema or a
         // *Resource. If it is *Schema, the element type is just a simple value.
         // If it is *Resource, the element type is a complex structure,
         // potentially with its own lifecycle.
@@ -141,13 +186,17 @@ type Schema struct {
         // used to wrap a complex structure, however less than one instance would
         // cause instability.
         //
-        // PromoteSingle, if true, will allow single elements to be standalone
-        // and promote them to a list. For example "foo" would be promoted to
-        // ["foo"] automatically. This is primarily for legacy reasons and the
-        // ambiguity is not recommended for new usage. Promotion is only allowed
-        // for primitive element types.
-        MaxItems      int
-        MinItems      int
+        // If the field Optional is set to true then MinItems is ignored and thus
+        // effectively zero.
+        MaxItems int
+        MinItems int
+
+        // PromoteSingle originally allowed for a single element to be assigned
+        // where a primitive list was expected, but this no longer works from
+        // Terraform v0.12 onwards (Terraform Core will require a list to be set
+        // regardless of what this is set to) and so only applies to Terraform v0.11
+        // and earlier, and so should be used only to retain this functionality
+        // for those still using v0.11 with a provider that formerly used this.
         PromoteSingle bool
 
         // The following fields are only valid for a TypeSet type.
@@ -189,7 +238,8 @@ type Schema struct {
         // guaranteed to be of the proper Schema type, and it can yield warnings or
         // errors based on inspection of that value.
         //
-        // ValidateFunc currently only works for primitive types.
+        // ValidateFunc is honored only when the schema's Type is set to TypeInt,
+        // TypeFloat, TypeString, TypeBool, or TypeMap. It is ignored for all other types.
         ValidateFunc SchemaValidateFunc
 
         // Sensitive ensures that the attribute's value does not get displayed in
@@ -199,6 +249,17 @@ type Schema struct {
         Sensitive bool
 }
 
+// SchemaConfigMode is used to influence how a schema item is mapped into a
+// corresponding configuration construct, using the ConfigMode field of
+// Schema.
+type SchemaConfigMode int
+
+const (
+        SchemaConfigModeAuto SchemaConfigMode = iota
+        SchemaConfigModeAttr
+        SchemaConfigModeBlock
+)
+
 // SchemaDiffSuppressFunc is a function which can be used to determine
 // whether a detected diff on a schema element is "valid" or not, and
 // suppress it from the plan if necessary.
@@ -364,6 +425,11 @@ func (s *Schema) finalizeDiff(d *terraform.ResourceAttrDiff, customized bool) *t
         return d
 }
 
+// InternalMap is used to aid in the transition to the new schema types and
+// protocol. The name is not meant to convey any usefulness, as this is not to
+// be used directly by any providers.
+type InternalMap = schemaMap
+
 // schemaMap is a wrapper that adds nice functions on top of schemas.
 type schemaMap map[string]*Schema
 
@@ -404,7 +470,8 @@ func (m schemaMap) Diff(
         s *terraform.InstanceState,
         c *terraform.ResourceConfig,
         customizeDiff CustomizeDiffFunc,
-        meta interface{}) (*terraform.InstanceDiff, error) {
+        meta interface{},
+        handleRequiresNew bool) (*terraform.InstanceDiff, error) {
         result := new(terraform.InstanceDiff)
         result.Attributes = make(map[string]*terraform.ResourceAttrDiff)
 
@@ -450,82 +517,85 @@ func (m schemaMap) Diff(
                 }
         }
 
-        // If the diff requires a new resource, then we recompute the diff
-        // so we have the complete new resource diff, and preserve the
-        // RequiresNew fields where necessary so the user knows exactly what
-        // caused that.
-        if result.RequiresNew() {
-                // Create the new diff
-                result2 := new(terraform.InstanceDiff)
-                result2.Attributes = make(map[string]*terraform.ResourceAttrDiff)
-
-                // Preserve the DestroyTainted flag
-                result2.DestroyTainted = result.DestroyTainted
+        if handleRequiresNew {
+                // If the diff requires a new resource, then we recompute the diff
+                // so we have the complete new resource diff, and preserve the
+                // RequiresNew fields where necessary so the user knows exactly what
+                // caused that.
+                if result.RequiresNew() {
+                        // Create the new diff
+                        result2 := new(terraform.InstanceDiff)
+                        result2.Attributes = make(map[string]*terraform.ResourceAttrDiff)
 
-                // Reset the data to not contain state. We have to call init()
-                // again in order to reset the FieldReaders.
-                d.state = nil
-                d.init()
+                        // Preserve the DestroyTainted flag
+                        result2.DestroyTainted = result.DestroyTainted
 
-                // Perform the diff again
-                for k, schema := range m {
-                        err := m.diff(k, schema, result2, d, false)
-                        if err != nil {
-                                return nil, err
-                        }
-                }
+                        // Reset the data to not contain state. We have to call init()
+                        // again in order to reset the FieldReaders.
+                        d.state = nil
+                        d.init()
 
-                // Re-run customization
-                if !result2.DestroyTainted && customizeDiff != nil {
-                        mc := m.DeepCopy()
-                        rd := newResourceDiff(mc, c, d.state, result2)
-                        if err := customizeDiff(rd, meta); err != nil {
-                                return nil, err
-                        }
-                        for _, k := range rd.UpdatedKeys() {
-                                err := m.diff(k, mc[k], result2, rd, false)
+                        // Perform the diff again
+                        for k, schema := range m {
+                                err := m.diff(k, schema, result2, d, false)
                                 if err != nil {
                                         return nil, err
                                 }
                         }
-                }
 
-                // Force all the fields to not force a new since we know what we
-                // want to force new.
-                for k, attr := range result2.Attributes {
-                        if attr == nil {
-                                continue
+                        // Re-run customization
+                        if !result2.DestroyTainted && customizeDiff != nil {
+                                mc := m.DeepCopy()
+                                rd := newResourceDiff(mc, c, d.state, result2)
+                                if err := customizeDiff(rd, meta); err != nil {
+                                        return nil, err
+                                }
+                                for _, k := range rd.UpdatedKeys() {
+                                        err := m.diff(k, mc[k], result2, rd, false)
+                                        if err != nil {
+                                                return nil, err
+                                        }
+                                }
                         }
 
-                        if attr.RequiresNew {
-                                attr.RequiresNew = false
-                        }
+                        // Force all the fields to not force a new since we know what we
+                        // want to force new.
+                        for k, attr := range result2.Attributes {
+                                if attr == nil {
+                                        continue
+                                }
 
-                        if s != nil {
-                                attr.Old = s.Attributes[k]
-                        }
-                }
+                                if attr.RequiresNew {
+                                        attr.RequiresNew = false
+                                }
 
-                // Now copy in all the requires new diffs...
-                for k, attr := range result.Attributes {
-                        if attr == nil {
-                                continue
+                                if s != nil {
+                                        attr.Old = s.Attributes[k]
+                                }
                         }
 
-                        newAttr, ok := result2.Attributes[k]
-                        if !ok {
-                                newAttr = attr
-                        }
+                        // Now copy in all the requires new diffs...
+                        for k, attr := range result.Attributes {
+                                if attr == nil {
+                                        continue
+                                }
 
-                        if attr.RequiresNew {
-                                newAttr.RequiresNew = true
+                                newAttr, ok := result2.Attributes[k]
+                                if !ok {
+                                        newAttr = attr
+                                }
+
+                                if attr.RequiresNew {
+                                        newAttr.RequiresNew = true
+                                }
+
+                                result2.Attributes[k] = newAttr
                         }
 
-                        result2.Attributes[k] = newAttr
+                        // And set the diff!
+                        result = result2
                 }
 
-                // And set the diff!
-                result = result2
         }
 
         // Go through and detect all of the ComputedWhens now that we've
@@ -611,6 +681,10 @@ func (m schemaMap) Validate(c *terraform.ResourceConfig) ([]string, []error) {
 // from a unit test (and not in user-path code) to verify that a schema
 // is properly built.
 func (m schemaMap) InternalValidate(topSchemaMap schemaMap) error {
+        return m.internalValidate(topSchemaMap, false)
+}
+
+func (m schemaMap) internalValidate(topSchemaMap schemaMap, attrsOnly bool) error {
         if topSchemaMap == nil {
                 topSchemaMap = m
         }
@@ -631,6 +705,34 @@ func (m schemaMap) InternalValidate(topSchemaMap schemaMap) error {
                         return fmt.Errorf("%s: One of optional, required, or computed must be set", k)
                 }
 
+                computedOnly := v.Computed && !v.Optional
+
+                switch v.ConfigMode {
+                case SchemaConfigModeBlock:
+                        if _, ok := v.Elem.(*Resource); !ok {
+                                return fmt.Errorf("%s: ConfigMode of block is allowed only when Elem is *schema.Resource", k)
+                        }
+                        if attrsOnly {
+                                return fmt.Errorf("%s: ConfigMode of block cannot be used in child of schema with ConfigMode of attribute", k)
+                        }
+                        if computedOnly {
+                                return fmt.Errorf("%s: ConfigMode of block cannot be used for computed schema", k)
+                        }
+                case SchemaConfigModeAttr:
+                        // anything goes
+                case SchemaConfigModeAuto:
+                        // Since "Auto" for Elem: *Resource would create a nested block,
+                        // and that's impossible inside an attribute, we require it to be
+                        // explicitly overridden as mode "Attr" for clarity.
+                        if _, ok := v.Elem.(*Resource); ok {
+                                if attrsOnly {
+                                        return fmt.Errorf("%s: in *schema.Resource with ConfigMode of attribute, so must also have ConfigMode of attribute", k)
+                                }
+                        }
+                default:
+                        return fmt.Errorf("%s: invalid ConfigMode value", k)
+                }
+
                 if v.Computed && v.Default != nil {
                         return fmt.Errorf("%s: Default must be nil if computed", k)
                 }
@@ -695,7 +797,9 @@ func (m schemaMap) InternalValidate(topSchemaMap schemaMap) error {
 
                         switch t := v.Elem.(type) {
                         case *Resource:
-                                if err := t.InternalValidate(topSchemaMap, true); err != nil {
+                                attrsOnly := attrsOnly || v.ConfigMode == SchemaConfigModeAttr
+
+                                if err := schemaMap(t.Schema).internalValidate(topSchemaMap, attrsOnly); err != nil {
                                         return err
                                 }
                         case *Schema:
@@ -785,10 +889,19 @@ func (m schemaMap) diff(
         for attrK, attrV := range unsupressedDiff.Attributes {
                 switch rd := d.(type) {
                 case *ResourceData:
-                        if schema.DiffSuppressFunc != nil &&
-                                attrV != nil &&
+                        if schema.DiffSuppressFunc != nil && attrV != nil &&
                                 schema.DiffSuppressFunc(attrK, attrV.Old, attrV.New, rd) {
-                                continue
+                                // If this attr diff is suppressed, we may still need it in the
+                                // overall diff if it's contained within a set. Rather than
+                                // dropping the diff, make it a NOOP.
+                                if !all {
+                                        continue
+                                }
+
+                                attrV = &terraform.ResourceAttrDiff{
+                                        Old: attrV.Old,
+                                        New: attrV.Old,
+                                }
                         }
                 }
                 diff.Attributes[attrK] = attrV
@@ -1171,7 +1284,7 @@ func (m schemaMap) diffString(
                 return fmt.Errorf("%s: %s", k, err)
         }
 
-        if os == ns && !all {
+        if os == ns && !all && !computed {
                 // They're the same value. If there old value is not blank or we
                 // have an ID, then return right away since we're already setup.
                 if os != "" || d.Id() != "" {
@@ -1179,7 +1292,7 @@ func (m schemaMap) diffString(
                 }
 
                 // Otherwise, only continue if we're computed
-                if !schema.Computed && !computed {
+                if !schema.Computed {
                         return nil
                 }
         }
@@ -1210,7 +1323,7 @@ func (m schemaMap) inputString(
         input terraform.UIInput,
         k string,
         schema *Schema) (interface{}, error) {
-        result, err := input.Input(&terraform.InputOpts{
+        result, err := input.Input(context.Background(), &terraform.InputOpts{
                 Id:          k,
                 Query:       k,
                 Description: schema.Description,
@@ -1252,6 +1365,13 @@ func (m schemaMap) validate(
                         "%q: this field cannot be set", k)}
         }
 
+        if raw == config.UnknownVariableValue {
+                // If the value is unknown then we can't validate it yet.
+                // In particular, this avoids spurious type errors where downstream
+                // validation code sees UnknownVariableValue as being just a string.
+                return nil, nil
+        }
+
         err := m.validateConflictingAttributes(k, schema, c)
         if err != nil {
                 return nil, []error{err}
@@ -1269,10 +1389,15 @@ func (m schemaMap) validateConflictingAttributes(
                 return nil
         }
 
-        for _, conflicting_key := range schema.ConflictsWith {
-                if _, ok := c.Get(conflicting_key); ok {
+        for _, conflictingKey := range schema.ConflictsWith {
+                if raw, ok := c.Get(conflictingKey); ok {
+                        if raw == config.UnknownVariableValue {
+                                // An unknown value might become unset (null) once known, so
+                                // we must defer validation until it's known.
+                                continue
+                        }
                         return fmt.Errorf(
-                                "%q: conflicts with %s", k, conflicting_key)
+                                "%q: conflicts with %s", k, conflictingKey)
                 }
         }
 
@@ -1284,6 +1409,13 @@ func (m schemaMap) validateList(
         raw interface{},
         schema *Schema,
         c *terraform.ResourceConfig) ([]string, []error) {
+        // first check if the list is wholly unknown
+        if s, ok := raw.(string); ok {
+                if s == config.UnknownVariableValue {
+                        return nil, nil
+                }
+        }
+
         // We use reflection to verify the slice because you can't
         // case to []interface{} unless the slice is exactly that type.
         rawV := reflect.ValueOf(raw)
@@ -1355,6 +1487,13 @@ func (m schemaMap) validateMap(
         raw interface{},
         schema *Schema,
         c *terraform.ResourceConfig) ([]string, []error) {
+        // first check if the list is wholly unknown
+        if s, ok := raw.(string); ok {
+                if s == config.UnknownVariableValue {
+                        return nil, nil
+                }
+        }
+
         // We use reflection to verify the slice because you can't
         // case to []interface{} unless the slice is exactly that type.
         rawV := reflect.ValueOf(raw)
@@ -1556,12 +1695,25 @@ func (m schemaMap) validatePrimitive(
                 }
                 decoded = n
         case TypeInt:
-                // Verify that we can parse this as an int
-                var n int
-                if err := mapstructure.WeakDecode(raw, &n); err != nil {
-                        return nil, []error{fmt.Errorf("%s: %s", k, err)}
+                switch {
+                case isProto5():
+                        // We need to verify the type precisely, because WeakDecode will
+                        // decode a float as an integer.
+
+                        // the config shims only use int for integral number values
+                        if v, ok := raw.(int); ok {
+                                decoded = v
+                        } else {
+                                return nil, []error{fmt.Errorf("%s: must be a whole number, got %v", k, raw)}
+                        }
+                default:
+                        // Verify that we can parse this as an int
+                        var n int
+                        if err := mapstructure.WeakDecode(raw, &n); err != nil {
+                                return nil, []error{fmt.Errorf("%s: %s", k, err)}
+                        }
+                        decoded = n
                 }
-                decoded = n
         case TypeFloat:
                 // Verify that we can parse this as an int
                 var n float64
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/set.go b/vendor/github.com/hashicorp/terraform/helper/schema/set.go
index cba2890..8ee89e4 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/set.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/set.go
@@ -198,6 +198,16 @@ func (s *Set) add(item interface{}, computed bool) string {
         code := s.hash(item)
         if computed {
                 code = "~" + code
+
+                if isProto5() {
+                        tmpCode := code
+                        count := 0
+                        for _, exists := s.m[tmpCode]; exists; _, exists = s.m[tmpCode] {
+                                count++
+                                tmpCode = fmt.Sprintf("%s%d", code, count)
+                        }
+                        code = tmpCode
+                }
         }
 
         if _, ok := s.m[code]; !ok {
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/shims.go b/vendor/github.com/hashicorp/terraform/helper/schema/shims.go
new file mode 100644
index 0000000..203d017
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/shims.go
@@ -0,0 +1,115 @@
+package schema
+
+import (
+        "encoding/json"
+
+        "github.com/zclconf/go-cty/cty"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+
+        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/terraform"
+)
+
+// DiffFromValues takes the current state and desired state as cty.Values and
+// derives a terraform.InstanceDiff to give to the legacy providers. This is
+// used to take the states provided by the new ApplyResourceChange method and
+// convert them to a state+diff required for the legacy Apply method.
+func DiffFromValues(prior, planned cty.Value, res *Resource) (*terraform.InstanceDiff, error) {
+        return diffFromValues(prior, planned, res, nil)
+}
+
+// diffFromValues takes an additional CustomizeDiffFunc, so we can generate our
+// test fixtures from the legacy tests. In the new provider protocol the diff
+// only needs to be created for the apply operation, and any customizations
+// have already been done.
+func diffFromValues(prior, planned cty.Value, res *Resource, cust CustomizeDiffFunc) (*terraform.InstanceDiff, error) {
+        instanceState, err := res.ShimInstanceStateFromValue(prior)
+        if err != nil {
+                return nil, err
+        }
+
+        configSchema := res.CoreConfigSchema()
+
+        cfg := terraform.NewResourceConfigShimmed(planned, configSchema)
+        removeConfigUnknowns(cfg.Config)
+        removeConfigUnknowns(cfg.Raw)
+
+        diff, err := schemaMap(res.Schema).Diff(instanceState, cfg, cust, nil, false)
+        if err != nil {
+                return nil, err
+        }
+
+        return diff, err
+}
+
+// During apply the only unknown values are those which are to be computed by
+// the resource itself. These may have been marked as unknown config values, and
+// need to be removed to prevent the UnknownVariableValue from appearing the diff.
+func removeConfigUnknowns(cfg map[string]interface{}) {
+        for k, v := range cfg {
+                switch v := v.(type) {
+                case string:
+                        if v == config.UnknownVariableValue {
+                                delete(cfg, k)
+                        }
+                case []interface{}:
+                        for _, i := range v {
+                                if m, ok := i.(map[string]interface{}); ok {
+                                        removeConfigUnknowns(m)
+                                }
+                        }
+                case map[string]interface{}:
+                        removeConfigUnknowns(v)
+                }
+        }
+}
+
+// ApplyDiff takes a cty.Value state and applies a terraform.InstanceDiff to
+// get a new cty.Value state. This is used to convert the diff returned from
+// the legacy provider Diff method to the state required for the new
+// PlanResourceChange method.
+func ApplyDiff(base cty.Value, d *terraform.InstanceDiff, schema *configschema.Block) (cty.Value, error) {
+        return d.ApplyToValue(base, schema)
+}
+
+// StateValueToJSONMap converts a cty.Value to generic JSON map via the cty JSON
+// encoding.
+func StateValueToJSONMap(val cty.Value, ty cty.Type) (map[string]interface{}, error) {
+        js, err := ctyjson.Marshal(val, ty)
+        if err != nil {
+                return nil, err
+        }
+
+        var m map[string]interface{}
+        if err := json.Unmarshal(js, &m); err != nil {
+                return nil, err
+        }
+
+        return m, nil
+}
+
+// JSONMapToStateValue takes a generic json map[string]interface{} and converts it
+// to the specific type, ensuring that the values conform to the schema.
+func JSONMapToStateValue(m map[string]interface{}, block *configschema.Block) (cty.Value, error) {
+        var val cty.Value
+
+        js, err := json.Marshal(m)
+        if err != nil {
+                return val, err
+        }
+
+        val, err = ctyjson.Unmarshal(js, block.ImpliedType())
+        if err != nil {
+                return val, err
+        }
+
+        return block.CoerceValue(val)
+}
+
+// StateValueFromInstanceState converts a terraform.InstanceState to a
+// cty.Value as described by the provided cty.Type, and maintains the resource
+// ID as the "id" attribute.
+func StateValueFromInstanceState(is *terraform.InstanceState, ty cty.Type) (cty.Value, error) {
+        return is.AttrsAsObjectValue(ty)
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/testing.go b/vendor/github.com/hashicorp/terraform/helper/schema/testing.go
index da754ac..a367a1f 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/testing.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/testing.go
@@ -18,7 +18,7 @@ func TestResourceDataRaw(
         }
 
         sm := schemaMap(schema)
-        diff, err := sm.Diff(nil, terraform.NewResourceConfig(c), nil, nil)
+        diff, err := sm.Diff(nil, terraform.NewResourceConfig(c), nil, nil, true)
         if err != nil {
                 t.Fatalf("err: %s", err)
         }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go b/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go
index 3bc3ac4..914ca32 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go
@@ -4,6 +4,21 @@ package schema
 
 import "strconv"
 
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[TypeInvalid-0]
+        _ = x[TypeBool-1]
+        _ = x[TypeInt-2]
+        _ = x[TypeFloat-3]
+        _ = x[TypeString-4]
+        _ = x[TypeList-5]
+        _ = x[TypeMap-6]
+        _ = x[TypeSet-7]
+        _ = x[typeObject-8]
+}
+
 const _ValueType_name = "TypeInvalidTypeBoolTypeIntTypeFloatTypeStringTypeListTypeMapTypeSettypeObject"
 
 var _ValueType_index = [...]uint8{0, 11, 19, 26, 35, 45, 53, 60, 67, 77}