Upgrade to 0.12

16 files changed, 2273 insertions, 0 deletions

diff --git a/vendor/github.com/hashicorp/terraform/plans/action.go b/vendor/github.com/hashicorp/terraform/plans/action.go
new file mode 100644
index 0000000..c3e6a32
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/action.go
@@ -0,0 +1,22 @@
+package plans
+
+type Action rune
+
+const (
+        NoOp             Action = 0
+        Create           Action = '+'
+        Read             Action = '←'
+        Update           Action = '~'
+        DeleteThenCreate Action = '∓'
+        CreateThenDelete Action = '±'
+        Delete           Action = '-'
+)
+
+//go:generate stringer -type Action
+
+// IsReplace returns true if the action is one of the two actions that
+// represents replacing an existing object with a new object:
+// DeleteThenCreate or CreateThenDelete.
+func (a Action) IsReplace() bool {
+        return a == DeleteThenCreate || a == CreateThenDelete
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/action_string.go b/vendor/github.com/hashicorp/terraform/plans/action_string.go
new file mode 100644
index 0000000..be43ab1
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/action_string.go
@@ -0,0 +1,49 @@
+// Code generated by "stringer -type Action"; DO NOT EDIT.
+
+package plans
+
+import "strconv"
+
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[NoOp-0]
+        _ = x[Create-43]
+        _ = x[Read-8592]
+        _ = x[Update-126]
+        _ = x[DeleteThenCreate-8723]
+        _ = x[CreateThenDelete-177]
+        _ = x[Delete-45]
+}
+
+const (
+        _Action_name_0 = "NoOp"
+        _Action_name_1 = "Create"
+        _Action_name_2 = "Delete"
+        _Action_name_3 = "Update"
+        _Action_name_4 = "CreateThenDelete"
+        _Action_name_5 = "Read"
+        _Action_name_6 = "DeleteThenCreate"
+)
+
+func (i Action) String() string {
+        switch {
+        case i == 0:
+                return _Action_name_0
+        case i == 43:
+                return _Action_name_1
+        case i == 45:
+                return _Action_name_2
+        case i == 126:
+                return _Action_name_3
+        case i == 177:
+                return _Action_name_4
+        case i == 8592:
+                return _Action_name_5
+        case i == 8723:
+                return _Action_name_6
+        default:
+                return "Action(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/changes.go b/vendor/github.com/hashicorp/terraform/plans/changes.go
new file mode 100644
index 0000000..d7e0dcd
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/changes.go
@@ -0,0 +1,308 @@
+package plans
+
+import (
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/states"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Changes describes various actions that Terraform will attempt to take if
+// the corresponding plan is applied.
+//
+// A Changes object can be rendered into a visual diff (by the caller, using
+// code in another package) for display to the user.
+type Changes struct {
+        // Resources tracks planned changes to resource instance objects.
+        Resources []*ResourceInstanceChangeSrc
+
+        // Outputs tracks planned changes output values.
+        //
+        // Note that although an in-memory plan contains planned changes for
+        // outputs throughout the configuration, a plan serialized
+        // to disk retains only the root outputs because they are
+        // externally-visible, while other outputs are implementation details and
+        // can be easily re-calculated during the apply phase. Therefore only root
+        // module outputs will survive a round-trip through a plan file.
+        Outputs []*OutputChangeSrc
+}
+
+// NewChanges returns a valid Changes object that describes no changes.
+func NewChanges() *Changes {
+        return &Changes{}
+}
+
+func (c *Changes) Empty() bool {
+        for _, res := range c.Resources {
+                if res.Action != NoOp {
+                        return false
+                }
+        }
+        return true
+}
+
+// ResourceInstance returns the planned change for the current object of the
+// resource instance of the given address, if any. Returns nil if no change is
+// planned.
+func (c *Changes) ResourceInstance(addr addrs.AbsResourceInstance) *ResourceInstanceChangeSrc {
+        addrStr := addr.String()
+        for _, rc := range c.Resources {
+                if rc.Addr.String() == addrStr && rc.DeposedKey == states.NotDeposed {
+                        return rc
+                }
+        }
+
+        return nil
+}
+
+// ResourceInstanceDeposed returns the plan change of a deposed object of
+// the resource instance of the given address, if any. Returns nil if no change
+// is planned.
+func (c *Changes) ResourceInstanceDeposed(addr addrs.AbsResourceInstance, key states.DeposedKey) *ResourceInstanceChangeSrc {
+        addrStr := addr.String()
+        for _, rc := range c.Resources {
+                if rc.Addr.String() == addrStr && rc.DeposedKey == key {
+                        return rc
+                }
+        }
+
+        return nil
+}
+
+// OutputValue returns the planned change for the output value with the
+//  given address, if any. Returns nil if no change is planned.
+func (c *Changes) OutputValue(addr addrs.AbsOutputValue) *OutputChangeSrc {
+        addrStr := addr.String()
+        for _, oc := range c.Outputs {
+                if oc.Addr.String() == addrStr {
+                        return oc
+                }
+        }
+
+        return nil
+}
+
+// SyncWrapper returns a wrapper object around the receiver that can be used
+// to make certain changes to the receiver in a concurrency-safe way, as long
+// as all callers share the same wrapper object.
+func (c *Changes) SyncWrapper() *ChangesSync {
+        return &ChangesSync{
+                changes: c,
+        }
+}
+
+// ResourceInstanceChange describes a change to a particular resource instance
+// object.
+type ResourceInstanceChange struct {
+        // Addr is the absolute address of the resource instance that the change
+        // will apply to.
+        Addr addrs.AbsResourceInstance
+
+        // DeposedKey is the identifier for a deposed object associated with the
+        // given instance, or states.NotDeposed if this change applies to the
+        // current object.
+        //
+        // A Replace change for a resource with create_before_destroy set will
+        // create a new DeposedKey temporarily during replacement. In that case,
+        // DeposedKey in the plan is always states.NotDeposed, representing that
+        // the current object is being replaced with the deposed.
+        DeposedKey states.DeposedKey
+
+        // Provider is the address of the provider configuration that was used
+        // to plan this change, and thus the configuration that must also be
+        // used to apply it.
+        ProviderAddr addrs.AbsProviderConfig
+
+        // Change is an embedded description of the change.
+        Change
+
+        // RequiredReplace is a set of paths that caused the change action to be
+        // Replace rather than Update. Always nil if the change action is not
+        // Replace.
+        //
+        // This is retained only for UI-plan-rendering purposes and so it does not
+        // currently survive a round-trip through a saved plan file.
+        RequiredReplace cty.PathSet
+
+        // Private allows a provider to stash any extra data that is opaque to
+        // Terraform that relates to this change. Terraform will save this
+        // byte-for-byte and return it to the provider in the apply call.
+        Private []byte
+}
+
+// Encode produces a variant of the reciever that has its change values
+// serialized so it can be written to a plan file. Pass the implied type of the
+// corresponding resource type schema for correct operation.
+func (rc *ResourceInstanceChange) Encode(ty cty.Type) (*ResourceInstanceChangeSrc, error) {
+        cs, err := rc.Change.Encode(ty)
+        if err != nil {
+                return nil, err
+        }
+        return &ResourceInstanceChangeSrc{
+                Addr:            rc.Addr,
+                DeposedKey:      rc.DeposedKey,
+                ProviderAddr:    rc.ProviderAddr,
+                ChangeSrc:       *cs,
+                RequiredReplace: rc.RequiredReplace,
+                Private:         rc.Private,
+        }, err
+}
+
+// Simplify will, where possible, produce a change with a simpler action than
+// the receiever given a flag indicating whether the caller is dealing with
+// a normal apply or a destroy. This flag deals with the fact that Terraform
+// Core uses a specialized graph node type for destroying; only that
+// specialized node should set "destroying" to true.
+//
+// The following table shows the simplification behavior:
+//
+//     Action    Destroying?   New Action
+//     --------+-------------+-----------
+//     Create    true          NoOp
+//     Delete    false         NoOp
+//     Replace   true          Delete
+//     Replace   false         Create
+//
+// For any combination not in the above table, the Simplify just returns the
+// receiver as-is.
+func (rc *ResourceInstanceChange) Simplify(destroying bool) *ResourceInstanceChange {
+        if destroying {
+                switch rc.Action {
+                case Delete:
+                        // We'll fall out and just return rc verbatim, then.
+                case CreateThenDelete, DeleteThenCreate:
+                        return &ResourceInstanceChange{
+                                Addr:         rc.Addr,
+                                DeposedKey:   rc.DeposedKey,
+                                Private:      rc.Private,
+                                ProviderAddr: rc.ProviderAddr,
+                                Change: Change{
+                                        Action: Delete,
+                                        Before: rc.Before,
+                                        After:  cty.NullVal(rc.Before.Type()),
+                                },
+                        }
+                default:
+                        return &ResourceInstanceChange{
+                                Addr:         rc.Addr,
+                                DeposedKey:   rc.DeposedKey,
+                                Private:      rc.Private,
+                                ProviderAddr: rc.ProviderAddr,
+                                Change: Change{
+                                        Action: NoOp,
+                                        Before: rc.Before,
+                                        After:  rc.Before,
+                                },
+                        }
+                }
+        } else {
+                switch rc.Action {
+                case Delete:
+                        return &ResourceInstanceChange{
+                                Addr:         rc.Addr,
+                                DeposedKey:   rc.DeposedKey,
+                                Private:      rc.Private,
+                                ProviderAddr: rc.ProviderAddr,
+                                Change: Change{
+                                        Action: NoOp,
+                                        Before: rc.Before,
+                                        After:  rc.Before,
+                                },
+                        }
+                case CreateThenDelete, DeleteThenCreate:
+                        return &ResourceInstanceChange{
+                                Addr:         rc.Addr,
+                                DeposedKey:   rc.DeposedKey,
+                                Private:      rc.Private,
+                                ProviderAddr: rc.ProviderAddr,
+                                Change: Change{
+                                        Action: Create,
+                                        Before: cty.NullVal(rc.After.Type()),
+                                        After:  rc.After,
+                                },
+                        }
+                }
+        }
+
+        // If we fall out here then our change is already simple enough.
+        return rc
+}
+
+// OutputChange describes a change to an output value.
+type OutputChange struct {
+        // Addr is the absolute address of the output value that the change
+        // will apply to.
+        Addr addrs.AbsOutputValue
+
+        // Change is an embedded description of the change.
+        //
+        // For output value changes, the type constraint for the DynamicValue
+        // instances is always cty.DynamicPseudoType.
+        Change
+
+        // Sensitive, if true, indicates that either the old or new value in the
+        // change is sensitive and so a rendered version of the plan in the UI
+        // should elide the actual values while still indicating the action of the
+        // change.
+        Sensitive bool
+}
+
+// Encode produces a variant of the reciever that has its change values
+// serialized so it can be written to a plan file.
+func (oc *OutputChange) Encode() (*OutputChangeSrc, error) {
+        cs, err := oc.Change.Encode(cty.DynamicPseudoType)
+        if err != nil {
+                return nil, err
+        }
+        return &OutputChangeSrc{
+                Addr:      oc.Addr,
+                ChangeSrc: *cs,
+                Sensitive: oc.Sensitive,
+        }, err
+}
+
+// Change describes a single change with a given action.
+type Change struct {
+        // Action defines what kind of change is being made.
+        Action Action
+
+        // Interpretation of Before and After depend on Action:
+        //
+        //     NoOp     Before and After are the same, unchanged value
+        //     Create   Before is nil, and After is the expected value after create.
+        //     Read     Before is any prior value (nil if no prior), and After is the
+        //              value that was or will be read.
+        //     Update   Before is the value prior to update, and After is the expected
+        //              value after update.
+        //     Replace  As with Update.
+        //     Delete   Before is the value prior to delete, and After is always nil.
+        //
+        // Unknown values may appear anywhere within the Before and After values,
+        // either as the values themselves or as nested elements within known
+        // collections/structures.
+        Before, After cty.Value
+}
+
+// Encode produces a variant of the reciever that has its change values
+// serialized so it can be written to a plan file. Pass the type constraint
+// that the values are expected to conform to; to properly decode the values
+// later an identical type constraint must be provided at that time.
+//
+// Where a Change is embedded in some other struct, it's generally better
+// to call the corresponding Encode method of that struct rather than working
+// directly with its embedded Change.
+func (c *Change) Encode(ty cty.Type) (*ChangeSrc, error) {
+        beforeDV, err := NewDynamicValue(c.Before, ty)
+        if err != nil {
+                return nil, err
+        }
+        afterDV, err := NewDynamicValue(c.After, ty)
+        if err != nil {
+                return nil, err
+        }
+
+        return &ChangeSrc{
+                Action: c.Action,
+                Before: beforeDV,
+                After:  afterDV,
+        }, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/changes_src.go b/vendor/github.com/hashicorp/terraform/plans/changes_src.go
new file mode 100644
index 0000000..90153ea
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/changes_src.go
@@ -0,0 +1,190 @@
+package plans
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/states"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// ResourceInstanceChangeSrc is a not-yet-decoded ResourceInstanceChange.
+// Pass the associated resource type's schema type to method Decode to
+// obtain a ResourceInstancChange.
+type ResourceInstanceChangeSrc struct {
+        // Addr is the absolute address of the resource instance that the change
+        // will apply to.
+        Addr addrs.AbsResourceInstance
+
+        // DeposedKey is the identifier for a deposed object associated with the
+        // given instance, or states.NotDeposed if this change applies to the
+        // current object.
+        //
+        // A Replace change for a resource with create_before_destroy set will
+        // create a new DeposedKey temporarily during replacement. In that case,
+        // DeposedKey in the plan is always states.NotDeposed, representing that
+        // the current object is being replaced with the deposed.
+        DeposedKey states.DeposedKey
+
+        // Provider is the address of the provider configuration that was used
+        // to plan this change, and thus the configuration that must also be
+        // used to apply it.
+        ProviderAddr addrs.AbsProviderConfig
+
+        // ChangeSrc is an embedded description of the not-yet-decoded change.
+        ChangeSrc
+
+        // RequiredReplace is a set of paths that caused the change action to be
+        // Replace rather than Update. Always nil if the change action is not
+        // Replace.
+        //
+        // This is retained only for UI-plan-rendering purposes and so it does not
+        // currently survive a round-trip through a saved plan file.
+        RequiredReplace cty.PathSet
+
+        // Private allows a provider to stash any extra data that is opaque to
+        // Terraform that relates to this change. Terraform will save this
+        // byte-for-byte and return it to the provider in the apply call.
+        Private []byte
+}
+
+// Decode unmarshals the raw representation of the instance object being
+// changed. Pass the implied type of the corresponding resource type schema
+// for correct operation.
+func (rcs *ResourceInstanceChangeSrc) Decode(ty cty.Type) (*ResourceInstanceChange, error) {
+        change, err := rcs.ChangeSrc.Decode(ty)
+        if err != nil {
+                return nil, err
+        }
+        return &ResourceInstanceChange{
+                Addr:            rcs.Addr,
+                DeposedKey:      rcs.DeposedKey,
+                ProviderAddr:    rcs.ProviderAddr,
+                Change:          *change,
+                RequiredReplace: rcs.RequiredReplace,
+                Private:         rcs.Private,
+        }, nil
+}
+
+// DeepCopy creates a copy of the receiver where any pointers to nested mutable
+// values are also copied, thus ensuring that future mutations of the receiver
+// will not affect the copy.
+//
+// Some types used within a resource change are immutable by convention even
+// though the Go language allows them to be mutated, such as the types from
+// the addrs package. These are _not_ copied by this method, under the
+// assumption that callers will behave themselves.
+func (rcs *ResourceInstanceChangeSrc) DeepCopy() *ResourceInstanceChangeSrc {
+        if rcs == nil {
+                return nil
+        }
+        ret := *rcs
+
+        ret.RequiredReplace = cty.NewPathSet(ret.RequiredReplace.List()...)
+
+        if len(ret.Private) != 0 {
+                private := make([]byte, len(ret.Private))
+                copy(private, ret.Private)
+                ret.Private = private
+        }
+
+        ret.ChangeSrc.Before = ret.ChangeSrc.Before.Copy()
+        ret.ChangeSrc.After = ret.ChangeSrc.After.Copy()
+
+        return &ret
+}
+
+// OutputChangeSrc describes a change to an output value.
+type OutputChangeSrc struct {
+        // Addr is the absolute address of the output value that the change
+        // will apply to.
+        Addr addrs.AbsOutputValue
+
+        // ChangeSrc is an embedded description of the not-yet-decoded change.
+        //
+        // For output value changes, the type constraint for the DynamicValue
+        // instances is always cty.DynamicPseudoType.
+        ChangeSrc
+
+        // Sensitive, if true, indicates that either the old or new value in the
+        // change is sensitive and so a rendered version of the plan in the UI
+        // should elide the actual values while still indicating the action of the
+        // change.
+        Sensitive bool
+}
+
+// Decode unmarshals the raw representation of the output value being
+// changed.
+func (ocs *OutputChangeSrc) Decode() (*OutputChange, error) {
+        change, err := ocs.ChangeSrc.Decode(cty.DynamicPseudoType)
+        if err != nil {
+                return nil, err
+        }
+        return &OutputChange{
+                Addr:      ocs.Addr,
+                Change:    *change,
+                Sensitive: ocs.Sensitive,
+        }, nil
+}
+
+// DeepCopy creates a copy of the receiver where any pointers to nested mutable
+// values are also copied, thus ensuring that future mutations of the receiver
+// will not affect the copy.
+//
+// Some types used within a resource change are immutable by convention even
+// though the Go language allows them to be mutated, such as the types from
+// the addrs package. These are _not_ copied by this method, under the
+// assumption that callers will behave themselves.
+func (ocs *OutputChangeSrc) DeepCopy() *OutputChangeSrc {
+        if ocs == nil {
+                return nil
+        }
+        ret := *ocs
+
+        ret.ChangeSrc.Before = ret.ChangeSrc.Before.Copy()
+        ret.ChangeSrc.After = ret.ChangeSrc.After.Copy()
+
+        return &ret
+}
+
+// ChangeSrc is a not-yet-decoded Change.
+type ChangeSrc struct {
+        // Action defines what kind of change is being made.
+        Action Action
+
+        // Before and After correspond to the fields of the same name in Change,
+        // but have not yet been decoded from the serialized value used for
+        // storage.
+        Before, After DynamicValue
+}
+
+// Decode unmarshals the raw representations of the before and after values
+// to produce a Change object. Pass the type constraint that the result must
+// conform to.
+//
+// Where a ChangeSrc is embedded in some other struct, it's generally better
+// to call the corresponding Decode method of that struct rather than working
+// directly with its embedded Change.
+func (cs *ChangeSrc) Decode(ty cty.Type) (*Change, error) {
+        var err error
+        before := cty.NullVal(ty)
+        after := cty.NullVal(ty)
+
+        if len(cs.Before) > 0 {
+                before, err = cs.Before.Decode(ty)
+                if err != nil {
+                        return nil, fmt.Errorf("error decoding 'before' value: %s", err)
+                }
+        }
+        if len(cs.After) > 0 {
+                after, err = cs.After.Decode(ty)
+                if err != nil {
+                        return nil, fmt.Errorf("error decoding 'after' value: %s", err)
+                }
+        }
+        return &Change{
+                Action: cs.Action,
+                Before: before,
+                After:  after,
+        }, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/changes_state.go b/vendor/github.com/hashicorp/terraform/plans/changes_state.go
new file mode 100644
index 0000000..543e6c2
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/changes_state.go
@@ -0,0 +1,15 @@
+package plans
+
+import (
+        "github.com/hashicorp/terraform/states"
+)
+
+// PlannedState merges the set of changes described by the receiver into the
+// given prior state to produce the planned result state.
+//
+// The result is an approximation of the state as it would exist after
+// applying these changes, omitting any values that cannot be determined until
+// the changes are actually applied.
+func (c *Changes) PlannedState(prior *states.State) (*states.State, error) {
+        panic("Changes.PlannedState not yet implemented")
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/changes_sync.go b/vendor/github.com/hashicorp/terraform/plans/changes_sync.go
new file mode 100644
index 0000000..6b4ff98
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/changes_sync.go
@@ -0,0 +1,144 @@
+package plans
+
+import (
+        "fmt"
+        "sync"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/states"
+)
+
+// ChangesSync is a wrapper around a Changes that provides a concurrency-safe
+// interface to insert new changes and retrieve copies of existing changes.
+//
+// Each ChangesSync is independent of all others, so all concurrent writers
+// to a particular Changes must share a single ChangesSync. Behavior is
+// undefined if any other caller makes changes to the underlying Changes
+// object or its nested objects concurrently with any of the methods of a
+// particular ChangesSync.
+type ChangesSync struct {
+        lock    sync.Mutex
+        changes *Changes
+}
+
+// AppendResourceInstanceChange records the given resource instance change in
+// the set of planned resource changes.
+//
+// The caller must ensure that there are no concurrent writes to the given
+// change while this method is running, but it is safe to resume mutating
+// it after this method returns without affecting the saved change.
+func (cs *ChangesSync) AppendResourceInstanceChange(changeSrc *ResourceInstanceChangeSrc) {
+        if cs == nil {
+                panic("AppendResourceInstanceChange on nil ChangesSync")
+        }
+        cs.lock.Lock()
+        defer cs.lock.Unlock()
+
+        s := changeSrc.DeepCopy()
+        cs.changes.Resources = append(cs.changes.Resources, s)
+}
+
+// GetResourceInstanceChange searches the set of resource instance changes for
+// one matching the given address and generation, returning it if it exists.
+//
+// If no such change exists, nil is returned.
+//
+// The returned object is a deep copy of the change recorded in the plan, so
+// callers may mutate it although it's generally better (less confusing) to
+// treat planned changes as immutable after they've been initially constructed.
+func (cs *ChangesSync) GetResourceInstanceChange(addr addrs.AbsResourceInstance, gen states.Generation) *ResourceInstanceChangeSrc {
+        if cs == nil {
+                panic("GetResourceInstanceChange on nil ChangesSync")
+        }
+        cs.lock.Lock()
+        defer cs.lock.Unlock()
+
+        if gen == states.CurrentGen {
+                return cs.changes.ResourceInstance(addr).DeepCopy()
+        }
+        if dk, ok := gen.(states.DeposedKey); ok {
+                return cs.changes.ResourceInstanceDeposed(addr, dk).DeepCopy()
+        }
+        panic(fmt.Sprintf("unsupported generation value %#v", gen))
+}
+
+// RemoveResourceInstanceChange searches the set of resource instance changes
+// for one matching the given address and generation, and removes it from the
+// set if it exists.
+func (cs *ChangesSync) RemoveResourceInstanceChange(addr addrs.AbsResourceInstance, gen states.Generation) {
+        if cs == nil {
+                panic("RemoveResourceInstanceChange on nil ChangesSync")
+        }
+        cs.lock.Lock()
+        defer cs.lock.Unlock()
+
+        dk := states.NotDeposed
+        if realDK, ok := gen.(states.DeposedKey); ok {
+                dk = realDK
+        }
+
+        addrStr := addr.String()
+        for i, r := range cs.changes.Resources {
+                if r.Addr.String() != addrStr || r.DeposedKey != dk {
+                        continue
+                }
+                copy(cs.changes.Resources[i:], cs.changes.Resources[i+1:])
+                cs.changes.Resources = cs.changes.Resources[:len(cs.changes.Resources)-1]
+                return
+        }
+}
+
+// AppendOutputChange records the given output value change in the set of
+// planned value changes.
+//
+// The caller must ensure that there are no concurrent writes to the given
+// change while this method is running, but it is safe to resume mutating
+// it after this method returns without affecting the saved change.
+func (cs *ChangesSync) AppendOutputChange(changeSrc *OutputChangeSrc) {
+        if cs == nil {
+                panic("AppendOutputChange on nil ChangesSync")
+        }
+        cs.lock.Lock()
+        defer cs.lock.Unlock()
+
+        s := changeSrc.DeepCopy()
+        cs.changes.Outputs = append(cs.changes.Outputs, s)
+}
+
+// GetOutputChange searches the set of output value changes for one matching
+// the given address, returning it if it exists.
+//
+// If no such change exists, nil is returned.
+//
+// The returned object is a deep copy of the change recorded in the plan, so
+// callers may mutate it although it's generally better (less confusing) to
+// treat planned changes as immutable after they've been initially constructed.
+func (cs *ChangesSync) GetOutputChange(addr addrs.AbsOutputValue) *OutputChangeSrc {
+        if cs == nil {
+                panic("GetOutputChange on nil ChangesSync")
+        }
+        cs.lock.Lock()
+        defer cs.lock.Unlock()
+
+        return cs.changes.OutputValue(addr)
+}
+
+// RemoveOutputChange searches the set of output value changes for one matching
+// the given address, and removes it from the set if it exists.
+func (cs *ChangesSync) RemoveOutputChange(addr addrs.AbsOutputValue) {
+        if cs == nil {
+                panic("RemoveOutputChange on nil ChangesSync")
+        }
+        cs.lock.Lock()
+        defer cs.lock.Unlock()
+
+        addrStr := addr.String()
+        for i, o := range cs.changes.Outputs {
+                if o.Addr.String() != addrStr {
+                        continue
+                }
+                copy(cs.changes.Outputs[i:], cs.changes.Outputs[i+1:])
+                cs.changes.Outputs = cs.changes.Outputs[:len(cs.changes.Outputs)-1]
+                return
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/doc.go b/vendor/github.com/hashicorp/terraform/plans/doc.go
new file mode 100644
index 0000000..01ca389
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/doc.go
@@ -0,0 +1,5 @@
+// Package plans contains the types that are used to represent Terraform plans.
+//
+// A plan describes a set of changes that Terraform will make to update remote
+// objects to match with changes to the configuration.
+package plans
diff --git a/vendor/github.com/hashicorp/terraform/plans/dynamic_value.go b/vendor/github.com/hashicorp/terraform/plans/dynamic_value.go
new file mode 100644
index 0000000..51fbb24
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/dynamic_value.go
@@ -0,0 +1,96 @@
+package plans
+
+import (
+        "github.com/zclconf/go-cty/cty"
+        ctymsgpack "github.com/zclconf/go-cty/cty/msgpack"
+)
+
+// DynamicValue is the representation in the plan of a value whose type cannot
+// be determined at compile time, such as because it comes from a schema
+// defined in a plugin.
+//
+// This type is used as an indirection so that the overall plan structure can
+// be decoded without schema available, and then the dynamic values accessed
+// at a later time once the appropriate schema has been determined.
+//
+// Internally, DynamicValue is a serialized version of a cty.Value created
+// against a particular type constraint. Callers should not access directly
+// the serialized form, whose format may change in future. Values of this
+// type must always be created by calling NewDynamicValue.
+//
+// The zero value of DynamicValue is nil, and represents the absense of a
+// value within the Go type system. This is distinct from a cty.NullVal
+// result, which represents the absense of a value within the cty type system.
+type DynamicValue []byte
+
+// NewDynamicValue creates a DynamicValue by serializing the given value
+// against the given type constraint. The value must conform to the type
+// constraint, or the result is undefined.
+//
+// If the value to be encoded has no predefined schema (for example, for
+// module output values and input variables), set the type constraint to
+// cty.DynamicPseudoType in order to save type information as part of the
+// value, and then also pass cty.DynamicPseudoType to method Decode to recover
+// the original value.
+//
+// cty.NilVal can be used to represent the absense of a value, but callers
+// must be careful to distinguish values that are absent at the Go layer
+// (cty.NilVal) vs. values that are absent at the cty layer (cty.NullVal
+// results).
+func NewDynamicValue(val cty.Value, ty cty.Type) (DynamicValue, error) {
+        // If we're given cty.NilVal (the zero value of cty.Value, which is
+        // distinct from a typed null value created by cty.NullVal) then we'll
+        // assume the caller is trying to represent the _absense_ of a value,
+        // and so we'll return a nil DynamicValue.
+        if val == cty.NilVal {
+                return DynamicValue(nil), nil
+        }
+
+        // Currently our internal encoding is msgpack, via ctymsgpack.
+        buf, err := ctymsgpack.Marshal(val, ty)
+        if err != nil {
+                return nil, err
+        }
+
+        return DynamicValue(buf), nil
+}
+
+// Decode retrieves the effective value from the receiever by interpreting the
+// serialized form against the given type constraint. For correct results,
+// the type constraint must match (or be consistent with) the one that was
+// used to create the receiver.
+//
+// A nil DynamicValue decodes to cty.NilVal, which is not a valid value and
+// instead represents the absense of a value.
+func (v DynamicValue) Decode(ty cty.Type) (cty.Value, error) {
+        if v == nil {
+                return cty.NilVal, nil
+        }
+
+        return ctymsgpack.Unmarshal([]byte(v), ty)
+}
+
+// ImpliedType returns the type implied by the serialized structure of the
+// receiving value.
+//
+// This will not necessarily be exactly the type that was given when the
+// value was encoded, and in particular must not be used for values that
+// were encoded with their static type given as cty.DynamicPseudoType.
+// It is however safe to use this method for values that were encoded using
+// their runtime type as the conforming type, with the result being
+// semantically equivalent but with all lists and sets represented as tuples,
+// and maps as objects, due to ambiguities of the serialization.
+func (v DynamicValue) ImpliedType() (cty.Type, error) {
+        return ctymsgpack.ImpliedType([]byte(v))
+}
+
+// Copy produces a copy of the receiver with a distinct backing array.
+func (v DynamicValue) Copy() DynamicValue {
+        if v == nil {
+                return nil
+        }
+
+        ret := make(DynamicValue, len(v))
+        copy(ret, v)
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/objchange/all_null.go b/vendor/github.com/hashicorp/terraform/plans/objchange/all_null.go
new file mode 100644
index 0000000..18a7e99
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/objchange/all_null.go
@@ -0,0 +1,18 @@
+package objchange
+
+import (
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// AllAttributesNull constructs a non-null cty.Value of the object type implied
+// by the given schema that has all of its leaf attributes set to null and all
+// of its nested block collections set to zero-length.
+//
+// This simulates what would result from decoding an empty configuration block
+// with the given schema, except that it does not produce errors
+func AllAttributesNull(schema *configschema.Block) cty.Value {
+        // "All attributes null" happens to be the definition of EmptyValue for
+        // a Block, so we can just delegate to that.
+        return schema.EmptyValue()
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/objchange/compatible.go b/vendor/github.com/hashicorp/terraform/plans/objchange/compatible.go
new file mode 100644
index 0000000..8b7ef43
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/objchange/compatible.go
@@ -0,0 +1,437 @@
+package objchange
+
+import (
+        "fmt"
+        "strconv"
+
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+
+        "github.com/hashicorp/terraform/configs/configschema"
+)
+
+// AssertObjectCompatible checks whether the given "actual" value is a valid
+// completion of the possibly-partially-unknown "planned" value.
+//
+// This means that any known leaf value in "planned" must be equal to the
+// corresponding value in "actual", and various other similar constraints.
+//
+// Any inconsistencies are reported by returning a non-zero number of errors.
+// These errors are usually (but not necessarily) cty.PathError values
+// referring to a particular nested value within the "actual" value.
+//
+// The two values must have types that conform to the given schema's implied
+// type, or this function will panic.
+func AssertObjectCompatible(schema *configschema.Block, planned, actual cty.Value) []error {
+        return assertObjectCompatible(schema, planned, actual, nil)
+}
+
+func assertObjectCompatible(schema *configschema.Block, planned, actual cty.Value, path cty.Path) []error {
+        var errs []error
+        if planned.IsNull() && !actual.IsNull() {
+                errs = append(errs, path.NewErrorf("was absent, but now present"))
+                return errs
+        }
+        if actual.IsNull() && !planned.IsNull() {
+                errs = append(errs, path.NewErrorf("was present, but now absent"))
+                return errs
+        }
+        if planned.IsNull() {
+                // No further checks possible if both values are null
+                return errs
+        }
+
+        for name, attrS := range schema.Attributes {
+                plannedV := planned.GetAttr(name)
+                actualV := actual.GetAttr(name)
+
+                path := append(path, cty.GetAttrStep{Name: name})
+                moreErrs := assertValueCompatible(plannedV, actualV, path)
+                if attrS.Sensitive {
+                        if len(moreErrs) > 0 {
+                                // Use a vague placeholder message instead, to avoid disclosing
+                                // sensitive information.
+                                errs = append(errs, path.NewErrorf("inconsistent values for sensitive attribute"))
+                        }
+                } else {
+                        errs = append(errs, moreErrs...)
+                }
+        }
+        for name, blockS := range schema.BlockTypes {
+                plannedV := planned.GetAttr(name)
+                actualV := actual.GetAttr(name)
+
+                // As a special case, if there were any blocks whose leaf attributes
+                // are all unknown then we assume (possibly incorrectly) that the
+                // HCL dynamic block extension is in use with an unknown for_each
+                // argument, and so we will do looser validation here that allows
+                // for those blocks to have expanded into a different number of blocks
+                // if the for_each value is now known.
+                maybeUnknownBlocks := couldHaveUnknownBlockPlaceholder(plannedV, blockS, false)
+
+                path := append(path, cty.GetAttrStep{Name: name})
+                switch blockS.Nesting {
+                case configschema.NestingSingle, configschema.NestingGroup:
+                        // If an unknown block placeholder was present then the placeholder
+                        // may have expanded out into zero blocks, which is okay.
+                        if maybeUnknownBlocks && actualV.IsNull() {
+                                continue
+                        }
+                        moreErrs := assertObjectCompatible(&blockS.Block, plannedV, actualV, path)
+                        errs = append(errs, moreErrs...)
+                case configschema.NestingList:
+                        // A NestingList might either be a list or a tuple, depending on
+                        // whether there are dynamically-typed attributes inside. However,
+                        // both support a similar-enough API that we can treat them the
+                        // same for our purposes here.
+                        if !plannedV.IsKnown() || plannedV.IsNull() || actualV.IsNull() {
+                                continue
+                        }
+
+                        if maybeUnknownBlocks {
+                                // When unknown blocks are present the final blocks may be
+                                // at different indices than the planned blocks, so unfortunately
+                                // we can't do our usual checks in this case without generating
+                                // false negatives.
+                                continue
+                        }
+
+                        plannedL := plannedV.LengthInt()
+                        actualL := actualV.LengthInt()
+                        if plannedL != actualL {
+                                errs = append(errs, path.NewErrorf("block count changed from %d to %d", plannedL, actualL))
+                                continue
+                        }
+                        for it := plannedV.ElementIterator(); it.Next(); {
+                                idx, plannedEV := it.Element()
+                                if !actualV.HasIndex(idx).True() {
+                                        continue
+                                }
+                                actualEV := actualV.Index(idx)
+                                moreErrs := assertObjectCompatible(&blockS.Block, plannedEV, actualEV, append(path, cty.IndexStep{Key: idx}))
+                                errs = append(errs, moreErrs...)
+                        }
+                case configschema.NestingMap:
+                        // A NestingMap might either be a map or an object, depending on
+                        // whether there are dynamically-typed attributes inside, but
+                        // that's decided statically and so both values will have the same
+                        // kind.
+                        if plannedV.Type().IsObjectType() {
+                                plannedAtys := plannedV.Type().AttributeTypes()
+                                actualAtys := actualV.Type().AttributeTypes()
+                                for k := range plannedAtys {
+                                        if _, ok := actualAtys[k]; !ok {
+                                                errs = append(errs, path.NewErrorf("block key %q has vanished", k))
+                                                continue
+                                        }
+
+                                        plannedEV := plannedV.GetAttr(k)
+                                        actualEV := actualV.GetAttr(k)
+                                        moreErrs := assertObjectCompatible(&blockS.Block, plannedEV, actualEV, append(path, cty.GetAttrStep{Name: k}))
+                                        errs = append(errs, moreErrs...)
+                                }
+                                if !maybeUnknownBlocks { // new blocks may appear if unknown blocks were present in the plan
+                                        for k := range actualAtys {
+                                                if _, ok := plannedAtys[k]; !ok {
+                                                        errs = append(errs, path.NewErrorf("new block key %q has appeared", k))
+                                                        continue
+                                                }
+                                        }
+                                }
+                        } else {
+                                if !plannedV.IsKnown() || plannedV.IsNull() || actualV.IsNull() {
+                                        continue
+                                }
+                                plannedL := plannedV.LengthInt()
+                                actualL := actualV.LengthInt()
+                                if plannedL != actualL && !maybeUnknownBlocks { // new blocks may appear if unknown blocks were persent in the plan
+                                        errs = append(errs, path.NewErrorf("block count changed from %d to %d", plannedL, actualL))
+                                        continue
+                                }
+                                for it := plannedV.ElementIterator(); it.Next(); {
+                                        idx, plannedEV := it.Element()
+                                        if !actualV.HasIndex(idx).True() {
+                                                continue
+                                        }
+                                        actualEV := actualV.Index(idx)
+                                        moreErrs := assertObjectCompatible(&blockS.Block, plannedEV, actualEV, append(path, cty.IndexStep{Key: idx}))
+                                        errs = append(errs, moreErrs...)
+                                }
+                        }
+                case configschema.NestingSet:
+                        if !plannedV.IsKnown() || !actualV.IsKnown() || plannedV.IsNull() || actualV.IsNull() {
+                                continue
+                        }
+
+                        setErrs := assertSetValuesCompatible(plannedV, actualV, path, func(plannedEV, actualEV cty.Value) bool {
+                                errs := assertObjectCompatible(&blockS.Block, plannedEV, actualEV, append(path, cty.IndexStep{Key: actualEV}))
+                                return len(errs) == 0
+                        })
+                        errs = append(errs, setErrs...)
+
+                        // There can be fewer elements in a set after its elements are all
+                        // known (values that turn out to be equal will coalesce) but the
+                        // number of elements must never get larger.
+                        plannedL := plannedV.LengthInt()
+                        actualL := actualV.LengthInt()
+                        if plannedL < actualL {
+                                errs = append(errs, path.NewErrorf("block set length changed from %d to %d", plannedL, actualL))
+                        }
+                default:
+                        panic(fmt.Sprintf("unsupported nesting mode %s", blockS.Nesting))
+                }
+        }
+        return errs
+}
+
+func assertValueCompatible(planned, actual cty.Value, path cty.Path) []error {
+        // NOTE: We don't normally use the GoString rendering of cty.Value in
+        // user-facing error messages as a rule, but we make an exception
+        // for this function because we expect the user to pass this message on
+        // verbatim to the provider development team and so more detail is better.
+
+        var errs []error
+        if planned.Type() == cty.DynamicPseudoType {
+                // Anything goes, then
+                return errs
+        }
+        if problems := planned.Type().TestConformance(actual.Type()); len(problems) > 0 {
+                errs = append(errs, path.NewErrorf("wrong final value type: %s", convert.MismatchMessage(actual.Type(), planned.Type())))
+                // If the types don't match then we can't do any other comparisons,
+                // so we bail early.
+                return errs
+        }
+
+        if !planned.IsKnown() {
+                // We didn't know what were going to end up with during plan, so
+                // anything goes during apply.
+                return errs
+        }
+
+        if actual.IsNull() {
+                if planned.IsNull() {
+                        return nil
+                }
+                errs = append(errs, path.NewErrorf("was %#v, but now null", planned))
+                return errs
+        }
+        if planned.IsNull() {
+                errs = append(errs, path.NewErrorf("was null, but now %#v", actual))
+                return errs
+        }
+
+        ty := planned.Type()
+        switch {
+
+        case !actual.IsKnown():
+                errs = append(errs, path.NewErrorf("was known, but now unknown"))
+
+        case ty.IsPrimitiveType():
+                if !actual.Equals(planned).True() {
+                        errs = append(errs, path.NewErrorf("was %#v, but now %#v", planned, actual))
+                }
+
+        case ty.IsListType() || ty.IsMapType() || ty.IsTupleType():
+                for it := planned.ElementIterator(); it.Next(); {
+                        k, plannedV := it.Element()
+                        if !actual.HasIndex(k).True() {
+                                errs = append(errs, path.NewErrorf("element %s has vanished", indexStrForErrors(k)))
+                                continue
+                        }
+
+                        actualV := actual.Index(k)
+                        moreErrs := assertValueCompatible(plannedV, actualV, append(path, cty.IndexStep{Key: k}))
+                        errs = append(errs, moreErrs...)
+                }
+
+                for it := actual.ElementIterator(); it.Next(); {
+                        k, _ := it.Element()
+                        if !planned.HasIndex(k).True() {
+                                errs = append(errs, path.NewErrorf("new element %s has appeared", indexStrForErrors(k)))
+                        }
+                }
+
+        case ty.IsObjectType():
+                atys := ty.AttributeTypes()
+                for name := range atys {
+                        // Because we already tested that the two values have the same type,
+                        // we can assume that the same attributes are present in both and
+                        // focus just on testing their values.
+                        plannedV := planned.GetAttr(name)
+                        actualV := actual.GetAttr(name)
+                        moreErrs := assertValueCompatible(plannedV, actualV, append(path, cty.GetAttrStep{Name: name}))
+                        errs = append(errs, moreErrs...)
+                }
+
+        case ty.IsSetType():
+                // We can't really do anything useful for sets here because changing
+                // an unknown element to known changes the identity of the element, and
+                // so we can't correlate them properly. However, we will at least check
+                // to ensure that the number of elements is consistent, along with
+                // the general type-match checks we ran earlier in this function.
+                if planned.IsKnown() && !planned.IsNull() && !actual.IsNull() {
+
+                        setErrs := assertSetValuesCompatible(planned, actual, path, func(plannedV, actualV cty.Value) bool {
+                                errs := assertValueCompatible(plannedV, actualV, append(path, cty.IndexStep{Key: actualV}))
+                                return len(errs) == 0
+                        })
+                        errs = append(errs, setErrs...)
+
+                        // There can be fewer elements in a set after its elements are all
+                        // known (values that turn out to be equal will coalesce) but the
+                        // number of elements must never get larger.
+
+                        plannedL := planned.LengthInt()
+                        actualL := actual.LengthInt()
+                        if plannedL < actualL {
+                                errs = append(errs, path.NewErrorf("length changed from %d to %d", plannedL, actualL))
+                        }
+                }
+        }
+
+        return errs
+}
+
+func indexStrForErrors(v cty.Value) string {
+        switch v.Type() {
+        case cty.Number:
+                return v.AsBigFloat().Text('f', -1)
+        case cty.String:
+                return strconv.Quote(v.AsString())
+        default:
+                // Should be impossible, since no other index types are allowed!
+                return fmt.Sprintf("%#v", v)
+        }
+}
+
+// couldHaveUnknownBlockPlaceholder is a heuristic that recognizes how the
+// HCL dynamic block extension behaves when it's asked to expand a block whose
+// for_each argument is unknown. In such cases, it generates a single placeholder
+// block with all leaf attribute values unknown, and once the for_each
+// expression becomes known the placeholder may be replaced with any number
+// of blocks, so object compatibility checks would need to be more liberal.
+//
+// Set "nested" if testing a block that is nested inside a candidate block
+// placeholder; this changes the interpretation of there being no blocks of
+// a type to allow for there being zero nested blocks.
+func couldHaveUnknownBlockPlaceholder(v cty.Value, blockS *configschema.NestedBlock, nested bool) bool {
+        switch blockS.Nesting {
+        case configschema.NestingSingle, configschema.NestingGroup:
+                if nested && v.IsNull() {
+                        return true // for nested blocks, a single block being unset doesn't disqualify from being an unknown block placeholder
+                }
+                return couldBeUnknownBlockPlaceholderElement(v, &blockS.Block)
+        default:
+                // These situations should be impossible for correct providers, but
+                // we permit the legacy SDK to produce some incorrect outcomes
+                // for compatibility with its existing logic, and so we must be
+                // tolerant here.
+                if !v.IsKnown() {
+                        return true
+                }
+                if v.IsNull() {
+                        return false // treated as if the list were empty, so we would see zero iterations below
+                }
+
+                // For all other nesting modes, our value should be something iterable.
+                for it := v.ElementIterator(); it.Next(); {
+                        _, ev := it.Element()
+                        if couldBeUnknownBlockPlaceholderElement(ev, &blockS.Block) {
+                                return true
+                        }
+                }
+
+                // Our default changes depending on whether we're testing the candidate
+                // block itself or something nested inside of it: zero blocks of a type
+                // can never contain a dynamic block placeholder, but a dynamic block
+                // placeholder might contain zero blocks of one of its own nested block
+                // types, if none were set in the config at all.
+                return nested
+        }
+}
+
+func couldBeUnknownBlockPlaceholderElement(v cty.Value, schema *configschema.Block) bool {
+        if v.IsNull() {
+                return false // null value can never be a placeholder element
+        }
+        if !v.IsKnown() {
+                return true // this should never happen for well-behaved providers, but can happen with the legacy SDK opt-outs
+        }
+        for name := range schema.Attributes {
+                av := v.GetAttr(name)
+
+                // Unknown block placeholders contain only unknown or null attribute
+                // values, depending on whether or not a particular attribute was set
+                // explicitly inside the content block. Note that this is imprecise:
+                // non-placeholders can also match this, so this function can generate
+                // false positives.
+                if av.IsKnown() && !av.IsNull() {
+                        return false
+                }
+        }
+        for name, blockS := range schema.BlockTypes {
+                if !couldHaveUnknownBlockPlaceholder(v.GetAttr(name), blockS, true) {
+                        return false
+                }
+        }
+        return true
+}
+
+// assertSetValuesCompatible checks that each of the elements in a can
+// be correlated with at least one equivalent element in b and vice-versa,
+// using the given correlation function.
+//
+// This allows the number of elements in the sets to change as long as all
+// elements in both sets can be correlated, making this function safe to use
+// with sets that may contain unknown values as long as the unknown case is
+// addressed in some reasonable way in the callback function.
+//
+// The callback always recieves values from set a as its first argument and
+// values from set b in its second argument, so it is safe to use with
+// non-commutative functions.
+//
+// As with assertValueCompatible, we assume that the target audience of error
+// messages here is a provider developer (via a bug report from a user) and so
+// we intentionally violate our usual rule of keeping cty implementation
+// details out of error messages.
+func assertSetValuesCompatible(planned, actual cty.Value, path cty.Path, f func(aVal, bVal cty.Value) bool) []error {
+        a := planned
+        b := actual
+
+        // Our methodology here is a little tricky, to deal with the fact that
+        // it's impossible to directly correlate two non-equal set elements because
+        // they don't have identities separate from their values.
+        // The approach is to count the number of equivalent elements each element
+        // of a has in b and vice-versa, and then return true only if each element
+        // in both sets has at least one equivalent.
+        as := a.AsValueSlice()
+        bs := b.AsValueSlice()
+        aeqs := make([]bool, len(as))
+        beqs := make([]bool, len(bs))
+        for ai, av := range as {
+                for bi, bv := range bs {
+                        if f(av, bv) {
+                                aeqs[ai] = true
+                                beqs[bi] = true
+                        }
+                }
+        }
+
+        var errs []error
+        for i, eq := range aeqs {
+                if !eq {
+                        errs = append(errs, path.NewErrorf("planned set element %#v does not correlate with any element in actual", as[i]))
+                }
+        }
+        if len(errs) > 0 {
+                // Exit early since otherwise we're likely to generate duplicate
+                // error messages from the other perspective in the subsequent loop.
+                return errs
+        }
+        for i, eq := range beqs {
+                if !eq {
+                        errs = append(errs, path.NewErrorf("actual set element %#v does not correlate with any element in plan", bs[i]))
+                }
+        }
+        return errs
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/objchange/doc.go b/vendor/github.com/hashicorp/terraform/plans/objchange/doc.go
new file mode 100644
index 0000000..2c18a01
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/objchange/doc.go
@@ -0,0 +1,4 @@
+// Package objchange deals with the business logic of taking a prior state
+// value and a config value and producing a proposed new merged value, along
+// with other related rules in this domain.
+package objchange
diff --git a/vendor/github.com/hashicorp/terraform/plans/objchange/lcs.go b/vendor/github.com/hashicorp/terraform/plans/objchange/lcs.go
new file mode 100644
index 0000000..cbfefdd
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/objchange/lcs.go
@@ -0,0 +1,104 @@
+package objchange
+
+import (
+        "github.com/zclconf/go-cty/cty"
+)
+
+// LongestCommonSubsequence finds a sequence of values that are common to both
+// x and y, with the same relative ordering as in both collections. This result
+// is useful as a first step towards computing a diff showing added/removed
+// elements in a sequence.
+//
+// The approached used here is a "naive" one, assuming that both xs and ys will
+// generally be small in most reasonable Terraform configurations. For larger
+// lists the time/space usage may be sub-optimal.
+//
+// A pair of lists may have multiple longest common subsequences. In that
+// case, the one selected by this function is undefined.
+func LongestCommonSubsequence(xs, ys []cty.Value) []cty.Value {
+        if len(xs) == 0 || len(ys) == 0 {
+                return make([]cty.Value, 0)
+        }
+
+        c := make([]int, len(xs)*len(ys))
+        eqs := make([]bool, len(xs)*len(ys))
+        w := len(xs)
+
+        for y := 0; y < len(ys); y++ {
+                for x := 0; x < len(xs); x++ {
+                        eqV := xs[x].Equals(ys[y])
+                        eq := false
+                        if eqV.IsKnown() && eqV.True() {
+                                eq = true
+                                eqs[(w*y)+x] = true // equality tests can be expensive, so cache it
+                        }
+                        if eq {
+                                // Sequence gets one longer than for the cell at top left,
+                                // since we'd append a new item to the sequence here.
+                                if x == 0 || y == 0 {
+                                        c[(w*y)+x] = 1
+                                } else {
+                                        c[(w*y)+x] = c[(w*(y-1))+(x-1)] + 1
+                                }
+                        } else {
+                                // We follow the longest of the sequence above and the sequence
+                                // to the left of us in the matrix.
+                                l := 0
+                                u := 0
+                                if x > 0 {
+                                        l = c[(w*y)+(x-1)]
+                                }
+                                if y > 0 {
+                                        u = c[(w*(y-1))+x]
+                                }
+                                if l > u {
+                                        c[(w*y)+x] = l
+                                } else {
+                                        c[(w*y)+x] = u
+                                }
+                        }
+                }
+        }
+
+        // The bottom right cell tells us how long our longest sequence will be
+        seq := make([]cty.Value, c[len(c)-1])
+
+        // Now we will walk back from the bottom right cell, finding again all
+        // of the equal pairs to construct our sequence.
+        x := len(xs) - 1
+        y := len(ys) - 1
+        i := len(seq) - 1
+
+        for x > -1 && y > -1 {
+                if eqs[(w*y)+x] {
+                        // Add the value to our result list and then walk diagonally
+                        // up and to the left.
+                        seq[i] = xs[x]
+                        x--
+                        y--
+                        i--
+                } else {
+                        // Take the path with the greatest sequence length in the matrix.
+                        l := 0
+                        u := 0
+                        if x > 0 {
+                                l = c[(w*y)+(x-1)]
+                        }
+                        if y > 0 {
+                                u = c[(w*(y-1))+x]
+                        }
+                        if l > u {
+                                x--
+                        } else {
+                                y--
+                        }
+                }
+        }
+
+        if i > -1 {
+                // should never happen if the matrix was constructed properly
+                panic("not enough elements in sequence")
+        }
+
+        return seq
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/objchange/normalize_obj.go b/vendor/github.com/hashicorp/terraform/plans/objchange/normalize_obj.go
new file mode 100644
index 0000000..c23f44d
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/objchange/normalize_obj.go
@@ -0,0 +1,132 @@
+package objchange
+
+import (
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// NormalizeObjectFromLegacySDK takes an object that may have been generated
+// by the legacy Terraform SDK (i.e. returned from a provider with the
+// LegacyTypeSystem opt-out set) and does its best to normalize it for the
+// assumptions we would normally enforce if the provider had not opted out.
+//
+// In particular, this function guarantees that a value representing a nested
+// block will never itself be unknown or null, instead representing that as
+// a non-null value that may contain null/unknown values.
+//
+// The input value must still conform to the implied type of the given schema,
+// or else this function may produce garbage results or panic. This is usually
+// okay because type consistency is enforced when deserializing the value
+// returned from the provider over the RPC wire protocol anyway.
+func NormalizeObjectFromLegacySDK(val cty.Value, schema *configschema.Block) cty.Value {
+        if val == cty.NilVal || val.IsNull() {
+                // This should never happen in reasonable use, but we'll allow it
+                // and normalize to a null of the expected type rather than panicking
+                // below.
+                return cty.NullVal(schema.ImpliedType())
+        }
+
+        vals := make(map[string]cty.Value)
+        for name := range schema.Attributes {
+                // No normalization for attributes, since them being type-conformant
+                // is all that we require.
+                vals[name] = val.GetAttr(name)
+        }
+        for name, blockS := range schema.BlockTypes {
+                lv := val.GetAttr(name)
+
+                // Legacy SDK never generates dynamically-typed attributes and so our
+                // normalization code doesn't deal with them, but we need to make sure
+                // we still pass them through properly so that we don't interfere with
+                // objects generated by other SDKs.
+                if ty := blockS.Block.ImpliedType(); ty.HasDynamicTypes() {
+                        vals[name] = lv
+                        continue
+                }
+
+                switch blockS.Nesting {
+                case configschema.NestingSingle, configschema.NestingGroup:
+                        if lv.IsKnown() {
+                                if lv.IsNull() && blockS.Nesting == configschema.NestingGroup {
+                                        vals[name] = blockS.EmptyValue()
+                                } else {
+                                        vals[name] = NormalizeObjectFromLegacySDK(lv, &blockS.Block)
+                                }
+                        } else {
+                                vals[name] = unknownBlockStub(&blockS.Block)
+                        }
+                case configschema.NestingList:
+                        switch {
+                        case !lv.IsKnown():
+                                vals[name] = cty.ListVal([]cty.Value{unknownBlockStub(&blockS.Block)})
+                        case lv.IsNull() || lv.LengthInt() == 0:
+                                vals[name] = cty.ListValEmpty(blockS.Block.ImpliedType())
+                        default:
+                                subVals := make([]cty.Value, 0, lv.LengthInt())
+                                for it := lv.ElementIterator(); it.Next(); {
+                                        _, subVal := it.Element()
+                                        subVals = append(subVals, NormalizeObjectFromLegacySDK(subVal, &blockS.Block))
+                                }
+                                vals[name] = cty.ListVal(subVals)
+                        }
+                case configschema.NestingSet:
+                        switch {
+                        case !lv.IsKnown():
+                                vals[name] = cty.SetVal([]cty.Value{unknownBlockStub(&blockS.Block)})
+                        case lv.IsNull() || lv.LengthInt() == 0:
+                                vals[name] = cty.SetValEmpty(blockS.Block.ImpliedType())
+                        default:
+                                subVals := make([]cty.Value, 0, lv.LengthInt())
+                                for it := lv.ElementIterator(); it.Next(); {
+                                        _, subVal := it.Element()
+                                        subVals = append(subVals, NormalizeObjectFromLegacySDK(subVal, &blockS.Block))
+                                }
+                                vals[name] = cty.SetVal(subVals)
+                        }
+                default:
+                        // The legacy SDK doesn't support NestingMap, so we just assume
+                        // maps are always okay. (If not, we would've detected and returned
+                        // an error to the user before we got here.)
+                        vals[name] = lv
+                }
+        }
+        return cty.ObjectVal(vals)
+}
+
+// unknownBlockStub constructs an object value that approximates an unknown
+// block by producing a known block object with all of its leaf attribute
+// values set to unknown.
+//
+// Blocks themselves cannot be unknown, so if the legacy SDK tries to return
+// such a thing, we'll use this result instead. This convention mimics how
+// the dynamic block feature deals with being asked to iterate over an unknown
+// value, because our value-checking functions already accept this convention
+// as a special case.
+func unknownBlockStub(schema *configschema.Block) cty.Value {
+        vals := make(map[string]cty.Value)
+        for name, attrS := range schema.Attributes {
+                vals[name] = cty.UnknownVal(attrS.Type)
+        }
+        for name, blockS := range schema.BlockTypes {
+                switch blockS.Nesting {
+                case configschema.NestingSingle, configschema.NestingGroup:
+                        vals[name] = unknownBlockStub(&blockS.Block)
+                case configschema.NestingList:
+                        // In principle we may be expected to produce a tuple value here,
+                        // if there are any dynamically-typed attributes in our nested block,
+                        // but the legacy SDK doesn't support that, so we just assume it'll
+                        // never be necessary to normalize those. (Incorrect usage in any
+                        // other SDK would be caught and returned as an error before we
+                        // get here.)
+                        vals[name] = cty.ListVal([]cty.Value{unknownBlockStub(&blockS.Block)})
+                case configschema.NestingSet:
+                        vals[name] = cty.SetVal([]cty.Value{unknownBlockStub(&blockS.Block)})
+                case configschema.NestingMap:
+                        // A nesting map can never be unknown since we then wouldn't know
+                        // what the keys are. (Legacy SDK doesn't support NestingMap anyway,
+                        // so this should never arise.)
+                        vals[name] = cty.MapValEmpty(blockS.Block.ImpliedType())
+                }
+        }
+        return cty.ObjectVal(vals)
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/objchange/objchange.go b/vendor/github.com/hashicorp/terraform/plans/objchange/objchange.go
new file mode 100644
index 0000000..5a8af14
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/objchange/objchange.go
@@ -0,0 +1,390 @@
+package objchange
+
+import (
+        "fmt"
+
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/configs/configschema"
+)
+
+// ProposedNewObject constructs a proposed new object value by combining the
+// computed attribute values from "prior" with the configured attribute values
+// from "config".
+//
+// Both value must conform to the given schema's implied type, or this function
+// will panic.
+//
+// The prior value must be wholly known, but the config value may be unknown
+// or have nested unknown values.
+//
+// The merging of the two objects includes the attributes of any nested blocks,
+// which will be correlated in a manner appropriate for their nesting mode.
+// Note in particular that the correlation for blocks backed by sets is a
+// heuristic based on matching non-computed attribute values and so it may
+// produce strange results with more "extreme" cases, such as a nested set
+// block where _all_ attributes are computed.
+func ProposedNewObject(schema *configschema.Block, prior, config cty.Value) cty.Value {
+        // If the config and prior are both null, return early here before
+        // populating the prior block. The prevents non-null blocks from appearing
+        // the proposed state value.
+        if config.IsNull() && prior.IsNull() {
+                return prior
+        }
+
+        if prior.IsNull() {
+                // In this case, we will construct a synthetic prior value that is
+                // similar to the result of decoding an empty configuration block,
+                // which simplifies our handling of the top-level attributes/blocks
+                // below by giving us one non-null level of object to pull values from.
+                prior = AllAttributesNull(schema)
+        }
+        return proposedNewObject(schema, prior, config)
+}
+
+// PlannedDataResourceObject is similar to ProposedNewObject but tailored for
+// planning data resources in particular. Specifically, it replaces the values
+// of any Computed attributes not set in the configuration with an unknown
+// value, which serves as a placeholder for a value to be filled in by the
+// provider when the data resource is finally read.
+//
+// Data resources are different because the planning of them is handled
+// entirely within Terraform Core and not subject to customization by the
+// provider. This function is, in effect, producing an equivalent result to
+// passing the ProposedNewObject result into a provider's PlanResourceChange
+// function, assuming a fixed implementation of PlanResourceChange that just
+// fills in unknown values as needed.
+func PlannedDataResourceObject(schema *configschema.Block, config cty.Value) cty.Value {
+        // Our trick here is to run the ProposedNewObject logic with an
+        // entirely-unknown prior value. Because of cty's unknown short-circuit
+        // behavior, any operation on prior returns another unknown, and so
+        // unknown values propagate into all of the parts of the resulting value
+        // that would normally be filled in by preserving the prior state.
+        prior := cty.UnknownVal(schema.ImpliedType())
+        return proposedNewObject(schema, prior, config)
+}
+
+func proposedNewObject(schema *configschema.Block, prior, config cty.Value) cty.Value {
+        if config.IsNull() || !config.IsKnown() {
+                // This is a weird situation, but we'll allow it anyway to free
+                // callers from needing to specifically check for these cases.
+                return prior
+        }
+        if (!prior.Type().IsObjectType()) || (!config.Type().IsObjectType()) {
+                panic("ProposedNewObject only supports object-typed values")
+        }
+
+        // From this point onwards, we can assume that both values are non-null
+        // object types, and that the config value itself is known (though it
+        // may contain nested values that are unknown.)
+
+        newAttrs := map[string]cty.Value{}
+        for name, attr := range schema.Attributes {
+                priorV := prior.GetAttr(name)
+                configV := config.GetAttr(name)
+                var newV cty.Value
+                switch {
+                case attr.Computed && attr.Optional:
+                        // This is the trickiest scenario: we want to keep the prior value
+                        // if the config isn't overriding it. Note that due to some
+                        // ambiguity here, setting an optional+computed attribute from
+                        // config and then later switching the config to null in a
+                        // subsequent change causes the initial config value to be "sticky"
+                        // unless the provider specifically overrides it during its own
+                        // plan customization step.
+                        if configV.IsNull() {
+                                newV = priorV
+                        } else {
+                                newV = configV
+                        }
+                case attr.Computed:
+                        // configV will always be null in this case, by definition.
+                        // priorV may also be null, but that's okay.
+                        newV = priorV
+                default:
+                        // For non-computed attributes, we always take the config value,
+                        // even if it is null. If it's _required_ then null values
+                        // should've been caught during an earlier validation step, and
+                        // so we don't really care about that here.
+                        newV = configV
+                }
+                newAttrs[name] = newV
+        }
+
+        // Merging nested blocks is a little more complex, since we need to
+        // correlate blocks between both objects and then recursively propose
+        // a new object for each. The correlation logic depends on the nesting
+        // mode for each block type.
+        for name, blockType := range schema.BlockTypes {
+                priorV := prior.GetAttr(name)
+                configV := config.GetAttr(name)
+                var newV cty.Value
+                switch blockType.Nesting {
+
+                case configschema.NestingSingle, configschema.NestingGroup:
+                        newV = ProposedNewObject(&blockType.Block, priorV, configV)
+
+                case configschema.NestingList:
+                        // Nested blocks are correlated by index.
+                        configVLen := 0
+                        if configV.IsKnown() && !configV.IsNull() {
+                                configVLen = configV.LengthInt()
+                        }
+                        if configVLen > 0 {
+                                newVals := make([]cty.Value, 0, configVLen)
+                                for it := configV.ElementIterator(); it.Next(); {
+                                        idx, configEV := it.Element()
+                                        if priorV.IsKnown() && (priorV.IsNull() || !priorV.HasIndex(idx).True()) {
+                                                // If there is no corresponding prior element then
+                                                // we just take the config value as-is.
+                                                newVals = append(newVals, configEV)
+                                                continue
+                                        }
+                                        priorEV := priorV.Index(idx)
+
+                                        newEV := ProposedNewObject(&blockType.Block, priorEV, configEV)
+                                        newVals = append(newVals, newEV)
+                                }
+                                // Despite the name, a NestingList might also be a tuple, if
+                                // its nested schema contains dynamically-typed attributes.
+                                if configV.Type().IsTupleType() {
+                                        newV = cty.TupleVal(newVals)
+                                } else {
+                                        newV = cty.ListVal(newVals)
+                                }
+                        } else {
+                                // Despite the name, a NestingList might also be a tuple, if
+                                // its nested schema contains dynamically-typed attributes.
+                                if configV.Type().IsTupleType() {
+                                        newV = cty.EmptyTupleVal
+                                } else {
+                                        newV = cty.ListValEmpty(blockType.ImpliedType())
+                                }
+                        }
+
+                case configschema.NestingMap:
+                        // Despite the name, a NestingMap may produce either a map or
+                        // object value, depending on whether the nested schema contains
+                        // dynamically-typed attributes.
+                        if configV.Type().IsObjectType() {
+                                // Nested blocks are correlated by key.
+                                configVLen := 0
+                                if configV.IsKnown() && !configV.IsNull() {
+                                        configVLen = configV.LengthInt()
+                                }
+                                if configVLen > 0 {
+                                        newVals := make(map[string]cty.Value, configVLen)
+                                        atys := configV.Type().AttributeTypes()
+                                        for name := range atys {
+                                                configEV := configV.GetAttr(name)
+                                                if !priorV.IsKnown() || priorV.IsNull() || !priorV.Type().HasAttribute(name) {
+                                                        // If there is no corresponding prior element then
+                                                        // we just take the config value as-is.
+                                                        newVals[name] = configEV
+                                                        continue
+                                                }
+                                                priorEV := priorV.GetAttr(name)
+
+                                                newEV := ProposedNewObject(&blockType.Block, priorEV, configEV)
+                                                newVals[name] = newEV
+                                        }
+                                        // Although we call the nesting mode "map", we actually use
+                                        // object values so that elements might have different types
+                                        // in case of dynamically-typed attributes.
+                                        newV = cty.ObjectVal(newVals)
+                                } else {
+                                        newV = cty.EmptyObjectVal
+                                }
+                        } else {
+                                configVLen := 0
+                                if configV.IsKnown() && !configV.IsNull() {
+                                        configVLen = configV.LengthInt()
+                                }
+                                if configVLen > 0 {
+                                        newVals := make(map[string]cty.Value, configVLen)
+                                        for it := configV.ElementIterator(); it.Next(); {
+                                                idx, configEV := it.Element()
+                                                k := idx.AsString()
+                                                if priorV.IsKnown() && (priorV.IsNull() || !priorV.HasIndex(idx).True()) {
+                                                        // If there is no corresponding prior element then
+                                                        // we just take the config value as-is.
+                                                        newVals[k] = configEV
+                                                        continue
+                                                }
+                                                priorEV := priorV.Index(idx)
+
+                                                newEV := ProposedNewObject(&blockType.Block, priorEV, configEV)
+                                                newVals[k] = newEV
+                                        }
+                                        newV = cty.MapVal(newVals)
+                                } else {
+                                        newV = cty.MapValEmpty(blockType.ImpliedType())
+                                }
+                        }
+
+                case configschema.NestingSet:
+                        if !configV.Type().IsSetType() {
+                                panic("configschema.NestingSet value is not a set as expected")
+                        }
+
+                        // Nested blocks are correlated by comparing the element values
+                        // after eliminating all of the computed attributes. In practice,
+                        // this means that any config change produces an entirely new
+                        // nested object, and we only propagate prior computed values
+                        // if the non-computed attribute values are identical.
+                        var cmpVals [][2]cty.Value
+                        if priorV.IsKnown() && !priorV.IsNull() {
+                                cmpVals = setElementCompareValues(&blockType.Block, priorV, false)
+                        }
+                        configVLen := 0
+                        if configV.IsKnown() && !configV.IsNull() {
+                                configVLen = configV.LengthInt()
+                        }
+                        if configVLen > 0 {
+                                used := make([]bool, len(cmpVals)) // track used elements in case multiple have the same compare value
+                                newVals := make([]cty.Value, 0, configVLen)
+                                for it := configV.ElementIterator(); it.Next(); {
+                                        _, configEV := it.Element()
+                                        var priorEV cty.Value
+                                        for i, cmp := range cmpVals {
+                                                if used[i] {
+                                                        continue
+                                                }
+                                                if cmp[1].RawEquals(configEV) {
+                                                        priorEV = cmp[0]
+                                                        used[i] = true // we can't use this value on a future iteration
+                                                        break
+                                                }
+                                        }
+                                        if priorEV == cty.NilVal {
+                                                priorEV = cty.NullVal(blockType.ImpliedType())
+                                        }
+
+                                        newEV := ProposedNewObject(&blockType.Block, priorEV, configEV)
+                                        newVals = append(newVals, newEV)
+                                }
+                                newV = cty.SetVal(newVals)
+                        } else {
+                                newV = cty.SetValEmpty(blockType.Block.ImpliedType())
+                        }
+
+                default:
+                        // Should never happen, since the above cases are comprehensive.
+                        panic(fmt.Sprintf("unsupported block nesting mode %s", blockType.Nesting))
+                }
+
+                newAttrs[name] = newV
+        }
+
+        return cty.ObjectVal(newAttrs)
+}
+
+// setElementCompareValues takes a known, non-null value of a cty.Set type and
+// returns a table -- constructed of two-element arrays -- that maps original
+// set element values to corresponding values that have all of the computed
+// values removed, making them suitable for comparison with values obtained
+// from configuration. The element type of the set must conform to the implied
+// type of the given schema, or this function will panic.
+//
+// In the resulting slice, the zeroth element of each array is the original
+// value and the one-indexed element is the corresponding "compare value".
+//
+// This is intended to help correlate prior elements with configured elements
+// in ProposedNewObject. The result is a heuristic rather than an exact science,
+// since e.g. two separate elements may reduce to the same value through this
+// process. The caller must therefore be ready to deal with duplicates.
+func setElementCompareValues(schema *configschema.Block, set cty.Value, isConfig bool) [][2]cty.Value {
+        ret := make([][2]cty.Value, 0, set.LengthInt())
+        for it := set.ElementIterator(); it.Next(); {
+                _, ev := it.Element()
+                ret = append(ret, [2]cty.Value{ev, setElementCompareValue(schema, ev, isConfig)})
+        }
+        return ret
+}
+
+// setElementCompareValue creates a new value that has all of the same
+// non-computed attribute values as the one given but has all computed
+// attribute values forced to null.
+//
+// If isConfig is true then non-null Optional+Computed attribute values will
+// be preserved. Otherwise, they will also be set to null.
+//
+// The input value must conform to the schema's implied type, and the return
+// value is guaranteed to conform to it.
+func setElementCompareValue(schema *configschema.Block, v cty.Value, isConfig bool) cty.Value {
+        if v.IsNull() || !v.IsKnown() {
+                return v
+        }
+
+        attrs := map[string]cty.Value{}
+        for name, attr := range schema.Attributes {
+                switch {
+                case attr.Computed && attr.Optional:
+                        if isConfig {
+                                attrs[name] = v.GetAttr(name)
+                        } else {
+                                attrs[name] = cty.NullVal(attr.Type)
+                        }
+                case attr.Computed:
+                        attrs[name] = cty.NullVal(attr.Type)
+                default:
+                        attrs[name] = v.GetAttr(name)
+                }
+        }
+
+        for name, blockType := range schema.BlockTypes {
+                switch blockType.Nesting {
+
+                case configschema.NestingSingle, configschema.NestingGroup:
+                        attrs[name] = setElementCompareValue(&blockType.Block, v.GetAttr(name), isConfig)
+
+                case configschema.NestingList, configschema.NestingSet:
+                        cv := v.GetAttr(name)
+                        if cv.IsNull() || !cv.IsKnown() {
+                                attrs[name] = cv
+                                continue
+                        }
+                        if l := cv.LengthInt(); l > 0 {
+                                elems := make([]cty.Value, 0, l)
+                                for it := cv.ElementIterator(); it.Next(); {
+                                        _, ev := it.Element()
+                                        elems = append(elems, setElementCompareValue(&blockType.Block, ev, isConfig))
+                                }
+                                if blockType.Nesting == configschema.NestingSet {
+                                        // SetValEmpty would panic if given elements that are not
+                                        // all of the same type, but that's guaranteed not to
+                                        // happen here because our input value was _already_ a
+                                        // set and we've not changed the types of any elements here.
+                                        attrs[name] = cty.SetVal(elems)
+                                } else {
+                                        attrs[name] = cty.TupleVal(elems)
+                                }
+                        } else {
+                                if blockType.Nesting == configschema.NestingSet {
+                                        attrs[name] = cty.SetValEmpty(blockType.Block.ImpliedType())
+                                } else {
+                                        attrs[name] = cty.EmptyTupleVal
+                                }
+                        }
+
+                case configschema.NestingMap:
+                        cv := v.GetAttr(name)
+                        if cv.IsNull() || !cv.IsKnown() {
+                                attrs[name] = cv
+                                continue
+                        }
+                        elems := make(map[string]cty.Value)
+                        for it := cv.ElementIterator(); it.Next(); {
+                                kv, ev := it.Element()
+                                elems[kv.AsString()] = setElementCompareValue(&blockType.Block, ev, isConfig)
+                        }
+                        attrs[name] = cty.ObjectVal(elems)
+
+                default:
+                        // Should never happen, since the above cases are comprehensive.
+                        panic(fmt.Sprintf("unsupported block nesting mode %s", blockType.Nesting))
+                }
+        }
+
+        return cty.ObjectVal(attrs)
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/objchange/plan_valid.go b/vendor/github.com/hashicorp/terraform/plans/objchange/plan_valid.go
new file mode 100644
index 0000000..69acb89
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/objchange/plan_valid.go
@@ -0,0 +1,267 @@
+package objchange
+
+import (
+        "fmt"
+
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/configs/configschema"
+)
+
+// AssertPlanValid checks checks whether a planned new state returned by a
+// provider's PlanResourceChange method is suitable to achieve a change
+// from priorState to config. It returns a slice with nonzero length if
+// any problems are detected. Because problems here indicate bugs in the
+// provider that generated the plannedState, they are written with provider
+// developers as an audience, rather than end-users.
+//
+// All of the given values must have the same type and must conform to the
+// implied type of the given schema, or this function may panic or produce
+// garbage results.
+//
+// During planning, a provider may only make changes to attributes that are
+// null (unset) in the configuration and are marked as "computed" in the
+// resource type schema, in order to insert any default values the provider
+// may know about. If the default value cannot be determined until apply time,
+// the provider can return an unknown value. Providers are forbidden from
+// planning a change that disagrees with any non-null argument in the
+// configuration.
+//
+// As a special exception, providers _are_ allowed to provide attribute values
+// conflicting with configuration if and only if the planned value exactly
+// matches the corresponding attribute value in the prior state. The provider
+// can use this to signal that the new value is functionally equivalent to
+// the old and thus no change is required.
+func AssertPlanValid(schema *configschema.Block, priorState, config, plannedState cty.Value) []error {
+        return assertPlanValid(schema, priorState, config, plannedState, nil)
+}
+
+func assertPlanValid(schema *configschema.Block, priorState, config, plannedState cty.Value, path cty.Path) []error {
+        var errs []error
+        if plannedState.IsNull() && !config.IsNull() {
+                errs = append(errs, path.NewErrorf("planned for absense but config wants existence"))
+                return errs
+        }
+        if config.IsNull() && !plannedState.IsNull() {
+                errs = append(errs, path.NewErrorf("planned for existence but config wants absense"))
+                return errs
+        }
+        if plannedState.IsNull() {
+                // No further checks possible if the planned value is null
+                return errs
+        }
+
+        impTy := schema.ImpliedType()
+
+        for name, attrS := range schema.Attributes {
+                plannedV := plannedState.GetAttr(name)
+                configV := config.GetAttr(name)
+                priorV := cty.NullVal(attrS.Type)
+                if !priorState.IsNull() {
+                        priorV = priorState.GetAttr(name)
+                }
+
+                path := append(path, cty.GetAttrStep{Name: name})
+                moreErrs := assertPlannedValueValid(attrS, priorV, configV, plannedV, path)
+                errs = append(errs, moreErrs...)
+        }
+        for name, blockS := range schema.BlockTypes {
+                path := append(path, cty.GetAttrStep{Name: name})
+                plannedV := plannedState.GetAttr(name)
+                configV := config.GetAttr(name)
+                priorV := cty.NullVal(impTy.AttributeType(name))
+                if !priorState.IsNull() {
+                        priorV = priorState.GetAttr(name)
+                }
+                if plannedV.RawEquals(configV) {
+                        // Easy path: nothing has changed at all
+                        continue
+                }
+                if !plannedV.IsKnown() {
+                        errs = append(errs, path.NewErrorf("attribute representing nested block must not be unknown itself; set nested attribute values to unknown instead"))
+                        continue
+                }
+
+                switch blockS.Nesting {
+                case configschema.NestingSingle, configschema.NestingGroup:
+                        moreErrs := assertPlanValid(&blockS.Block, priorV, configV, plannedV, path)
+                        errs = append(errs, moreErrs...)
+                case configschema.NestingList:
+                        // A NestingList might either be a list or a tuple, depending on
+                        // whether there are dynamically-typed attributes inside. However,
+                        // both support a similar-enough API that we can treat them the
+                        // same for our purposes here.
+                        if plannedV.IsNull() {
+                                errs = append(errs, path.NewErrorf("attribute representing a list of nested blocks must be empty to indicate no blocks, not null"))
+                                continue
+                        }
+
+                        plannedL := plannedV.LengthInt()
+                        configL := configV.LengthInt()
+                        if plannedL != configL {
+                                errs = append(errs, path.NewErrorf("block count in plan (%d) disagrees with count in config (%d)", plannedL, configL))
+                                continue
+                        }
+                        for it := plannedV.ElementIterator(); it.Next(); {
+                                idx, plannedEV := it.Element()
+                                path := append(path, cty.IndexStep{Key: idx})
+                                if !plannedEV.IsKnown() {
+                                        errs = append(errs, path.NewErrorf("element representing nested block must not be unknown itself; set nested attribute values to unknown instead"))
+                                        continue
+                                }
+                                if !configV.HasIndex(idx).True() {
+                                        continue // should never happen since we checked the lengths above
+                                }
+                                configEV := configV.Index(idx)
+                                priorEV := cty.NullVal(blockS.ImpliedType())
+                                if !priorV.IsNull() && priorV.HasIndex(idx).True() {
+                                        priorEV = priorV.Index(idx)
+                                }
+
+                                moreErrs := assertPlanValid(&blockS.Block, priorEV, configEV, plannedEV, path)
+                                errs = append(errs, moreErrs...)
+                        }
+                case configschema.NestingMap:
+                        if plannedV.IsNull() {
+                                errs = append(errs, path.NewErrorf("attribute representing a map of nested blocks must be empty to indicate no blocks, not null"))
+                                continue
+                        }
+
+                        // A NestingMap might either be a map or an object, depending on
+                        // whether there are dynamically-typed attributes inside, but
+                        // that's decided statically and so all values will have the same
+                        // kind.
+                        if plannedV.Type().IsObjectType() {
+                                plannedAtys := plannedV.Type().AttributeTypes()
+                                configAtys := configV.Type().AttributeTypes()
+                                for k := range plannedAtys {
+                                        if _, ok := configAtys[k]; !ok {
+                                                errs = append(errs, path.NewErrorf("block key %q from plan is not present in config", k))
+                                                continue
+                                        }
+                                        path := append(path, cty.GetAttrStep{Name: k})
+
+                                        plannedEV := plannedV.GetAttr(k)
+                                        if !plannedEV.IsKnown() {
+                                                errs = append(errs, path.NewErrorf("element representing nested block must not be unknown itself; set nested attribute values to unknown instead"))
+                                                continue
+                                        }
+                                        configEV := configV.GetAttr(k)
+                                        priorEV := cty.NullVal(blockS.ImpliedType())
+                                        if !priorV.IsNull() && priorV.Type().HasAttribute(k) {
+                                                priorEV = priorV.GetAttr(k)
+                                        }
+                                        moreErrs := assertPlanValid(&blockS.Block, priorEV, configEV, plannedEV, path)
+                                        errs = append(errs, moreErrs...)
+                                }
+                                for k := range configAtys {
+                                        if _, ok := plannedAtys[k]; !ok {
+                                                errs = append(errs, path.NewErrorf("block key %q from config is not present in plan", k))
+                                                continue
+                                        }
+                                }
+                        } else {
+                                plannedL := plannedV.LengthInt()
+                                configL := configV.LengthInt()
+                                if plannedL != configL {
+                                        errs = append(errs, path.NewErrorf("block count in plan (%d) disagrees with count in config (%d)", plannedL, configL))
+                                        continue
+                                }
+                                for it := plannedV.ElementIterator(); it.Next(); {
+                                        idx, plannedEV := it.Element()
+                                        path := append(path, cty.IndexStep{Key: idx})
+                                        if !plannedEV.IsKnown() {
+                                                errs = append(errs, path.NewErrorf("element representing nested block must not be unknown itself; set nested attribute values to unknown instead"))
+                                                continue
+                                        }
+                                        k := idx.AsString()
+                                        if !configV.HasIndex(idx).True() {
+                                                errs = append(errs, path.NewErrorf("block key %q from plan is not present in config", k))
+                                                continue
+                                        }
+                                        configEV := configV.Index(idx)
+                                        priorEV := cty.NullVal(blockS.ImpliedType())
+                                        if !priorV.IsNull() && priorV.HasIndex(idx).True() {
+                                                priorEV = priorV.Index(idx)
+                                        }
+                                        moreErrs := assertPlanValid(&blockS.Block, priorEV, configEV, plannedEV, path)
+                                        errs = append(errs, moreErrs...)
+                                }
+                                for it := configV.ElementIterator(); it.Next(); {
+                                        idx, _ := it.Element()
+                                        if !plannedV.HasIndex(idx).True() {
+                                                errs = append(errs, path.NewErrorf("block key %q from config is not present in plan", idx.AsString()))
+                                                continue
+                                        }
+                                }
+                        }
+                case configschema.NestingSet:
+                        if plannedV.IsNull() {
+                                errs = append(errs, path.NewErrorf("attribute representing a set of nested blocks must be empty to indicate no blocks, not null"))
+                                continue
+                        }
+
+                        // Because set elements have no identifier with which to correlate
+                        // them, we can't robustly validate the plan for a nested block
+                        // backed by a set, and so unfortunately we need to just trust the
+                        // provider to do the right thing. :(
+                        //
+                        // (In principle we could correlate elements by matching the
+                        // subset of attributes explicitly set in config, except for the
+                        // special diff suppression rule which allows for there to be a
+                        // planned value that is constructed by mixing part of a prior
+                        // value with part of a config value, creating an entirely new
+                        // element that is not present in either prior nor config.)
+                        for it := plannedV.ElementIterator(); it.Next(); {
+                                idx, plannedEV := it.Element()
+                                path := append(path, cty.IndexStep{Key: idx})
+                                if !plannedEV.IsKnown() {
+                                        errs = append(errs, path.NewErrorf("element representing nested block must not be unknown itself; set nested attribute values to unknown instead"))
+                                        continue
+                                }
+                        }
+
+                default:
+                        panic(fmt.Sprintf("unsupported nesting mode %s", blockS.Nesting))
+                }
+        }
+
+        return errs
+}
+
+func assertPlannedValueValid(attrS *configschema.Attribute, priorV, configV, plannedV cty.Value, path cty.Path) []error {
+        var errs []error
+        if plannedV.RawEquals(configV) {
+                // This is the easy path: provider didn't change anything at all.
+                return errs
+        }
+        if plannedV.RawEquals(priorV) && !priorV.IsNull() {
+                // Also pretty easy: there is a prior value and the provider has
+                // returned it unchanged. This indicates that configV and plannedV
+                // are functionally equivalent and so the provider wishes to disregard
+                // the configuration value in favor of the prior.
+                return errs
+        }
+        if attrS.Computed && configV.IsNull() {
+                // The provider is allowed to change the value of any computed
+                // attribute that isn't explicitly set in the config.
+                return errs
+        }
+
+        // If none of the above conditions match, the provider has made an invalid
+        // change to this attribute.
+        if priorV.IsNull() {
+                if attrS.Sensitive {
+                        errs = append(errs, path.NewErrorf("sensitive planned value does not match config value"))
+                } else {
+                        errs = append(errs, path.NewErrorf("planned value %#v does not match config value %#v", plannedV, configV))
+                }
+                return errs
+        }
+        if attrS.Sensitive {
+                errs = append(errs, path.NewErrorf("sensitive planned value does not match config value nor prior value"))
+        } else {
+                errs = append(errs, path.NewErrorf("planned value %#v does not match config value %#v nor prior value %#v", plannedV, configV, priorV))
+        }
+        return errs
+}
diff --git a/vendor/github.com/hashicorp/terraform/plans/plan.go b/vendor/github.com/hashicorp/terraform/plans/plan.go
new file mode 100644
index 0000000..5a3e454
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plans/plan.go
@@ -0,0 +1,92 @@
+package plans
+
+import (
+        "sort"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Plan is the top-level type representing a planned set of changes.
+//
+// A plan is a summary of the set of changes required to move from a current
+// state to a goal state derived from configuration. The described changes
+// are not applied directly, but contain an approximation of the final
+// result that will be completed during apply by resolving any values that
+// cannot be predicted.
+//
+// A plan must always be accompanied by the state and configuration it was
+// built from, since the plan does not itself include all of the information
+// required to make the changes indicated.
+type Plan struct {
+        VariableValues  map[string]DynamicValue
+        Changes         *Changes
+        TargetAddrs     []addrs.Targetable
+        ProviderSHA256s map[string][]byte
+        Backend         Backend
+}
+
+// Backend represents the backend-related configuration and other data as it
+// existed when a plan was created.
+type Backend struct {
+        // Type is the type of backend that the plan will apply against.
+        Type string
+
+        // Config is the configuration of the backend, whose schema is decided by
+        // the backend Type.
+        Config DynamicValue
+
+        // Workspace is the name of the workspace that was active when the plan
+        // was created. It is illegal to apply a plan created for one workspace
+        // to the state of another workspace.
+        // (This constraint is already enforced by the statefile lineage mechanism,
+        // but storing this explicitly allows us to return a better error message
+        // in the situation where the user has the wrong workspace selected.)
+        Workspace string
+}
+
+func NewBackend(typeName string, config cty.Value, configSchema *configschema.Block, workspaceName string) (*Backend, error) {
+        dv, err := NewDynamicValue(config, configSchema.ImpliedType())
+        if err != nil {
+                return nil, err
+        }
+
+        return &Backend{
+                Type:      typeName,
+                Config:    dv,
+                Workspace: workspaceName,
+        }, nil
+}
+
+// ProviderAddrs returns a list of all of the provider configuration addresses
+// referenced throughout the receiving plan.
+//
+// The result is de-duplicated so that each distinct address appears only once.
+func (p *Plan) ProviderAddrs() []addrs.AbsProviderConfig {
+        if p == nil || p.Changes == nil {
+                return nil
+        }
+
+        m := map[string]addrs.AbsProviderConfig{}
+        for _, rc := range p.Changes.Resources {
+                m[rc.ProviderAddr.String()] = rc.ProviderAddr
+        }
+        if len(m) == 0 {
+                return nil
+        }
+
+        // This is mainly just so we'll get stable results for testing purposes.
+        keys := make([]string, 0, len(m))
+        for k := range m {
+                keys = append(keys, k)
+        }
+        sort.Strings(keys)
+
+        ret := make([]addrs.AbsProviderConfig, len(keys))
+        for i, key := range keys {
+                ret[i] = m[key]
+        }
+
+        return ret
+}