vendor: github.com/hashicorp/terraform/...@v0.10.0

46 files changed, 2538 insertions, 204 deletions

diff --git a/vendor/github.com/hashicorp/terraform/config/config.go b/vendor/github.com/hashicorp/terraform/config/config.go
index a157824..3f756dc 100644
--- a/vendor/github.com/hashicorp/terraform/config/config.go
+++ b/vendor/github.com/hashicorp/terraform/config/config.go
@@ -12,6 +12,7 @@ import (
         "github.com/hashicorp/hil"
         "github.com/hashicorp/hil/ast"
         "github.com/hashicorp/terraform/helper/hilmapstructure"
+        "github.com/hashicorp/terraform/plugin/discovery"
         "github.com/mitchellh/reflectwalk"
 )
 
@@ -64,6 +65,7 @@ type Module struct {
 type ProviderConfig struct {
         Name      string
         Alias     string
+        Version   string
         RawConfig *RawConfig
 }
 
@@ -238,6 +240,33 @@ func (r *Resource) Id() string {
         }
 }
 
+// ProviderFullName returns the full name of the provider for this resource,
+// which may either be specified explicitly using the "provider" meta-argument
+// or implied by the prefix on the resource type name.
+func (r *Resource) ProviderFullName() string {
+        return ResourceProviderFullName(r.Type, r.Provider)
+}
+
+// ResourceProviderFullName returns the full (dependable) name of the
+// provider for a hypothetical resource with the given resource type and
+// explicit provider string. If the explicit provider string is empty then
+// the provider name is inferred from the resource type name.
+func ResourceProviderFullName(resourceType, explicitProvider string) string {
+        if explicitProvider != "" {
+                return explicitProvider
+        }
+
+        idx := strings.IndexRune(resourceType, '_')
+        if idx == -1 {
+                // If no underscores, the resource name is assumed to be
+                // also the provider name, e.g. if the provider exposes
+                // only a single resource of each type.
+                return resourceType
+        }
+
+        return resourceType[:idx]
+}
+
 // Validate does some basic semantic checking of the configuration.
 func (c *Config) Validate() error {
         if c == nil {
@@ -349,7 +378,8 @@ func (c *Config) Validate() error {
                 }
         }
 
-        // Check that providers aren't declared multiple times.
+        // Check that providers aren't declared multiple times and that their
+        // version constraints, where present, are syntactically valid.
         providerSet := make(map[string]struct{})
         for _, p := range c.ProviderConfigs {
                 name := p.FullName()
@@ -360,6 +390,16 @@ func (c *Config) Validate() error {
                         continue
                 }
 
+                if p.Version != "" {
+                        _, err := discovery.ConstraintStr(p.Version).Parse()
+                        if err != nil {
+                                errs = append(errs, fmt.Errorf(
+                                        "provider.%s: invalid version constraint %q: %s",
+                                        name, p.Version, err,
+                                ))
+                        }
+                }
+
                 providerSet[name] = struct{}{}
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/config/interpolate_funcs.go b/vendor/github.com/hashicorp/terraform/config/interpolate_funcs.go
index 7b7b3f2..a298cf2 100644
--- a/vendor/github.com/hashicorp/terraform/config/interpolate_funcs.go
+++ b/vendor/github.com/hashicorp/terraform/config/interpolate_funcs.go
@@ -70,6 +70,7 @@ func Funcs() map[string]ast.Function {
                 "coalescelist": interpolationFuncCoalesceList(),
                 "compact":      interpolationFuncCompact(),
                 "concat":       interpolationFuncConcat(),
+                "contains":     interpolationFuncContains(),
                 "dirname":      interpolationFuncDirname(),
                 "distinct":     interpolationFuncDistinct(),
                 "element":      interpolationFuncElement(),
@@ -356,6 +357,22 @@ func interpolationFuncCoalesceList() ast.Function {
         }
 }
 
+// interpolationFuncContains returns true if an element is in the list
+// and return false otherwise
+func interpolationFuncContains() ast.Function {
+        return ast.Function{
+                ArgTypes:   []ast.Type{ast.TypeList, ast.TypeString},
+                ReturnType: ast.TypeBool,
+                Callback: func(args []interface{}) (interface{}, error) {
+                        _, err := interpolationFuncIndex().Callback(args)
+                        if err != nil {
+                                return false, nil
+                        }
+                        return true, nil
+                },
+        }
+}
+
 // interpolationFuncConcat implements the "concat" function that concatenates
 // multiple lists.
 func interpolationFuncConcat() ast.Function {
diff --git a/vendor/github.com/hashicorp/terraform/config/loader.go b/vendor/github.com/hashicorp/terraform/config/loader.go
index 0bfa89c..5dd7d46 100644
--- a/vendor/github.com/hashicorp/terraform/config/loader.go
+++ b/vendor/github.com/hashicorp/terraform/config/loader.go
@@ -194,7 +194,7 @@ func dirFiles(dir string) ([]string, []string, error) {
                         // Only care about files that are valid to load
                         name := fi.Name()
                         extValue := ext(name)
-                        if extValue == "" || isIgnoredFile(name) {
+                        if extValue == "" || IsIgnoredFile(name) {
                                 continue
                         }
 
@@ -215,9 +215,9 @@ func dirFiles(dir string) ([]string, []string, error) {
         return files, overrides, nil
 }
 
-// isIgnoredFile returns true or false depending on whether the
+// IsIgnoredFile returns true or false depending on whether the
 // provided file name is a file that should be ignored.
-func isIgnoredFile(name string) bool {
+func IsIgnoredFile(name string) bool {
         return strings.HasPrefix(name, ".") || // Unix-like hidden files
                 strings.HasSuffix(name, "~") || // vim
                 strings.HasPrefix(name, "#") && strings.HasSuffix(name, "#") // emacs
diff --git a/vendor/github.com/hashicorp/terraform/config/loader_hcl.go b/vendor/github.com/hashicorp/terraform/config/loader_hcl.go
index 9abb196..e85e493 100644
--- a/vendor/github.com/hashicorp/terraform/config/loader_hcl.go
+++ b/vendor/github.com/hashicorp/terraform/config/loader_hcl.go
@@ -17,6 +17,20 @@ type hclConfigurable struct {
         Root *ast.File
 }
 
+var ReservedResourceFields = []string{
+        "connection",
+        "count",
+        "depends_on",
+        "lifecycle",
+        "provider",
+        "provisioner",
+}
+
+var ReservedProviderFields = []string{
+        "alias",
+        "version",
+}
+
 func (t *hclConfigurable) Config() (*Config, error) {
         validKeys := map[string]struct{}{
                 "atlas":     struct{}{},
@@ -562,6 +576,7 @@ func loadProvidersHcl(list *ast.ObjectList) ([]*ProviderConfig, error) {
                 }
 
                 delete(config, "alias")
+                delete(config, "version")
 
                 rawConfig, err := NewRawConfig(config)
                 if err != nil {
@@ -583,9 +598,22 @@ func loadProvidersHcl(list *ast.ObjectList) ([]*ProviderConfig, error) {
                         }
                 }
 
+                // If we have a version field then extract it
+                var version string
+                if a := listVal.Filter("version"); len(a.Items) > 0 {
+                        err := hcl.DecodeObject(&version, a.Items[0].Val)
+                        if err != nil {
+                                return nil, fmt.Errorf(
+                                        "Error reading version for provider[%s]: %s",
+                                        n,
+                                        err)
+                        }
+                }
+
                 result = append(result, &ProviderConfig{
                         Name:      n,
                         Alias:     alias,
+                        Version:   version,
                         RawConfig: rawConfig,
                 })
         }
diff --git a/vendor/github.com/hashicorp/terraform/config/module/tree.go b/vendor/github.com/hashicorp/terraform/config/module/tree.go
index b6f90fd..4b0b153 100644
--- a/vendor/github.com/hashicorp/terraform/config/module/tree.go
+++ b/vendor/github.com/hashicorp/terraform/config/module/tree.go
@@ -92,6 +92,25 @@ func (t *Tree) Children() map[string]*Tree {
         return t.children
 }
 
+// DeepEach calls the provided callback for the receiver and then all of
+// its descendents in the tree, allowing an operation to be performed on
+// all modules in the tree.
+//
+// Parents will be visited before their children but otherwise the order is
+// not defined.
+func (t *Tree) DeepEach(cb func(*Tree)) {
+        t.lock.RLock()
+        defer t.lock.RUnlock()
+        t.deepEach(cb)
+}
+
+func (t *Tree) deepEach(cb func(*Tree)) {
+        cb(t)
+        for _, c := range t.children {
+                c.deepEach(cb)
+        }
+}
+
 // Loaded says whether or not this tree has been loaded or not yet.
 func (t *Tree) Loaded() bool {
         t.lock.RLock()
diff --git a/vendor/github.com/hashicorp/terraform/config/providers.go b/vendor/github.com/hashicorp/terraform/config/providers.go
new file mode 100644
index 0000000..7a50782
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/providers.go
@@ -0,0 +1,103 @@
+package config
+
+import "github.com/blang/semver"
+
+// ProviderVersionConstraint presents a constraint for a particular
+// provider, identified by its full name.
+type ProviderVersionConstraint struct {
+        Constraint   string
+        ProviderType string
+}
+
+// ProviderVersionConstraints is a map from provider full name to its associated
+// ProviderVersionConstraint, as produced by Config.RequiredProviders.
+type ProviderVersionConstraints map[string]ProviderVersionConstraint
+
+// RequiredProviders returns the ProviderVersionConstraints for this
+// module.
+//
+// This includes both providers that are explicitly requested by provider
+// blocks and those that are used implicitly by instantiating one of their
+// resource types. In the latter case, the returned semver Range will
+// accept any version of the provider.
+func (c *Config) RequiredProviders() ProviderVersionConstraints {
+        ret := make(ProviderVersionConstraints, len(c.ProviderConfigs))
+
+        configs := c.ProviderConfigsByFullName()
+
+        // In order to find the *implied* dependencies (those without explicit
+        // "provider" blocks) we need to walk over all of the resources and
+        // cross-reference with the provider configs.
+        for _, rc := range c.Resources {
+                providerName := rc.ProviderFullName()
+                var providerType string
+
+                // Default to (effectively) no constraint whatsoever, but we might
+                // override if there's an explicit constraint in config.
+                constraint := ">=0.0.0"
+
+                config, ok := configs[providerName]
+                if ok {
+                        if config.Version != "" {
+                                constraint = config.Version
+                        }
+                        providerType = config.Name
+                } else {
+                        providerType = providerName
+                }
+
+                ret[providerName] = ProviderVersionConstraint{
+                        ProviderType: providerType,
+                        Constraint:   constraint,
+                }
+        }
+
+        return ret
+}
+
+// RequiredRanges returns a semver.Range for each distinct provider type in
+// the constraint map. If the same provider type appears more than once
+// (e.g. because aliases are in use) then their respective constraints are
+// combined such that they must *all* apply.
+//
+// The result of this method can be passed to the
+// PluginMetaSet.ConstrainVersions method within the plugin/discovery
+// package in order to filter down the available plugins to those which
+// satisfy the given constraints.
+//
+// This function will panic if any of the constraints within cannot be
+// parsed as semver ranges. This is guaranteed to never happen for a
+// constraint set that was built from a configuration that passed validation.
+func (cons ProviderVersionConstraints) RequiredRanges() map[string]semver.Range {
+        ret := make(map[string]semver.Range, len(cons))
+
+        for _, con := range cons {
+                spec := semver.MustParseRange(con.Constraint)
+                if existing, exists := ret[con.ProviderType]; exists {
+                        ret[con.ProviderType] = existing.AND(spec)
+                } else {
+                        ret[con.ProviderType] = spec
+                }
+        }
+
+        return ret
+}
+
+// ProviderConfigsByFullName returns a map from provider full names (as
+// returned by ProviderConfig.FullName()) to the corresponding provider
+// configs.
+//
+// This function returns no new information than what's already in
+// c.ProviderConfigs, but returns it in a more convenient shape. If there
+// is more than one provider config with the same full name then the result
+// is undefined, but that is guaranteed not to happen for any config that
+// has passed validation.
+func (c *Config) ProviderConfigsByFullName() map[string]*ProviderConfig {
+        ret := make(map[string]*ProviderConfig, len(c.ProviderConfigs))
+
+        for _, pc := range c.ProviderConfigs {
+                ret[pc.FullName()] = pc
+        }
+
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/flatmap/expand.go b/vendor/github.com/hashicorp/terraform/flatmap/expand.go
index e0b81b6..1449065 100644
--- a/vendor/github.com/hashicorp/terraform/flatmap/expand.go
+++ b/vendor/github.com/hashicorp/terraform/flatmap/expand.go
@@ -60,6 +60,11 @@ func expandArray(m map[string]string, prefix string) []interface{} {
                 return []interface{}{}
         }
 
+        // NOTE: "num" is not necessarily accurate, e.g. if a user tampers
+        // with state, so the following code should not crash when given a
+        // number of items more or less than what's given in num. The
+        // num key is mainly just a hint that this is a list or set.
+
         // The Schema "Set" type stores its values in an array format, but
         // using numeric hash values instead of ordinal keys. Take the set
         // of keys regardless of value, and expand them in numeric order.
@@ -101,7 +106,7 @@ func expandArray(m map[string]string, prefix string) []interface{} {
         }
         sort.Ints(keysList)
 
-        result := make([]interface{}, num)
+        result := make([]interface{}, len(keysList))
         for i, key := range keysList {
                 keyString := strconv.Itoa(key)
                 if computed[keyString] {
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/id.go b/vendor/github.com/hashicorp/terraform/helper/resource/id.go
index 629582b..1cde67c 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/id.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/id.go
@@ -1,21 +1,17 @@
 package resource
 
 import (
-        "crypto/rand"
         "fmt"
-        "math/big"
+        "strings"
         "sync"
+        "time"
 )
 
 const UniqueIdPrefix = `terraform-`
 
-// idCounter is a randomly seeded monotonic counter for generating ordered
-// unique ids.  It uses a big.Int so we can easily increment a long numeric
-// string.  The max possible hex value here with 12 random bytes is
-// "01000000000000000000000000", so there's no chance of rollover during
-// operation.
+// idCounter is a monotonic counter for generating ordered unique ids.
 var idMutex sync.Mutex
-var idCounter = big.NewInt(0).SetBytes(randomBytes(12))
+var idCounter uint32
 
 // Helper for a resource to generate a unique identifier w/ default prefix
 func UniqueId() string {
@@ -25,15 +21,20 @@ func UniqueId() string {
 // Helper for a resource to generate a unique identifier w/ given prefix
 //
 // After the prefix, the ID consists of an incrementing 26 digit value (to match
-// previous timestamp output).
+// previous timestamp output).  After the prefix, the ID consists of a timestamp
+// and an incrementing 8 hex digit value The timestamp means that multiple IDs
+// created with the same prefix will sort in the order of their creation, even
+// across multiple terraform executions, as long as the clock is not turned back
+// between calls, and as long as any given terraform execution generates fewer
+// than 4 billion IDs.
 func PrefixedUniqueId(prefix string) string {
+        // Be precise to 4 digits of fractional seconds, but remove the dot before the
+        // fractional seconds.
+        timestamp := strings.Replace(
+                time.Now().UTC().Format("20060102150405.0000"), ".", "", 1)
+
         idMutex.Lock()
         defer idMutex.Unlock()
-        return fmt.Sprintf("%s%026x", prefix, idCounter.Add(idCounter, big.NewInt(1)))
-}
-
-func randomBytes(n int) []byte {
-        b := make([]byte, n)
-        rand.Read(b)
-        return b
+        idCounter++
+        return fmt.Sprintf("%s%s%08x", prefix, timestamp, idCounter)
 }
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/testing.go b/vendor/github.com/hashicorp/terraform/helper/resource/testing.go
index ebdbde2..d7de1a0 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/testing.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/testing.go
@@ -383,11 +383,11 @@ func Test(t TestT, c TestCase) {
                 c.PreCheck()
         }
 
-        ctxProviders, err := testProviderFactories(c)
+        providerResolver, err := testProviderResolver(c)
         if err != nil {
                 t.Fatal(err)
         }
-        opts := terraform.ContextOpts{Providers: ctxProviders}
+        opts := terraform.ContextOpts{ProviderResolver: providerResolver}
 
         // A single state variable to track the lifecycle, starting with no state
         var state *terraform.State
@@ -400,15 +400,22 @@ func Test(t TestT, c TestCase) {
                 var err error
                 log.Printf("[WARN] Test: Executing step %d", i)
 
-                // Determine the test mode to execute
-                if step.Config != "" {
-                        state, err = testStepConfig(opts, state, step)
-                } else if step.ImportState {
-                        state, err = testStepImportState(opts, state, step)
-                } else {
+                if step.Config == "" && !step.ImportState {
                         err = fmt.Errorf(
                                 "unknown test mode for step. Please see TestStep docs\n\n%#v",
                                 step)
+                } else {
+                        if step.ImportState {
+                                if step.Config == "" {
+                                        step.Config = testProviderConfig(c)
+                                }
+
+                                // Can optionally set step.Config in addition to
+                                // step.ImportState, to provide config for the import.
+                                state, err = testStepImportState(opts, state, step)
+                        } else {
+                                state, err = testStepConfig(opts, state, step)
+                        }
                 }
 
                 // If there was an error, exit
@@ -496,16 +503,29 @@ func Test(t TestT, c TestCase) {
         }
 }
 
-// testProviderFactories is a helper to build the ResourceProviderFactory map
+// testProviderConfig takes the list of Providers in a TestCase and returns a
+// config with only empty provider blocks. This is useful for Import, where no
+// config is provided, but the providers must be defined.
+func testProviderConfig(c TestCase) string {
+        var lines []string
+        for p := range c.Providers {
+                lines = append(lines, fmt.Sprintf("provider %q {}\n", p))
+        }
+
+        return strings.Join(lines, "")
+}
+
+// testProviderResolver is a helper to build a ResourceProviderResolver
 // with pre instantiated ResourceProviders, so that we can reset them for the
 // test, while only calling the factory function once.
 // Any errors are stored so that they can be returned by the factory in
 // terraform to match non-test behavior.
-func testProviderFactories(c TestCase) (map[string]terraform.ResourceProviderFactory, error) {
-        ctxProviders := c.ProviderFactories // make(map[string]terraform.ResourceProviderFactory)
+func testProviderResolver(c TestCase) (terraform.ResourceProviderResolver, error) {
+        ctxProviders := c.ProviderFactories
         if ctxProviders == nil {
                 ctxProviders = make(map[string]terraform.ResourceProviderFactory)
         }
+
         // add any fixed providers
         for k, p := range c.Providers {
                 ctxProviders[k] = terraform.ResourceProviderFactoryFixed(p)
@@ -527,7 +547,7 @@ func testProviderFactories(c TestCase) (map[string]terraform.ResourceProviderFac
                 }
         }
 
-        return ctxProviders, nil
+        return terraform.ResourceProviderResolverFixed(ctxProviders), nil
 }
 
 // UnitTest is a helper to force the acceptance testing harness to run in the
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/provider.go b/vendor/github.com/hashicorp/terraform/helper/schema/provider.go
index d52d2f5..fb28b41 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/provider.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/provider.go
@@ -8,6 +8,7 @@ import (
         "sync"
 
         "github.com/hashicorp/go-multierror"
+        "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/terraform"
 )
 
@@ -89,6 +90,13 @@ func (p *Provider) InternalValidate() error {
                 validationErrors = multierror.Append(validationErrors, err)
         }
 
+        // Provider-specific checks
+        for k, _ := range sm {
+                if isReservedProviderFieldName(k) {
+                        return fmt.Errorf("%s is a reserved field name for a provider", k)
+                }
+        }
+
         for k, r := range p.ResourcesMap {
                 if err := r.InternalValidate(nil, true); err != nil {
                         validationErrors = multierror.Append(validationErrors, fmt.Errorf("resource %s: %s", k, err))
@@ -104,6 +112,15 @@ func (p *Provider) InternalValidate() error {
         return validationErrors
 }
 
+func isReservedProviderFieldName(name string) bool {
+        for _, reservedName := range config.ReservedProviderFields {
+                if name == reservedName {
+                        return true
+                }
+        }
+        return false
+}
+
 // Meta returns the metadata associated with this provider that was
 // returned by the Configure call. It will be nil until Configure is called.
 func (p *Provider) Meta() interface{} {
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go b/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go
index 856c675..476192e 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go
@@ -43,7 +43,7 @@ type Provisioner struct {
 
         // ValidateFunc is a function for extended validation. This is optional
         // and should be used when individual field validation is not enough.
-        ValidateFunc func(*ResourceData) ([]string, []error)
+        ValidateFunc func(*terraform.ResourceConfig) ([]string, []error)
 
         stopCtx       context.Context
         stopCtxCancel context.CancelFunc
@@ -121,32 +121,6 @@ func (p *Provisioner) Stop() error {
         return nil
 }
 
-func (p *Provisioner) Validate(config *terraform.ResourceConfig) ([]string, []error) {
-        if err := p.InternalValidate(); err != nil {
-                return nil, []error{fmt.Errorf(
-                        "Internal validation of the provisioner failed! This is always a bug\n"+
-                                "with the provisioner itself, and not a user issue. Please report\n"+
-                                "this bug:\n\n%s", err)}
-        }
-        w := []string{}
-        e := []error{}
-        if p.Schema != nil {
-                w2, e2 := schemaMap(p.Schema).Validate(config)
-                w = append(w, w2...)
-                e = append(e, e2...)
-        }
-        if p.ValidateFunc != nil {
-                data := &ResourceData{
-                        schema: p.Schema,
-                        config: config,
-                }
-                w2, e2 := p.ValidateFunc(data)
-                w = append(w, w2...)
-                e = append(e, e2...)
-        }
-        return w, e
-}
-
 // Apply implementation of terraform.ResourceProvisioner interface.
 func (p *Provisioner) Apply(
         o terraform.UIOutput,
@@ -204,3 +178,27 @@ func (p *Provisioner) Apply(
         ctx = context.WithValue(ctx, ProvRawStateKey, s)
         return p.ApplyFunc(ctx)
 }
+
+// Validate implements the terraform.ResourceProvisioner interface.
+func (p *Provisioner) Validate(c *terraform.ResourceConfig) (ws []string, es []error) {
+        if err := p.InternalValidate(); err != nil {
+                return nil, []error{fmt.Errorf(
+                        "Internal validation of the provisioner failed! This is always a bug\n"+
+                                "with the provisioner itself, and not a user issue. Please report\n"+
+                                "this bug:\n\n%s", err)}
+        }
+
+        if p.Schema != nil {
+                w, e := schemaMap(p.Schema).Validate(c)
+                ws = append(ws, w...)
+                es = append(es, e...)
+        }
+
+        if p.ValidateFunc != nil {
+                w, e := p.ValidateFunc(c)
+                ws = append(ws, w...)
+                es = append(es, e...)
+        }
+
+        return ws, es
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
index c810558..ddba109 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
@@ -6,6 +6,7 @@ import (
         "log"
         "strconv"
 
+        "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/terraform"
 )
 
@@ -142,6 +143,12 @@ func (r *Resource) Apply(
                 if err := rt.DiffDecode(d); err != nil {
                         log.Printf("[ERR] Error decoding ResourceTimeout: %s", err)
                 }
+        } else if s != nil {
+                if _, ok := s.Meta[TimeoutKey]; ok {
+                        if err := rt.StateDecode(s); err != nil {
+                                log.Printf("[ERR] Error decoding ResourceTimeout: %s", err)
+                        }
+                }
         } else {
                 log.Printf("[DEBUG] No meta timeoutkey found in Apply()")
         }
@@ -388,9 +395,25 @@ func (r *Resource) InternalValidate(topSchemaMap schemaMap, writable bool) error
                 }
         }
 
+        // Resource-specific checks
+        for k, _ := range tsm {
+                if isReservedResourceFieldName(k) {
+                        return fmt.Errorf("%s is a reserved field name for a resource", k)
+                }
+        }
+
         return schemaMap(r.Schema).InternalValidate(tsm)
 }
 
+func isReservedResourceFieldName(name string) bool {
+        for _, reservedName := range config.ReservedResourceFields {
+                if name == reservedName {
+                        return true
+                }
+        }
+        return false
+}
+
 // Data returns a ResourceData struct for this Resource. Each return value
 // is a separate copy and can be safely modified differently.
 //
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/schema.go b/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
index 632672a..acb5618 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
@@ -15,6 +15,7 @@ import (
         "fmt"
         "os"
         "reflect"
+        "regexp"
         "sort"
         "strconv"
         "strings"
@@ -661,7 +662,13 @@ func (m schemaMap) InternalValidate(topSchemaMap schemaMap) error {
                 if v.ValidateFunc != nil {
                         switch v.Type {
                         case TypeList, TypeSet:
-                                return fmt.Errorf("ValidateFunc is not yet supported on lists or sets.")
+                                return fmt.Errorf("%s: ValidateFunc is not yet supported on lists or sets.", k)
+                        }
+                }
+
+                if v.Deprecated == "" && v.Removed == "" {
+                        if !isValidFieldName(k) {
+                                return fmt.Errorf("%s: Field name may only contain lowercase alphanumeric characters & underscores.", k)
                         }
                 }
         }
@@ -669,6 +676,11 @@ func (m schemaMap) InternalValidate(topSchemaMap schemaMap) error {
         return nil
 }
 
+func isValidFieldName(name string) bool {
+        re := regexp.MustCompile("^[a-z0-9_]+$")
+        return re.MatchString(name)
+}
+
 func (m schemaMap) diff(
         k string,
         schema *Schema,
diff --git a/vendor/github.com/hashicorp/terraform/helper/shadow/closer.go b/vendor/github.com/hashicorp/terraform/helper/shadow/closer.go
index 7edd5e7..edc1e2a 100644
--- a/vendor/github.com/hashicorp/terraform/helper/shadow/closer.go
+++ b/vendor/github.com/hashicorp/terraform/helper/shadow/closer.go
@@ -39,6 +39,8 @@ func (w *closeWalker) Struct(reflect.Value) error {
         return nil
 }
 
+var closerType = reflect.TypeOf((*io.Closer)(nil)).Elem()
+
 func (w *closeWalker) StructField(f reflect.StructField, v reflect.Value) error {
         // Not sure why this would be but lets avoid some panics
         if !v.IsValid() {
@@ -56,17 +58,18 @@ func (w *closeWalker) StructField(f reflect.StructField, v reflect.Value) error
                 return nil
         }
 
-        // We're looking for an io.Closer
-        raw := v.Interface()
-        if raw == nil {
-                return nil
+        var closer io.Closer
+        if v.Type().Implements(closerType) {
+                closer = v.Interface().(io.Closer)
+        } else if v.CanAddr() {
+                // The Close method may require a pointer receiver, but we only have a value.
+                v := v.Addr()
+                if v.Type().Implements(closerType) {
+                        closer = v.Interface().(io.Closer)
+                }
         }
 
-        closer, ok := raw.(io.Closer)
-        if !ok && v.CanAddr() {
-                closer, ok = v.Addr().Interface().(io.Closer)
-        }
-        if !ok {
+        if closer == nil {
                 return reflectwalk.SkipEntry
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/helper/shadow/value.go b/vendor/github.com/hashicorp/terraform/helper/shadow/value.go
index 2413335..178b7e7 100644
--- a/vendor/github.com/hashicorp/terraform/helper/shadow/value.go
+++ b/vendor/github.com/hashicorp/terraform/helper/shadow/value.go
@@ -26,6 +26,14 @@ type Value struct {
         valueSet bool
 }
 
+func (v *Value) Lock() {
+        v.lock.Lock()
+}
+
+func (v *Value) Unlock() {
+        v.lock.Unlock()
+}
+
 // Close closes the value. This can never fail. For a definition of
 // "close" see the struct docs.
 func (w *Value) Close() error {
diff --git a/vendor/github.com/hashicorp/terraform/moduledeps/dependencies.go b/vendor/github.com/hashicorp/terraform/moduledeps/dependencies.go
new file mode 100644
index 0000000..87c8431
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/moduledeps/dependencies.go
@@ -0,0 +1,43 @@
+package moduledeps
+
+import (
+        "github.com/hashicorp/terraform/plugin/discovery"
+)
+
+// Providers describes a set of provider dependencies for a given module.
+//
+// Each named provider instance can have one version constraint.
+type Providers map[ProviderInstance]ProviderDependency
+
+// ProviderDependency describes the dependency for a particular provider
+// instance, including both the set of allowed versions and the reason for
+// the dependency.
+type ProviderDependency struct {
+        Constraints discovery.Constraints
+        Reason      ProviderDependencyReason
+}
+
+// ProviderDependencyReason is an enumeration of reasons why a dependency might be
+// present.
+type ProviderDependencyReason int
+
+const (
+        // ProviderDependencyExplicit means that there is an explicit "provider"
+        // block in the configuration for this module.
+        ProviderDependencyExplicit ProviderDependencyReason = iota
+
+        // ProviderDependencyImplicit means that there is no explicit "provider"
+        // block but there is at least one resource that uses this provider.
+        ProviderDependencyImplicit
+
+        // ProviderDependencyInherited is a special case of
+        // ProviderDependencyImplicit where a parent module has defined a
+        // configuration for the provider that has been inherited by at least one
+        // resource in this module.
+        ProviderDependencyInherited
+
+        // ProviderDependencyFromState means that this provider is not currently
+        // referenced by configuration at all, but some existing instances in
+        // the state still depend on it.
+        ProviderDependencyFromState
+)
diff --git a/vendor/github.com/hashicorp/terraform/moduledeps/doc.go b/vendor/github.com/hashicorp/terraform/moduledeps/doc.go
new file mode 100644
index 0000000..7eff083
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/moduledeps/doc.go
@@ -0,0 +1,7 @@
+// Package moduledeps contains types that can be used to describe the
+// providers required for all of the modules in a module tree.
+//
+// It does not itself contain the functionality for populating such
+// data structures; that's in Terraform core, since this package intentionally
+// does not depend on terraform core to avoid package dependency cycles.
+package moduledeps
diff --git a/vendor/github.com/hashicorp/terraform/moduledeps/module.go b/vendor/github.com/hashicorp/terraform/moduledeps/module.go
new file mode 100644
index 0000000..d6cbaf5
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/moduledeps/module.go
@@ -0,0 +1,204 @@
+package moduledeps
+
+import (
+        "sort"
+        "strings"
+
+        "github.com/hashicorp/terraform/plugin/discovery"
+)
+
+// Module represents the dependencies of a single module, as well being
+// a node in a tree of such structures representing the dependencies of
+// an entire configuration.
+type Module struct {
+        Name      string
+        Providers Providers
+        Children  []*Module
+}
+
+// WalkFunc is a callback type for use with Module.WalkTree
+type WalkFunc func(path []string, parent *Module, current *Module) error
+
+// WalkTree calls the given callback once for the receiver and then
+// once for each descendent, in an order such that parents are called
+// before their children and siblings are called in the order they
+// appear in the Children slice.
+//
+// When calling the callback, parent will be nil for the first call
+// for the receiving module, and then set to the direct parent of
+// each module for the subsequent calls.
+//
+// The path given to the callback is valid only until the callback
+// returns, after which it will be mutated and reused. Callbacks must
+// therefore copy the path slice if they wish to retain it.
+//
+// If the given callback returns an error, the walk will be aborted at
+// that point and that error returned to the caller.
+//
+// This function is not thread-safe for concurrent modifications of the
+// data structure, so it's the caller's responsibility to arrange for that
+// should it be needed.
+//
+// It is safe for a callback to modify the descendents of the "current"
+// module, including the ordering of the Children slice itself, but the
+// callback MUST NOT modify the parent module.
+func (m *Module) WalkTree(cb WalkFunc) error {
+        return walkModuleTree(make([]string, 0, 1), nil, m, cb)
+}
+
+func walkModuleTree(path []string, parent *Module, current *Module, cb WalkFunc) error {
+        path = append(path, current.Name)
+        err := cb(path, parent, current)
+        if err != nil {
+                return err
+        }
+
+        for _, child := range current.Children {
+                err := walkModuleTree(path, current, child, cb)
+                if err != nil {
+                        return err
+                }
+        }
+        return nil
+}
+
+// SortChildren sorts the Children slice into lexicographic order by
+// name, in-place.
+//
+// This is primarily useful prior to calling WalkTree so that the walk
+// will proceed in a consistent order.
+func (m *Module) SortChildren() {
+        sort.Sort(sortModules{m.Children})
+}
+
+// SortDescendents is a convenience wrapper for calling SortChildren on
+// the receiver and all of its descendent modules.
+func (m *Module) SortDescendents() {
+        m.WalkTree(func(path []string, parent *Module, current *Module) error {
+                current.SortChildren()
+                return nil
+        })
+}
+
+type sortModules struct {
+        modules []*Module
+}
+
+func (s sortModules) Len() int {
+        return len(s.modules)
+}
+
+func (s sortModules) Less(i, j int) bool {
+        cmp := strings.Compare(s.modules[i].Name, s.modules[j].Name)
+        return cmp < 0
+}
+
+func (s sortModules) Swap(i, j int) {
+        s.modules[i], s.modules[j] = s.modules[j], s.modules[i]
+}
+
+// PluginRequirements produces a PluginRequirements structure that can
+// be used with discovery.PluginMetaSet.ConstrainVersions to identify
+// suitable plugins to satisfy the module's provider dependencies.
+//
+// This method only considers the direct requirements of the receiver.
+// Use AllPluginRequirements to flatten the dependencies for the
+// entire tree of modules.
+//
+// Requirements returned by this method include only version constraints,
+// and apply no particular SHA256 hash constraint.
+func (m *Module) PluginRequirements() discovery.PluginRequirements {
+        ret := make(discovery.PluginRequirements)
+        for inst, dep := range m.Providers {
+                // m.Providers is keyed on provider names, such as "aws.foo".
+                // a PluginRequirements wants keys to be provider *types*, such
+                // as "aws". If there are multiple aliases for the same
+                // provider then we will flatten them into a single requirement
+                // by combining their constraint sets.
+                pty := inst.Type()
+                if existing, exists := ret[pty]; exists {
+                        ret[pty].Versions = existing.Versions.Append(dep.Constraints)
+                } else {
+                        ret[pty] = &discovery.PluginConstraints{
+                                Versions: dep.Constraints,
+                        }
+                }
+        }
+        return ret
+}
+
+// AllPluginRequirements calls PluginRequirements for the receiver and all
+// of its descendents, and merges the result into a single PluginRequirements
+// structure that would satisfy all of the modules together.
+//
+// Requirements returned by this method include only version constraints,
+// and apply no particular SHA256 hash constraint.
+func (m *Module) AllPluginRequirements() discovery.PluginRequirements {
+        var ret discovery.PluginRequirements
+        m.WalkTree(func(path []string, parent *Module, current *Module) error {
+                ret = ret.Merge(current.PluginRequirements())
+                return nil
+        })
+        return ret
+}
+
+// Equal returns true if the receiver is the root of an identical tree
+// to the other given Module. This is a deep comparison that considers
+// the equality of all downstream modules too.
+//
+// The children are considered to be ordered, so callers may wish to use
+// SortDescendents first to normalize the order of the slices of child nodes.
+//
+// The implementation of this function is not optimized since it is provided
+// primarily for use in tests.
+func (m *Module) Equal(other *Module) bool {
+        // take care of nils first
+        if m == nil && other == nil {
+                return true
+        } else if (m == nil && other != nil) || (m != nil && other == nil) {
+                return false
+        }
+
+        if m.Name != other.Name {
+                return false
+        }
+
+        if len(m.Providers) != len(other.Providers) {
+                return false
+        }
+        if len(m.Children) != len(other.Children) {
+                return false
+        }
+
+        // Can't use reflect.DeepEqual on this provider structure because
+        // the nested Constraints objects contain function pointers that
+        // never compare as equal. So we'll need to walk it the long way.
+        for inst, dep := range m.Providers {
+                if _, exists := other.Providers[inst]; !exists {
+                        return false
+                }
+
+                if dep.Reason != other.Providers[inst].Reason {
+                        return false
+                }
+
+                // Constraints are not too easy to compare robustly, so
+                // we'll just use their string representations as a proxy
+                // for now.
+                if dep.Constraints.String() != other.Providers[inst].Constraints.String() {
+                        return false
+                }
+        }
+
+        // Above we already checked that we have the same number of children
+        // in each module, so now we just need to check that they are
+        // recursively equal.
+        for i := range m.Children {
+                if !m.Children[i].Equal(other.Children[i]) {
+                        return false
+                }
+        }
+
+        // If we fall out here then they are equal
+        return true
+}
diff --git a/vendor/github.com/hashicorp/terraform/moduledeps/provider.go b/vendor/github.com/hashicorp/terraform/moduledeps/provider.go
new file mode 100644
index 0000000..89ceefb
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/moduledeps/provider.go
@@ -0,0 +1,30 @@
+package moduledeps
+
+import (
+        "strings"
+)
+
+// ProviderInstance describes a particular provider instance by its full name,
+// like "null" or "aws.foo".
+type ProviderInstance string
+
+// Type returns the provider type of this instance. For example, for an instance
+// named "aws.foo" the type is "aws".
+func (p ProviderInstance) Type() string {
+        t := string(p)
+        if dotPos := strings.Index(t, "."); dotPos != -1 {
+                t = t[:dotPos]
+        }
+        return t
+}
+
+// Alias returns the alias of this provider, if any. An instance named "aws.foo"
+// has the alias "foo", while an instance named just "docker" has no alias,
+// so the empty string would be returned.
+func (p ProviderInstance) Alias() string {
+        t := string(p)
+        if dotPos := strings.Index(t, "."); dotPos != -1 {
+                return t[dotPos+1:]
+        }
+        return ""
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/client.go b/vendor/github.com/hashicorp/terraform/plugin/client.go
new file mode 100644
index 0000000..3a5cb7a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/client.go
@@ -0,0 +1,24 @@
+package plugin
+
+import (
+        "os/exec"
+
+        plugin "github.com/hashicorp/go-plugin"
+        "github.com/hashicorp/terraform/plugin/discovery"
+)
+
+// ClientConfig returns a configuration object that can be used to instantiate
+// a client for the plugin described by the given metadata.
+func ClientConfig(m discovery.PluginMeta) *plugin.ClientConfig {
+        return &plugin.ClientConfig{
+                Cmd:             exec.Command(m.Path),
+                HandshakeConfig: Handshake,
+                Managed:         true,
+                Plugins:         PluginMap,
+        }
+}
+
+// Client returns a plugin client for the plugin described by the given metadata.
+func Client(m discovery.PluginMeta) *plugin.Client {
+        return plugin.NewClient(ClientConfig(m))
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/error.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/error.go
new file mode 100644
index 0000000..df855a7
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/error.go
@@ -0,0 +1,30 @@
+package discovery
+
+// Error is a type used to describe situations that the caller must handle
+// since they indicate some form of user error.
+//
+// The functions and methods that return these specialized errors indicate so
+// in their documentation. The Error type should not itself be used directly,
+// but rather errors should be compared using the == operator with the
+// error constants in this package.
+//
+// Values of this type are _not_ used when the error being reported is an
+// operational error (server unavailable, etc) or indicative of a bug in
+// this package or its caller.
+type Error string
+
+// ErrorNoSuitableVersion indicates that a suitable version (meeting given
+// constraints) is not available.
+const ErrorNoSuitableVersion = Error("no suitable version is available")
+
+// ErrorNoVersionCompatible indicates that all of the available versions
+// that otherwise met constraints are not compatible with the current
+// version of Terraform.
+const ErrorNoVersionCompatible = Error("no available version is compatible with this version of Terraform")
+
+// ErrorNoSuchProvider indicates that no provider exists with a name given
+const ErrorNoSuchProvider = Error("no provider exists with the given name")
+
+func (err Error) Error() string {
+        return string(err)
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/find.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/find.go
new file mode 100644
index 0000000..f5bc4c1
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/find.go
@@ -0,0 +1,168 @@
+package discovery
+
+import (
+        "io/ioutil"
+        "log"
+        "path/filepath"
+        "strings"
+)
+
+// FindPlugins looks in the given directories for files whose filenames
+// suggest that they are plugins of the given kind (e.g. "provider") and
+// returns a PluginMetaSet representing the discovered potential-plugins.
+//
+// Currently this supports two different naming schemes. The current
+// standard naming scheme is a subdirectory called $GOOS-$GOARCH containing
+// files named terraform-$KIND-$NAME-V$VERSION. The legacy naming scheme is
+// files directly in the given directory whose names are like
+// terraform-$KIND-$NAME.
+//
+// Only one plugin will be returned for each unique plugin (name, version)
+// pair, with preference given to files found in earlier directories.
+//
+// This is a convenience wrapper around FindPluginPaths and ResolvePluginsPaths.
+func FindPlugins(kind string, dirs []string) PluginMetaSet {
+        return ResolvePluginPaths(FindPluginPaths(kind, dirs))
+}
+
+// FindPluginPaths looks in the given directories for files whose filenames
+// suggest that they are plugins of the given kind (e.g. "provider").
+//
+// The return value is a list of absolute paths that appear to refer to
+// plugins in the given directories, based only on what can be inferred
+// from the naming scheme. The paths returned are ordered such that files
+// in later dirs appear after files in earlier dirs in the given directory
+// list. Within the same directory plugins are returned in a consistent but
+// undefined order.
+func FindPluginPaths(kind string, dirs []string) []string {
+        // This is just a thin wrapper around findPluginPaths so that we can
+        // use the latter in tests with a fake machineName so we can use our
+        // test fixtures.
+        return findPluginPaths(kind, dirs)
+}
+
+func findPluginPaths(kind string, dirs []string) []string {
+        prefix := "terraform-" + kind + "-"
+
+        ret := make([]string, 0, len(dirs))
+
+        for _, dir := range dirs {
+                items, err := ioutil.ReadDir(dir)
+                if err != nil {
+                        // Ignore missing dirs, non-dirs, etc
+                        continue
+                }
+
+                log.Printf("[DEBUG] checking for %s in %q", kind, dir)
+
+                for _, item := range items {
+                        fullName := item.Name()
+
+                        if !strings.HasPrefix(fullName, prefix) {
+                                log.Printf("[DEBUG] skipping %q, not a %s", fullName, kind)
+                                continue
+                        }
+
+                        // New-style paths must have a version segment in filename
+                        if strings.Contains(strings.ToLower(fullName), "_v") {
+                                absPath, err := filepath.Abs(filepath.Join(dir, fullName))
+                                if err != nil {
+                                        log.Printf("[ERROR] plugin filepath error: %s", err)
+                                        continue
+                                }
+
+                                log.Printf("[DEBUG] found %s %q", kind, fullName)
+                                ret = append(ret, filepath.Clean(absPath))
+                                continue
+                        }
+
+                        // Legacy style with files directly in the base directory
+                        absPath, err := filepath.Abs(filepath.Join(dir, fullName))
+                        if err != nil {
+                                log.Printf("[ERROR] plugin filepath error: %s", err)
+                                continue
+                        }
+
+                        log.Printf("[WARNING] found legacy %s %q", kind, fullName)
+
+                        ret = append(ret, filepath.Clean(absPath))
+                }
+        }
+
+        return ret
+}
+
+// ResolvePluginPaths takes a list of paths to plugin executables (as returned
+// by e.g. FindPluginPaths) and produces a PluginMetaSet describing the
+// referenced plugins.
+//
+// If the same combination of plugin name and version appears multiple times,
+// the earlier reference will be preferred. Several different versions of
+// the same plugin name may be returned, in which case the methods of
+// PluginMetaSet can be used to filter down.
+func ResolvePluginPaths(paths []string) PluginMetaSet {
+        s := make(PluginMetaSet)
+
+        type nameVersion struct {
+                Name    string
+                Version string
+        }
+        found := make(map[nameVersion]struct{})
+
+        for _, path := range paths {
+                baseName := strings.ToLower(filepath.Base(path))
+                if !strings.HasPrefix(baseName, "terraform-") {
+                        // Should never happen with reasonable input
+                        continue
+                }
+
+                baseName = baseName[10:]
+                firstDash := strings.Index(baseName, "-")
+                if firstDash == -1 {
+                        // Should never happen with reasonable input
+                        continue
+                }
+
+                baseName = baseName[firstDash+1:]
+                if baseName == "" {
+                        // Should never happen with reasonable input
+                        continue
+                }
+
+                // Trim the .exe suffix used on Windows before we start wrangling
+                // the remainder of the path.
+                if strings.HasSuffix(baseName, ".exe") {
+                        baseName = baseName[:len(baseName)-4]
+                }
+
+                parts := strings.SplitN(baseName, "_v", 2)
+                name := parts[0]
+                version := VersionZero
+                if len(parts) == 2 {
+                        version = parts[1]
+                }
+
+                // Auto-installed plugins contain an extra name portion representing
+                // the expected plugin version, which we must trim off.
+                if underX := strings.Index(version, "_x"); underX != -1 {
+                        version = version[:underX]
+                }
+
+                if _, ok := found[nameVersion{name, version}]; ok {
+                        // Skip duplicate versions of the same plugin
+                        // (We do this during this step because after this we will be
+                        // dealing with sets and thus lose our ordering with which to
+                        // decide preference.)
+                        continue
+                }
+
+                s.Add(PluginMeta{
+                        Name:    name,
+                        Version: VersionStr(version),
+                        Path:    path,
+                })
+                found[nameVersion{name, version}] = struct{}{}
+        }
+
+        return s
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/get.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/get.go
new file mode 100644
index 0000000..241b5cb
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/get.go
@@ -0,0 +1,424 @@
+package discovery
+
+import (
+        "errors"
+        "fmt"
+        "io/ioutil"
+        "log"
+        "net/http"
+        "os"
+        "runtime"
+        "strconv"
+        "strings"
+
+        "golang.org/x/net/html"
+
+        cleanhttp "github.com/hashicorp/go-cleanhttp"
+        getter "github.com/hashicorp/go-getter"
+        multierror "github.com/hashicorp/go-multierror"
+)
+
+// Releases are located by parsing the html listing from releases.hashicorp.com.
+//
+// The URL for releases follows the pattern:
+//    https://releases.hashicorp.com/terraform-provider-name/<x.y.z>/terraform-provider-name_<x.y.z>_<os>_<arch>.<ext>
+//
+// The plugin protocol version will be saved with the release and returned in
+// the header X-TERRAFORM_PROTOCOL_VERSION.
+
+const protocolVersionHeader = "x-terraform-protocol-version"
+
+var releaseHost = "https://releases.hashicorp.com"
+
+var httpClient = cleanhttp.DefaultClient()
+
+// An Installer maintains a local cache of plugins by downloading plugins
+// from an online repository.
+type Installer interface {
+        Get(name string, req Constraints) (PluginMeta, error)
+        PurgeUnused(used map[string]PluginMeta) (removed PluginMetaSet, err error)
+}
+
+// ProviderInstaller is an Installer implementation that knows how to
+// download Terraform providers from the official HashiCorp releases service
+// into a local directory. The files downloaded are compliant with the
+// naming scheme expected by FindPlugins, so the target directory of a
+// provider installer can be used as one of several plugin discovery sources.
+type ProviderInstaller struct {
+        Dir string
+
+        PluginProtocolVersion uint
+
+        // OS and Arch specify the OS and architecture that should be used when
+        // installing plugins. These use the same labels as the runtime.GOOS and
+        // runtime.GOARCH variables respectively, and indeed the values of these
+        // are used as defaults if either of these is the empty string.
+        OS   string
+        Arch string
+
+        // Skip checksum and signature verification
+        SkipVerify bool
+}
+
+// Get is part of an implementation of type Installer, and attempts to download
+// and install a Terraform provider matching the given constraints.
+//
+// This method may return one of a number of sentinel errors from this
+// package to indicate issues that are likely to be resolvable via user action:
+//
+//     ErrorNoSuchProvider: no provider with the given name exists in the repository.
+//     ErrorNoSuitableVersion: the provider exists but no available version matches constraints.
+//     ErrorNoVersionCompatible: a plugin was found within the constraints but it is
+//                               incompatible with the current Terraform version.
+//
+// These errors should be recognized and handled as special cases by the caller
+// to present a suitable user-oriented error message.
+//
+// All other errors indicate an internal problem that is likely _not_ solvable
+// through user action, or at least not within Terraform's scope. Error messages
+// are produced under the assumption that if presented to the user they will
+// be presented alongside context about what is being installed, and thus the
+// error messages do not redundantly include such information.
+func (i *ProviderInstaller) Get(provider string, req Constraints) (PluginMeta, error) {
+        versions, err := i.listProviderVersions(provider)
+        // TODO: return multiple errors
+        if err != nil {
+                return PluginMeta{}, err
+        }
+
+        if len(versions) == 0 {
+                return PluginMeta{}, ErrorNoSuitableVersion
+        }
+
+        versions = allowedVersions(versions, req)
+        if len(versions) == 0 {
+                return PluginMeta{}, ErrorNoSuitableVersion
+        }
+
+        // sort them newest to oldest
+        Versions(versions).Sort()
+
+        // take the first matching plugin we find
+        for _, v := range versions {
+                url := i.providerURL(provider, v.String())
+
+                if !i.SkipVerify {
+                        sha256, err := i.getProviderChecksum(provider, v.String())
+                        if err != nil {
+                                return PluginMeta{}, err
+                        }
+
+                        // add the checksum parameter for go-getter to verify the download for us.
+                        if sha256 != "" {
+                                url = url + "?checksum=sha256:" + sha256
+                        }
+                }
+
+                log.Printf("[DEBUG] fetching provider info for %s version %s", provider, v)
+                if checkPlugin(url, i.PluginProtocolVersion) {
+                        log.Printf("[DEBUG] getting provider %q version %q at %s", provider, v, url)
+                        err := getter.Get(i.Dir, url)
+                        if err != nil {
+                                return PluginMeta{}, err
+                        }
+
+                        // Find what we just installed
+                        // (This is weird, because go-getter doesn't directly return
+                        //  information about what was extracted, and we just extracted
+                        //  the archive directly into a shared dir here.)
+                        log.Printf("[DEBUG] looking for the %s %s plugin we just installed", provider, v)
+                        metas := FindPlugins("provider", []string{i.Dir})
+                        log.Printf("[DEBUG] all plugins found %#v", metas)
+                        metas, _ = metas.ValidateVersions()
+                        metas = metas.WithName(provider).WithVersion(v)
+                        log.Printf("[DEBUG] filtered plugins %#v", metas)
+                        if metas.Count() == 0 {
+                                // This should never happen. Suggests that the release archive
+                                // contains an executable file whose name doesn't match the
+                                // expected convention.
+                                return PluginMeta{}, fmt.Errorf(
+                                        "failed to find installed plugin version %s; this is a bug in Terraform and should be reported",
+                                        v,
+                                )
+                        }
+
+                        if metas.Count() > 1 {
+                                // This should also never happen, and suggests that a
+                                // particular version was re-released with a different
+                                // executable filename. We consider releases as immutable, so
+                                // this is an error.
+                                return PluginMeta{}, fmt.Errorf(
+                                        "multiple plugins installed for version %s; this is a bug in Terraform and should be reported",
+                                        v,
+                                )
+                        }
+
+                        // By now we know we have exactly one meta, and so "Newest" will
+                        // return that one.
+                        return metas.Newest(), nil
+                }
+
+                log.Printf("[INFO] incompatible ProtocolVersion for %s version %s", provider, v)
+        }
+
+        return PluginMeta{}, ErrorNoVersionCompatible
+}
+
+func (i *ProviderInstaller) PurgeUnused(used map[string]PluginMeta) (PluginMetaSet, error) {
+        purge := make(PluginMetaSet)
+
+        present := FindPlugins("provider", []string{i.Dir})
+        for meta := range present {
+                chosen, ok := used[meta.Name]
+                if !ok {
+                        purge.Add(meta)
+                }
+                if chosen.Path != meta.Path {
+                        purge.Add(meta)
+                }
+        }
+
+        removed := make(PluginMetaSet)
+        var errs error
+        for meta := range purge {
+                path := meta.Path
+                err := os.Remove(path)
+                if err != nil {
+                        errs = multierror.Append(errs, fmt.Errorf(
+                                "failed to remove unused provider plugin %s: %s",
+                                path, err,
+                        ))
+                } else {
+                        removed.Add(meta)
+                }
+        }
+
+        return removed, errs
+}
+
+// Plugins are referred to by the short name, but all URLs and files will use
+// the full name prefixed with terraform-<plugin_type>-
+func (i *ProviderInstaller) providerName(name string) string {
+        return "terraform-provider-" + name
+}
+
+func (i *ProviderInstaller) providerFileName(name, version string) string {
+        os := i.OS
+        arch := i.Arch
+        if os == "" {
+                os = runtime.GOOS
+        }
+        if arch == "" {
+                arch = runtime.GOARCH
+        }
+        return fmt.Sprintf("%s_%s_%s_%s.zip", i.providerName(name), version, os, arch)
+}
+
+// providerVersionsURL returns the path to the released versions directory for the provider:
+// https://releases.hashicorp.com/terraform-provider-name/
+func (i *ProviderInstaller) providerVersionsURL(name string) string {
+        return releaseHost + "/" + i.providerName(name) + "/"
+}
+
+// providerURL returns the full path to the provider file, using the current OS
+// and ARCH:
+// .../terraform-provider-name_<x.y.z>/terraform-provider-name_<x.y.z>_<os>_<arch>.<ext>
+func (i *ProviderInstaller) providerURL(name, version string) string {
+        return fmt.Sprintf("%s%s/%s", i.providerVersionsURL(name), version, i.providerFileName(name, version))
+}
+
+func (i *ProviderInstaller) providerChecksumURL(name, version string) string {
+        fileName := fmt.Sprintf("%s_%s_SHA256SUMS", i.providerName(name), version)
+        u := fmt.Sprintf("%s%s/%s", i.providerVersionsURL(name), version, fileName)
+        return u
+}
+
+func (i *ProviderInstaller) getProviderChecksum(name, version string) (string, error) {
+        checksums, err := getPluginSHA256SUMs(i.providerChecksumURL(name, version))
+        if err != nil {
+                return "", err
+        }
+
+        return checksumForFile(checksums, i.providerFileName(name, version)), nil
+}
+
+// Return the plugin version by making a HEAD request to the provided url.
+// If the header is not present, we assume the latest version will be
+// compatible, and leave the check for discovery or execution.
+func checkPlugin(url string, pluginProtocolVersion uint) bool {
+        resp, err := httpClient.Head(url)
+        if err != nil {
+                log.Printf("[ERROR] error fetching plugin headers: %s", err)
+                return false
+        }
+
+        if resp.StatusCode != http.StatusOK {
+                log.Println("[ERROR] non-200 status fetching plugin headers:", resp.Status)
+                return false
+        }
+
+        proto := resp.Header.Get(protocolVersionHeader)
+        if proto == "" {
+                // The header isn't present, but we don't make this error fatal since
+                // the latest version will probably work.
+                log.Printf("[WARNING] missing %s from: %s", protocolVersionHeader, url)
+                return true
+        }
+
+        protoVersion, err := strconv.Atoi(proto)
+        if err != nil {
+                log.Printf("[ERROR] invalid ProtocolVersion: %s", proto)
+                return false
+        }
+
+        return protoVersion == int(pluginProtocolVersion)
+}
+
+// list the version available for the named plugin
+func (i *ProviderInstaller) listProviderVersions(name string) ([]Version, error) {
+        versions, err := listPluginVersions(i.providerVersionsURL(name))
+        if err != nil {
+                // listPluginVersions returns a verbose error message indicating
+                // what was being accessed and what failed
+                return nil, err
+        }
+        return versions, nil
+}
+
+var errVersionNotFound = errors.New("version not found")
+
+// take the list of available versions for a plugin, and filter out those that
+// don't fit the constraints.
+func allowedVersions(available []Version, required Constraints) []Version {
+        var allowed []Version
+
+        for _, v := range available {
+                if required.Allows(v) {
+                        allowed = append(allowed, v)
+                }
+        }
+
+        return allowed
+}
+
+// return a list of the plugin versions at the given URL
+func listPluginVersions(url string) ([]Version, error) {
+        resp, err := httpClient.Get(url)
+        if err != nil {
+                // http library produces a verbose error message that includes the
+                // URL being accessed, etc.
+                return nil, err
+        }
+        defer resp.Body.Close()
+
+        if resp.StatusCode != http.StatusOK {
+                body, _ := ioutil.ReadAll(resp.Body)
+                log.Printf("[ERROR] failed to fetch plugin versions from %s\n%s\n%s", url, resp.Status, body)
+
+                switch resp.StatusCode {
+                case http.StatusNotFound, http.StatusForbidden:
+                        // These are treated as indicative of the given name not being
+                        // a valid provider name at all.
+                        return nil, ErrorNoSuchProvider
+
+                default:
+                        // All other errors are assumed to be operational problems.
+                        return nil, fmt.Errorf("error accessing %s: %s", url, resp.Status)
+                }
+
+        }
+
+        body, err := html.Parse(resp.Body)
+        if err != nil {
+                log.Fatal(err)
+        }
+
+        names := []string{}
+
+        // all we need to do is list links on the directory listing page that look like plugins
+        var f func(*html.Node)
+        f = func(n *html.Node) {
+                if n.Type == html.ElementNode && n.Data == "a" {
+                        c := n.FirstChild
+                        if c != nil && c.Type == html.TextNode && strings.HasPrefix(c.Data, "terraform-") {
+                                names = append(names, c.Data)
+                                return
+                        }
+                }
+                for c := n.FirstChild; c != nil; c = c.NextSibling {
+                        f(c)
+                }
+        }
+        f(body)
+
+        return versionsFromNames(names), nil
+}
+
+// parse the list of directory names into a sorted list of available versions
+func versionsFromNames(names []string) []Version {
+        var versions []Version
+        for _, name := range names {
+                parts := strings.SplitN(name, "_", 2)
+                if len(parts) == 2 && parts[1] != "" {
+                        v, err := VersionStr(parts[1]).Parse()
+                        if err != nil {
+                                // filter invalid versions scraped from the page
+                                log.Printf("[WARN] invalid version found for %q: %s", name, err)
+                                continue
+                        }
+
+                        versions = append(versions, v)
+                }
+        }
+
+        return versions
+}
+
+func checksumForFile(sums []byte, name string) string {
+        for _, line := range strings.Split(string(sums), "\n") {
+                parts := strings.Fields(line)
+                if len(parts) > 1 && parts[1] == name {
+                        return parts[0]
+                }
+        }
+        return ""
+}
+
+// fetch the SHA256SUMS file provided, and verify its signature.
+func getPluginSHA256SUMs(sumsURL string) ([]byte, error) {
+        sigURL := sumsURL + ".sig"
+
+        sums, err := getFile(sumsURL)
+        if err != nil {
+                return nil, fmt.Errorf("error fetching checksums: %s", err)
+        }
+
+        sig, err := getFile(sigURL)
+        if err != nil {
+                return nil, fmt.Errorf("error fetching checksums signature: %s", err)
+        }
+
+        if err := verifySig(sums, sig); err != nil {
+                return nil, err
+        }
+
+        return sums, nil
+}
+
+func getFile(url string) ([]byte, error) {
+        resp, err := httpClient.Get(url)
+        if err != nil {
+                return nil, err
+        }
+        defer resp.Body.Close()
+
+        if resp.StatusCode != http.StatusOK {
+                return nil, fmt.Errorf("%s", resp.Status)
+        }
+
+        data, err := ioutil.ReadAll(resp.Body)
+        if err != nil {
+                return data, err
+        }
+        return data, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/meta.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/meta.go
new file mode 100644
index 0000000..bdcebcb
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/meta.go
@@ -0,0 +1,41 @@
+package discovery
+
+import (
+        "crypto/sha256"
+        "io"
+        "os"
+)
+
+// PluginMeta is metadata about a plugin, useful for launching the plugin
+// and for understanding which plugins are available.
+type PluginMeta struct {
+        // Name is the name of the plugin, e.g. as inferred from the plugin
+        // binary's filename, or by explicit configuration.
+        Name string
+
+        // Version is the semver version of the plugin, expressed as a string
+        // that might not be semver-valid.
+        Version VersionStr
+
+        // Path is the absolute path of the executable that can be launched
+        // to provide the RPC server for this plugin.
+        Path string
+}
+
+// SHA256 returns a SHA256 hash of the content of the referenced executable
+// file, or an error if the file's contents cannot be read.
+func (m PluginMeta) SHA256() ([]byte, error) {
+        f, err := os.Open(m.Path)
+        if err != nil {
+                return nil, err
+        }
+        defer f.Close()
+
+        h := sha256.New()
+        _, err = io.Copy(h, f)
+        if err != nil {
+                return nil, err
+        }
+
+        return h.Sum(nil), nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/meta_set.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/meta_set.go
new file mode 100644
index 0000000..181ea1f
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/meta_set.go
@@ -0,0 +1,195 @@
+package discovery
+
+// A PluginMetaSet is a set of PluginMeta objects meeting a certain criteria.
+//
+// Methods on this type allow filtering of the set to produce subsets that
+// meet more restrictive criteria.
+type PluginMetaSet map[PluginMeta]struct{}
+
+// Add inserts the given PluginMeta into the receiving set. This is a no-op
+// if the given meta is already present.
+func (s PluginMetaSet) Add(p PluginMeta) {
+        s[p] = struct{}{}
+}
+
+// Remove removes the given PluginMeta from the receiving set. This is a no-op
+// if the given meta is not already present.
+func (s PluginMetaSet) Remove(p PluginMeta) {
+        delete(s, p)
+}
+
+// Has returns true if the given meta is in the receiving set, or false
+// otherwise.
+func (s PluginMetaSet) Has(p PluginMeta) bool {
+        _, ok := s[p]
+        return ok
+}
+
+// Count returns the number of metas in the set
+func (s PluginMetaSet) Count() int {
+        return len(s)
+}
+
+// ValidateVersions returns two new PluginMetaSets, separating those with
+// versions that have syntax-valid semver versions from those that don't.
+//
+// Eliminating invalid versions from consideration (and possibly warning about
+// them) is usually the first step of working with a meta set after discovery
+// has completed.
+func (s PluginMetaSet) ValidateVersions() (valid, invalid PluginMetaSet) {
+        valid = make(PluginMetaSet)
+        invalid = make(PluginMetaSet)
+        for p := range s {
+                if _, err := p.Version.Parse(); err == nil {
+                        valid.Add(p)
+                } else {
+                        invalid.Add(p)
+                }
+        }
+        return
+}
+
+// WithName returns the subset of metas that have the given name.
+func (s PluginMetaSet) WithName(name string) PluginMetaSet {
+        ns := make(PluginMetaSet)
+        for p := range s {
+                if p.Name == name {
+                        ns.Add(p)
+                }
+        }
+        return ns
+}
+
+// WithVersion returns the subset of metas that have the given version.
+//
+// This should be used only with the "valid" result from ValidateVersions;
+// it will ignore any plugin metas that have a invalid version strings.
+func (s PluginMetaSet) WithVersion(version Version) PluginMetaSet {
+        ns := make(PluginMetaSet)
+        for p := range s {
+                gotVersion, err := p.Version.Parse()
+                if err != nil {
+                        continue
+                }
+                if gotVersion.Equal(version) {
+                        ns.Add(p)
+                }
+        }
+        return ns
+}
+
+// ByName groups the metas in the set by their Names, returning a map.
+func (s PluginMetaSet) ByName() map[string]PluginMetaSet {
+        ret := make(map[string]PluginMetaSet)
+        for p := range s {
+                if _, ok := ret[p.Name]; !ok {
+                        ret[p.Name] = make(PluginMetaSet)
+                }
+                ret[p.Name].Add(p)
+        }
+        return ret
+}
+
+// Newest returns the one item from the set that has the newest Version value.
+//
+// The result is meaningful only if the set is already filtered such that
+// all of the metas have the same Name.
+//
+// If there isn't at least one meta in the set then this function will panic.
+// Use Count() to ensure that there is at least one value before calling.
+//
+// If any of the metas have invalid version strings then this function will
+// panic. Use ValidateVersions() first to filter out metas with invalid
+// versions.
+//
+// If two metas have the same Version then one is arbitrarily chosen. This
+// situation should be avoided by pre-filtering the set.
+func (s PluginMetaSet) Newest() PluginMeta {
+        if len(s) == 0 {
+                panic("can't call NewestStable on empty PluginMetaSet")
+        }
+
+        var first = true
+        var winner PluginMeta
+        var winnerVersion Version
+        for p := range s {
+                version, err := p.Version.Parse()
+                if err != nil {
+                        panic(err)
+                }
+
+                if first == true || version.NewerThan(winnerVersion) {
+                        winner = p
+                        winnerVersion = version
+                        first = false
+                }
+        }
+
+        return winner
+}
+
+// ConstrainVersions takes a set of requirements and attempts to
+// return a map from name to a set of metas that have the matching
+// name and an appropriate version.
+//
+// If any of the given requirements match *no* plugins then its PluginMetaSet
+// in the returned map will be empty.
+//
+// All viable metas are returned, so the caller can apply any desired filtering
+// to reduce down to a single option. For example, calling Newest() to obtain
+// the highest available version.
+//
+// If any of the metas in the set have invalid version strings then this
+// function will panic. Use ValidateVersions() first to filter out metas with
+// invalid versions.
+func (s PluginMetaSet) ConstrainVersions(reqd PluginRequirements) map[string]PluginMetaSet {
+        ret := make(map[string]PluginMetaSet)
+        for p := range s {
+                name := p.Name
+                allowedVersions, ok := reqd[name]
+                if !ok {
+                        continue
+                }
+                if _, ok := ret[p.Name]; !ok {
+                        ret[p.Name] = make(PluginMetaSet)
+                }
+                version, err := p.Version.Parse()
+                if err != nil {
+                        panic(err)
+                }
+                if allowedVersions.Allows(version) {
+                        ret[p.Name].Add(p)
+                }
+        }
+        return ret
+}
+
+// OverridePaths returns a new set where any existing plugins with the given
+// names are removed and replaced with the single path given in the map.
+//
+// This is here only to continue to support the legacy way of overriding
+// plugin binaries in the .terraformrc file. It treats all given plugins
+// as pre-versioning (version 0.0.0). This mechanism will eventually be
+// phased out, with vendor directories being the intended replacement.
+func (s PluginMetaSet) OverridePaths(paths map[string]string) PluginMetaSet {
+        ret := make(PluginMetaSet)
+        for p := range s {
+                if _, ok := paths[p.Name]; ok {
+                        // Skip plugins that we're overridding
+                        continue
+                }
+
+                ret.Add(p)
+        }
+
+        // Now add the metadata for overriding plugins
+        for name, path := range paths {
+                ret.Add(PluginMeta{
+                        Name:    name,
+                        Version: VersionZero,
+                        Path:    path,
+                })
+        }
+
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/requirements.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/requirements.go
new file mode 100644
index 0000000..75430fd
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/requirements.go
@@ -0,0 +1,105 @@
+package discovery
+
+import (
+        "bytes"
+)
+
+// PluginRequirements describes a set of plugins (assumed to be of a consistent
+// kind) that are required to exist and have versions within the given
+// corresponding sets.
+type PluginRequirements map[string]*PluginConstraints
+
+// PluginConstraints represents an element of PluginRequirements describing
+// the constraints for a single plugin.
+type PluginConstraints struct {
+        // Specifies that the plugin's version must be within the given
+        // constraints.
+        Versions Constraints
+
+        // If non-nil, the hash of the on-disk plugin executable must exactly
+        // match the SHA256 hash given here.
+        SHA256 []byte
+}
+
+// Allows returns true if the given version is within the receiver's version
+// constraints.
+func (s *PluginConstraints) Allows(v Version) bool {
+        return s.Versions.Allows(v)
+}
+
+// AcceptsSHA256 returns true if the given executable SHA256 hash is acceptable,
+// either because it matches the constraint or because there is no such
+// constraint.
+func (s *PluginConstraints) AcceptsSHA256(digest []byte) bool {
+        if s.SHA256 == nil {
+                return true
+        }
+        return bytes.Equal(s.SHA256, digest)
+}
+
+// Merge takes the contents of the receiver and the other given requirements
+// object and merges them together into a single requirements structure
+// that satisfies both sets of requirements.
+//
+// Note that it doesn't make sense to merge two PluginRequirements with
+// differing required plugin SHA256 hashes, since the result will never
+// match any plugin.
+func (r PluginRequirements) Merge(other PluginRequirements) PluginRequirements {
+        ret := make(PluginRequirements)
+        for n, c := range r {
+                ret[n] = &PluginConstraints{
+                        Versions: Constraints{}.Append(c.Versions),
+                        SHA256:   c.SHA256,
+                }
+        }
+        for n, c := range other {
+                if existing, exists := ret[n]; exists {
+                        ret[n].Versions = ret[n].Versions.Append(c.Versions)
+
+                        if existing.SHA256 != nil {
+                                if c.SHA256 != nil && !bytes.Equal(c.SHA256, existing.SHA256) {
+                                        // If we've been asked to merge two constraints with
+                                        // different SHA256 hashes then we'll produce a dummy value
+                                        // that can never match anything. This is a silly edge case
+                                        // that no reasonable caller should hit.
+                                        ret[n].SHA256 = []byte(invalidProviderHash)
+                                }
+                        } else {
+                                ret[n].SHA256 = c.SHA256 // might still be nil
+                        }
+                } else {
+                        ret[n] = &PluginConstraints{
+                                Versions: Constraints{}.Append(c.Versions),
+                                SHA256:   c.SHA256,
+                        }
+                }
+        }
+        return ret
+}
+
+// LockExecutables applies additional constraints to the receiver that
+// require plugin executables with specific SHA256 digests. This modifies
+// the receiver in-place, since it's intended to be applied after
+// version constraints have been resolved.
+//
+// The given map must include a key for every plugin that is already
+// required. If not, any missing keys will cause the corresponding plugin
+// to never match, though the direct caller doesn't necessarily need to
+// guarantee this as long as the downstream code _applying_ these constraints
+// is able to deal with the non-match in some way.
+func (r PluginRequirements) LockExecutables(sha256s map[string][]byte) {
+        for name, cons := range r {
+                digest := sha256s[name]
+
+                if digest == nil {
+                        // Prevent any match, which will then presumably cause the
+                        // downstream consumer of this requirements to report an error.
+                        cons.SHA256 = []byte(invalidProviderHash)
+                        continue
+                }
+
+                cons.SHA256 = digest
+        }
+}
+
+const invalidProviderHash = "<invalid>"
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/signature.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/signature.go
new file mode 100644
index 0000000..b6686a5
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/signature.go
@@ -0,0 +1,53 @@
+package discovery
+
+import (
+        "bytes"
+        "log"
+        "strings"
+
+        "golang.org/x/crypto/openpgp"
+)
+
+// Verify the data using the provided openpgp detached signature and the
+// embedded hashicorp public key.
+func verifySig(data, sig []byte) error {
+        el, err := openpgp.ReadArmoredKeyRing(strings.NewReader(hashiPublicKey))
+        if err != nil {
+                log.Fatal(err)
+        }
+
+        _, err = openpgp.CheckDetachedSignature(el, bytes.NewReader(data), bytes.NewReader(sig))
+        return err
+}
+
+// this is the public key that signs the checksums file for releases.
+const hashiPublicKey = `-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1
+
+mQENBFMORM0BCADBRyKO1MhCirazOSVwcfTr1xUxjPvfxD3hjUwHtjsOy/bT6p9f
+W2mRPfwnq2JB5As+paL3UGDsSRDnK9KAxQb0NNF4+eVhr/EJ18s3wwXXDMjpIifq
+fIm2WyH3G+aRLTLPIpscUNKDyxFOUbsmgXAmJ46Re1fn8uKxKRHbfa39aeuEYWFA
+3drdL1WoUngvED7f+RnKBK2G6ZEpO+LDovQk19xGjiMTtPJrjMjZJ3QXqPvx5wca
+KSZLr4lMTuoTI/ZXyZy5bD4tShiZz6KcyX27cD70q2iRcEZ0poLKHyEIDAi3TM5k
+SwbbWBFd5RNPOR0qzrb/0p9ksKK48IIfH2FvABEBAAG0K0hhc2hpQ29ycCBTZWN1
+cml0eSA8c2VjdXJpdHlAaGFzaGljb3JwLmNvbT6JATgEEwECACIFAlMORM0CGwMG
+CwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEFGFLYc0j/xMyWIIAIPhcVqiQ59n
+Jc07gjUX0SWBJAxEG1lKxfzS4Xp+57h2xxTpdotGQ1fZwsihaIqow337YHQI3q0i
+SqV534Ms+j/tU7X8sq11xFJIeEVG8PASRCwmryUwghFKPlHETQ8jJ+Y8+1asRydi
+psP3B/5Mjhqv/uOK+Vy3zAyIpyDOMtIpOVfjSpCplVRdtSTFWBu9Em7j5I2HMn1w
+sJZnJgXKpybpibGiiTtmnFLOwibmprSu04rsnP4ncdC2XRD4wIjoyA+4PKgX3sCO
+klEzKryWYBmLkJOMDdo52LttP3279s7XrkLEE7ia0fXa2c12EQ0f0DQ1tGUvyVEW
+WmJVccm5bq25AQ0EUw5EzQEIANaPUY04/g7AmYkOMjaCZ6iTp9hB5Rsj/4ee/ln9
+wArzRO9+3eejLWh53FoN1rO+su7tiXJA5YAzVy6tuolrqjM8DBztPxdLBbEi4V+j
+2tK0dATdBQBHEh3OJApO2UBtcjaZBT31zrG9K55D+CrcgIVEHAKY8Cb4kLBkb5wM
+skn+DrASKU0BNIV1qRsxfiUdQHZfSqtp004nrql1lbFMLFEuiY8FZrkkQ9qduixo
+mTT6f34/oiY+Jam3zCK7RDN/OjuWheIPGj/Qbx9JuNiwgX6yRj7OE1tjUx6d8g9y
+0H1fmLJbb3WZZbuuGFnK6qrE3bGeY8+AWaJAZ37wpWh1p0cAEQEAAYkBHwQYAQIA
+CQUCUw5EzQIbDAAKCRBRhS2HNI/8TJntCAClU7TOO/X053eKF1jqNW4A1qpxctVc
+z8eTcY8Om5O4f6a/rfxfNFKn9Qyja/OG1xWNobETy7MiMXYjaa8uUx5iFy6kMVaP
+0BXJ59NLZjMARGw6lVTYDTIvzqqqwLxgliSDfSnqUhubGwvykANPO+93BBx89MRG
+unNoYGXtPlhNFrAsB1VR8+EyKLv2HQtGCPSFBhrjuzH3gxGibNDDdFQLxxuJWepJ
+EK1UbTS4ms0NgZ2Uknqn1WRU1Ki7rE4sTy68iZtWpKQXZEJa0IGnuI2sSINGcXCJ
+oEIgXTMyCILo34Fa/C6VCm2WBgz9zZO8/rHIiQm1J5zqz0DrDwKBUM9C
+=LYpS
+-----END PGP PUBLIC KEY BLOCK-----`
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/version.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/version.go
new file mode 100644
index 0000000..8fad58d
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/version.go
@@ -0,0 +1,72 @@
+package discovery
+
+import (
+        "fmt"
+        "sort"
+
+        version "github.com/hashicorp/go-version"
+)
+
+const VersionZero = "0.0.0"
+
+// A VersionStr is a string containing a possibly-invalid representation
+// of a semver version number. Call Parse on it to obtain a real Version
+// object, or discover that it is invalid.
+type VersionStr string
+
+// Parse transforms a VersionStr into a Version if it is
+// syntactically valid. If it isn't then an error is returned instead.
+func (s VersionStr) Parse() (Version, error) {
+        raw, err := version.NewVersion(string(s))
+        if err != nil {
+                return Version{}, err
+        }
+        return Version{raw}, nil
+}
+
+// MustParse transforms a VersionStr into a Version if it is
+// syntactically valid. If it isn't then it panics.
+func (s VersionStr) MustParse() Version {
+        ret, err := s.Parse()
+        if err != nil {
+                panic(err)
+        }
+        return ret
+}
+
+// Version represents a version number that has been parsed from
+// a semver string and known to be valid.
+type Version struct {
+        // We wrap this here just because it avoids a proliferation of
+        // direct go-version imports all over the place, and keeps the
+        // version-processing details within this package.
+        raw *version.Version
+}
+
+func (v Version) String() string {
+        return v.raw.String()
+}
+
+func (v Version) NewerThan(other Version) bool {
+        return v.raw.GreaterThan(other.raw)
+}
+
+func (v Version) Equal(other Version) bool {
+        return v.raw.Equal(other.raw)
+}
+
+// MinorUpgradeConstraintStr returns a ConstraintStr that would permit
+// minor upgrades relative to the receiving version.
+func (v Version) MinorUpgradeConstraintStr() ConstraintStr {
+        segments := v.raw.Segments()
+        return ConstraintStr(fmt.Sprintf("~> %d.%d", segments[0], segments[1]))
+}
+
+type Versions []Version
+
+// Sort sorts version from newest to oldest.
+func (v Versions) Sort() {
+        sort.Slice(v, func(i, j int) bool {
+                return v[i].NewerThan(v[j])
+        })
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/version_set.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/version_set.go
new file mode 100644
index 0000000..0aefd75
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/version_set.go
@@ -0,0 +1,84 @@
+package discovery
+
+import (
+        "sort"
+
+        version "github.com/hashicorp/go-version"
+)
+
+// A ConstraintStr is a string containing a possibly-invalid representation
+// of a version constraint provided in configuration. Call Parse on it to
+// obtain a real Constraint object, or discover that it is invalid.
+type ConstraintStr string
+
+// Parse transforms a ConstraintStr into a Constraints if it is
+// syntactically valid. If it isn't then an error is returned instead.
+func (s ConstraintStr) Parse() (Constraints, error) {
+        raw, err := version.NewConstraint(string(s))
+        if err != nil {
+                return Constraints{}, err
+        }
+        return Constraints{raw}, nil
+}
+
+// MustParse is like Parse but it panics if the constraint string is invalid.
+func (s ConstraintStr) MustParse() Constraints {
+        ret, err := s.Parse()
+        if err != nil {
+                panic(err)
+        }
+        return ret
+}
+
+// Constraints represents a set of versions which any given Version is either
+// a member of or not.
+type Constraints struct {
+        raw version.Constraints
+}
+
+// AllVersions is a Constraints containing all versions
+var AllVersions Constraints
+
+func init() {
+        AllVersions = Constraints{
+                raw: make(version.Constraints, 0),
+        }
+}
+
+// Allows returns true if the given version permitted by the receiving
+// constraints set.
+func (s Constraints) Allows(v Version) bool {
+        return s.raw.Check(v.raw)
+}
+
+// Append combines the receiving set with the given other set to produce
+// a set that is the intersection of both sets, which is to say that resulting
+// constraints contain only the versions that are members of both.
+func (s Constraints) Append(other Constraints) Constraints {
+        raw := make(version.Constraints, 0, len(s.raw)+len(other.raw))
+
+        // Since "raw" is a list of constraints that remove versions from the set,
+        // "Intersection" is implemented by concatenating together those lists,
+        // thus leaving behind only the versions not removed by either list.
+        raw = append(raw, s.raw...)
+        raw = append(raw, other.raw...)
+
+        // while the set is unordered, we sort these lexically for consistent output
+        sort.Slice(raw, func(i, j int) bool {
+                return raw[i].String() < raw[j].String()
+        })
+
+        return Constraints{raw}
+}
+
+// String returns a string representation of the set members as a set
+// of range constraints.
+func (s Constraints) String() string {
+        return s.raw.String()
+}
+
+// Unconstrained returns true if and only if the receiver is an empty
+// constraint set.
+func (s Constraints) Unconstrained() bool {
+        return len(s.raw) == 0
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/context.go b/vendor/github.com/hashicorp/terraform/terraform/context.go
index 306128e..a814a85 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/context.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/context.go
@@ -57,12 +57,17 @@ type ContextOpts struct {
         Parallelism        int
         State              *State
         StateFutureAllowed bool
-        Providers          map[string]ResourceProviderFactory
+        ProviderResolver   ResourceProviderResolver
         Provisioners       map[string]ResourceProvisionerFactory
         Shadow             bool
         Targets            []string
         Variables          map[string]interface{}
 
+        // If non-nil, will apply as additional constraints on the provider
+        // plugins that will be requested from the provider resolver.
+        ProviderSHA256s    map[string][]byte
+        SkipProviderVerify bool
+
         UIInput UIInput
 }
 
@@ -102,6 +107,7 @@ type Context struct {
         l                   sync.Mutex // Lock acquired during any task
         parallelSem         Semaphore
         providerInputConfig map[string]map[string]interface{}
+        providerSHA256s     map[string][]byte
         runLock             sync.Mutex
         runCond             *sync.Cond
         runContext          context.Context
@@ -166,7 +172,6 @@ func NewContext(opts *ContextOpts) (*Context, error) {
         //        set by environment variables if necessary. This includes
         //        values taken from -var-file in addition.
         variables := make(map[string]interface{})
-
         if opts.Module != nil {
                 var err error
                 variables, err = Variables(opts.Module, opts.Variables)
@@ -175,6 +180,23 @@ func NewContext(opts *ContextOpts) (*Context, error) {
                 }
         }
 
+        // Bind available provider plugins to the constraints in config
+        var providers map[string]ResourceProviderFactory
+        if opts.ProviderResolver != nil {
+                var err error
+                deps := ModuleTreeDependencies(opts.Module, state)
+                reqd := deps.AllPluginRequirements()
+                if opts.ProviderSHA256s != nil && !opts.SkipProviderVerify {
+                        reqd.LockExecutables(opts.ProviderSHA256s)
+                }
+                providers, err = resourceProviderFactories(opts.ProviderResolver, reqd)
+                if err != nil {
+                        return nil, err
+                }
+        } else {
+                providers = make(map[string]ResourceProviderFactory)
+        }
+
         diff := opts.Diff
         if diff == nil {
                 diff = &Diff{}
@@ -182,7 +204,7 @@ func NewContext(opts *ContextOpts) (*Context, error) {
 
         return &Context{
                 components: &basicComponentFactory{
-                        providers:    opts.Providers,
+                        providers:    providers,
                         provisioners: opts.Provisioners,
                 },
                 destroy:   opts.Destroy,
@@ -198,6 +220,7 @@ func NewContext(opts *ContextOpts) (*Context, error) {
 
                 parallelSem:         NewSemaphore(par),
                 providerInputConfig: make(map[string]map[string]interface{}),
+                providerSHA256s:     opts.ProviderSHA256s,
                 sh:                  sh,
         }, nil
 }
@@ -509,6 +532,9 @@ func (c *Context) Plan() (*Plan, error) {
                 Vars:    c.variables,
                 State:   c.state,
                 Targets: c.targets,
+
+                TerraformVersion: VersionString(),
+                ProviderSHA256s:  c.providerSHA256s,
         }
 
         var operation walkOperation
diff --git a/vendor/github.com/hashicorp/terraform/terraform/diff.go b/vendor/github.com/hashicorp/terraform/terraform/diff.go
index a9fae6c..fd1687e 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/diff.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/diff.go
@@ -28,7 +28,7 @@ const (
 // multiVal matches the index key to a flatmapped set, list or map
 var multiVal = regexp.MustCompile(`\.(#|%)$`)
 
-// Diff trackes the changes that are necessary to apply a configuration
+// Diff tracks the changes that are necessary to apply a configuration
 // to an existing infrastructure.
 type Diff struct {
         // Modules contains all the modules that have a diff
@@ -370,7 +370,7 @@ type InstanceDiff struct {
 
         // Meta is a simple K/V map that is stored in a diff and persisted to
         // plans but otherwise is completely ignored by Terraform core. It is
-        // mean to be used for additional data a resource may want to pass through.
+        // meant to be used for additional data a resource may want to pass through.
         // The value here must only contain Go primitives and collections.
         Meta map[string]interface{}
 }
@@ -551,7 +551,7 @@ func (d *InstanceDiff) SetDestroyDeposed(b bool) {
 }
 
 // These methods are properly locked, for use outside other InstanceDiff
-// methods but everywhere else within in the terraform package.
+// methods but everywhere else within the terraform package.
 // TODO refactor the locking scheme
 func (d *InstanceDiff) SetTainted(b bool) {
         d.mu.Lock()
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go b/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go
index 6f09526..c35f908 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go
@@ -81,6 +81,12 @@ type EvalDiff struct {
         // Resource is needed to fetch the ignore_changes list so we can
         // filter user-requested ignored attributes from the diff.
         Resource *config.Resource
+
+        // Stub is used to flag the generated InstanceDiff as a stub. This is used to
+        // ensure that the node exists to perform interpolations and generate
+        // computed paths off of, but not as an actual diff where resouces should be
+        // counted, and not as a diff that should be acted on.
+        Stub bool
 }
 
 // TODO: test
@@ -90,11 +96,13 @@ func (n *EvalDiff) Eval(ctx EvalContext) (interface{}, error) {
         provider := *n.Provider
 
         // Call pre-diff hook
-        err := ctx.Hook(func(h Hook) (HookAction, error) {
-                return h.PreDiff(n.Info, state)
-        })
-        if err != nil {
-                return nil, err
+        if !n.Stub {
+                err := ctx.Hook(func(h Hook) (HookAction, error) {
+                        return h.PreDiff(n.Info, state)
+                })
+                if err != nil {
+                        return nil, err
+                }
         }
 
         // The state for the diff must never be nil
@@ -158,15 +166,19 @@ func (n *EvalDiff) Eval(ctx EvalContext) (interface{}, error) {
         }
 
         // Call post-refresh hook
-        err = ctx.Hook(func(h Hook) (HookAction, error) {
-                return h.PostDiff(n.Info, diff)
-        })
-        if err != nil {
-                return nil, err
+        if !n.Stub {
+                err = ctx.Hook(func(h Hook) (HookAction, error) {
+                        return h.PostDiff(n.Info, diff)
+                })
+                if err != nil {
+                        return nil, err
+                }
         }
 
-        // Update our output
-        *n.OutputDiff = diff
+        // Update our output if we care
+        if n.OutputDiff != nil {
+                *n.OutputDiff = diff
+        }
 
         // Update the state if we care
         if n.OutputState != nil {
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_plan.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_plan.go
index a6a3a90..4b29bbb 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_plan.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_plan.go
@@ -117,7 +117,15 @@ func (b *PlanGraphBuilder) Steps() []GraphTransformer {
                 &CountBoundaryTransformer{},
 
                 // Target
-                &TargetsTransformer{Targets: b.Targets},
+                &TargetsTransformer{
+                        Targets: b.Targets,
+
+                        // Resource nodes from config have not yet been expanded for
+                        // "count", so we must apply targeting without indices. Exact
+                        // targeting will be dealt with later when these resources
+                        // DynamicExpand.
+                        IgnoreIndices: true,
+                },
 
                 // Close opened plugin connections
                 &CloseProviderTransformer{},
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_refresh.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_refresh.go
index 0634f96..3d3e968 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_refresh.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_refresh.go
@@ -144,7 +144,15 @@ func (b *RefreshGraphBuilder) Steps() []GraphTransformer {
                 &ReferenceTransformer{},
 
                 // Target
-                &TargetsTransformer{Targets: b.Targets},
+                &TargetsTransformer{
+                        Targets: b.Targets,
+
+                        // Resource nodes from config have not yet been expanded for
+                        // "count", so we must apply targeting without indices. Exact
+                        // targeting will be dealt with later when these resources
+                        // DynamicExpand.
+                        IgnoreIndices: true,
+                },
 
                 // Close opened plugin connections
                 &CloseProviderTransformer{},
diff --git a/vendor/github.com/hashicorp/terraform/terraform/interpolate.go b/vendor/github.com/hashicorp/terraform/terraform/interpolate.go
index 0def295..22ddce6 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/interpolate.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/interpolate.go
@@ -317,9 +317,13 @@ func (i *Interpolater) valueTerraformVar(
         n string,
         v *config.TerraformVariable,
         result map[string]ast.Variable) error {
-        if v.Field != "env" {
+
+        // "env" is supported for backward compatibility, but it's deprecated and
+        // so we won't advertise it as being allowed in the error message. It will
+        // be removed in a future version of Terraform.
+        if v.Field != "workspace" && v.Field != "env" {
                 return fmt.Errorf(
-                        "%s: only supported key for 'terraform.X' interpolations is 'env'", n)
+                        "%s: only supported key for 'terraform.X' interpolations is 'workspace'", n)
         }
 
         if i.Meta == nil {
diff --git a/vendor/github.com/hashicorp/terraform/terraform/module_dependencies.go b/vendor/github.com/hashicorp/terraform/terraform/module_dependencies.go
new file mode 100644
index 0000000..b9f44a0
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/module_dependencies.go
@@ -0,0 +1,156 @@
+package terraform
+
+import (
+        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/moduledeps"
+        "github.com/hashicorp/terraform/plugin/discovery"
+)
+
+// ModuleTreeDependencies returns the dependencies of the tree of modules
+// described by the given configuration tree and state.
+//
+// Both configuration and state are required because there can be resources
+// implied by instances in the state that no longer exist in config.
+//
+// This function will panic if any invalid version constraint strings are
+// present in the configuration. This is guaranteed not to happen for any
+// configuration that has passed a call to Config.Validate().
+func ModuleTreeDependencies(root *module.Tree, state *State) *moduledeps.Module {
+
+        // First we walk the configuration tree to build the overall structure
+        // and capture the explicit/implicit/inherited provider dependencies.
+        deps := moduleTreeConfigDependencies(root, nil)
+
+        // Next we walk over the resources in the state to catch any additional
+        // dependencies created by existing resources that are no longer in config.
+        // Most things we find in state will already be present in 'deps', but
+        // we're interested in the rare thing that isn't.
+        moduleTreeMergeStateDependencies(deps, state)
+
+        return deps
+}
+
+func moduleTreeConfigDependencies(root *module.Tree, inheritProviders map[string]*config.ProviderConfig) *moduledeps.Module {
+        if root == nil {
+                // If no config is provided, we'll make a synthetic root.
+                // This isn't necessarily correct if we're called with a nil that
+                // *isn't* at the root, but in practice that can never happen.
+                return &moduledeps.Module{
+                        Name: "root",
+                }
+        }
+
+        ret := &moduledeps.Module{
+                Name: root.Name(),
+        }
+
+        cfg := root.Config()
+        providerConfigs := cfg.ProviderConfigsByFullName()
+
+        // Provider dependencies
+        {
+                providers := make(moduledeps.Providers, len(providerConfigs))
+
+                // Any providerConfigs elements are *explicit* provider dependencies,
+                // which is the only situation where the user might provide an actual
+                // version constraint. We'll take care of these first.
+                for fullName, pCfg := range providerConfigs {
+                        inst := moduledeps.ProviderInstance(fullName)
+                        versionSet := discovery.AllVersions
+                        if pCfg.Version != "" {
+                                versionSet = discovery.ConstraintStr(pCfg.Version).MustParse()
+                        }
+                        providers[inst] = moduledeps.ProviderDependency{
+                                Constraints: versionSet,
+                                Reason:      moduledeps.ProviderDependencyExplicit,
+                        }
+                }
+
+                // Each resource in the configuration creates an *implicit* provider
+                // dependency, though we'll only record it if there isn't already
+                // an explicit dependency on the same provider.
+                for _, rc := range cfg.Resources {
+                        fullName := rc.ProviderFullName()
+                        inst := moduledeps.ProviderInstance(fullName)
+                        if _, exists := providers[inst]; exists {
+                                // Explicit dependency already present
+                                continue
+                        }
+
+                        reason := moduledeps.ProviderDependencyImplicit
+                        if _, inherited := inheritProviders[fullName]; inherited {
+                                reason = moduledeps.ProviderDependencyInherited
+                        }
+
+                        providers[inst] = moduledeps.ProviderDependency{
+                                Constraints: discovery.AllVersions,
+                                Reason:      reason,
+                        }
+                }
+
+                ret.Providers = providers
+        }
+
+        childInherit := make(map[string]*config.ProviderConfig)
+        for k, v := range inheritProviders {
+                childInherit[k] = v
+        }
+        for k, v := range providerConfigs {
+                childInherit[k] = v
+        }
+        for _, c := range root.Children() {
+                ret.Children = append(ret.Children, moduleTreeConfigDependencies(c, childInherit))
+        }
+
+        return ret
+}
+
+func moduleTreeMergeStateDependencies(root *moduledeps.Module, state *State) {
+        if state == nil {
+                return
+        }
+
+        findModule := func(path []string) *moduledeps.Module {
+                module := root
+                for _, name := range path[1:] { // skip initial "root"
+                        var next *moduledeps.Module
+                        for _, cm := range module.Children {
+                                if cm.Name == name {
+                                        next = cm
+                                        break
+                                }
+                        }
+
+                        if next == nil {
+                                // If we didn't find a next node, we'll need to make one
+                                next = &moduledeps.Module{
+                                        Name: name,
+                                }
+                                module.Children = append(module.Children, next)
+                        }
+
+                        module = next
+                }
+                return module
+        }
+
+        for _, ms := range state.Modules {
+                module := findModule(ms.Path)
+
+                for _, is := range ms.Resources {
+                        fullName := config.ResourceProviderFullName(is.Type, is.Provider)
+                        inst := moduledeps.ProviderInstance(fullName)
+                        if _, exists := module.Providers[inst]; !exists {
+                                if module.Providers == nil {
+                                        module.Providers = make(moduledeps.Providers)
+                                }
+                                module.Providers[inst] = moduledeps.ProviderDependency{
+                                        Constraints: discovery.AllVersions,
+                                        Reason:      moduledeps.ProviderDependencyFromState,
+                                }
+                        }
+                }
+        }
+
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_refresh.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_refresh.go
index 6ab9df7..cd4fe92 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_refresh.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_refresh.go
@@ -45,13 +45,6 @@ func (n *NodeRefreshableManagedResource) DynamicExpand(ctx EvalContext) (*Graph,
                         Addr:     n.ResourceAddr(),
                 },
 
-                // Switch up any node missing state to a plannable resource. This helps
-                // catch cases where data sources depend on the counts from this resource
-                // during a scale out.
-                &ResourceRefreshPlannableTransformer{
-                        State: state,
-                },
-
                 // Add the count orphans to make sure these resources are accounted for
                 // during a scale in.
                 &OrphanResourceCountTransformer{
@@ -100,6 +93,9 @@ func (n *NodeRefreshableManagedResourceInstance) EvalTree() EvalNode {
         // Eval info is different depending on what kind of resource this is
         switch mode := n.Addr.Mode; mode {
         case config.ManagedResourceMode:
+                if n.ResourceState == nil {
+                        return n.evalTreeManagedResourceNoState()
+                }
                 return n.evalTreeManagedResource()
 
         case config.DataResourceMode:
@@ -176,3 +172,88 @@ func (n *NodeRefreshableManagedResourceInstance) evalTreeManagedResource() EvalN
                 },
         }
 }
+
+// evalTreeManagedResourceNoState produces an EvalSequence for refresh resource
+// nodes that don't have state attached. An example of where this functionality
+// is useful is when a resource that already exists in state is being scaled
+// out, ie: has its resource count increased. In this case, the scaled out node
+// needs to be available to other nodes (namely data sources) that may depend
+// on it for proper interpolation, or confusing "index out of range" errors can
+// occur.
+//
+// The steps in this sequence are very similar to the steps carried out in
+// plan, but nothing is done with the diff after it is created - it is dropped,
+// and its changes are not counted in the UI.
+func (n *NodeRefreshableManagedResourceInstance) evalTreeManagedResourceNoState() EvalNode {
+        // Declare a bunch of variables that are used for state during
+        // evaluation. Most of this are written to by-address below.
+        var provider ResourceProvider
+        var state *InstanceState
+        var resourceConfig *ResourceConfig
+
+        addr := n.NodeAbstractResource.Addr
+        stateID := addr.stateId()
+        info := &InstanceInfo{
+                Id:         stateID,
+                Type:       addr.Type,
+                ModulePath: normalizeModulePath(addr.Path),
+        }
+
+        // Build the resource for eval
+        resource := &Resource{
+                Name:       addr.Name,
+                Type:       addr.Type,
+                CountIndex: addr.Index,
+        }
+        if resource.CountIndex < 0 {
+                resource.CountIndex = 0
+        }
+
+        // Determine the dependencies for the state.
+        stateDeps := n.StateReferences()
+
+        return &EvalSequence{
+                Nodes: []EvalNode{
+                        &EvalInterpolate{
+                                Config:   n.Config.RawConfig.Copy(),
+                                Resource: resource,
+                                Output:   &resourceConfig,
+                        },
+                        &EvalGetProvider{
+                                Name:   n.ProvidedBy()[0],
+                                Output: &provider,
+                        },
+                        // Re-run validation to catch any errors we missed, e.g. type
+                        // mismatches on computed values.
+                        &EvalValidateResource{
+                                Provider:       &provider,
+                                Config:         &resourceConfig,
+                                ResourceName:   n.Config.Name,
+                                ResourceType:   n.Config.Type,
+                                ResourceMode:   n.Config.Mode,
+                                IgnoreWarnings: true,
+                        },
+                        &EvalReadState{
+                                Name:   stateID,
+                                Output: &state,
+                        },
+                        &EvalDiff{
+                                Name:        stateID,
+                                Info:        info,
+                                Config:      &resourceConfig,
+                                Resource:    n.Config,
+                                Provider:    &provider,
+                                State:       &state,
+                                OutputState: &state,
+                                Stub:        true,
+                        },
+                        &EvalWriteState{
+                                Name:         stateID,
+                                ResourceType: n.Config.Type,
+                                Provider:     n.Config.Provider,
+                                Dependencies: stateDeps,
+                                State:        &state,
+                        },
+                },
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/plan.go b/vendor/github.com/hashicorp/terraform/terraform/plan.go
index ea08845..51d6652 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/plan.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/plan.go
@@ -6,6 +6,7 @@ import (
         "errors"
         "fmt"
         "io"
+        "log"
         "sync"
 
         "github.com/hashicorp/terraform/config/module"
@@ -31,6 +32,9 @@ type Plan struct {
         Vars    map[string]interface{}
         Targets []string
 
+        TerraformVersion string
+        ProviderSHA256s  map[string][]byte
+
         // Backend is the backend that this plan should use and store data with.
         Backend *BackendState
 
@@ -40,19 +44,58 @@ type Plan struct {
 // Context returns a Context with the data encapsulated in this plan.
 //
 // The following fields in opts are overridden by the plan: Config,
-// Diff, State, Variables.
+// Diff, Variables.
+//
+// If State is not provided, it is set from the plan. If it _is_ provided,
+// it must be Equal to the state stored in plan, but may have a newer
+// serial.
 func (p *Plan) Context(opts *ContextOpts) (*Context, error) {
+        var err error
+        opts, err = p.contextOpts(opts)
+        if err != nil {
+                return nil, err
+        }
+        return NewContext(opts)
+}
+
+// contextOpts mutates the given base ContextOpts in place to use input
+// objects obtained from the receiving plan.
+func (p *Plan) contextOpts(base *ContextOpts) (*ContextOpts, error) {
+        opts := base
+
         opts.Diff = p.Diff
         opts.Module = p.Module
-        opts.State = p.State
         opts.Targets = p.Targets
+        opts.ProviderSHA256s = p.ProviderSHA256s
+
+        if opts.State == nil {
+                opts.State = p.State
+        } else if !opts.State.Equal(p.State) {
+                // Even if we're overriding the state, it should be logically equal
+                // to what's in plan. The only valid change to have made by the time
+                // we get here is to have incremented the serial.
+                //
+                // Due to the fact that serialization may change the representation of
+                // the state, there is little chance that these aren't actually equal.
+                // Log the error condition for reference, but continue with the state
+                // we have.
+                log.Println("[WARNING] Plan state and ContextOpts state are not equal")
+        }
+
+        thisVersion := VersionString()
+        if p.TerraformVersion != "" && p.TerraformVersion != thisVersion {
+                return nil, fmt.Errorf(
+                        "plan was created with a different version of Terraform (created with %s, but running %s)",
+                        p.TerraformVersion, thisVersion,
+                )
+        }
 
         opts.Variables = make(map[string]interface{})
         for k, v := range p.Vars {
                 opts.Variables[k] = v
         }
 
-        return NewContext(opts)
+        return opts, nil
 }
 
 func (p *Plan) String() string {
@@ -86,7 +129,7 @@ func (p *Plan) init() {
 // the ability in the future to change the file format if we want for any
 // reason.
 const planFormatMagic = "tfplan"
-const planFormatVersion byte = 1
+const planFormatVersion byte = 2
 
 // ReadPlan reads a plan structure out of a reader in the format that
 // was written by WritePlan.
diff --git a/vendor/github.com/hashicorp/terraform/terraform/resource_address.go b/vendor/github.com/hashicorp/terraform/terraform/resource_address.go
index a8a0c95..8badca8 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/resource_address.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/resource_address.go
@@ -8,6 +8,7 @@ import (
         "strings"
 
         "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/config/module"
 )
 
 // ResourceAddress is a way of identifying an individual resource (or,
@@ -89,6 +90,51 @@ func (r *ResourceAddress) String() string {
         return strings.Join(result, ".")
 }
 
+// HasResourceSpec returns true if the address has a resource spec, as
+// defined in the documentation:
+//    https://www.terraform.io/docs/internals/resource-addressing.html
+// In particular, this returns false if the address contains only
+// a module path, thus addressing the entire module.
+func (r *ResourceAddress) HasResourceSpec() bool {
+        return r.Type != "" && r.Name != ""
+}
+
+// WholeModuleAddress returns the resource address that refers to all
+// resources in the same module as the receiver address.
+func (r *ResourceAddress) WholeModuleAddress() *ResourceAddress {
+        return &ResourceAddress{
+                Path:            r.Path,
+                Index:           -1,
+                InstanceTypeSet: false,
+        }
+}
+
+// MatchesConfig returns true if the receiver matches the given
+// configuration resource within the given configuration module.
+//
+// Since resource configuration blocks represent all of the instances of
+// a multi-instance resource, the index of the address (if any) is not
+// considered.
+func (r *ResourceAddress) MatchesConfig(mod *module.Tree, rc *config.Resource) bool {
+        if r.HasResourceSpec() {
+                if r.Mode != rc.Mode || r.Type != rc.Type || r.Name != rc.Name {
+                        return false
+                }
+        }
+
+        addrPath := r.Path
+        cfgPath := mod.Path()
+
+        // normalize
+        if len(addrPath) == 0 {
+                addrPath = nil
+        }
+        if len(cfgPath) == 0 {
+                cfgPath = nil
+        }
+        return reflect.DeepEqual(addrPath, cfgPath)
+}
+
 // stateId returns the ID that this resource should be entered with
 // in the state. This is also used for diffs. In the future, we'd like to
 // move away from this string field so I don't export this.
@@ -185,7 +231,10 @@ func ParseResourceAddress(s string) (*ResourceAddress, error) {
 
         // not allowed to say "data." without a type following
         if mode == config.DataResourceMode && matches["type"] == "" {
-                return nil, fmt.Errorf("must target specific data instance")
+                return nil, fmt.Errorf(
+                        "invalid resource address %q: must target specific data instance",
+                        s,
+                )
         }
 
         return &ResourceAddress{
@@ -199,6 +248,75 @@ func ParseResourceAddress(s string) (*ResourceAddress, error) {
         }, nil
 }
 
+// ParseResourceAddressForInstanceDiff creates a ResourceAddress for a
+// resource name as described in a module diff.
+//
+// For historical reasons a different addressing format is used in this
+// context. The internal format should not be shown in the UI and instead
+// this function should be used to translate to a ResourceAddress and
+// then, where appropriate, use the String method to produce a canonical
+// resource address string for display in the UI.
+//
+// The given path slice must be empty (or nil) for the root module, and
+// otherwise consist of a sequence of module names traversing down into
+// the module tree. If a non-nil path is provided, the caller must not
+// modify its underlying array after passing it to this function.
+func ParseResourceAddressForInstanceDiff(path []string, key string) (*ResourceAddress, error) {
+        addr, err := parseResourceAddressInternal(key)
+        if err != nil {
+                return nil, err
+        }
+        addr.Path = path
+        return addr, nil
+}
+
+// Contains returns true if and only if the given node is contained within
+// the receiver.
+//
+// Containment is defined in terms of the module and resource heirarchy:
+// a resource is contained within its module and any ancestor modules,
+// an indexed resource instance is contained with the unindexed resource, etc.
+func (addr *ResourceAddress) Contains(other *ResourceAddress) bool {
+        ourPath := addr.Path
+        givenPath := other.Path
+        if len(givenPath) < len(ourPath) {
+                return false
+        }
+        for i := range ourPath {
+                if ourPath[i] != givenPath[i] {
+                        return false
+                }
+        }
+
+        // If the receiver is a whole-module address then the path prefix
+        // matching is all we need.
+        if !addr.HasResourceSpec() {
+                return true
+        }
+
+        if addr.Type != other.Type || addr.Name != other.Name || addr.Mode != other.Mode {
+                return false
+        }
+
+        if addr.Index != -1 && addr.Index != other.Index {
+                return false
+        }
+
+        if addr.InstanceTypeSet && (addr.InstanceTypeSet != other.InstanceTypeSet || addr.InstanceType != other.InstanceType) {
+                return false
+        }
+
+        return true
+}
+
+// Equals returns true if the receiver matches the given address.
+//
+// The name of this method is a misnomer, since it doesn't test for exact
+// equality. Instead, it tests that the _specified_ parts of each
+// address match, treating any unspecified parts as wildcards.
+//
+// See also Contains, which takes a more heirarchical approach to comparing
+// addresses.
 func (addr *ResourceAddress) Equals(raw interface{}) bool {
         other, ok := raw.(*ResourceAddress)
         if !ok {
@@ -233,6 +351,58 @@ func (addr *ResourceAddress) Equals(raw interface{}) bool {
                 modeMatch
 }
 
+// Less returns true if and only if the receiver should be sorted before
+// the given address when presenting a list of resource addresses to
+// an end-user.
+//
+// This sort uses lexicographic sorting for most components, but uses
+// numeric sort for indices, thus causing index 10 to sort after
+// index 9, rather than after index 1.
+func (addr *ResourceAddress) Less(other *ResourceAddress) bool {
+
+        switch {
+
+        case len(addr.Path) < len(other.Path):
+                return true
+
+        case !reflect.DeepEqual(addr.Path, other.Path):
+                // If the two paths are the same length but don't match, we'll just
+                // cheat and compare the string forms since it's easier than
+                // comparing all of the path segments in turn.
+                addrStr := addr.String()
+                otherStr := other.String()
+                return addrStr < otherStr
+
+        case addr.Mode == config.DataResourceMode && other.Mode != config.DataResourceMode:
+                return true
+
+        case addr.Type < other.Type:
+                return true
+
+        case addr.Name < other.Name:
+                return true
+
+        case addr.Index < other.Index:
+                // Since "Index" is -1 for an un-indexed address, this also conveniently
+                // sorts unindexed addresses before indexed ones, should they both
+                // appear for some reason.
+                return true
+
+        case other.InstanceTypeSet && !addr.InstanceTypeSet:
+                return true
+
+        case addr.InstanceType < other.InstanceType:
+                // InstanceType is actually an enum, so this is just an arbitrary
+                // sort based on the enum numeric values, and thus not particularly
+                // meaningful.
+                return true
+
+        default:
+                return false
+
+        }
+}
+
 func ParseResourceIndex(s string) (int, error) {
         if s == "" {
                 return -1, nil
@@ -275,7 +445,7 @@ func tokenizeResourceAddress(s string) (map[string]string, error) {
         // string "aws_instance.web.tainted[1]"
         re := regexp.MustCompile(`\A` +
                 // "module.foo.module.bar" (optional)
-                `(?P<path>(?:module\.[^.]+\.?)*)` +
+                `(?P<path>(?:module\.(?P<module_name>[^.]+)\.?)*)` +
                 // possibly "data.", if targeting is a data resource
                 `(?P<data_prefix>(?:data\.)?)` +
                 // "aws_instance.web" (optional when module path specified)
@@ -289,7 +459,7 @@ func tokenizeResourceAddress(s string) (map[string]string, error) {
         groupNames := re.SubexpNames()
         rawMatches := re.FindAllStringSubmatch(s, -1)
         if len(rawMatches) != 1 {
-                return nil, fmt.Errorf("Problem parsing address: %q", s)
+                return nil, fmt.Errorf("invalid resource address %q", s)
         }
 
         matches := make(map[string]string)
diff --git a/vendor/github.com/hashicorp/terraform/terraform/resource_provider.go b/vendor/github.com/hashicorp/terraform/terraform/resource_provider.go
index 1a68c86..7d78f67 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/resource_provider.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/resource_provider.go
@@ -1,5 +1,12 @@
 package terraform
 
+import (
+        "fmt"
+
+        multierror "github.com/hashicorp/go-multierror"
+        "github.com/hashicorp/terraform/plugin/discovery"
+)
+
 // ResourceProvider is an interface that must be implemented by any
 // resource provider: the thing that creates and manages the resources in
 // a Terraform configuration.
@@ -154,6 +161,18 @@ type ResourceProvider interface {
         ReadDataApply(*InstanceInfo, *InstanceDiff) (*InstanceState, error)
 }
 
+// ResourceProviderError may be returned when creating a Context if the
+// required providers cannot be satisfied. This error can then be used to
+// format a more useful message for the user.
+type ResourceProviderError struct {
+        Errors []error
+}
+
+func (e *ResourceProviderError) Error() string {
+        // use multierror to format the default output
+        return multierror.Append(nil, e.Errors...).Error()
+}
+
 // ResourceProviderCloser is an interface that providers that can close
 // connections that aren't needed anymore must implement.
 type ResourceProviderCloser interface {
@@ -171,6 +190,50 @@ type DataSource struct {
         Name string
 }
 
+// ResourceProviderResolver is an interface implemented by objects that are
+// able to resolve a given set of resource provider version constraints
+// into ResourceProviderFactory callbacks.
+type ResourceProviderResolver interface {
+        // Given a constraint map, return a ResourceProviderFactory for each
+        // requested provider. If some or all of the constraints cannot be
+        // satisfied, return a non-nil slice of errors describing the problems.
+        ResolveProviders(reqd discovery.PluginRequirements) (map[string]ResourceProviderFactory, []error)
+}
+
+// ResourceProviderResolverFunc wraps a callback function and turns it into
+// a ResourceProviderResolver implementation, for convenience in situations
+// where a function and its associated closure are sufficient as a resolver
+// implementation.
+type ResourceProviderResolverFunc func(reqd discovery.PluginRequirements) (map[string]ResourceProviderFactory, []error)
+
+// ResolveProviders implements ResourceProviderResolver by calling the
+// wrapped function.
+func (f ResourceProviderResolverFunc) ResolveProviders(reqd discovery.PluginRequirements) (map[string]ResourceProviderFactory, []error) {
+        return f(reqd)
+}
+
+// ResourceProviderResolverFixed returns a ResourceProviderResolver that
+// has a fixed set of provider factories provided by the caller. The returned
+// resolver ignores version constraints entirely and just returns the given
+// factory for each requested provider name.
+//
+// This function is primarily used in tests, to provide mock providers or
+// in-process providers under test.
+func ResourceProviderResolverFixed(factories map[string]ResourceProviderFactory) ResourceProviderResolver {
+        return ResourceProviderResolverFunc(func(reqd discovery.PluginRequirements) (map[string]ResourceProviderFactory, []error) {
+                ret := make(map[string]ResourceProviderFactory, len(reqd))
+                var errs []error
+                for name := range reqd {
+                        if factory, exists := factories[name]; exists {
+                                ret[name] = factory
+                        } else {
+                                errs = append(errs, fmt.Errorf("provider %q is not available", name))
+                        }
+                }
+                return ret, errs
+        })
+}
+
 // ResourceProviderFactory is a function type that creates a new instance
 // of a resource provider.
 type ResourceProviderFactory func() (ResourceProvider, error)
@@ -202,3 +265,21 @@ func ProviderHasDataSource(p ResourceProvider, n string) bool {
 
         return false
 }
+
+// resourceProviderFactories matches available plugins to the given version
+// requirements to produce a map of compatible provider plugins if possible,
+// or an error if the currently-available plugins are insufficient.
+//
+// This should be called only with configurations that have passed calls
+// to config.Validate(), which ensures that all of the given version
+// constraints are valid. It will panic if any invalid constraints are present.
+func resourceProviderFactories(resolver ResourceProviderResolver, reqd discovery.PluginRequirements) (map[string]ResourceProviderFactory, error) {
+        ret, errs := resolver.ResolveProviders(reqd)
+        if errs != nil {
+                return nil, &ResourceProviderError{
+                        Errors: errs,
+                }
+        }
+
+        return ret, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/state.go b/vendor/github.com/hashicorp/terraform/terraform/state.go
index 074b682..0c46194 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/state.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/state.go
@@ -533,6 +533,43 @@ func (s *State) equal(other *State) bool {
         return true
 }
 
+// MarshalEqual is similar to Equal but provides a stronger definition of
+// "equal", where two states are equal if and only if their serialized form
+// is byte-for-byte identical.
+//
+// This is primarily useful for callers that are trying to save snapshots
+// of state to persistent storage, allowing them to detect when a new
+// snapshot must be taken.
+//
+// Note that the serial number and lineage are included in the serialized form,
+// so it's the caller's responsibility to properly manage these attributes
+// so that this method is only called on two states that have the same
+// serial and lineage, unless detecting such differences is desired.
+func (s *State) MarshalEqual(other *State) bool {
+        if s == nil && other == nil {
+                return true
+        } else if s == nil || other == nil {
+                return false
+        }
+
+        recvBuf := &bytes.Buffer{}
+        otherBuf := &bytes.Buffer{}
+
+        err := WriteState(s, recvBuf)
+        if err != nil {
+                // should never happen, since we're writing to a buffer
+                panic(err)
+        }
+
+        err = WriteState(other, otherBuf)
+        if err != nil {
+                // should never happen, since we're writing to a buffer
+                panic(err)
+        }
+
+        return bytes.Equal(recvBuf.Bytes(), otherBuf.Bytes())
+}
+
 type StateAgeComparison int
 
 const (
@@ -603,6 +640,10 @@ func (s *State) SameLineage(other *State) bool {
 // DeepCopy performs a deep copy of the state structure and returns
 // a new structure.
 func (s *State) DeepCopy() *State {
+        if s == nil {
+                return nil
+        }
+
         copy, err := copystructure.Config{Lock: true}.Copy(s)
         if err != nil {
                 panic(err)
@@ -611,30 +652,6 @@ func (s *State) DeepCopy() *State {
         return copy.(*State)
 }
 
-// IncrementSerialMaybe increments the serial number of this state
-// if it different from the other state.
-func (s *State) IncrementSerialMaybe(other *State) {
-        if s == nil {
-                return
-        }
-        if other == nil {
-                return
-        }
-        s.Lock()
-        defer s.Unlock()
-
-        if s.Serial > other.Serial {
-                return
-        }
-        if other.TFVersion != s.TFVersion || !s.equal(other) {
-                if other.Serial > s.Serial {
-                        s.Serial = other.Serial
-                }
-
-                s.Serial++
-        }
-}
-
 // FromFutureTerraform checks if this state was written by a Terraform
 // version from the future.
 func (s *State) FromFutureTerraform() bool {
@@ -660,6 +677,7 @@ func (s *State) init() {
         if s.Version == 0 {
                 s.Version = StateVersion
         }
+
         if s.moduleByPath(rootModulePath) == nil {
                 s.addModule(rootModulePath)
         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/test_failure b/vendor/github.com/hashicorp/terraform/terraform/test_failure
new file mode 100644
index 0000000..5d3ad1a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/test_failure
@@ -0,0 +1,9 @@
+--- FAIL: TestContext2Plan_moduleProviderInherit (0.01s)
+        context_plan_test.go:552: bad: []string{"child"}
+map[string]dag.Vertex{}
+"module.middle.null"
+map[string]dag.Vertex{}
+"module.middle.module.inner.null"
+map[string]dag.Vertex{}
+"aws"
+FAIL
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_resource_refresh_plannable.go b/vendor/github.com/hashicorp/terraform/terraform/transform_resource_refresh_plannable.go
deleted file mode 100644
index 35358a3..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_resource_refresh_plannable.go
+++ /dev/null
@@ -1,55 +0,0 @@
-package terraform
-
-import (
-        "fmt"
-        "log"
-)
-
-// ResourceRefreshPlannableTransformer is a GraphTransformer that replaces any
-// nodes that don't have state yet exist in config with
-// NodePlannableResourceInstance.
-//
-// This transformer is used when expanding count on managed resource nodes
-// during the refresh phase to ensure that data sources that have
-// interpolations that depend on resources existing in the graph can be walked
-// properly.
-type ResourceRefreshPlannableTransformer struct {
-        // The full global state.
-        State *State
-}
-
-// Transform implements GraphTransformer for
-// ResourceRefreshPlannableTransformer.
-func (t *ResourceRefreshPlannableTransformer) Transform(g *Graph) error {
-nextVertex:
-        for _, v := range g.Vertices() {
-                addr := v.(*NodeRefreshableManagedResourceInstance).Addr
-
-                // Find the state for this address, if there is one
-                filter := &StateFilter{State: t.State}
-                results, err := filter.Filter(addr.String())
-                if err != nil {
-                        return err
-                }
-
-                // Check to see if we have a state for this resource. If we do, skip this
-                // node.
-                for _, result := range results {
-                        if _, ok := result.Value.(*ResourceState); ok {
-                                continue nextVertex
-                        }
-                }
-                // If we don't, convert this resource to a NodePlannableResourceInstance node
-                // with all of the data we need to make it happen.
-                log.Printf("[TRACE] No state for %s, converting to NodePlannableResourceInstance", addr.String())
-                new := &NodePlannableResourceInstance{
-                        NodeAbstractResource: v.(*NodeRefreshableManagedResourceInstance).NodeAbstractResource,
-                }
-                // Replace the node in the graph
-                if !g.Replace(v, new) {
-                        return fmt.Errorf("ResourceRefreshPlannableTransformer: Could not replace node %#v with %#v", v, new)
-                }
-        }
-
-        return nil
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_targets.go b/vendor/github.com/hashicorp/terraform/terraform/transform_targets.go
index 125f9e3..4f117b4 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_targets.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_targets.go
@@ -41,6 +41,12 @@ type TargetsTransformer struct {
         // that already have the targets parsed
         ParsedTargets []ResourceAddress
 
+        // If set, the index portions of resource addresses will be ignored
+        // for comparison. This is used when transforming a graph where
+        // counted resources have not yet been expanded, since otherwise
+        // the unexpanded nodes (which never have indices) would not match.
+        IgnoreIndices bool
+
         // Set to true when we're in a `terraform destroy` or a
         // `terraform plan -destroy`
         Destroy bool
@@ -199,7 +205,12 @@ func (t *TargetsTransformer) nodeIsTarget(
 
         addr := r.ResourceAddr()
         for _, targetAddr := range addrs {
-                if targetAddr.Equals(addr) {
+                if t.IgnoreIndices {
+                        // targetAddr is not a pointer, so we can safely mutate it without
+                        // interfering with references elsewhere.
+                        targetAddr.Index = -1
+                }
+                if targetAddr.Contains(addr) {
                         return true
                 }
         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/util.go b/vendor/github.com/hashicorp/terraform/terraform/util.go
index f41f0d7..752241a 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/util.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/util.go
@@ -2,7 +2,8 @@ package terraform
 
 import (
         "sort"
-        "strings"
+
+        "github.com/hashicorp/terraform/config"
 )
 
 // Semaphore is a wrapper around a channel to provide
@@ -47,21 +48,8 @@ func (s Semaphore) Release() {
         }
 }
 
-// resourceProvider returns the provider name for the given type.
-func resourceProvider(t, alias string) string {
-        if alias != "" {
-                return alias
-        }
-
-        idx := strings.IndexRune(t, '_')
-        if idx == -1 {
-                // If no underscores, the resource name is assumed to be
-                // also the provider name, e.g. if the provider exposes
-                // only a single resource of each type.
-                return t
-        }
-
-        return t[:idx]
+func resourceProvider(resourceType, explicitProvider string) string {
+        return config.ResourceProviderFullName(resourceType, explicitProvider)
 }
 
 // strSliceContains checks if a given string is contained in a slice
diff --git a/vendor/github.com/hashicorp/terraform/terraform/version.go b/vendor/github.com/hashicorp/terraform/terraform/version.go
index cdfb8fb..d61b11e 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/version.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/version.go
@@ -7,12 +7,12 @@ import (
 )
 
 // The main version number that is being run at the moment.
-const Version = "0.9.8"
+const Version = "0.10.0"
 
 // A pre-release marker for the version. If this is "" (empty string)
 // then it means that it is a final release. Otherwise, this is a pre-release
 // such as "dev" (in development), "beta", "rc1", etc.
-var VersionPrerelease = ""
+var VersionPrerelease = "dev"
 
 // SemVersion is an instance of version.Version. This has the secondary
 // benefit of verifying during tests and init time that our version is a