Merge pull request #27 from terraform-providers/go-modules-2019-02-22

[MODULES] Switch to Go Modules

34 files changed, 1529 insertions, 915 deletions

diff --git a/vendor/github.com/hashicorp/terraform/helper/experiment/experiment.go b/vendor/github.com/hashicorp/terraform/helper/experiment/experiment.go
deleted file mode 100644
index 18b8837..0000000
--- a/vendor/github.com/hashicorp/terraform/helper/experiment/experiment.go
+++ /dev/null
@@ -1,154 +0,0 @@
-// experiment package contains helper functions for tracking experimental
-// features throughout Terraform.
-//
-// This package should be used for creating, enabling, querying, and deleting
-// experimental features. By unifying all of that onto a single interface,
-// we can have the Go compiler help us by enforcing every place we touch
-// an experimental feature.
-//
-// To create a new experiment:
-//
-//   1. Add the experiment to the global vars list below, prefixed with X_
-//
-//   2. Add the experiment variable to the All listin the init() function
-//
-//   3. Use it!
-//
-// To remove an experiment:
-//
-//   1. Delete the experiment global var.
-//
-//   2. Try to compile and fix all the places where the var was referenced.
-//
-// To use an experiment:
-//
-//   1. Use Flag() if you want the experiment to be available from the CLI.
-//
-//   2. Use Enabled() to check whether it is enabled.
-//
-// As a general user:
-//
-//   1. The `-Xexperiment-name` flag
-//   2. The `TF_X_<experiment-name>` env var.
-//   3. The `TF_X_FORCE` env var can be set to force an experimental feature
-//      without human verifications.
-//
-package experiment
-
-import (
-        "flag"
-        "fmt"
-        "os"
-        "strconv"
-        "strings"
-        "sync"
-)
-
-// The experiments that are available are listed below. Any package in
-// Terraform defining an experiment should define the experiments below.
-// By keeping them all within the experiment package we force a single point
-// of definition and use. This allows the compiler to enforce references
-// so it becomes easy to remove the features.
-var (
-        // Shadow graph. This is already on by default. Disabling it will be
-        // allowed for awhile in order for it to not block operations.
-        X_shadow = newBasicID("shadow", "SHADOW", false)
-)
-
-// Global variables this package uses because we are a package
-// with global state.
-var (
-        // all is the list of all experiements. Do not modify this.
-        All []ID
-
-        // enabled keeps track of what flags have been enabled
-        enabled     map[string]bool
-        enabledLock sync.Mutex
-
-        // Hidden "experiment" that forces all others to be on without verification
-        x_force = newBasicID("force", "FORCE", false)
-)
-
-func init() {
-        // The list of all experiments, update this when an experiment is added.
-        All = []ID{
-                X_shadow,
-                x_force,
-        }
-
-        // Load
-        reload()
-}
-
-// reload is used by tests to reload the global state. This is called by
-// init publicly.
-func reload() {
-        // Initialize
-        enabledLock.Lock()
-        enabled = make(map[string]bool)
-        enabledLock.Unlock()
-
-        // Set defaults and check env vars
-        for _, id := range All {
-                // Get the default value
-                def := id.Default()
-
-                // If we set it in the env var, default it to true
-                key := fmt.Sprintf("TF_X_%s", strings.ToUpper(id.Env()))
-                if v := os.Getenv(key); v != "" {
-                        def = v != "0"
-                }
-
-                // Set the default
-                SetEnabled(id, def)
-        }
-}
-
-// Enabled returns whether an experiment has been enabled or not.
-func Enabled(id ID) bool {
-        enabledLock.Lock()
-        defer enabledLock.Unlock()
-        return enabled[id.Flag()]
-}
-
-// SetEnabled sets an experiment to enabled/disabled. Please check with
-// the experiment docs for when calling this actually affects the experiment.
-func SetEnabled(id ID, v bool) {
-        enabledLock.Lock()
-        defer enabledLock.Unlock()
-        enabled[id.Flag()] = v
-}
-
-// Force returns true if the -Xforce of TF_X_FORCE flag is present, which
-// advises users of this package to not verify with the user that they want
-// experimental behavior and to just continue with it.
-func Force() bool {
-        return Enabled(x_force)
-}
-
-// Flag configures the given FlagSet with the flags to configure
-// all active experiments.
-func Flag(fs *flag.FlagSet) {
-        for _, id := range All {
-                desc := id.Flag()
-                key := fmt.Sprintf("X%s", id.Flag())
-                fs.Var(&idValue{X: id}, key, desc)
-        }
-}
-
-// idValue implements flag.Value for setting the enabled/disabled state
-// of an experiment from the CLI.
-type idValue struct {
-        X ID
-}
-
-func (v *idValue) IsBoolFlag() bool { return true }
-func (v *idValue) String() string   { return strconv.FormatBool(Enabled(v.X)) }
-func (v *idValue) Set(raw string) error {
-        b, err := strconv.ParseBool(raw)
-        if err == nil {
-                SetEnabled(v.X, b)
-        }
-
-        return err
-}
diff --git a/vendor/github.com/hashicorp/terraform/helper/experiment/id.go b/vendor/github.com/hashicorp/terraform/helper/experiment/id.go
deleted file mode 100644
index 8e2f707..0000000
--- a/vendor/github.com/hashicorp/terraform/helper/experiment/id.go
+++ /dev/null
@@ -1,34 +0,0 @@
-package experiment
-
-// ID represents an experimental feature.
-//
-// The global vars defined on this package should be used as ID values.
-// This interface is purposely not implement-able outside of this package
-// so that we can rely on the Go compiler to enforce all experiment references.
-type ID interface {
-        Env() string
-        Flag() string
-        Default() bool
-
-        unexported() // So the ID can't be implemented externally.
-}
-
-// basicID implements ID.
-type basicID struct {
-        EnvValue     string
-        FlagValue    string
-        DefaultValue bool
-}
-
-func newBasicID(flag, env string, def bool) ID {
-        return &basicID{
-                EnvValue:     env,
-                FlagValue:    flag,
-                DefaultValue: def,
-        }
-}
-
-func (id *basicID) Env() string   { return id.EnvValue }
-func (id *basicID) Flag() string  { return id.FlagValue }
-func (id *basicID) Default() bool { return id.DefaultValue }
-func (id *basicID) unexported()   {}
diff --git a/vendor/github.com/hashicorp/terraform/helper/hashcode/hashcode.go b/vendor/github.com/hashicorp/terraform/helper/hashcode/hashcode.go
index 64d8263..6ccc523 100644
--- a/vendor/github.com/hashicorp/terraform/helper/hashcode/hashcode.go
+++ b/vendor/github.com/hashicorp/terraform/helper/hashcode/hashcode.go
@@ -1,6 +1,8 @@
 package hashcode
 
 import (
+        "bytes"
+        "fmt"
         "hash/crc32"
 )
 
@@ -20,3 +22,14 @@ func String(s string) int {
         // v == MinInt
         return 0
 }
+
+// Strings hashes a list of strings to a unique hashcode.
+func Strings(strings []string) string {
+        var buf bytes.Buffer
+
+        for _, s := range strings {
+                buf.WriteString(fmt.Sprintf("%s-", s))
+        }
+
+        return fmt.Sprintf("%d", String(buf.String()))
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/logging/logging.go b/vendor/github.com/hashicorp/terraform/helper/logging/logging.go
index 433cd77..6bd92f7 100644
--- a/vendor/github.com/hashicorp/terraform/helper/logging/logging.go
+++ b/vendor/github.com/hashicorp/terraform/helper/logging/logging.go
@@ -18,7 +18,7 @@ const (
         EnvLogFile = "TF_LOG_PATH" // Set to a file
 )
 
-var validLevels = []logutils.LogLevel{"TRACE", "DEBUG", "INFO", "WARN", "ERROR"}
+var ValidLevels = []logutils.LogLevel{"TRACE", "DEBUG", "INFO", "WARN", "ERROR"}
 
 // LogOutput determines where we should send logs (if anywhere) and the log level.
 func LogOutput() (logOutput io.Writer, err error) {
@@ -40,7 +40,7 @@ func LogOutput() (logOutput io.Writer, err error) {
 
         // This was the default since the beginning
         logOutput = &logutils.LevelFilter{
-                Levels:   validLevels,
+                Levels:   ValidLevels,
                 MinLevel: logutils.LogLevel(logLevel),
                 Writer:   logOutput,
         }
@@ -77,7 +77,7 @@ func LogLevel() string {
                 logLevel = strings.ToUpper(envLevel)
         } else {
                 log.Printf("[WARN] Invalid log level: %q. Defaulting to level: TRACE. Valid levels are: %+v",
-                        envLevel, validLevels)
+                        envLevel, ValidLevels)
         }
 
         return logLevel
@@ -90,7 +90,7 @@ func IsDebugOrHigher() bool {
 }
 
 func isValidLogLevel(level string) bool {
-        for _, l := range validLevels {
+        for _, l := range ValidLevels {
                 if strings.ToUpper(level) == string(l) {
                         return true
                 }
diff --git a/vendor/github.com/hashicorp/terraform/helper/logging/transport.go b/vendor/github.com/hashicorp/terraform/helper/logging/transport.go
index 4477924..bddabe6 100644
--- a/vendor/github.com/hashicorp/terraform/helper/logging/transport.go
+++ b/vendor/github.com/hashicorp/terraform/helper/logging/transport.go
@@ -1,9 +1,12 @@
 package logging
 
 import (
+        "bytes"
+        "encoding/json"
         "log"
         "net/http"
         "net/http/httputil"
+        "strings"
 )
 
 type transport struct {
@@ -15,7 +18,7 @@ func (t *transport) RoundTrip(req *http.Request) (*http.Response, error) {
         if IsDebugOrHigher() {
                 reqData, err := httputil.DumpRequestOut(req, true)
                 if err == nil {
-                        log.Printf("[DEBUG] "+logReqMsg, t.name, string(reqData))
+                        log.Printf("[DEBUG] "+logReqMsg, t.name, prettyPrintJsonLines(reqData))
                 } else {
                         log.Printf("[ERROR] %s API Request error: %#v", t.name, err)
                 }
@@ -29,7 +32,7 @@ func (t *transport) RoundTrip(req *http.Request) (*http.Response, error) {
         if IsDebugOrHigher() {
                 respData, err := httputil.DumpResponse(resp, true)
                 if err == nil {
-                        log.Printf("[DEBUG] "+logRespMsg, t.name, string(respData))
+                        log.Printf("[DEBUG] "+logRespMsg, t.name, prettyPrintJsonLines(respData))
                 } else {
                         log.Printf("[ERROR] %s API Response error: %#v", t.name, err)
                 }
@@ -42,6 +45,20 @@ func NewTransport(name string, t http.RoundTripper) *transport {
         return &transport{name, t}
 }
 
+// prettyPrintJsonLines iterates through a []byte line-by-line,
+// transforming any lines that are complete json into pretty-printed json.
+func prettyPrintJsonLines(b []byte) string {
+        parts := strings.Split(string(b), "\n")
+        for i, p := range parts {
+                if b := []byte(p); json.Valid(b) {
+                        var out bytes.Buffer
+                        json.Indent(&out, b, "", " ")
+                        parts[i] = out.String()
+                }
+        }
+        return strings.Join(parts, "\n")
+}
+
 const logReqMsg = `%s API Request Details:
 ---[ REQUEST ]---------------------------------------
 %s
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/id.go b/vendor/github.com/hashicorp/terraform/helper/resource/id.go
index 1cde67c..4494955 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/id.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/id.go
@@ -18,6 +18,11 @@ func UniqueId() string {
         return PrefixedUniqueId(UniqueIdPrefix)
 }
 
+// UniqueIDSuffixLength is the string length of the suffix generated by
+// PrefixedUniqueId. This can be used by length validation functions to
+// ensure prefixes are the correct length for the target field.
+const UniqueIDSuffixLength = 26
+
 // Helper for a resource to generate a unique identifier w/ given prefix
 //
 // After the prefix, the ID consists of an incrementing 26 digit value (to match
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/state.go b/vendor/github.com/hashicorp/terraform/helper/resource/state.go
index 37c586a..c34e21b 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/state.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/state.go
@@ -46,7 +46,7 @@ type StateChangeConf struct {
 // If the Timeout is exceeded before reaching the Target state, return an
 // error.
 //
-// Otherwise, result the result of the first call to the Refresh function to
+// Otherwise, the result is the result of the first call to the Refresh function to
 // reach the target state.
 func (conf *StateChangeConf) WaitForState() (interface{}, error) {
         log.Printf("[DEBUG] Waiting for state to become: %s", conf.Target)
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/testing.go b/vendor/github.com/hashicorp/terraform/helper/resource/testing.go
index d7de1a0..b97673f 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/testing.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/testing.go
@@ -11,11 +11,13 @@ import (
         "reflect"
         "regexp"
         "strings"
+        "syscall"
         "testing"
 
         "github.com/davecgh/go-spew/spew"
-        "github.com/hashicorp/go-getter"
+        "github.com/hashicorp/errwrap"
         "github.com/hashicorp/go-multierror"
+        "github.com/hashicorp/logutils"
         "github.com/hashicorp/terraform/config/module"
         "github.com/hashicorp/terraform/helper/logging"
         "github.com/hashicorp/terraform/terraform"
@@ -186,6 +188,10 @@ type TestCheckFunc func(*terraform.State) error
 // ImportStateCheckFunc is the check function for ImportState tests
 type ImportStateCheckFunc func([]*terraform.InstanceState) error
 
+// ImportStateIdFunc is an ID generation function to help with complex ID
+// generation for ImportState tests.
+type ImportStateIdFunc func(*terraform.State) (string, error)
+
 // TestCase is a single acceptance test case used to test the apply/destroy
 // lifecycle of a resource in a specific configuration.
 //
@@ -260,6 +266,15 @@ type TestStep struct {
         // below.
         PreConfig func()
 
+        // Taint is a list of resource addresses to taint prior to the execution of
+        // the step. Be sure to only include this at a step where the referenced
+        // address will be present in state, as it will fail the test if the resource
+        // is missing.
+        //
+        // This option is ignored on ImportState tests, and currently only works for
+        // resources in the root module path.
+        Taint []string
+
         //---------------------------------------------------------------
         // Test modes. One of the following groups of settings must be
         // set to determine what the test step will do. Ideally we would've
@@ -304,10 +319,19 @@ type TestStep struct {
         // no-op plans
         PlanOnly bool
 
+        // PreventDiskCleanup can be set to true for testing terraform modules which
+        // require access to disk at runtime. Note that this will leave files in the
+        // temp folder
+        PreventDiskCleanup bool
+
         // PreventPostDestroyRefresh can be set to true for cases where data sources
         // are tested alongside real resources
         PreventPostDestroyRefresh bool
 
+        // SkipFunc is called before applying config, but after PreConfig
+        // This is useful for defining test steps with platform-dependent checks
+        SkipFunc func() (bool, error)
+
         //---------------------------------------------------------------
         // ImportState testing
         //---------------------------------------------------------------
@@ -329,6 +353,12 @@ type TestStep struct {
         // the unset ImportStateId field.
         ImportStateIdPrefix string
 
+        // ImportStateIdFunc is a function that can be used to dynamically generate
+        // the ID for the ImportState tests. It is sent the state, which can be
+        // checked to derive the attributes necessary and generate the string in the
+        // desired format.
+        ImportStateIdFunc ImportStateIdFunc
+
         // ImportStateCheck checks the results of ImportState. It should be
         // used to verify that the resulting value of ImportState has the
         // proper resources, IDs, and attributes.
@@ -345,6 +375,60 @@ type TestStep struct {
         ImportStateVerifyIgnore []string
 }
 
+// Set to a file mask in sprintf format where %s is test name
+const EnvLogPathMask = "TF_LOG_PATH_MASK"
+
+func LogOutput(t TestT) (logOutput io.Writer, err error) {
+        logOutput = ioutil.Discard
+
+        logLevel := logging.LogLevel()
+        if logLevel == "" {
+                return
+        }
+
+        logOutput = os.Stderr
+
+        if logPath := os.Getenv(logging.EnvLogFile); logPath != "" {
+                var err error
+                logOutput, err = os.OpenFile(logPath, syscall.O_CREAT|syscall.O_RDWR|syscall.O_APPEND, 0666)
+                if err != nil {
+                        return nil, err
+                }
+        }
+
+        if logPathMask := os.Getenv(EnvLogPathMask); logPathMask != "" {
+                // Escape special characters which may appear if we have subtests
+                testName := strings.Replace(t.Name(), "/", "__", -1)
+
+                logPath := fmt.Sprintf(logPathMask, testName)
+                var err error
+                logOutput, err = os.OpenFile(logPath, syscall.O_CREAT|syscall.O_RDWR|syscall.O_APPEND, 0666)
+                if err != nil {
+                        return nil, err
+                }
+        }
+
+        // This was the default since the beginning
+        logOutput = &logutils.LevelFilter{
+                Levels:   logging.ValidLevels,
+                MinLevel: logutils.LogLevel(logLevel),
+                Writer:   logOutput,
+        }
+
+        return
+}
+
+// ParallelTest performs an acceptance test on a resource, allowing concurrency
+// with other ParallelTest.
+//
+// Tests will fail if they do not properly handle conditions to allow multiple
+// tests to occur against the same resource or service (e.g. random naming).
+// All other requirements of the Test function also apply to this function.
+func ParallelTest(t TestT, c TestCase) {
+        t.Parallel()
+        Test(t, c)
+}
+
 // Test performs an acceptance test on a resource.
 //
 // Tests are not run unless an environmental variable "TF_ACC" is
@@ -366,7 +450,7 @@ func Test(t TestT, c TestCase) {
                 return
         }
 
-        logWriter, err := logging.LogOutput()
+        logWriter, err := LogOutput(t)
         if err != nil {
                 t.Error(fmt.Errorf("error setting up logging: %s", err))
         }
@@ -398,7 +482,18 @@ func Test(t TestT, c TestCase) {
         errored := false
         for i, step := range c.Steps {
                 var err error
-                log.Printf("[WARN] Test: Executing step %d", i)
+                log.Printf("[DEBUG] Test: Executing step %d", i)
+
+                if step.SkipFunc != nil {
+                        skip, err := step.SkipFunc()
+                        if err != nil {
+                                t.Fatal(err)
+                        }
+                        if skip {
+                                log.Printf("[WARN] Skipping step %d", i)
+                                continue
+                        }
+                }
 
                 if step.Config == "" && !step.ImportState {
                         err = fmt.Errorf(
@@ -418,6 +513,15 @@ func Test(t TestT, c TestCase) {
                         }
                 }
 
+                // If we expected an error, but did not get one, fail
+                if err == nil && step.ExpectError != nil {
+                        errored = true
+                        t.Error(fmt.Sprintf(
+                                "Step %d, no error received, but expected a match to:\n\n%s\n\n",
+                                i, step.ExpectError))
+                        break
+                }
+
                 // If there was an error, exit
                 if err != nil {
                         // Perhaps we expected an error? Check if it matches
@@ -485,6 +589,7 @@ func Test(t TestT, c TestCase) {
                         Config:                    lastStep.Config,
                         Check:                     c.CheckDestroy,
                         Destroy:                   true,
+                        PreventDiskCleanup:        lastStep.PreventDiskCleanup,
                         PreventPostDestroyRefresh: c.PreventPostDestroyRefresh,
                 }
 
@@ -593,18 +698,12 @@ func testIDOnlyRefresh(c TestCase, opts terraform.ContextOpts, step TestStep, r
         if err != nil {
                 return err
         }
-        if ws, es := ctx.Validate(); len(ws) > 0 || len(es) > 0 {
-                if len(es) > 0 {
-                        estrs := make([]string, len(es))
-                        for i, e := range es {
-                                estrs[i] = e.Error()
-                        }
-                        return fmt.Errorf(
-                                "Configuration is invalid.\n\nWarnings: %#v\n\nErrors: %#v",
-                                ws, estrs)
+        if diags := ctx.Validate(); len(diags) > 0 {
+                if diags.HasErrors() {
+                        return errwrap.Wrapf("config is invalid: {{err}}", diags.Err())
                 }
 
-                log.Printf("[WARN] Config warnings: %#v", ws)
+                log.Printf("[WARN] Config warnings:\n%s", diags.Err().Error())
         }
 
         // Refresh!
@@ -657,9 +756,7 @@ func testIDOnlyRefresh(c TestCase, opts terraform.ContextOpts, step TestStep, r
         return nil
 }
 
-func testModule(
-        opts terraform.ContextOpts,
-        step TestStep) (*module.Tree, error) {
+func testModule(opts terraform.ContextOpts, step TestStep) (*module.Tree, error) {
         if step.PreConfig != nil {
                 step.PreConfig()
         }
@@ -669,7 +766,12 @@ func testModule(
                 return nil, fmt.Errorf(
                         "Error creating temporary directory for config: %s", err)
         }
-        defer os.RemoveAll(cfgPath)
+
+        if step.PreventDiskCleanup {
+                log.Printf("[INFO] Skipping defer os.RemoveAll call")
+        } else {
+                defer os.RemoveAll(cfgPath)
+        }
 
         // Write the configuration
         cfgF, err := os.Create(filepath.Join(cfgPath, "main.tf"))
@@ -693,10 +795,11 @@ func testModule(
         }
 
         // Load the modules
-        modStorage := &getter.FolderStorage{
+        modStorage := &module.Storage{
                 StorageDir: filepath.Join(cfgPath, ".tfmodules"),
+                Mode:       module.GetModeGet,
         }
-        err = mod.Load(modStorage, module.GetModeGet)
+        err = mod.Load(modStorage)
         if err != nil {
                 return nil, fmt.Errorf("Error downloading modules: %s", err)
         }
@@ -771,12 +874,29 @@ func TestCheckResourceAttrSet(name, key string) TestCheckFunc {
                         return err
                 }
 
-                if val, ok := is.Attributes[key]; ok && val != "" {
-                        return nil
+                return testCheckResourceAttrSet(is, name, key)
+        }
+}
+
+// TestCheckModuleResourceAttrSet - as per TestCheckResourceAttrSet but with
+// support for non-root modules
+func TestCheckModuleResourceAttrSet(mp []string, name string, key string) TestCheckFunc {
+        return func(s *terraform.State) error {
+                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                if err != nil {
+                        return err
                 }
 
+                return testCheckResourceAttrSet(is, name, key)
+        }
+}
+
+func testCheckResourceAttrSet(is *terraform.InstanceState, name string, key string) error {
+        if val, ok := is.Attributes[key]; !ok || val == "" {
                 return fmt.Errorf("%s: Attribute '%s' expected to be set", name, key)
         }
+
+        return nil
 }
 
 // TestCheckResourceAttr is a TestCheckFunc which validates
@@ -788,21 +908,37 @@ func TestCheckResourceAttr(name, key, value string) TestCheckFunc {
                         return err
                 }
 
-                if v, ok := is.Attributes[key]; !ok || v != value {
-                        if !ok {
-                                return fmt.Errorf("%s: Attribute '%s' not found", name, key)
-                        }
+                return testCheckResourceAttr(is, name, key, value)
+        }
+}
 
-                        return fmt.Errorf(
-                                "%s: Attribute '%s' expected %#v, got %#v",
-                                name,
-                                key,
-                                value,
-                                v)
+// TestCheckModuleResourceAttr - as per TestCheckResourceAttr but with
+// support for non-root modules
+func TestCheckModuleResourceAttr(mp []string, name string, key string, value string) TestCheckFunc {
+        return func(s *terraform.State) error {
+                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                if err != nil {
+                        return err
                 }
 
-                return nil
+                return testCheckResourceAttr(is, name, key, value)
+        }
+}
+
+func testCheckResourceAttr(is *terraform.InstanceState, name string, key string, value string) error {
+        if v, ok := is.Attributes[key]; !ok || v != value {
+                if !ok {
+                        return fmt.Errorf("%s: Attribute '%s' not found", name, key)
+                }
+
+                return fmt.Errorf(
+                        "%s: Attribute '%s' expected %#v, got %#v",
+                        name,
+                        key,
+                        value,
+                        v)
         }
+        return nil
 }
 
 // TestCheckNoResourceAttr is a TestCheckFunc which ensures that
@@ -814,14 +950,31 @@ func TestCheckNoResourceAttr(name, key string) TestCheckFunc {
                         return err
                 }
 
-                if _, ok := is.Attributes[key]; ok {
-                        return fmt.Errorf("%s: Attribute '%s' found when not expected", name, key)
+                return testCheckNoResourceAttr(is, name, key)
+        }
+}
+
+// TestCheckModuleNoResourceAttr - as per TestCheckNoResourceAttr but with
+// support for non-root modules
+func TestCheckModuleNoResourceAttr(mp []string, name string, key string) TestCheckFunc {
+        return func(s *terraform.State) error {
+                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                if err != nil {
+                        return err
                 }
 
-                return nil
+                return testCheckNoResourceAttr(is, name, key)
         }
 }
 
+func testCheckNoResourceAttr(is *terraform.InstanceState, name string, key string) error {
+        if _, ok := is.Attributes[key]; ok {
+                return fmt.Errorf("%s: Attribute '%s' found when not expected", name, key)
+        }
+
+        return nil
+}
+
 // TestMatchResourceAttr is a TestCheckFunc which checks that the value
 // in state for the given name/key combination matches the given regex.
 func TestMatchResourceAttr(name, key string, r *regexp.Regexp) TestCheckFunc {
@@ -831,17 +984,34 @@ func TestMatchResourceAttr(name, key string, r *regexp.Regexp) TestCheckFunc {
                         return err
                 }
 
-                if !r.MatchString(is.Attributes[key]) {
-                        return fmt.Errorf(
-                                "%s: Attribute '%s' didn't match %q, got %#v",
-                                name,
-                                key,
-                                r.String(),
-                                is.Attributes[key])
+                return testMatchResourceAttr(is, name, key, r)
+        }
+}
+
+// TestModuleMatchResourceAttr - as per TestMatchResourceAttr but with
+// support for non-root modules
+func TestModuleMatchResourceAttr(mp []string, name string, key string, r *regexp.Regexp) TestCheckFunc {
+        return func(s *terraform.State) error {
+                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                if err != nil {
+                        return err
                 }
 
-                return nil
+                return testMatchResourceAttr(is, name, key, r)
+        }
+}
+
+func testMatchResourceAttr(is *terraform.InstanceState, name string, key string, r *regexp.Regexp) error {
+        if !r.MatchString(is.Attributes[key]) {
+                return fmt.Errorf(
+                        "%s: Attribute '%s' didn't match %q, got %#v",
+                        name,
+                        key,
+                        r.String(),
+                        is.Attributes[key])
         }
+
+        return nil
 }
 
 // TestCheckResourceAttrPtr is like TestCheckResourceAttr except the
@@ -853,6 +1023,14 @@ func TestCheckResourceAttrPtr(name string, key string, value *string) TestCheckF
         }
 }
 
+// TestCheckModuleResourceAttrPtr - as per TestCheckResourceAttrPtr but with
+// support for non-root modules
+func TestCheckModuleResourceAttrPtr(mp []string, name string, key string, value *string) TestCheckFunc {
+        return func(s *terraform.State) error {
+                return TestCheckModuleResourceAttr(mp, name, key, *value)(s)
+        }
+}
+
 // TestCheckResourceAttrPair is a TestCheckFunc which validates that the values
 // in state for a pair of name/key combinations are equal.
 func TestCheckResourceAttrPair(nameFirst, keyFirst, nameSecond, keySecond string) TestCheckFunc {
@@ -861,33 +1039,57 @@ func TestCheckResourceAttrPair(nameFirst, keyFirst, nameSecond, keySecond string
                 if err != nil {
                         return err
                 }
-                vFirst, ok := isFirst.Attributes[keyFirst]
-                if !ok {
-                        return fmt.Errorf("%s: Attribute '%s' not found", nameFirst, keyFirst)
-                }
 
                 isSecond, err := primaryInstanceState(s, nameSecond)
                 if err != nil {
                         return err
                 }
-                vSecond, ok := isSecond.Attributes[keySecond]
-                if !ok {
-                        return fmt.Errorf("%s: Attribute '%s' not found", nameSecond, keySecond)
+
+                return testCheckResourceAttrPair(isFirst, nameFirst, keyFirst, isSecond, nameSecond, keySecond)
+        }
+}
+
+// TestCheckModuleResourceAttrPair - as per TestCheckResourceAttrPair but with
+// support for non-root modules
+func TestCheckModuleResourceAttrPair(mpFirst []string, nameFirst string, keyFirst string, mpSecond []string, nameSecond string, keySecond string) TestCheckFunc {
+        return func(s *terraform.State) error {
+                isFirst, err := modulePathPrimaryInstanceState(s, mpFirst, nameFirst)
+                if err != nil {
+                        return err
                 }
 
-                if vFirst != vSecond {
-                        return fmt.Errorf(
-                                "%s: Attribute '%s' expected %#v, got %#v",
-                                nameFirst,
-                                keyFirst,
-                                vSecond,
-                                vFirst)
+                isSecond, err := modulePathPrimaryInstanceState(s, mpSecond, nameSecond)
+                if err != nil {
+                        return err
                 }
 
-                return nil
+                return testCheckResourceAttrPair(isFirst, nameFirst, keyFirst, isSecond, nameSecond, keySecond)
         }
 }
 
+func testCheckResourceAttrPair(isFirst *terraform.InstanceState, nameFirst string, keyFirst string, isSecond *terraform.InstanceState, nameSecond string, keySecond string) error {
+        vFirst, ok := isFirst.Attributes[keyFirst]
+        if !ok {
+                return fmt.Errorf("%s: Attribute '%s' not found", nameFirst, keyFirst)
+        }
+
+        vSecond, ok := isSecond.Attributes[keySecond]
+        if !ok {
+                return fmt.Errorf("%s: Attribute '%s' not found", nameSecond, keySecond)
+        }
+
+        if vFirst != vSecond {
+                return fmt.Errorf(
+                        "%s: Attribute '%s' expected %#v, got %#v",
+                        nameFirst,
+                        keyFirst,
+                        vSecond,
+                        vFirst)
+        }
+
+        return nil
+}
+
 // TestCheckOutput checks an output in the Terraform configuration
 func TestCheckOutput(name, value string) TestCheckFunc {
         return func(s *terraform.State) error {
@@ -936,23 +1138,43 @@ type TestT interface {
         Error(args ...interface{})
         Fatal(args ...interface{})
         Skip(args ...interface{})
+        Name() string
+        Parallel()
 }
 
 // This is set to true by unit tests to alter some behavior
 var testTesting = false
 
-// primaryInstanceState returns the primary instance state for the given resource name.
-func primaryInstanceState(s *terraform.State, name string) (*terraform.InstanceState, error) {
-        ms := s.RootModule()
+// modulePrimaryInstanceState returns the instance state for the given resource
+// name in a ModuleState
+func modulePrimaryInstanceState(s *terraform.State, ms *terraform.ModuleState, name string) (*terraform.InstanceState, error) {
         rs, ok := ms.Resources[name]
         if !ok {
-                return nil, fmt.Errorf("Not found: %s", name)
+                return nil, fmt.Errorf("Not found: %s in %s", name, ms.Path)
         }
 
         is := rs.Primary
         if is == nil {
-                return nil, fmt.Errorf("No primary instance: %s", name)
+                return nil, fmt.Errorf("No primary instance: %s in %s", name, ms.Path)
         }
 
         return is, nil
 }
+
+// modulePathPrimaryInstanceState returns the primary instance state for the
+// given resource name in a given module path.
+func modulePathPrimaryInstanceState(s *terraform.State, mp []string, name string) (*terraform.InstanceState, error) {
+        ms := s.ModuleByPath(mp)
+        if ms == nil {
+                return nil, fmt.Errorf("No module found at: %s", mp)
+        }
+
+        return modulePrimaryInstanceState(s, ms, name)
+}
+
+// primaryInstanceState returns the primary instance state for the given
+// resource name in the root module.
+func primaryInstanceState(s *terraform.State, name string) (*terraform.InstanceState, error) {
+        ms := s.RootModule()
+        return modulePrimaryInstanceState(s, ms, name)
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go b/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go
index 537a11c..033f126 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go
@@ -1,10 +1,12 @@
 package resource
 
 import (
+        "errors"
         "fmt"
         "log"
         "strings"
 
+        "github.com/hashicorp/errwrap"
         "github.com/hashicorp/terraform/terraform"
 )
 
@@ -20,6 +22,14 @@ func testStep(
         opts terraform.ContextOpts,
         state *terraform.State,
         step TestStep) (*terraform.State, error) {
+        // Pre-taint any resources that have been defined in Taint, as long as this
+        // is not a destroy step.
+        if !step.Destroy {
+                if err := testStepTaint(state, step); err != nil {
+                        return state, err
+                }
+        }
+
         mod, err := testModule(opts, step)
         if err != nil {
                 return state, err
@@ -33,17 +43,12 @@ func testStep(
         if err != nil {
                 return state, fmt.Errorf("Error initializing context: %s", err)
         }
-        if ws, es := ctx.Validate(); len(ws) > 0 || len(es) > 0 {
-                if len(es) > 0 {
-                        estrs := make([]string, len(es))
-                        for i, e := range es {
-                                estrs[i] = e.Error()
-                        }
-                        return state, fmt.Errorf(
-                                "Configuration is invalid.\n\nWarnings: %#v\n\nErrors: %#v",
-                                ws, estrs)
+        if diags := ctx.Validate(); len(diags) > 0 {
+                if diags.HasErrors() {
+                        return nil, errwrap.Wrapf("config is invalid: {{err}}", diags.Err())
                 }
-                log.Printf("[WARN] Config warnings: %#v", ws)
+
+                log.Printf("[WARN] Config warnings:\n%s", diags)
         }
 
         // Refresh!
@@ -158,3 +163,19 @@ func testStep(
         // Made it here? Good job test step!
         return state, nil
 }
+
+func testStepTaint(state *terraform.State, step TestStep) error {
+        for _, p := range step.Taint {
+                m := state.RootModule()
+                if m == nil {
+                        return errors.New("no state")
+                }
+                rs, ok := m.Resources[p]
+                if !ok {
+                        return fmt.Errorf("resource %q not found in state", p)
+                }
+                log.Printf("[WARN] Test: Explicitly tainting resource %q", p)
+                rs.Taint()
+        }
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go b/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go
index 28ad105..94fef3c 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go
@@ -16,15 +16,24 @@ func testStepImportState(
         state *terraform.State,
         step TestStep) (*terraform.State, error) {
         // Determine the ID to import
-        importId := step.ImportStateId
-        if importId == "" {
+        var importId string
+        switch {
+        case step.ImportStateIdFunc != nil:
+                var err error
+                importId, err = step.ImportStateIdFunc(state)
+                if err != nil {
+                        return state, err
+                }
+        case step.ImportStateId != "":
+                importId = step.ImportStateId
+        default:
                 resource, err := testResource(step, state)
                 if err != nil {
                         return state, err
                 }
-
                 importId = resource.Primary.ID
         }
+
         importPrefix := step.ImportStateIdPrefix
         if importPrefix != "" {
                 importId = fmt.Sprintf("%s%s", importPrefix, importId)
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/wait.go b/vendor/github.com/hashicorp/terraform/helper/resource/wait.go
index ca50e29..e56a515 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/wait.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/wait.go
@@ -74,7 +74,7 @@ func RetryableError(err error) *RetryError {
         return &RetryError{Err: err, Retryable: true}
 }
 
-// NonRetryableError is a helper to create a RetryError that's _not)_ retryable
+// NonRetryableError is a helper to create a RetryError that's _not_ retryable
 // from a given error.
 func NonRetryableError(err error) *RetryError {
         if err == nil {
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/backend.go b/vendor/github.com/hashicorp/terraform/helper/schema/backend.go
index a0729c0..57fbba7 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/backend.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/backend.go
@@ -65,7 +65,7 @@ func (b *Backend) Configure(c *terraform.ResourceConfig) error {
 
         // Get a ResourceData for this configuration. To do this, we actually
         // generate an intermediary "diff" although that is never exposed.
-        diff, err := sm.Diff(nil, c)
+        diff, err := sm.Diff(nil, c, nil, nil)
         if err != nil {
                 return err
         }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go b/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go
new file mode 100644
index 0000000..bf952f6
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go
@@ -0,0 +1,155 @@
+package schema
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/config/configschema"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// The functions and methods in this file are concerned with the conversion
+// of this package's schema model into the slightly-lower-level schema model
+// used by Terraform core for configuration parsing.
+
+// CoreConfigSchema lowers the receiver to the schema model expected by
+// Terraform core.
+//
+// This lower-level model has fewer features than the schema in this package,
+// describing only the basic structure of configuration and state values we
+// expect. The full schemaMap from this package is still required for full
+// validation, handling of default values, etc.
+//
+// This method presumes a schema that passes InternalValidate, and so may
+// panic or produce an invalid result if given an invalid schemaMap.
+func (m schemaMap) CoreConfigSchema() *configschema.Block {
+        if len(m) == 0 {
+                // We return an actual (empty) object here, rather than a nil,
+                // because a nil result would mean that we don't have a schema at
+                // all, rather than that we have an empty one.
+                return &configschema.Block{}
+        }
+
+        ret := &configschema.Block{
+                Attributes: map[string]*configschema.Attribute{},
+                BlockTypes: map[string]*configschema.NestedBlock{},
+        }
+
+        for name, schema := range m {
+                if schema.Elem == nil {
+                        ret.Attributes[name] = schema.coreConfigSchemaAttribute()
+                        continue
+                }
+                switch schema.Elem.(type) {
+                case *Schema:
+                        ret.Attributes[name] = schema.coreConfigSchemaAttribute()
+                case *Resource:
+                        ret.BlockTypes[name] = schema.coreConfigSchemaBlock()
+                default:
+                        // Should never happen for a valid schema
+                        panic(fmt.Errorf("invalid Schema.Elem %#v; need *Schema or *Resource", schema.Elem))
+                }
+        }
+
+        return ret
+}
+
+// coreConfigSchemaAttribute prepares a configschema.Attribute representation
+// of a schema. This is appropriate only for primitives or collections whose
+// Elem is an instance of Schema. Use coreConfigSchemaBlock for collections
+// whose elem is a whole resource.
+func (s *Schema) coreConfigSchemaAttribute() *configschema.Attribute {
+        return &configschema.Attribute{
+                Type:      s.coreConfigSchemaType(),
+                Optional:  s.Optional,
+                Required:  s.Required,
+                Computed:  s.Computed,
+                Sensitive: s.Sensitive,
+        }
+}
+
+// coreConfigSchemaBlock prepares a configschema.NestedBlock representation of
+// a schema. This is appropriate only for collections whose Elem is an instance
+// of Resource, and will panic otherwise.
+func (s *Schema) coreConfigSchemaBlock() *configschema.NestedBlock {
+        ret := &configschema.NestedBlock{}
+        if nested := s.Elem.(*Resource).CoreConfigSchema(); nested != nil {
+                ret.Block = *nested
+        }
+        switch s.Type {
+        case TypeList:
+                ret.Nesting = configschema.NestingList
+        case TypeSet:
+                ret.Nesting = configschema.NestingSet
+        case TypeMap:
+                ret.Nesting = configschema.NestingMap
+        default:
+                // Should never happen for a valid schema
+                panic(fmt.Errorf("invalid s.Type %s for s.Elem being resource", s.Type))
+        }
+
+        ret.MinItems = s.MinItems
+        ret.MaxItems = s.MaxItems
+
+        if s.Required && s.MinItems == 0 {
+                // configschema doesn't have a "required" representation for nested
+                // blocks, but we can fake it by requiring at least one item.
+                ret.MinItems = 1
+        }
+
+        return ret
+}
+
+// coreConfigSchemaType determines the core config schema type that corresponds
+// to a particular schema's type.
+func (s *Schema) coreConfigSchemaType() cty.Type {
+        switch s.Type {
+        case TypeString:
+                return cty.String
+        case TypeBool:
+                return cty.Bool
+        case TypeInt, TypeFloat:
+                // configschema doesn't distinguish int and float, so helper/schema
+                // will deal with this as an additional validation step after
+                // configuration has been parsed and decoded.
+                return cty.Number
+        case TypeList, TypeSet, TypeMap:
+                var elemType cty.Type
+                switch set := s.Elem.(type) {
+                case *Schema:
+                        elemType = set.coreConfigSchemaType()
+                case *Resource:
+                        // In practice we don't actually use this for normal schema
+                        // construction because we construct a NestedBlock in that
+                        // case instead. See schemaMap.CoreConfigSchema.
+                        elemType = set.CoreConfigSchema().ImpliedType()
+                default:
+                        if set != nil {
+                                // Should never happen for a valid schema
+                                panic(fmt.Errorf("invalid Schema.Elem %#v; need *Schema or *Resource", s.Elem))
+                        }
+                        // Some pre-existing schemas assume string as default, so we need
+                        // to be compatible with them.
+                        elemType = cty.String
+                }
+                switch s.Type {
+                case TypeList:
+                        return cty.List(elemType)
+                case TypeSet:
+                        return cty.Set(elemType)
+                case TypeMap:
+                        return cty.Map(elemType)
+                default:
+                        // can never get here in practice, due to the case we're inside
+                        panic("invalid collection type")
+                }
+        default:
+                // should never happen for a valid schema
+                panic(fmt.Errorf("invalid Schema.Type %s", s.Type))
+        }
+}
+
+// CoreConfigSchema is a convenient shortcut for calling CoreConfigSchema
+// on the resource's schema.
+func (r *Resource) CoreConfigSchema() *configschema.Block {
+        return schemaMap(r.Schema).CoreConfigSchema()
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/data_source_resource_shim.go b/vendor/github.com/hashicorp/terraform/helper/schema/data_source_resource_shim.go
index 5a03d2d..8d93750 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/data_source_resource_shim.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/data_source_resource_shim.go
@@ -32,7 +32,7 @@ func DataSourceResourceShim(name string, dataSource *Resource) *Resource {
 
         // FIXME: Link to some further docs either on the website or in the
         // changelog, once such a thing exists.
-        dataSource.deprecationMessage = fmt.Sprintf(
+        dataSource.DeprecationMessage = fmt.Sprintf(
                 "using %s as a resource is deprecated; consider using the data source instead",
                 name,
         )
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go
index 1660a67..b80b223 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go
@@ -126,6 +126,8 @@ func addrToSchema(addr []string, schemaMap map[string]*Schema) []*Schema {
                                 switch v := current.Elem.(type) {
                                 case ValueType:
                                         current = &Schema{Type: v}
+                                case *Schema:
+                                        current, _ = current.Elem.(*Schema)
                                 default:
                                         // maps default to string values. This is all we can have
                                         // if this is nested in another list or map.
@@ -249,11 +251,10 @@ func readObjectField(
 }
 
 // convert map values to the proper primitive type based on schema.Elem
-func mapValuesToPrimitive(m map[string]interface{}, schema *Schema) error {
-
-        elemType := TypeString
-        if et, ok := schema.Elem.(ValueType); ok {
-                elemType = et
+func mapValuesToPrimitive(k string, m map[string]interface{}, schema *Schema) error {
+        elemType, err := getValueType(k, schema)
+        if err != nil {
+                return err
         }
 
         switch elemType {
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go
index f958bbc..55a301d 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go
@@ -206,7 +206,7 @@ func (r *ConfigFieldReader) readMap(k string, schema *Schema) (FieldReadResult,
                 panic(fmt.Sprintf("unknown type: %#v", mraw))
         }
 
-        err := mapValuesToPrimitive(result, schema)
+        err := mapValuesToPrimitive(k, result, schema)
         if err != nil {
                 return FieldReadResult{}, nil
         }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go
index 16bbae2..d558a5b 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go
@@ -29,29 +29,59 @@ type DiffFieldReader struct {
         Diff   *terraform.InstanceDiff
         Source FieldReader
         Schema map[string]*Schema
+
+        // cache for memoizing ReadField calls.
+        cache map[string]cachedFieldReadResult
+}
+
+type cachedFieldReadResult struct {
+        val FieldReadResult
+        err error
 }
 
 func (r *DiffFieldReader) ReadField(address []string) (FieldReadResult, error) {
+        if r.cache == nil {
+                r.cache = make(map[string]cachedFieldReadResult)
+        }
+
+        // Create the cache key by joining around a value that isn't a valid part
+        // of an address. This assumes that the Source and Schema are not changed
+        // for the life of this DiffFieldReader.
+        cacheKey := strings.Join(address, "|")
+        if cached, ok := r.cache[cacheKey]; ok {
+                return cached.val, cached.err
+        }
+
         schemaList := addrToSchema(address, r.Schema)
         if len(schemaList) == 0 {
+                r.cache[cacheKey] = cachedFieldReadResult{}
                 return FieldReadResult{}, nil
         }
 
+        var res FieldReadResult
+        var err error
+
         schema := schemaList[len(schemaList)-1]
         switch schema.Type {
         case TypeBool, TypeInt, TypeFloat, TypeString:
-                return r.readPrimitive(address, schema)
+                res, err = r.readPrimitive(address, schema)
         case TypeList:
-                return readListField(r, address, schema)
+                res, err = readListField(r, address, schema)
         case TypeMap:
-                return r.readMap(address, schema)
+                res, err = r.readMap(address, schema)
         case TypeSet:
-                return r.readSet(address, schema)
+                res, err = r.readSet(address, schema)
         case typeObject:
-                return readObjectField(r, address, schema.Elem.(map[string]*Schema))
+                res, err = readObjectField(r, address, schema.Elem.(map[string]*Schema))
         default:
                 panic(fmt.Sprintf("Unknown type: %#v", schema.Type))
         }
+
+        r.cache[cacheKey] = cachedFieldReadResult{
+                val: res,
+                err: err,
+        }
+        return res, err
 }
 
 func (r *DiffFieldReader) readMap(
@@ -92,7 +122,8 @@ func (r *DiffFieldReader) readMap(
                 result[k] = v.New
         }
 
-        err = mapValuesToPrimitive(result, schema)
+        key := address[len(address)-1]
+        err = mapValuesToPrimitive(key, result, schema)
         if err != nil {
                 return FieldReadResult{}, nil
         }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go
index 9533981..054efe0 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go
@@ -61,7 +61,7 @@ func (r *MapFieldReader) readMap(k string, schema *Schema) (FieldReadResult, err
                 return true
         })
 
-        err := mapValuesToPrimitive(result, schema)
+        err := mapValuesToPrimitive(k, result, schema)
         if err != nil {
                 return FieldReadResult{}, nil
         }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go
index 689ed8d..814c7ba 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go
@@ -39,6 +39,19 @@ func (w *MapFieldWriter) unsafeWriteField(addr string, value string) {
         w.result[addr] = value
 }
 
+// clearTree clears a field and any sub-fields of the given address out of the
+// map. This should be used to reset some kind of complex structures (namely
+// sets) before writing to make sure that any conflicting data is removed (for
+// example, if the set was previously written to the writer's layer).
+func (w *MapFieldWriter) clearTree(addr []string) {
+        prefix := strings.Join(addr, ".") + "."
+        for k := range w.result {
+                if strings.HasPrefix(k, prefix) {
+                        delete(w.result, k)
+                }
+        }
+}
+
 func (w *MapFieldWriter) WriteField(addr []string, value interface{}) error {
         w.lock.Lock()
         defer w.lock.Unlock()
@@ -115,6 +128,14 @@ func (w *MapFieldWriter) setList(
                 return fmt.Errorf("%s: %s", k, err)
         }
 
+        // Wipe the set from the current writer prior to writing if it exists.
+        // Multiple writes to the same layer is a lot safer for lists than sets due
+        // to the fact that indexes are always deterministic and the length will
+        // always be updated with the current length on the last write, but making
+        // sure we have a clean namespace removes any chance for edge cases to pop up
+        // and ensures that the last write to the set is the correct value.
+        w.clearTree(addr)
+
         // Set the entire list.
         var err error
         for i, elem := range vs {
@@ -162,6 +183,10 @@ func (w *MapFieldWriter) setMap(
                 vs[mk.String()] = mv.Interface()
         }
 
+        // Wipe this address tree. The contents of the map should always reflect the
+        // last write made to it.
+        w.clearTree(addr)
+
         // Remove the pure key since we're setting the full map value
         delete(w.result, k)
 
@@ -308,6 +333,13 @@ func (w *MapFieldWriter) setSet(
                 value = s
         }
 
+        // Clear any keys that match the set address first. This is necessary because
+        // it's always possible and sometimes may be necessary to write to a certain
+        // writer layer more than once with different set data each time, which will
+        // lead to different keys being inserted, which can lead to determinism
+        // problems when the old data isn't wiped first.
+        w.clearTree(addr)
+
         for code, elem := range value.(*Set).m {
                 if err := w.set(append(addrCopy, code), elem); err != nil {
                         return err
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go b/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go
index 3a97629..38cd8c7 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go
@@ -2,7 +2,7 @@
 
 package schema
 
-import "fmt"
+import "strconv"
 
 const (
         _getSource_name_0 = "getSourceStategetSourceConfig"
@@ -13,8 +13,6 @@ const (
 
 var (
         _getSource_index_0 = [...]uint8{0, 14, 29}
-        _getSource_index_1 = [...]uint8{0, 13}
-        _getSource_index_2 = [...]uint8{0, 12}
         _getSource_index_3 = [...]uint8{0, 18, 32}
 )
 
@@ -31,6 +29,6 @@ func (i getSource) String() string {
                 i -= 15
                 return _getSource_name_3[_getSource_index_3[i]:_getSource_index_3[i+1]]
         default:
-                return fmt.Sprintf("getSource(%d)", i)
+                return "getSource(" + strconv.FormatInt(int64(i), 10) + ")"
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/provider.go b/vendor/github.com/hashicorp/terraform/helper/schema/provider.go
index fb28b41..6cd325d 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/provider.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/provider.go
@@ -9,6 +9,7 @@ import (
 
         "github.com/hashicorp/go-multierror"
         "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/config/configschema"
         "github.com/hashicorp/terraform/terraform"
 )
 
@@ -58,7 +59,7 @@ type Provider struct {
 
         meta interface{}
 
-        // a mutex is required because TestReset can directly repalce the stopCtx
+        // a mutex is required because TestReset can directly replace the stopCtx
         stopMu        sync.Mutex
         stopCtx       context.Context
         stopCtxCancel context.CancelFunc
@@ -185,6 +186,29 @@ func (p *Provider) TestReset() error {
         return nil
 }
 
+// GetSchema implementation of terraform.ResourceProvider interface
+func (p *Provider) GetSchema(req *terraform.ProviderSchemaRequest) (*terraform.ProviderSchema, error) {
+        resourceTypes := map[string]*configschema.Block{}
+        dataSources := map[string]*configschema.Block{}
+
+        for _, name := range req.ResourceTypes {
+                if r, exists := p.ResourcesMap[name]; exists {
+                        resourceTypes[name] = r.CoreConfigSchema()
+                }
+        }
+        for _, name := range req.DataSources {
+                if r, exists := p.DataSourcesMap[name]; exists {
+                        dataSources[name] = r.CoreConfigSchema()
+                }
+        }
+
+        return &terraform.ProviderSchema{
+                Provider:      schemaMap(p.Schema).CoreConfigSchema(),
+                ResourceTypes: resourceTypes,
+                DataSources:   dataSources,
+        }, nil
+}
+
 // Input implementation of terraform.ResourceProvider interface.
 func (p *Provider) Input(
         input terraform.UIInput,
@@ -227,7 +251,7 @@ func (p *Provider) Configure(c *terraform.ResourceConfig) error {
 
         // Get a ResourceData for this configuration. To do this, we actually
         // generate an intermediary "diff" although that is never exposed.
-        diff, err := sm.Diff(nil, c)
+        diff, err := sm.Diff(nil, c, nil, p.meta)
         if err != nil {
                 return err
         }
@@ -269,7 +293,7 @@ func (p *Provider) Diff(
                 return nil, fmt.Errorf("unknown resource type: %s", info.Type)
         }
 
-        return r.Diff(s, c)
+        return r.Diff(s, c, p.meta)
 }
 
 // Refresh implementation of terraform.ResourceProvider interface.
@@ -305,6 +329,10 @@ func (p *Provider) Resources() []terraform.ResourceType {
                 result = append(result, terraform.ResourceType{
                         Name:       k,
                         Importable: resource.Importer != nil,
+
+                        // Indicates that a provider is compiled against a new enough
+                        // version of core to support the GetSchema method.
+                        SchemaAvailable: true,
                 })
         }
 
@@ -382,7 +410,7 @@ func (p *Provider) ReadDataDiff(
                 return nil, fmt.Errorf("unknown data source: %s", info.Type)
         }
 
-        return r.Diff(nil, c)
+        return r.Diff(nil, c, p.meta)
 }
 
 // RefreshData implementation of terraform.ResourceProvider interface.
@@ -410,6 +438,10 @@ func (p *Provider) DataSources() []terraform.DataSource {
         for _, k := range keys {
                 result = append(result, terraform.DataSource{
                         Name: k,
+
+                        // Indicates that a provider is compiled against a new enough
+                        // version of core to support the GetSchema method.
+                        SchemaAvailable: true,
                 })
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go b/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go
index 476192e..a8d42db 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go
@@ -146,7 +146,7 @@ func (p *Provisioner) Apply(
                 }
 
                 sm := schemaMap(p.ConnSchema)
-                diff, err := sm.Diff(nil, terraform.NewResourceConfig(c))
+                diff, err := sm.Diff(nil, terraform.NewResourceConfig(c), nil, nil)
                 if err != nil {
                         return err
                 }
@@ -160,7 +160,7 @@ func (p *Provisioner) Apply(
                 // Build the configuration data. Doing this requires making a "diff"
                 // even though that's never used. We use that just to get the correct types.
                 configMap := schemaMap(p.Schema)
-                diff, err := configMap.Diff(nil, c)
+                diff, err := configMap.Diff(nil, c, nil, nil)
                 if err != nil {
                         return err
                 }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
index ddba109..d3be2d6 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
@@ -85,6 +85,37 @@ type Resource struct {
         Delete DeleteFunc
         Exists ExistsFunc
 
+        // CustomizeDiff is a custom function for working with the diff that
+        // Terraform has created for this resource - it can be used to customize the
+        // diff that has been created, diff values not controlled by configuration,
+        // or even veto the diff altogether and abort the plan. It is passed a
+        // *ResourceDiff, a structure similar to ResourceData but lacking most write
+        // functions like Set, while introducing new functions that work with the
+        // diff such as SetNew, SetNewComputed, and ForceNew.
+        //
+        // The phases Terraform runs this in, and the state available via functions
+        // like Get and GetChange, are as follows:
+        //
+        //  * New resource: One run with no state
+        //  * Existing resource: One run with state
+        //   * Existing resource, forced new: One run with state (before ForceNew),
+        //     then one run without state (as if new resource)
+        //  * Tainted resource: No runs (custom diff logic is skipped)
+        //  * Destroy: No runs (standard diff logic is skipped on destroy diffs)
+        //
+        // This function needs to be resilient to support all scenarios.
+        //
+        // If this function needs to access external API resources, remember to flag
+        // the RequiresRefresh attribute mentioned below to ensure that
+        // -refresh=false is blocked when running plan or apply, as this means that
+        // this resource requires refresh-like behaviour to work effectively.
+        //
+        // For the most part, only computed fields can be customized by this
+        // function.
+        //
+        // This function is only allowed on regular resources (not data sources).
+        CustomizeDiff CustomizeDiffFunc
+
         // Importer is the ResourceImporter implementation for this resource.
         // If this is nil, then this resource does not support importing. If
         // this is non-nil, then it supports importing and ResourceImporter
@@ -93,9 +124,7 @@ type Resource struct {
         Importer *ResourceImporter
 
         // If non-empty, this string is emitted as a warning during Validate.
-        // This is a private interface for now, for use by DataSourceResourceShim,
-        // and not for general use. (But maybe later...)
-        deprecationMessage string
+        DeprecationMessage string
 
         // Timeouts allow users to specify specific time durations in which an
         // operation should time out, to allow them to extend an action to suit their
@@ -126,6 +155,9 @@ type ExistsFunc func(*ResourceData, interface{}) (bool, error)
 type StateMigrateFunc func(
         int, *terraform.InstanceState, interface{}) (*terraform.InstanceState, error)
 
+// See Resource documentation.
+type CustomizeDiffFunc func(*ResourceDiff, interface{}) error
+
 // Apply creates, updates, and/or deletes a resource.
 func (r *Resource) Apply(
         s *terraform.InstanceState,
@@ -202,11 +234,11 @@ func (r *Resource) Apply(
         return r.recordCurrentSchemaVersion(data.State()), err
 }
 
-// Diff returns a diff of this resource and is API compatible with the
-// ResourceProvider interface.
+// Diff returns a diff of this resource.
 func (r *Resource) Diff(
         s *terraform.InstanceState,
-        c *terraform.ResourceConfig) (*terraform.InstanceDiff, error) {
+        c *terraform.ResourceConfig,
+        meta interface{}) (*terraform.InstanceDiff, error) {
 
         t := &ResourceTimeout{}
         err := t.ConfigDecode(r, c)
@@ -215,7 +247,7 @@ func (r *Resource) Diff(
                 return nil, fmt.Errorf("[ERR] Error decoding timeout: %s", err)
         }
 
-        instanceDiff, err := schemaMap(r.Schema).Diff(s, c)
+        instanceDiff, err := schemaMap(r.Schema).Diff(s, c, r.CustomizeDiff, meta)
         if err != nil {
                 return instanceDiff, err
         }
@@ -235,8 +267,8 @@ func (r *Resource) Diff(
 func (r *Resource) Validate(c *terraform.ResourceConfig) ([]string, []error) {
         warns, errs := schemaMap(r.Schema).Validate(c)
 
-        if r.deprecationMessage != "" {
-                warns = append(warns, r.deprecationMessage)
+        if r.DeprecationMessage != "" {
+                warns = append(warns, r.DeprecationMessage)
         }
 
         return warns, errs
@@ -248,7 +280,6 @@ func (r *Resource) ReadDataApply(
         d *terraform.InstanceDiff,
         meta interface{},
 ) (*terraform.InstanceState, error) {
-
         // Data sources are always built completely from scratch
         // on each read, so the source state is always nil.
         data, err := schemaMap(r.Schema).Data(nil, d)
@@ -346,6 +377,11 @@ func (r *Resource) InternalValidate(topSchemaMap schemaMap, writable bool) error
                 if r.Create != nil || r.Update != nil || r.Delete != nil {
                         return fmt.Errorf("must not implement Create, Update or Delete")
                 }
+
+                // CustomizeDiff cannot be defined for read-only resources
+                if r.CustomizeDiff != nil {
+                        return fmt.Errorf("cannot implement CustomizeDiff")
+                }
         }
 
         tsm := topSchemaMap
@@ -393,19 +429,43 @@ func (r *Resource) InternalValidate(topSchemaMap schemaMap, writable bool) error
                                 return err
                         }
                 }
+
+                for k, f := range tsm {
+                        if isReservedResourceFieldName(k, f) {
+                                return fmt.Errorf("%s is a reserved field name", k)
+                        }
+                }
         }
 
-        // Resource-specific checks
-        for k, _ := range tsm {
-                if isReservedResourceFieldName(k) {
-                        return fmt.Errorf("%s is a reserved field name for a resource", k)
+        // Data source
+        if r.isTopLevel() && !writable {
+                tsm = schemaMap(r.Schema)
+                for k, _ := range tsm {
+                        if isReservedDataSourceFieldName(k) {
+                                return fmt.Errorf("%s is a reserved field name", k)
+                        }
                 }
         }
 
         return schemaMap(r.Schema).InternalValidate(tsm)
 }
 
-func isReservedResourceFieldName(name string) bool {
+func isReservedDataSourceFieldName(name string) bool {
+        for _, reservedName := range config.ReservedDataSourceFields {
+                if name == reservedName {
+                        return true
+                }
+        }
+        return false
+}
+
+func isReservedResourceFieldName(name string, s *Schema) bool {
+        // Allow phasing out "id"
+        // See https://github.com/terraform-providers/terraform-provider-aws/pull/1626#issuecomment-328881415
+        if name == "id" && (s.Deprecated != "" || s.Removed != "") {
+                return false
+        }
+
         for _, reservedName := range config.ReservedResourceFields {
                 if name == reservedName {
                         return true
@@ -430,6 +490,12 @@ func (r *Resource) Data(s *terraform.InstanceState) *ResourceData {
                 panic(err)
         }
 
+        // load the Resource timeouts
+        result.timeouts = r.Timeouts
+        if result.timeouts == nil {
+                result.timeouts = &ResourceTimeout{}
+        }
+
         // Set the schema version to latest by default
         result.meta = map[string]interface{}{
                 "schema_version": strconv.Itoa(r.SchemaVersion),
@@ -450,7 +516,7 @@ func (r *Resource) TestResourceData() *ResourceData {
 // Returns true if the resource is "top level" i.e. not a sub-resource.
 func (r *Resource) isTopLevel() bool {
         // TODO: This is a heuristic; replace with a definitive attribute?
-        return r.Create != nil
+        return (r.Create != nil || r.Read != nil)
 }
 
 // Determines if a given InstanceState needs to be migrated by checking the
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go
index b2bc8f6..6cc01ee 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go
@@ -35,6 +35,8 @@ type ResourceData struct {
         partialMap  map[string]struct{}
         once        sync.Once
         isNew       bool
+
+        panicOnError bool
 }
 
 // getResult is the internal structure that is generated when a Get
@@ -104,6 +106,22 @@ func (d *ResourceData) GetOk(key string) (interface{}, bool) {
         return r.Value, exists
 }
 
+// GetOkExists returns the data for a given key and whether or not the key
+// has been set to a non-zero value. This is only useful for determining
+// if boolean attributes have been set, if they are Optional but do not
+// have a Default value.
+//
+// This is nearly the same function as GetOk, yet it does not check
+// for the zero value of the attribute's type. This allows for attributes
+// without a default, to fully check for a literal assignment, regardless
+// of the zero-value for that type.
+// This should only be used if absolutely required/needed.
+func (d *ResourceData) GetOkExists(key string) (interface{}, bool) {
+        r := d.getRaw(key, getSourceSet)
+        exists := r.Exists && !r.Computed
+        return r.Value, exists
+}
+
 func (d *ResourceData) getRaw(key string, level getSource) getResult {
         var parts []string
         if key != "" {
@@ -168,7 +186,11 @@ func (d *ResourceData) Set(key string, value interface{}) error {
                 }
         }
 
-        return d.setWriter.WriteField(strings.Split(key, "."), value)
+        err := d.setWriter.WriteField(strings.Split(key, "."), value)
+        if err != nil && d.panicOnError {
+                panic(err)
+        }
+        return err
 }
 
 // SetPartial adds the key to the final state output while
@@ -293,6 +315,7 @@ func (d *ResourceData) State() *terraform.InstanceState {
 
         mapW := &MapFieldWriter{Schema: d.schema}
         if err := mapW.WriteField(nil, rawMap); err != nil {
+                log.Printf("[ERR] Error writing fields: %s", err)
                 return nil
         }
 
@@ -344,6 +367,13 @@ func (d *ResourceData) State() *terraform.InstanceState {
 func (d *ResourceData) Timeout(key string) time.Duration {
         key = strings.ToLower(key)
 
+        // System default of 20 minutes
+        defaultTimeout := 20 * time.Minute
+
+        if d.timeouts == nil {
+                return defaultTimeout
+        }
+
         var timeout *time.Duration
         switch key {
         case TimeoutCreate:
@@ -364,8 +394,7 @@ func (d *ResourceData) Timeout(key string) time.Duration {
                 return *d.timeouts.Default
         }
 
-        // Return system default of 20 minutes
-        return 20 * time.Minute
+        return defaultTimeout
 }
 
 func (d *ResourceData) init() {
@@ -423,7 +452,7 @@ func (d *ResourceData) init() {
 }
 
 func (d *ResourceData) diffChange(
-        k string) (interface{}, interface{}, bool, bool) {
+        k string) (interface{}, interface{}, bool, bool, bool) {
         // Get the change between the state and the config.
         o, n := d.getChange(k, getSourceState, getSourceConfig|getSourceExact)
         if !o.Exists {
@@ -434,7 +463,7 @@ func (d *ResourceData) diffChange(
         }
 
         // Return the old, new, and whether there is a change
-        return o.Value, n.Value, !reflect.DeepEqual(o.Value, n.Value), n.Computed
+        return o.Value, n.Value, !reflect.DeepEqual(o.Value, n.Value), n.Computed, false
 }
 
 func (d *ResourceData) getChange(
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go
new file mode 100644
index 0000000..7db3dec
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go
@@ -0,0 +1,559 @@
+package schema
+
+import (
+        "errors"
+        "fmt"
+        "reflect"
+        "strings"
+        "sync"
+
+        "github.com/hashicorp/terraform/terraform"
+)
+
+// newValueWriter is a minor re-implementation of MapFieldWriter to include
+// keys that should be marked as computed, to represent the new part of a
+// pseudo-diff.
+type newValueWriter struct {
+        *MapFieldWriter
+
+        // A list of keys that should be marked as computed.
+        computedKeys map[string]bool
+
+        // A lock to prevent races on writes. The underlying writer will have one as
+        // well - this is for computed keys.
+        lock sync.Mutex
+
+        // To be used with init.
+        once sync.Once
+}
+
+// init performs any initialization tasks for the newValueWriter.
+func (w *newValueWriter) init() {
+        if w.computedKeys == nil {
+                w.computedKeys = make(map[string]bool)
+        }
+}
+
+// WriteField overrides MapValueWriter's WriteField, adding the ability to flag
+// the address as computed.
+func (w *newValueWriter) WriteField(address []string, value interface{}, computed bool) error {
+        // Fail the write if we have a non-nil value and computed is true.
+        // NewComputed values should not have a value when written.
+        if value != nil && computed {
+                return errors.New("Non-nil value with computed set")
+        }
+
+        if err := w.MapFieldWriter.WriteField(address, value); err != nil {
+                return err
+        }
+
+        w.once.Do(w.init)
+
+        w.lock.Lock()
+        defer w.lock.Unlock()
+        if computed {
+                w.computedKeys[strings.Join(address, ".")] = true
+        }
+        return nil
+}
+
+// ComputedKeysMap returns the underlying computed keys map.
+func (w *newValueWriter) ComputedKeysMap() map[string]bool {
+        w.once.Do(w.init)
+        return w.computedKeys
+}
+
+// newValueReader is a minor re-implementation of MapFieldReader and is the
+// read counterpart to MapValueWriter, allowing the read of keys flagged as
+// computed to accommodate the diff override logic in ResourceDiff.
+type newValueReader struct {
+        *MapFieldReader
+
+        // The list of computed keys from a newValueWriter.
+        computedKeys map[string]bool
+}
+
+// ReadField reads the values from the underlying writer, returning the
+// computed value if it is found as well.
+func (r *newValueReader) ReadField(address []string) (FieldReadResult, error) {
+        addrKey := strings.Join(address, ".")
+        v, err := r.MapFieldReader.ReadField(address)
+        if err != nil {
+                return FieldReadResult{}, err
+        }
+        for computedKey := range r.computedKeys {
+                if childAddrOf(addrKey, computedKey) {
+                        if strings.HasSuffix(addrKey, ".#") {
+                                // This is a count value for a list or set that has been marked as
+                                // computed, or a sub-list/sub-set of a complex resource that has
+                                // been marked as computed.  We need to pass through to other readers
+                                // so that an accurate previous count can be fetched for the diff.
+                                v.Exists = false
+                        }
+                        v.Computed = true
+                }
+        }
+
+        return v, nil
+}
+
+// ResourceDiff is used to query and make custom changes to an in-flight diff.
+// It can be used to veto particular changes in the diff, customize the diff
+// that has been created, or diff values not controlled by config.
+//
+// The object functions similar to ResourceData, however most notably lacks
+// Set, SetPartial, and Partial, as it should be used to change diff values
+// only.  Most other first-class ResourceData functions exist, namely Get,
+// GetOk, HasChange, and GetChange exist.
+//
+// All functions in ResourceDiff, save for ForceNew, can only be used on
+// computed fields.
+type ResourceDiff struct {
+        // The schema for the resource being worked on.
+        schema map[string]*Schema
+
+        // The current config for this resource.
+        config *terraform.ResourceConfig
+
+        // The state for this resource as it exists post-refresh, after the initial
+        // diff.
+        state *terraform.InstanceState
+
+        // The diff created by Terraform. This diff is used, along with state,
+        // config, and custom-set diff data, to provide a multi-level reader
+        // experience similar to ResourceData.
+        diff *terraform.InstanceDiff
+
+        // The internal reader structure that contains the state, config, the default
+        // diff, and the new diff.
+        multiReader *MultiLevelFieldReader
+
+        // A writer that writes overridden new fields.
+        newWriter *newValueWriter
+
+        // Tracks which keys have been updated by ResourceDiff to ensure that the
+        // diff does not get re-run on keys that were not touched, or diffs that were
+        // just removed (re-running on the latter would just roll back the removal).
+        updatedKeys map[string]bool
+
+        // Tracks which keys were flagged as forceNew. These keys are not saved in
+        // newWriter, but we need to track them so that they can be re-diffed later.
+        forcedNewKeys map[string]bool
+}
+
+// newResourceDiff creates a new ResourceDiff instance.
+func newResourceDiff(schema map[string]*Schema, config *terraform.ResourceConfig, state *terraform.InstanceState, diff *terraform.InstanceDiff) *ResourceDiff {
+        d := &ResourceDiff{
+                config: config,
+                state:  state,
+                diff:   diff,
+                schema: schema,
+        }
+
+        d.newWriter = &newValueWriter{
+                MapFieldWriter: &MapFieldWriter{Schema: d.schema},
+        }
+        readers := make(map[string]FieldReader)
+        var stateAttributes map[string]string
+        if d.state != nil {
+                stateAttributes = d.state.Attributes
+                readers["state"] = &MapFieldReader{
+                        Schema: d.schema,
+                        Map:    BasicMapReader(stateAttributes),
+                }
+        }
+        if d.config != nil {
+                readers["config"] = &ConfigFieldReader{
+                        Schema: d.schema,
+                        Config: d.config,
+                }
+        }
+        if d.diff != nil {
+                readers["diff"] = &DiffFieldReader{
+                        Schema: d.schema,
+                        Diff:   d.diff,
+                        Source: &MultiLevelFieldReader{
+                                Levels:  []string{"state", "config"},
+                                Readers: readers,
+                        },
+                }
+        }
+        readers["newDiff"] = &newValueReader{
+                MapFieldReader: &MapFieldReader{
+                        Schema: d.schema,
+                        Map:    BasicMapReader(d.newWriter.Map()),
+                },
+                computedKeys: d.newWriter.ComputedKeysMap(),
+        }
+        d.multiReader = &MultiLevelFieldReader{
+                Levels: []string{
+                        "state",
+                        "config",
+                        "diff",
+                        "newDiff",
+                },
+
+                Readers: readers,
+        }
+
+        d.updatedKeys = make(map[string]bool)
+        d.forcedNewKeys = make(map[string]bool)
+
+        return d
+}
+
+// UpdatedKeys returns the keys that were updated by this ResourceDiff run.
+// These are the only keys that a diff should be re-calculated for.
+//
+// This is the combined result of both keys for which diff values were updated
+// for or cleared, and also keys that were flagged to be re-diffed as a result
+// of ForceNew.
+func (d *ResourceDiff) UpdatedKeys() []string {
+        var s []string
+        for k := range d.updatedKeys {
+                s = append(s, k)
+        }
+        for k := range d.forcedNewKeys {
+                for _, l := range s {
+                        if k == l {
+                                break
+                        }
+                }
+                s = append(s, k)
+        }
+        return s
+}
+
+// Clear wipes the diff for a particular key. It is called by ResourceDiff's
+// functionality to remove any possibility of conflicts, but can be called on
+// its own to just remove a specific key from the diff completely.
+//
+// Note that this does not wipe an override. This function is only allowed on
+// computed keys.
+func (d *ResourceDiff) Clear(key string) error {
+        if err := d.checkKey(key, "Clear", true); err != nil {
+                return err
+        }
+
+        return d.clear(key)
+}
+
+func (d *ResourceDiff) clear(key string) error {
+        // Check the schema to make sure that this key exists first.
+        schemaL := addrToSchema(strings.Split(key, "."), d.schema)
+        if len(schemaL) == 0 {
+                return fmt.Errorf("%s is not a valid key", key)
+        }
+
+        for k := range d.diff.Attributes {
+                if strings.HasPrefix(k, key) {
+                        delete(d.diff.Attributes, k)
+                }
+        }
+        return nil
+}
+
+// GetChangedKeysPrefix helps to implement Resource.CustomizeDiff
+// where we need to act on all nested fields
+// without calling out each one separately
+func (d *ResourceDiff) GetChangedKeysPrefix(prefix string) []string {
+        keys := make([]string, 0)
+        for k := range d.diff.Attributes {
+                if strings.HasPrefix(k, prefix) {
+                        keys = append(keys, k)
+                }
+        }
+        return keys
+}
+
+// diffChange helps to implement resourceDiffer and derives its change values
+// from ResourceDiff's own change data, in addition to existing diff, config, and state.
+func (d *ResourceDiff) diffChange(key string) (interface{}, interface{}, bool, bool, bool) {
+        old, new, customized := d.getChange(key)
+
+        if !old.Exists {
+                old.Value = nil
+        }
+        if !new.Exists || d.removed(key) {
+                new.Value = nil
+        }
+
+        return old.Value, new.Value, !reflect.DeepEqual(old.Value, new.Value), new.Computed, customized
+}
+
+// SetNew is used to set a new diff value for the mentioned key. The value must
+// be correct for the attribute's schema (mostly relevant for maps, lists, and
+// sets). The original value from the state is used as the old value.
+//
+// This function is only allowed on computed attributes.
+func (d *ResourceDiff) SetNew(key string, value interface{}) error {
+        if err := d.checkKey(key, "SetNew", false); err != nil {
+                return err
+        }
+
+        return d.setDiff(key, value, false)
+}
+
+// SetNewComputed functions like SetNew, except that it blanks out a new value
+// and marks it as computed.
+//
+// This function is only allowed on computed attributes.
+func (d *ResourceDiff) SetNewComputed(key string) error {
+        if err := d.checkKey(key, "SetNewComputed", false); err != nil {
+                return err
+        }
+
+        return d.setDiff(key, nil, true)
+}
+
+// setDiff performs common diff setting behaviour.
+func (d *ResourceDiff) setDiff(key string, new interface{}, computed bool) error {
+        if err := d.clear(key); err != nil {
+                return err
+        }
+
+        if err := d.newWriter.WriteField(strings.Split(key, "."), new, computed); err != nil {
+                return fmt.Errorf("Cannot set new diff value for key %s: %s", key, err)
+        }
+
+        d.updatedKeys[key] = true
+
+        return nil
+}
+
+// ForceNew force-flags ForceNew in the schema for a specific key, and
+// re-calculates its diff, effectively causing this attribute to force a new
+// resource.
+//
+// Keep in mind that forcing a new resource will force a second run of the
+// resource's CustomizeDiff function (with a new ResourceDiff) once the current
+// one has completed. This second run is performed without state. This behavior
+// will be the same as if a new resource is being created and is performed to
+// ensure that the diff looks like the diff for a new resource as much as
+// possible. CustomizeDiff should expect such a scenario and act correctly.
+//
+// This function is a no-op/error if there is no diff.
+//
+// Note that the change to schema is permanent for the lifecycle of this
+// specific ResourceDiff instance.
+func (d *ResourceDiff) ForceNew(key string) error {
+        if !d.HasChange(key) {
+                return fmt.Errorf("ForceNew: No changes for %s", key)
+        }
+
+        keyParts := strings.Split(key, ".")
+        var schema *Schema
+        schemaL := addrToSchema(keyParts, d.schema)
+        if len(schemaL) > 0 {
+                schema = schemaL[len(schemaL)-1]
+        } else {
+                return fmt.Errorf("ForceNew: %s is not a valid key", key)
+        }
+
+        schema.ForceNew = true
+
+        // Flag this for a re-diff. Don't save any values to guarantee that existing
+        // diffs aren't messed with, as this gets messy when dealing with complex
+        // structures, zero values, etc.
+        d.forcedNewKeys[keyParts[0]] = true
+
+        return nil
+}
+
+// Get hands off to ResourceData.Get.
+func (d *ResourceDiff) Get(key string) interface{} {
+        r, _ := d.GetOk(key)
+        return r
+}
+
+// GetChange gets the change between the state and diff, checking first to see
+// if a overridden diff exists.
+//
+// This implementation differs from ResourceData's in the way that we first get
+// results from the exact levels for the new diff, then from state and diff as
+// per normal.
+func (d *ResourceDiff) GetChange(key string) (interface{}, interface{}) {
+        old, new, _ := d.getChange(key)
+        return old.Value, new.Value
+}
+
+// GetOk functions the same way as ResourceData.GetOk, but it also checks the
+// new diff levels to provide data consistent with the current state of the
+// customized diff.
+func (d *ResourceDiff) GetOk(key string) (interface{}, bool) {
+        r := d.get(strings.Split(key, "."), "newDiff")
+        exists := r.Exists && !r.Computed
+        if exists {
+                // If it exists, we also want to verify it is not the zero-value.
+                value := r.Value
+                zero := r.Schema.Type.Zero()
+
+                if eq, ok := value.(Equal); ok {
+                        exists = !eq.Equal(zero)
+                } else {
+                        exists = !reflect.DeepEqual(value, zero)
+                }
+        }
+
+        return r.Value, exists
+}
+
+// GetOkExists functions the same way as GetOkExists within ResourceData, but
+// it also checks the new diff levels to provide data consistent with the
+// current state of the customized diff.
+//
+// This is nearly the same function as GetOk, yet it does not check
+// for the zero value of the attribute's type. This allows for attributes
+// without a default, to fully check for a literal assignment, regardless
+// of the zero-value for that type.
+func (d *ResourceDiff) GetOkExists(key string) (interface{}, bool) {
+        r := d.get(strings.Split(key, "."), "newDiff")
+        exists := r.Exists && !r.Computed
+        return r.Value, exists
+}
+
+// NewValueKnown returns true if the new value for the given key is available
+// as its final value at diff time. If the return value is false, this means
+// either the value is based of interpolation that was unavailable at diff
+// time, or that the value was explicitly marked as computed by SetNewComputed.
+func (d *ResourceDiff) NewValueKnown(key string) bool {
+        r := d.get(strings.Split(key, "."), "newDiff")
+        return !r.Computed
+}
+
+// HasChange checks to see if there is a change between state and the diff, or
+// in the overridden diff.
+func (d *ResourceDiff) HasChange(key string) bool {
+        old, new := d.GetChange(key)
+
+        // If the type implements the Equal interface, then call that
+        // instead of just doing a reflect.DeepEqual. An example where this is
+        // needed is *Set
+        if eq, ok := old.(Equal); ok {
+                return !eq.Equal(new)
+        }
+
+        return !reflect.DeepEqual(old, new)
+}
+
+// Id returns the ID of this resource.
+//
+// Note that technically, ID does not change during diffs (it either has
+// already changed in the refresh, or will change on update), hence we do not
+// support updating the ID or fetching it from anything else other than state.
+func (d *ResourceDiff) Id() string {
+        var result string
+
+        if d.state != nil {
+                result = d.state.ID
+        }
+        return result
+}
+
+// getChange gets values from two different levels, designed for use in
+// diffChange, HasChange, and GetChange.
+//
+// This implementation differs from ResourceData's in the way that we first get
+// results from the exact levels for the new diff, then from state and diff as
+// per normal.
+func (d *ResourceDiff) getChange(key string) (getResult, getResult, bool) {
+        old := d.get(strings.Split(key, "."), "state")
+        var new getResult
+        for p := range d.updatedKeys {
+                if childAddrOf(key, p) {
+                        new = d.getExact(strings.Split(key, "."), "newDiff")
+                        return old, new, true
+                }
+        }
+        new = d.get(strings.Split(key, "."), "newDiff")
+        return old, new, false
+}
+
+// removed checks to see if the key is present in the existing, pre-customized
+// diff and if it was marked as NewRemoved.
+func (d *ResourceDiff) removed(k string) bool {
+        diff, ok := d.diff.Attributes[k]
+        if !ok {
+                return false
+        }
+        return diff.NewRemoved
+}
+
+// get performs the appropriate multi-level reader logic for ResourceDiff,
+// starting at source. Refer to newResourceDiff for the level order.
+func (d *ResourceDiff) get(addr []string, source string) getResult {
+        result, err := d.multiReader.ReadFieldMerge(addr, source)
+        if err != nil {
+                panic(err)
+        }
+
+        return d.finalizeResult(addr, result)
+}
+
+// getExact gets an attribute from the exact level referenced by source.
+func (d *ResourceDiff) getExact(addr []string, source string) getResult {
+        result, err := d.multiReader.ReadFieldExact(addr, source)
+        if err != nil {
+                panic(err)
+        }
+
+        return d.finalizeResult(addr, result)
+}
+
+// finalizeResult does some post-processing of the result produced by get and getExact.
+func (d *ResourceDiff) finalizeResult(addr []string, result FieldReadResult) getResult {
+        // If the result doesn't exist, then we set the value to the zero value
+        var schema *Schema
+        if schemaL := addrToSchema(addr, d.schema); len(schemaL) > 0 {
+                schema = schemaL[len(schemaL)-1]
+        }
+
+        if result.Value == nil && schema != nil {
+                result.Value = result.ValueOrZero(schema)
+        }
+
+        // Transform the FieldReadResult into a getResult. It might be worth
+        // merging these two structures one day.
+        return getResult{
+                Value:          result.Value,
+                ValueProcessed: result.ValueProcessed,
+                Computed:       result.Computed,
+                Exists:         result.Exists,
+                Schema:         schema,
+        }
+}
+
+// childAddrOf does a comparison of two addresses to see if one is the child of
+// the other.
+func childAddrOf(child, parent string) bool {
+        cs := strings.Split(child, ".")
+        ps := strings.Split(parent, ".")
+        if len(ps) > len(cs) {
+                return false
+        }
+        return reflect.DeepEqual(ps, cs[:len(ps)])
+}
+
+// checkKey checks the key to make sure it exists and is computed.
+func (d *ResourceDiff) checkKey(key, caller string, nested bool) error {
+        var schema *Schema
+        if nested {
+                keyParts := strings.Split(key, ".")
+                schemaL := addrToSchema(keyParts, d.schema)
+                if len(schemaL) > 0 {
+                        schema = schemaL[len(schemaL)-1]
+                }
+        } else {
+                s, ok := d.schema[key]
+                if ok {
+                        schema = s
+                }
+        }
+        if schema == nil {
+                return fmt.Errorf("%s: invalid key: %s", caller, key)
+        }
+        if !schema.Computed {
+                return fmt.Errorf("%s only operates on computed keys - %s is not one", caller, key)
+        }
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/schema.go b/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
index acb5618..0ea5aad 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
@@ -21,9 +21,13 @@ import (
         "strings"
 
         "github.com/hashicorp/terraform/terraform"
+        "github.com/mitchellh/copystructure"
         "github.com/mitchellh/mapstructure"
 )
 
+// Name of ENV variable which (if not empty) prefers panic over error
+const PanicOnErr = "TF_SCHEMA_PANIC_ON_ERROR"
+
 // type used for schema package context keys
 type contextKey string
 
@@ -116,12 +120,16 @@ type Schema struct {
         ForceNew  bool
         StateFunc SchemaStateFunc
 
-        // The following fields are only set for a TypeList or TypeSet Type.
+        // The following fields are only set for a TypeList, TypeSet, or TypeMap.
         //
-        // Elem must be either a *Schema or a *Resource only if the Type is
-        // TypeList, and represents what the element type is. If it is *Schema,
-        // the element type is just a simple value. If it is *Resource, the
-        // element type is a complex structure, potentially with its own lifecycle.
+        // Elem represents the element type. For a TypeMap, it must be a *Schema
+        // with a Type of TypeString, otherwise it may be either a *Schema or a
+        // *Resource. If it is *Schema, the element type is just a simple value.
+        // If it is *Resource, the element type is a complex structure,
+        // potentially with its own lifecycle.
+        Elem interface{}
+
+        // The following fields are only set for a TypeList or TypeSet.
         //
         // MaxItems defines a maximum amount of items that can exist within a
         // TypeSet or TypeList. Specific use cases would be if a TypeSet is being
@@ -138,7 +146,6 @@ type Schema struct {
         // ["foo"] automatically. This is primarily for legacy reasons and the
         // ambiguity is not recommended for new usage. Promotion is only allowed
         // for primitive element types.
-        Elem          interface{}
         MaxItems      int
         MinItems      int
         PromoteSingle bool
@@ -192,7 +199,7 @@ type Schema struct {
         Sensitive bool
 }
 
-// SchemaDiffSuppresFunc is a function which can be used to determine
+// SchemaDiffSuppressFunc is a function which can be used to determine
 // whether a detected diff on a schema element is "valid" or not, and
 // suppress it from the plan if necessary.
 //
@@ -289,8 +296,7 @@ func (s *Schema) ZeroValue() interface{} {
         }
 }
 
-func (s *Schema) finalizeDiff(
-        d *terraform.ResourceAttrDiff) *terraform.ResourceAttrDiff {
+func (s *Schema) finalizeDiff(d *terraform.ResourceAttrDiff, customized bool) *terraform.ResourceAttrDiff {
         if d == nil {
                 return d
         }
@@ -331,13 +337,20 @@ func (s *Schema) finalizeDiff(
         }
 
         if s.Computed {
-                if d.Old != "" && d.New == "" {
-                        // This is a computed value with an old value set already,
-                        // just let it go.
-                        return nil
+                // FIXME: This is where the customized bool from getChange finally
+                //        comes into play.  It allows the previously incorrect behavior
+                //        of an empty string being used as "unset" when the value is
+                //        computed. This should be removed once we can properly
+                //        represent an unset/nil value from the configuration.
+                if !customized {
+                        if d.Old != "" && d.New == "" {
+                                // This is a computed value with an old value set already,
+                                // just let it go.
+                                return nil
+                        }
                 }
 
-                if d.New == "" {
+                if d.New == "" && !d.NewComputed {
                         // Computed attribute without a new value set
                         d.NewComputed = true
                 }
@@ -354,6 +367,13 @@ func (s *Schema) finalizeDiff(
 // schemaMap is a wrapper that adds nice functions on top of schemas.
 type schemaMap map[string]*Schema
 
+func (m schemaMap) panicOnError() bool {
+        if os.Getenv(PanicOnErr) != "" {
+                return true
+        }
+        return false
+}
+
 // Data returns a ResourceData for the given schema, state, and diff.
 //
 // The diff is optional.
@@ -361,17 +381,30 @@ func (m schemaMap) Data(
         s *terraform.InstanceState,
         d *terraform.InstanceDiff) (*ResourceData, error) {
         return &ResourceData{
-                schema: m,
-                state:  s,
-                diff:   d,
+                schema:       m,
+                state:        s,
+                diff:         d,
+                panicOnError: m.panicOnError(),
         }, nil
 }
 
+// DeepCopy returns a copy of this schemaMap. The copy can be safely modified
+// without affecting the original.
+func (m *schemaMap) DeepCopy() schemaMap {
+        copy, err := copystructure.Config{Lock: true}.Copy(m)
+        if err != nil {
+                panic(err)
+        }
+        return *copy.(*schemaMap)
+}
+
 // Diff returns the diff for a resource given the schema map,
 // state, and configuration.
 func (m schemaMap) Diff(
         s *terraform.InstanceState,
-        c *terraform.ResourceConfig) (*terraform.InstanceDiff, error) {
+        c *terraform.ResourceConfig,
+        customizeDiff CustomizeDiffFunc,
+        meta interface{}) (*terraform.InstanceDiff, error) {
         result := new(terraform.InstanceDiff)
         result.Attributes = make(map[string]*terraform.ResourceAttrDiff)
 
@@ -381,9 +414,10 @@ func (m schemaMap) Diff(
         }
 
         d := &ResourceData{
-                schema: m,
-                state:  s,
-                config: c,
+                schema:       m,
+                state:        s,
+                config:       c,
+                panicOnError: m.panicOnError(),
         }
 
         for k, schema := range m {
@@ -393,6 +427,29 @@ func (m schemaMap) Diff(
                 }
         }
 
+        // Remove any nil diffs just to keep things clean
+        for k, v := range result.Attributes {
+                if v == nil {
+                        delete(result.Attributes, k)
+                }
+        }
+
+        // If this is a non-destroy diff, call any custom diff logic that has been
+        // defined.
+        if !result.DestroyTainted && customizeDiff != nil {
+                mc := m.DeepCopy()
+                rd := newResourceDiff(mc, c, s, result)
+                if err := customizeDiff(rd, meta); err != nil {
+                        return nil, err
+                }
+                for _, k := range rd.UpdatedKeys() {
+                        err := m.diff(k, mc[k], result, rd, false)
+                        if err != nil {
+                                return nil, err
+                        }
+                }
+        }
+
         // If the diff requires a new resource, then we recompute the diff
         // so we have the complete new resource diff, and preserve the
         // RequiresNew fields where necessary so the user knows exactly what
@@ -418,6 +475,21 @@ func (m schemaMap) Diff(
                         }
                 }
 
+                // Re-run customization
+                if !result2.DestroyTainted && customizeDiff != nil {
+                        mc := m.DeepCopy()
+                        rd := newResourceDiff(mc, c, d.state, result2)
+                        if err := customizeDiff(rd, meta); err != nil {
+                                return nil, err
+                        }
+                        for _, k := range rd.UpdatedKeys() {
+                                err := m.diff(k, mc[k], result2, rd, false)
+                                if err != nil {
+                                        return nil, err
+                                }
+                        }
+                }
+
                 // Force all the fields to not force a new since we know what we
                 // want to force new.
                 for k, attr := range result2.Attributes {
@@ -456,13 +528,6 @@ func (m schemaMap) Diff(
                 result = result2
         }
 
-        // Remove any nil diffs just to keep things clean
-        for k, v := range result.Attributes {
-                if v == nil {
-                        delete(result.Attributes, k)
-                }
-        }
-
         // Go through and detect all of the ComputedWhens now that we've
         // finished the diff.
         // TODO
@@ -681,11 +746,23 @@ func isValidFieldName(name string) bool {
         return re.MatchString(name)
 }
 
+// resourceDiffer is an interface that is used by the private diff functions.
+// This helps facilitate diff logic for both ResourceData and ResoureDiff with
+// minimal divergence in code.
+type resourceDiffer interface {
+        diffChange(string) (interface{}, interface{}, bool, bool, bool)
+        Get(string) interface{}
+        GetChange(string) (interface{}, interface{})
+        GetOk(string) (interface{}, bool)
+        HasChange(string) bool
+        Id() string
+}
+
 func (m schemaMap) diff(
         k string,
         schema *Schema,
         diff *terraform.InstanceDiff,
-        d *ResourceData,
+        d resourceDiffer,
         all bool) error {
 
         unsupressedDiff := new(terraform.InstanceDiff)
@@ -706,12 +783,14 @@ func (m schemaMap) diff(
         }
 
         for attrK, attrV := range unsupressedDiff.Attributes {
-                if schema.DiffSuppressFunc != nil &&
-                        attrV != nil &&
-                        schema.DiffSuppressFunc(attrK, attrV.Old, attrV.New, d) {
-                        continue
+                switch rd := d.(type) {
+                case *ResourceData:
+                        if schema.DiffSuppressFunc != nil &&
+                                attrV != nil &&
+                                schema.DiffSuppressFunc(attrK, attrV.Old, attrV.New, rd) {
+                                continue
+                        }
                 }
-
                 diff.Attributes[attrK] = attrV
         }
 
@@ -722,9 +801,9 @@ func (m schemaMap) diffList(
         k string,
         schema *Schema,
         diff *terraform.InstanceDiff,
-        d *ResourceData,
+        d resourceDiffer,
         all bool) error {
-        o, n, _, computedList := d.diffChange(k)
+        o, n, _, computedList, customized := d.diffChange(k)
         if computedList {
                 n = nil
         }
@@ -791,10 +870,13 @@ func (m schemaMap) diffList(
                         oldStr = ""
                 }
 
-                diff.Attributes[k+".#"] = countSchema.finalizeDiff(&terraform.ResourceAttrDiff{
-                        Old: oldStr,
-                        New: newStr,
-                })
+                diff.Attributes[k+".#"] = countSchema.finalizeDiff(
+                        &terraform.ResourceAttrDiff{
+                                Old: oldStr,
+                                New: newStr,
+                        },
+                        customized,
+                )
         }
 
         // Figure out the maximum
@@ -841,13 +923,13 @@ func (m schemaMap) diffMap(
         k string,
         schema *Schema,
         diff *terraform.InstanceDiff,
-        d *ResourceData,
+        d resourceDiffer,
         all bool) error {
         prefix := k + "."
 
         // First get all the values from the state
         var stateMap, configMap map[string]string
-        o, n, _, nComputed := d.diffChange(k)
+        o, n, _, nComputed, customized := d.diffChange(k)
         if err := mapstructure.WeakDecode(o, &stateMap); err != nil {
                 return fmt.Errorf("%s: %s", k, err)
         }
@@ -899,6 +981,7 @@ func (m schemaMap) diffMap(
                                 Old: oldStr,
                                 New: newStr,
                         },
+                        customized,
                 )
         }
 
@@ -916,16 +999,22 @@ func (m schemaMap) diffMap(
                         continue
                 }
 
-                diff.Attributes[prefix+k] = schema.finalizeDiff(&terraform.ResourceAttrDiff{
-                        Old: old,
-                        New: v,
-                })
+                diff.Attributes[prefix+k] = schema.finalizeDiff(
+                        &terraform.ResourceAttrDiff{
+                                Old: old,
+                                New: v,
+                        },
+                        customized,
+                )
         }
         for k, v := range stateMap {
-                diff.Attributes[prefix+k] = schema.finalizeDiff(&terraform.ResourceAttrDiff{
-                        Old:        v,
-                        NewRemoved: true,
-                })
+                diff.Attributes[prefix+k] = schema.finalizeDiff(
+                        &terraform.ResourceAttrDiff{
+                                Old:        v,
+                                NewRemoved: true,
+                        },
+                        customized,
+                )
         }
 
         return nil
@@ -935,10 +1024,10 @@ func (m schemaMap) diffSet(
         k string,
         schema *Schema,
         diff *terraform.InstanceDiff,
-        d *ResourceData,
+        d resourceDiffer,
         all bool) error {
 
-        o, n, _, computedSet := d.diffChange(k)
+        o, n, _, computedSet, customized := d.diffChange(k)
         if computedSet {
                 n = nil
         }
@@ -997,20 +1086,26 @@ func (m schemaMap) diffSet(
                         countStr = ""
                 }
 
-                diff.Attributes[k+".#"] = countSchema.finalizeDiff(&terraform.ResourceAttrDiff{
-                        Old:         countStr,
-                        NewComputed: true,
-                })
+                diff.Attributes[k+".#"] = countSchema.finalizeDiff(
+                        &terraform.ResourceAttrDiff{
+                                Old:         countStr,
+                                NewComputed: true,
+                        },
+                        customized,
+                )
                 return nil
         }
 
         // If the counts are not the same, then record that diff
         changed := oldLen != newLen
         if changed || all {
-                diff.Attributes[k+".#"] = countSchema.finalizeDiff(&terraform.ResourceAttrDiff{
-                        Old: oldStr,
-                        New: newStr,
-                })
+                diff.Attributes[k+".#"] = countSchema.finalizeDiff(
+                        &terraform.ResourceAttrDiff{
+                                Old: oldStr,
+                                New: newStr,
+                        },
+                        customized,
+                )
         }
 
         // Build the list of codes that will make up our set. This is the
@@ -1056,11 +1151,11 @@ func (m schemaMap) diffString(
         k string,
         schema *Schema,
         diff *terraform.InstanceDiff,
-        d *ResourceData,
+        d resourceDiffer,
         all bool) error {
         var originalN interface{}
         var os, ns string
-        o, n, _, computed := d.diffChange(k)
+        o, n, _, computed, customized := d.diffChange(k)
         if schema.StateFunc != nil && n != nil {
                 originalN = n
                 n = schema.StateFunc(n)
@@ -1090,20 +1185,23 @@ func (m schemaMap) diffString(
         }
 
         removed := false
-        if o != nil && n == nil {
+        if o != nil && n == nil && !computed {
                 removed = true
         }
         if removed && schema.Computed {
                 return nil
         }
 
-        diff.Attributes[k] = schema.finalizeDiff(&terraform.ResourceAttrDiff{
-                Old:         os,
-                New:         ns,
-                NewExtra:    originalN,
-                NewRemoved:  removed,
-                NewComputed: computed,
-        })
+        diff.Attributes[k] = schema.finalizeDiff(
+                &terraform.ResourceAttrDiff{
+                        Old:         os,
+                        New:         ns,
+                        NewExtra:    originalN,
+                        NewRemoved:  removed,
+                        NewComputed: computed,
+                },
+                customized,
+        )
 
         return nil
 }
@@ -1172,9 +1270,9 @@ func (m schemaMap) validateConflictingAttributes(
         }
 
         for _, conflicting_key := range schema.ConflictsWith {
-                if value, ok := c.Get(conflicting_key); ok {
+                if _, ok := c.Get(conflicting_key); ok {
                         return fmt.Errorf(
-                                "%q: conflicts with %s (%#v)", k, conflicting_key, value)
+                                "%q: conflicts with %s", k, conflicting_key)
                 }
         }
 
@@ -1363,13 +1461,10 @@ func getValueType(k string, schema *Schema) (ValueType, error) {
                 return vt, nil
         }
 
+        // If a Schema is provided to a Map, we use the Type of that schema
+        // as the type for each element in the Map.
         if s, ok := schema.Elem.(*Schema); ok {
-                if s.Elem == nil {
-                        return TypeString, nil
-                }
-                if vt, ok := s.Elem.(ValueType); ok {
-                        return vt, nil
-                }
+                return s.Type, nil
         }
 
         if _, ok := schema.Elem.(*Resource); ok {
@@ -1430,7 +1525,6 @@ func (m schemaMap) validatePrimitive(
         raw interface{},
         schema *Schema,
         c *terraform.ResourceConfig) ([]string, []error) {
-
         // Catch if the user gave a complex type where a primitive was
         // expected, so we can return a friendly error message that
         // doesn't contain Go type system terminology.
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/set.go b/vendor/github.com/hashicorp/terraform/helper/schema/set.go
index de05f40..cba2890 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/set.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/set.go
@@ -17,6 +17,12 @@ func HashString(v interface{}) int {
         return hashcode.String(v.(string))
 }
 
+// HashInt hashes integers. If you want a Set of integers, this is the
+// SchemaSetFunc you want.
+func HashInt(v interface{}) int {
+        return hashcode.String(strconv.Itoa(v.(int)))
+}
+
 // HashResource hashes complex structures that are described using
 // a *Resource. This is the default set implementation used when a set's
 // element type is a full resource.
@@ -153,6 +159,31 @@ func (s *Set) Equal(raw interface{}) bool {
         return reflect.DeepEqual(s.m, other.m)
 }
 
+// HashEqual simply checks to the keys the top-level map to the keys in the
+// other set's top-level map to see if they are equal. This obviously assumes
+// you have a properly working hash function - use HashResource if in doubt.
+func (s *Set) HashEqual(raw interface{}) bool {
+        other, ok := raw.(*Set)
+        if !ok {
+                return false
+        }
+
+        ks1 := make([]string, 0)
+        ks2 := make([]string, 0)
+
+        for k := range s.m {
+                ks1 = append(ks1, k)
+        }
+        for k := range other.m {
+                ks2 = append(ks2, k)
+        }
+
+        sort.Strings(ks1)
+        sort.Strings(ks2)
+
+        return reflect.DeepEqual(ks1, ks2)
+}
+
 func (s *Set) GoString() string {
         return fmt.Sprintf("*Set(%#v)", s.m)
 }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/testing.go b/vendor/github.com/hashicorp/terraform/helper/schema/testing.go
index 9765bdb..da754ac 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/testing.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/testing.go
@@ -10,13 +10,15 @@ import (
 // TestResourceDataRaw creates a ResourceData from a raw configuration map.
 func TestResourceDataRaw(
         t *testing.T, schema map[string]*Schema, raw map[string]interface{}) *ResourceData {
+        t.Helper()
+
         c, err := config.NewRawConfig(raw)
         if err != nil {
                 t.Fatalf("err: %s", err)
         }
 
         sm := schemaMap(schema)
-        diff, err := sm.Diff(nil, terraform.NewResourceConfig(c))
+        diff, err := sm.Diff(nil, terraform.NewResourceConfig(c), nil, nil)
         if err != nil {
                 t.Fatalf("err: %s", err)
         }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go b/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go
index 1610cec..3bc3ac4 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go
@@ -2,7 +2,7 @@
 
 package schema
 
-import "fmt"
+import "strconv"
 
 const _ValueType_name = "TypeInvalidTypeBoolTypeIntTypeFloatTypeStringTypeListTypeMapTypeSettypeObject"
 
@@ -10,7 +10,7 @@ var _ValueType_index = [...]uint8{0, 11, 19, 26, 35, 45, 53, 60, 67, 77}
 
 func (i ValueType) String() string {
         if i < 0 || i >= ValueType(len(_ValueType_index)-1) {
-                return fmt.Sprintf("ValueType(%d)", i)
+                return "ValueType(" + strconv.FormatInt(int64(i), 10) + ")"
         }
         return _ValueType_name[_ValueType_index[i]:_ValueType_index[i+1]]
 }
diff --git a/vendor/github.com/hashicorp/terraform/helper/shadow/closer.go b/vendor/github.com/hashicorp/terraform/helper/shadow/closer.go
deleted file mode 100644
index edc1e2a..0000000
--- a/vendor/github.com/hashicorp/terraform/helper/shadow/closer.go
+++ /dev/null
@@ -1,83 +0,0 @@
-package shadow
-
-import (
-        "fmt"
-        "io"
-        "reflect"
-
-        "github.com/hashicorp/go-multierror"
-        "github.com/mitchellh/reflectwalk"
-)
-
-// Close will close all shadow values within the given structure.
-//
-// This uses reflection to walk the structure, find all shadow elements,
-// and close them. Currently this will only find struct fields that are
-// shadow values, and not slice elements, etc.
-func Close(v interface{}) error {
-        // We require a pointer so we can address the internal fields
-        val := reflect.ValueOf(v)
-        if val.Kind() != reflect.Ptr {
-                return fmt.Errorf("value must be a pointer")
-        }
-
-        // Walk and close
-        var w closeWalker
-        if err := reflectwalk.Walk(v, &w); err != nil {
-                return err
-        }
-
-        return w.Err
-}
-
-type closeWalker struct {
-        Err error
-}
-
-func (w *closeWalker) Struct(reflect.Value) error {
-        // Do nothing. We implement this for reflectwalk.StructWalker
-        return nil
-}
-
-var closerType = reflect.TypeOf((*io.Closer)(nil)).Elem()
-
-func (w *closeWalker) StructField(f reflect.StructField, v reflect.Value) error {
-        // Not sure why this would be but lets avoid some panics
-        if !v.IsValid() {
-                return nil
-        }
-
-        // Empty for exported, so don't check unexported fields
-        if f.PkgPath != "" {
-                return nil
-        }
-
-        // Verify the io.Closer is in this package
-        typ := v.Type()
-        if typ.PkgPath() != "github.com/hashicorp/terraform/helper/shadow" {
-                return nil
-        }
-
-        var closer io.Closer
-        if v.Type().Implements(closerType) {
-                closer = v.Interface().(io.Closer)
-        } else if v.CanAddr() {
-                // The Close method may require a pointer receiver, but we only have a value.
-                v := v.Addr()
-                if v.Type().Implements(closerType) {
-                        closer = v.Interface().(io.Closer)
-                }
-        }
-
-        if closer == nil {
-                return reflectwalk.SkipEntry
-        }
-
-        // Close it
-        if err := closer.Close(); err != nil {
-                w.Err = multierror.Append(w.Err, err)
-        }
-
-        // Don't go into the struct field
-        return reflectwalk.SkipEntry
-}
diff --git a/vendor/github.com/hashicorp/terraform/helper/shadow/compared_value.go b/vendor/github.com/hashicorp/terraform/helper/shadow/compared_value.go
deleted file mode 100644
index 4223e92..0000000
--- a/vendor/github.com/hashicorp/terraform/helper/shadow/compared_value.go
+++ /dev/null
@@ -1,128 +0,0 @@
-package shadow
-
-import (
-        "sync"
-)
-
-// ComparedValue is a struct that finds a value by comparing some key
-// to the list of stored values. This is useful when there is no easy
-// uniquely identifying key that works in a map (for that, use KeyedValue).
-//
-// ComparedValue is very expensive, relative to other Value types. Try to
-// limit the number of values stored in a ComparedValue by potentially
-// nesting it within a KeyedValue (a keyed value points to a compared value,
-// for example).
-type ComparedValue struct {
-        // Func is a function that is given the lookup key and a single
-        // stored value. If it matches, it returns true.
-        Func func(k, v interface{}) bool
-
-        lock    sync.Mutex
-        once    sync.Once
-        closed  bool
-        values  []interface{}
-        waiters map[interface{}]*Value
-}
-
-// Close closes the value. This can never fail. For a definition of
-// "close" see the ErrClosed docs.
-func (w *ComparedValue) Close() error {
-        w.lock.Lock()
-        defer w.lock.Unlock()
-
-        // Set closed to true always
-        w.closed = true
-
-        // For all waiters, complete with ErrClosed
-        for k, val := range w.waiters {
-                val.SetValue(ErrClosed)
-                delete(w.waiters, k)
-        }
-
-        return nil
-}
-
-// Value returns the value that was set for the given key, or blocks
-// until one is available.
-func (w *ComparedValue) Value(k interface{}) interface{} {
-        v, val := w.valueWaiter(k)
-        if val == nil {
-                return v
-        }
-
-        return val.Value()
-}
-
-// ValueOk gets the value for the given key, returning immediately if the
-// value doesn't exist. The second return argument is true if the value exists.
-func (w *ComparedValue) ValueOk(k interface{}) (interface{}, bool) {
-        v, val := w.valueWaiter(k)
-        return v, val == nil
-}
-
-func (w *ComparedValue) SetValue(v interface{}) {
-        w.lock.Lock()
-        defer w.lock.Unlock()
-        w.once.Do(w.init)
-
-        // Check if we already have this exact value (by simply comparing
-        // with == directly). If we do, then we don't insert it again.
-        found := false
-        for _, v2 := range w.values {
-                if v == v2 {
-                        found = true
-                        break
-                }
-        }
-
-        if !found {
-                // Set the value, always
-                w.values = append(w.values, v)
-        }
-
-        // Go through the waiters
-        for k, val := range w.waiters {
-                if w.Func(k, v) {
-                        val.SetValue(v)
-                        delete(w.waiters, k)
-                }
-        }
-}
-
-func (w *ComparedValue) valueWaiter(k interface{}) (interface{}, *Value) {
-        w.lock.Lock()
-        w.once.Do(w.init)
-
-        // Look for a pre-existing value
-        for _, v := range w.values {
-                if w.Func(k, v) {
-                        w.lock.Unlock()
-                        return v, nil
-                }
-        }
-
-        // If we're closed, return that
-        if w.closed {
-                w.lock.Unlock()
-                return ErrClosed, nil
-        }
-
-        // Pre-existing value doesn't exist, create a waiter
-        val := w.waiters[k]
-        if val == nil {
-                val = new(Value)
-                w.waiters[k] = val
-        }
-        w.lock.Unlock()
-
-        // Return the waiter
-        return nil, val
-}
-
-// Must be called with w.lock held.
-func (w *ComparedValue) init() {
-        w.waiters = make(map[interface{}]*Value)
-        if w.Func == nil {
-                w.Func = func(k, v interface{}) bool { return k == v }
-        }
-}
diff --git a/vendor/github.com/hashicorp/terraform/helper/shadow/keyed_value.go b/vendor/github.com/hashicorp/terraform/helper/shadow/keyed_value.go
deleted file mode 100644
index 432b036..0000000
--- a/vendor/github.com/hashicorp/terraform/helper/shadow/keyed_value.go
+++ /dev/null
@@ -1,151 +0,0 @@
-package shadow
-
-import (
-        "sync"
-)
-
-// KeyedValue is a struct that coordinates a value by key. If a value is
-// not available for a give key, it'll block until it is available.
-type KeyedValue struct {
-        lock    sync.Mutex
-        once    sync.Once
-        values  map[string]interface{}
-        waiters map[string]*Value
-        closed  bool
-}
-
-// Close closes the value. This can never fail. For a definition of
-// "close" see the ErrClosed docs.
-func (w *KeyedValue) Close() error {
-        w.lock.Lock()
-        defer w.lock.Unlock()
-
-        // Set closed to true always
-        w.closed = true
-
-        // For all waiters, complete with ErrClosed
-        for k, val := range w.waiters {
-                val.SetValue(ErrClosed)
-                delete(w.waiters, k)
-        }
-
-        return nil
-}
-
-// Value returns the value that was set for the given key, or blocks
-// until one is available.
-func (w *KeyedValue) Value(k string) interface{} {
-        w.lock.Lock()
-        v, val := w.valueWaiter(k)
-        w.lock.Unlock()
-
-        // If we have no waiter, then return the value
-        if val == nil {
-                return v
-        }
-
-        // We have a waiter, so wait
-        return val.Value()
-}
-
-// WaitForChange waits for the value with the given key to be set again.
-// If the key isn't set, it'll wait for an initial value. Note that while
-// it is called "WaitForChange", the value isn't guaranteed to _change_;
-// this will return when a SetValue is called for the given k.
-func (w *KeyedValue) WaitForChange(k string) interface{} {
-        w.lock.Lock()
-        w.once.Do(w.init)
-
-        // If we're closed, we're closed
-        if w.closed {
-                w.lock.Unlock()
-                return ErrClosed
-        }
-
-        // Check for an active waiter. If there isn't one, make it
-        val := w.waiters[k]
-        if val == nil {
-                val = new(Value)
-                w.waiters[k] = val
-        }
-        w.lock.Unlock()
-
-        // And wait
-        return val.Value()
-}
-
-// ValueOk gets the value for the given key, returning immediately if the
-// value doesn't exist. The second return argument is true if the value exists.
-func (w *KeyedValue) ValueOk(k string) (interface{}, bool) {
-        w.lock.Lock()
-        defer w.lock.Unlock()
-
-        v, val := w.valueWaiter(k)
-        return v, val == nil
-}
-
-func (w *KeyedValue) SetValue(k string, v interface{}) {
-        w.lock.Lock()
-        defer w.lock.Unlock()
-        w.setValue(k, v)
-}
-
-// Init will initialize the key to a given value only if the key has
-// not been set before. This is safe to call multiple times and in parallel.
-func (w *KeyedValue) Init(k string, v interface{}) {
-        w.lock.Lock()
-        defer w.lock.Unlock()
-
-        // If we have a waiter, set the value.
-        _, val := w.valueWaiter(k)
-        if val != nil {
-                w.setValue(k, v)
-        }
-}
-
-// Must be called with w.lock held.
-func (w *KeyedValue) init() {
-        w.values = make(map[string]interface{})
-        w.waiters = make(map[string]*Value)
-}
-
-// setValue is like SetValue but assumes the lock is held.
-func (w *KeyedValue) setValue(k string, v interface{}) {
-        w.once.Do(w.init)
-
-        // Set the value, always
-        w.values[k] = v
-
-        // If we have a waiter, set it
-        if val, ok := w.waiters[k]; ok {
-                val.SetValue(v)
-                delete(w.waiters, k)
-        }
-}
-
-// valueWaiter gets the value or the Value waiter for a given key.
-//
-// This must be called with lock held.
-func (w *KeyedValue) valueWaiter(k string) (interface{}, *Value) {
-        w.once.Do(w.init)
-
-        // If we have this value already, return it
-        if v, ok := w.values[k]; ok {
-                return v, nil
-        }
-
-        // If we're closed, return that
-        if w.closed {
-                return ErrClosed, nil
-        }
-
-        // No pending value, check for a waiter
-        val := w.waiters[k]
-        if val == nil {
-                val = new(Value)
-                w.waiters[k] = val
-        }
-
-        // Return the waiter
-        return nil, val
-}
diff --git a/vendor/github.com/hashicorp/terraform/helper/shadow/ordered_value.go b/vendor/github.com/hashicorp/terraform/helper/shadow/ordered_value.go
deleted file mode 100644
index 0a43d4d..0000000
--- a/vendor/github.com/hashicorp/terraform/helper/shadow/ordered_value.go
+++ /dev/null
@@ -1,66 +0,0 @@
-package shadow
-
-import (
-        "container/list"
-        "sync"
-)
-
-// OrderedValue is a struct that keeps track of a value in the order
-// it is set. Each time Value() is called, it will return the most recent
-// calls value then discard it.
-//
-// This is unlike Value that returns the same value once it is set.
-type OrderedValue struct {
-        lock    sync.Mutex
-        values  *list.List
-        waiters *list.List
-}
-
-// Value returns the last value that was set, or blocks until one
-// is received.
-func (w *OrderedValue) Value() interface{} {
-        w.lock.Lock()
-
-        // If we have a pending value already, use it
-        if w.values != nil && w.values.Len() > 0 {
-                front := w.values.Front()
-                w.values.Remove(front)
-                w.lock.Unlock()
-                return front.Value
-        }
-
-        // No pending value, create a waiter
-        if w.waiters == nil {
-                w.waiters = list.New()
-        }
-
-        var val Value
-        w.waiters.PushBack(&val)
-        w.lock.Unlock()
-
-        // Return the value once we have it
-        return val.Value()
-}
-
-// SetValue sets the latest value.
-func (w *OrderedValue) SetValue(v interface{}) {
-        w.lock.Lock()
-        defer w.lock.Unlock()
-
-        // If we have a waiter, notify it
-        if w.waiters != nil && w.waiters.Len() > 0 {
-                front := w.waiters.Front()
-                w.waiters.Remove(front)
-
-                val := front.Value.(*Value)
-                val.SetValue(v)
-                return
-        }
-
-        // Add it to the list of values
-        if w.values == nil {
-                w.values = list.New()
-        }
-
-        w.values.PushBack(v)
-}
diff --git a/vendor/github.com/hashicorp/terraform/helper/shadow/value.go b/vendor/github.com/hashicorp/terraform/helper/shadow/value.go
deleted file mode 100644
index 178b7e7..0000000
--- a/vendor/github.com/hashicorp/terraform/helper/shadow/value.go
+++ /dev/null
@@ -1,87 +0,0 @@
-package shadow
-
-import (
-        "errors"
-        "sync"
-)
-
-// ErrClosed is returned by any closed values.
-//
-// A "closed value" is when the shadow has been notified that the real
-// side is complete and any blocking values will _never_ be satisfied
-// in the future. In this case, this error is returned. If a value is already
-// available, that is still returned.
-var ErrClosed = errors.New("shadow closed")
-
-// Value is a struct that coordinates a value between two
-// parallel routines. It is similar to atomic.Value except that when
-// Value is called if it isn't set it will wait for it.
-//
-// The Value can be closed with Close, which will cause any future
-// blocking operations to return immediately with ErrClosed.
-type Value struct {
-        lock     sync.Mutex
-        cond     *sync.Cond
-        value    interface{}
-        valueSet bool
-}
-
-func (v *Value) Lock() {
-        v.lock.Lock()
-}
-
-func (v *Value) Unlock() {
-        v.lock.Unlock()
-}
-
-// Close closes the value. This can never fail. For a definition of
-// "close" see the struct docs.
-func (w *Value) Close() error {
-        w.lock.Lock()
-        set := w.valueSet
-        w.lock.Unlock()
-
-        // If we haven't set the value, set it
-        if !set {
-                w.SetValue(ErrClosed)
-        }
-
-        // Done
-        return nil
-}
-
-// Value returns the value that was set.
-func (w *Value) Value() interface{} {
-        w.lock.Lock()
-        defer w.lock.Unlock()
-
-        // If we already have a value just return
-        for !w.valueSet {
-                // No value, setup the condition variable if we have to
-                if w.cond == nil {
-                        w.cond = sync.NewCond(&w.lock)
-                }
-
-                // Wait on it
-                w.cond.Wait()
-        }
-
-        // Return the value
-        return w.value
-}
-
-// SetValue sets the value.
-func (w *Value) SetValue(v interface{}) {
-        w.lock.Lock()
-        defer w.lock.Unlock()
-
-        // Set the value
-        w.valueSet = true
-        w.value = v
-
-        // If we have a condition, clear it
-        if w.cond != nil {
-                w.cond.Broadcast()
-                w.cond = nil
-        }
-}