deps: github.com/hashicorp/terraform@sdk-v0.11-with-go-modules

Updated via: go get github.com/hashicorp/terraform@sdk-v0.11-with-go-modules and go mod tidy

183 files changed, 9142 insertions, 3772 deletions

diff --git a/vendor/github.com/hashicorp/terraform/config/append.go b/vendor/github.com/hashicorp/terraform/config/append.go
index 5f4e89e..9d80c42 100644
--- a/vendor/github.com/hashicorp/terraform/config/append.go
+++ b/vendor/github.com/hashicorp/terraform/config/append.go
@@ -82,5 +82,11 @@ func Append(c1, c2 *Config) (*Config, error) {
                 c.Variables = append(c.Variables, c2.Variables...)
         }
 
+        if len(c1.Locals) > 0 || len(c2.Locals) > 0 {
+                c.Locals = make([]*Local, 0, len(c1.Locals)+len(c2.Locals))
+                c.Locals = append(c.Locals, c1.Locals...)
+                c.Locals = append(c.Locals, c2.Locals...)
+        }
+
         return c, nil
 }
diff --git a/vendor/github.com/hashicorp/terraform/config/config.go b/vendor/github.com/hashicorp/terraform/config/config.go
index 3f756dc..1772fd7 100644
--- a/vendor/github.com/hashicorp/terraform/config/config.go
+++ b/vendor/github.com/hashicorp/terraform/config/config.go
@@ -8,11 +8,11 @@ import (
         "strconv"
         "strings"
 
-        "github.com/hashicorp/go-multierror"
-        "github.com/hashicorp/hil"
+        hcl2 "github.com/hashicorp/hcl2/hcl"
         "github.com/hashicorp/hil/ast"
         "github.com/hashicorp/terraform/helper/hilmapstructure"
         "github.com/hashicorp/terraform/plugin/discovery"
+        "github.com/hashicorp/terraform/tfdiags"
         "github.com/mitchellh/reflectwalk"
 )
 
@@ -34,6 +34,7 @@ type Config struct {
         ProviderConfigs []*ProviderConfig
         Resources       []*Resource
         Variables       []*Variable
+        Locals          []*Local
         Outputs         []*Output
 
         // The fields below can be filled in by loaders for validation
@@ -55,6 +56,8 @@ type AtlasConfig struct {
 type Module struct {
         Name      string
         Source    string
+        Version   string
+        Providers map[string]string
         RawConfig *RawConfig
 }
 
@@ -147,7 +150,7 @@ func (p *Provisioner) Copy() *Provisioner {
         }
 }
 
-// Variable is a variable defined within the configuration.
+// Variable is a module argument defined within the configuration.
 type Variable struct {
         Name         string
         DeclaredType string `mapstructure:"type"`
@@ -155,6 +158,12 @@ type Variable struct {
         Description  string
 }
 
+// Local is a local value defined within the configuration.
+type Local struct {
+        Name      string
+        RawConfig *RawConfig
+}
+
 // Output is an output defined within the configuration. An output is
 // resulting data that is highlighted by Terraform when finished. An
 // output marked Sensitive will be output in a masked form following
@@ -222,7 +231,10 @@ func (r *Resource) Count() (int, error) {
 
         v, err := strconv.ParseInt(count, 0, 0)
         if err != nil {
-                return 0, err
+                return 0, fmt.Errorf(
+                        "cannot parse %q as an integer",
+                        count,
+                )
         }
 
         return int(v), nil
@@ -253,7 +265,9 @@ func (r *Resource) ProviderFullName() string {
 // the provider name is inferred from the resource type name.
 func ResourceProviderFullName(resourceType, explicitProvider string) string {
         if explicitProvider != "" {
-                return explicitProvider
+                // check for an explicit provider name, or return the original
+                parts := strings.SplitAfter(explicitProvider, "provider.")
+                return parts[len(parts)-1]
         }
 
         idx := strings.IndexRune(resourceType, '_')
@@ -268,30 +282,35 @@ func ResourceProviderFullName(resourceType, explicitProvider string) string {
 }
 
 // Validate does some basic semantic checking of the configuration.
-func (c *Config) Validate() error {
+func (c *Config) Validate() tfdiags.Diagnostics {
         if c == nil {
                 return nil
         }
 
-        var errs []error
+        var diags tfdiags.Diagnostics
 
         for _, k := range c.unknownKeys {
-                errs = append(errs, fmt.Errorf(
-                        "Unknown root level key: %s", k))
+                diags = diags.Append(
+                        fmt.Errorf("Unknown root level key: %s", k),
+                )
         }
 
         // Validate the Terraform config
         if tf := c.Terraform; tf != nil {
-                errs = append(errs, c.Terraform.Validate()...)
+                errs := c.Terraform.Validate()
+                for _, err := range errs {
+                        diags = diags.Append(err)
+                }
         }
 
         vars := c.InterpolatedVariables()
         varMap := make(map[string]*Variable)
         for _, v := range c.Variables {
                 if _, ok := varMap[v.Name]; ok {
-                        errs = append(errs, fmt.Errorf(
+                        diags = diags.Append(fmt.Errorf(
                                 "Variable '%s': duplicate found. Variable names must be unique.",
-                                v.Name))
+                                v.Name,
+                        ))
                 }
 
                 varMap[v.Name] = v
@@ -299,17 +318,19 @@ func (c *Config) Validate() error {
 
         for k, _ := range varMap {
                 if !NameRegexp.MatchString(k) {
-                        errs = append(errs, fmt.Errorf(
-                                "variable %q: variable name must match regular expresion %s",
-                                k, NameRegexp))
+                        diags = diags.Append(fmt.Errorf(
+                                "variable %q: variable name must match regular expression %s",
+                                k, NameRegexp,
+                        ))
                 }
         }
 
         for _, v := range c.Variables {
                 if v.Type() == VariableTypeUnknown {
-                        errs = append(errs, fmt.Errorf(
+                        diags = diags.Append(fmt.Errorf(
                                 "Variable '%s': must be a string or a map",
-                                v.Name))
+                                v.Name,
+                        ))
                         continue
                 }
 
@@ -330,9 +351,10 @@ func (c *Config) Validate() error {
                 if v.Default != nil {
                         if err := reflectwalk.Walk(v.Default, w); err == nil {
                                 if interp {
-                                        errs = append(errs, fmt.Errorf(
-                                                "Variable '%s': cannot contain interpolations",
-                                                v.Name))
+                                        diags = diags.Append(fmt.Errorf(
+                                                "variable %q: default may not contain interpolations",
+                                                v.Name,
+                                        ))
                                 }
                         }
                 }
@@ -348,10 +370,11 @@ func (c *Config) Validate() error {
                         }
 
                         if _, ok := varMap[uv.Name]; !ok {
-                                errs = append(errs, fmt.Errorf(
-                                        "%s: unknown variable referenced: '%s'. define it with 'variable' blocks",
+                                diags = diags.Append(fmt.Errorf(
+                                        "%s: unknown variable referenced: '%s'; define it with a 'variable' block",
                                         source,
-                                        uv.Name))
+                                        uv.Name,
+                                ))
                         }
                 }
         }
@@ -362,17 +385,19 @@ func (c *Config) Validate() error {
                         switch v := rawV.(type) {
                         case *CountVariable:
                                 if v.Type == CountValueInvalid {
-                                        errs = append(errs, fmt.Errorf(
+                                        diags = diags.Append(fmt.Errorf(
                                                 "%s: invalid count variable: %s",
                                                 source,
-                                                v.FullKey()))
+                                                v.FullKey(),
+                                        ))
                                 }
                         case *PathVariable:
                                 if v.Type == PathValueInvalid {
-                                        errs = append(errs, fmt.Errorf(
+                                        diags = diags.Append(fmt.Errorf(
                                                 "%s: invalid path variable: %s",
                                                 source,
-                                                v.FullKey()))
+                                                v.FullKey(),
+                                        ))
                                 }
                         }
                 }
@@ -380,27 +405,35 @@ func (c *Config) Validate() error {
 
         // Check that providers aren't declared multiple times and that their
         // version constraints, where present, are syntactically valid.
-        providerSet := make(map[string]struct{})
+        providerSet := make(map[string]bool)
         for _, p := range c.ProviderConfigs {
                 name := p.FullName()
                 if _, ok := providerSet[name]; ok {
-                        errs = append(errs, fmt.Errorf(
-                                "provider.%s: declared multiple times, you can only declare a provider once",
-                                name))
+                        diags = diags.Append(fmt.Errorf(
+                                "provider.%s: multiple configurations present; only one configuration is allowed per provider",
+                                name,
+                        ))
                         continue
                 }
 
                 if p.Version != "" {
                         _, err := discovery.ConstraintStr(p.Version).Parse()
                         if err != nil {
-                                errs = append(errs, fmt.Errorf(
-                                        "provider.%s: invalid version constraint %q: %s",
-                                        name, p.Version, err,
-                                ))
+                                diags = diags.Append(&hcl2.Diagnostic{
+                                        Severity: hcl2.DiagError,
+                                        Summary:  "Invalid provider version constraint",
+                                        Detail: fmt.Sprintf(
+                                                "The value %q given for provider.%s is not a valid version constraint.",
+                                                p.Version, name,
+                                        ),
+                                        // TODO: include a "Subject" source reference in here,
+                                        // once the config loader is able to retain source
+                                        // location information.
+                                })
                         }
                 }
 
-                providerSet[name] = struct{}{}
+                providerSet[name] = true
         }
 
         // Check that all references to modules are valid
@@ -412,9 +445,10 @@ func (c *Config) Validate() error {
                         if _, ok := dupped[m.Id()]; !ok {
                                 dupped[m.Id()] = struct{}{}
 
-                                errs = append(errs, fmt.Errorf(
-                                        "%s: module repeated multiple times",
-                                        m.Id()))
+                                diags = diags.Append(fmt.Errorf(
+                                        "module %q: module repeated multiple times",
+                                        m.Id(),
+                                ))
                         }
 
                         // Already seen this module, just skip it
@@ -428,21 +462,23 @@ func (c *Config) Validate() error {
                         "root": m.Source,
                 })
                 if err != nil {
-                        errs = append(errs, fmt.Errorf(
-                                "%s: module source error: %s",
-                                m.Id(), err))
+                        diags = diags.Append(fmt.Errorf(
+                                "module %q: module source error: %s",
+                                m.Id(), err,
+                        ))
                 } else if len(rc.Interpolations) > 0 {
-                        errs = append(errs, fmt.Errorf(
-                                "%s: module source cannot contain interpolations",
-                                m.Id()))
+                        diags = diags.Append(fmt.Errorf(
+                                "module %q: module source cannot contain interpolations",
+                                m.Id(),
+                        ))
                 }
 
                 // Check that the name matches our regexp
                 if !NameRegexp.Match([]byte(m.Name)) {
-                        errs = append(errs, fmt.Errorf(
-                                "%s: module name can only contain letters, numbers, "+
-                                        "dashes, and underscores",
-                                m.Id()))
+                        diags = diags.Append(fmt.Errorf(
+                                "module %q: module name must be a letter or underscore followed by only letters, numbers, dashes, and underscores",
+                                m.Id(),
+                        ))
                 }
 
                 // Check that the configuration can all be strings, lists or maps
@@ -466,30 +502,47 @@ func (c *Config) Validate() error {
                                 continue
                         }
 
-                        errs = append(errs, fmt.Errorf(
-                                "%s: variable %s must be a string, list or map value",
-                                m.Id(), k))
+                        diags = diags.Append(fmt.Errorf(
+                                "module %q: argument %s must have a string, list, or map value",
+                                m.Id(), k,
+                        ))
                 }
 
                 // Check for invalid count variables
                 for _, v := range m.RawConfig.Variables {
                         switch v.(type) {
                         case *CountVariable:
-                                errs = append(errs, fmt.Errorf(
-                                        "%s: count variables are only valid within resources", m.Name))
+                                diags = diags.Append(fmt.Errorf(
+                                        "module %q: count variables are only valid within resources",
+                                        m.Name,
+                                ))
                         case *SelfVariable:
-                                errs = append(errs, fmt.Errorf(
-                                        "%s: self variables are only valid within resources", m.Name))
+                                diags = diags.Append(fmt.Errorf(
+                                        "module %q: self variables are only valid within resources",
+                                        m.Name,
+                                ))
                         }
                 }
 
                 // Update the raw configuration to only contain the string values
                 m.RawConfig, err = NewRawConfig(raw)
                 if err != nil {
-                        errs = append(errs, fmt.Errorf(
+                        diags = diags.Append(fmt.Errorf(
                                 "%s: can't initialize configuration: %s",
-                                m.Id(), err))
+                                m.Id(), err,
+                        ))
                 }
+
+                // check that all named providers actually exist
+                for _, p := range m.Providers {
+                        if !providerSet[p] {
+                                diags = diags.Append(fmt.Errorf(
+                                        "module %q: cannot pass non-existent provider %q",
+                                        m.Name, p,
+                                ))
+                        }
+                }
+
         }
         dupped = nil
 
@@ -503,10 +556,10 @@ func (c *Config) Validate() error {
                         }
 
                         if _, ok := modules[mv.Name]; !ok {
-                                errs = append(errs, fmt.Errorf(
+                                diags = diags.Append(fmt.Errorf(
                                         "%s: unknown module referenced: %s",
-                                        source,
-                                        mv.Name))
+                                        source, mv.Name,
+                                ))
                         }
                 }
         }
@@ -519,9 +572,10 @@ func (c *Config) Validate() error {
                         if _, ok := dupped[r.Id()]; !ok {
                                 dupped[r.Id()] = struct{}{}
 
-                                errs = append(errs, fmt.Errorf(
+                                diags = diags.Append(fmt.Errorf(
                                         "%s: resource repeated multiple times",
-                                        r.Id()))
+                                        r.Id(),
+                                ))
                         }
                 }
 
@@ -535,53 +589,42 @@ func (c *Config) Validate() error {
                 for _, v := range r.RawCount.Variables {
                         switch v.(type) {
                         case *CountVariable:
-                                errs = append(errs, fmt.Errorf(
+                                diags = diags.Append(fmt.Errorf(
                                         "%s: resource count can't reference count variable: %s",
-                                        n,
-                                        v.FullKey()))
+                                        n, v.FullKey(),
+                                ))
                         case *SimpleVariable:
-                                errs = append(errs, fmt.Errorf(
+                                diags = diags.Append(fmt.Errorf(
                                         "%s: resource count can't reference variable: %s",
-                                        n,
-                                        v.FullKey()))
+                                        n, v.FullKey(),
+                                ))
 
                         // Good
                         case *ModuleVariable:
                         case *ResourceVariable:
                         case *TerraformVariable:
                         case *UserVariable:
+                        case *LocalVariable:
 
                         default:
-                                errs = append(errs, fmt.Errorf(
+                                diags = diags.Append(fmt.Errorf(
                                         "Internal error. Unknown type in count var in %s: %T",
-                                        n, v))
+                                        n, v,
+                                ))
                         }
                 }
 
-                // Interpolate with a fixed number to verify that its a number.
-                r.RawCount.interpolate(func(root ast.Node) (interface{}, error) {
-                        // Execute the node but transform the AST so that it returns
-                        // a fixed value of "5" for all interpolations.
-                        result, err := hil.Eval(
-                                hil.FixedValueTransform(
-                                        root, &ast.LiteralNode{Value: "5", Typex: ast.TypeString}),
-                                nil)
-                        if err != nil {
-                                return "", err
-                        }
-
-                        return result.Value, nil
-                })
-                _, err := strconv.ParseInt(r.RawCount.Value().(string), 0, 0)
-                if err != nil {
-                        errs = append(errs, fmt.Errorf(
-                                "%s: resource count must be an integer",
-                                n))
+                if !r.RawCount.couldBeInteger() {
+                        diags = diags.Append(fmt.Errorf(
+                                "%s: resource count must be an integer", n,
+                        ))
                 }
                 r.RawCount.init()
 
                 // Validate DependsOn
-                errs = append(errs, c.validateDependsOn(n, r.DependsOn, resources, modules)...)
+                for _, err := range c.validateDependsOn(n, r.DependsOn, resources, modules) {
+                        diags = diags.Append(err)
+                }
 
                 // Verify provisioners
                 for _, p := range r.Provisioners {
@@ -595,9 +638,10 @@ func (c *Config) Validate() error {
                                 }
 
                                 if rv.Multi && rv.Index == -1 && rv.Type == r.Type && rv.Name == r.Name {
-                                        errs = append(errs, fmt.Errorf(
-                                                "%s: connection info cannot contain splat variable "+
-                                                        "referencing itself", n))
+                                        diags = diags.Append(fmt.Errorf(
+                                                "%s: connection info cannot contain splat variable referencing itself",
+                                                n,
+                                        ))
                                         break
                                 }
                         }
@@ -609,9 +653,10 @@ func (c *Config) Validate() error {
                                 }
 
                                 if rv.Multi && rv.Index == -1 && rv.Type == r.Type && rv.Name == r.Name {
-                                        errs = append(errs, fmt.Errorf(
-                                                "%s: connection info cannot contain splat variable "+
-                                                        "referencing itself", n))
+                                        diags = diags.Append(fmt.Errorf(
+                                                "%s: connection info cannot contain splat variable referencing itself",
+                                                n,
+                                        ))
                                         break
                                 }
                         }
@@ -619,21 +664,24 @@ func (c *Config) Validate() error {
                         // Check for invalid when/onFailure values, though this should be
                         // picked up by the loader we check here just in case.
                         if p.When == ProvisionerWhenInvalid {
-                                errs = append(errs, fmt.Errorf(
-                                        "%s: provisioner 'when' value is invalid", n))
+                                diags = diags.Append(fmt.Errorf(
+                                        "%s: provisioner 'when' value is invalid", n,
+                                ))
                         }
                         if p.OnFailure == ProvisionerOnFailureInvalid {
-                                errs = append(errs, fmt.Errorf(
-                                        "%s: provisioner 'on_failure' value is invalid", n))
+                                diags = diags.Append(fmt.Errorf(
+                                        "%s: provisioner 'on_failure' value is invalid", n,
+                                ))
                         }
                 }
 
                 // Verify ignore_changes contains valid entries
                 for _, v := range r.Lifecycle.IgnoreChanges {
                         if strings.Contains(v, "*") && v != "*" {
-                                errs = append(errs, fmt.Errorf(
-                                        "%s: ignore_changes does not support using a partial string "+
-                                                "together with a wildcard: %s", n, v))
+                                diags = diags.Append(fmt.Errorf(
+                                        "%s: ignore_changes does not support using a partial string together with a wildcard: %s",
+                                        n, v,
+                                ))
                         }
                 }
 
@@ -642,21 +690,24 @@ func (c *Config) Validate() error {
                         "root": r.Lifecycle.IgnoreChanges,
                 })
                 if err != nil {
-                        errs = append(errs, fmt.Errorf(
+                        diags = diags.Append(fmt.Errorf(
                                 "%s: lifecycle ignore_changes error: %s",
-                                n, err))
+                                n, err,
+                        ))
                 } else if len(rc.Interpolations) > 0 {
-                        errs = append(errs, fmt.Errorf(
+                        diags = diags.Append(fmt.Errorf(
                                 "%s: lifecycle ignore_changes cannot contain interpolations",
-                                n))
+                                n,
+                        ))
                 }
 
                 // If it is a data source then it can't have provisioners
                 if r.Mode == DataResourceMode {
                         if _, ok := r.RawConfig.Raw["provisioner"]; ok {
-                                errs = append(errs, fmt.Errorf(
+                                diags = diags.Append(fmt.Errorf(
                                         "%s: data sources cannot have provisioners",
-                                        n))
+                                        n,
+                                ))
                         }
                 }
         }
@@ -670,25 +721,50 @@ func (c *Config) Validate() error {
 
                         id := rv.ResourceId()
                         if _, ok := resources[id]; !ok {
-                                errs = append(errs, fmt.Errorf(
+                                diags = diags.Append(fmt.Errorf(
                                         "%s: unknown resource '%s' referenced in variable %s",
                                         source,
                                         id,
-                                        rv.FullKey()))
+                                        rv.FullKey(),
+                                ))
                                 continue
                         }
                 }
         }
 
+        // Check that all locals are valid
+        {
+                found := make(map[string]struct{})
+                for _, l := range c.Locals {
+                        if _, ok := found[l.Name]; ok {
+                                diags = diags.Append(fmt.Errorf(
+                                        "%s: duplicate local. local value names must be unique",
+                                        l.Name,
+                                ))
+                                continue
+                        }
+                        found[l.Name] = struct{}{}
+
+                        for _, v := range l.RawConfig.Variables {
+                                if _, ok := v.(*CountVariable); ok {
+                                        diags = diags.Append(fmt.Errorf(
+                                                "local %s: count variables are only valid within resources", l.Name,
+                                        ))
+                                }
+                        }
+                }
+        }
+
         // Check that all outputs are valid
         {
                 found := make(map[string]struct{})
                 for _, o := range c.Outputs {
                         // Verify the output is new
                         if _, ok := found[o.Name]; ok {
-                                errs = append(errs, fmt.Errorf(
-                                        "%s: duplicate output. output names must be unique.",
-                                        o.Name))
+                                diags = diags.Append(fmt.Errorf(
+                                        "output %q: an output of this name was already defined",
+                                        o.Name,
+                                ))
                                 continue
                         }
                         found[o.Name] = struct{}{}
@@ -708,9 +784,10 @@ func (c *Config) Validate() error {
                                                 continue
                                         }
 
-                                        errs = append(errs, fmt.Errorf(
-                                                "%s: value for 'sensitive' must be boolean",
-                                                o.Name))
+                                        diags = diags.Append(fmt.Errorf(
+                                                "output %q: value for 'sensitive' must be boolean",
+                                                o.Name,
+                                        ))
                                         continue
                                 }
                                 if k == "description" {
@@ -719,27 +796,78 @@ func (c *Config) Validate() error {
                                                 continue
                                         }
 
-                                        errs = append(errs, fmt.Errorf(
-                                                "%s: value for 'description' must be string",
-                                                o.Name))
+                                        diags = diags.Append(fmt.Errorf(
+                                                "output %q: value for 'description' must be string",
+                                                o.Name,
+                                        ))
                                         continue
                                 }
                                 invalidKeys = append(invalidKeys, k)
                         }
                         if len(invalidKeys) > 0 {
-                                errs = append(errs, fmt.Errorf(
-                                        "%s: output has invalid keys: %s",
-                                        o.Name, strings.Join(invalidKeys, ", ")))
+                                diags = diags.Append(fmt.Errorf(
+                                        "output %q: invalid keys: %s",
+                                        o.Name, strings.Join(invalidKeys, ", "),
+                                ))
                         }
                         if !valueKeyFound {
-                                errs = append(errs, fmt.Errorf(
-                                        "%s: output is missing required 'value' key", o.Name))
+                                diags = diags.Append(fmt.Errorf(
+                                        "output %q: missing required 'value' argument", o.Name,
+                                ))
                         }
 
                         for _, v := range o.RawConfig.Variables {
                                 if _, ok := v.(*CountVariable); ok {
-                                        errs = append(errs, fmt.Errorf(
-                                                "%s: count variables are only valid within resources", o.Name))
+                                        diags = diags.Append(fmt.Errorf(
+                                                "output %q: count variables are only valid within resources",
+                                                o.Name,
+                                        ))
+                                }
+                        }
+
+                        // Detect a common mistake of using a "count"ed resource in
+                        // an output value without using the splat or index form.
+                        // Prior to 0.11 this error was silently ignored, but outputs
+                        // now have their errors checked like all other contexts.
+                        //
+                        // TODO: Remove this in 0.12.
+                        for _, v := range o.RawConfig.Variables {
+                                rv, ok := v.(*ResourceVariable)
+                                if !ok {
+                                        continue
+                                }
+
+                                // If the variable seems to be treating the referenced
+                                // resource as a singleton (no count specified) then
+                                // we'll check to make sure it is indeed a singleton.
+                                // It's a warning if not.
+
+                                if rv.Multi || rv.Index != 0 {
+                                        // This reference is treating the resource as a
+                                        // multi-resource, so the warning doesn't apply.
+                                        continue
+                                }
+
+                                for _, r := range c.Resources {
+                                        if r.Id() != rv.ResourceId() {
+                                                continue
+                                        }
+
+                                        // We test specifically for the raw string "1" here
+                                        // because we _do_ want to generate this warning if
+                                        // the user has provided an expression that happens
+                                        // to return 1 right now, to catch situations where
+                                        // a count might dynamically be set to something
+                                        // other than 1 and thus splat syntax is still needed
+                                        // to be safe.
+                                        if r.RawCount != nil && r.RawCount.Raw != nil && r.RawCount.Raw["count"] != "1" && rv.Field != "count" {
+                                                diags = diags.Append(tfdiags.SimpleWarning(fmt.Sprintf(
+                                                        "output %q: must use splat syntax to access %s attribute %q, because it has \"count\" set; use %s.*.%s to obtain a list of the attributes across all instances",
+                                                        o.Name,
+                                                        r.Id(), rv.Field,
+                                                        r.Id(), rv.Field,
+                                                )))
+                                        }
                                 }
                         }
                 }
@@ -755,17 +883,15 @@ func (c *Config) Validate() error {
 
                 for _, v := range rc.Variables {
                         if _, ok := v.(*SelfVariable); ok {
-                                errs = append(errs, fmt.Errorf(
-                                        "%s: cannot contain self-reference %s", source, v.FullKey()))
+                                diags = diags.Append(fmt.Errorf(
+                                        "%s: cannot contain self-reference %s",
+                                        source, v.FullKey(),
+                                ))
                         }
                 }
         }
 
-        if len(errs) > 0 {
-                return &multierror.Error{Errors: errs}
-        }
-
-        return nil
+        return diags
 }
 
 // InterpolatedVariables is a helper that returns a mapping of all the interpolated
diff --git a/vendor/github.com/hashicorp/terraform/config/config_string.go b/vendor/github.com/hashicorp/terraform/config/config_string.go
index 0b3abbc..a6933c2 100644
--- a/vendor/github.com/hashicorp/terraform/config/config_string.go
+++ b/vendor/github.com/hashicorp/terraform/config/config_string.go
@@ -143,6 +143,46 @@ func outputsStr(os []*Output) string {
                                 result += fmt.Sprintf("    %s: %s\n", kind, str)
                         }
                 }
+
+                if o.Description != "" {
+                        result += fmt.Sprintf("  description\n    %s\n", o.Description)
+                }
+        }
+
+        return strings.TrimSpace(result)
+}
+
+func localsStr(ls []*Local) string {
+        ns := make([]string, 0, len(ls))
+        m := make(map[string]*Local)
+        for _, l := range ls {
+                ns = append(ns, l.Name)
+                m[l.Name] = l
+        }
+        sort.Strings(ns)
+
+        result := ""
+        for _, n := range ns {
+                l := m[n]
+
+                result += fmt.Sprintf("%s\n", n)
+
+                if len(l.RawConfig.Variables) > 0 {
+                        result += fmt.Sprintf("  vars\n")
+                        for _, rawV := range l.RawConfig.Variables {
+                                kind := "unknown"
+                                str := rawV.FullKey()
+
+                                switch rawV.(type) {
+                                case *ResourceVariable:
+                                        kind = "resource"
+                                case *UserVariable:
+                                        kind = "user"
+                                }
+
+                                result += fmt.Sprintf("    %s: %s\n", kind, str)
+                        }
+                }
         }
 
         return strings.TrimSpace(result)
diff --git a/vendor/github.com/hashicorp/terraform/config/configschema/decoder_spec.go b/vendor/github.com/hashicorp/terraform/config/configschema/decoder_spec.go
new file mode 100644
index 0000000..2b1b0ca
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/configschema/decoder_spec.go
@@ -0,0 +1,97 @@
+package configschema
+
+import (
+        "github.com/hashicorp/hcl2/hcldec"
+        "github.com/zclconf/go-cty/cty"
+)
+
+var mapLabelNames = []string{"key"}
+
+// DecoderSpec returns a hcldec.Spec that can be used to decode a HCL Body
+// using the facilities in the hcldec package.
+//
+// The returned specification is guaranteed to return a value of the same type
+// returned by method ImpliedType, but it may contain null or unknown values if
+// any of the block attributes are defined as optional and/or computed
+// respectively.
+func (b *Block) DecoderSpec() hcldec.Spec {
+        ret := hcldec.ObjectSpec{}
+        if b == nil {
+                return ret
+        }
+
+        for name, attrS := range b.Attributes {
+                switch {
+                case attrS.Computed && attrS.Optional:
+                        // In this special case we use an unknown value as a default
+                        // to get the intended behavior that the result is computed
+                        // unless it has been explicitly set in config.
+                        ret[name] = &hcldec.DefaultSpec{
+                                Primary: &hcldec.AttrSpec{
+                                        Name: name,
+                                        Type: attrS.Type,
+                                },
+                                Default: &hcldec.LiteralSpec{
+                                        Value: cty.UnknownVal(attrS.Type),
+                                },
+                        }
+                case attrS.Computed:
+                        ret[name] = &hcldec.LiteralSpec{
+                                Value: cty.UnknownVal(attrS.Type),
+                        }
+                default:
+                        ret[name] = &hcldec.AttrSpec{
+                                Name:     name,
+                                Type:     attrS.Type,
+                                Required: attrS.Required,
+                        }
+                }
+        }
+
+        for name, blockS := range b.BlockTypes {
+                if _, exists := ret[name]; exists {
+                        // This indicates an invalid schema, since it's not valid to
+                        // define both an attribute and a block type of the same name.
+                        // However, we don't raise this here since it's checked by
+                        // InternalValidate.
+                        continue
+                }
+
+                childSpec := blockS.Block.DecoderSpec()
+
+                switch blockS.Nesting {
+                case NestingSingle:
+                        ret[name] = &hcldec.BlockSpec{
+                                TypeName: name,
+                                Nested:   childSpec,
+                                Required: blockS.MinItems == 1 && blockS.MaxItems >= 1,
+                        }
+                case NestingList:
+                        ret[name] = &hcldec.BlockListSpec{
+                                TypeName: name,
+                                Nested:   childSpec,
+                                MinItems: blockS.MinItems,
+                                MaxItems: blockS.MaxItems,
+                        }
+                case NestingSet:
+                        ret[name] = &hcldec.BlockSetSpec{
+                                TypeName: name,
+                                Nested:   childSpec,
+                                MinItems: blockS.MinItems,
+                                MaxItems: blockS.MaxItems,
+                        }
+                case NestingMap:
+                        ret[name] = &hcldec.BlockMapSpec{
+                                TypeName:   name,
+                                Nested:     childSpec,
+                                LabelNames: mapLabelNames,
+                        }
+                default:
+                        // Invalid nesting type is just ignored. It's checked by
+                        // InternalValidate.
+                        continue
+                }
+        }
+
+        return ret
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/configschema/doc.go b/vendor/github.com/hashicorp/terraform/config/configschema/doc.go
new file mode 100644
index 0000000..caf8d73
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/configschema/doc.go
@@ -0,0 +1,14 @@
+// Package configschema contains types for describing the expected structure
+// of a configuration block whose shape is not known until runtime.
+//
+// For example, this is used to describe the expected contents of a resource
+// configuration block, which is defined by the corresponding provider plugin
+// and thus not compiled into Terraform core.
+//
+// A configschema primarily describes the shape of configuration, but it is
+// also suitable for use with other structures derived from the configuration,
+// such as the cached state of a resource or a resource diff.
+//
+// This package should not be confused with the package helper/schema, which
+// is the higher-level helper library used to implement providers themselves.
+package configschema
diff --git a/vendor/github.com/hashicorp/terraform/config/configschema/implied_type.go b/vendor/github.com/hashicorp/terraform/config/configschema/implied_type.go
new file mode 100644
index 0000000..67324eb
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/configschema/implied_type.go
@@ -0,0 +1,21 @@
+package configschema
+
+import (
+        "github.com/hashicorp/hcl2/hcldec"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// ImpliedType returns the cty.Type that would result from decoding a
+// configuration block using the receiving block schema.
+//
+// ImpliedType always returns a result, even if the given schema is
+// inconsistent. Code that creates configschema.Block objects should be
+// tested using the InternalValidate method to detect any inconsistencies
+// that would cause this method to fall back on defaults and assumptions.
+func (b *Block) ImpliedType() cty.Type {
+        if b == nil {
+                return cty.EmptyObject
+        }
+
+        return hcldec.ImpliedType(b.DecoderSpec())
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/configschema/internal_validate.go b/vendor/github.com/hashicorp/terraform/config/configschema/internal_validate.go
new file mode 100644
index 0000000..33cbe88
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/configschema/internal_validate.go
@@ -0,0 +1,92 @@
+package configschema
+
+import (
+        "fmt"
+        "regexp"
+
+        "github.com/zclconf/go-cty/cty"
+
+        multierror "github.com/hashicorp/go-multierror"
+)
+
+var validName = regexp.MustCompile(`^[a-z0-9_]+$`)
+
+// InternalValidate returns an error if the receiving block and its child
+// schema definitions have any consistencies with the documented rules for
+// valid schema.
+//
+// This is intended to be used within unit tests to detect when a given
+// schema is invalid.
+func (b *Block) InternalValidate() error {
+        if b == nil {
+                return fmt.Errorf("top-level block schema is nil")
+        }
+        return b.internalValidate("", nil)
+
+}
+
+func (b *Block) internalValidate(prefix string, err error) error {
+        for name, attrS := range b.Attributes {
+                if attrS == nil {
+                        err = multierror.Append(err, fmt.Errorf("%s%s: attribute schema is nil", prefix, name))
+                        continue
+                }
+                if !validName.MatchString(name) {
+                        err = multierror.Append(err, fmt.Errorf("%s%s: name may contain only lowercase letters, digits and underscores", prefix, name))
+                }
+                if attrS.Optional == false && attrS.Required == false && attrS.Computed == false {
+                        err = multierror.Append(err, fmt.Errorf("%s%s: must set Optional, Required or Computed", prefix, name))
+                }
+                if attrS.Optional && attrS.Required {
+                        err = multierror.Append(err, fmt.Errorf("%s%s: cannot set both Optional and Required", prefix, name))
+                }
+                if attrS.Computed && attrS.Required {
+                        err = multierror.Append(err, fmt.Errorf("%s%s: cannot set both Computed and Required", prefix, name))
+                }
+                if attrS.Type == cty.NilType {
+                        err = multierror.Append(err, fmt.Errorf("%s%s: Type must be set to something other than cty.NilType", prefix, name))
+                }
+        }
+
+        for name, blockS := range b.BlockTypes {
+                if blockS == nil {
+                        err = multierror.Append(err, fmt.Errorf("%s%s: block schema is nil", prefix, name))
+                        continue
+                }
+
+                if _, isAttr := b.Attributes[name]; isAttr {
+                        err = multierror.Append(err, fmt.Errorf("%s%s: name defined as both attribute and child block type", prefix, name))
+                } else if !validName.MatchString(name) {
+                        err = multierror.Append(err, fmt.Errorf("%s%s: name may contain only lowercase letters, digits and underscores", prefix, name))
+                }
+
+                if blockS.MinItems < 0 || blockS.MaxItems < 0 {
+                        err = multierror.Append(err, fmt.Errorf("%s%s: MinItems and MaxItems must both be greater than zero", prefix, name))
+                }
+
+                switch blockS.Nesting {
+                case NestingSingle:
+                        switch {
+                        case blockS.MinItems != blockS.MaxItems:
+                                err = multierror.Append(err, fmt.Errorf("%s%s: MinItems and MaxItems must match in NestingSingle mode", prefix, name))
+                        case blockS.MinItems < 0 || blockS.MinItems > 1:
+                                err = multierror.Append(err, fmt.Errorf("%s%s: MinItems and MaxItems must be set to either 0 or 1 in NestingSingle mode", prefix, name))
+                        }
+                case NestingList, NestingSet:
+                        if blockS.MinItems > blockS.MaxItems && blockS.MaxItems != 0 {
+                                err = multierror.Append(err, fmt.Errorf("%s%s: MinItems must be less than or equal to MaxItems in %s mode", prefix, name, blockS.Nesting))
+                        }
+                case NestingMap:
+                        if blockS.MinItems != 0 || blockS.MaxItems != 0 {
+                                err = multierror.Append(err, fmt.Errorf("%s%s: MinItems and MaxItems must both be 0 in NestingMap mode", prefix, name))
+                        }
+                default:
+                        err = multierror.Append(err, fmt.Errorf("%s%s: invalid nesting mode %s", prefix, name, blockS.Nesting))
+                }
+
+                subPrefix := prefix + name + "."
+                err = blockS.Block.internalValidate(subPrefix, err)
+        }
+
+        return err
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/configschema/nestingmode_string.go b/vendor/github.com/hashicorp/terraform/config/configschema/nestingmode_string.go
new file mode 100644
index 0000000..6cb9313
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/configschema/nestingmode_string.go
@@ -0,0 +1,16 @@
+// Code generated by "stringer -type=NestingMode"; DO NOT EDIT.
+
+package configschema
+
+import "strconv"
+
+const _NestingMode_name = "nestingModeInvalidNestingSingleNestingListNestingSetNestingMap"
+
+var _NestingMode_index = [...]uint8{0, 18, 31, 42, 52, 62}
+
+func (i NestingMode) String() string {
+        if i < 0 || i >= NestingMode(len(_NestingMode_index)-1) {
+                return "NestingMode(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+        return _NestingMode_name[_NestingMode_index[i]:_NestingMode_index[i+1]]
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/configschema/schema.go b/vendor/github.com/hashicorp/terraform/config/configschema/schema.go
new file mode 100644
index 0000000..9a8ee55
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/configschema/schema.go
@@ -0,0 +1,107 @@
+package configschema
+
+import (
+        "github.com/zclconf/go-cty/cty"
+)
+
+// Block represents a configuration block.
+//
+// "Block" here is a logical grouping construct, though it happens to map
+// directly onto the physical block syntax of Terraform's native configuration
+// syntax. It may be a more a matter of convention in other syntaxes, such as
+// JSON.
+//
+// When converted to a value, a Block always becomes an instance of an object
+// type derived from its defined attributes and nested blocks
+type Block struct {
+        // Attributes describes any attributes that may appear directly inside
+        // the block.
+        Attributes map[string]*Attribute
+
+        // BlockTypes describes any nested block types that may appear directly
+        // inside the block.
+        BlockTypes map[string]*NestedBlock
+}
+
+// Attribute represents a configuration attribute, within a block.
+type Attribute struct {
+        // Type is a type specification that the attribute's value must conform to.
+        Type cty.Type
+
+        // Required, if set to true, specifies that an omitted or null value is
+        // not permitted.
+        Required bool
+
+        // Optional, if set to true, specifies that an omitted or null value is
+        // permitted. This field conflicts with Required.
+        Optional bool
+
+        // Computed, if set to true, specifies that the value comes from the
+        // provider rather than from configuration. If combined with Optional,
+        // then the config may optionally provide an overridden value.
+        Computed bool
+
+        // Sensitive, if set to true, indicates that an attribute may contain
+        // sensitive information.
+        //
+        // At present nothing is done with this information, but callers are
+        // encouraged to set it where appropriate so that it may be used in the
+        // future to help Terraform mask sensitive information. (Terraform
+        // currently achieves this in a limited sense via other mechanisms.)
+        Sensitive bool
+}
+
+// NestedBlock represents the embedding of one block within another.
+type NestedBlock struct {
+        // Block is the description of the block that's nested.
+        Block
+
+        // Nesting provides the nesting mode for the child block, which determines
+        // how many instances of the block are allowed, how many labels it expects,
+        // and how the resulting data will be converted into a data structure.
+        Nesting NestingMode
+
+        // MinItems and MaxItems set, for the NestingList and NestingSet nesting
+        // modes, lower and upper limits on the number of child blocks allowed
+        // of the given type. If both are left at zero, no limit is applied.
+        //
+        // As a special case, both values can be set to 1 for NestingSingle in
+        // order to indicate that a particular single block is required.
+        //
+        // These fields are ignored for other nesting modes and must both be left
+        // at zero.
+        MinItems, MaxItems int
+}
+
+// NestingMode is an enumeration of modes for nesting blocks inside other
+// blocks.
+type NestingMode int
+
+//go:generate stringer -type=NestingMode
+
+const (
+        nestingModeInvalid NestingMode = iota
+
+        // NestingSingle indicates that only a single instance of a given
+        // block type is permitted, with no labels, and its content should be
+        // provided directly as an object value.
+        NestingSingle
+
+        // NestingList indicates that multiple blocks of the given type are
+        // permitted, with no labels, and that their corresponding objects should
+        // be provided in a list.
+        NestingList
+
+        // NestingSet indicates that multiple blocks of the given type are
+        // permitted, with no labels, and that their corresponding objects should
+        // be provided in a set.
+        NestingSet
+
+        // NestingMap indicates that multiple blocks of the given type are
+        // permitted, each with a single label, and that their corresponding
+        // objects should be provided in a map whose keys are the labels.
+        //
+        // It's an error, therefore, to use the same label value on multiple
+        // blocks.
+        NestingMap
+)
diff --git a/vendor/github.com/hashicorp/terraform/config/hcl2_shim_util.go b/vendor/github.com/hashicorp/terraform/config/hcl2_shim_util.go
new file mode 100644
index 0000000..207d105
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/hcl2_shim_util.go
@@ -0,0 +1,134 @@
+package config
+
+import (
+        "fmt"
+
+        "github.com/zclconf/go-cty/cty/function/stdlib"
+
+        "github.com/hashicorp/hil/ast"
+        "github.com/hashicorp/terraform/config/hcl2shim"
+
+        hcl2 "github.com/hashicorp/hcl2/hcl"
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+        "github.com/zclconf/go-cty/cty/function"
+)
+
+// ---------------------------------------------------------------------------
+// This file contains some helper functions that are used to shim between
+// HCL2 concepts and HCL/HIL concepts, to help us mostly preserve the existing
+// public API that was built around HCL/HIL-oriented approaches.
+// ---------------------------------------------------------------------------
+
+func hcl2InterpolationFuncs() map[string]function.Function {
+        hcl2Funcs := map[string]function.Function{}
+
+        for name, hilFunc := range Funcs() {
+                hcl2Funcs[name] = hcl2InterpolationFuncShim(hilFunc)
+        }
+
+        // Some functions in the old world are dealt with inside langEvalConfig
+        // due to their legacy reliance on direct access to the symbol table.
+        // Since 0.7 they don't actually need it anymore and just ignore it,
+        // so we're cheating a bit here and exploiting that detail by passing nil.
+        hcl2Funcs["lookup"] = hcl2InterpolationFuncShim(interpolationFuncLookup(nil))
+        hcl2Funcs["keys"] = hcl2InterpolationFuncShim(interpolationFuncKeys(nil))
+        hcl2Funcs["values"] = hcl2InterpolationFuncShim(interpolationFuncValues(nil))
+
+        // As a bonus, we'll provide the JSON-handling functions from the cty
+        // function library since its "jsonencode" is more complete (doesn't force
+        // weird type conversions) and HIL's type system can't represent
+        // "jsondecode" at all. The result of jsondecode will eventually be forced
+        // to conform to the HIL type system on exit into the rest of Terraform due
+        // to our shimming right now, but it should be usable for decoding _within_
+        // an expression.
+        hcl2Funcs["jsonencode"] = stdlib.JSONEncodeFunc
+        hcl2Funcs["jsondecode"] = stdlib.JSONDecodeFunc
+
+        return hcl2Funcs
+}
+
+func hcl2InterpolationFuncShim(hilFunc ast.Function) function.Function {
+        spec := &function.Spec{}
+
+        for i, hilArgType := range hilFunc.ArgTypes {
+                spec.Params = append(spec.Params, function.Parameter{
+                        Type: hcl2shim.HCL2TypeForHILType(hilArgType),
+                        Name: fmt.Sprintf("arg%d", i+1), // HIL args don't have names, so we'll fudge it
+                })
+        }
+
+        if hilFunc.Variadic {
+                spec.VarParam = &function.Parameter{
+                        Type: hcl2shim.HCL2TypeForHILType(hilFunc.VariadicType),
+                        Name: "varargs", // HIL args don't have names, so we'll fudge it
+                }
+        }
+
+        spec.Type = func(args []cty.Value) (cty.Type, error) {
+                return hcl2shim.HCL2TypeForHILType(hilFunc.ReturnType), nil
+        }
+        spec.Impl = func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+                hilArgs := make([]interface{}, len(args))
+                for i, arg := range args {
+                        hilV := hcl2shim.HILVariableFromHCL2Value(arg)
+
+                        // Although the cty function system does automatic type conversions
+                        // to match the argument types, cty doesn't distinguish int and
+                        // float and so we may need to adjust here to ensure that the
+                        // wrapped function gets exactly the Go type it was expecting.
+                        var wantType ast.Type
+                        if i < len(hilFunc.ArgTypes) {
+                                wantType = hilFunc.ArgTypes[i]
+                        } else {
+                                wantType = hilFunc.VariadicType
+                        }
+                        switch {
+                        case hilV.Type == ast.TypeInt && wantType == ast.TypeFloat:
+                                hilV.Type = wantType
+                                hilV.Value = float64(hilV.Value.(int))
+                        case hilV.Type == ast.TypeFloat && wantType == ast.TypeInt:
+                                hilV.Type = wantType
+                                hilV.Value = int(hilV.Value.(float64))
+                        }
+
+                        // HIL functions actually expect to have the outermost variable
+                        // "peeled" but any nested values (in lists or maps) will
+                        // still have their ast.Variable wrapping.
+                        hilArgs[i] = hilV.Value
+                }
+
+                hilResult, err := hilFunc.Callback(hilArgs)
+                if err != nil {
+                        return cty.DynamicVal, err
+                }
+
+                // Just as on the way in, we get back a partially-peeled ast.Variable
+                // which we need to re-wrap in order to convert it back into what
+                // we're calling a "config value".
+                rv := hcl2shim.HCL2ValueFromHILVariable(ast.Variable{
+                        Type:  hilFunc.ReturnType,
+                        Value: hilResult,
+                })
+
+                return convert.Convert(rv, retType) // if result is unknown we'll force the correct type here
+        }
+        return function.New(spec)
+}
+
+func hcl2EvalWithUnknownVars(expr hcl2.Expression) (cty.Value, hcl2.Diagnostics) {
+        trs := expr.Variables()
+        vars := map[string]cty.Value{}
+        val := cty.DynamicVal
+
+        for _, tr := range trs {
+                name := tr.RootName()
+                vars[name] = val
+        }
+
+        ctx := &hcl2.EvalContext{
+                Variables: vars,
+                Functions: hcl2InterpolationFuncs(),
+        }
+        return expr.Value(ctx)
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/hcl2shim/single_attr_body.go b/vendor/github.com/hashicorp/terraform/config/hcl2shim/single_attr_body.go
new file mode 100644
index 0000000..19651c8
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/hcl2shim/single_attr_body.go
@@ -0,0 +1,85 @@
+package hcl2shim
+
+import (
+        "fmt"
+
+        hcl2 "github.com/hashicorp/hcl2/hcl"
+)
+
+// SingleAttrBody is a weird implementation of hcl2.Body that acts as if
+// it has a single attribute whose value is the given expression.
+//
+// This is used to shim Resource.RawCount and Output.RawConfig to behave
+// more like they do in the old HCL loader.
+type SingleAttrBody struct {
+        Name string
+        Expr hcl2.Expression
+}
+
+var _ hcl2.Body = SingleAttrBody{}
+
+func (b SingleAttrBody) Content(schema *hcl2.BodySchema) (*hcl2.BodyContent, hcl2.Diagnostics) {
+        content, all, diags := b.content(schema)
+        if !all {
+                // This should never happen because this body implementation should only
+                // be used by code that is aware that it's using a single-attr body.
+                diags = append(diags, &hcl2.Diagnostic{
+                        Severity: hcl2.DiagError,
+                        Summary:  "Invalid attribute",
+                        Detail:   fmt.Sprintf("The correct attribute name is %q.", b.Name),
+                        Subject:  b.Expr.Range().Ptr(),
+                })
+        }
+        return content, diags
+}
+
+func (b SingleAttrBody) PartialContent(schema *hcl2.BodySchema) (*hcl2.BodyContent, hcl2.Body, hcl2.Diagnostics) {
+        content, all, diags := b.content(schema)
+        var remain hcl2.Body
+        if all {
+                // If the request matched the one attribute we represent, then the
+                // remaining body is empty.
+                remain = hcl2.EmptyBody()
+        } else {
+                remain = b
+        }
+        return content, remain, diags
+}
+
+func (b SingleAttrBody) content(schema *hcl2.BodySchema) (*hcl2.BodyContent, bool, hcl2.Diagnostics) {
+        ret := &hcl2.BodyContent{}
+        all := false
+        var diags hcl2.Diagnostics
+
+        for _, attrS := range schema.Attributes {
+                if attrS.Name == b.Name {
+                        attrs, _ := b.JustAttributes()
+                        ret.Attributes = attrs
+                        all = true
+                } else if attrS.Required {
+                        diags = append(diags, &hcl2.Diagnostic{
+                                Severity: hcl2.DiagError,
+                                Summary:  "Missing attribute",
+                                Detail:   fmt.Sprintf("The attribute %q is required.", attrS.Name),
+                                Subject:  b.Expr.Range().Ptr(),
+                        })
+                }
+        }
+
+        return ret, all, diags
+}
+
+func (b SingleAttrBody) JustAttributes() (hcl2.Attributes, hcl2.Diagnostics) {
+        return hcl2.Attributes{
+                b.Name: {
+                        Expr:      b.Expr,
+                        Name:      b.Name,
+                        NameRange: b.Expr.Range(),
+                        Range:     b.Expr.Range(),
+                },
+        }, nil
+}
+
+func (b SingleAttrBody) MissingItemRange() hcl2.Range {
+        return b.Expr.Range()
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/hcl2shim/values.go b/vendor/github.com/hashicorp/terraform/config/hcl2shim/values.go
new file mode 100644
index 0000000..0b697a5
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/hcl2shim/values.go
@@ -0,0 +1,246 @@
+package hcl2shim
+
+import (
+        "fmt"
+        "math/big"
+
+        "github.com/hashicorp/hil/ast"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// UnknownVariableValue is a sentinel value that can be used
+// to denote that the value of a variable is unknown at this time.
+// RawConfig uses this information to build up data about
+// unknown keys.
+const UnknownVariableValue = "74D93920-ED26-11E3-AC10-0800200C9A66"
+
+// ConfigValueFromHCL2 converts a value from HCL2 (really, from the cty dynamic
+// types library that HCL2 uses) to a value type that matches what would've
+// been produced from the HCL-based interpolator for an equivalent structure.
+//
+// This function will transform a cty null value into a Go nil value, which
+// isn't a possible outcome of the HCL/HIL-based decoder and so callers may
+// need to detect and reject any null values.
+func ConfigValueFromHCL2(v cty.Value) interface{} {
+        if !v.IsKnown() {
+                return UnknownVariableValue
+        }
+        if v.IsNull() {
+                return nil
+        }
+
+        switch v.Type() {
+        case cty.Bool:
+                return v.True() // like HCL.BOOL
+        case cty.String:
+                return v.AsString() // like HCL token.STRING or token.HEREDOC
+        case cty.Number:
+                // We can't match HCL _exactly_ here because it distinguishes between
+                // int and float values, but we'll get as close as we can by using
+                // an int if the number is exactly representable, and a float if not.
+                // The conversion to float will force precision to that of a float64,
+                // which is potentially losing information from the specific number
+                // given, but no worse than what HCL would've done in its own conversion
+                // to float.
+
+                f := v.AsBigFloat()
+                if i, acc := f.Int64(); acc == big.Exact {
+                        // if we're on a 32-bit system and the number is too big for 32-bit
+                        // int then we'll fall through here and use a float64.
+                        const MaxInt = int(^uint(0) >> 1)
+                        const MinInt = -MaxInt - 1
+                        if i <= int64(MaxInt) && i >= int64(MinInt) {
+                                return int(i) // Like HCL token.NUMBER
+                        }
+                }
+
+                f64, _ := f.Float64()
+                return f64 // like HCL token.FLOAT
+        }
+
+        if v.Type().IsListType() || v.Type().IsSetType() || v.Type().IsTupleType() {
+                l := make([]interface{}, 0, v.LengthInt())
+                it := v.ElementIterator()
+                for it.Next() {
+                        _, ev := it.Element()
+                        l = append(l, ConfigValueFromHCL2(ev))
+                }
+                return l
+        }
+
+        if v.Type().IsMapType() || v.Type().IsObjectType() {
+                l := make(map[string]interface{})
+                it := v.ElementIterator()
+                for it.Next() {
+                        ek, ev := it.Element()
+                        l[ek.AsString()] = ConfigValueFromHCL2(ev)
+                }
+                return l
+        }
+
+        // If we fall out here then we have some weird type that we haven't
+        // accounted for. This should never happen unless the caller is using
+        // capsule types, and we don't currently have any such types defined.
+        panic(fmt.Errorf("can't convert %#v to config value", v))
+}
+
+// HCL2ValueFromConfigValue is the opposite of configValueFromHCL2: it takes
+// a value as would be returned from the old interpolator and turns it into
+// a cty.Value so it can be used within, for example, an HCL2 EvalContext.
+func HCL2ValueFromConfigValue(v interface{}) cty.Value {
+        if v == nil {
+                return cty.NullVal(cty.DynamicPseudoType)
+        }
+        if v == UnknownVariableValue {
+                return cty.DynamicVal
+        }
+
+        switch tv := v.(type) {
+        case bool:
+                return cty.BoolVal(tv)
+        case string:
+                return cty.StringVal(tv)
+        case int:
+                return cty.NumberIntVal(int64(tv))
+        case float64:
+                return cty.NumberFloatVal(tv)
+        case []interface{}:
+                vals := make([]cty.Value, len(tv))
+                for i, ev := range tv {
+                        vals[i] = HCL2ValueFromConfigValue(ev)
+                }
+                return cty.TupleVal(vals)
+        case map[string]interface{}:
+                vals := map[string]cty.Value{}
+                for k, ev := range tv {
+                        vals[k] = HCL2ValueFromConfigValue(ev)
+                }
+                return cty.ObjectVal(vals)
+        default:
+                // HCL/HIL should never generate anything that isn't caught by
+                // the above, so if we get here something has gone very wrong.
+                panic(fmt.Errorf("can't convert %#v to cty.Value", v))
+        }
+}
+
+func HILVariableFromHCL2Value(v cty.Value) ast.Variable {
+        if v.IsNull() {
+                // Caller should guarantee/check this before calling
+                panic("Null values cannot be represented in HIL")
+        }
+        if !v.IsKnown() {
+                return ast.Variable{
+                        Type:  ast.TypeUnknown,
+                        Value: UnknownVariableValue,
+                }
+        }
+
+        switch v.Type() {
+        case cty.Bool:
+                return ast.Variable{
+                        Type:  ast.TypeBool,
+                        Value: v.True(),
+                }
+        case cty.Number:
+                v := ConfigValueFromHCL2(v)
+                switch tv := v.(type) {
+                case int:
+                        return ast.Variable{
+                                Type:  ast.TypeInt,
+                                Value: tv,
+                        }
+                case float64:
+                        return ast.Variable{
+                                Type:  ast.TypeFloat,
+                                Value: tv,
+                        }
+                default:
+                        // should never happen
+                        panic("invalid return value for configValueFromHCL2")
+                }
+        case cty.String:
+                return ast.Variable{
+                        Type:  ast.TypeString,
+                        Value: v.AsString(),
+                }
+        }
+
+        if v.Type().IsListType() || v.Type().IsSetType() || v.Type().IsTupleType() {
+                l := make([]ast.Variable, 0, v.LengthInt())
+                it := v.ElementIterator()
+                for it.Next() {
+                        _, ev := it.Element()
+                        l = append(l, HILVariableFromHCL2Value(ev))
+                }
+                // If we were given a tuple then this could actually produce an invalid
+                // list with non-homogenous types, which we expect to be caught inside
+                // HIL just like a user-supplied non-homogenous list would be.
+                return ast.Variable{
+                        Type:  ast.TypeList,
+                        Value: l,
+                }
+        }
+
+        if v.Type().IsMapType() || v.Type().IsObjectType() {
+                l := make(map[string]ast.Variable)
+                it := v.ElementIterator()
+                for it.Next() {
+                        ek, ev := it.Element()
+                        l[ek.AsString()] = HILVariableFromHCL2Value(ev)
+                }
+                // If we were given an object then this could actually produce an invalid
+                // map with non-homogenous types, which we expect to be caught inside
+                // HIL just like a user-supplied non-homogenous map would be.
+                return ast.Variable{
+                        Type:  ast.TypeMap,
+                        Value: l,
+                }
+        }
+
+        // If we fall out here then we have some weird type that we haven't
+        // accounted for. This should never happen unless the caller is using
+        // capsule types, and we don't currently have any such types defined.
+        panic(fmt.Errorf("can't convert %#v to HIL variable", v))
+}
+
+func HCL2ValueFromHILVariable(v ast.Variable) cty.Value {
+        switch v.Type {
+        case ast.TypeList:
+                vals := make([]cty.Value, len(v.Value.([]ast.Variable)))
+                for i, ev := range v.Value.([]ast.Variable) {
+                        vals[i] = HCL2ValueFromHILVariable(ev)
+                }
+                return cty.TupleVal(vals)
+        case ast.TypeMap:
+                vals := make(map[string]cty.Value, len(v.Value.(map[string]ast.Variable)))
+                for k, ev := range v.Value.(map[string]ast.Variable) {
+                        vals[k] = HCL2ValueFromHILVariable(ev)
+                }
+                return cty.ObjectVal(vals)
+        default:
+                return HCL2ValueFromConfigValue(v.Value)
+        }
+}
+
+func HCL2TypeForHILType(hilType ast.Type) cty.Type {
+        switch hilType {
+        case ast.TypeAny:
+                return cty.DynamicPseudoType
+        case ast.TypeUnknown:
+                return cty.DynamicPseudoType
+        case ast.TypeBool:
+                return cty.Bool
+        case ast.TypeInt:
+                return cty.Number
+        case ast.TypeFloat:
+                return cty.Number
+        case ast.TypeString:
+                return cty.String
+        case ast.TypeList:
+                return cty.List(cty.DynamicPseudoType)
+        case ast.TypeMap:
+                return cty.Map(cty.DynamicPseudoType)
+        default:
+                return cty.NilType // equilvalent to ast.TypeInvalid
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/import_tree.go b/vendor/github.com/hashicorp/terraform/config/import_tree.go
index 37ec11a..08cbc77 100644
--- a/vendor/github.com/hashicorp/terraform/config/import_tree.go
+++ b/vendor/github.com/hashicorp/terraform/config/import_tree.go
@@ -1,8 +1,12 @@
 package config
 
 import (
+        "bufio"
         "fmt"
         "io"
+        "os"
+
+        "github.com/hashicorp/errwrap"
 )
 
 // configurable is an interface that must be implemented by any configuration
@@ -27,15 +31,52 @@ type importTree struct {
 // imports.
 type fileLoaderFunc func(path string) (configurable, []string, error)
 
+// Set this to a non-empty value at link time to enable the HCL2 experiment.
+// This is not currently enabled for release builds.
+//
+// For example:
+//    go install -ldflags="-X github.com/hashicorp/terraform/config.enableHCL2Experiment=true" github.com/hashicorp/terraform
+var enableHCL2Experiment = ""
+
 // loadTree takes a single file and loads the entire importTree for that
 // file. This function detects what kind of configuration file it is an
 // executes the proper fileLoaderFunc.
 func loadTree(root string) (*importTree, error) {
         var f fileLoaderFunc
-        switch ext(root) {
-        case ".tf", ".tf.json":
-                f = loadFileHcl
-        default:
+
+        // HCL2 experiment is currently activated at build time via the linker.
+        // See the comment on this variable for more information.
+        if enableHCL2Experiment == "" {
+                // Main-line behavior: always use the original HCL parser
+                switch ext(root) {
+                case ".tf", ".tf.json":
+                        f = loadFileHcl
+                default:
+                }
+        } else {
+                // Experimental behavior: use the HCL2 parser if the opt-in comment
+                // is present.
+                switch ext(root) {
+                case ".tf":
+                        // We need to sniff the file for the opt-in comment line to decide
+                        // if the file is participating in the HCL2 experiment.
+                        cf, err := os.Open(root)
+                        if err != nil {
+                                return nil, err
+                        }
+                        sc := bufio.NewScanner(cf)
+                        for sc.Scan() {
+                                if sc.Text() == "#terraform:hcl2" {
+                                        f = globalHCL2Loader.loadFile
+                                }
+                        }
+                        if f == nil {
+                                f = loadFileHcl
+                        }
+                case ".tf.json":
+                        f = loadFileHcl
+                default:
+                }
         }
 
         if f == nil {
@@ -86,10 +127,7 @@ func (t *importTree) Close() error {
 func (t *importTree) ConfigTree() (*configTree, error) {
         config, err := t.Raw.Config()
         if err != nil {
-                return nil, fmt.Errorf(
-                        "Error loading %s: %s",
-                        t.Path,
-                        err)
+                return nil, errwrap.Wrapf(fmt.Sprintf("Error loading %s: {{err}}", t.Path), err)
         }
 
         // Build our result
diff --git a/vendor/github.com/hashicorp/terraform/config/interpolate.go b/vendor/github.com/hashicorp/terraform/config/interpolate.go
index bbb3555..599e5ec 100644
--- a/vendor/github.com/hashicorp/terraform/config/interpolate.go
+++ b/vendor/github.com/hashicorp/terraform/config/interpolate.go
@@ -5,6 +5,8 @@ import (
         "strconv"
         "strings"
 
+        "github.com/hashicorp/terraform/tfdiags"
+
         "github.com/hashicorp/hil/ast"
 )
 
@@ -14,6 +16,21 @@ import (
 // variables can come from: user variables, resources, etc.
 type InterpolatedVariable interface {
         FullKey() string
+        SourceRange() tfdiags.SourceRange
+}
+
+// varRange can be embedded into an InterpolatedVariable implementation to
+// implement the SourceRange method.
+type varRange struct {
+        rng tfdiags.SourceRange
+}
+
+func (r varRange) SourceRange() tfdiags.SourceRange {
+        return r.rng
+}
+
+func makeVarRange(rng tfdiags.SourceRange) varRange {
+        return varRange{rng}
 }
 
 // CountVariable is a variable for referencing information about
@@ -21,6 +38,7 @@ type InterpolatedVariable interface {
 type CountVariable struct {
         Type CountValueType
         key  string
+        varRange
 }
 
 // CountValueType is the type of the count variable that is referenced.
@@ -37,6 +55,7 @@ type ModuleVariable struct {
         Name  string
         Field string
         key   string
+        varRange
 }
 
 // A PathVariable is a variable that references path information about the
@@ -44,6 +63,7 @@ type ModuleVariable struct {
 type PathVariable struct {
         Type PathValueType
         key  string
+        varRange
 }
 
 type PathValueType byte
@@ -67,6 +87,7 @@ type ResourceVariable struct {
         Index int  // Index for multi-variable: aws_instance.foo.1.id == 1
 
         key string
+        varRange
 }
 
 // SelfVariable is a variable that is referencing the same resource
@@ -75,6 +96,7 @@ type SelfVariable struct {
         Field string
 
         key string
+        varRange
 }
 
 // SimpleVariable is an unprefixed variable, which can show up when users have
@@ -82,6 +104,7 @@ type SelfVariable struct {
 // internally. The template_file resource is an example of this.
 type SimpleVariable struct {
         Key string
+        varRange
 }
 
 // TerraformVariable is a "terraform."-prefixed variable used to access
@@ -89,6 +112,7 @@ type SimpleVariable struct {
 type TerraformVariable struct {
         Field string
         key   string
+        varRange
 }
 
 // A UserVariable is a variable that is referencing a user variable
@@ -99,6 +123,14 @@ type UserVariable struct {
         Elem string
 
         key string
+        varRange
+}
+
+// A LocalVariable is a variable that references a local value defined within
+// the current module, via a "locals" block. This looks like "${local.foo}".
+type LocalVariable struct {
+        Name string
+        varRange
 }
 
 func NewInterpolatedVariable(v string) (InterpolatedVariable, error) {
@@ -112,6 +144,8 @@ func NewInterpolatedVariable(v string) (InterpolatedVariable, error) {
                 return NewTerraformVariable(v)
         } else if strings.HasPrefix(v, "var.") {
                 return NewUserVariable(v)
+        } else if strings.HasPrefix(v, "local.") {
+                return NewLocalVariable(v)
         } else if strings.HasPrefix(v, "module.") {
                 return NewModuleVariable(v)
         } else if !strings.ContainsRune(v, '.') {
@@ -276,7 +310,7 @@ func (v *SelfVariable) GoString() string {
 }
 
 func NewSimpleVariable(key string) (*SimpleVariable, error) {
-        return &SimpleVariable{key}, nil
+        return &SimpleVariable{Key: key}, nil
 }
 
 func (v *SimpleVariable) FullKey() string {
@@ -331,6 +365,25 @@ func (v *UserVariable) GoString() string {
         return fmt.Sprintf("*%#v", *v)
 }
 
+func NewLocalVariable(key string) (*LocalVariable, error) {
+        name := key[len("local."):]
+        if idx := strings.Index(name, "."); idx > -1 {
+                return nil, fmt.Errorf("Can't use dot (.) attribute access in local.%s; use square bracket indexing", name)
+        }
+
+        return &LocalVariable{
+                Name: name,
+        }, nil
+}
+
+func (v *LocalVariable) FullKey() string {
+        return fmt.Sprintf("local.%s", v.Name)
+}
+
+func (v *LocalVariable) GoString() string {
+        return fmt.Sprintf("*%#v", *v)
+}
+
 // DetectVariables takes an AST root and returns all the interpolated
 // variables that are detected in the AST tree.
 func DetectVariables(root ast.Node) ([]InterpolatedVariable, error) {
diff --git a/vendor/github.com/hashicorp/terraform/config/interpolate_funcs.go b/vendor/github.com/hashicorp/terraform/config/interpolate_funcs.go
index a298cf2..421edb0 100644
--- a/vendor/github.com/hashicorp/terraform/config/interpolate_funcs.go
+++ b/vendor/github.com/hashicorp/terraform/config/interpolate_funcs.go
@@ -1,17 +1,23 @@
 package config
 
 import (
+        "bytes"
+        "compress/gzip"
         "crypto/md5"
+        "crypto/rsa"
         "crypto/sha1"
         "crypto/sha256"
         "crypto/sha512"
+        "crypto/x509"
         "encoding/base64"
         "encoding/hex"
         "encoding/json"
+        "encoding/pem"
         "fmt"
         "io/ioutil"
         "math"
         "net"
+        "net/url"
         "path/filepath"
         "regexp"
         "sort"
@@ -55,59 +61,74 @@ func listVariableValueToStringSlice(values []ast.Variable) ([]string, error) {
 // Funcs is the mapping of built-in functions for configuration.
 func Funcs() map[string]ast.Function {
         return map[string]ast.Function{
-                "basename":     interpolationFuncBasename(),
-                "base64decode": interpolationFuncBase64Decode(),
-                "base64encode": interpolationFuncBase64Encode(),
-                "base64sha256": interpolationFuncBase64Sha256(),
-                "base64sha512": interpolationFuncBase64Sha512(),
-                "bcrypt":       interpolationFuncBcrypt(),
-                "ceil":         interpolationFuncCeil(),
-                "chomp":        interpolationFuncChomp(),
-                "cidrhost":     interpolationFuncCidrHost(),
-                "cidrnetmask":  interpolationFuncCidrNetmask(),
-                "cidrsubnet":   interpolationFuncCidrSubnet(),
-                "coalesce":     interpolationFuncCoalesce(),
-                "coalescelist": interpolationFuncCoalesceList(),
-                "compact":      interpolationFuncCompact(),
-                "concat":       interpolationFuncConcat(),
-                "contains":     interpolationFuncContains(),
-                "dirname":      interpolationFuncDirname(),
-                "distinct":     interpolationFuncDistinct(),
-                "element":      interpolationFuncElement(),
-                "file":         interpolationFuncFile(),
-                "matchkeys":    interpolationFuncMatchKeys(),
-                "floor":        interpolationFuncFloor(),
-                "format":       interpolationFuncFormat(),
-                "formatlist":   interpolationFuncFormatList(),
-                "index":        interpolationFuncIndex(),
-                "join":         interpolationFuncJoin(),
-                "jsonencode":   interpolationFuncJSONEncode(),
-                "length":       interpolationFuncLength(),
-                "list":         interpolationFuncList(),
-                "log":          interpolationFuncLog(),
-                "lower":        interpolationFuncLower(),
-                "map":          interpolationFuncMap(),
-                "max":          interpolationFuncMax(),
-                "md5":          interpolationFuncMd5(),
-                "merge":        interpolationFuncMerge(),
-                "min":          interpolationFuncMin(),
-                "pathexpand":   interpolationFuncPathExpand(),
-                "pow":          interpolationFuncPow(),
-                "uuid":         interpolationFuncUUID(),
-                "replace":      interpolationFuncReplace(),
-                "sha1":         interpolationFuncSha1(),
-                "sha256":       interpolationFuncSha256(),
-                "sha512":       interpolationFuncSha512(),
-                "signum":       interpolationFuncSignum(),
-                "slice":        interpolationFuncSlice(),
-                "sort":         interpolationFuncSort(),
-                "split":        interpolationFuncSplit(),
-                "substr":       interpolationFuncSubstr(),
-                "timestamp":    interpolationFuncTimestamp(),
-                "title":        interpolationFuncTitle(),
-                "trimspace":    interpolationFuncTrimSpace(),
-                "upper":        interpolationFuncUpper(),
-                "zipmap":       interpolationFuncZipMap(),
+                "abs":              interpolationFuncAbs(),
+                "basename":         interpolationFuncBasename(),
+                "base64decode":     interpolationFuncBase64Decode(),
+                "base64encode":     interpolationFuncBase64Encode(),
+                "base64gzip":       interpolationFuncBase64Gzip(),
+                "base64sha256":     interpolationFuncBase64Sha256(),
+                "base64sha512":     interpolationFuncBase64Sha512(),
+                "bcrypt":           interpolationFuncBcrypt(),
+                "ceil":             interpolationFuncCeil(),
+                "chomp":            interpolationFuncChomp(),
+                "cidrhost":         interpolationFuncCidrHost(),
+                "cidrnetmask":      interpolationFuncCidrNetmask(),
+                "cidrsubnet":       interpolationFuncCidrSubnet(),
+                "coalesce":         interpolationFuncCoalesce(),
+                "coalescelist":     interpolationFuncCoalesceList(),
+                "compact":          interpolationFuncCompact(),
+                "concat":           interpolationFuncConcat(),
+                "contains":         interpolationFuncContains(),
+                "dirname":          interpolationFuncDirname(),
+                "distinct":         interpolationFuncDistinct(),
+                "element":          interpolationFuncElement(),
+                "chunklist":        interpolationFuncChunklist(),
+                "file":             interpolationFuncFile(),
+                "filebase64sha256": interpolationFuncMakeFileHash(interpolationFuncBase64Sha256()),
+                "filebase64sha512": interpolationFuncMakeFileHash(interpolationFuncBase64Sha512()),
+                "filemd5":          interpolationFuncMakeFileHash(interpolationFuncMd5()),
+                "filesha1":         interpolationFuncMakeFileHash(interpolationFuncSha1()),
+                "filesha256":       interpolationFuncMakeFileHash(interpolationFuncSha256()),
+                "filesha512":       interpolationFuncMakeFileHash(interpolationFuncSha512()),
+                "matchkeys":        interpolationFuncMatchKeys(),
+                "flatten":          interpolationFuncFlatten(),
+                "floor":            interpolationFuncFloor(),
+                "format":           interpolationFuncFormat(),
+                "formatlist":       interpolationFuncFormatList(),
+                "indent":           interpolationFuncIndent(),
+                "index":            interpolationFuncIndex(),
+                "join":             interpolationFuncJoin(),
+                "jsonencode":       interpolationFuncJSONEncode(),
+                "length":           interpolationFuncLength(),
+                "list":             interpolationFuncList(),
+                "log":              interpolationFuncLog(),
+                "lower":            interpolationFuncLower(),
+                "map":              interpolationFuncMap(),
+                "max":              interpolationFuncMax(),
+                "md5":              interpolationFuncMd5(),
+                "merge":            interpolationFuncMerge(),
+                "min":              interpolationFuncMin(),
+                "pathexpand":       interpolationFuncPathExpand(),
+                "pow":              interpolationFuncPow(),
+                "uuid":             interpolationFuncUUID(),
+                "replace":          interpolationFuncReplace(),
+                "rsadecrypt":       interpolationFuncRsaDecrypt(),
+                "sha1":             interpolationFuncSha1(),
+                "sha256":           interpolationFuncSha256(),
+                "sha512":           interpolationFuncSha512(),
+                "signum":           interpolationFuncSignum(),
+                "slice":            interpolationFuncSlice(),
+                "sort":             interpolationFuncSort(),
+                "split":            interpolationFuncSplit(),
+                "substr":           interpolationFuncSubstr(),
+                "timestamp":        interpolationFuncTimestamp(),
+                "timeadd":          interpolationFuncTimeAdd(),
+                "title":            interpolationFuncTitle(),
+                "transpose":        interpolationFuncTranspose(),
+                "trimspace":        interpolationFuncTrimSpace(),
+                "upper":            interpolationFuncUpper(),
+                "urlencode":        interpolationFuncURLEncode(),
+                "zipmap":           interpolationFuncZipMap(),
         }
 }
 
@@ -669,6 +690,21 @@ func interpolationFuncFormatList() ast.Function {
         }
 }
 
+// interpolationFuncIndent indents a multi-line string with the
+// specified number of spaces
+func interpolationFuncIndent() ast.Function {
+        return ast.Function{
+                ArgTypes:   []ast.Type{ast.TypeInt, ast.TypeString},
+                ReturnType: ast.TypeString,
+                Callback: func(args []interface{}) (interface{}, error) {
+                        spaces := args[0].(int)
+                        data := args[1].(string)
+                        pad := strings.Repeat(" ", spaces)
+                        return strings.Replace(data, "\n", "\n"+pad, -1), nil
+                },
+        }
+}
+
 // interpolationFuncIndex implements the "index" function that allows one to
 // find the index of a specific element in a list
 func interpolationFuncIndex() ast.Function {
@@ -823,8 +859,7 @@ func interpolationFuncJoin() ast.Function {
 }
 
 // interpolationFuncJSONEncode implements the "jsonencode" function that encodes
-// a string, list, or map as its JSON representation. For now, values in the
-// list or map may only be strings.
+// a string, list, or map as its JSON representation.
 func interpolationFuncJSONEncode() ast.Function {
         return ast.Function{
                 ArgTypes:   []ast.Type{ast.TypeAny},
@@ -837,28 +872,36 @@ func interpolationFuncJSONEncode() ast.Function {
                                 toEncode = typedArg
 
                         case []ast.Variable:
-                                // We preallocate the list here. Note that it's important that in
-                                // the length 0 case, we have an empty list rather than nil, as
-                                // they encode differently.
-                                // XXX It would be nice to support arbitrarily nested data here. Is
-                                // there an inverse of hil.InterfaceToVariable?
                                 strings := make([]string, len(typedArg))
 
                                 for i, v := range typedArg {
                                         if v.Type != ast.TypeString {
-                                                return "", fmt.Errorf("list elements must be strings")
+                                                variable, _ := hil.InterfaceToVariable(typedArg)
+                                                toEncode, _ = hil.VariableToInterface(variable)
+
+                                                jEnc, err := json.Marshal(toEncode)
+                                                if err != nil {
+                                                        return "", fmt.Errorf("failed to encode JSON data '%s'", toEncode)
+                                                }
+                                                return string(jEnc), nil
+
                                         }
                                         strings[i] = v.Value.(string)
                                 }
                                 toEncode = strings
 
                         case map[string]ast.Variable:
-                                // XXX It would be nice to support arbitrarily nested data here. Is
-                                // there an inverse of hil.InterfaceToVariable?
                                 stringMap := make(map[string]string)
                                 for k, v := range typedArg {
                                         if v.Type != ast.TypeString {
-                                                return "", fmt.Errorf("map values must be strings")
+                                                variable, _ := hil.InterfaceToVariable(typedArg)
+                                                toEncode, _ = hil.VariableToInterface(variable)
+
+                                                jEnc, err := json.Marshal(toEncode)
+                                                if err != nil {
+                                                        return "", fmt.Errorf("failed to encode JSON data '%s'", toEncode)
+                                                }
+                                                return string(jEnc), nil
                                         }
                                         stringMap[k] = v.Value.(string)
                                 }
@@ -1098,6 +1141,56 @@ func interpolationFuncElement() ast.Function {
         }
 }
 
+// returns the `list` items chunked by `size`.
+func interpolationFuncChunklist() ast.Function {
+        return ast.Function{
+                ArgTypes: []ast.Type{
+                        ast.TypeList, // inputList
+                        ast.TypeInt,  // size
+                },
+                ReturnType: ast.TypeList,
+                Callback: func(args []interface{}) (interface{}, error) {
+                        output := make([]ast.Variable, 0)
+
+                        values, _ := args[0].([]ast.Variable)
+                        size, _ := args[1].(int)
+
+                        // errors if size is negative
+                        if size < 0 {
+                                return nil, fmt.Errorf("The size argument must be positive")
+                        }
+
+                        // if size is 0, returns a list made of the initial list
+                        if size == 0 {
+                                output = append(output, ast.Variable{
+                                        Type:  ast.TypeList,
+                                        Value: values,
+                                })
+                                return output, nil
+                        }
+
+                        variables := make([]ast.Variable, 0)
+                        chunk := ast.Variable{
+                                Type:  ast.TypeList,
+                                Value: variables,
+                        }
+                        l := len(values)
+                        for i, v := range values {
+                                variables = append(variables, v)
+
+                                // Chunk when index isn't 0, or when reaching the values's length
+                                if (i+1)%size == 0 || (i+1) == l {
+                                        chunk.Value = variables
+                                        output = append(output, chunk)
+                                        variables = make([]ast.Variable, 0)
+                                }
+                        }
+
+                        return output, nil
+                },
+        }
+}
+
 // interpolationFuncKeys implements the "keys" function that yields a list of
 // keys of map types within a Terraform configuration.
 func interpolationFuncKeys(vs map[string]ast.Variable) ast.Function {
@@ -1197,6 +1290,32 @@ func interpolationFuncBase64Decode() ast.Function {
         }
 }
 
+// interpolationFuncBase64Gzip implements the "gzip" function that allows gzip
+// compression encoding the result using base64
+func interpolationFuncBase64Gzip() ast.Function {
+        return ast.Function{
+                ArgTypes:   []ast.Type{ast.TypeString},
+                ReturnType: ast.TypeString,
+                Callback: func(args []interface{}) (interface{}, error) {
+                        s := args[0].(string)
+
+                        var b bytes.Buffer
+                        gz := gzip.NewWriter(&b)
+                        if _, err := gz.Write([]byte(s)); err != nil {
+                                return "", fmt.Errorf("failed to write gzip raw data: '%s'", s)
+                        }
+                        if err := gz.Flush(); err != nil {
+                                return "", fmt.Errorf("failed to flush gzip writer: '%s'", s)
+                        }
+                        if err := gz.Close(); err != nil {
+                                return "", fmt.Errorf("failed to close gzip writer: '%s'", s)
+                        }
+
+                        return base64.StdEncoding.EncodeToString(b.Bytes()), nil
+                },
+        }
+}
+
 // interpolationFuncLower implements the "lower" function that does
 // string lower casing.
 func interpolationFuncLower() ast.Function {
@@ -1396,6 +1515,29 @@ func interpolationFuncTimestamp() ast.Function {
         }
 }
 
+func interpolationFuncTimeAdd() ast.Function {
+        return ast.Function{
+                ArgTypes: []ast.Type{
+                        ast.TypeString, // input timestamp string in RFC3339 format
+                        ast.TypeString, // duration to add to input timestamp that should be parsable by time.ParseDuration
+                },
+                ReturnType: ast.TypeString,
+                Callback: func(args []interface{}) (interface{}, error) {
+
+                        ts, err := time.Parse(time.RFC3339, args[0].(string))
+                        if err != nil {
+                                return nil, err
+                        }
+                        duration, err := time.ParseDuration(args[1].(string))
+                        if err != nil {
+                                return nil, err
+                        }
+
+                        return ts.Add(duration).Format(time.RFC3339), nil
+                },
+        }
+}
+
 // interpolationFuncTitle implements the "title" function that returns a copy of the
 // string in which first characters of all the words are capitalized.
 func interpolationFuncTitle() ast.Function {
@@ -1441,7 +1583,7 @@ func interpolationFuncSubstr() ast.Function {
                                 return nil, fmt.Errorf("length should be a non-negative integer")
                         }
 
-                        if offset > len(str) {
+                        if offset > len(str) || offset < 0 {
                                 return nil, fmt.Errorf("offset cannot be larger than the length of the string")
                         }
 
@@ -1453,3 +1595,160 @@ func interpolationFuncSubstr() ast.Function {
                 },
         }
 }
+
+// Flatten until it's not ast.TypeList
+func flattener(finalList []ast.Variable, flattenList []ast.Variable) []ast.Variable {
+        for _, val := range flattenList {
+                if val.Type == ast.TypeList {
+                        finalList = flattener(finalList, val.Value.([]ast.Variable))
+                } else {
+                        finalList = append(finalList, val)
+                }
+        }
+        return finalList
+}
+
+// Flatten to single list
+func interpolationFuncFlatten() ast.Function {
+        return ast.Function{
+                ArgTypes:   []ast.Type{ast.TypeList},
+                ReturnType: ast.TypeList,
+                Variadic:   false,
+                Callback: func(args []interface{}) (interface{}, error) {
+                        inputList := args[0].([]ast.Variable)
+
+                        var outputList []ast.Variable
+                        return flattener(outputList, inputList), nil
+                },
+        }
+}
+
+func interpolationFuncURLEncode() ast.Function {
+        return ast.Function{
+                ArgTypes:   []ast.Type{ast.TypeString},
+                ReturnType: ast.TypeString,
+                Callback: func(args []interface{}) (interface{}, error) {
+                        s := args[0].(string)
+                        return url.QueryEscape(s), nil
+                },
+        }
+}
+
+// interpolationFuncTranspose implements the "transpose" function
+// that converts a map (string,list) to a map (string,list) where
+// the unique values of the original lists become the keys of the
+// new map and the keys of the original map become values for the
+// corresponding new keys.
+func interpolationFuncTranspose() ast.Function {
+        return ast.Function{
+                ArgTypes:   []ast.Type{ast.TypeMap},
+                ReturnType: ast.TypeMap,
+                Callback: func(args []interface{}) (interface{}, error) {
+
+                        inputMap := args[0].(map[string]ast.Variable)
+                        outputMap := make(map[string]ast.Variable)
+                        tmpMap := make(map[string][]string)
+
+                        for inKey, inVal := range inputMap {
+                                if inVal.Type != ast.TypeList {
+                                        return nil, fmt.Errorf("transpose requires a map of lists of strings")
+                                }
+                                values := inVal.Value.([]ast.Variable)
+                                for _, listVal := range values {
+                                        if listVal.Type != ast.TypeString {
+                                                return nil, fmt.Errorf("transpose requires the given map values to be lists of strings")
+                                        }
+                                        outKey := listVal.Value.(string)
+                                        if _, ok := tmpMap[outKey]; !ok {
+                                                tmpMap[outKey] = make([]string, 0)
+                                        }
+                                        outVal := tmpMap[outKey]
+                                        outVal = append(outVal, inKey)
+                                        sort.Strings(outVal)
+                                        tmpMap[outKey] = outVal
+                                }
+                        }
+
+                        for outKey, outVal := range tmpMap {
+                                values := make([]ast.Variable, 0)
+                                for _, v := range outVal {
+                                        values = append(values, ast.Variable{Type: ast.TypeString, Value: v})
+                                }
+                                outputMap[outKey] = ast.Variable{Type: ast.TypeList, Value: values}
+                        }
+                        return outputMap, nil
+                },
+        }
+}
+
+// interpolationFuncAbs returns the absolute value of a given float.
+func interpolationFuncAbs() ast.Function {
+        return ast.Function{
+                ArgTypes:   []ast.Type{ast.TypeFloat},
+                ReturnType: ast.TypeFloat,
+                Callback: func(args []interface{}) (interface{}, error) {
+                        return math.Abs(args[0].(float64)), nil
+                },
+        }
+}
+
+// interpolationFuncRsaDecrypt implements the "rsadecrypt" function that does
+// RSA decryption.
+func interpolationFuncRsaDecrypt() ast.Function {
+        return ast.Function{
+                ArgTypes:   []ast.Type{ast.TypeString, ast.TypeString},
+                ReturnType: ast.TypeString,
+                Callback: func(args []interface{}) (interface{}, error) {
+                        s := args[0].(string)
+                        key := args[1].(string)
+
+                        b, err := base64.StdEncoding.DecodeString(s)
+                        if err != nil {
+                                return "", fmt.Errorf("Failed to decode input %q: cipher text must be base64-encoded", s)
+                        }
+
+                        block, _ := pem.Decode([]byte(key))
+                        if block == nil {
+                                return "", fmt.Errorf("Failed to read key %q: no key found", key)
+                        }
+                        if block.Headers["Proc-Type"] == "4,ENCRYPTED" {
+                                return "", fmt.Errorf(
+                                        "Failed to read key %q: password protected keys are\n"+
+                                                "not supported. Please decrypt the key prior to use.", key)
+                        }
+
+                        x509Key, err := x509.ParsePKCS1PrivateKey(block.Bytes)
+                        if err != nil {
+                                return "", err
+                        }
+
+                        out, err := rsa.DecryptPKCS1v15(nil, x509Key, b)
+                        if err != nil {
+                                return "", err
+                        }
+
+                        return string(out), nil
+                },
+        }
+}
+
+// interpolationFuncMakeFileHash constructs a function that hashes the contents
+// of a file by combining the implementations of the file(...) function and
+// a given other function that is assumed to take a single string argument and
+// return a hash value.
+func interpolationFuncMakeFileHash(hashFunc ast.Function) ast.Function {
+        fileFunc := interpolationFuncFile()
+
+        return ast.Function{
+                ArgTypes:   []ast.Type{ast.TypeString},
+                ReturnType: ast.TypeString,
+                Callback: func(args []interface{}) (interface{}, error) {
+                        filename := args[0].(string)
+                        contents, err := fileFunc.Callback([]interface{}{filename})
+                        if err != nil {
+                                return nil, err
+                        }
+                        return hashFunc.Callback([]interface{}{contents})
+                },
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/interpolate_walk.go b/vendor/github.com/hashicorp/terraform/config/interpolate_walk.go
index ead3d10..66a677d 100644
--- a/vendor/github.com/hashicorp/terraform/config/interpolate_walk.go
+++ b/vendor/github.com/hashicorp/terraform/config/interpolate_walk.go
@@ -271,9 +271,7 @@ func (w *interpolationWalker) splitSlice() {
                                 result = append(result, val.Value)
                         }
                 case []interface{}:
-                        for _, element := range val {
-                                result = append(result, element)
-                        }
+                        result = append(result, val...)
                 default:
                         result = append(result, v)
                 }
diff --git a/vendor/github.com/hashicorp/terraform/config/loader.go b/vendor/github.com/hashicorp/terraform/config/loader.go
index 5dd7d46..6e34781 100644
--- a/vendor/github.com/hashicorp/terraform/config/loader.go
+++ b/vendor/github.com/hashicorp/terraform/config/loader.go
@@ -80,7 +80,7 @@ func LoadDir(root string) (*Config, error) {
         if err != nil {
                 return nil, err
         }
-        if len(files) == 0 {
+        if len(files) == 0 && len(overrides) == 0 {
                 return nil, &ErrNoConfigsFound{Dir: root}
         }
 
@@ -112,6 +112,9 @@ func LoadDir(root string) (*Config, error) {
                         result = c
                 }
         }
+        if len(files) == 0 {
+                result = &Config{}
+        }
 
         // Load all the overrides, and merge them into the config
         for _, f := range overrides {
diff --git a/vendor/github.com/hashicorp/terraform/config/loader_hcl.go b/vendor/github.com/hashicorp/terraform/config/loader_hcl.go
index e85e493..68cffe2 100644
--- a/vendor/github.com/hashicorp/terraform/config/loader_hcl.go
+++ b/vendor/github.com/hashicorp/terraform/config/loader_hcl.go
@@ -17,10 +17,20 @@ type hclConfigurable struct {
         Root *ast.File
 }
 
+var ReservedDataSourceFields = []string{
+        "connection",
+        "count",
+        "depends_on",
+        "lifecycle",
+        "provider",
+        "provisioner",
+}
+
 var ReservedResourceFields = []string{
         "connection",
         "count",
         "depends_on",
+        "id",
         "lifecycle",
         "provider",
         "provisioner",
@@ -35,6 +45,7 @@ func (t *hclConfigurable) Config() (*Config, error) {
         validKeys := map[string]struct{}{
                 "atlas":     struct{}{},
                 "data":      struct{}{},
+                "locals":    struct{}{},
                 "module":    struct{}{},
                 "output":    struct{}{},
                 "provider":  struct{}{},
@@ -70,6 +81,15 @@ func (t *hclConfigurable) Config() (*Config, error) {
                 }
         }
 
+        // Build local values
+        if locals := list.Filter("locals"); len(locals.Items) > 0 {
+                var err error
+                config.Locals, err = loadLocalsHcl(locals)
+                if err != nil {
+                        return nil, err
+                }
+        }
+
         // Get Atlas configuration
         if atlas := list.Filter("atlas"); len(atlas.Items) > 0 {
                 var err error
@@ -373,9 +393,6 @@ func loadModulesHcl(list *ast.ObjectList) ([]*Module, error) {
                                 err)
                 }
 
-                // Remove the fields we handle specially
-                delete(config, "source")
-
                 rawConfig, err := NewRawConfig(config)
                 if err != nil {
                         return nil, fmt.Errorf(
@@ -384,7 +401,11 @@ func loadModulesHcl(list *ast.ObjectList) ([]*Module, error) {
                                 err)
                 }
 
-                // If we have a count, then figure it out
+                // Remove the fields we handle specially
+                delete(config, "source")
+                delete(config, "version")
+                delete(config, "providers")
+
                 var source string
                 if o := listVal.Filter("source"); len(o.Items) > 0 {
                         err = hcl.DecodeObject(&source, o.Items[0].Val)
@@ -396,9 +417,33 @@ func loadModulesHcl(list *ast.ObjectList) ([]*Module, error) {
                         }
                 }
 
+                var version string
+                if o := listVal.Filter("version"); len(o.Items) > 0 {
+                        err = hcl.DecodeObject(&version, o.Items[0].Val)
+                        if err != nil {
+                                return nil, fmt.Errorf(
+                                        "Error parsing version for %s: %s",
+                                        k,
+                                        err)
+                        }
+                }
+
+                var providers map[string]string
+                if o := listVal.Filter("providers"); len(o.Items) > 0 {
+                        err = hcl.DecodeObject(&providers, o.Items[0].Val)
+                        if err != nil {
+                                return nil, fmt.Errorf(
+                                        "Error parsing providers for %s: %s",
+                                        k,
+                                        err)
+                        }
+                }
+
                 result = append(result, &Module{
                         Name:      k,
                         Source:    source,
+                        Version:   version,
+                        Providers: providers,
                         RawConfig: rawConfig,
                 })
         }
@@ -406,6 +451,59 @@ func loadModulesHcl(list *ast.ObjectList) ([]*Module, error) {
         return result, nil
 }
 
+// loadLocalsHcl recurses into the given HCL object turns it into
+// a list of locals.
+func loadLocalsHcl(list *ast.ObjectList) ([]*Local, error) {
+
+        result := make([]*Local, 0, len(list.Items))
+
+        for _, block := range list.Items {
+                if len(block.Keys) > 0 {
+                        return nil, fmt.Errorf(
+                                "locals block at %s should not have label %q",
+                                block.Pos(), block.Keys[0].Token.Value(),
+                        )
+                }
+
+                blockObj, ok := block.Val.(*ast.ObjectType)
+                if !ok {
+                        return nil, fmt.Errorf("locals value at %s should be a block", block.Val.Pos())
+                }
+
+                // blockObj now contains directly our local decls
+                for _, item := range blockObj.List.Items {
+                        if len(item.Keys) != 1 {
+                                return nil, fmt.Errorf("local declaration at %s may not be a block", item.Val.Pos())
+                        }
+
+                        // By the time we get here there can only be one item left, but
+                        // we'll decode into a map anyway because it's a convenient way
+                        // to extract both the key and the value robustly.
+                        kv := map[string]interface{}{}
+                        hcl.DecodeObject(&kv, item)
+                        for k, v := range kv {
+                                rawConfig, err := NewRawConfig(map[string]interface{}{
+                                        "value": v,
+                                })
+
+                                if err != nil {
+                                        return nil, fmt.Errorf(
+                                                "error parsing local value %q at %s: %s",
+                                                k, item.Val.Pos(), err,
+                                        )
+                                }
+
+                                result = append(result, &Local{
+                                        Name:      k,
+                                        RawConfig: rawConfig,
+                                })
+                        }
+                }
+        }
+
+        return result, nil
+}
+
 // LoadOutputsHcl recurses into the given HCL object and turns
 // it into a mapping of outputs.
 func loadOutputsHcl(list *ast.ObjectList) ([]*Output, error) {
@@ -434,6 +532,7 @@ func loadOutputsHcl(list *ast.ObjectList) ([]*Output, error) {
 
                 // Delete special keys
                 delete(config, "depends_on")
+                delete(config, "description")
 
                 rawConfig, err := NewRawConfig(config)
                 if err != nil {
@@ -455,10 +554,23 @@ func loadOutputsHcl(list *ast.ObjectList) ([]*Output, error) {
                         }
                 }
 
+                // If we have a description field, then filter that
+                var description string
+                if o := listVal.Filter("description"); len(o.Items) > 0 {
+                        err := hcl.DecodeObject(&description, o.Items[0].Val)
+                        if err != nil {
+                                return nil, fmt.Errorf(
+                                        "Error reading description for output %q: %s",
+                                        n,
+                                        err)
+                        }
+                }
+
                 result = append(result, &Output{
-                        Name:      n,
-                        RawConfig: rawConfig,
-                        DependsOn: dependsOn,
+                        Name:        n,
+                        RawConfig:   rawConfig,
+                        DependsOn:   dependsOn,
+                        Description: description,
                 })
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/config/loader_hcl2.go b/vendor/github.com/hashicorp/terraform/config/loader_hcl2.go
new file mode 100644
index 0000000..4f9f129
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/loader_hcl2.go
@@ -0,0 +1,473 @@
+package config
+
+import (
+        "fmt"
+        "sort"
+        "strings"
+
+        gohcl2 "github.com/hashicorp/hcl2/gohcl"
+        hcl2 "github.com/hashicorp/hcl2/hcl"
+        hcl2parse "github.com/hashicorp/hcl2/hclparse"
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// hcl2Configurable is an implementation of configurable that knows
+// how to turn a HCL Body into a *Config object.
+type hcl2Configurable struct {
+        SourceFilename string
+        Body           hcl2.Body
+}
+
+// hcl2Loader is a wrapper around a HCL parser that provides a fileLoaderFunc.
+type hcl2Loader struct {
+        Parser *hcl2parse.Parser
+}
+
+// For the moment we'll just have a global loader since we don't have anywhere
+// better to stash this.
+// TODO: refactor the loader API so that it uses some sort of object we can
+// stash the parser inside.
+var globalHCL2Loader = newHCL2Loader()
+
+// newHCL2Loader creates a new hcl2Loader containing a new HCL Parser.
+//
+// HCL parsers retain information about files that are loaded to aid in
+// producing diagnostic messages, so all files within a single configuration
+// should be loaded with the same parser to ensure the availability of
+// full diagnostic information.
+func newHCL2Loader() hcl2Loader {
+        return hcl2Loader{
+                Parser: hcl2parse.NewParser(),
+        }
+}
+
+// loadFile is a fileLoaderFunc that knows how to read a HCL2 file and turn it
+// into a hcl2Configurable.
+func (l hcl2Loader) loadFile(filename string) (configurable, []string, error) {
+        var f *hcl2.File
+        var diags hcl2.Diagnostics
+        if strings.HasSuffix(filename, ".json") {
+                f, diags = l.Parser.ParseJSONFile(filename)
+        } else {
+                f, diags = l.Parser.ParseHCLFile(filename)
+        }
+        if diags.HasErrors() {
+                // Return diagnostics as an error; callers may type-assert this to
+                // recover the original diagnostics, if it doesn't end up wrapped
+                // in another error.
+                return nil, nil, diags
+        }
+
+        return &hcl2Configurable{
+                SourceFilename: filename,
+                Body:           f.Body,
+        }, nil, nil
+}
+
+func (t *hcl2Configurable) Config() (*Config, error) {
+        config := &Config{}
+
+        // these structs are used only for the initial shallow decoding; we'll
+        // expand this into the main, public-facing config structs afterwards.
+        type atlas struct {
+                Name    string    `hcl:"name"`
+                Include *[]string `hcl:"include"`
+                Exclude *[]string `hcl:"exclude"`
+        }
+        type provider struct {
+                Name    string    `hcl:"name,label"`
+                Alias   *string   `hcl:"alias,attr"`
+                Version *string   `hcl:"version,attr"`
+                Config  hcl2.Body `hcl:",remain"`
+        }
+        type module struct {
+                Name      string             `hcl:"name,label"`
+                Source    string             `hcl:"source,attr"`
+                Version   *string            `hcl:"version,attr"`
+                Providers *map[string]string `hcl:"providers,attr"`
+                Config    hcl2.Body          `hcl:",remain"`
+        }
+        type resourceLifecycle struct {
+                CreateBeforeDestroy *bool     `hcl:"create_before_destroy,attr"`
+                PreventDestroy      *bool     `hcl:"prevent_destroy,attr"`
+                IgnoreChanges       *[]string `hcl:"ignore_changes,attr"`
+        }
+        type connection struct {
+                Config hcl2.Body `hcl:",remain"`
+        }
+        type provisioner struct {
+                Type string `hcl:"type,label"`
+
+                When      *string `hcl:"when,attr"`
+                OnFailure *string `hcl:"on_failure,attr"`
+
+                Connection *connection `hcl:"connection,block"`
+                Config     hcl2.Body   `hcl:",remain"`
+        }
+        type managedResource struct {
+                Type string `hcl:"type,label"`
+                Name string `hcl:"name,label"`
+
+                CountExpr hcl2.Expression `hcl:"count,attr"`
+                Provider  *string         `hcl:"provider,attr"`
+                DependsOn *[]string       `hcl:"depends_on,attr"`
+
+                Lifecycle    *resourceLifecycle `hcl:"lifecycle,block"`
+                Provisioners []provisioner      `hcl:"provisioner,block"`
+                Connection   *connection        `hcl:"connection,block"`
+
+                Config hcl2.Body `hcl:",remain"`
+        }
+        type dataResource struct {
+                Type string `hcl:"type,label"`
+                Name string `hcl:"name,label"`
+
+                CountExpr hcl2.Expression `hcl:"count,attr"`
+                Provider  *string         `hcl:"provider,attr"`
+                DependsOn *[]string       `hcl:"depends_on,attr"`
+
+                Config hcl2.Body `hcl:",remain"`
+        }
+        type variable struct {
+                Name string `hcl:"name,label"`
+
+                DeclaredType *string    `hcl:"type,attr"`
+                Default      *cty.Value `hcl:"default,attr"`
+                Description  *string    `hcl:"description,attr"`
+                Sensitive    *bool      `hcl:"sensitive,attr"`
+        }
+        type output struct {
+                Name string `hcl:"name,label"`
+
+                ValueExpr   hcl2.Expression `hcl:"value,attr"`
+                DependsOn   *[]string       `hcl:"depends_on,attr"`
+                Description *string         `hcl:"description,attr"`
+                Sensitive   *bool           `hcl:"sensitive,attr"`
+        }
+        type locals struct {
+                Definitions hcl2.Attributes `hcl:",remain"`
+        }
+        type backend struct {
+                Type   string    `hcl:"type,label"`
+                Config hcl2.Body `hcl:",remain"`
+        }
+        type terraform struct {
+                RequiredVersion *string  `hcl:"required_version,attr"`
+                Backend         *backend `hcl:"backend,block"`
+        }
+        type topLevel struct {
+                Atlas     *atlas            `hcl:"atlas,block"`
+                Datas     []dataResource    `hcl:"data,block"`
+                Modules   []module          `hcl:"module,block"`
+                Outputs   []output          `hcl:"output,block"`
+                Providers []provider        `hcl:"provider,block"`
+                Resources []managedResource `hcl:"resource,block"`
+                Terraform *terraform        `hcl:"terraform,block"`
+                Variables []variable        `hcl:"variable,block"`
+                Locals    []*locals         `hcl:"locals,block"`
+        }
+
+        var raw topLevel
+        diags := gohcl2.DecodeBody(t.Body, nil, &raw)
+        if diags.HasErrors() {
+                // Do some minimal decoding to see if we can at least get the
+                // required Terraform version, which might help explain why we
+                // couldn't parse the rest.
+                if raw.Terraform != nil && raw.Terraform.RequiredVersion != nil {
+                        config.Terraform = &Terraform{
+                                RequiredVersion: *raw.Terraform.RequiredVersion,
+                        }
+                }
+
+                // We return the diags as an implementation of error, which the
+                // caller than then type-assert if desired to recover the individual
+                // diagnostics.
+                // FIXME: The current API gives us no way to return warnings in the
+                // absense of any errors.
+                return config, diags
+        }
+
+        if raw.Terraform != nil {
+                var reqdVersion string
+                var backend *Backend
+
+                if raw.Terraform.RequiredVersion != nil {
+                        reqdVersion = *raw.Terraform.RequiredVersion
+                }
+                if raw.Terraform.Backend != nil {
+                        backend = new(Backend)
+                        backend.Type = raw.Terraform.Backend.Type
+
+                        // We don't permit interpolations or nested blocks inside the
+                        // backend config, so we can decode the config early here and
+                        // get direct access to the values, which is important for the
+                        // config hashing to work as expected.
+                        var config map[string]string
+                        configDiags := gohcl2.DecodeBody(raw.Terraform.Backend.Config, nil, &config)
+                        diags = append(diags, configDiags...)
+
+                        raw := make(map[string]interface{}, len(config))
+                        for k, v := range config {
+                                raw[k] = v
+                        }
+
+                        var err error
+                        backend.RawConfig, err = NewRawConfig(raw)
+                        if err != nil {
+                                diags = append(diags, &hcl2.Diagnostic{
+                                        Severity: hcl2.DiagError,
+                                        Summary:  "Invalid backend configuration",
+                                        Detail:   fmt.Sprintf("Error in backend configuration: %s", err),
+                                })
+                        }
+                }
+
+                config.Terraform = &Terraform{
+                        RequiredVersion: reqdVersion,
+                        Backend:         backend,
+                }
+        }
+
+        if raw.Atlas != nil {
+                var include, exclude []string
+                if raw.Atlas.Include != nil {
+                        include = *raw.Atlas.Include
+                }
+                if raw.Atlas.Exclude != nil {
+                        exclude = *raw.Atlas.Exclude
+                }
+                config.Atlas = &AtlasConfig{
+                        Name:    raw.Atlas.Name,
+                        Include: include,
+                        Exclude: exclude,
+                }
+        }
+
+        for _, rawM := range raw.Modules {
+                m := &Module{
+                        Name:      rawM.Name,
+                        Source:    rawM.Source,
+                        RawConfig: NewRawConfigHCL2(rawM.Config),
+                }
+
+                if rawM.Version != nil {
+                        m.Version = *rawM.Version
+                }
+
+                if rawM.Providers != nil {
+                        m.Providers = *rawM.Providers
+                }
+
+                config.Modules = append(config.Modules, m)
+        }
+
+        for _, rawV := range raw.Variables {
+                v := &Variable{
+                        Name: rawV.Name,
+                }
+                if rawV.DeclaredType != nil {
+                        v.DeclaredType = *rawV.DeclaredType
+                }
+                if rawV.Default != nil {
+                        v.Default = hcl2shim.ConfigValueFromHCL2(*rawV.Default)
+                }
+                if rawV.Description != nil {
+                        v.Description = *rawV.Description
+                }
+
+                config.Variables = append(config.Variables, v)
+        }
+
+        for _, rawO := range raw.Outputs {
+                o := &Output{
+                        Name: rawO.Name,
+                }
+
+                if rawO.Description != nil {
+                        o.Description = *rawO.Description
+                }
+                if rawO.DependsOn != nil {
+                        o.DependsOn = *rawO.DependsOn
+                }
+                if rawO.Sensitive != nil {
+                        o.Sensitive = *rawO.Sensitive
+                }
+
+                // The result is expected to be a map like map[string]interface{}{"value": something},
+                // so we'll fake that with our hcl2shim.SingleAttrBody shim.
+                o.RawConfig = NewRawConfigHCL2(hcl2shim.SingleAttrBody{
+                        Name: "value",
+                        Expr: rawO.ValueExpr,
+                })
+
+                config.Outputs = append(config.Outputs, o)
+        }
+
+        for _, rawR := range raw.Resources {
+                r := &Resource{
+                        Mode: ManagedResourceMode,
+                        Type: rawR.Type,
+                        Name: rawR.Name,
+                }
+                if rawR.Lifecycle != nil {
+                        var l ResourceLifecycle
+                        if rawR.Lifecycle.CreateBeforeDestroy != nil {
+                                l.CreateBeforeDestroy = *rawR.Lifecycle.CreateBeforeDestroy
+                        }
+                        if rawR.Lifecycle.PreventDestroy != nil {
+                                l.PreventDestroy = *rawR.Lifecycle.PreventDestroy
+                        }
+                        if rawR.Lifecycle.IgnoreChanges != nil {
+                                l.IgnoreChanges = *rawR.Lifecycle.IgnoreChanges
+                        }
+                        r.Lifecycle = l
+                }
+                if rawR.Provider != nil {
+                        r.Provider = *rawR.Provider
+                }
+                if rawR.DependsOn != nil {
+                        r.DependsOn = *rawR.DependsOn
+                }
+
+                var defaultConnInfo *RawConfig
+                if rawR.Connection != nil {
+                        defaultConnInfo = NewRawConfigHCL2(rawR.Connection.Config)
+                }
+
+                for _, rawP := range rawR.Provisioners {
+                        p := &Provisioner{
+                                Type: rawP.Type,
+                        }
+
+                        switch {
+                        case rawP.When == nil:
+                                p.When = ProvisionerWhenCreate
+                        case *rawP.When == "create":
+                                p.When = ProvisionerWhenCreate
+                        case *rawP.When == "destroy":
+                                p.When = ProvisionerWhenDestroy
+                        default:
+                                p.When = ProvisionerWhenInvalid
+                        }
+
+                        switch {
+                        case rawP.OnFailure == nil:
+                                p.OnFailure = ProvisionerOnFailureFail
+                        case *rawP.When == "fail":
+                                p.OnFailure = ProvisionerOnFailureFail
+                        case *rawP.When == "continue":
+                                p.OnFailure = ProvisionerOnFailureContinue
+                        default:
+                                p.OnFailure = ProvisionerOnFailureInvalid
+                        }
+
+                        if rawP.Connection != nil {
+                                p.ConnInfo = NewRawConfigHCL2(rawP.Connection.Config)
+                        } else {
+                                p.ConnInfo = defaultConnInfo
+                        }
+
+                        p.RawConfig = NewRawConfigHCL2(rawP.Config)
+
+                        r.Provisioners = append(r.Provisioners, p)
+                }
+
+                // The old loader records the count expression as a weird RawConfig with
+                // a single-element map inside. Since the rest of the world is assuming
+                // that, we'll mimic it here.
+                {
+                        countBody := hcl2shim.SingleAttrBody{
+                                Name: "count",
+                                Expr: rawR.CountExpr,
+                        }
+
+                        r.RawCount = NewRawConfigHCL2(countBody)
+                        r.RawCount.Key = "count"
+                }
+
+                r.RawConfig = NewRawConfigHCL2(rawR.Config)
+
+                config.Resources = append(config.Resources, r)
+
+        }
+
+        for _, rawR := range raw.Datas {
+                r := &Resource{
+                        Mode: DataResourceMode,
+                        Type: rawR.Type,
+                        Name: rawR.Name,
+                }
+
+                if rawR.Provider != nil {
+                        r.Provider = *rawR.Provider
+                }
+                if rawR.DependsOn != nil {
+                        r.DependsOn = *rawR.DependsOn
+                }
+
+                // The old loader records the count expression as a weird RawConfig with
+                // a single-element map inside. Since the rest of the world is assuming
+                // that, we'll mimic it here.
+                {
+                        countBody := hcl2shim.SingleAttrBody{
+                                Name: "count",
+                                Expr: rawR.CountExpr,
+                        }
+
+                        r.RawCount = NewRawConfigHCL2(countBody)
+                        r.RawCount.Key = "count"
+                }
+
+                r.RawConfig = NewRawConfigHCL2(rawR.Config)
+
+                config.Resources = append(config.Resources, r)
+        }
+
+        for _, rawP := range raw.Providers {
+                p := &ProviderConfig{
+                        Name: rawP.Name,
+                }
+
+                if rawP.Alias != nil {
+                        p.Alias = *rawP.Alias
+                }
+                if rawP.Version != nil {
+                        p.Version = *rawP.Version
+                }
+
+                // The result is expected to be a map like map[string]interface{}{"value": something},
+                // so we'll fake that with our hcl2shim.SingleAttrBody shim.
+                p.RawConfig = NewRawConfigHCL2(rawP.Config)
+
+                config.ProviderConfigs = append(config.ProviderConfigs, p)
+        }
+
+        for _, rawL := range raw.Locals {
+                names := make([]string, 0, len(rawL.Definitions))
+                for n := range rawL.Definitions {
+                        names = append(names, n)
+                }
+                sort.Strings(names)
+                for _, n := range names {
+                        attr := rawL.Definitions[n]
+                        l := &Local{
+                                Name: n,
+                                RawConfig: NewRawConfigHCL2(hcl2shim.SingleAttrBody{
+                                        Name: "value",
+                                        Expr: attr.Expr,
+                                }),
+                        }
+                        config.Locals = append(config.Locals, l)
+                }
+        }
+
+        // FIXME: The current API gives us no way to return warnings in the
+        // absense of any errors.
+        var err error
+        if diags.HasErrors() {
+                err = diags
+        }
+
+        return config, err
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/merge.go b/vendor/github.com/hashicorp/terraform/config/merge.go
index db214be..55fc864 100644
--- a/vendor/github.com/hashicorp/terraform/config/merge.go
+++ b/vendor/github.com/hashicorp/terraform/config/merge.go
@@ -137,6 +137,17 @@ func Merge(c1, c2 *Config) (*Config, error) {
                 }
         }
 
+        // Local Values
+        // These are simpler than the other config elements because they are just
+        // flat values and so no deep merging is required.
+        if localsCount := len(c1.Locals) + len(c2.Locals); localsCount != 0 {
+                // Explicit length check above because we want c.Locals to remain
+                // nil if the result would be empty.
+                c.Locals = make([]*Local, 0, len(c1.Locals)+len(c2.Locals))
+                c.Locals = append(c.Locals, c1.Locals...)
+                c.Locals = append(c.Locals, c2.Locals...)
+        }
+
         return c, nil
 }
 
diff --git a/vendor/github.com/hashicorp/terraform/config/module/get.go b/vendor/github.com/hashicorp/terraform/config/module/get.go
index 96b4a63..5073d0d 100644
--- a/vendor/github.com/hashicorp/terraform/config/module/get.go
+++ b/vendor/github.com/hashicorp/terraform/config/module/get.go
@@ -3,6 +3,7 @@ package module
 import (
         "io/ioutil"
         "os"
+        "path/filepath"
 
         "github.com/hashicorp/go-getter"
 )
@@ -37,13 +38,10 @@ func GetCopy(dst, src string) error {
         if err != nil {
                 return err
         }
-        // FIXME: This isn't completely safe. Creating and removing our temp path
-        //        exposes where to race to inject files.
-        if err := os.RemoveAll(tmpDir); err != nil {
-                return err
-        }
         defer os.RemoveAll(tmpDir)
 
+        tmpDir = filepath.Join(tmpDir, "module")
+
         // Get to that temporary dir
         if err := getter.Get(tmpDir, src); err != nil {
                 return err
@@ -57,15 +55,3 @@ func GetCopy(dst, src string) error {
         // Copy to the final location
         return copyDir(dst, tmpDir)
 }
-
-func getStorage(s getter.Storage, key string, src string, mode GetMode) (string, bool, error) {
-        // Get the module with the level specified if we were told to.
-        if mode > GetModeNone {
-                if err := s.Get(key, src, mode == GetModeUpdate); err != nil {
-                        return "", false, err
-                }
-        }
-
-        // Get the directory where the module is.
-        return s.Dir(key)
-}
diff --git a/vendor/github.com/hashicorp/terraform/config/module/inode.go b/vendor/github.com/hashicorp/terraform/config/module/inode.go
index 8603ee2..da520ab 100644
--- a/vendor/github.com/hashicorp/terraform/config/module/inode.go
+++ b/vendor/github.com/hashicorp/terraform/config/module/inode.go
@@ -1,4 +1,4 @@
-// +build linux darwin openbsd netbsd solaris
+// +build linux darwin openbsd netbsd solaris dragonfly
 
 package module
 
diff --git a/vendor/github.com/hashicorp/terraform/config/module/module.go b/vendor/github.com/hashicorp/terraform/config/module/module.go
index f8649f6..7dc8fcc 100644
--- a/vendor/github.com/hashicorp/terraform/config/module/module.go
+++ b/vendor/github.com/hashicorp/terraform/config/module/module.go
@@ -2,6 +2,8 @@ package module
 
 // Module represents the metadata for a single module.
 type Module struct {
-        Name   string
-        Source string
+        Name      string
+        Source    string
+        Version   string
+        Providers map[string]string
 }
diff --git a/vendor/github.com/hashicorp/terraform/config/module/storage.go b/vendor/github.com/hashicorp/terraform/config/module/storage.go
new file mode 100644
index 0000000..58e3a10
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/module/storage.go
@@ -0,0 +1,365 @@
+package module
+
+import (
+        "encoding/json"
+        "fmt"
+        "io/ioutil"
+        "log"
+        "os"
+        "path/filepath"
+        "strings"
+
+        getter "github.com/hashicorp/go-getter"
+        "github.com/hashicorp/terraform/registry"
+        "github.com/hashicorp/terraform/registry/regsrc"
+        "github.com/hashicorp/terraform/svchost/disco"
+        "github.com/mitchellh/cli"
+)
+
+const manifestName = "modules.json"
+
+// moduleManifest is the serialization structure used to record the stored
+// module's metadata.
+type moduleManifest struct {
+        Modules []moduleRecord
+}
+
+// moduleRecords represents the stored module's metadata.
+// This is compared for equality using '==', so all fields needs to remain
+// comparable.
+type moduleRecord struct {
+        // Source is the module source string from the config, minus any
+        // subdirectory.
+        Source string
+
+        // Key is the locally unique identifier for this module.
+        Key string
+
+        // Version is the exact version string for the stored module.
+        Version string
+
+        // Dir is the directory name returned by the FileStorage. This is what
+        // allows us to correlate a particular module version with the location on
+        // disk.
+        Dir string
+
+        // Root is the root directory containing the module. If the module is
+        // unpacked from an archive, and not located in the root directory, this is
+        // used to direct the loader to the correct subdirectory. This is
+        // independent from any subdirectory in the original source string, which
+        // may traverse further into the module tree.
+        Root string
+
+        // url is the location of the module source
+        url string
+
+        // Registry is true if this module is sourced from a registry
+        registry bool
+}
+
+// Storage implements methods to manage the storage of modules.
+// This is used by Tree.Load to query registries, authenticate requests, and
+// store modules locally.
+type Storage struct {
+        // StorageDir is the full path to the directory where all modules will be
+        // stored.
+        StorageDir string
+
+        // Ui is an optional cli.Ui for user output
+        Ui cli.Ui
+
+        // Mode is the GetMode that will be used for various operations.
+        Mode GetMode
+
+        registry *registry.Client
+}
+
+// NewStorage returns a new initialized Storage object.
+func NewStorage(dir string, services *disco.Disco) *Storage {
+        regClient := registry.NewClient(services, nil)
+
+        return &Storage{
+                StorageDir: dir,
+                registry:   regClient,
+        }
+}
+
+// loadManifest returns the moduleManifest file from the parent directory.
+func (s Storage) loadManifest() (moduleManifest, error) {
+        manifest := moduleManifest{}
+
+        manifestPath := filepath.Join(s.StorageDir, manifestName)
+        data, err := ioutil.ReadFile(manifestPath)
+        if err != nil && !os.IsNotExist(err) {
+                return manifest, err
+        }
+
+        if len(data) == 0 {
+                return manifest, nil
+        }
+
+        if err := json.Unmarshal(data, &manifest); err != nil {
+                return manifest, err
+        }
+
+        for i, rec := range manifest.Modules {
+                // If the path was recorded before we changed to always using a
+                // slash as separator, we delete the record from the manifest so
+                // it can be discovered again and will be recorded using a slash.
+                if strings.Contains(rec.Dir, "\\") {
+                        manifest.Modules[i] = manifest.Modules[len(manifest.Modules)-1]
+                        manifest.Modules = manifest.Modules[:len(manifest.Modules)-1]
+                        continue
+                }
+
+                // Make sure we use the correct path separator.
+                rec.Dir = filepath.FromSlash(rec.Dir)
+        }
+
+        return manifest, nil
+}
+
+// Store the location of the module, along with the version used and the module
+// root directory. The storage method loads the entire file and rewrites it
+// each time. This is only done a few times during init, so efficiency is
+// not a concern.
+func (s Storage) recordModule(rec moduleRecord) error {
+        manifest, err := s.loadManifest()
+        if err != nil {
+                // if there was a problem with the file, we will attempt to write a new
+                // one. Any non-data related error should surface there.
+                log.Printf("[WARN] error reading module manifest: %s", err)
+        }
+
+        // do nothing if we already have the exact module
+        for i, stored := range manifest.Modules {
+                if rec == stored {
+                        return nil
+                }
+
+                // they are not equal, but if the storage path is the same we need to
+                // remove this rec to be replaced.
+                if rec.Dir == stored.Dir {
+                        manifest.Modules[i] = manifest.Modules[len(manifest.Modules)-1]
+                        manifest.Modules = manifest.Modules[:len(manifest.Modules)-1]
+                        break
+                }
+        }
+
+        // Make sure we always use a slash separator.
+        rec.Dir = filepath.ToSlash(rec.Dir)
+
+        manifest.Modules = append(manifest.Modules, rec)
+
+        js, err := json.Marshal(manifest)
+        if err != nil {
+                panic(err)
+        }
+
+        manifestPath := filepath.Join(s.StorageDir, manifestName)
+        return ioutil.WriteFile(manifestPath, js, 0644)
+}
+
+// load the manifest from dir, and return all module versions matching the
+// provided source. Records with no version info will be skipped, as they need
+// to be uniquely identified by other means.
+func (s Storage) moduleVersions(source string) ([]moduleRecord, error) {
+        manifest, err := s.loadManifest()
+        if err != nil {
+                return manifest.Modules, err
+        }
+
+        var matching []moduleRecord
+
+        for _, m := range manifest.Modules {
+                if m.Source == source && m.Version != "" {
+                        log.Printf("[DEBUG] found local version %q for module %s", m.Version, m.Source)
+                        matching = append(matching, m)
+                }
+        }
+
+        return matching, nil
+}
+
+func (s Storage) moduleDir(key string) (string, error) {
+        manifest, err := s.loadManifest()
+        if err != nil {
+                return "", err
+        }
+
+        for _, m := range manifest.Modules {
+                if m.Key == key {
+                        return m.Dir, nil
+                }
+        }
+
+        return "", nil
+}
+
+// return only the root directory of the module stored in dir.
+func (s Storage) getModuleRoot(dir string) (string, error) {
+        manifest, err := s.loadManifest()
+        if err != nil {
+                return "", err
+        }
+
+        for _, mod := range manifest.Modules {
+                if mod.Dir == dir {
+                        return mod.Root, nil
+                }
+        }
+        return "", nil
+}
+
+// record only the Root directory for the module stored at dir.
+func (s Storage) recordModuleRoot(dir, root string) error {
+        rec := moduleRecord{
+                Dir:  dir,
+                Root: root,
+        }
+
+        return s.recordModule(rec)
+}
+
+func (s Storage) output(msg string) {
+        if s.Ui == nil || s.Mode == GetModeNone {
+                return
+        }
+        s.Ui.Output(msg)
+}
+
+func (s Storage) getStorage(key string, src string) (string, bool, error) {
+        storage := &getter.FolderStorage{
+                StorageDir: s.StorageDir,
+        }
+
+        log.Printf("[DEBUG] fetching module from %s", src)
+
+        // Get the module with the level specified if we were told to.
+        if s.Mode > GetModeNone {
+                log.Printf("[DEBUG] fetching %q with key %q", src, key)
+                if err := storage.Get(key, src, s.Mode == GetModeUpdate); err != nil {
+                        return "", false, err
+                }
+        }
+
+        // Get the directory where the module is.
+        dir, found, err := storage.Dir(key)
+        log.Printf("[DEBUG] found %q in %q: %t", src, dir, found)
+        return dir, found, err
+}
+
+// find a stored module that's not from a registry
+func (s Storage) findModule(key string) (string, error) {
+        if s.Mode == GetModeUpdate {
+                return "", nil
+        }
+
+        return s.moduleDir(key)
+}
+
+// GetModule fetches a module source into the specified directory. This is used
+// as a convenience function by the CLI to initialize a configuration.
+func (s Storage) GetModule(dst, src string) error {
+        // reset this in case the caller was going to re-use it
+        mode := s.Mode
+        s.Mode = GetModeUpdate
+        defer func() {
+                s.Mode = mode
+        }()
+
+        rec, err := s.findRegistryModule(src, anyVersion)
+        if err != nil {
+                return err
+        }
+
+        pwd, err := os.Getwd()
+        if err != nil {
+                return err
+        }
+
+        source := rec.url
+        if source == "" {
+                source, err = getter.Detect(src, pwd, getter.Detectors)
+                if err != nil {
+                        return fmt.Errorf("module %s: %s", src, err)
+                }
+        }
+
+        if source == "" {
+                return fmt.Errorf("module %q not found", src)
+        }
+
+        return GetCopy(dst, source)
+}
+
+// find a registry module
+func (s Storage) findRegistryModule(mSource, constraint string) (moduleRecord, error) {
+        rec := moduleRecord{
+                Source: mSource,
+        }
+        // detect if we have a registry source
+        mod, err := regsrc.ParseModuleSource(mSource)
+        switch err {
+        case nil:
+                //ok
+        case regsrc.ErrInvalidModuleSource:
+                return rec, nil
+        default:
+                return rec, err
+        }
+        rec.registry = true
+
+        log.Printf("[TRACE] %q is a registry module", mod.Display())
+
+        versions, err := s.moduleVersions(mod.String())
+        if err != nil {
+                log.Printf("[ERROR] error looking up versions for %q: %s", mod.Display(), err)
+                return rec, err
+        }
+
+        match, err := newestRecord(versions, constraint)
+        if err != nil {
+                log.Printf("[INFO] no matching version for %q<%s>, %s", mod.Display(), constraint, err)
+        }
+        log.Printf("[DEBUG] matched %q version %s for %s", mod, match.Version, constraint)
+
+        rec.Dir = match.Dir
+        rec.Version = match.Version
+        found := rec.Dir != ""
+
+        // we need to lookup available versions
+        // Only on Get if it's not found, on unconditionally on Update
+        if (s.Mode == GetModeGet && !found) || (s.Mode == GetModeUpdate) {
+                resp, err := s.registry.Versions(mod)
+                if err != nil {
+                        return rec, err
+                }
+
+                if len(resp.Modules) == 0 {
+                        return rec, fmt.Errorf("module %q not found in registry", mod.Display())
+                }
+
+                match, err := newestVersion(resp.Modules[0].Versions, constraint)
+                if err != nil {
+                        return rec, err
+                }
+
+                if match == nil {
+                        return rec, fmt.Errorf("no versions for %q found matching %q", mod.Display(), constraint)
+                }
+
+                rec.Version = match.Version
+
+                rec.url, err = s.registry.Location(mod, rec.Version)
+                if err != nil {
+                        return rec, err
+                }
+
+                // we've already validated this by now
+                host, _ := mod.SvcHost()
+                s.output(fmt.Sprintf("  Found version %s of %s on %s", rec.Version, mod.Module(), host.ForDisplay()))
+
+        }
+        return rec, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/module/testing.go b/vendor/github.com/hashicorp/terraform/config/module/testing.go
index fc9e733..6f1ff05 100644
--- a/vendor/github.com/hashicorp/terraform/config/module/testing.go
+++ b/vendor/github.com/hashicorp/terraform/config/module/testing.go
@@ -4,8 +4,6 @@ import (
         "io/ioutil"
         "os"
         "testing"
-
-        "github.com/hashicorp/go-getter"
 )
 
 // TestTree loads a module at the given path and returns the tree as well
@@ -26,8 +24,8 @@ func TestTree(t *testing.T, path string) (*Tree, func()) {
         }
 
         // Get the child modules
-        s := &getter.FolderStorage{StorageDir: dir}
-        if err := mod.Load(s, GetModeGet); err != nil {
+        s := &Storage{StorageDir: dir, Mode: GetModeGet}
+        if err := mod.Load(s); err != nil {
                 t.Fatalf("err: %s", err)
                 return nil, nil
         }
diff --git a/vendor/github.com/hashicorp/terraform/config/module/tree.go b/vendor/github.com/hashicorp/terraform/config/module/tree.go
index 4b0b153..f56d69b 100644
--- a/vendor/github.com/hashicorp/terraform/config/module/tree.go
+++ b/vendor/github.com/hashicorp/terraform/config/module/tree.go
@@ -4,11 +4,14 @@ import (
         "bufio"
         "bytes"
         "fmt"
+        "log"
         "path/filepath"
         "strings"
         "sync"
 
-        "github.com/hashicorp/go-getter"
+        "github.com/hashicorp/terraform/tfdiags"
+
+        getter "github.com/hashicorp/go-getter"
         "github.com/hashicorp/terraform/config"
 )
 
@@ -26,6 +29,17 @@ type Tree struct {
         children map[string]*Tree
         path     []string
         lock     sync.RWMutex
+
+        // version is the final version of the config loaded for the Tree's module
+        version string
+        // source is the "source" string used to load this module. It's possible
+        // for a module source to change, but the path remains the same, preventing
+        // it from being reloaded.
+        source string
+        // parent allows us to walk back up the tree and determine if there are any
+        // versioned ancestor modules which may effect the stored location of
+        // submodules
+        parent *Tree
 }
 
 // NewTree returns a new Tree for the given config structure.
@@ -40,7 +54,7 @@ func NewEmptyTree() *Tree {
         // We do this dummy load so that the tree is marked as "loaded". It
         // should never fail because this is just about a no-op. If it does fail
         // we panic so we can know its a bug.
-        if err := t.Load(nil, GetModeGet); err != nil {
+        if err := t.Load(&Storage{Mode: GetModeGet}); err != nil {
                 panic(err)
         }
 
@@ -126,8 +140,10 @@ func (t *Tree) Modules() []*Module {
         result := make([]*Module, len(t.config.Modules))
         for i, m := range t.config.Modules {
                 result[i] = &Module{
-                        Name:   m.Name,
-                        Source: m.Source,
+                        Name:      m.Name,
+                        Version:   m.Version,
+                        Source:    m.Source,
+                        Providers: m.Providers,
                 }
         }
 
@@ -155,81 +171,178 @@ func (t *Tree) Name() string {
 // module trees inherently require the configuration to be in a reasonably
 // sane state: no circular dependencies, proper module sources, etc. A full
 // suite of validations can be done by running Validate (after loading).
-func (t *Tree) Load(s getter.Storage, mode GetMode) error {
+func (t *Tree) Load(s *Storage) error {
         t.lock.Lock()
         defer t.lock.Unlock()
 
-        // Reset the children if we have any
-        t.children = nil
+        children, err := t.getChildren(s)
+        if err != nil {
+                return err
+        }
+
+        // Go through all the children and load them.
+        for _, c := range children {
+                if err := c.Load(s); err != nil {
+                        return err
+                }
+        }
+
+        // Set our tree up
+        t.children = children
 
-        modules := t.Modules()
+        return nil
+}
+
+func (t *Tree) getChildren(s *Storage) (map[string]*Tree, error) {
         children := make(map[string]*Tree)
 
         // Go through all the modules and get the directory for them.
-        for _, m := range modules {
+        for _, m := range t.Modules() {
                 if _, ok := children[m.Name]; ok {
-                        return fmt.Errorf(
+                        return nil, fmt.Errorf(
                                 "module %s: duplicated. module names must be unique", m.Name)
                 }
 
                 // Determine the path to this child
-                path := make([]string, len(t.path), len(t.path)+1)
-                copy(path, t.path)
-                path = append(path, m.Name)
+                modPath := make([]string, len(t.path), len(t.path)+1)
+                copy(modPath, t.path)
+                modPath = append(modPath, m.Name)
 
-                // Split out the subdir if we have one
-                source, subDir := getter.SourceDirSubdir(m.Source)
+                log.Printf("[TRACE] module source: %q", m.Source)
 
-                source, err := getter.Detect(source, t.config.Dir, getter.Detectors)
+                // add the module path to help indicate where modules with relative
+                // paths are being loaded from
+                s.output(fmt.Sprintf("- module.%s", strings.Join(modPath, ".")))
+
+                // Lookup the local location of the module.
+                // dir is the local directory where the module is stored
+                mod, err := s.findRegistryModule(m.Source, m.Version)
                 if err != nil {
-                        return fmt.Errorf("module %s: %s", m.Name, err)
+                        return nil, err
                 }
 
+                // The key is the string that will be used to uniquely id the Source in
+                // the local storage.  The prefix digit can be incremented to
+                // invalidate the local module storage.
+                key := "1." + t.versionedPathKey(m)
+                if mod.Version != "" {
+                        key += "." + mod.Version
+                }
+
+                // Check for the exact key if it's not a registry module
+                if !mod.registry {
+                        mod.Dir, err = s.findModule(key)
+                        if err != nil {
+                                return nil, err
+                        }
+                }
+
+                if mod.Dir != "" && s.Mode != GetModeUpdate {
+                        // We found it locally, but in order to load the Tree we need to
+                        // find out if there was another subDir stored from detection.
+                        subDir, err := s.getModuleRoot(mod.Dir)
+                        if err != nil {
+                                // If there's a problem with the subdir record, we'll let the
+                                // recordSubdir method fix it up.  Any other filesystem errors
+                                // will turn up again below.
+                                log.Println("[WARN] error reading subdir record:", err)
+                        }
+
+                        fullDir := filepath.Join(mod.Dir, subDir)
+
+                        child, err := NewTreeModule(m.Name, fullDir)
+                        if err != nil {
+                                return nil, fmt.Errorf("module %s: %s", m.Name, err)
+                        }
+                        child.path = modPath
+                        child.parent = t
+                        child.version = mod.Version
+                        child.source = m.Source
+                        children[m.Name] = child
+                        continue
+                }
+
+                // Split out the subdir if we have one.
+                // Terraform keeps the entire requested tree, so that modules can
+                // reference sibling modules from the same archive or repo.
+                rawSource, subDir := getter.SourceDirSubdir(m.Source)
+
+                // we haven't found a source, so fallback to the go-getter detectors
+                source := mod.url
+                if source == "" {
+                        source, err = getter.Detect(rawSource, t.config.Dir, getter.Detectors)
+                        if err != nil {
+                                return nil, fmt.Errorf("module %s: %s", m.Name, err)
+                        }
+                }
+
+                log.Printf("[TRACE] detected module source %q", source)
+
                 // Check if the detector introduced something new.
-                source, subDir2 := getter.SourceDirSubdir(source)
-                if subDir2 != "" {
-                        subDir = filepath.Join(subDir2, subDir)
+                // For example, the registry always adds a subdir of `//*`,
+                // indicating that we need to strip off the first component from the
+                // tar archive, though we may not yet know what it is called.
+                source, detectedSubDir := getter.SourceDirSubdir(source)
+                if detectedSubDir != "" {
+                        subDir = filepath.Join(detectedSubDir, subDir)
+                }
+
+                output := ""
+                switch s.Mode {
+                case GetModeUpdate:
+                        output = fmt.Sprintf("  Updating source %q", m.Source)
+                default:
+                        output = fmt.Sprintf("  Getting source %q", m.Source)
                 }
+                s.output(output)
 
-                // Get the directory where this module is so we can load it
-                key := strings.Join(path, ".")
-                key = fmt.Sprintf("root.%s-%s", key, m.Source)
-                dir, ok, err := getStorage(s, key, source, mode)
+                dir, ok, err := s.getStorage(key, source)
                 if err != nil {
-                        return err
+                        return nil, err
                 }
                 if !ok {
-                        return fmt.Errorf(
-                                "module %s: not found, may need to be downloaded using 'terraform get'", m.Name)
+                        return nil, fmt.Errorf("module %s: not found, may need to run 'terraform init'", m.Name)
                 }
 
-                // If we have a subdirectory, then merge that in
+                log.Printf("[TRACE] %q stored in %q", source, dir)
+
+                // expand and record the subDir for later
+                fullDir := dir
                 if subDir != "" {
-                        dir = filepath.Join(dir, subDir)
-                }
+                        fullDir, err = getter.SubdirGlob(dir, subDir)
+                        if err != nil {
+                                return nil, err
+                        }
 
-                // Load the configurations.Dir(source)
-                children[m.Name], err = NewTreeModule(m.Name, dir)
-                if err != nil {
-                        return fmt.Errorf(
-                                "module %s: %s", m.Name, err)
+                        // +1 to account for the pathsep
+                        if len(dir)+1 > len(fullDir) {
+                                return nil, fmt.Errorf("invalid module storage path %q", fullDir)
+                        }
+                        subDir = fullDir[len(dir)+1:]
                 }
 
-                // Set the path of this child
-                children[m.Name].path = path
-        }
+                // add new info to the module record
+                mod.Key = key
+                mod.Dir = dir
+                mod.Root = subDir
 
-        // Go through all the children and load them.
-        for _, c := range children {
-                if err := c.Load(s, mode); err != nil {
-                        return err
+                // record the module in our manifest
+                if err := s.recordModule(mod); err != nil {
+                        return nil, err
                 }
-        }
 
-        // Set our tree up
-        t.children = children
+                child, err := NewTreeModule(m.Name, fullDir)
+                if err != nil {
+                        return nil, fmt.Errorf("module %s: %s", m.Name, err)
+                }
+                child.path = modPath
+                child.parent = t
+                child.version = mod.Version
+                child.source = m.Source
+                children[m.Name] = child
+        }
 
-        return nil
+        return children, nil
 }
 
 // Path is the full path to this tree.
@@ -272,32 +385,35 @@ func (t *Tree) String() string {
 // as verifying things such as parameters/outputs between the various modules.
 //
 // Load must be called prior to calling Validate or an error will be returned.
-func (t *Tree) Validate() error {
+func (t *Tree) Validate() tfdiags.Diagnostics {
+        var diags tfdiags.Diagnostics
+
         if !t.Loaded() {
-                return fmt.Errorf("tree must be loaded before calling Validate")
+                diags = diags.Append(fmt.Errorf(
+                        "tree must be loaded before calling Validate",
+                ))
+                return diags
         }
 
-        // If something goes wrong, here is our error template
-        newErr := &treeError{Name: []string{t.Name()}}
-
         // Terraform core does not handle root module children named "root".
         // We plan to fix this in the future but this bug was brought up in
         // the middle of a release and we don't want to introduce wide-sweeping
         // changes at that time.
         if len(t.path) == 1 && t.name == "root" {
-                return fmt.Errorf("root module cannot contain module named 'root'")
+                diags = diags.Append(fmt.Errorf(
+                        "root module cannot contain module named 'root'",
+                ))
+                return diags
         }
 
         // Validate our configuration first.
-        if err := t.config.Validate(); err != nil {
-                newErr.Add(err)
-        }
+        diags = diags.Append(t.config.Validate())
 
         // If we're the root, we do extra validation. This validation usually
         // requires the entire tree (since children don't have parent pointers).
         if len(t.path) == 0 {
                 if err := t.validateProviderAlias(); err != nil {
-                        newErr.Add(err)
+                        diags = diags.Append(err)
                 }
         }
 
@@ -306,20 +422,11 @@ func (t *Tree) Validate() error {
 
         // Validate all our children
         for _, c := range children {
-                err := c.Validate()
-                if err == nil {
+                childDiags := c.Validate()
+                diags = diags.Append(childDiags)
+                if diags.HasErrors() {
                         continue
                 }
-
-                verr, ok := err.(*treeError)
-                if !ok {
-                        // Unknown error, just return...
-                        return err
-                }
-
-                // Append ourselves to the error and then return
-                verr.Name = append(verr.Name, t.Name())
-                newErr.AddChild(verr)
         }
 
         // Go over all the modules and verify that any parameters are valid
@@ -345,9 +452,10 @@ func (t *Tree) Validate() error {
                 // Compare to the keys in our raw config for the module
                 for k, _ := range m.RawConfig.Raw {
                         if _, ok := varMap[k]; !ok {
-                                newErr.Add(fmt.Errorf(
-                                        "module %s: %s is not a valid parameter",
-                                        m.Name, k))
+                                diags = diags.Append(fmt.Errorf(
+                                        "module %q: %q is not a valid argument",
+                                        m.Name, k,
+                                ))
                         }
 
                         // Remove the required
@@ -356,9 +464,10 @@ func (t *Tree) Validate() error {
 
                 // If we have any required left over, they aren't set.
                 for k, _ := range requiredMap {
-                        newErr.Add(fmt.Errorf(
-                                "module %s: required variable %q not set",
-                                m.Name, k))
+                        diags = diags.Append(fmt.Errorf(
+                                "module %q: missing required argument %q",
+                                m.Name, k,
+                        ))
                 }
         }
 
@@ -373,9 +482,10 @@ func (t *Tree) Validate() error {
 
                         tree, ok := children[mv.Name]
                         if !ok {
-                                newErr.Add(fmt.Errorf(
-                                        "%s: undefined module referenced %s",
-                                        source, mv.Name))
+                                diags = diags.Append(fmt.Errorf(
+                                        "%s: reference to undefined module %q",
+                                        source, mv.Name,
+                                ))
                                 continue
                         }
 
@@ -387,14 +497,56 @@ func (t *Tree) Validate() error {
                                 }
                         }
                         if !found {
-                                newErr.Add(fmt.Errorf(
-                                        "%s: %s is not a valid output for module %s",
-                                        source, mv.Field, mv.Name))
+                                diags = diags.Append(fmt.Errorf(
+                                        "%s: %q is not a valid output for module %q",
+                                        source, mv.Field, mv.Name,
+                                ))
                         }
                 }
         }
 
-        return newErr.ErrOrNil()
+        return diags
+}
+
+// versionedPathKey returns a path string with every levels full name, version
+// and source encoded. This is to provide a unique key for our module storage,
+// since submodules need to know which versions of their ancestor modules they
+// are loaded from.
+// For example, if module A has a subdirectory B, if module A's source or
+// version is updated B's storage key must reflect this change in order for the
+// correct version of B's source to be loaded.
+func (t *Tree) versionedPathKey(m *Module) string {
+        path := make([]string, len(t.path)+1)
+        path[len(path)-1] = m.Name + ";" + m.Source
+        // We're going to load these in order for easier reading and debugging, but
+        // in practice they only need to be unique and consistent.
+
+        p := t
+        i := len(path) - 2
+        for ; i >= 0; i-- {
+                if p == nil {
+                        break
+                }
+                // we may have been loaded under a blank Tree, so always check for a name
+                // too.
+                if p.name == "" {
+                        break
+                }
+                seg := p.name
+                if p.version != "" {
+                        seg += "#" + p.version
+                }
+
+                if p.source != "" {
+                        seg += ";" + p.source
+                }
+
+                path[i] = seg
+                p = p.parent
+        }
+
+        key := strings.Join(path, "|")
+        return key
 }
 
 // treeError is an error use by Tree.Validate to accumulates all
diff --git a/vendor/github.com/hashicorp/terraform/config/module/validate_provider_alias.go b/vendor/github.com/hashicorp/terraform/config/module/validate_provider_alias.go
index 090d4f7..f203556 100644
--- a/vendor/github.com/hashicorp/terraform/config/module/validate_provider_alias.go
+++ b/vendor/github.com/hashicorp/terraform/config/module/validate_provider_alias.go
@@ -67,7 +67,7 @@ func (t *Tree) validateProviderAlias() error {
 
                         // We didn't find the alias, error!
                         err = multierror.Append(err, fmt.Errorf(
-                                "module %s: provider alias must be defined by the module or a parent: %s",
+                                "module %s: provider alias must be defined by the module: %s",
                                 strings.Join(pv.Path, "."), k))
                 }
         }
diff --git a/vendor/github.com/hashicorp/terraform/config/module/versions.go b/vendor/github.com/hashicorp/terraform/config/module/versions.go
new file mode 100644
index 0000000..8348d4b
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/config/module/versions.go
@@ -0,0 +1,95 @@
+package module
+
+import (
+        "errors"
+        "fmt"
+        "sort"
+
+        version "github.com/hashicorp/go-version"
+        "github.com/hashicorp/terraform/registry/response"
+)
+
+const anyVersion = ">=0.0.0"
+
+// return the newest version that satisfies the provided constraint
+func newest(versions []string, constraint string) (string, error) {
+        if constraint == "" {
+                constraint = anyVersion
+        }
+        cs, err := version.NewConstraint(constraint)
+        if err != nil {
+                return "", err
+        }
+
+        switch len(versions) {
+        case 0:
+                return "", errors.New("no versions found")
+        case 1:
+                v, err := version.NewVersion(versions[0])
+                if err != nil {
+                        return "", err
+                }
+
+                if !cs.Check(v) {
+                        return "", fmt.Errorf("no version found matching constraint %q", constraint)
+                }
+                return versions[0], nil
+        }
+
+        sort.Slice(versions, func(i, j int) bool {
+                // versions should have already been validated
+                // sort invalid version strings to the end
+                iv, err := version.NewVersion(versions[i])
+                if err != nil {
+                        return true
+                }
+                jv, err := version.NewVersion(versions[j])
+                if err != nil {
+                        return true
+                }
+                return iv.GreaterThan(jv)
+        })
+
+        // versions are now in order, so just find the first which satisfies the
+        // constraint
+        for i := range versions {
+                v, err := version.NewVersion(versions[i])
+                if err != nil {
+                        continue
+                }
+                if cs.Check(v) {
+                        return versions[i], nil
+                }
+        }
+
+        return "", nil
+}
+
+// return the newest *moduleVersion that matches the given constraint
+// TODO: reconcile these two types and newest* functions
+func newestVersion(moduleVersions []*response.ModuleVersion, constraint string) (*response.ModuleVersion, error) {
+        var versions []string
+        modules := make(map[string]*response.ModuleVersion)
+
+        for _, m := range moduleVersions {
+                versions = append(versions, m.Version)
+                modules[m.Version] = m
+        }
+
+        match, err := newest(versions, constraint)
+        return modules[match], err
+}
+
+// return the newest moduleRecord that matches the given constraint
+func newestRecord(moduleVersions []moduleRecord, constraint string) (moduleRecord, error) {
+        var versions []string
+        modules := make(map[string]moduleRecord)
+
+        for _, m := range moduleVersions {
+                versions = append(versions, m.Version)
+                modules[m.Version] = m
+        }
+
+        match, err := newest(versions, constraint)
+        return modules[match], err
+}
diff --git a/vendor/github.com/hashicorp/terraform/config/raw_config.go b/vendor/github.com/hashicorp/terraform/config/raw_config.go
index f8498d8..1854a8b 100644
--- a/vendor/github.com/hashicorp/terraform/config/raw_config.go
+++ b/vendor/github.com/hashicorp/terraform/config/raw_config.go
@@ -3,8 +3,14 @@ package config
 import (
         "bytes"
         "encoding/gob"
+        "errors"
+        "strconv"
         "sync"
 
+        "github.com/zclconf/go-cty/cty"
+        "github.com/zclconf/go-cty/cty/convert"
+
+        hcl2 "github.com/hashicorp/hcl2/hcl"
         "github.com/hashicorp/hil"
         "github.com/hashicorp/hil/ast"
         "github.com/mitchellh/copystructure"
@@ -27,8 +33,24 @@ const UnknownVariableValue = "74D93920-ED26-11E3-AC10-0800200C9A66"
 // RawConfig supports a query-like interface to request
 // information from deep within the structure.
 type RawConfig struct {
-        Key            string
-        Raw            map[string]interface{}
+        Key string
+
+        // Only _one_ of Raw and Body may be populated at a time.
+        //
+        // In the normal case, Raw is populated and Body is nil.
+        //
+        // When the experimental HCL2 parsing mode is enabled, "Body"
+        // is populated and RawConfig serves only to transport the hcl2.Body
+        // through the rest of Terraform core so we can ultimately decode it
+        // once its schema is known.
+        //
+        // Once we transition to HCL2 as the primary representation, RawConfig
+        // should be removed altogether and the hcl2.Body should be passed
+        // around directly.
+
+        Raw  map[string]interface{}
+        Body hcl2.Body
+
         Interpolations []ast.Node
         Variables      map[string]InterpolatedVariable
 
@@ -48,6 +70,26 @@ func NewRawConfig(raw map[string]interface{}) (*RawConfig, error) {
         return result, nil
 }
 
+// NewRawConfigHCL2 creates a new RawConfig that is serving as a capsule
+// to transport a hcl2.Body. In this mode, the publicly-readable struct
+// fields are not populated since all operations should instead be diverted
+// to the HCL2 body.
+//
+// For a RawConfig object constructed with this function, the only valid use
+// is to later retrieve the Body value and call its own methods. Callers
+// may choose to set and then later handle the Key field, in a manner
+// consistent with how it is handled by the Value method, but the Value
+// method itself must not be used.
+//
+// This is an experimental codepath to be used only by the HCL2 config loader.
+// Non-experimental parsing should _always_ use NewRawConfig to produce a
+// fully-functional RawConfig object.
+func NewRawConfigHCL2(body hcl2.Body) *RawConfig {
+        return &RawConfig{
+                Body: body,
+        }
+}
+
 // RawMap returns a copy of the RawConfig.Raw map.
 func (r *RawConfig) RawMap() map[string]interface{} {
         r.lock.Lock()
@@ -69,6 +111,10 @@ func (r *RawConfig) Copy() *RawConfig {
         r.lock.Lock()
         defer r.lock.Unlock()
 
+        if r.Body != nil {
+                return NewRawConfigHCL2(r.Body)
+        }
+
         newRaw := make(map[string]interface{})
         for k, v := range r.Raw {
                 newRaw[k] = v
@@ -223,6 +269,13 @@ func (r *RawConfig) init() error {
 }
 
 func (r *RawConfig) interpolate(fn interpolationWalkerFunc) error {
+        if r.Body != nil {
+                // For RawConfigs created for the HCL2 experiement, callers must
+                // use the HCL2 Body API directly rather than interpolating via
+                // the RawConfig.
+                return errors.New("this feature is not yet supported under the HCL2 experiment")
+        }
+
         config, err := copystructure.Copy(r.Raw)
         if err != nil {
                 return err
@@ -268,6 +321,74 @@ func (r *RawConfig) merge(r2 *RawConfig) *RawConfig {
         return result
 }
 
+// couldBeInteger is a helper that determines if the represented value could
+// result in an integer.
+//
+// This function only works for RawConfigs that have "Key" set, meaning that
+// a single result can be produced. Calling this function will overwrite
+// the Config and Value results to be a test value.
+//
+// This function is conservative. If there is some doubt about whether the
+// result could be an integer -- for example, if it depends on a variable
+// whose type we don't know yet -- it will still return true.
+func (r *RawConfig) couldBeInteger() bool {
+        if r.Key == "" {
+                // un-keyed RawConfigs can never produce numbers
+                return false
+        }
+        if r.Body == nil {
+                // Normal path: using the interpolator in this package
+                // Interpolate with a fixed number to verify that its a number.
+                r.interpolate(func(root ast.Node) (interface{}, error) {
+                        // Execute the node but transform the AST so that it returns
+                        // a fixed value of "5" for all interpolations.
+                        result, err := hil.Eval(
+                                hil.FixedValueTransform(
+                                        root, &ast.LiteralNode{Value: "5", Typex: ast.TypeString}),
+                                nil)
+                        if err != nil {
+                                return "", err
+                        }
+
+                        return result.Value, nil
+                })
+                _, err := strconv.ParseInt(r.Value().(string), 0, 0)
+                return err == nil
+        } else {
+                // HCL2 experiment path: using the HCL2 API via shims
+                //
+                // This path catches fewer situations because we have to assume all
+                // variables are entirely unknown in HCL2, rather than the assumption
+                // above that all variables can be numbers because names like "var.foo"
+                // are considered a single variable rather than an attribute access.
+                // This is fine in practice, because we get a definitive answer
+                // during the graph walk when we have real values to work with.
+                attrs, diags := r.Body.JustAttributes()
+                if diags.HasErrors() {
+                        // This body is not just a single attribute with a value, so
+                        // this can't be a number.
+                        return false
+                }
+                attr, hasAttr := attrs[r.Key]
+                if !hasAttr {
+                        return false
+                }
+                result, diags := hcl2EvalWithUnknownVars(attr.Expr)
+                if diags.HasErrors() {
+                        // We'll conservatively assume that this error is a result of
+                        // us not being ready to fully-populate the scope, and catch
+                        // any further problems during the main graph walk.
+                        return true
+                }
+
+                // If the result is convertable to number then we'll allow it.
+                // We do this because an unknown string is optimistically convertable
+                // to number (might be "5") but a _known_ string "hello" is not.
+                _, err := convert.Convert(result, cty.Number)
+                return err == nil
+        }
+}
+
 // UnknownKeys returns the keys of the configuration that are unknown
 // because they had interpolated variables that must be computed.
 func (r *RawConfig) UnknownKeys() []string {
diff --git a/vendor/github.com/hashicorp/terraform/config/resource_mode_string.go b/vendor/github.com/hashicorp/terraform/config/resource_mode_string.go
index ea68b4f..8a55e06 100644
--- a/vendor/github.com/hashicorp/terraform/config/resource_mode_string.go
+++ b/vendor/github.com/hashicorp/terraform/config/resource_mode_string.go
@@ -2,7 +2,7 @@
 
 package config
 
-import "fmt"
+import "strconv"
 
 const _ResourceMode_name = "ManagedResourceModeDataResourceMode"
 
@@ -10,7 +10,7 @@ var _ResourceMode_index = [...]uint8{0, 19, 35}
 
 func (i ResourceMode) String() string {
         if i < 0 || i >= ResourceMode(len(_ResourceMode_index)-1) {
-                return fmt.Sprintf("ResourceMode(%d)", i)
+                return "ResourceMode(" + strconv.FormatInt(int64(i), 10) + ")"
         }
         return _ResourceMode_name[_ResourceMode_index[i]:_ResourceMode_index[i+1]]
 }
diff --git a/vendor/github.com/hashicorp/terraform/config/testing.go b/vendor/github.com/hashicorp/terraform/config/testing.go
index f7bfadd..831fc77 100644
--- a/vendor/github.com/hashicorp/terraform/config/testing.go
+++ b/vendor/github.com/hashicorp/terraform/config/testing.go
@@ -6,6 +6,8 @@ import (
 
 // TestRawConfig is used to create a RawConfig for testing.
 func TestRawConfig(t *testing.T, c map[string]interface{}) *RawConfig {
+        t.Helper()
+
         cfg, err := NewRawConfig(c)
         if err != nil {
                 t.Fatalf("err: %s", err)
diff --git a/vendor/github.com/hashicorp/terraform/dag/dag.go b/vendor/github.com/hashicorp/terraform/dag/dag.go
index f8776bc..b7eb10c 100644
--- a/vendor/github.com/hashicorp/terraform/dag/dag.go
+++ b/vendor/github.com/hashicorp/terraform/dag/dag.go
@@ -106,7 +106,7 @@ func (g *AcyclicGraph) TransitiveReduction() {
                 uTargets := g.DownEdges(u)
                 vs := AsVertexList(g.DownEdges(u))
 
-                g.DepthFirstWalk(vs, func(v Vertex, d int) error {
+                g.depthFirstWalk(vs, false, func(v Vertex, d int) error {
                         shared := uTargets.Intersection(g.DownEdges(v))
                         for _, vPrime := range AsVertexList(shared) {
                                 g.RemoveEdge(BasicEdge(u, vPrime))
@@ -187,9 +187,18 @@ type vertexAtDepth struct {
 }
 
 // depthFirstWalk does a depth-first walk of the graph starting from
-// the vertices in start. This is not exported now but it would make sense
-// to export this publicly at some point.
+// the vertices in start.
 func (g *AcyclicGraph) DepthFirstWalk(start []Vertex, f DepthWalkFunc) error {
+        return g.depthFirstWalk(start, true, f)
+}
+
+// This internal method provides the option of not sorting the vertices during
+// the walk, which we use for the Transitive reduction.
+// Some configurations can lead to fully-connected subgraphs, which makes our
+// transitive reduction algorithm O(n^3). This is still passable for the size
+// of our graphs, but the additional n^2 sort operations would make this
+// uncomputable in a reasonable amount of time.
+func (g *AcyclicGraph) depthFirstWalk(start []Vertex, sorted bool, f DepthWalkFunc) error {
         defer g.debug.BeginOperation(typeDepthFirstWalk, "").End("")
 
         seen := make(map[Vertex]struct{})
@@ -219,7 +228,11 @@ func (g *AcyclicGraph) DepthFirstWalk(start []Vertex, f DepthWalkFunc) error {
 
                 // Visit targets of this in a consistent order.
                 targets := AsVertexList(g.DownEdges(current.Vertex))
-                sort.Sort(byVertexName(targets))
+
+                if sorted {
+                        sort.Sort(byVertexName(targets))
+                }
+
                 for _, t := range targets {
                         frontier = append(frontier, &vertexAtDepth{
                                 Vertex: t,
diff --git a/vendor/github.com/hashicorp/terraform/dag/marshal.go b/vendor/github.com/hashicorp/terraform/dag/marshal.go
index 16d5dd6..c567d27 100644
--- a/vendor/github.com/hashicorp/terraform/dag/marshal.go
+++ b/vendor/github.com/hashicorp/terraform/dag/marshal.go
@@ -273,6 +273,9 @@ func (e *encoder) Encode(i interface{}) {
 }
 
 func (e *encoder) Add(v Vertex) {
+        if e == nil {
+                return
+        }
         e.Encode(marshalTransform{
                 Type:      typeTransform,
                 AddVertex: newMarshalVertex(v),
@@ -281,6 +284,9 @@ func (e *encoder) Add(v Vertex) {
 
 // Remove records the removal of Vertex v.
 func (e *encoder) Remove(v Vertex) {
+        if e == nil {
+                return
+        }
         e.Encode(marshalTransform{
                 Type:         typeTransform,
                 RemoveVertex: newMarshalVertex(v),
@@ -288,6 +294,9 @@ func (e *encoder) Remove(v Vertex) {
 }
 
 func (e *encoder) Connect(edge Edge) {
+        if e == nil {
+                return
+        }
         e.Encode(marshalTransform{
                 Type:    typeTransform,
                 AddEdge: newMarshalEdge(edge),
@@ -295,6 +304,9 @@ func (e *encoder) Connect(edge Edge) {
 }
 
 func (e *encoder) RemoveEdge(edge Edge) {
+        if e == nil {
+                return
+        }
         e.Encode(marshalTransform{
                 Type:       typeTransform,
                 RemoveEdge: newMarshalEdge(edge),
diff --git a/vendor/github.com/hashicorp/terraform/dag/walk.go b/vendor/github.com/hashicorp/terraform/dag/walk.go
index 23c87ad..f03b100 100644
--- a/vendor/github.com/hashicorp/terraform/dag/walk.go
+++ b/vendor/github.com/hashicorp/terraform/dag/walk.go
@@ -166,7 +166,7 @@ func (w *Walker) Update(g *AcyclicGraph) {
                 w.wait.Add(1)
 
                 // Add to our own set so we know about it already
-                log.Printf("[DEBUG] dag/walk: added new vertex: %q", VertexName(v))
+                log.Printf("[TRACE] dag/walk: added new vertex: %q", VertexName(v))
                 w.vertices.Add(raw)
 
                 // Initialize the vertex info
@@ -198,7 +198,7 @@ func (w *Walker) Update(g *AcyclicGraph) {
                 // Delete it out of the map
                 delete(w.vertexMap, v)
 
-                log.Printf("[DEBUG] dag/walk: removed vertex: %q", VertexName(v))
+                log.Printf("[TRACE] dag/walk: removed vertex: %q", VertexName(v))
                 w.vertices.Delete(raw)
         }
 
@@ -229,7 +229,7 @@ func (w *Walker) Update(g *AcyclicGraph) {
                 changedDeps.Add(waiter)
 
                 log.Printf(
-                        "[DEBUG] dag/walk: added edge: %q waiting on %q",
+                        "[TRACE] dag/walk: added edge: %q waiting on %q",
                         VertexName(waiter), VertexName(dep))
                 w.edges.Add(raw)
         }
@@ -253,7 +253,7 @@ func (w *Walker) Update(g *AcyclicGraph) {
                 changedDeps.Add(waiter)
 
                 log.Printf(
-                        "[DEBUG] dag/walk: removed edge: %q waiting on %q",
+                        "[TRACE] dag/walk: removed edge: %q waiting on %q",
                         VertexName(waiter), VertexName(dep))
                 w.edges.Delete(raw)
         }
@@ -296,7 +296,7 @@ func (w *Walker) Update(g *AcyclicGraph) {
                 info.depsCancelCh = cancelCh
 
                 log.Printf(
-                        "[DEBUG] dag/walk: dependencies changed for %q, sending new deps",
+                        "[TRACE] dag/walk: dependencies changed for %q, sending new deps",
                         VertexName(v))
 
                 // Start the waiter
@@ -383,10 +383,10 @@ func (w *Walker) walkVertex(v Vertex, info *walkerVertex) {
         // Run our callback or note that our upstream failed
         var err error
         if depsSuccess {
-                log.Printf("[DEBUG] dag/walk: walking %q", VertexName(v))
+                log.Printf("[TRACE] dag/walk: walking %q", VertexName(v))
                 err = w.Callback(v)
         } else {
-                log.Printf("[DEBUG] dag/walk: upstream errored, not walking %q", VertexName(v))
+                log.Printf("[TRACE] dag/walk: upstream errored, not walking %q", VertexName(v))
                 err = errWalkUpstream
         }
 
@@ -423,7 +423,7 @@ func (w *Walker) waitDeps(
                                 return
 
                         case <-time.After(time.Second * 5):
-                                log.Printf("[DEBUG] dag/walk: vertex %q, waiting for: %q",
+                                log.Printf("[TRACE] dag/walk: vertex %q, waiting for: %q",
                                         VertexName(v), VertexName(dep))
                         }
                 }
diff --git a/vendor/github.com/hashicorp/terraform/helper/experiment/experiment.go b/vendor/github.com/hashicorp/terraform/helper/experiment/experiment.go
deleted file mode 100644
index 18b8837..0000000
--- a/vendor/github.com/hashicorp/terraform/helper/experiment/experiment.go
+++ /dev/null
@@ -1,154 +0,0 @@
-// experiment package contains helper functions for tracking experimental
-// features throughout Terraform.
-//
-// This package should be used for creating, enabling, querying, and deleting
-// experimental features. By unifying all of that onto a single interface,
-// we can have the Go compiler help us by enforcing every place we touch
-// an experimental feature.
-//
-// To create a new experiment:
-//
-//   1. Add the experiment to the global vars list below, prefixed with X_
-//
-//   2. Add the experiment variable to the All listin the init() function
-//
-//   3. Use it!
-//
-// To remove an experiment:
-//
-//   1. Delete the experiment global var.
-//
-//   2. Try to compile and fix all the places where the var was referenced.
-//
-// To use an experiment:
-//
-//   1. Use Flag() if you want the experiment to be available from the CLI.
-//
-//   2. Use Enabled() to check whether it is enabled.
-//
-// As a general user:
-//
-//   1. The `-Xexperiment-name` flag
-//   2. The `TF_X_<experiment-name>` env var.
-//   3. The `TF_X_FORCE` env var can be set to force an experimental feature
-//      without human verifications.
-//
-package experiment
-
-import (
-        "flag"
-        "fmt"
-        "os"
-        "strconv"
-        "strings"
-        "sync"
-)
-
-// The experiments that are available are listed below. Any package in
-// Terraform defining an experiment should define the experiments below.
-// By keeping them all within the experiment package we force a single point
-// of definition and use. This allows the compiler to enforce references
-// so it becomes easy to remove the features.
-var (
-        // Shadow graph. This is already on by default. Disabling it will be
-        // allowed for awhile in order for it to not block operations.
-        X_shadow = newBasicID("shadow", "SHADOW", false)
-)
-
-// Global variables this package uses because we are a package
-// with global state.
-var (
-        // all is the list of all experiements. Do not modify this.
-        All []ID
-
-        // enabled keeps track of what flags have been enabled
-        enabled     map[string]bool
-        enabledLock sync.Mutex
-
-        // Hidden "experiment" that forces all others to be on without verification
-        x_force = newBasicID("force", "FORCE", false)
-)
-
-func init() {
-        // The list of all experiments, update this when an experiment is added.
-        All = []ID{
-                X_shadow,
-                x_force,
-        }
-
-        // Load
-        reload()
-}
-
-// reload is used by tests to reload the global state. This is called by
-// init publicly.
-func reload() {
-        // Initialize
-        enabledLock.Lock()
-        enabled = make(map[string]bool)
-        enabledLock.Unlock()
-
-        // Set defaults and check env vars
-        for _, id := range All {
-                // Get the default value
-                def := id.Default()
-
-                // If we set it in the env var, default it to true
-                key := fmt.Sprintf("TF_X_%s", strings.ToUpper(id.Env()))
-                if v := os.Getenv(key); v != "" {
-                        def = v != "0"
-                }
-
-                // Set the default
-                SetEnabled(id, def)
-        }
-}
-
-// Enabled returns whether an experiment has been enabled or not.
-func Enabled(id ID) bool {
-        enabledLock.Lock()
-        defer enabledLock.Unlock()
-        return enabled[id.Flag()]
-}
-
-// SetEnabled sets an experiment to enabled/disabled. Please check with
-// the experiment docs for when calling this actually affects the experiment.
-func SetEnabled(id ID, v bool) {
-        enabledLock.Lock()
-        defer enabledLock.Unlock()
-        enabled[id.Flag()] = v
-}
-
-// Force returns true if the -Xforce of TF_X_FORCE flag is present, which
-// advises users of this package to not verify with the user that they want
-// experimental behavior and to just continue with it.
-func Force() bool {
-        return Enabled(x_force)
-}
-
-// Flag configures the given FlagSet with the flags to configure
-// all active experiments.
-func Flag(fs *flag.FlagSet) {
-        for _, id := range All {
-                desc := id.Flag()
-                key := fmt.Sprintf("X%s", id.Flag())
-                fs.Var(&idValue{X: id}, key, desc)
-        }
-}
-
-// idValue implements flag.Value for setting the enabled/disabled state
-// of an experiment from the CLI.
-type idValue struct {
-        X ID
-}
-
-func (v *idValue) IsBoolFlag() bool { return true }
-func (v *idValue) String() string   { return strconv.FormatBool(Enabled(v.X)) }
-func (v *idValue) Set(raw string) error {
-        b, err := strconv.ParseBool(raw)
-        if err == nil {
-                SetEnabled(v.X, b)
-        }
-
-        return err
-}
diff --git a/vendor/github.com/hashicorp/terraform/helper/experiment/id.go b/vendor/github.com/hashicorp/terraform/helper/experiment/id.go
deleted file mode 100644
index 8e2f707..0000000
--- a/vendor/github.com/hashicorp/terraform/helper/experiment/id.go
+++ /dev/null
@@ -1,34 +0,0 @@
-package experiment
-
-// ID represents an experimental feature.
-//
-// The global vars defined on this package should be used as ID values.
-// This interface is purposely not implement-able outside of this package
-// so that we can rely on the Go compiler to enforce all experiment references.
-type ID interface {
-        Env() string
-        Flag() string
-        Default() bool
-
-        unexported() // So the ID can't be implemented externally.
-}
-
-// basicID implements ID.
-type basicID struct {
-        EnvValue     string
-        FlagValue    string
-        DefaultValue bool
-}
-
-func newBasicID(flag, env string, def bool) ID {
-        return &basicID{
-                EnvValue:     env,
-                FlagValue:    flag,
-                DefaultValue: def,
-        }
-}
-
-func (id *basicID) Env() string   { return id.EnvValue }
-func (id *basicID) Flag() string  { return id.FlagValue }
-func (id *basicID) Default() bool { return id.DefaultValue }
-func (id *basicID) unexported()   {}
diff --git a/vendor/github.com/hashicorp/terraform/helper/hashcode/hashcode.go b/vendor/github.com/hashicorp/terraform/helper/hashcode/hashcode.go
index 64d8263..6ccc523 100644
--- a/vendor/github.com/hashicorp/terraform/helper/hashcode/hashcode.go
+++ b/vendor/github.com/hashicorp/terraform/helper/hashcode/hashcode.go
@@ -1,6 +1,8 @@
 package hashcode
 
 import (
+        "bytes"
+        "fmt"
         "hash/crc32"
 )
 
@@ -20,3 +22,14 @@ func String(s string) int {
         // v == MinInt
         return 0
 }
+
+// Strings hashes a list of strings to a unique hashcode.
+func Strings(strings []string) string {
+        var buf bytes.Buffer
+
+        for _, s := range strings {
+                buf.WriteString(fmt.Sprintf("%s-", s))
+        }
+
+        return fmt.Sprintf("%d", String(buf.String()))
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/logging/logging.go b/vendor/github.com/hashicorp/terraform/helper/logging/logging.go
index 433cd77..6bd92f7 100644
--- a/vendor/github.com/hashicorp/terraform/helper/logging/logging.go
+++ b/vendor/github.com/hashicorp/terraform/helper/logging/logging.go
@@ -18,7 +18,7 @@ const (
         EnvLogFile = "TF_LOG_PATH" // Set to a file
 )
 
-var validLevels = []logutils.LogLevel{"TRACE", "DEBUG", "INFO", "WARN", "ERROR"}
+var ValidLevels = []logutils.LogLevel{"TRACE", "DEBUG", "INFO", "WARN", "ERROR"}
 
 // LogOutput determines where we should send logs (if anywhere) and the log level.
 func LogOutput() (logOutput io.Writer, err error) {
@@ -40,7 +40,7 @@ func LogOutput() (logOutput io.Writer, err error) {
 
         // This was the default since the beginning
         logOutput = &logutils.LevelFilter{
-                Levels:   validLevels,
+                Levels:   ValidLevels,
                 MinLevel: logutils.LogLevel(logLevel),
                 Writer:   logOutput,
         }
@@ -77,7 +77,7 @@ func LogLevel() string {
                 logLevel = strings.ToUpper(envLevel)
         } else {
                 log.Printf("[WARN] Invalid log level: %q. Defaulting to level: TRACE. Valid levels are: %+v",
-                        envLevel, validLevels)
+                        envLevel, ValidLevels)
         }
 
         return logLevel
@@ -90,7 +90,7 @@ func IsDebugOrHigher() bool {
 }
 
 func isValidLogLevel(level string) bool {
-        for _, l := range validLevels {
+        for _, l := range ValidLevels {
                 if strings.ToUpper(level) == string(l) {
                         return true
                 }
diff --git a/vendor/github.com/hashicorp/terraform/helper/logging/transport.go b/vendor/github.com/hashicorp/terraform/helper/logging/transport.go
index 4477924..bddabe6 100644
--- a/vendor/github.com/hashicorp/terraform/helper/logging/transport.go
+++ b/vendor/github.com/hashicorp/terraform/helper/logging/transport.go
@@ -1,9 +1,12 @@
 package logging
 
 import (
+        "bytes"
+        "encoding/json"
         "log"
         "net/http"
         "net/http/httputil"
+        "strings"
 )
 
 type transport struct {
@@ -15,7 +18,7 @@ func (t *transport) RoundTrip(req *http.Request) (*http.Response, error) {
         if IsDebugOrHigher() {
                 reqData, err := httputil.DumpRequestOut(req, true)
                 if err == nil {
-                        log.Printf("[DEBUG] "+logReqMsg, t.name, string(reqData))
+                        log.Printf("[DEBUG] "+logReqMsg, t.name, prettyPrintJsonLines(reqData))
                 } else {
                         log.Printf("[ERROR] %s API Request error: %#v", t.name, err)
                 }
@@ -29,7 +32,7 @@ func (t *transport) RoundTrip(req *http.Request) (*http.Response, error) {
         if IsDebugOrHigher() {
                 respData, err := httputil.DumpResponse(resp, true)
                 if err == nil {
-                        log.Printf("[DEBUG] "+logRespMsg, t.name, string(respData))
+                        log.Printf("[DEBUG] "+logRespMsg, t.name, prettyPrintJsonLines(respData))
                 } else {
                         log.Printf("[ERROR] %s API Response error: %#v", t.name, err)
                 }
@@ -42,6 +45,20 @@ func NewTransport(name string, t http.RoundTripper) *transport {
         return &transport{name, t}
 }
 
+// prettyPrintJsonLines iterates through a []byte line-by-line,
+// transforming any lines that are complete json into pretty-printed json.
+func prettyPrintJsonLines(b []byte) string {
+        parts := strings.Split(string(b), "\n")
+        for i, p := range parts {
+                if b := []byte(p); json.Valid(b) {
+                        var out bytes.Buffer
+                        json.Indent(&out, b, "", " ")
+                        parts[i] = out.String()
+                }
+        }
+        return strings.Join(parts, "\n")
+}
+
 const logReqMsg = `%s API Request Details:
 ---[ REQUEST ]---------------------------------------
 %s
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/id.go b/vendor/github.com/hashicorp/terraform/helper/resource/id.go
index 1cde67c..4494955 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/id.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/id.go
@@ -18,6 +18,11 @@ func UniqueId() string {
         return PrefixedUniqueId(UniqueIdPrefix)
 }
 
+// UniqueIDSuffixLength is the string length of the suffix generated by
+// PrefixedUniqueId. This can be used by length validation functions to
+// ensure prefixes are the correct length for the target field.
+const UniqueIDSuffixLength = 26
+
 // Helper for a resource to generate a unique identifier w/ given prefix
 //
 // After the prefix, the ID consists of an incrementing 26 digit value (to match
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/state.go b/vendor/github.com/hashicorp/terraform/helper/resource/state.go
index 37c586a..c34e21b 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/state.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/state.go
@@ -46,7 +46,7 @@ type StateChangeConf struct {
 // If the Timeout is exceeded before reaching the Target state, return an
 // error.
 //
-// Otherwise, result the result of the first call to the Refresh function to
+// Otherwise, the result is the result of the first call to the Refresh function to
 // reach the target state.
 func (conf *StateChangeConf) WaitForState() (interface{}, error) {
         log.Printf("[DEBUG] Waiting for state to become: %s", conf.Target)
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/testing.go b/vendor/github.com/hashicorp/terraform/helper/resource/testing.go
index d7de1a0..b97673f 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/testing.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/testing.go
@@ -11,11 +11,13 @@ import (
         "reflect"
         "regexp"
         "strings"
+        "syscall"
         "testing"
 
         "github.com/davecgh/go-spew/spew"
-        "github.com/hashicorp/go-getter"
+        "github.com/hashicorp/errwrap"
         "github.com/hashicorp/go-multierror"
+        "github.com/hashicorp/logutils"
         "github.com/hashicorp/terraform/config/module"
         "github.com/hashicorp/terraform/helper/logging"
         "github.com/hashicorp/terraform/terraform"
@@ -186,6 +188,10 @@ type TestCheckFunc func(*terraform.State) error
 // ImportStateCheckFunc is the check function for ImportState tests
 type ImportStateCheckFunc func([]*terraform.InstanceState) error
 
+// ImportStateIdFunc is an ID generation function to help with complex ID
+// generation for ImportState tests.
+type ImportStateIdFunc func(*terraform.State) (string, error)
+
 // TestCase is a single acceptance test case used to test the apply/destroy
 // lifecycle of a resource in a specific configuration.
 //
@@ -260,6 +266,15 @@ type TestStep struct {
         // below.
         PreConfig func()
 
+        // Taint is a list of resource addresses to taint prior to the execution of
+        // the step. Be sure to only include this at a step where the referenced
+        // address will be present in state, as it will fail the test if the resource
+        // is missing.
+        //
+        // This option is ignored on ImportState tests, and currently only works for
+        // resources in the root module path.
+        Taint []string
+
         //---------------------------------------------------------------
         // Test modes. One of the following groups of settings must be
         // set to determine what the test step will do. Ideally we would've
@@ -304,10 +319,19 @@ type TestStep struct {
         // no-op plans
         PlanOnly bool
 
+        // PreventDiskCleanup can be set to true for testing terraform modules which
+        // require access to disk at runtime. Note that this will leave files in the
+        // temp folder
+        PreventDiskCleanup bool
+
         // PreventPostDestroyRefresh can be set to true for cases where data sources
         // are tested alongside real resources
         PreventPostDestroyRefresh bool
 
+        // SkipFunc is called before applying config, but after PreConfig
+        // This is useful for defining test steps with platform-dependent checks
+        SkipFunc func() (bool, error)
+
         //---------------------------------------------------------------
         // ImportState testing
         //---------------------------------------------------------------
@@ -329,6 +353,12 @@ type TestStep struct {
         // the unset ImportStateId field.
         ImportStateIdPrefix string
 
+        // ImportStateIdFunc is a function that can be used to dynamically generate
+        // the ID for the ImportState tests. It is sent the state, which can be
+        // checked to derive the attributes necessary and generate the string in the
+        // desired format.
+        ImportStateIdFunc ImportStateIdFunc
+
         // ImportStateCheck checks the results of ImportState. It should be
         // used to verify that the resulting value of ImportState has the
         // proper resources, IDs, and attributes.
@@ -345,6 +375,60 @@ type TestStep struct {
         ImportStateVerifyIgnore []string
 }
 
+// Set to a file mask in sprintf format where %s is test name
+const EnvLogPathMask = "TF_LOG_PATH_MASK"
+
+func LogOutput(t TestT) (logOutput io.Writer, err error) {
+        logOutput = ioutil.Discard
+
+        logLevel := logging.LogLevel()
+        if logLevel == "" {
+                return
+        }
+
+        logOutput = os.Stderr
+
+        if logPath := os.Getenv(logging.EnvLogFile); logPath != "" {
+                var err error
+                logOutput, err = os.OpenFile(logPath, syscall.O_CREAT|syscall.O_RDWR|syscall.O_APPEND, 0666)
+                if err != nil {
+                        return nil, err
+                }
+        }
+
+        if logPathMask := os.Getenv(EnvLogPathMask); logPathMask != "" {
+                // Escape special characters which may appear if we have subtests
+                testName := strings.Replace(t.Name(), "/", "__", -1)
+
+                logPath := fmt.Sprintf(logPathMask, testName)
+                var err error
+                logOutput, err = os.OpenFile(logPath, syscall.O_CREAT|syscall.O_RDWR|syscall.O_APPEND, 0666)
+                if err != nil {
+                        return nil, err
+                }
+        }
+
+        // This was the default since the beginning
+        logOutput = &logutils.LevelFilter{
+                Levels:   logging.ValidLevels,
+                MinLevel: logutils.LogLevel(logLevel),
+                Writer:   logOutput,
+        }
+
+        return
+}
+
+// ParallelTest performs an acceptance test on a resource, allowing concurrency
+// with other ParallelTest.
+//
+// Tests will fail if they do not properly handle conditions to allow multiple
+// tests to occur against the same resource or service (e.g. random naming).
+// All other requirements of the Test function also apply to this function.
+func ParallelTest(t TestT, c TestCase) {
+        t.Parallel()
+        Test(t, c)
+}
+
 // Test performs an acceptance test on a resource.
 //
 // Tests are not run unless an environmental variable "TF_ACC" is
@@ -366,7 +450,7 @@ func Test(t TestT, c TestCase) {
                 return
         }
 
-        logWriter, err := logging.LogOutput()
+        logWriter, err := LogOutput(t)
         if err != nil {
                 t.Error(fmt.Errorf("error setting up logging: %s", err))
         }
@@ -398,7 +482,18 @@ func Test(t TestT, c TestCase) {
         errored := false
         for i, step := range c.Steps {
                 var err error
-                log.Printf("[WARN] Test: Executing step %d", i)
+                log.Printf("[DEBUG] Test: Executing step %d", i)
+
+                if step.SkipFunc != nil {
+                        skip, err := step.SkipFunc()
+                        if err != nil {
+                                t.Fatal(err)
+                        }
+                        if skip {
+                                log.Printf("[WARN] Skipping step %d", i)
+                                continue
+                        }
+                }
 
                 if step.Config == "" && !step.ImportState {
                         err = fmt.Errorf(
@@ -418,6 +513,15 @@ func Test(t TestT, c TestCase) {
                         }
                 }
 
+                // If we expected an error, but did not get one, fail
+                if err == nil && step.ExpectError != nil {
+                        errored = true
+                        t.Error(fmt.Sprintf(
+                                "Step %d, no error received, but expected a match to:\n\n%s\n\n",
+                                i, step.ExpectError))
+                        break
+                }
+
                 // If there was an error, exit
                 if err != nil {
                         // Perhaps we expected an error? Check if it matches
@@ -485,6 +589,7 @@ func Test(t TestT, c TestCase) {
                         Config:                    lastStep.Config,
                         Check:                     c.CheckDestroy,
                         Destroy:                   true,
+                        PreventDiskCleanup:        lastStep.PreventDiskCleanup,
                         PreventPostDestroyRefresh: c.PreventPostDestroyRefresh,
                 }
 
@@ -593,18 +698,12 @@ func testIDOnlyRefresh(c TestCase, opts terraform.ContextOpts, step TestStep, r
         if err != nil {
                 return err
         }
-        if ws, es := ctx.Validate(); len(ws) > 0 || len(es) > 0 {
-                if len(es) > 0 {
-                        estrs := make([]string, len(es))
-                        for i, e := range es {
-                                estrs[i] = e.Error()
-                        }
-                        return fmt.Errorf(
-                                "Configuration is invalid.\n\nWarnings: %#v\n\nErrors: %#v",
-                                ws, estrs)
+        if diags := ctx.Validate(); len(diags) > 0 {
+                if diags.HasErrors() {
+                        return errwrap.Wrapf("config is invalid: {{err}}", diags.Err())
                 }
 
-                log.Printf("[WARN] Config warnings: %#v", ws)
+                log.Printf("[WARN] Config warnings:\n%s", diags.Err().Error())
         }
 
         // Refresh!
@@ -657,9 +756,7 @@ func testIDOnlyRefresh(c TestCase, opts terraform.ContextOpts, step TestStep, r
         return nil
 }
 
-func testModule(
-        opts terraform.ContextOpts,
-        step TestStep) (*module.Tree, error) {
+func testModule(opts terraform.ContextOpts, step TestStep) (*module.Tree, error) {
         if step.PreConfig != nil {
                 step.PreConfig()
         }
@@ -669,7 +766,12 @@ func testModule(
                 return nil, fmt.Errorf(
                         "Error creating temporary directory for config: %s", err)
         }
-        defer os.RemoveAll(cfgPath)
+
+        if step.PreventDiskCleanup {
+                log.Printf("[INFO] Skipping defer os.RemoveAll call")
+        } else {
+                defer os.RemoveAll(cfgPath)
+        }
 
         // Write the configuration
         cfgF, err := os.Create(filepath.Join(cfgPath, "main.tf"))
@@ -693,10 +795,11 @@ func testModule(
         }
 
         // Load the modules
-        modStorage := &getter.FolderStorage{
+        modStorage := &module.Storage{
                 StorageDir: filepath.Join(cfgPath, ".tfmodules"),
+                Mode:       module.GetModeGet,
         }
-        err = mod.Load(modStorage, module.GetModeGet)
+        err = mod.Load(modStorage)
         if err != nil {
                 return nil, fmt.Errorf("Error downloading modules: %s", err)
         }
@@ -771,12 +874,29 @@ func TestCheckResourceAttrSet(name, key string) TestCheckFunc {
                         return err
                 }
 
-                if val, ok := is.Attributes[key]; ok && val != "" {
-                        return nil
+                return testCheckResourceAttrSet(is, name, key)
+        }
+}
+
+// TestCheckModuleResourceAttrSet - as per TestCheckResourceAttrSet but with
+// support for non-root modules
+func TestCheckModuleResourceAttrSet(mp []string, name string, key string) TestCheckFunc {
+        return func(s *terraform.State) error {
+                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                if err != nil {
+                        return err
                 }
 
+                return testCheckResourceAttrSet(is, name, key)
+        }
+}
+
+func testCheckResourceAttrSet(is *terraform.InstanceState, name string, key string) error {
+        if val, ok := is.Attributes[key]; !ok || val == "" {
                 return fmt.Errorf("%s: Attribute '%s' expected to be set", name, key)
         }
+
+        return nil
 }
 
 // TestCheckResourceAttr is a TestCheckFunc which validates
@@ -788,21 +908,37 @@ func TestCheckResourceAttr(name, key, value string) TestCheckFunc {
                         return err
                 }
 
-                if v, ok := is.Attributes[key]; !ok || v != value {
-                        if !ok {
-                                return fmt.Errorf("%s: Attribute '%s' not found", name, key)
-                        }
+                return testCheckResourceAttr(is, name, key, value)
+        }
+}
 
-                        return fmt.Errorf(
-                                "%s: Attribute '%s' expected %#v, got %#v",
-                                name,
-                                key,
-                                value,
-                                v)
+// TestCheckModuleResourceAttr - as per TestCheckResourceAttr but with
+// support for non-root modules
+func TestCheckModuleResourceAttr(mp []string, name string, key string, value string) TestCheckFunc {
+        return func(s *terraform.State) error {
+                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                if err != nil {
+                        return err
                 }
 
-                return nil
+                return testCheckResourceAttr(is, name, key, value)
+        }
+}
+
+func testCheckResourceAttr(is *terraform.InstanceState, name string, key string, value string) error {
+        if v, ok := is.Attributes[key]; !ok || v != value {
+                if !ok {
+                        return fmt.Errorf("%s: Attribute '%s' not found", name, key)
+                }
+
+                return fmt.Errorf(
+                        "%s: Attribute '%s' expected %#v, got %#v",
+                        name,
+                        key,
+                        value,
+                        v)
         }
+        return nil
 }
 
 // TestCheckNoResourceAttr is a TestCheckFunc which ensures that
@@ -814,14 +950,31 @@ func TestCheckNoResourceAttr(name, key string) TestCheckFunc {
                         return err
                 }
 
-                if _, ok := is.Attributes[key]; ok {
-                        return fmt.Errorf("%s: Attribute '%s' found when not expected", name, key)
+                return testCheckNoResourceAttr(is, name, key)
+        }
+}
+
+// TestCheckModuleNoResourceAttr - as per TestCheckNoResourceAttr but with
+// support for non-root modules
+func TestCheckModuleNoResourceAttr(mp []string, name string, key string) TestCheckFunc {
+        return func(s *terraform.State) error {
+                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                if err != nil {
+                        return err
                 }
 
-                return nil
+                return testCheckNoResourceAttr(is, name, key)
         }
 }
 
+func testCheckNoResourceAttr(is *terraform.InstanceState, name string, key string) error {
+        if _, ok := is.Attributes[key]; ok {
+                return fmt.Errorf("%s: Attribute '%s' found when not expected", name, key)
+        }
+
+        return nil
+}
+
 // TestMatchResourceAttr is a TestCheckFunc which checks that the value
 // in state for the given name/key combination matches the given regex.
 func TestMatchResourceAttr(name, key string, r *regexp.Regexp) TestCheckFunc {
@@ -831,17 +984,34 @@ func TestMatchResourceAttr(name, key string, r *regexp.Regexp) TestCheckFunc {
                         return err
                 }
 
-                if !r.MatchString(is.Attributes[key]) {
-                        return fmt.Errorf(
-                                "%s: Attribute '%s' didn't match %q, got %#v",
-                                name,
-                                key,
-                                r.String(),
-                                is.Attributes[key])
+                return testMatchResourceAttr(is, name, key, r)
+        }
+}
+
+// TestModuleMatchResourceAttr - as per TestMatchResourceAttr but with
+// support for non-root modules
+func TestModuleMatchResourceAttr(mp []string, name string, key string, r *regexp.Regexp) TestCheckFunc {
+        return func(s *terraform.State) error {
+                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                if err != nil {
+                        return err
                 }
 
-                return nil
+                return testMatchResourceAttr(is, name, key, r)
+        }
+}
+
+func testMatchResourceAttr(is *terraform.InstanceState, name string, key string, r *regexp.Regexp) error {
+        if !r.MatchString(is.Attributes[key]) {
+                return fmt.Errorf(
+                        "%s: Attribute '%s' didn't match %q, got %#v",
+                        name,
+                        key,
+                        r.String(),
+                        is.Attributes[key])
         }
+
+        return nil
 }
 
 // TestCheckResourceAttrPtr is like TestCheckResourceAttr except the
@@ -853,6 +1023,14 @@ func TestCheckResourceAttrPtr(name string, key string, value *string) TestCheckF
         }
 }
 
+// TestCheckModuleResourceAttrPtr - as per TestCheckResourceAttrPtr but with
+// support for non-root modules
+func TestCheckModuleResourceAttrPtr(mp []string, name string, key string, value *string) TestCheckFunc {
+        return func(s *terraform.State) error {
+                return TestCheckModuleResourceAttr(mp, name, key, *value)(s)
+        }
+}
+
 // TestCheckResourceAttrPair is a TestCheckFunc which validates that the values
 // in state for a pair of name/key combinations are equal.
 func TestCheckResourceAttrPair(nameFirst, keyFirst, nameSecond, keySecond string) TestCheckFunc {
@@ -861,33 +1039,57 @@ func TestCheckResourceAttrPair(nameFirst, keyFirst, nameSecond, keySecond string
                 if err != nil {
                         return err
                 }
-                vFirst, ok := isFirst.Attributes[keyFirst]
-                if !ok {
-                        return fmt.Errorf("%s: Attribute '%s' not found", nameFirst, keyFirst)
-                }
 
                 isSecond, err := primaryInstanceState(s, nameSecond)
                 if err != nil {
                         return err
                 }
-                vSecond, ok := isSecond.Attributes[keySecond]
-                if !ok {
-                        return fmt.Errorf("%s: Attribute '%s' not found", nameSecond, keySecond)
+
+                return testCheckResourceAttrPair(isFirst, nameFirst, keyFirst, isSecond, nameSecond, keySecond)
+        }
+}
+
+// TestCheckModuleResourceAttrPair - as per TestCheckResourceAttrPair but with
+// support for non-root modules
+func TestCheckModuleResourceAttrPair(mpFirst []string, nameFirst string, keyFirst string, mpSecond []string, nameSecond string, keySecond string) TestCheckFunc {
+        return func(s *terraform.State) error {
+                isFirst, err := modulePathPrimaryInstanceState(s, mpFirst, nameFirst)
+                if err != nil {
+                        return err
                 }
 
-                if vFirst != vSecond {
-                        return fmt.Errorf(
-                                "%s: Attribute '%s' expected %#v, got %#v",
-                                nameFirst,
-                                keyFirst,
-                                vSecond,
-                                vFirst)
+                isSecond, err := modulePathPrimaryInstanceState(s, mpSecond, nameSecond)
+                if err != nil {
+                        return err
                 }
 
-                return nil
+                return testCheckResourceAttrPair(isFirst, nameFirst, keyFirst, isSecond, nameSecond, keySecond)
         }
 }
 
+func testCheckResourceAttrPair(isFirst *terraform.InstanceState, nameFirst string, keyFirst string, isSecond *terraform.InstanceState, nameSecond string, keySecond string) error {
+        vFirst, ok := isFirst.Attributes[keyFirst]
+        if !ok {
+                return fmt.Errorf("%s: Attribute '%s' not found", nameFirst, keyFirst)
+        }
+
+        vSecond, ok := isSecond.Attributes[keySecond]
+        if !ok {
+                return fmt.Errorf("%s: Attribute '%s' not found", nameSecond, keySecond)
+        }
+
+        if vFirst != vSecond {
+                return fmt.Errorf(
+                        "%s: Attribute '%s' expected %#v, got %#v",
+                        nameFirst,
+                        keyFirst,
+                        vSecond,
+                        vFirst)
+        }
+
+        return nil
+}
+
 // TestCheckOutput checks an output in the Terraform configuration
 func TestCheckOutput(name, value string) TestCheckFunc {
         return func(s *terraform.State) error {
@@ -936,23 +1138,43 @@ type TestT interface {
         Error(args ...interface{})
         Fatal(args ...interface{})
         Skip(args ...interface{})
+        Name() string
+        Parallel()
 }
 
 // This is set to true by unit tests to alter some behavior
 var testTesting = false
 
-// primaryInstanceState returns the primary instance state for the given resource name.
-func primaryInstanceState(s *terraform.State, name string) (*terraform.InstanceState, error) {
-        ms := s.RootModule()
+// modulePrimaryInstanceState returns the instance state for the given resource
+// name in a ModuleState
+func modulePrimaryInstanceState(s *terraform.State, ms *terraform.ModuleState, name string) (*terraform.InstanceState, error) {
         rs, ok := ms.Resources[name]
         if !ok {
-                return nil, fmt.Errorf("Not found: %s", name)
+                return nil, fmt.Errorf("Not found: %s in %s", name, ms.Path)
         }
 
         is := rs.Primary
         if is == nil {
-                return nil, fmt.Errorf("No primary instance: %s", name)
+                return nil, fmt.Errorf("No primary instance: %s in %s", name, ms.Path)
         }
 
         return is, nil
 }
+
+// modulePathPrimaryInstanceState returns the primary instance state for the
+// given resource name in a given module path.
+func modulePathPrimaryInstanceState(s *terraform.State, mp []string, name string) (*terraform.InstanceState, error) {
+        ms := s.ModuleByPath(mp)
+        if ms == nil {
+                return nil, fmt.Errorf("No module found at: %s", mp)
+        }
+
+        return modulePrimaryInstanceState(s, ms, name)
+}
+
+// primaryInstanceState returns the primary instance state for the given
+// resource name in the root module.
+func primaryInstanceState(s *terraform.State, name string) (*terraform.InstanceState, error) {
+        ms := s.RootModule()
+        return modulePrimaryInstanceState(s, ms, name)
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go b/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go
index 537a11c..033f126 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go
@@ -1,10 +1,12 @@
 package resource
 
 import (
+        "errors"
         "fmt"
         "log"
         "strings"
 
+        "github.com/hashicorp/errwrap"
         "github.com/hashicorp/terraform/terraform"
 )
 
@@ -20,6 +22,14 @@ func testStep(
         opts terraform.ContextOpts,
         state *terraform.State,
         step TestStep) (*terraform.State, error) {
+        // Pre-taint any resources that have been defined in Taint, as long as this
+        // is not a destroy step.
+        if !step.Destroy {
+                if err := testStepTaint(state, step); err != nil {
+                        return state, err
+                }
+        }
+
         mod, err := testModule(opts, step)
         if err != nil {
                 return state, err
@@ -33,17 +43,12 @@ func testStep(
         if err != nil {
                 return state, fmt.Errorf("Error initializing context: %s", err)
         }
-        if ws, es := ctx.Validate(); len(ws) > 0 || len(es) > 0 {
-                if len(es) > 0 {
-                        estrs := make([]string, len(es))
-                        for i, e := range es {
-                                estrs[i] = e.Error()
-                        }
-                        return state, fmt.Errorf(
-                                "Configuration is invalid.\n\nWarnings: %#v\n\nErrors: %#v",
-                                ws, estrs)
+        if diags := ctx.Validate(); len(diags) > 0 {
+                if diags.HasErrors() {
+                        return nil, errwrap.Wrapf("config is invalid: {{err}}", diags.Err())
                 }
-                log.Printf("[WARN] Config warnings: %#v", ws)
+
+                log.Printf("[WARN] Config warnings:\n%s", diags)
         }
 
         // Refresh!
@@ -158,3 +163,19 @@ func testStep(
         // Made it here? Good job test step!
         return state, nil
 }
+
+func testStepTaint(state *terraform.State, step TestStep) error {
+        for _, p := range step.Taint {
+                m := state.RootModule()
+                if m == nil {
+                        return errors.New("no state")
+                }
+                rs, ok := m.Resources[p]
+                if !ok {
+                        return fmt.Errorf("resource %q not found in state", p)
+                }
+                log.Printf("[WARN] Test: Explicitly tainting resource %q", p)
+                rs.Taint()
+        }
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go b/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go
index 28ad105..94fef3c 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go
@@ -16,15 +16,24 @@ func testStepImportState(
         state *terraform.State,
         step TestStep) (*terraform.State, error) {
         // Determine the ID to import
-        importId := step.ImportStateId
-        if importId == "" {
+        var importId string
+        switch {
+        case step.ImportStateIdFunc != nil:
+                var err error
+                importId, err = step.ImportStateIdFunc(state)
+                if err != nil {
+                        return state, err
+                }
+        case step.ImportStateId != "":
+                importId = step.ImportStateId
+        default:
                 resource, err := testResource(step, state)
                 if err != nil {
                         return state, err
                 }
-
                 importId = resource.Primary.ID
         }
+
         importPrefix := step.ImportStateIdPrefix
         if importPrefix != "" {
                 importId = fmt.Sprintf("%s%s", importPrefix, importId)
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/wait.go b/vendor/github.com/hashicorp/terraform/helper/resource/wait.go
index ca50e29..e56a515 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/wait.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/wait.go
@@ -74,7 +74,7 @@ func RetryableError(err error) *RetryError {
         return &RetryError{Err: err, Retryable: true}
 }
 
-// NonRetryableError is a helper to create a RetryError that's _not)_ retryable
+// NonRetryableError is a helper to create a RetryError that's _not_ retryable
 // from a given error.
 func NonRetryableError(err error) *RetryError {
         if err == nil {
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/backend.go b/vendor/github.com/hashicorp/terraform/helper/schema/backend.go
index a0729c0..57fbba7 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/backend.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/backend.go
@@ -65,7 +65,7 @@ func (b *Backend) Configure(c *terraform.ResourceConfig) error {
 
         // Get a ResourceData for this configuration. To do this, we actually
         // generate an intermediary "diff" although that is never exposed.
-        diff, err := sm.Diff(nil, c)
+        diff, err := sm.Diff(nil, c, nil, nil)
         if err != nil {
                 return err
         }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go b/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go
new file mode 100644
index 0000000..bf952f6
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go
@@ -0,0 +1,155 @@
+package schema
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/config/configschema"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// The functions and methods in this file are concerned with the conversion
+// of this package's schema model into the slightly-lower-level schema model
+// used by Terraform core for configuration parsing.
+
+// CoreConfigSchema lowers the receiver to the schema model expected by
+// Terraform core.
+//
+// This lower-level model has fewer features than the schema in this package,
+// describing only the basic structure of configuration and state values we
+// expect. The full schemaMap from this package is still required for full
+// validation, handling of default values, etc.
+//
+// This method presumes a schema that passes InternalValidate, and so may
+// panic or produce an invalid result if given an invalid schemaMap.
+func (m schemaMap) CoreConfigSchema() *configschema.Block {
+        if len(m) == 0 {
+                // We return an actual (empty) object here, rather than a nil,
+                // because a nil result would mean that we don't have a schema at
+                // all, rather than that we have an empty one.
+                return &configschema.Block{}
+        }
+
+        ret := &configschema.Block{
+                Attributes: map[string]*configschema.Attribute{},
+                BlockTypes: map[string]*configschema.NestedBlock{},
+        }
+
+        for name, schema := range m {
+                if schema.Elem == nil {
+                        ret.Attributes[name] = schema.coreConfigSchemaAttribute()
+                        continue
+                }
+                switch schema.Elem.(type) {
+                case *Schema:
+                        ret.Attributes[name] = schema.coreConfigSchemaAttribute()
+                case *Resource:
+                        ret.BlockTypes[name] = schema.coreConfigSchemaBlock()
+                default:
+                        // Should never happen for a valid schema
+                        panic(fmt.Errorf("invalid Schema.Elem %#v; need *Schema or *Resource", schema.Elem))
+                }
+        }
+
+        return ret
+}
+
+// coreConfigSchemaAttribute prepares a configschema.Attribute representation
+// of a schema. This is appropriate only for primitives or collections whose
+// Elem is an instance of Schema. Use coreConfigSchemaBlock for collections
+// whose elem is a whole resource.
+func (s *Schema) coreConfigSchemaAttribute() *configschema.Attribute {
+        return &configschema.Attribute{
+                Type:      s.coreConfigSchemaType(),
+                Optional:  s.Optional,
+                Required:  s.Required,
+                Computed:  s.Computed,
+                Sensitive: s.Sensitive,
+        }
+}
+
+// coreConfigSchemaBlock prepares a configschema.NestedBlock representation of
+// a schema. This is appropriate only for collections whose Elem is an instance
+// of Resource, and will panic otherwise.
+func (s *Schema) coreConfigSchemaBlock() *configschema.NestedBlock {
+        ret := &configschema.NestedBlock{}
+        if nested := s.Elem.(*Resource).CoreConfigSchema(); nested != nil {
+                ret.Block = *nested
+        }
+        switch s.Type {
+        case TypeList:
+                ret.Nesting = configschema.NestingList
+        case TypeSet:
+                ret.Nesting = configschema.NestingSet
+        case TypeMap:
+                ret.Nesting = configschema.NestingMap
+        default:
+                // Should never happen for a valid schema
+                panic(fmt.Errorf("invalid s.Type %s for s.Elem being resource", s.Type))
+        }
+
+        ret.MinItems = s.MinItems
+        ret.MaxItems = s.MaxItems
+
+        if s.Required && s.MinItems == 0 {
+                // configschema doesn't have a "required" representation for nested
+                // blocks, but we can fake it by requiring at least one item.
+                ret.MinItems = 1
+        }
+
+        return ret
+}
+
+// coreConfigSchemaType determines the core config schema type that corresponds
+// to a particular schema's type.
+func (s *Schema) coreConfigSchemaType() cty.Type {
+        switch s.Type {
+        case TypeString:
+                return cty.String
+        case TypeBool:
+                return cty.Bool
+        case TypeInt, TypeFloat:
+                // configschema doesn't distinguish int and float, so helper/schema
+                // will deal with this as an additional validation step after
+                // configuration has been parsed and decoded.
+                return cty.Number
+        case TypeList, TypeSet, TypeMap:
+                var elemType cty.Type
+                switch set := s.Elem.(type) {
+                case *Schema:
+                        elemType = set.coreConfigSchemaType()
+                case *Resource:
+                        // In practice we don't actually use this for normal schema
+                        // construction because we construct a NestedBlock in that
+                        // case instead. See schemaMap.CoreConfigSchema.
+                        elemType = set.CoreConfigSchema().ImpliedType()
+                default:
+                        if set != nil {
+                                // Should never happen for a valid schema
+                                panic(fmt.Errorf("invalid Schema.Elem %#v; need *Schema or *Resource", s.Elem))
+                        }
+                        // Some pre-existing schemas assume string as default, so we need
+                        // to be compatible with them.
+                        elemType = cty.String
+                }
+                switch s.Type {
+                case TypeList:
+                        return cty.List(elemType)
+                case TypeSet:
+                        return cty.Set(elemType)
+                case TypeMap:
+                        return cty.Map(elemType)
+                default:
+                        // can never get here in practice, due to the case we're inside
+                        panic("invalid collection type")
+                }
+        default:
+                // should never happen for a valid schema
+                panic(fmt.Errorf("invalid Schema.Type %s", s.Type))
+        }
+}
+
+// CoreConfigSchema is a convenient shortcut for calling CoreConfigSchema
+// on the resource's schema.
+func (r *Resource) CoreConfigSchema() *configschema.Block {
+        return schemaMap(r.Schema).CoreConfigSchema()
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/data_source_resource_shim.go b/vendor/github.com/hashicorp/terraform/helper/schema/data_source_resource_shim.go
index 5a03d2d..8d93750 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/data_source_resource_shim.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/data_source_resource_shim.go
@@ -32,7 +32,7 @@ func DataSourceResourceShim(name string, dataSource *Resource) *Resource {
 
         // FIXME: Link to some further docs either on the website or in the
         // changelog, once such a thing exists.
-        dataSource.deprecationMessage = fmt.Sprintf(
+        dataSource.DeprecationMessage = fmt.Sprintf(
                 "using %s as a resource is deprecated; consider using the data source instead",
                 name,
         )
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go
index 1660a67..b80b223 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go
@@ -126,6 +126,8 @@ func addrToSchema(addr []string, schemaMap map[string]*Schema) []*Schema {
                                 switch v := current.Elem.(type) {
                                 case ValueType:
                                         current = &Schema{Type: v}
+                                case *Schema:
+                                        current, _ = current.Elem.(*Schema)
                                 default:
                                         // maps default to string values. This is all we can have
                                         // if this is nested in another list or map.
@@ -249,11 +251,10 @@ func readObjectField(
 }
 
 // convert map values to the proper primitive type based on schema.Elem
-func mapValuesToPrimitive(m map[string]interface{}, schema *Schema) error {
-
-        elemType := TypeString
-        if et, ok := schema.Elem.(ValueType); ok {
-                elemType = et
+func mapValuesToPrimitive(k string, m map[string]interface{}, schema *Schema) error {
+        elemType, err := getValueType(k, schema)
+        if err != nil {
+                return err
         }
 
         switch elemType {
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go
index f958bbc..55a301d 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go
@@ -206,7 +206,7 @@ func (r *ConfigFieldReader) readMap(k string, schema *Schema) (FieldReadResult,
                 panic(fmt.Sprintf("unknown type: %#v", mraw))
         }
 
-        err := mapValuesToPrimitive(result, schema)
+        err := mapValuesToPrimitive(k, result, schema)
         if err != nil {
                 return FieldReadResult{}, nil
         }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go
index 16bbae2..d558a5b 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go
@@ -29,29 +29,59 @@ type DiffFieldReader struct {
         Diff   *terraform.InstanceDiff
         Source FieldReader
         Schema map[string]*Schema
+
+        // cache for memoizing ReadField calls.
+        cache map[string]cachedFieldReadResult
+}
+
+type cachedFieldReadResult struct {
+        val FieldReadResult
+        err error
 }
 
 func (r *DiffFieldReader) ReadField(address []string) (FieldReadResult, error) {
+        if r.cache == nil {
+                r.cache = make(map[string]cachedFieldReadResult)
+        }
+
+        // Create the cache key by joining around a value that isn't a valid part
+        // of an address. This assumes that the Source and Schema are not changed
+        // for the life of this DiffFieldReader.
+        cacheKey := strings.Join(address, "|")
+        if cached, ok := r.cache[cacheKey]; ok {
+                return cached.val, cached.err
+        }
+
         schemaList := addrToSchema(address, r.Schema)
         if len(schemaList) == 0 {
+                r.cache[cacheKey] = cachedFieldReadResult{}
                 return FieldReadResult{}, nil
         }
 
+        var res FieldReadResult
+        var err error
+
         schema := schemaList[len(schemaList)-1]
         switch schema.Type {
         case TypeBool, TypeInt, TypeFloat, TypeString:
-                return r.readPrimitive(address, schema)
+                res, err = r.readPrimitive(address, schema)
         case TypeList:
-                return readListField(r, address, schema)
+                res, err = readListField(r, address, schema)
         case TypeMap:
-                return r.readMap(address, schema)
+                res, err = r.readMap(address, schema)
         case TypeSet:
-                return r.readSet(address, schema)
+                res, err = r.readSet(address, schema)
         case typeObject:
-                return readObjectField(r, address, schema.Elem.(map[string]*Schema))
+                res, err = readObjectField(r, address, schema.Elem.(map[string]*Schema))
         default:
                 panic(fmt.Sprintf("Unknown type: %#v", schema.Type))
         }
+
+        r.cache[cacheKey] = cachedFieldReadResult{
+                val: res,
+                err: err,
+        }
+        return res, err
 }
 
 func (r *DiffFieldReader) readMap(
@@ -92,7 +122,8 @@ func (r *DiffFieldReader) readMap(
                 result[k] = v.New
         }
 
-        err = mapValuesToPrimitive(result, schema)
+        key := address[len(address)-1]
+        err = mapValuesToPrimitive(key, result, schema)
         if err != nil {
                 return FieldReadResult{}, nil
         }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go
index 9533981..054efe0 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go
@@ -61,7 +61,7 @@ func (r *MapFieldReader) readMap(k string, schema *Schema) (FieldReadResult, err
                 return true
         })
 
-        err := mapValuesToPrimitive(result, schema)
+        err := mapValuesToPrimitive(k, result, schema)
         if err != nil {
                 return FieldReadResult{}, nil
         }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go
index 689ed8d..814c7ba 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go
@@ -39,6 +39,19 @@ func (w *MapFieldWriter) unsafeWriteField(addr string, value string) {
         w.result[addr] = value
 }
 
+// clearTree clears a field and any sub-fields of the given address out of the
+// map. This should be used to reset some kind of complex structures (namely
+// sets) before writing to make sure that any conflicting data is removed (for
+// example, if the set was previously written to the writer's layer).
+func (w *MapFieldWriter) clearTree(addr []string) {
+        prefix := strings.Join(addr, ".") + "."
+        for k := range w.result {
+                if strings.HasPrefix(k, prefix) {
+                        delete(w.result, k)
+                }
+        }
+}
+
 func (w *MapFieldWriter) WriteField(addr []string, value interface{}) error {
         w.lock.Lock()
         defer w.lock.Unlock()
@@ -115,6 +128,14 @@ func (w *MapFieldWriter) setList(
                 return fmt.Errorf("%s: %s", k, err)
         }
 
+        // Wipe the set from the current writer prior to writing if it exists.
+        // Multiple writes to the same layer is a lot safer for lists than sets due
+        // to the fact that indexes are always deterministic and the length will
+        // always be updated with the current length on the last write, but making
+        // sure we have a clean namespace removes any chance for edge cases to pop up
+        // and ensures that the last write to the set is the correct value.
+        w.clearTree(addr)
+
         // Set the entire list.
         var err error
         for i, elem := range vs {
@@ -162,6 +183,10 @@ func (w *MapFieldWriter) setMap(
                 vs[mk.String()] = mv.Interface()
         }
 
+        // Wipe this address tree. The contents of the map should always reflect the
+        // last write made to it.
+        w.clearTree(addr)
+
         // Remove the pure key since we're setting the full map value
         delete(w.result, k)
 
@@ -308,6 +333,13 @@ func (w *MapFieldWriter) setSet(
                 value = s
         }
 
+        // Clear any keys that match the set address first. This is necessary because
+        // it's always possible and sometimes may be necessary to write to a certain
+        // writer layer more than once with different set data each time, which will
+        // lead to different keys being inserted, which can lead to determinism
+        // problems when the old data isn't wiped first.
+        w.clearTree(addr)
+
         for code, elem := range value.(*Set).m {
                 if err := w.set(append(addrCopy, code), elem); err != nil {
                         return err
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go b/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go
index 3a97629..38cd8c7 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go
@@ -2,7 +2,7 @@
 
 package schema
 
-import "fmt"
+import "strconv"
 
 const (
         _getSource_name_0 = "getSourceStategetSourceConfig"
@@ -13,8 +13,6 @@ const (
 
 var (
         _getSource_index_0 = [...]uint8{0, 14, 29}
-        _getSource_index_1 = [...]uint8{0, 13}
-        _getSource_index_2 = [...]uint8{0, 12}
         _getSource_index_3 = [...]uint8{0, 18, 32}
 )
 
@@ -31,6 +29,6 @@ func (i getSource) String() string {
                 i -= 15
                 return _getSource_name_3[_getSource_index_3[i]:_getSource_index_3[i+1]]
         default:
-                return fmt.Sprintf("getSource(%d)", i)
+                return "getSource(" + strconv.FormatInt(int64(i), 10) + ")"
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/provider.go b/vendor/github.com/hashicorp/terraform/helper/schema/provider.go
index fb28b41..6cd325d 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/provider.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/provider.go
@@ -9,6 +9,7 @@ import (
 
         "github.com/hashicorp/go-multierror"
         "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/config/configschema"
         "github.com/hashicorp/terraform/terraform"
 )
 
@@ -58,7 +59,7 @@ type Provider struct {
 
         meta interface{}
 
-        // a mutex is required because TestReset can directly repalce the stopCtx
+        // a mutex is required because TestReset can directly replace the stopCtx
         stopMu        sync.Mutex
         stopCtx       context.Context
         stopCtxCancel context.CancelFunc
@@ -185,6 +186,29 @@ func (p *Provider) TestReset() error {
         return nil
 }
 
+// GetSchema implementation of terraform.ResourceProvider interface
+func (p *Provider) GetSchema(req *terraform.ProviderSchemaRequest) (*terraform.ProviderSchema, error) {
+        resourceTypes := map[string]*configschema.Block{}
+        dataSources := map[string]*configschema.Block{}
+
+        for _, name := range req.ResourceTypes {
+                if r, exists := p.ResourcesMap[name]; exists {
+                        resourceTypes[name] = r.CoreConfigSchema()
+                }
+        }
+        for _, name := range req.DataSources {
+                if r, exists := p.DataSourcesMap[name]; exists {
+                        dataSources[name] = r.CoreConfigSchema()
+                }
+        }
+
+        return &terraform.ProviderSchema{
+                Provider:      schemaMap(p.Schema).CoreConfigSchema(),
+                ResourceTypes: resourceTypes,
+                DataSources:   dataSources,
+        }, nil
+}
+
 // Input implementation of terraform.ResourceProvider interface.
 func (p *Provider) Input(
         input terraform.UIInput,
@@ -227,7 +251,7 @@ func (p *Provider) Configure(c *terraform.ResourceConfig) error {
 
         // Get a ResourceData for this configuration. To do this, we actually
         // generate an intermediary "diff" although that is never exposed.
-        diff, err := sm.Diff(nil, c)
+        diff, err := sm.Diff(nil, c, nil, p.meta)
         if err != nil {
                 return err
         }
@@ -269,7 +293,7 @@ func (p *Provider) Diff(
                 return nil, fmt.Errorf("unknown resource type: %s", info.Type)
         }
 
-        return r.Diff(s, c)
+        return r.Diff(s, c, p.meta)
 }
 
 // Refresh implementation of terraform.ResourceProvider interface.
@@ -305,6 +329,10 @@ func (p *Provider) Resources() []terraform.ResourceType {
                 result = append(result, terraform.ResourceType{
                         Name:       k,
                         Importable: resource.Importer != nil,
+
+                        // Indicates that a provider is compiled against a new enough
+                        // version of core to support the GetSchema method.
+                        SchemaAvailable: true,
                 })
         }
 
@@ -382,7 +410,7 @@ func (p *Provider) ReadDataDiff(
                 return nil, fmt.Errorf("unknown data source: %s", info.Type)
         }
 
-        return r.Diff(nil, c)
+        return r.Diff(nil, c, p.meta)
 }
 
 // RefreshData implementation of terraform.ResourceProvider interface.
@@ -410,6 +438,10 @@ func (p *Provider) DataSources() []terraform.DataSource {
         for _, k := range keys {
                 result = append(result, terraform.DataSource{
                         Name: k,
+
+                        // Indicates that a provider is compiled against a new enough
+                        // version of core to support the GetSchema method.
+                        SchemaAvailable: true,
                 })
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go b/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go
index 476192e..a8d42db 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go
@@ -146,7 +146,7 @@ func (p *Provisioner) Apply(
                 }
 
                 sm := schemaMap(p.ConnSchema)
-                diff, err := sm.Diff(nil, terraform.NewResourceConfig(c))
+                diff, err := sm.Diff(nil, terraform.NewResourceConfig(c), nil, nil)
                 if err != nil {
                         return err
                 }
@@ -160,7 +160,7 @@ func (p *Provisioner) Apply(
                 // Build the configuration data. Doing this requires making a "diff"
                 // even though that's never used. We use that just to get the correct types.
                 configMap := schemaMap(p.Schema)
-                diff, err := configMap.Diff(nil, c)
+                diff, err := configMap.Diff(nil, c, nil, nil)
                 if err != nil {
                         return err
                 }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
index ddba109..d3be2d6 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
@@ -85,6 +85,37 @@ type Resource struct {
         Delete DeleteFunc
         Exists ExistsFunc
 
+        // CustomizeDiff is a custom function for working with the diff that
+        // Terraform has created for this resource - it can be used to customize the
+        // diff that has been created, diff values not controlled by configuration,
+        // or even veto the diff altogether and abort the plan. It is passed a
+        // *ResourceDiff, a structure similar to ResourceData but lacking most write
+        // functions like Set, while introducing new functions that work with the
+        // diff such as SetNew, SetNewComputed, and ForceNew.
+        //
+        // The phases Terraform runs this in, and the state available via functions
+        // like Get and GetChange, are as follows:
+        //
+        //  * New resource: One run with no state
+        //  * Existing resource: One run with state
+        //   * Existing resource, forced new: One run with state (before ForceNew),
+        //     then one run without state (as if new resource)
+        //  * Tainted resource: No runs (custom diff logic is skipped)
+        //  * Destroy: No runs (standard diff logic is skipped on destroy diffs)
+        //
+        // This function needs to be resilient to support all scenarios.
+        //
+        // If this function needs to access external API resources, remember to flag
+        // the RequiresRefresh attribute mentioned below to ensure that
+        // -refresh=false is blocked when running plan or apply, as this means that
+        // this resource requires refresh-like behaviour to work effectively.
+        //
+        // For the most part, only computed fields can be customized by this
+        // function.
+        //
+        // This function is only allowed on regular resources (not data sources).
+        CustomizeDiff CustomizeDiffFunc
+
         // Importer is the ResourceImporter implementation for this resource.
         // If this is nil, then this resource does not support importing. If
         // this is non-nil, then it supports importing and ResourceImporter
@@ -93,9 +124,7 @@ type Resource struct {
         Importer *ResourceImporter
 
         // If non-empty, this string is emitted as a warning during Validate.
-        // This is a private interface for now, for use by DataSourceResourceShim,
-        // and not for general use. (But maybe later...)
-        deprecationMessage string
+        DeprecationMessage string
 
         // Timeouts allow users to specify specific time durations in which an
         // operation should time out, to allow them to extend an action to suit their
@@ -126,6 +155,9 @@ type ExistsFunc func(*ResourceData, interface{}) (bool, error)
 type StateMigrateFunc func(
         int, *terraform.InstanceState, interface{}) (*terraform.InstanceState, error)
 
+// See Resource documentation.
+type CustomizeDiffFunc func(*ResourceDiff, interface{}) error
+
 // Apply creates, updates, and/or deletes a resource.
 func (r *Resource) Apply(
         s *terraform.InstanceState,
@@ -202,11 +234,11 @@ func (r *Resource) Apply(
         return r.recordCurrentSchemaVersion(data.State()), err
 }
 
-// Diff returns a diff of this resource and is API compatible with the
-// ResourceProvider interface.
+// Diff returns a diff of this resource.
 func (r *Resource) Diff(
         s *terraform.InstanceState,
-        c *terraform.ResourceConfig) (*terraform.InstanceDiff, error) {
+        c *terraform.ResourceConfig,
+        meta interface{}) (*terraform.InstanceDiff, error) {
 
         t := &ResourceTimeout{}
         err := t.ConfigDecode(r, c)
@@ -215,7 +247,7 @@ func (r *Resource) Diff(
                 return nil, fmt.Errorf("[ERR] Error decoding timeout: %s", err)
         }
 
-        instanceDiff, err := schemaMap(r.Schema).Diff(s, c)
+        instanceDiff, err := schemaMap(r.Schema).Diff(s, c, r.CustomizeDiff, meta)
         if err != nil {
                 return instanceDiff, err
         }
@@ -235,8 +267,8 @@ func (r *Resource) Diff(
 func (r *Resource) Validate(c *terraform.ResourceConfig) ([]string, []error) {
         warns, errs := schemaMap(r.Schema).Validate(c)
 
-        if r.deprecationMessage != "" {
-                warns = append(warns, r.deprecationMessage)
+        if r.DeprecationMessage != "" {
+                warns = append(warns, r.DeprecationMessage)
         }
 
         return warns, errs
@@ -248,7 +280,6 @@ func (r *Resource) ReadDataApply(
         d *terraform.InstanceDiff,
         meta interface{},
 ) (*terraform.InstanceState, error) {
-
         // Data sources are always built completely from scratch
         // on each read, so the source state is always nil.
         data, err := schemaMap(r.Schema).Data(nil, d)
@@ -346,6 +377,11 @@ func (r *Resource) InternalValidate(topSchemaMap schemaMap, writable bool) error
                 if r.Create != nil || r.Update != nil || r.Delete != nil {
                         return fmt.Errorf("must not implement Create, Update or Delete")
                 }
+
+                // CustomizeDiff cannot be defined for read-only resources
+                if r.CustomizeDiff != nil {
+                        return fmt.Errorf("cannot implement CustomizeDiff")
+                }
         }
 
         tsm := topSchemaMap
@@ -393,19 +429,43 @@ func (r *Resource) InternalValidate(topSchemaMap schemaMap, writable bool) error
                                 return err
                         }
                 }
+
+                for k, f := range tsm {
+                        if isReservedResourceFieldName(k, f) {
+                                return fmt.Errorf("%s is a reserved field name", k)
+                        }
+                }
         }
 
-        // Resource-specific checks
-        for k, _ := range tsm {
-                if isReservedResourceFieldName(k) {
-                        return fmt.Errorf("%s is a reserved field name for a resource", k)
+        // Data source
+        if r.isTopLevel() && !writable {
+                tsm = schemaMap(r.Schema)
+                for k, _ := range tsm {
+                        if isReservedDataSourceFieldName(k) {
+                                return fmt.Errorf("%s is a reserved field name", k)
+                        }
                 }
         }
 
         return schemaMap(r.Schema).InternalValidate(tsm)
 }
 
-func isReservedResourceFieldName(name string) bool {
+func isReservedDataSourceFieldName(name string) bool {
+        for _, reservedName := range config.ReservedDataSourceFields {
+                if name == reservedName {
+                        return true
+                }
+        }
+        return false
+}
+
+func isReservedResourceFieldName(name string, s *Schema) bool {
+        // Allow phasing out "id"
+        // See https://github.com/terraform-providers/terraform-provider-aws/pull/1626#issuecomment-328881415
+        if name == "id" && (s.Deprecated != "" || s.Removed != "") {
+                return false
+        }
+
         for _, reservedName := range config.ReservedResourceFields {
                 if name == reservedName {
                         return true
@@ -430,6 +490,12 @@ func (r *Resource) Data(s *terraform.InstanceState) *ResourceData {
                 panic(err)
         }
 
+        // load the Resource timeouts
+        result.timeouts = r.Timeouts
+        if result.timeouts == nil {
+                result.timeouts = &ResourceTimeout{}
+        }
+
         // Set the schema version to latest by default
         result.meta = map[string]interface{}{
                 "schema_version": strconv.Itoa(r.SchemaVersion),
@@ -450,7 +516,7 @@ func (r *Resource) TestResourceData() *ResourceData {
 // Returns true if the resource is "top level" i.e. not a sub-resource.
 func (r *Resource) isTopLevel() bool {
         // TODO: This is a heuristic; replace with a definitive attribute?
-        return r.Create != nil
+        return (r.Create != nil || r.Read != nil)
 }
 
 // Determines if a given InstanceState needs to be migrated by checking the
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go
index b2bc8f6..6cc01ee 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go
@@ -35,6 +35,8 @@ type ResourceData struct {
         partialMap  map[string]struct{}
         once        sync.Once
         isNew       bool
+
+        panicOnError bool
 }
 
 // getResult is the internal structure that is generated when a Get
@@ -104,6 +106,22 @@ func (d *ResourceData) GetOk(key string) (interface{}, bool) {
         return r.Value, exists
 }
 
+// GetOkExists returns the data for a given key and whether or not the key
+// has been set to a non-zero value. This is only useful for determining
+// if boolean attributes have been set, if they are Optional but do not
+// have a Default value.
+//
+// This is nearly the same function as GetOk, yet it does not check
+// for the zero value of the attribute's type. This allows for attributes
+// without a default, to fully check for a literal assignment, regardless
+// of the zero-value for that type.
+// This should only be used if absolutely required/needed.
+func (d *ResourceData) GetOkExists(key string) (interface{}, bool) {
+        r := d.getRaw(key, getSourceSet)
+        exists := r.Exists && !r.Computed
+        return r.Value, exists
+}
+
 func (d *ResourceData) getRaw(key string, level getSource) getResult {
         var parts []string
         if key != "" {
@@ -168,7 +186,11 @@ func (d *ResourceData) Set(key string, value interface{}) error {
                 }
         }
 
-        return d.setWriter.WriteField(strings.Split(key, "."), value)
+        err := d.setWriter.WriteField(strings.Split(key, "."), value)
+        if err != nil && d.panicOnError {
+                panic(err)
+        }
+        return err
 }
 
 // SetPartial adds the key to the final state output while
@@ -293,6 +315,7 @@ func (d *ResourceData) State() *terraform.InstanceState {
 
         mapW := &MapFieldWriter{Schema: d.schema}
         if err := mapW.WriteField(nil, rawMap); err != nil {
+                log.Printf("[ERR] Error writing fields: %s", err)
                 return nil
         }
 
@@ -344,6 +367,13 @@ func (d *ResourceData) State() *terraform.InstanceState {
 func (d *ResourceData) Timeout(key string) time.Duration {
         key = strings.ToLower(key)
 
+        // System default of 20 minutes
+        defaultTimeout := 20 * time.Minute
+
+        if d.timeouts == nil {
+                return defaultTimeout
+        }
+
         var timeout *time.Duration
         switch key {
         case TimeoutCreate:
@@ -364,8 +394,7 @@ func (d *ResourceData) Timeout(key string) time.Duration {
                 return *d.timeouts.Default
         }
 
-        // Return system default of 20 minutes
-        return 20 * time.Minute
+        return defaultTimeout
 }
 
 func (d *ResourceData) init() {
@@ -423,7 +452,7 @@ func (d *ResourceData) init() {
 }
 
 func (d *ResourceData) diffChange(
-        k string) (interface{}, interface{}, bool, bool) {
+        k string) (interface{}, interface{}, bool, bool, bool) {
         // Get the change between the state and the config.
         o, n := d.getChange(k, getSourceState, getSourceConfig|getSourceExact)
         if !o.Exists {
@@ -434,7 +463,7 @@ func (d *ResourceData) diffChange(
         }
 
         // Return the old, new, and whether there is a change
-        return o.Value, n.Value, !reflect.DeepEqual(o.Value, n.Value), n.Computed
+        return o.Value, n.Value, !reflect.DeepEqual(o.Value, n.Value), n.Computed, false
 }
 
 func (d *ResourceData) getChange(
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go
new file mode 100644
index 0000000..7db3dec
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go
@@ -0,0 +1,559 @@
+package schema
+
+import (
+        "errors"
+        "fmt"
+        "reflect"
+        "strings"
+        "sync"
+
+        "github.com/hashicorp/terraform/terraform"
+)
+
+// newValueWriter is a minor re-implementation of MapFieldWriter to include
+// keys that should be marked as computed, to represent the new part of a
+// pseudo-diff.
+type newValueWriter struct {
+        *MapFieldWriter
+
+        // A list of keys that should be marked as computed.
+        computedKeys map[string]bool
+
+        // A lock to prevent races on writes. The underlying writer will have one as
+        // well - this is for computed keys.
+        lock sync.Mutex
+
+        // To be used with init.
+        once sync.Once
+}
+
+// init performs any initialization tasks for the newValueWriter.
+func (w *newValueWriter) init() {
+        if w.computedKeys == nil {
+                w.computedKeys = make(map[string]bool)
+        }
+}
+
+// WriteField overrides MapValueWriter's WriteField, adding the ability to flag
+// the address as computed.
+func (w *newValueWriter) WriteField(address []string, value interface{}, computed bool) error {
+        // Fail the write if we have a non-nil value and computed is true.
+        // NewComputed values should not have a value when written.
+        if value != nil && computed {
+                return errors.New("Non-nil value with computed set")
+        }
+
+        if err := w.MapFieldWriter.WriteField(address, value); err != nil {
+                return err
+        }
+
+        w.once.Do(w.init)
+
+        w.lock.Lock()
+        defer w.lock.Unlock()
+        if computed {
+                w.computedKeys[strings.Join(address, ".")] = true
+        }
+        return nil
+}
+
+// ComputedKeysMap returns the underlying computed keys map.
+func (w *newValueWriter) ComputedKeysMap() map[string]bool {
+        w.once.Do(w.init)
+        return w.computedKeys
+}
+
+// newValueReader is a minor re-implementation of MapFieldReader and is the
+// read counterpart to MapValueWriter, allowing the read of keys flagged as
+// computed to accommodate the diff override logic in ResourceDiff.
+type newValueReader struct {
+        *MapFieldReader
+
+        // The list of computed keys from a newValueWriter.
+        computedKeys map[string]bool
+}
+
+// ReadField reads the values from the underlying writer, returning the
+// computed value if it is found as well.
+func (r *newValueReader) ReadField(address []string) (FieldReadResult, error) {
+        addrKey := strings.Join(address, ".")
+        v, err := r.MapFieldReader.ReadField(address)
+        if err != nil {
+                return FieldReadResult{}, err
+        }
+        for computedKey := range r.computedKeys {
+                if childAddrOf(addrKey, computedKey) {
+                        if strings.HasSuffix(addrKey, ".#") {
+                                // This is a count value for a list or set that has been marked as
+                                // computed, or a sub-list/sub-set of a complex resource that has
+                                // been marked as computed.  We need to pass through to other readers
+                                // so that an accurate previous count can be fetched for the diff.
+                                v.Exists = false
+                        }
+                        v.Computed = true
+                }
+        }
+
+        return v, nil
+}
+
+// ResourceDiff is used to query and make custom changes to an in-flight diff.
+// It can be used to veto particular changes in the diff, customize the diff
+// that has been created, or diff values not controlled by config.
+//
+// The object functions similar to ResourceData, however most notably lacks
+// Set, SetPartial, and Partial, as it should be used to change diff values
+// only.  Most other first-class ResourceData functions exist, namely Get,
+// GetOk, HasChange, and GetChange exist.
+//
+// All functions in ResourceDiff, save for ForceNew, can only be used on
+// computed fields.
+type ResourceDiff struct {
+        // The schema for the resource being worked on.
+        schema map[string]*Schema
+
+        // The current config for this resource.
+        config *terraform.ResourceConfig
+
+        // The state for this resource as it exists post-refresh, after the initial
+        // diff.
+        state *terraform.InstanceState
+
+        // The diff created by Terraform. This diff is used, along with state,
+        // config, and custom-set diff data, to provide a multi-level reader
+        // experience similar to ResourceData.
+        diff *terraform.InstanceDiff
+
+        // The internal reader structure that contains the state, config, the default
+        // diff, and the new diff.
+        multiReader *MultiLevelFieldReader
+
+        // A writer that writes overridden new fields.
+        newWriter *newValueWriter
+
+        // Tracks which keys have been updated by ResourceDiff to ensure that the
+        // diff does not get re-run on keys that were not touched, or diffs that were
+        // just removed (re-running on the latter would just roll back the removal).
+        updatedKeys map[string]bool
+
+        // Tracks which keys were flagged as forceNew. These keys are not saved in
+        // newWriter, but we need to track them so that they can be re-diffed later.
+        forcedNewKeys map[string]bool
+}
+
+// newResourceDiff creates a new ResourceDiff instance.
+func newResourceDiff(schema map[string]*Schema, config *terraform.ResourceConfig, state *terraform.InstanceState, diff *terraform.InstanceDiff) *ResourceDiff {
+        d := &ResourceDiff{
+                config: config,
+                state:  state,
+                diff:   diff,
+                schema: schema,
+        }
+
+        d.newWriter = &newValueWriter{
+                MapFieldWriter: &MapFieldWriter{Schema: d.schema},
+        }
+        readers := make(map[string]FieldReader)
+        var stateAttributes map[string]string
+        if d.state != nil {
+                stateAttributes = d.state.Attributes
+                readers["state"] = &MapFieldReader{
+                        Schema: d.schema,
+                        Map:    BasicMapReader(stateAttributes),
+                }
+        }
+        if d.config != nil {
+                readers["config"] = &ConfigFieldReader{
+                        Schema: d.schema,
+                        Config: d.config,
+                }
+        }
+        if d.diff != nil {
+                readers["diff"] = &DiffFieldReader{
+                        Schema: d.schema,
+                        Diff:   d.diff,
+                        Source: &MultiLevelFieldReader{
+                                Levels:  []string{"state", "config"},
+                                Readers: readers,
+                        },
+                }
+        }
+        readers["newDiff"] = &newValueReader{
+                MapFieldReader: &MapFieldReader{
+                        Schema: d.schema,
+                        Map:    BasicMapReader(d.newWriter.Map()),
+                },
+                computedKeys: d.newWriter.ComputedKeysMap(),
+        }
+        d.multiReader = &MultiLevelFieldReader{
+                Levels: []string{
+                        "state",
+                        "config",
+                        "diff",
+                        "newDiff",
+                },
+
+                Readers: readers,
+        }
+
+        d.updatedKeys = make(map[string]bool)
+        d.forcedNewKeys = make(map[string]bool)
+
+        return d
+}
+
+// UpdatedKeys returns the keys that were updated by this ResourceDiff run.
+// These are the only keys that a diff should be re-calculated for.
+//
+// This is the combined result of both keys for which diff values were updated
+// for or cleared, and also keys that were flagged to be re-diffed as a result
+// of ForceNew.
+func (d *ResourceDiff) UpdatedKeys() []string {
+        var s []string
+        for k := range d.updatedKeys {
+                s = append(s, k)
+        }
+        for k := range d.forcedNewKeys {
+                for _, l := range s {
+                        if k == l {
+                                break
+                        }
+                }
+                s = append(s, k)
+        }
+        return s
+}
+
+// Clear wipes the diff for a particular key. It is called by ResourceDiff's
+// functionality to remove any possibility of conflicts, but can be called on
+// its own to just remove a specific key from the diff completely.
+//
+// Note that this does not wipe an override. This function is only allowed on
+// computed keys.
+func (d *ResourceDiff) Clear(key string) error {
+        if err := d.checkKey(key, "Clear", true); err != nil {
+                return err
+        }
+
+        return d.clear(key)
+}
+
+func (d *ResourceDiff) clear(key string) error {
+        // Check the schema to make sure that this key exists first.
+        schemaL := addrToSchema(strings.Split(key, "."), d.schema)
+        if len(schemaL) == 0 {
+                return fmt.Errorf("%s is not a valid key", key)
+        }
+
+        for k := range d.diff.Attributes {
+                if strings.HasPrefix(k, key) {
+                        delete(d.diff.Attributes, k)
+                }
+        }
+        return nil
+}
+
+// GetChangedKeysPrefix helps to implement Resource.CustomizeDiff
+// where we need to act on all nested fields
+// without calling out each one separately
+func (d *ResourceDiff) GetChangedKeysPrefix(prefix string) []string {
+        keys := make([]string, 0)
+        for k := range d.diff.Attributes {
+                if strings.HasPrefix(k, prefix) {
+                        keys = append(keys, k)
+                }
+        }
+        return keys
+}
+
+// diffChange helps to implement resourceDiffer and derives its change values
+// from ResourceDiff's own change data, in addition to existing diff, config, and state.
+func (d *ResourceDiff) diffChange(key string) (interface{}, interface{}, bool, bool, bool) {
+        old, new, customized := d.getChange(key)
+
+        if !old.Exists {
+                old.Value = nil
+        }
+        if !new.Exists || d.removed(key) {
+                new.Value = nil
+        }
+
+        return old.Value, new.Value, !reflect.DeepEqual(old.Value, new.Value), new.Computed, customized
+}
+
+// SetNew is used to set a new diff value for the mentioned key. The value must
+// be correct for the attribute's schema (mostly relevant for maps, lists, and
+// sets). The original value from the state is used as the old value.
+//
+// This function is only allowed on computed attributes.
+func (d *ResourceDiff) SetNew(key string, value interface{}) error {
+        if err := d.checkKey(key, "SetNew", false); err != nil {
+                return err
+        }
+
+        return d.setDiff(key, value, false)
+}
+
+// SetNewComputed functions like SetNew, except that it blanks out a new value
+// and marks it as computed.
+//
+// This function is only allowed on computed attributes.
+func (d *ResourceDiff) SetNewComputed(key string) error {
+        if err := d.checkKey(key, "SetNewComputed", false); err != nil {
+                return err
+        }
+
+        return d.setDiff(key, nil, true)
+}
+
+// setDiff performs common diff setting behaviour.
+func (d *ResourceDiff) setDiff(key string, new interface{}, computed bool) error {
+        if err := d.clear(key); err != nil {
+                return err
+        }
+
+        if err := d.newWriter.WriteField(strings.Split(key, "."), new, computed); err != nil {
+                return fmt.Errorf("Cannot set new diff value for key %s: %s", key, err)
+        }
+
+        d.updatedKeys[key] = true
+
+        return nil
+}
+
+// ForceNew force-flags ForceNew in the schema for a specific key, and
+// re-calculates its diff, effectively causing this attribute to force a new
+// resource.
+//
+// Keep in mind that forcing a new resource will force a second run of the
+// resource's CustomizeDiff function (with a new ResourceDiff) once the current
+// one has completed. This second run is performed without state. This behavior
+// will be the same as if a new resource is being created and is performed to
+// ensure that the diff looks like the diff for a new resource as much as
+// possible. CustomizeDiff should expect such a scenario and act correctly.
+//
+// This function is a no-op/error if there is no diff.
+//
+// Note that the change to schema is permanent for the lifecycle of this
+// specific ResourceDiff instance.
+func (d *ResourceDiff) ForceNew(key string) error {
+        if !d.HasChange(key) {
+                return fmt.Errorf("ForceNew: No changes for %s", key)
+        }
+
+        keyParts := strings.Split(key, ".")
+        var schema *Schema
+        schemaL := addrToSchema(keyParts, d.schema)
+        if len(schemaL) > 0 {
+                schema = schemaL[len(schemaL)-1]
+        } else {
+                return fmt.Errorf("ForceNew: %s is not a valid key", key)
+        }
+
+        schema.ForceNew = true
+
+        // Flag this for a re-diff. Don't save any values to guarantee that existing
+        // diffs aren't messed with, as this gets messy when dealing with complex
+        // structures, zero values, etc.
+        d.forcedNewKeys[keyParts[0]] = true
+
+        return nil
+}
+
+// Get hands off to ResourceData.Get.
+func (d *ResourceDiff) Get(key string) interface{} {
+        r, _ := d.GetOk(key)
+        return r
+}
+
+// GetChange gets the change between the state and diff, checking first to see
+// if a overridden diff exists.
+//
+// This implementation differs from ResourceData's in the way that we first get
+// results from the exact levels for the new diff, then from state and diff as
+// per normal.
+func (d *ResourceDiff) GetChange(key string) (interface{}, interface{}) {
+        old, new, _ := d.getChange(key)
+        return old.Value, new.Value
+}
+
+// GetOk functions the same way as ResourceData.GetOk, but it also checks the
+// new diff levels to provide data consistent with the current state of the
+// customized diff.
+func (d *ResourceDiff) GetOk(key string) (interface{}, bool) {
+        r := d.get(strings.Split(key, "."), "newDiff")
+        exists := r.Exists && !r.Computed
+        if exists {
+                // If it exists, we also want to verify it is not the zero-value.
+                value := r.Value
+                zero := r.Schema.Type.Zero()
+
+                if eq, ok := value.(Equal); ok {
+                        exists = !eq.Equal(zero)
+                } else {
+                        exists = !reflect.DeepEqual(value, zero)
+                }
+        }
+
+        return r.Value, exists
+}
+
+// GetOkExists functions the same way as GetOkExists within ResourceData, but
+// it also checks the new diff levels to provide data consistent with the
+// current state of the customized diff.
+//
+// This is nearly the same function as GetOk, yet it does not check
+// for the zero value of the attribute's type. This allows for attributes
+// without a default, to fully check for a literal assignment, regardless
+// of the zero-value for that type.
+func (d *ResourceDiff) GetOkExists(key string) (interface{}, bool) {
+        r := d.get(strings.Split(key, "."), "newDiff")
+        exists := r.Exists && !r.Computed
+        return r.Value, exists
+}
+
+// NewValueKnown returns true if the new value for the given key is available
+// as its final value at diff time. If the return value is false, this means
+// either the value is based of interpolation that was unavailable at diff
+// time, or that the value was explicitly marked as computed by SetNewComputed.
+func (d *ResourceDiff) NewValueKnown(key string) bool {
+        r := d.get(strings.Split(key, "."), "newDiff")
+        return !r.Computed
+}
+
+// HasChange checks to see if there is a change between state and the diff, or
+// in the overridden diff.
+func (d *ResourceDiff) HasChange(key string) bool {
+        old, new := d.GetChange(key)
+
+        // If the type implements the Equal interface, then call that
+        // instead of just doing a reflect.DeepEqual. An example where this is
+        // needed is *Set
+        if eq, ok := old.(Equal); ok {
+                return !eq.Equal(new)
+        }
+
+        return !reflect.DeepEqual(old, new)
+}
+
+// Id returns the ID of this resource.
+//
+// Note that technically, ID does not change during diffs (it either has
+// already changed in the refresh, or will change on update), hence we do not
+// support updating the ID or fetching it from anything else other than state.
+func (d *ResourceDiff) Id() string {
+        var result string
+
+        if d.state != nil {
+                result = d.state.ID
+        }
+        return result
+}
+
+// getChange gets values from two different levels, designed for use in
+// diffChange, HasChange, and GetChange.
+//
+// This implementation differs from ResourceData's in the way that we first get
+// results from the exact levels for the new diff, then from state and diff as
+// per normal.
+func (d *ResourceDiff) getChange(key string) (getResult, getResult, bool) {
+        old := d.get(strings.Split(key, "."), "state")
+        var new getResult
+        for p := range d.updatedKeys {
+                if childAddrOf(key, p) {
+                        new = d.getExact(strings.Split(key, "."), "newDiff")
+                        return old, new, true
+                }
+        }
+        new = d.get(strings.Split(key, "."), "newDiff")
+        return old, new, false
+}
+
+// removed checks to see if the key is present in the existing, pre-customized
+// diff and if it was marked as NewRemoved.
+func (d *ResourceDiff) removed(k string) bool {
+        diff, ok := d.diff.Attributes[k]
+        if !ok {
+                return false
+        }
+        return diff.NewRemoved
+}
+
+// get performs the appropriate multi-level reader logic for ResourceDiff,
+// starting at source. Refer to newResourceDiff for the level order.
+func (d *ResourceDiff) get(addr []string, source string) getResult {
+        result, err := d.multiReader.ReadFieldMerge(addr, source)
+        if err != nil {
+                panic(err)
+        }
+
+        return d.finalizeResult(addr, result)
+}
+
+// getExact gets an attribute from the exact level referenced by source.
+func (d *ResourceDiff) getExact(addr []string, source string) getResult {
+        result, err := d.multiReader.ReadFieldExact(addr, source)
+        if err != nil {
+                panic(err)
+        }
+
+        return d.finalizeResult(addr, result)
+}
+
+// finalizeResult does some post-processing of the result produced by get and getExact.
+func (d *ResourceDiff) finalizeResult(addr []string, result FieldReadResult) getResult {
+        // If the result doesn't exist, then we set the value to the zero value
+        var schema *Schema
+        if schemaL := addrToSchema(addr, d.schema); len(schemaL) > 0 {
+                schema = schemaL[len(schemaL)-1]
+        }
+
+        if result.Value == nil && schema != nil {
+                result.Value = result.ValueOrZero(schema)
+        }
+
+        // Transform the FieldReadResult into a getResult. It might be worth
+        // merging these two structures one day.
+        return getResult{
+                Value:          result.Value,
+                ValueProcessed: result.ValueProcessed,
+                Computed:       result.Computed,
+                Exists:         result.Exists,
+                Schema:         schema,
+        }
+}
+
+// childAddrOf does a comparison of two addresses to see if one is the child of
+// the other.
+func childAddrOf(child, parent string) bool {
+        cs := strings.Split(child, ".")
+        ps := strings.Split(parent, ".")
+        if len(ps) > len(cs) {
+                return false
+        }
+        return reflect.DeepEqual(ps, cs[:len(ps)])
+}
+
+// checkKey checks the key to make sure it exists and is computed.
+func (d *ResourceDiff) checkKey(key, caller string, nested bool) error {
+        var schema *Schema
+        if nested {
+                keyParts := strings.Split(key, ".")
+                schemaL := addrToSchema(keyParts, d.schema)
+                if len(schemaL) > 0 {
+                        schema = schemaL[len(schemaL)-1]
+                }
+        } else {
+                s, ok := d.schema[key]
+                if ok {
+                        schema = s
+                }
+        }
+        if schema == nil {
+                return fmt.Errorf("%s: invalid key: %s", caller, key)
+        }
+        if !schema.Computed {
+                return fmt.Errorf("%s only operates on computed keys - %s is not one", caller, key)
+        }
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/schema.go b/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
index acb5618..0ea5aad 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
@@ -21,9 +21,13 @@ import (
         "strings"
 
         "github.com/hashicorp/terraform/terraform"
+        "github.com/mitchellh/copystructure"
         "github.com/mitchellh/mapstructure"
 )
 
+// Name of ENV variable which (if not empty) prefers panic over error
+const PanicOnErr = "TF_SCHEMA_PANIC_ON_ERROR"
+
 // type used for schema package context keys
 type contextKey string
 
@@ -116,12 +120,16 @@ type Schema struct {
         ForceNew  bool
         StateFunc SchemaStateFunc
 
-        // The following fields are only set for a TypeList or TypeSet Type.
+        // The following fields are only set for a TypeList, TypeSet, or TypeMap.
         //
-        // Elem must be either a *Schema or a *Resource only if the Type is
-        // TypeList, and represents what the element type is. If it is *Schema,
-        // the element type is just a simple value. If it is *Resource, the
-        // element type is a complex structure, potentially with its own lifecycle.
+        // Elem represents the element type. For a TypeMap, it must be a *Schema
+        // with a Type of TypeString, otherwise it may be either a *Schema or a
+        // *Resource. If it is *Schema, the element type is just a simple value.
+        // If it is *Resource, the element type is a complex structure,
+        // potentially with its own lifecycle.
+        Elem interface{}
+
+        // The following fields are only set for a TypeList or TypeSet.
         //
         // MaxItems defines a maximum amount of items that can exist within a
         // TypeSet or TypeList. Specific use cases would be if a TypeSet is being
@@ -138,7 +146,6 @@ type Schema struct {
         // ["foo"] automatically. This is primarily for legacy reasons and the
         // ambiguity is not recommended for new usage. Promotion is only allowed
         // for primitive element types.
-        Elem          interface{}
         MaxItems      int
         MinItems      int
         PromoteSingle bool
@@ -192,7 +199,7 @@ type Schema struct {
         Sensitive bool
 }
 
-// SchemaDiffSuppresFunc is a function which can be used to determine
+// SchemaDiffSuppressFunc is a function which can be used to determine
 // whether a detected diff on a schema element is "valid" or not, and
 // suppress it from the plan if necessary.
 //
@@ -289,8 +296,7 @@ func (s *Schema) ZeroValue() interface{} {
         }
 }
 
-func (s *Schema) finalizeDiff(
-        d *terraform.ResourceAttrDiff) *terraform.ResourceAttrDiff {
+func (s *Schema) finalizeDiff(d *terraform.ResourceAttrDiff, customized bool) *terraform.ResourceAttrDiff {
         if d == nil {
                 return d
         }
@@ -331,13 +337,20 @@ func (s *Schema) finalizeDiff(
         }
 
         if s.Computed {
-                if d.Old != "" && d.New == "" {
-                        // This is a computed value with an old value set already,
-                        // just let it go.
-                        return nil
+                // FIXME: This is where the customized bool from getChange finally
+                //        comes into play.  It allows the previously incorrect behavior
+                //        of an empty string being used as "unset" when the value is
+                //        computed. This should be removed once we can properly
+                //        represent an unset/nil value from the configuration.
+                if !customized {
+                        if d.Old != "" && d.New == "" {
+                                // This is a computed value with an old value set already,
+                                // just let it go.
+                                return nil
+                        }
                 }
 
-                if d.New == "" {
+                if d.New == "" && !d.NewComputed {
                         // Computed attribute without a new value set
                         d.NewComputed = true
                 }
@@ -354,6 +367,13 @@ func (s *Schema) finalizeDiff(
 // schemaMap is a wrapper that adds nice functions on top of schemas.
 type schemaMap map[string]*Schema
 
+func (m schemaMap) panicOnError() bool {
+        if os.Getenv(PanicOnErr) != "" {
+                return true
+        }
+        return false
+}
+
 // Data returns a ResourceData for the given schema, state, and diff.
 //
 // The diff is optional.
@@ -361,17 +381,30 @@ func (m schemaMap) Data(
         s *terraform.InstanceState,
         d *terraform.InstanceDiff) (*ResourceData, error) {
         return &ResourceData{
-                schema: m,
-                state:  s,
-                diff:   d,
+                schema:       m,
+                state:        s,
+                diff:         d,
+                panicOnError: m.panicOnError(),
         }, nil
 }
 
+// DeepCopy returns a copy of this schemaMap. The copy can be safely modified
+// without affecting the original.
+func (m *schemaMap) DeepCopy() schemaMap {
+        copy, err := copystructure.Config{Lock: true}.Copy(m)
+        if err != nil {
+                panic(err)
+        }
+        return *copy.(*schemaMap)
+}
+
 // Diff returns the diff for a resource given the schema map,
 // state, and configuration.
 func (m schemaMap) Diff(
         s *terraform.InstanceState,
-        c *terraform.ResourceConfig) (*terraform.InstanceDiff, error) {
+        c *terraform.ResourceConfig,
+        customizeDiff CustomizeDiffFunc,
+        meta interface{}) (*terraform.InstanceDiff, error) {
         result := new(terraform.InstanceDiff)
         result.Attributes = make(map[string]*terraform.ResourceAttrDiff)
 
@@ -381,9 +414,10 @@ func (m schemaMap) Diff(
         }
 
         d := &ResourceData{
-                schema: m,
-                state:  s,
-                config: c,
+                schema:       m,
+                state:        s,
+                config:       c,
+                panicOnError: m.panicOnError(),
         }
 
         for k, schema := range m {
@@ -393,6 +427,29 @@ func (m schemaMap) Diff(
                 }
         }
 
+        // Remove any nil diffs just to keep things clean
+        for k, v := range result.Attributes {
+                if v == nil {
+                        delete(result.Attributes, k)
+                }
+        }
+
+        // If this is a non-destroy diff, call any custom diff logic that has been
+        // defined.
+        if !result.DestroyTainted && customizeDiff != nil {
+                mc := m.DeepCopy()
+                rd := newResourceDiff(mc, c, s, result)
+                if err := customizeDiff(rd, meta); err != nil {
+                        return nil, err
+                }
+                for _, k := range rd.UpdatedKeys() {
+                        err := m.diff(k, mc[k], result, rd, false)
+                        if err != nil {
+                                return nil, err
+                        }
+                }
+        }
+
         // If the diff requires a new resource, then we recompute the diff
         // so we have the complete new resource diff, and preserve the
         // RequiresNew fields where necessary so the user knows exactly what
@@ -418,6 +475,21 @@ func (m schemaMap) Diff(
                         }
                 }
 
+                // Re-run customization
+                if !result2.DestroyTainted && customizeDiff != nil {
+                        mc := m.DeepCopy()
+                        rd := newResourceDiff(mc, c, d.state, result2)
+                        if err := customizeDiff(rd, meta); err != nil {
+                                return nil, err
+                        }
+                        for _, k := range rd.UpdatedKeys() {
+                                err := m.diff(k, mc[k], result2, rd, false)
+                                if err != nil {
+                                        return nil, err
+                                }
+                        }
+                }
+
                 // Force all the fields to not force a new since we know what we
                 // want to force new.
                 for k, attr := range result2.Attributes {
@@ -456,13 +528,6 @@ func (m schemaMap) Diff(
                 result = result2
         }
 
-        // Remove any nil diffs just to keep things clean
-        for k, v := range result.Attributes {
-                if v == nil {
-                        delete(result.Attributes, k)
-                }
-        }
-
         // Go through and detect all of the ComputedWhens now that we've
         // finished the diff.
         // TODO
@@ -681,11 +746,23 @@ func isValidFieldName(name string) bool {
         return re.MatchString(name)
 }
 
+// resourceDiffer is an interface that is used by the private diff functions.
+// This helps facilitate diff logic for both ResourceData and ResoureDiff with
+// minimal divergence in code.
+type resourceDiffer interface {
+        diffChange(string) (interface{}, interface{}, bool, bool, bool)
+        Get(string) interface{}
+        GetChange(string) (interface{}, interface{})
+        GetOk(string) (interface{}, bool)
+        HasChange(string) bool
+        Id() string
+}
+
 func (m schemaMap) diff(
         k string,
         schema *Schema,
         diff *terraform.InstanceDiff,
-        d *ResourceData,
+        d resourceDiffer,
         all bool) error {
 
         unsupressedDiff := new(terraform.InstanceDiff)
@@ -706,12 +783,14 @@ func (m schemaMap) diff(
         }
 
         for attrK, attrV := range unsupressedDiff.Attributes {
-                if schema.DiffSuppressFunc != nil &&
-                        attrV != nil &&
-                        schema.DiffSuppressFunc(attrK, attrV.Old, attrV.New, d) {
-                        continue
+                switch rd := d.(type) {
+                case *ResourceData:
+                        if schema.DiffSuppressFunc != nil &&
+                                attrV != nil &&
+                                schema.DiffSuppressFunc(attrK, attrV.Old, attrV.New, rd) {
+                                continue
+                        }
                 }
-
                 diff.Attributes[attrK] = attrV
         }
 
@@ -722,9 +801,9 @@ func (m schemaMap) diffList(
         k string,
         schema *Schema,
         diff *terraform.InstanceDiff,
-        d *ResourceData,
+        d resourceDiffer,
         all bool) error {
-        o, n, _, computedList := d.diffChange(k)
+        o, n, _, computedList, customized := d.diffChange(k)
         if computedList {
                 n = nil
         }
@@ -791,10 +870,13 @@ func (m schemaMap) diffList(
                         oldStr = ""
                 }
 
-                diff.Attributes[k+".#"] = countSchema.finalizeDiff(&terraform.ResourceAttrDiff{
-                        Old: oldStr,
-                        New: newStr,
-                })
+                diff.Attributes[k+".#"] = countSchema.finalizeDiff(
+                        &terraform.ResourceAttrDiff{
+                                Old: oldStr,
+                                New: newStr,
+                        },
+                        customized,
+                )
         }
 
         // Figure out the maximum
@@ -841,13 +923,13 @@ func (m schemaMap) diffMap(
         k string,
         schema *Schema,
         diff *terraform.InstanceDiff,
-        d *ResourceData,
+        d resourceDiffer,
         all bool) error {
         prefix := k + "."
 
         // First get all the values from the state
         var stateMap, configMap map[string]string
-        o, n, _, nComputed := d.diffChange(k)
+        o, n, _, nComputed, customized := d.diffChange(k)
         if err := mapstructure.WeakDecode(o, &stateMap); err != nil {
                 return fmt.Errorf("%s: %s", k, err)
         }
@@ -899,6 +981,7 @@ func (m schemaMap) diffMap(
                                 Old: oldStr,
                                 New: newStr,
                         },
+                        customized,
                 )
         }
 
@@ -916,16 +999,22 @@ func (m schemaMap) diffMap(
                         continue
                 }
 
-                diff.Attributes[prefix+k] = schema.finalizeDiff(&terraform.ResourceAttrDiff{
-                        Old: old,
-                        New: v,
-                })
+                diff.Attributes[prefix+k] = schema.finalizeDiff(
+                        &terraform.ResourceAttrDiff{
+                                Old: old,
+                                New: v,
+                        },
+                        customized,
+                )
         }
         for k, v := range stateMap {
-                diff.Attributes[prefix+k] = schema.finalizeDiff(&terraform.ResourceAttrDiff{
-                        Old:        v,
-                        NewRemoved: true,
-                })
+                diff.Attributes[prefix+k] = schema.finalizeDiff(
+                        &terraform.ResourceAttrDiff{
+                                Old:        v,
+                                NewRemoved: true,
+                        },
+                        customized,
+                )
         }
 
         return nil
@@ -935,10 +1024,10 @@ func (m schemaMap) diffSet(
         k string,
         schema *Schema,
         diff *terraform.InstanceDiff,
-        d *ResourceData,
+        d resourceDiffer,
         all bool) error {
 
-        o, n, _, computedSet := d.diffChange(k)
+        o, n, _, computedSet, customized := d.diffChange(k)
         if computedSet {
                 n = nil
         }
@@ -997,20 +1086,26 @@ func (m schemaMap) diffSet(
                         countStr = ""
                 }
 
-                diff.Attributes[k+".#"] = countSchema.finalizeDiff(&terraform.ResourceAttrDiff{
-                        Old:         countStr,
-                        NewComputed: true,
-                })
+                diff.Attributes[k+".#"] = countSchema.finalizeDiff(
+                        &terraform.ResourceAttrDiff{
+                                Old:         countStr,
+                                NewComputed: true,
+                        },
+                        customized,
+                )
                 return nil
         }
 
         // If the counts are not the same, then record that diff
         changed := oldLen != newLen
         if changed || all {
-                diff.Attributes[k+".#"] = countSchema.finalizeDiff(&terraform.ResourceAttrDiff{
-                        Old: oldStr,
-                        New: newStr,
-                })
+                diff.Attributes[k+".#"] = countSchema.finalizeDiff(
+                        &terraform.ResourceAttrDiff{
+                                Old: oldStr,
+                                New: newStr,
+                        },
+                        customized,
+                )
         }
 
         // Build the list of codes that will make up our set. This is the
@@ -1056,11 +1151,11 @@ func (m schemaMap) diffString(
         k string,
         schema *Schema,
         diff *terraform.InstanceDiff,
-        d *ResourceData,
+        d resourceDiffer,
         all bool) error {
         var originalN interface{}
         var os, ns string
-        o, n, _, computed := d.diffChange(k)
+        o, n, _, computed, customized := d.diffChange(k)
         if schema.StateFunc != nil && n != nil {
                 originalN = n
                 n = schema.StateFunc(n)
@@ -1090,20 +1185,23 @@ func (m schemaMap) diffString(
         }
 
         removed := false
-        if o != nil && n == nil {
+        if o != nil && n == nil && !computed {
                 removed = true
         }
         if removed && schema.Computed {
                 return nil
         }
 
-        diff.Attributes[k] = schema.finalizeDiff(&terraform.ResourceAttrDiff{
-                Old:         os,
-                New:         ns,
-                NewExtra:    originalN,
-                NewRemoved:  removed,
-                NewComputed: computed,
-        })
+        diff.Attributes[k] = schema.finalizeDiff(
+                &terraform.ResourceAttrDiff{
+                        Old:         os,
+                        New:         ns,
+                        NewExtra:    originalN,
+                        NewRemoved:  removed,
+                        NewComputed: computed,
+                },
+                customized,
+        )
 
         return nil
 }
@@ -1172,9 +1270,9 @@ func (m schemaMap) validateConflictingAttributes(
         }
 
         for _, conflicting_key := range schema.ConflictsWith {
-                if value, ok := c.Get(conflicting_key); ok {
+                if _, ok := c.Get(conflicting_key); ok {
                         return fmt.Errorf(
-                                "%q: conflicts with %s (%#v)", k, conflicting_key, value)
+                                "%q: conflicts with %s", k, conflicting_key)
                 }
         }
 
@@ -1363,13 +1461,10 @@ func getValueType(k string, schema *Schema) (ValueType, error) {
                 return vt, nil
         }
 
+        // If a Schema is provided to a Map, we use the Type of that schema
+        // as the type for each element in the Map.
         if s, ok := schema.Elem.(*Schema); ok {
-                if s.Elem == nil {
-                        return TypeString, nil
-                }
-                if vt, ok := s.Elem.(ValueType); ok {
-                        return vt, nil
-                }
+                return s.Type, nil
         }
 
         if _, ok := schema.Elem.(*Resource); ok {
@@ -1430,7 +1525,6 @@ func (m schemaMap) validatePrimitive(
         raw interface{},
         schema *Schema,
         c *terraform.ResourceConfig) ([]string, []error) {
-
         // Catch if the user gave a complex type where a primitive was
         // expected, so we can return a friendly error message that
         // doesn't contain Go type system terminology.
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/set.go b/vendor/github.com/hashicorp/terraform/helper/schema/set.go
index de05f40..cba2890 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/set.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/set.go
@@ -17,6 +17,12 @@ func HashString(v interface{}) int {
         return hashcode.String(v.(string))
 }
 
+// HashInt hashes integers. If you want a Set of integers, this is the
+// SchemaSetFunc you want.
+func HashInt(v interface{}) int {
+        return hashcode.String(strconv.Itoa(v.(int)))
+}
+
 // HashResource hashes complex structures that are described using
 // a *Resource. This is the default set implementation used when a set's
 // element type is a full resource.
@@ -153,6 +159,31 @@ func (s *Set) Equal(raw interface{}) bool {
         return reflect.DeepEqual(s.m, other.m)
 }
 
+// HashEqual simply checks to the keys the top-level map to the keys in the
+// other set's top-level map to see if they are equal. This obviously assumes
+// you have a properly working hash function - use HashResource if in doubt.
+func (s *Set) HashEqual(raw interface{}) bool {
+        other, ok := raw.(*Set)
+        if !ok {
+                return false
+        }
+
+        ks1 := make([]string, 0)
+        ks2 := make([]string, 0)
+
+        for k := range s.m {
+                ks1 = append(ks1, k)
+        }
+        for k := range other.m {
+                ks2 = append(ks2, k)
+        }
+
+        sort.Strings(ks1)
+        sort.Strings(ks2)
+
+        return reflect.DeepEqual(ks1, ks2)
+}
+
 func (s *Set) GoString() string {
         return fmt.Sprintf("*Set(%#v)", s.m)
 }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/testing.go b/vendor/github.com/hashicorp/terraform/helper/schema/testing.go
index 9765bdb..da754ac 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/testing.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/testing.go
@@ -10,13 +10,15 @@ import (
 // TestResourceDataRaw creates a ResourceData from a raw configuration map.
 func TestResourceDataRaw(
         t *testing.T, schema map[string]*Schema, raw map[string]interface{}) *ResourceData {
+        t.Helper()
+
         c, err := config.NewRawConfig(raw)
         if err != nil {
                 t.Fatalf("err: %s", err)
         }
 
         sm := schemaMap(schema)
-        diff, err := sm.Diff(nil, terraform.NewResourceConfig(c))
+        diff, err := sm.Diff(nil, terraform.NewResourceConfig(c), nil, nil)
         if err != nil {
                 t.Fatalf("err: %s", err)
         }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go b/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go
index 1610cec..3bc3ac4 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go
@@ -2,7 +2,7 @@
 
 package schema
 
-import "fmt"
+import "strconv"
 
 const _ValueType_name = "TypeInvalidTypeBoolTypeIntTypeFloatTypeStringTypeListTypeMapTypeSettypeObject"
 
@@ -10,7 +10,7 @@ var _ValueType_index = [...]uint8{0, 11, 19, 26, 35, 45, 53, 60, 67, 77}
 
 func (i ValueType) String() string {
         if i < 0 || i >= ValueType(len(_ValueType_index)-1) {
-                return fmt.Sprintf("ValueType(%d)", i)
+                return "ValueType(" + strconv.FormatInt(int64(i), 10) + ")"
         }
         return _ValueType_name[_ValueType_index[i]:_ValueType_index[i+1]]
 }
diff --git a/vendor/github.com/hashicorp/terraform/helper/shadow/closer.go b/vendor/github.com/hashicorp/terraform/helper/shadow/closer.go
deleted file mode 100644
index edc1e2a..0000000
--- a/vendor/github.com/hashicorp/terraform/helper/shadow/closer.go
+++ /dev/null
@@ -1,83 +0,0 @@
-package shadow
-
-import (
-        "fmt"
-        "io"
-        "reflect"
-
-        "github.com/hashicorp/go-multierror"
-        "github.com/mitchellh/reflectwalk"
-)
-
-// Close will close all shadow values within the given structure.
-//
-// This uses reflection to walk the structure, find all shadow elements,
-// and close them. Currently this will only find struct fields that are
-// shadow values, and not slice elements, etc.
-func Close(v interface{}) error {
-        // We require a pointer so we can address the internal fields
-        val := reflect.ValueOf(v)
-        if val.Kind() != reflect.Ptr {
-                return fmt.Errorf("value must be a pointer")
-        }
-
-        // Walk and close
-        var w closeWalker
-        if err := reflectwalk.Walk(v, &w); err != nil {
-                return err
-        }
-
-        return w.Err
-}
-
-type closeWalker struct {
-        Err error
-}
-
-func (w *closeWalker) Struct(reflect.Value) error {
-        // Do nothing. We implement this for reflectwalk.StructWalker
-        return nil
-}
-
-var closerType = reflect.TypeOf((*io.Closer)(nil)).Elem()
-
-func (w *closeWalker) StructField(f reflect.StructField, v reflect.Value) error {
-        // Not sure why this would be but lets avoid some panics
-        if !v.IsValid() {
-                return nil
-        }
-
-        // Empty for exported, so don't check unexported fields
-        if f.PkgPath != "" {
-                return nil
-        }
-
-        // Verify the io.Closer is in this package
-        typ := v.Type()
-        if typ.PkgPath() != "github.com/hashicorp/terraform/helper/shadow" {
-                return nil
-        }
-
-        var closer io.Closer
-        if v.Type().Implements(closerType) {
-                closer = v.Interface().(io.Closer)
-        } else if v.CanAddr() {
-                // The Close method may require a pointer receiver, but we only have a value.
-                v := v.Addr()
-                if v.Type().Implements(closerType) {
-                        closer = v.Interface().(io.Closer)
-                }
-        }
-
-        if closer == nil {
-                return reflectwalk.SkipEntry
-        }
-
-        // Close it
-        if err := closer.Close(); err != nil {
-                w.Err = multierror.Append(w.Err, err)
-        }
-
-        // Don't go into the struct field
-        return reflectwalk.SkipEntry
-}
diff --git a/vendor/github.com/hashicorp/terraform/helper/shadow/compared_value.go b/vendor/github.com/hashicorp/terraform/helper/shadow/compared_value.go
deleted file mode 100644
index 4223e92..0000000
--- a/vendor/github.com/hashicorp/terraform/helper/shadow/compared_value.go
+++ /dev/null
@@ -1,128 +0,0 @@
-package shadow
-
-import (
-        "sync"
-)
-
-// ComparedValue is a struct that finds a value by comparing some key
-// to the list of stored values. This is useful when there is no easy
-// uniquely identifying key that works in a map (for that, use KeyedValue).
-//
-// ComparedValue is very expensive, relative to other Value types. Try to
-// limit the number of values stored in a ComparedValue by potentially
-// nesting it within a KeyedValue (a keyed value points to a compared value,
-// for example).
-type ComparedValue struct {
-        // Func is a function that is given the lookup key and a single
-        // stored value. If it matches, it returns true.
-        Func func(k, v interface{}) bool
-
-        lock    sync.Mutex
-        once    sync.Once
-        closed  bool
-        values  []interface{}
-        waiters map[interface{}]*Value
-}
-
-// Close closes the value. This can never fail. For a definition of
-// "close" see the ErrClosed docs.
-func (w *ComparedValue) Close() error {
-        w.lock.Lock()
-        defer w.lock.Unlock()
-
-        // Set closed to true always
-        w.closed = true
-
-        // For all waiters, complete with ErrClosed
-        for k, val := range w.waiters {
-                val.SetValue(ErrClosed)
-                delete(w.waiters, k)
-        }
-
-        return nil
-}
-
-// Value returns the value that was set for the given key, or blocks
-// until one is available.
-func (w *ComparedValue) Value(k interface{}) interface{} {
-        v, val := w.valueWaiter(k)
-        if val == nil {
-                return v
-        }
-
-        return val.Value()
-}
-
-// ValueOk gets the value for the given key, returning immediately if the
-// value doesn't exist. The second return argument is true if the value exists.
-func (w *ComparedValue) ValueOk(k interface{}) (interface{}, bool) {
-        v, val := w.valueWaiter(k)
-        return v, val == nil
-}
-
-func (w *ComparedValue) SetValue(v interface{}) {
-        w.lock.Lock()
-        defer w.lock.Unlock()
-        w.once.Do(w.init)
-
-        // Check if we already have this exact value (by simply comparing
-        // with == directly). If we do, then we don't insert it again.
-        found := false
-        for _, v2 := range w.values {
-                if v == v2 {
-                        found = true
-                        break
-                }
-        }
-
-        if !found {
-                // Set the value, always
-                w.values = append(w.values, v)
-        }
-
-        // Go through the waiters
-        for k, val := range w.waiters {
-                if w.Func(k, v) {
-                        val.SetValue(v)
-                        delete(w.waiters, k)
-                }
-        }
-}
-
-func (w *ComparedValue) valueWaiter(k interface{}) (interface{}, *Value) {
-        w.lock.Lock()
-        w.once.Do(w.init)
-
-        // Look for a pre-existing value
-        for _, v := range w.values {
-                if w.Func(k, v) {
-                        w.lock.Unlock()
-                        return v, nil
-                }
-        }
-
-        // If we're closed, return that
-        if w.closed {
-                w.lock.Unlock()
-                return ErrClosed, nil
-        }
-
-        // Pre-existing value doesn't exist, create a waiter
-        val := w.waiters[k]
-        if val == nil {
-                val = new(Value)
-                w.waiters[k] = val
-        }
-        w.lock.Unlock()
-
-        // Return the waiter
-        return nil, val
-}
-
-// Must be called with w.lock held.
-func (w *ComparedValue) init() {
-        w.waiters = make(map[interface{}]*Value)
-        if w.Func == nil {
-                w.Func = func(k, v interface{}) bool { return k == v }
-        }
-}
diff --git a/vendor/github.com/hashicorp/terraform/helper/shadow/keyed_value.go b/vendor/github.com/hashicorp/terraform/helper/shadow/keyed_value.go
deleted file mode 100644
index 432b036..0000000
--- a/vendor/github.com/hashicorp/terraform/helper/shadow/keyed_value.go
+++ /dev/null
@@ -1,151 +0,0 @@
-package shadow
-
-import (
-        "sync"
-)
-
-// KeyedValue is a struct that coordinates a value by key. If a value is
-// not available for a give key, it'll block until it is available.
-type KeyedValue struct {
-        lock    sync.Mutex
-        once    sync.Once
-        values  map[string]interface{}
-        waiters map[string]*Value
-        closed  bool
-}
-
-// Close closes the value. This can never fail. For a definition of
-// "close" see the ErrClosed docs.
-func (w *KeyedValue) Close() error {
-        w.lock.Lock()
-        defer w.lock.Unlock()
-
-        // Set closed to true always
-        w.closed = true
-
-        // For all waiters, complete with ErrClosed
-        for k, val := range w.waiters {
-                val.SetValue(ErrClosed)
-                delete(w.waiters, k)
-        }
-
-        return nil
-}
-
-// Value returns the value that was set for the given key, or blocks
-// until one is available.
-func (w *KeyedValue) Value(k string) interface{} {
-        w.lock.Lock()
-        v, val := w.valueWaiter(k)
-        w.lock.Unlock()
-
-        // If we have no waiter, then return the value
-        if val == nil {
-                return v
-        }
-
-        // We have a waiter, so wait
-        return val.Value()
-}
-
-// WaitForChange waits for the value with the given key to be set again.
-// If the key isn't set, it'll wait for an initial value. Note that while
-// it is called "WaitForChange", the value isn't guaranteed to _change_;
-// this will return when a SetValue is called for the given k.
-func (w *KeyedValue) WaitForChange(k string) interface{} {
-        w.lock.Lock()
-        w.once.Do(w.init)
-
-        // If we're closed, we're closed
-        if w.closed {
-                w.lock.Unlock()
-                return ErrClosed
-        }
-
-        // Check for an active waiter. If there isn't one, make it
-        val := w.waiters[k]
-        if val == nil {
-                val = new(Value)
-                w.waiters[k] = val
-        }
-        w.lock.Unlock()
-
-        // And wait
-        return val.Value()
-}
-
-// ValueOk gets the value for the given key, returning immediately if the
-// value doesn't exist. The second return argument is true if the value exists.
-func (w *KeyedValue) ValueOk(k string) (interface{}, bool) {
-        w.lock.Lock()
-        defer w.lock.Unlock()
-
-        v, val := w.valueWaiter(k)
-        return v, val == nil
-}
-
-func (w *KeyedValue) SetValue(k string, v interface{}) {
-        w.lock.Lock()
-        defer w.lock.Unlock()
-        w.setValue(k, v)
-}
-
-// Init will initialize the key to a given value only if the key has
-// not been set before. This is safe to call multiple times and in parallel.
-func (w *KeyedValue) Init(k string, v interface{}) {
-        w.lock.Lock()
-        defer w.lock.Unlock()
-
-        // If we have a waiter, set the value.
-        _, val := w.valueWaiter(k)
-        if val != nil {
-                w.setValue(k, v)
-        }
-}
-
-// Must be called with w.lock held.
-func (w *KeyedValue) init() {
-        w.values = make(map[string]interface{})
-        w.waiters = make(map[string]*Value)
-}
-
-// setValue is like SetValue but assumes the lock is held.
-func (w *KeyedValue) setValue(k string, v interface{}) {
-        w.once.Do(w.init)
-
-        // Set the value, always
-        w.values[k] = v
-
-        // If we have a waiter, set it
-        if val, ok := w.waiters[k]; ok {
-                val.SetValue(v)
-                delete(w.waiters, k)
-        }
-}
-
-// valueWaiter gets the value or the Value waiter for a given key.
-//
-// This must be called with lock held.
-func (w *KeyedValue) valueWaiter(k string) (interface{}, *Value) {
-        w.once.Do(w.init)
-
-        // If we have this value already, return it
-        if v, ok := w.values[k]; ok {
-                return v, nil
-        }
-
-        // If we're closed, return that
-        if w.closed {
-                return ErrClosed, nil
-        }
-
-        // No pending value, check for a waiter
-        val := w.waiters[k]
-        if val == nil {
-                val = new(Value)
-                w.waiters[k] = val
-        }
-
-        // Return the waiter
-        return nil, val
-}
diff --git a/vendor/github.com/hashicorp/terraform/helper/shadow/ordered_value.go b/vendor/github.com/hashicorp/terraform/helper/shadow/ordered_value.go
deleted file mode 100644
index 0a43d4d..0000000
--- a/vendor/github.com/hashicorp/terraform/helper/shadow/ordered_value.go
+++ /dev/null
@@ -1,66 +0,0 @@
-package shadow
-
-import (
-        "container/list"
-        "sync"
-)
-
-// OrderedValue is a struct that keeps track of a value in the order
-// it is set. Each time Value() is called, it will return the most recent
-// calls value then discard it.
-//
-// This is unlike Value that returns the same value once it is set.
-type OrderedValue struct {
-        lock    sync.Mutex
-        values  *list.List
-        waiters *list.List
-}
-
-// Value returns the last value that was set, or blocks until one
-// is received.
-func (w *OrderedValue) Value() interface{} {
-        w.lock.Lock()
-
-        // If we have a pending value already, use it
-        if w.values != nil && w.values.Len() > 0 {
-                front := w.values.Front()
-                w.values.Remove(front)
-                w.lock.Unlock()
-                return front.Value
-        }
-
-        // No pending value, create a waiter
-        if w.waiters == nil {
-                w.waiters = list.New()
-        }
-
-        var val Value
-        w.waiters.PushBack(&val)
-        w.lock.Unlock()
-
-        // Return the value once we have it
-        return val.Value()
-}
-
-// SetValue sets the latest value.
-func (w *OrderedValue) SetValue(v interface{}) {
-        w.lock.Lock()
-        defer w.lock.Unlock()
-
-        // If we have a waiter, notify it
-        if w.waiters != nil && w.waiters.Len() > 0 {
-                front := w.waiters.Front()
-                w.waiters.Remove(front)
-
-                val := front.Value.(*Value)
-                val.SetValue(v)
-                return
-        }
-
-        // Add it to the list of values
-        if w.values == nil {
-                w.values = list.New()
-        }
-
-        w.values.PushBack(v)
-}
diff --git a/vendor/github.com/hashicorp/terraform/helper/shadow/value.go b/vendor/github.com/hashicorp/terraform/helper/shadow/value.go
deleted file mode 100644
index 178b7e7..0000000
--- a/vendor/github.com/hashicorp/terraform/helper/shadow/value.go
+++ /dev/null
@@ -1,87 +0,0 @@
-package shadow
-
-import (
-        "errors"
-        "sync"
-)
-
-// ErrClosed is returned by any closed values.
-//
-// A "closed value" is when the shadow has been notified that the real
-// side is complete and any blocking values will _never_ be satisfied
-// in the future. In this case, this error is returned. If a value is already
-// available, that is still returned.
-var ErrClosed = errors.New("shadow closed")
-
-// Value is a struct that coordinates a value between two
-// parallel routines. It is similar to atomic.Value except that when
-// Value is called if it isn't set it will wait for it.
-//
-// The Value can be closed with Close, which will cause any future
-// blocking operations to return immediately with ErrClosed.
-type Value struct {
-        lock     sync.Mutex
-        cond     *sync.Cond
-        value    interface{}
-        valueSet bool
-}
-
-func (v *Value) Lock() {
-        v.lock.Lock()
-}
-
-func (v *Value) Unlock() {
-        v.lock.Unlock()
-}
-
-// Close closes the value. This can never fail. For a definition of
-// "close" see the struct docs.
-func (w *Value) Close() error {
-        w.lock.Lock()
-        set := w.valueSet
-        w.lock.Unlock()
-
-        // If we haven't set the value, set it
-        if !set {
-                w.SetValue(ErrClosed)
-        }
-
-        // Done
-        return nil
-}
-
-// Value returns the value that was set.
-func (w *Value) Value() interface{} {
-        w.lock.Lock()
-        defer w.lock.Unlock()
-
-        // If we already have a value just return
-        for !w.valueSet {
-                // No value, setup the condition variable if we have to
-                if w.cond == nil {
-                        w.cond = sync.NewCond(&w.lock)
-                }
-
-                // Wait on it
-                w.cond.Wait()
-        }
-
-        // Return the value
-        return w.value
-}
-
-// SetValue sets the value.
-func (w *Value) SetValue(v interface{}) {
-        w.lock.Lock()
-        defer w.lock.Unlock()
-
-        // Set the value
-        w.valueSet = true
-        w.value = v
-
-        // If we have a condition, clear it
-        if w.cond != nil {
-                w.cond.Broadcast()
-                w.cond = nil
-        }
-}
diff --git a/vendor/github.com/hashicorp/terraform/httpclient/client.go b/vendor/github.com/hashicorp/terraform/httpclient/client.go
new file mode 100644
index 0000000..bb06beb
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/httpclient/client.go
@@ -0,0 +1,18 @@
+package httpclient
+
+import (
+        "net/http"
+
+        cleanhttp "github.com/hashicorp/go-cleanhttp"
+)
+
+// New returns the DefaultPooledClient from the cleanhttp
+// package that will also send a Terraform User-Agent string.
+func New() *http.Client {
+        cli := cleanhttp.DefaultPooledClient()
+        cli.Transport = &userAgentRoundTripper{
+                userAgent: UserAgentString(),
+                inner:     cli.Transport,
+        }
+        return cli
+}
diff --git a/vendor/github.com/hashicorp/terraform/httpclient/useragent.go b/vendor/github.com/hashicorp/terraform/httpclient/useragent.go
new file mode 100644
index 0000000..5e28017
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/httpclient/useragent.go
@@ -0,0 +1,40 @@
+package httpclient
+
+import (
+        "fmt"
+        "log"
+        "net/http"
+        "os"
+        "strings"
+
+        "github.com/hashicorp/terraform/version"
+)
+
+const userAgentFormat = "Terraform/%s"
+const uaEnvVar = "TF_APPEND_USER_AGENT"
+
+func UserAgentString() string {
+        ua := fmt.Sprintf(userAgentFormat, version.Version)
+
+        if add := os.Getenv(uaEnvVar); add != "" {
+                add = strings.TrimSpace(add)
+                if len(add) > 0 {
+                        ua += " " + add
+                        log.Printf("[DEBUG] Using modified User-Agent: %s", ua)
+                }
+        }
+
+        return ua
+}
+
+type userAgentRoundTripper struct {
+        inner     http.RoundTripper
+        userAgent string
+}
+
+func (rt *userAgentRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+        if _, ok := req.Header["User-Agent"]; !ok {
+                req.Header.Set("User-Agent", rt.userAgent)
+        }
+        return rt.inner.RoundTrip(req)
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/client.go b/vendor/github.com/hashicorp/terraform/plugin/client.go
index 3a5cb7a..7e2f4fe 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/client.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/client.go
@@ -1,8 +1,10 @@
 package plugin
 
 import (
+        "os"
         "os/exec"
 
+        hclog "github.com/hashicorp/go-hclog"
         plugin "github.com/hashicorp/go-plugin"
         "github.com/hashicorp/terraform/plugin/discovery"
 )
@@ -10,11 +12,18 @@ import (
 // ClientConfig returns a configuration object that can be used to instantiate
 // a client for the plugin described by the given metadata.
 func ClientConfig(m discovery.PluginMeta) *plugin.ClientConfig {
+        logger := hclog.New(&hclog.LoggerOptions{
+                Name:   "plugin",
+                Level:  hclog.Trace,
+                Output: os.Stderr,
+        })
+
         return &plugin.ClientConfig{
                 Cmd:             exec.Command(m.Path),
                 HandshakeConfig: Handshake,
                 Managed:         true,
                 Plugins:         PluginMap,
+                Logger:          logger,
         }
 }
 
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/find.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/find.go
index f5bc4c1..f053312 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/discovery/find.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/find.go
@@ -3,6 +3,7 @@ package discovery
 import (
         "io/ioutil"
         "log"
+        "os"
         "path/filepath"
         "strings"
 )
@@ -59,7 +60,6 @@ func findPluginPaths(kind string, dirs []string) []string {
                         fullName := item.Name()
 
                         if !strings.HasPrefix(fullName, prefix) {
-                                log.Printf("[DEBUG] skipping %q, not a %s", fullName, kind)
                                 continue
                         }
 
@@ -71,6 +71,12 @@ func findPluginPaths(kind string, dirs []string) []string {
                                         continue
                                 }
 
+                                // Check that the file we found is usable
+                                if !pathIsFile(absPath) {
+                                        log.Printf("[ERROR] ignoring non-file %s", absPath)
+                                        continue
+                                }
+
                                 log.Printf("[DEBUG] found %s %q", kind, fullName)
                                 ret = append(ret, filepath.Clean(absPath))
                                 continue
@@ -83,7 +89,13 @@ func findPluginPaths(kind string, dirs []string) []string {
                                 continue
                         }
 
-                        log.Printf("[WARNING] found legacy %s %q", kind, fullName)
+                        // Check that the file we found is usable
+                        if !pathIsFile(absPath) {
+                                log.Printf("[ERROR] ignoring non-file %s", absPath)
+                                continue
+                        }
+
+                        log.Printf("[WARN] found legacy %s %q", kind, fullName)
 
                         ret = append(ret, filepath.Clean(absPath))
                 }
@@ -92,6 +104,17 @@ func findPluginPaths(kind string, dirs []string) []string {
         return ret
 }
 
+// Returns true if and only if the given path refers to a file or a symlink
+// to a file.
+func pathIsFile(path string) bool {
+        info, err := os.Stat(path)
+        if err != nil {
+                return false
+        }
+
+        return !info.IsDir()
+}
+
 // ResolvePluginPaths takes a list of paths to plugin executables (as returned
 // by e.g. FindPluginPaths) and produces a PluginMetaSet describing the
 // referenced plugins.
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/get.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/get.go
index 241b5cb..815640f 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/discovery/get.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/get.go
@@ -3,19 +3,22 @@ package discovery
 import (
         "errors"
         "fmt"
+        "io"
         "io/ioutil"
         "log"
         "net/http"
         "os"
+        "path/filepath"
         "runtime"
         "strconv"
         "strings"
 
         "golang.org/x/net/html"
 
-        cleanhttp "github.com/hashicorp/go-cleanhttp"
         getter "github.com/hashicorp/go-getter"
         multierror "github.com/hashicorp/go-multierror"
+        "github.com/hashicorp/terraform/httpclient"
+        "github.com/mitchellh/cli"
 )
 
 // Releases are located by parsing the html listing from releases.hashicorp.com.
@@ -30,7 +33,19 @@ const protocolVersionHeader = "x-terraform-protocol-version"
 
 var releaseHost = "https://releases.hashicorp.com"
 
-var httpClient = cleanhttp.DefaultClient()
+var httpClient *http.Client
+
+func init() {
+        httpClient = httpclient.New()
+
+        httpGetter := &getter.HttpGetter{
+                Client: httpClient,
+                Netrc:  true,
+        }
+
+        getter.Getters["http"] = httpGetter
+        getter.Getters["https"] = httpGetter
+}
 
 // An Installer maintains a local cache of plugins by downloading plugins
 // from an online repository.
@@ -47,6 +62,10 @@ type Installer interface {
 type ProviderInstaller struct {
         Dir string
 
+        // Cache is used to access and update a local cache of plugins if non-nil.
+        // Can be nil to disable caching.
+        Cache PluginCache
+
         PluginProtocolVersion uint
 
         // OS and Arch specify the OS and architecture that should be used when
@@ -58,6 +77,8 @@ type ProviderInstaller struct {
 
         // Skip checksum and signature verification
         SkipVerify bool
+
+        Ui cli.Ui // Ui for output
 }
 
 // Get is part of an implementation of type Installer, and attempts to download
@@ -98,6 +119,12 @@ func (i *ProviderInstaller) Get(provider string, req Constraints) (PluginMeta, e
         // sort them newest to oldest
         Versions(versions).Sort()
 
+        // Ensure that our installation directory exists
+        err = os.MkdirAll(i.Dir, os.ModePerm)
+        if err != nil {
+                return PluginMeta{}, fmt.Errorf("failed to create plugin dir %s: %s", i.Dir, err)
+        }
+
         // take the first matching plugin we find
         for _, v := range versions {
                 url := i.providerURL(provider, v.String())
@@ -116,8 +143,9 @@ func (i *ProviderInstaller) Get(provider string, req Constraints) (PluginMeta, e
 
                 log.Printf("[DEBUG] fetching provider info for %s version %s", provider, v)
                 if checkPlugin(url, i.PluginProtocolVersion) {
-                        log.Printf("[DEBUG] getting provider %q version %q at %s", provider, v, url)
-                        err := getter.Get(i.Dir, url)
+                        i.Ui.Info(fmt.Sprintf("- Downloading plugin for provider %q (%s)...", provider, v.String()))
+                        log.Printf("[DEBUG] getting provider %q version %q", provider, v)
+                        err := i.install(provider, v, url)
                         if err != nil {
                                 return PluginMeta{}, err
                         }
@@ -164,6 +192,98 @@ func (i *ProviderInstaller) Get(provider string, req Constraints) (PluginMeta, e
         return PluginMeta{}, ErrorNoVersionCompatible
 }
 
+func (i *ProviderInstaller) install(provider string, version Version, url string) error {
+        if i.Cache != nil {
+                log.Printf("[DEBUG] looking for provider %s %s in plugin cache", provider, version)
+                cached := i.Cache.CachedPluginPath("provider", provider, version)
+                if cached == "" {
+                        log.Printf("[DEBUG] %s %s not yet in cache, so downloading %s", provider, version, url)
+                        err := getter.Get(i.Cache.InstallDir(), url)
+                        if err != nil {
+                                return err
+                        }
+                        // should now be in cache
+                        cached = i.Cache.CachedPluginPath("provider", provider, version)
+                        if cached == "" {
+                                // should never happen if the getter is behaving properly
+                                // and the plugins are packaged properly.
+                                return fmt.Errorf("failed to find downloaded plugin in cache %s", i.Cache.InstallDir())
+                        }
+                }
+
+                // Link or copy the cached binary into our install dir so the
+                // normal resolution machinery can find it.
+                filename := filepath.Base(cached)
+                targetPath := filepath.Join(i.Dir, filename)
+
+                log.Printf("[DEBUG] installing %s %s to %s from local cache %s", provider, version, targetPath, cached)
+
+                // Delete if we can. If there's nothing there already then no harm done.
+                // This is important because we can't create a link if there's
+                // already a file of the same name present.
+                // (any other error here we'll catch below when we try to write here)
+                os.Remove(targetPath)
+
+                // We don't attempt linking on Windows because links are not
+                // comprehensively supported by all tools/apps in Windows and
+                // so we choose to be conservative to avoid creating any
+                // weird issues for Windows users.
+                linkErr := errors.New("link not supported for Windows") // placeholder error, never actually returned
+                if runtime.GOOS != "windows" {
+                        // Try hard linking first. Hard links are preferable because this
+                        // creates a self-contained directory that doesn't depend on the
+                        // cache after install.
+                        linkErr = os.Link(cached, targetPath)
+
+                        // If that failed, try a symlink. This _does_ depend on the cache
+                        // after install, so the user must manage the cache more carefully
+                        // in this case, but avoids creating redundant copies of the
+                        // plugins on disk.
+                        if linkErr != nil {
+                                linkErr = os.Symlink(cached, targetPath)
+                        }
+                }
+
+                // If we still have an error then we'll try a copy as a fallback.
+                // In this case either the OS is Windows or the target filesystem
+                // can't support symlinks.
+                if linkErr != nil {
+                        srcFile, err := os.Open(cached)
+                        if err != nil {
+                                return fmt.Errorf("failed to open cached plugin %s: %s", cached, err)
+                        }
+                        defer srcFile.Close()
+
+                        destFile, err := os.OpenFile(targetPath, os.O_TRUNC|os.O_CREATE|os.O_WRONLY, os.ModePerm)
+                        if err != nil {
+                                return fmt.Errorf("failed to create %s: %s", targetPath, err)
+                        }
+
+                        _, err = io.Copy(destFile, srcFile)
+                        if err != nil {
+                                destFile.Close()
+                                return fmt.Errorf("failed to copy cached plugin from %s to %s: %s", cached, targetPath, err)
+                        }
+
+                        err = destFile.Close()
+                        if err != nil {
+                                return fmt.Errorf("error creating %s: %s", targetPath, err)
+                        }
+                }
+
+                // One way or another, by the time we get here we should have either
+                // a link or a copy of the cached plugin within i.Dir, as expected.
+        } else {
+                log.Printf("[DEBUG] plugin cache is disabled, so downloading %s %s from %s", provider, version, url)
+                err := getter.Get(i.Dir, url)
+                if err != nil {
+                        return err
+                }
+        }
+
+        return nil
+}
+
 func (i *ProviderInstaller) PurgeUnused(used map[string]PluginMeta) (PluginMetaSet, error) {
         purge := make(PluginMetaSet)
 
@@ -261,7 +381,7 @@ func checkPlugin(url string, pluginProtocolVersion uint) bool {
         if proto == "" {
                 // The header isn't present, but we don't make this error fatal since
                 // the latest version will probably work.
-                log.Printf("[WARNING] missing %s from: %s", protocolVersionHeader, url)
+                log.Printf("[WARN] missing %s from: %s", protocolVersionHeader, url)
                 return true
         }
 
@@ -422,3 +542,7 @@ func getFile(url string) ([]byte, error) {
         }
         return data, nil
 }
+
+func GetReleaseHost() string {
+        return releaseHost
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/discovery/get_cache.go b/vendor/github.com/hashicorp/terraform/plugin/discovery/get_cache.go
new file mode 100644
index 0000000..1a10042
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/plugin/discovery/get_cache.go
@@ -0,0 +1,48 @@
+package discovery
+
+// PluginCache is an interface implemented by objects that are able to maintain
+// a cache of plugins.
+type PluginCache interface {
+        // CachedPluginPath returns a path where the requested plugin is already
+        // cached, or an empty string if the requested plugin is not yet cached.
+        CachedPluginPath(kind string, name string, version Version) string
+
+        // InstallDir returns the directory that new plugins should be installed into
+        // in order to populate the cache. This directory should be used as the
+        // first argument to getter.Get when downloading plugins with go-getter.
+        //
+        // After installing into this directory, use CachedPluginPath to obtain the
+        // path where the plugin was installed.
+        InstallDir() string
+}
+
+// NewLocalPluginCache returns a PluginCache that caches plugins in a
+// given local directory.
+func NewLocalPluginCache(dir string) PluginCache {
+        return &pluginCache{
+                Dir: dir,
+        }
+}
+
+type pluginCache struct {
+        Dir string
+}
+
+func (c *pluginCache) CachedPluginPath(kind string, name string, version Version) string {
+        allPlugins := FindPlugins(kind, []string{c.Dir})
+        plugins := allPlugins.WithName(name).WithVersion(version)
+
+        if plugins.Count() == 0 {
+                // nothing cached
+                return ""
+        }
+
+        // There should generally be only one plugin here; if there's more than
+        // one match for some reason then we'll just choose one arbitrarily.
+        plugin := plugins.Newest()
+        return plugin.Path
+}
+
+func (c *pluginCache) InstallDir() string {
+        return c.Dir
+}
diff --git a/vendor/github.com/hashicorp/terraform/plugin/resource_provider.go b/vendor/github.com/hashicorp/terraform/plugin/resource_provider.go
index 473f786..d6a433c 100644
--- a/vendor/github.com/hashicorp/terraform/plugin/resource_provider.go
+++ b/vendor/github.com/hashicorp/terraform/plugin/resource_provider.go
@@ -41,6 +41,24 @@ func (p *ResourceProvider) Stop() error {
         return err
 }
 
+func (p *ResourceProvider) GetSchema(req *terraform.ProviderSchemaRequest) (*terraform.ProviderSchema, error) {
+        var result ResourceProviderGetSchemaResponse
+        args := &ResourceProviderGetSchemaArgs{
+                Req: req,
+        }
+
+        err := p.Client.Call("Plugin.GetSchema", args, &result)
+        if err != nil {
+                return nil, err
+        }
+
+        if result.Error != nil {
+                err = result.Error
+        }
+
+        return result.Schema, err
+}
+
 func (p *ResourceProvider) Input(
         input terraform.UIInput,
         c *terraform.ResourceConfig) (*terraform.ResourceConfig, error) {
@@ -312,6 +330,15 @@ type ResourceProviderStopResponse struct {
         Error *plugin.BasicError
 }
 
+type ResourceProviderGetSchemaArgs struct {
+        Req *terraform.ProviderSchemaRequest
+}
+
+type ResourceProviderGetSchemaResponse struct {
+        Schema *terraform.ProviderSchema
+        Error  *plugin.BasicError
+}
+
 type ResourceProviderConfigureResponse struct {
         Error *plugin.BasicError
 }
@@ -418,6 +445,18 @@ func (s *ResourceProviderServer) Stop(
         return nil
 }
 
+func (s *ResourceProviderServer) GetSchema(
+        args *ResourceProviderGetSchemaArgs,
+        result *ResourceProviderGetSchemaResponse,
+) error {
+        schema, err := s.Provider.GetSchema(args.Req)
+        result.Schema = schema
+        if err != nil {
+                result.Error = plugin.NewBasicError(err)
+        }
+        return nil
+}
+
 func (s *ResourceProviderServer) Input(
         args *ResourceProviderInputArgs,
         reply *ResourceProviderInputResponse) error {
diff --git a/vendor/github.com/hashicorp/terraform/registry/client.go b/vendor/github.com/hashicorp/terraform/registry/client.go
new file mode 100644
index 0000000..a18e6b8
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/client.go
@@ -0,0 +1,227 @@
+package registry
+
+import (
+        "encoding/json"
+        "fmt"
+        "io/ioutil"
+        "log"
+        "net/http"
+        "net/url"
+        "path"
+        "strings"
+        "time"
+
+        "github.com/hashicorp/terraform/httpclient"
+        "github.com/hashicorp/terraform/registry/regsrc"
+        "github.com/hashicorp/terraform/registry/response"
+        "github.com/hashicorp/terraform/svchost"
+        "github.com/hashicorp/terraform/svchost/disco"
+        "github.com/hashicorp/terraform/version"
+)
+
+const (
+        xTerraformGet     = "X-Terraform-Get"
+        xTerraformVersion = "X-Terraform-Version"
+        requestTimeout    = 10 * time.Second
+        serviceID         = "modules.v1"
+)
+
+var tfVersion = version.String()
+
+// Client provides methods to query Terraform Registries.
+type Client struct {
+        // this is the client to be used for all requests.
+        client *http.Client
+
+        // services is a required *disco.Disco, which may have services and
+        // credentials pre-loaded.
+        services *disco.Disco
+}
+
+// NewClient returns a new initialized registry client.
+func NewClient(services *disco.Disco, client *http.Client) *Client {
+        if services == nil {
+                services = disco.New()
+        }
+
+        if client == nil {
+                client = httpclient.New()
+                client.Timeout = requestTimeout
+        }
+
+        services.Transport = client.Transport
+
+        return &Client{
+                client:   client,
+                services: services,
+        }
+}
+
+// Discover queries the host, and returns the url for the registry.
+func (c *Client) Discover(host svchost.Hostname) (*url.URL, error) {
+        service, err := c.services.DiscoverServiceURL(host, serviceID)
+        if err != nil {
+                return nil, err
+        }
+        if !strings.HasSuffix(service.Path, "/") {
+                service.Path += "/"
+        }
+        return service, nil
+}
+
+// Versions queries the registry for a module, and returns the available versions.
+func (c *Client) Versions(module *regsrc.Module) (*response.ModuleVersions, error) {
+        host, err := module.SvcHost()
+        if err != nil {
+                return nil, err
+        }
+
+        service, err := c.Discover(host)
+        if err != nil {
+                return nil, err
+        }
+
+        p, err := url.Parse(path.Join(module.Module(), "versions"))
+        if err != nil {
+                return nil, err
+        }
+
+        service = service.ResolveReference(p)
+
+        log.Printf("[DEBUG] fetching module versions from %q", service)
+
+        req, err := http.NewRequest("GET", service.String(), nil)
+        if err != nil {
+                return nil, err
+        }
+
+        c.addRequestCreds(host, req)
+        req.Header.Set(xTerraformVersion, tfVersion)
+
+        resp, err := c.client.Do(req)
+        if err != nil {
+                return nil, err
+        }
+        defer resp.Body.Close()
+
+        switch resp.StatusCode {
+        case http.StatusOK:
+                // OK
+        case http.StatusNotFound:
+                return nil, &errModuleNotFound{addr: module}
+        default:
+                return nil, fmt.Errorf("error looking up module versions: %s", resp.Status)
+        }
+
+        var versions response.ModuleVersions
+
+        dec := json.NewDecoder(resp.Body)
+        if err := dec.Decode(&versions); err != nil {
+                return nil, err
+        }
+
+        for _, mod := range versions.Modules {
+                for _, v := range mod.Versions {
+                        log.Printf("[DEBUG] found available version %q for %s", v.Version, mod.Source)
+                }
+        }
+
+        return &versions, nil
+}
+
+func (c *Client) addRequestCreds(host svchost.Hostname, req *http.Request) {
+        creds, err := c.services.CredentialsForHost(host)
+        if err != nil {
+                log.Printf("[WARN] Failed to get credentials for %s: %s (ignoring)", host, err)
+                return
+        }
+
+        if creds != nil {
+                creds.PrepareRequest(req)
+        }
+}
+
+// Location find the download location for a specific version module.
+// This returns a string, because the final location may contain special go-getter syntax.
+func (c *Client) Location(module *regsrc.Module, version string) (string, error) {
+        host, err := module.SvcHost()
+        if err != nil {
+                return "", err
+        }
+
+        service, err := c.Discover(host)
+        if err != nil {
+                return "", err
+        }
+
+        var p *url.URL
+        if version == "" {
+                p, err = url.Parse(path.Join(module.Module(), "download"))
+        } else {
+                p, err = url.Parse(path.Join(module.Module(), version, "download"))
+        }
+        if err != nil {
+                return "", err
+        }
+        download := service.ResolveReference(p)
+
+        log.Printf("[DEBUG] looking up module location from %q", download)
+
+        req, err := http.NewRequest("GET", download.String(), nil)
+        if err != nil {
+                return "", err
+        }
+
+        c.addRequestCreds(host, req)
+        req.Header.Set(xTerraformVersion, tfVersion)
+
+        resp, err := c.client.Do(req)
+        if err != nil {
+                return "", err
+        }
+        defer resp.Body.Close()
+
+        // there should be no body, but save it for logging
+        body, err := ioutil.ReadAll(resp.Body)
+        if err != nil {
+                return "", fmt.Errorf("error reading response body from registry: %s", err)
+        }
+
+        switch resp.StatusCode {
+        case http.StatusOK, http.StatusNoContent:
+                // OK
+        case http.StatusNotFound:
+                return "", fmt.Errorf("module %q version %q not found", module, version)
+        default:
+                // anything else is an error:
+                return "", fmt.Errorf("error getting download location for %q: %s resp:%s", module, resp.Status, body)
+        }
+
+        // the download location is in the X-Terraform-Get header
+        location := resp.Header.Get(xTerraformGet)
+        if location == "" {
+                return "", fmt.Errorf("failed to get download URL for %q: %s resp:%s", module, resp.Status, body)
+        }
+
+        // If location looks like it's trying to be a relative URL, treat it as
+        // one.
+        //
+        // We don't do this for just _any_ location, since the X-Terraform-Get
+        // header is a go-getter location rather than a URL, and so not all
+        // possible values will parse reasonably as URLs.)
+        //
+        // When used in conjunction with go-getter we normally require this header
+        // to be an absolute URL, but we are more liberal here because third-party
+        // registry implementations may not "know" their own absolute URLs if
+        // e.g. they are running behind a reverse proxy frontend, or such.
+        if strings.HasPrefix(location, "/") || strings.HasPrefix(location, "./") || strings.HasPrefix(location, "../") {
+                locationURL, err := url.Parse(location)
+                if err != nil {
+                        return "", fmt.Errorf("invalid relative URL for %q: %s", module, err)
+                }
+                locationURL = download.ResolveReference(locationURL)
+                location = locationURL.String()
+        }
+
+        return location, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/errors.go b/vendor/github.com/hashicorp/terraform/registry/errors.go
new file mode 100644
index 0000000..b8dcd31
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/errors.go
@@ -0,0 +1,23 @@
+package registry
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/registry/regsrc"
+)
+
+type errModuleNotFound struct {
+        addr *regsrc.Module
+}
+
+func (e *errModuleNotFound) Error() string {
+        return fmt.Sprintf("module %s not found", e.addr)
+}
+
+// IsModuleNotFound returns true only if the given error is a "module not found"
+// error. This allows callers to recognize this particular error condition
+// as distinct from operational errors such as poor network connectivity.
+func IsModuleNotFound(err error) bool {
+        _, ok := err.(*errModuleNotFound)
+        return ok
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/regsrc/friendly_host.go b/vendor/github.com/hashicorp/terraform/registry/regsrc/friendly_host.go
new file mode 100644
index 0000000..14b4dce
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/regsrc/friendly_host.go
@@ -0,0 +1,140 @@
+package regsrc
+
+import (
+        "regexp"
+        "strings"
+
+        "github.com/hashicorp/terraform/svchost"
+)
+
+var (
+        // InvalidHostString is a placeholder returned when a raw host can't be
+        // converted by IDNA spec. It will never be returned for any host for which
+        // Valid() is true.
+        InvalidHostString = "<invalid host>"
+
+        // urlLabelEndSubRe is a sub-expression that matches any character that's
+        // allowed at the start or end of a URL label according to RFC1123.
+        urlLabelEndSubRe = "[0-9A-Za-z]"
+
+        // urlLabelEndSubRe is a sub-expression that matches any character that's
+        // allowed at in a non-start or end of a URL label according to RFC1123.
+        urlLabelMidSubRe = "[0-9A-Za-z-]"
+
+        // urlLabelUnicodeSubRe is a sub-expression that matches any non-ascii char
+        // in an IDN (Unicode) display URL. It's not strict - there are only ~15k
+        // valid Unicode points in IDN RFC (some with conditions). We are just going
+        // with being liberal with matching and then erroring if we fail to convert
+        // to punycode later (which validates chars fully). This at least ensures
+        // ascii chars dissalowed by the RC1123 parts above don't become legal
+        // again.
+        urlLabelUnicodeSubRe = "[^[:ascii:]]"
+
+        // hostLabelSubRe is the sub-expression that matches a valid hostname label.
+        // It does not anchor the start or end so it can be composed into more
+        // complex RegExps below. Note that for sanity we don't handle disallowing
+        // raw punycode in this regexp (esp. since re2 doesn't support negative
+        // lookbehind, but we can capture it's presence here to check later).
+        hostLabelSubRe = "" +
+                // Match valid initial char, or unicode char
+                "(?:" + urlLabelEndSubRe + "|" + urlLabelUnicodeSubRe + ")" +
+                // Optionally, match 0 to 61 valid URL or Unicode chars,
+                // followed by one valid end char or unicode char
+                "(?:" +
+                "(?:" + urlLabelMidSubRe + "|" + urlLabelUnicodeSubRe + "){0,61}" +
+                "(?:" + urlLabelEndSubRe + "|" + urlLabelUnicodeSubRe + ")" +
+                ")?"
+
+        // hostSubRe is the sub-expression that matches a valid host prefix.
+        // Allows custom port.
+        hostSubRe = hostLabelSubRe + "(?:\\." + hostLabelSubRe + ")+(?::\\d+)?"
+
+        // hostRe is a regexp that matches a valid host prefix. Additional
+        // validation of unicode strings is needed for matches.
+        hostRe = regexp.MustCompile("^" + hostSubRe + "$")
+)
+
+// FriendlyHost describes a registry instance identified in source strings by a
+// simple bare hostname like registry.terraform.io.
+type FriendlyHost struct {
+        Raw string
+}
+
+func NewFriendlyHost(host string) *FriendlyHost {
+        return &FriendlyHost{Raw: host}
+}
+
+// ParseFriendlyHost attempts to parse a valid "friendly host" prefix from the
+// given string. If no valid prefix is found, host will be nil and rest will
+// contain the full source string. The host prefix must terminate at the end of
+// the input or at the first / character. If one or more characters exist after
+// the first /, they will be returned as rest (without the / delimiter).
+// Hostnames containing punycode WILL be parsed successfully since they may have
+// come from an internal normalized source string, however should be considered
+// invalid if the string came from a user directly. This must be checked
+// explicitly for user-input strings by calling Valid() on the
+// returned host.
+func ParseFriendlyHost(source string) (host *FriendlyHost, rest string) {
+        parts := strings.SplitN(source, "/", 2)
+
+        if hostRe.MatchString(parts[0]) {
+                host = &FriendlyHost{Raw: parts[0]}
+                if len(parts) == 2 {
+                        rest = parts[1]
+                }
+                return
+        }
+
+        // No match, return whole string as rest along with nil host
+        rest = source
+        return
+}
+
+// Valid returns whether the host prefix is considered valid in any case.
+// Example of invalid prefixes might include ones that don't conform to the host
+// name specifications. Not that IDN prefixes containing punycode are not valid
+// input which we expect to always be in user-input or normalised display form.
+func (h *FriendlyHost) Valid() bool {
+        return svchost.IsValid(h.Raw)
+}
+
+// Display returns the host formatted for display to the user in CLI or web
+// output.
+func (h *FriendlyHost) Display() string {
+        return svchost.ForDisplay(h.Raw)
+}
+
+// Normalized returns the host formatted for internal reference or comparison.
+func (h *FriendlyHost) Normalized() string {
+        host, err := svchost.ForComparison(h.Raw)
+        if err != nil {
+                return InvalidHostString
+        }
+        return string(host)
+}
+
+// String returns the host formatted as the user originally typed it assuming it
+// was parsed from user input.
+func (h *FriendlyHost) String() string {
+        return h.Raw
+}
+
+// Equal compares the FriendlyHost against another instance taking normalization
+// into account. Invalid hosts cannot be compared and will always return false.
+func (h *FriendlyHost) Equal(other *FriendlyHost) bool {
+        if other == nil {
+                return false
+        }
+
+        otherHost, err := svchost.ForComparison(other.Raw)
+        if err != nil {
+                return false
+        }
+
+        host, err := svchost.ForComparison(h.Raw)
+        if err != nil {
+                return false
+        }
+
+        return otherHost == host
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/regsrc/module.go b/vendor/github.com/hashicorp/terraform/registry/regsrc/module.go
new file mode 100644
index 0000000..325706e
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/regsrc/module.go
@@ -0,0 +1,205 @@
+package regsrc
+
+import (
+        "errors"
+        "fmt"
+        "regexp"
+        "strings"
+
+        "github.com/hashicorp/terraform/svchost"
+)
+
+var (
+        ErrInvalidModuleSource = errors.New("not a valid registry module source")
+
+        // nameSubRe is the sub-expression that matches a valid module namespace or
+        // name. It's strictly a super-set of what GitHub allows for user/org and
+        // repo names respectively, but more restrictive than our original repo-name
+        // regex which allowed periods but could cause ambiguity with hostname
+        // prefixes. It does not anchor the start or end so it can be composed into
+        // more complex RegExps below. Alphanumeric with - and _ allowed in non
+        // leading or trailing positions. Max length 64 chars. (GitHub username is
+        // 38 max.)
+        nameSubRe = "[0-9A-Za-z](?:[0-9A-Za-z-_]{0,62}[0-9A-Za-z])?"
+
+        // providerSubRe is the sub-expression that matches a valid provider. It
+        // does not anchor the start or end so it can be composed into more complex
+        // RegExps below. Only lowercase chars and digits are supported in practice.
+        // Max length 64 chars.
+        providerSubRe = "[0-9a-z]{1,64}"
+
+        // moduleSourceRe is a regular expression that matches the basic
+        // namespace/name/provider[//...] format for registry sources. It assumes
+        // any FriendlyHost prefix has already been removed if present.
+        moduleSourceRe = regexp.MustCompile(
+                fmt.Sprintf("^(%s)\\/(%s)\\/(%s)(?:\\/\\/(.*))?$",
+                        nameSubRe, nameSubRe, providerSubRe))
+
+        // NameRe is a regular expression defining the format allowed for namespace
+        // or name fields in module registry implementations.
+        NameRe = regexp.MustCompile("^" + nameSubRe + "$")
+
+        // ProviderRe is a regular expression defining the format allowed for
+        // provider fields in module registry implementations.
+        ProviderRe = regexp.MustCompile("^" + providerSubRe + "$")
+
+        // these hostnames are not allowed as registry sources, because they are
+        // already special case module sources in terraform.
+        disallowed = map[string]bool{
+                "github.com":    true,
+                "bitbucket.org": true,
+        }
+)
+
+// Module describes a Terraform Registry Module source.
+type Module struct {
+        // RawHost is the friendly host prefix if one was present. It might be nil
+        // if the original source had no host prefix which implies
+        // PublicRegistryHost but is distinct from having an actual pointer to
+        // PublicRegistryHost since it encodes the fact the original string didn't
+        // include a host prefix at all which is significant for recovering actual
+        // input not just normalized form. Most callers should access it with Host()
+        // which will return public registry host instance if it's nil.
+        RawHost      *FriendlyHost
+        RawNamespace string
+        RawName      string
+        RawProvider  string
+        RawSubmodule string
+}
+
+// NewModule construct a new module source from separate parts. Pass empty
+// string if host or submodule are not needed.
+func NewModule(host, namespace, name, provider, submodule string) (*Module, error) {
+        m := &Module{
+                RawNamespace: namespace,
+                RawName:      name,
+                RawProvider:  provider,
+                RawSubmodule: submodule,
+        }
+        if host != "" {
+                h := NewFriendlyHost(host)
+                if h != nil {
+                        fmt.Println("HOST:", h)
+                        if !h.Valid() || disallowed[h.Display()] {
+                                return nil, ErrInvalidModuleSource
+                        }
+                }
+                m.RawHost = h
+        }
+        return m, nil
+}
+
+// ParseModuleSource attempts to parse source as a Terraform registry module
+// source. If the string is not found to be in a valid format,
+// ErrInvalidModuleSource is returned. Note that this can only be used on
+// "input" strings, e.g. either ones supplied by the user or potentially
+// normalised but in Display form (unicode). It will fail to parse a source with
+// a punycoded domain since this is not permitted input from a user. If you have
+// an already normalized string internally, you can compare it without parsing
+// by comparing with the normalized version of the subject with the normal
+// string equality operator.
+func ParseModuleSource(source string) (*Module, error) {
+        // See if there is a friendly host prefix.
+        host, rest := ParseFriendlyHost(source)
+        if host != nil {
+                if !host.Valid() || disallowed[host.Display()] {
+                        return nil, ErrInvalidModuleSource
+                }
+        }
+
+        matches := moduleSourceRe.FindStringSubmatch(rest)
+        if len(matches) < 4 {
+                return nil, ErrInvalidModuleSource
+        }
+
+        m := &Module{
+                RawHost:      host,
+                RawNamespace: matches[1],
+                RawName:      matches[2],
+                RawProvider:  matches[3],
+        }
+
+        if len(matches) == 5 {
+                m.RawSubmodule = matches[4]
+        }
+
+        return m, nil
+}
+
+// Display returns the source formatted for display to the user in CLI or web
+// output.
+func (m *Module) Display() string {
+        return m.formatWithPrefix(m.normalizedHostPrefix(m.Host().Display()), false)
+}
+
+// Normalized returns the source formatted for internal reference or comparison.
+func (m *Module) Normalized() string {
+        return m.formatWithPrefix(m.normalizedHostPrefix(m.Host().Normalized()), false)
+}
+
+// String returns the source formatted as the user originally typed it assuming
+// it was parsed from user input.
+func (m *Module) String() string {
+        // Don't normalize public registry hostname - leave it exactly like the user
+        // input it.
+        hostPrefix := ""
+        if m.RawHost != nil {
+                hostPrefix = m.RawHost.String() + "/"
+        }
+        return m.formatWithPrefix(hostPrefix, true)
+}
+
+// Equal compares the module source against another instance taking
+// normalization into account.
+func (m *Module) Equal(other *Module) bool {
+        return m.Normalized() == other.Normalized()
+}
+
+// Host returns the FriendlyHost object describing which registry this module is
+// in. If the original source string had not host component this will return the
+// PublicRegistryHost.
+func (m *Module) Host() *FriendlyHost {
+        if m.RawHost == nil {
+                return PublicRegistryHost
+        }
+        return m.RawHost
+}
+
+func (m *Module) normalizedHostPrefix(host string) string {
+        if m.Host().Equal(PublicRegistryHost) {
+                return ""
+        }
+        return host + "/"
+}
+
+func (m *Module) formatWithPrefix(hostPrefix string, preserveCase bool) string {
+        suffix := ""
+        if m.RawSubmodule != "" {
+                suffix = "//" + m.RawSubmodule
+        }
+        str := fmt.Sprintf("%s%s/%s/%s%s", hostPrefix, m.RawNamespace, m.RawName,
+                m.RawProvider, suffix)
+
+        // lower case by default
+        if !preserveCase {
+                return strings.ToLower(str)
+        }
+        return str
+}
+
+// Module returns just the registry ID of the module, without a hostname or
+// suffix.
+func (m *Module) Module() string {
+        return fmt.Sprintf("%s/%s/%s", m.RawNamespace, m.RawName, m.RawProvider)
+}
+
+// SvcHost returns the svchost.Hostname for this module. Since FriendlyHost may
+// contain an invalid hostname, this also returns an error indicating if it
+// could be converted to a svchost.Hostname. If no host is specified, the
+// default PublicRegistryHost is returned.
+func (m *Module) SvcHost() (svchost.Hostname, error) {
+        if m.RawHost == nil {
+                return svchost.ForComparison(PublicRegistryHost.Raw)
+        }
+        return svchost.ForComparison(m.RawHost.Raw)
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/regsrc/regsrc.go b/vendor/github.com/hashicorp/terraform/registry/regsrc/regsrc.go
new file mode 100644
index 0000000..c430bf1
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/regsrc/regsrc.go
@@ -0,0 +1,8 @@
+// Package regsrc provides helpers for working with source strings that identify
+// resources within a Terraform registry.
+package regsrc
+
+var (
+        // PublicRegistryHost is a FriendlyHost that represents the public registry.
+        PublicRegistryHost = NewFriendlyHost("registry.terraform.io")
+)
diff --git a/vendor/github.com/hashicorp/terraform/registry/response/module.go b/vendor/github.com/hashicorp/terraform/registry/response/module.go
new file mode 100644
index 0000000..3bd2b3d
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/response/module.go
@@ -0,0 +1,93 @@
+package response
+
+import (
+        "time"
+)
+
+// Module is the response structure with the data for a single module version.
+type Module struct {
+        ID string `json:"id"`
+
+        //---------------------------------------------------------------
+        // Metadata about the overall module.
+
+        Owner       string    `json:"owner"`
+        Namespace   string    `json:"namespace"`
+        Name        string    `json:"name"`
+        Version     string    `json:"version"`
+        Provider    string    `json:"provider"`
+        Description string    `json:"description"`
+        Source      string    `json:"source"`
+        PublishedAt time.Time `json:"published_at"`
+        Downloads   int       `json:"downloads"`
+        Verified    bool      `json:"verified"`
+}
+
+// ModuleDetail represents a module in full detail.
+type ModuleDetail struct {
+        Module
+
+        //---------------------------------------------------------------
+        // Metadata about the overall module. This is only available when
+        // requesting the specific module (not in list responses).
+
+        // Root is the root module.
+        Root *ModuleSubmodule `json:"root"`
+
+        // Submodules are the other submodules that are available within
+        // this module.
+        Submodules []*ModuleSubmodule `json:"submodules"`
+
+        //---------------------------------------------------------------
+        // The fields below are only set when requesting this specific
+        // module. They are available to easily know all available versions
+        // and providers without multiple API calls.
+
+        Providers []string `json:"providers"` // All available providers
+        Versions  []string `json:"versions"`  // All versions
+}
+
+// ModuleSubmodule is the metadata about a specific submodule within
+// a module. This includes the root module as a special case.
+type ModuleSubmodule struct {
+        Path   string `json:"path"`
+        Readme string `json:"readme"`
+        Empty  bool   `json:"empty"`
+
+        Inputs       []*ModuleInput    `json:"inputs"`
+        Outputs      []*ModuleOutput   `json:"outputs"`
+        Dependencies []*ModuleDep      `json:"dependencies"`
+        Resources    []*ModuleResource `json:"resources"`
+}
+
+// ModuleInput is an input for a module.
+type ModuleInput struct {
+        Name        string `json:"name"`
+        Description string `json:"description"`
+        Default     string `json:"default"`
+}
+
+// ModuleOutput is an output for a module.
+type ModuleOutput struct {
+        Name        string `json:"name"`
+        Description string `json:"description"`
+}
+
+// ModuleDep is an output for a module.
+type ModuleDep struct {
+        Name    string `json:"name"`
+        Source  string `json:"source"`
+        Version string `json:"version"`
+}
+
+// ModuleProviderDep is the output for a provider dependency
+type ModuleProviderDep struct {
+        Name    string `json:"name"`
+        Version string `json:"version"`
+}
+
+// ModuleResource is an output for a module.
+type ModuleResource struct {
+        Name string `json:"name"`
+        Type string `json:"type"`
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/response/module_list.go b/vendor/github.com/hashicorp/terraform/registry/response/module_list.go
new file mode 100644
index 0000000..9783748
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/response/module_list.go
@@ -0,0 +1,7 @@
+package response
+
+// ModuleList is the response structure for a pageable list of modules.
+type ModuleList struct {
+        Meta    PaginationMeta `json:"meta"`
+        Modules []*Module      `json:"modules"`
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/response/module_provider.go b/vendor/github.com/hashicorp/terraform/registry/response/module_provider.go
new file mode 100644
index 0000000..e48499d
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/response/module_provider.go
@@ -0,0 +1,14 @@
+package response
+
+// ModuleProvider represents a single provider for modules.
+type ModuleProvider struct {
+        Name        string `json:"name"`
+        Downloads   int    `json:"downloads"`
+        ModuleCount int    `json:"module_count"`
+}
+
+// ModuleProviderList is the response structure for a pageable list of ModuleProviders.
+type ModuleProviderList struct {
+        Meta      PaginationMeta    `json:"meta"`
+        Providers []*ModuleProvider `json:"providers"`
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/response/module_versions.go b/vendor/github.com/hashicorp/terraform/registry/response/module_versions.go
new file mode 100644
index 0000000..f69e975
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/response/module_versions.go
@@ -0,0 +1,32 @@
+package response
+
+// ModuleVersions is the response format that contains all metadata about module
+// versions needed for terraform CLI to resolve version constraints. See RFC
+// TF-042 for details on this format.
+type ModuleVersions struct {
+        Modules []*ModuleProviderVersions `json:"modules"`
+}
+
+// ModuleProviderVersions is the response format for a single module instance,
+// containing metadata about all versions and their dependencies.
+type ModuleProviderVersions struct {
+        Source   string           `json:"source"`
+        Versions []*ModuleVersion `json:"versions"`
+}
+
+// ModuleVersion is the output metadata for a given version needed by CLI to
+// resolve candidate versions to satisfy requirements.
+type ModuleVersion struct {
+        Version    string              `json:"version"`
+        Root       VersionSubmodule    `json:"root"`
+        Submodules []*VersionSubmodule `json:"submodules"`
+}
+
+// VersionSubmodule is the output metadata for a submodule within a given
+// version needed by CLI to resolve candidate versions to satisfy requirements.
+// When representing the Root in JSON the path is omitted.
+type VersionSubmodule struct {
+        Path         string               `json:"path,omitempty"`
+        Providers    []*ModuleProviderDep `json:"providers"`
+        Dependencies []*ModuleDep         `json:"dependencies"`
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/response/pagination.go b/vendor/github.com/hashicorp/terraform/registry/response/pagination.go
new file mode 100644
index 0000000..75a9254
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/response/pagination.go
@@ -0,0 +1,65 @@
+package response
+
+import (
+        "net/url"
+        "strconv"
+)
+
+// PaginationMeta is a structure included in responses for pagination.
+type PaginationMeta struct {
+        Limit         int    `json:"limit"`
+        CurrentOffset int    `json:"current_offset"`
+        NextOffset    *int   `json:"next_offset,omitempty"`
+        PrevOffset    *int   `json:"prev_offset,omitempty"`
+        NextURL       string `json:"next_url,omitempty"`
+        PrevURL       string `json:"prev_url,omitempty"`
+}
+
+// NewPaginationMeta populates pagination meta data from result parameters
+func NewPaginationMeta(offset, limit int, hasMore bool, currentURL string) PaginationMeta {
+        pm := PaginationMeta{
+                Limit:         limit,
+                CurrentOffset: offset,
+        }
+
+        // Calculate next/prev offsets, leave nil if not valid pages
+        nextOffset := offset + limit
+        if hasMore {
+                pm.NextOffset = &nextOffset
+        }
+
+        prevOffset := offset - limit
+        if prevOffset < 0 {
+                prevOffset = 0
+        }
+        if prevOffset < offset {
+                pm.PrevOffset = &prevOffset
+        }
+
+        // If URL format provided, populate URLs. Intentionally swallow URL errors for now, API should
+        // catch missing URLs if we call with bad URL arg (and we care about them being present).
+        if currentURL != "" && pm.NextOffset != nil {
+                pm.NextURL, _ = setQueryParam(currentURL, "offset", *pm.NextOffset, 0)
+        }
+        if currentURL != "" && pm.PrevOffset != nil {
+                pm.PrevURL, _ = setQueryParam(currentURL, "offset", *pm.PrevOffset, 0)
+        }
+
+        return pm
+}
+
+func setQueryParam(baseURL, key string, val, defaultVal int) (string, error) {
+        u, err := url.Parse(baseURL)
+        if err != nil {
+                return "", err
+        }
+        q := u.Query()
+        if val == defaultVal {
+                // elide param if it's the default value
+                q.Del(key)
+        } else {
+                q.Set(key, strconv.Itoa(val))
+        }
+        u.RawQuery = q.Encode()
+        return u.String(), nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/registry/response/redirect.go b/vendor/github.com/hashicorp/terraform/registry/response/redirect.go
new file mode 100644
index 0000000..d5eb49b
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/registry/response/redirect.go
@@ -0,0 +1,6 @@
+package response
+
+// Redirect causes the frontend to perform a window redirect.
+type Redirect struct {
+        URL string `json:"url"`
+}
diff --git a/vendor/github.com/hashicorp/terraform/svchost/auth/cache.go b/vendor/github.com/hashicorp/terraform/svchost/auth/cache.go
new file mode 100644
index 0000000..4f0d168
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/svchost/auth/cache.go
@@ -0,0 +1,45 @@
+package auth
+
+import (
+        "github.com/hashicorp/terraform/svchost"
+)
+
+// CachingCredentialsSource creates a new credentials source that wraps another
+// and caches its results in memory, on a per-hostname basis.
+//
+// No means is provided for expiration of cached credentials, so a caching
+// credentials source should have a limited lifetime (one Terraform operation,
+// for example) to ensure that time-limited credentials don't expire before
+// their cache entries do.
+func CachingCredentialsSource(source CredentialsSource) CredentialsSource {
+        return &cachingCredentialsSource{
+                source: source,
+                cache:  map[svchost.Hostname]HostCredentials{},
+        }
+}
+
+type cachingCredentialsSource struct {
+        source CredentialsSource
+        cache  map[svchost.Hostname]HostCredentials
+}
+
+// ForHost passes the given hostname on to the wrapped credentials source and
+// caches the result to return for future requests with the same hostname.
+//
+// Both credentials and non-credentials (nil) responses are cached.
+//
+// No cache entry is created if the wrapped source returns an error, to allow
+// the caller to retry the failing operation.
+func (s *cachingCredentialsSource) ForHost(host svchost.Hostname) (HostCredentials, error) {
+        if cache, cached := s.cache[host]; cached {
+                return cache, nil
+        }
+
+        result, err := s.source.ForHost(host)
+        if err != nil {
+                return result, err
+        }
+
+        s.cache[host] = result
+        return result, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/svchost/auth/credentials.go b/vendor/github.com/hashicorp/terraform/svchost/auth/credentials.go
new file mode 100644
index 0000000..0372c16
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/svchost/auth/credentials.go
@@ -0,0 +1,63 @@
+// Package auth contains types and functions to manage authentication
+// credentials for service hosts.
+package auth
+
+import (
+        "net/http"
+
+        "github.com/hashicorp/terraform/svchost"
+)
+
+// Credentials is a list of CredentialsSource objects that can be tried in
+// turn until one returns credentials for a host, or one returns an error.
+//
+// A Credentials is itself a CredentialsSource, wrapping its members.
+// In principle one CredentialsSource can be nested inside another, though
+// there is no good reason to do so.
+type Credentials []CredentialsSource
+
+// NoCredentials is an empty CredentialsSource that always returns nil
+// when asked for credentials.
+var NoCredentials CredentialsSource = Credentials{}
+
+// A CredentialsSource is an object that may be able to provide credentials
+// for a given host.
+//
+// Credentials lookups are not guaranteed to be concurrency-safe. Callers
+// using these facilities in concurrent code must use external concurrency
+// primitives to prevent race conditions.
+type CredentialsSource interface {
+        // ForHost returns a non-nil HostCredentials if the source has credentials
+        // available for the host, and a nil HostCredentials if it does not.
+        //
+        // If an error is returned, progress through a list of CredentialsSources
+        // is halted and the error is returned to the user.
+        ForHost(host svchost.Hostname) (HostCredentials, error)
+}
+
+// HostCredentials represents a single set of credentials for a particular
+// host.
+type HostCredentials interface {
+        // PrepareRequest modifies the given request in-place to apply the
+        // receiving credentials. The usual behavior of this method is to
+        // add some sort of Authorization header to the request.
+        PrepareRequest(req *http.Request)
+
+        // Token returns the authentication token.
+        Token() string
+}
+
+// ForHost iterates over the contained CredentialsSource objects and
+// tries to obtain credentials for the given host from each one in turn.
+//
+// If any source returns either a non-nil HostCredentials or a non-nil error
+// then this result is returned. Otherwise, the result is nil, nil.
+func (c Credentials) ForHost(host svchost.Hostname) (HostCredentials, error) {
+        for _, source := range c {
+                creds, err := source.ForHost(host)
+                if creds != nil || err != nil {
+                        return creds, err
+                }
+        }
+        return nil, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/svchost/auth/from_map.go b/vendor/github.com/hashicorp/terraform/svchost/auth/from_map.go
new file mode 100644
index 0000000..f91006a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/svchost/auth/from_map.go
@@ -0,0 +1,18 @@
+package auth
+
+// HostCredentialsFromMap converts a map of key-value pairs from a credentials
+// definition provided by the user (e.g. in a config file, or via a credentials
+// helper) into a HostCredentials object if possible, or returns nil if
+// no credentials could be extracted from the map.
+//
+// This function ignores map keys it is unfamiliar with, to allow for future
+// expansion of the credentials map format for new credential types.
+func HostCredentialsFromMap(m map[string]interface{}) HostCredentials {
+        if m == nil {
+                return nil
+        }
+        if token, ok := m["token"].(string); ok {
+                return HostCredentialsToken(token)
+        }
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/svchost/auth/helper_program.go b/vendor/github.com/hashicorp/terraform/svchost/auth/helper_program.go
new file mode 100644
index 0000000..d72ffe3
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/svchost/auth/helper_program.go
@@ -0,0 +1,80 @@
+package auth
+
+import (
+        "bytes"
+        "encoding/json"
+        "fmt"
+        "os/exec"
+        "path/filepath"
+
+        "github.com/hashicorp/terraform/svchost"
+)
+
+type helperProgramCredentialsSource struct {
+        executable string
+        args       []string
+}
+
+// HelperProgramCredentialsSource returns a CredentialsSource that runs the
+// given program with the given arguments in order to obtain credentials.
+//
+// The given executable path must be an absolute path; it is the caller's
+// responsibility to validate and process a relative path or other input
+// provided by an end-user. If the given path is not absolute, this
+// function will panic.
+//
+// When credentials are requested, the program will be run in a child process
+// with the given arguments along with two additional arguments added to the
+// end of the list: the literal string "get", followed by the requested
+// hostname in ASCII compatibility form (punycode form).
+func HelperProgramCredentialsSource(executable string, args ...string) CredentialsSource {
+        if !filepath.IsAbs(executable) {
+                panic("NewCredentialsSourceHelperProgram requires absolute path to executable")
+        }
+
+        fullArgs := make([]string, len(args)+1)
+        fullArgs[0] = executable
+        copy(fullArgs[1:], args)
+
+        return &helperProgramCredentialsSource{
+                executable: executable,
+                args:       fullArgs,
+        }
+}
+
+func (s *helperProgramCredentialsSource) ForHost(host svchost.Hostname) (HostCredentials, error) {
+        args := make([]string, len(s.args), len(s.args)+2)
+        copy(args, s.args)
+        args = append(args, "get")
+        args = append(args, string(host))
+
+        outBuf := bytes.Buffer{}
+        errBuf := bytes.Buffer{}
+
+        cmd := exec.Cmd{
+                Path:   s.executable,
+                Args:   args,
+                Stdin:  nil,
+                Stdout: &outBuf,
+                Stderr: &errBuf,
+        }
+        err := cmd.Run()
+        if _, isExitErr := err.(*exec.ExitError); isExitErr {
+                errText := errBuf.String()
+                if errText == "" {
+                        // Shouldn't happen for a well-behaved helper program
+                        return nil, fmt.Errorf("error in %s, but it produced no error message", s.executable)
+                }
+                return nil, fmt.Errorf("error in %s: %s", s.executable, errText)
+        } else if err != nil {
+                return nil, fmt.Errorf("failed to run %s: %s", s.executable, err)
+        }
+
+        var m map[string]interface{}
+        err = json.Unmarshal(outBuf.Bytes(), &m)
+        if err != nil {
+                return nil, fmt.Errorf("malformed output from %s: %s", s.executable, err)
+        }
+
+        return HostCredentialsFromMap(m), nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/svchost/auth/static.go b/vendor/github.com/hashicorp/terraform/svchost/auth/static.go
new file mode 100644
index 0000000..5373fdd
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/svchost/auth/static.go
@@ -0,0 +1,28 @@
+package auth
+
+import (
+        "github.com/hashicorp/terraform/svchost"
+)
+
+// StaticCredentialsSource is a credentials source that retrieves credentials
+// from the provided map. It returns nil if a requested hostname is not
+// present in the map.
+//
+// The caller should not modify the given map after passing it to this function.
+func StaticCredentialsSource(creds map[svchost.Hostname]map[string]interface{}) CredentialsSource {
+        return staticCredentialsSource(creds)
+}
+
+type staticCredentialsSource map[svchost.Hostname]map[string]interface{}
+
+func (s staticCredentialsSource) ForHost(host svchost.Hostname) (HostCredentials, error) {
+        if s == nil {
+                return nil, nil
+        }
+
+        if m, exists := s[host]; exists {
+                return HostCredentialsFromMap(m), nil
+        }
+
+        return nil, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/svchost/auth/token_credentials.go b/vendor/github.com/hashicorp/terraform/svchost/auth/token_credentials.go
new file mode 100644
index 0000000..9358bcb
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/svchost/auth/token_credentials.go
@@ -0,0 +1,25 @@
+package auth
+
+import (
+        "net/http"
+)
+
+// HostCredentialsToken is a HostCredentials implementation that represents a
+// single "bearer token", to be sent to the server via an Authorization header
+// with the auth type set to "Bearer"
+type HostCredentialsToken string
+
+// PrepareRequest alters the given HTTP request by setting its Authorization
+// header to the string "Bearer " followed by the encapsulated authentication
+// token.
+func (tc HostCredentialsToken) PrepareRequest(req *http.Request) {
+        if req.Header == nil {
+                req.Header = http.Header{}
+        }
+        req.Header.Set("Authorization", "Bearer "+string(tc))
+}
+
+// Token returns the authentication token.
+func (tc HostCredentialsToken) Token() string {
+        return string(tc)
+}
diff --git a/vendor/github.com/hashicorp/terraform/svchost/disco/disco.go b/vendor/github.com/hashicorp/terraform/svchost/disco/disco.go
new file mode 100644
index 0000000..1963cbd
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/svchost/disco/disco.go
@@ -0,0 +1,259 @@
+// Package disco handles Terraform's remote service discovery protocol.
+//
+// This protocol allows mapping from a service hostname, as produced by the
+// svchost package, to a set of services supported by that host and the
+// endpoint information for each supported service.
+package disco
+
+import (
+        "encoding/json"
+        "errors"
+        "fmt"
+        "io"
+        "io/ioutil"
+        "log"
+        "mime"
+        "net/http"
+        "net/url"
+        "time"
+
+        cleanhttp "github.com/hashicorp/go-cleanhttp"
+        "github.com/hashicorp/terraform/httpclient"
+        "github.com/hashicorp/terraform/svchost"
+        "github.com/hashicorp/terraform/svchost/auth"
+)
+
+const (
+        // Fixed path to the discovery manifest.
+        discoPath = "/.well-known/terraform.json"
+
+        // Arbitrary-but-small number to prevent runaway redirect loops.
+        maxRedirects = 3
+
+        // Arbitrary-but-small time limit to prevent UI "hangs" during discovery.
+        discoTimeout = 11 * time.Second
+
+        // 1MB - to prevent abusive services from using loads of our memory.
+        maxDiscoDocBytes = 1 * 1024 * 1024
+)
+
+// httpTransport is overridden during tests, to skip TLS verification.
+var httpTransport = cleanhttp.DefaultPooledTransport()
+
+// Disco is the main type in this package, which allows discovery on given
+// hostnames and caches the results by hostname to avoid repeated requests
+// for the same information.
+type Disco struct {
+        hostCache map[svchost.Hostname]*Host
+        credsSrc  auth.CredentialsSource
+
+        // Transport is a custom http.RoundTripper to use.
+        Transport http.RoundTripper
+}
+
+// New returns a new initialized discovery object.
+func New() *Disco {
+        return NewWithCredentialsSource(nil)
+}
+
+// NewWithCredentialsSource returns a new discovery object initialized with
+// the given credentials source.
+func NewWithCredentialsSource(credsSrc auth.CredentialsSource) *Disco {
+        return &Disco{
+                hostCache: make(map[svchost.Hostname]*Host),
+                credsSrc:  credsSrc,
+                Transport: httpTransport,
+        }
+}
+
+// SetCredentialsSource provides a credentials source that will be used to
+// add credentials to outgoing discovery requests, where available.
+//
+// If this method is never called, no outgoing discovery requests will have
+// credentials.
+func (d *Disco) SetCredentialsSource(src auth.CredentialsSource) {
+        d.credsSrc = src
+}
+
+// CredentialsForHost returns a non-nil HostCredentials if the embedded source has
+// credentials available for the host, and a nil HostCredentials if it does not.
+func (d *Disco) CredentialsForHost(hostname svchost.Hostname) (auth.HostCredentials, error) {
+        if d.credsSrc == nil {
+                return nil, nil
+        }
+        return d.credsSrc.ForHost(hostname)
+}
+
+// ForceHostServices provides a pre-defined set of services for a given
+// host, which prevents the receiver from attempting network-based discovery
+// for the given host. Instead, the given services map will be returned
+// verbatim.
+//
+// When providing "forced" services, any relative URLs are resolved against
+// the initial discovery URL that would have been used for network-based
+// discovery, yielding the same results as if the given map were published
+// at the host's default discovery URL, though using absolute URLs is strongly
+// recommended to make the configured behavior more explicit.
+func (d *Disco) ForceHostServices(hostname svchost.Hostname, services map[string]interface{}) {
+        if services == nil {
+                services = map[string]interface{}{}
+        }
+
+        d.hostCache[hostname] = &Host{
+                discoURL: &url.URL{
+                        Scheme: "https",
+                        Host:   string(hostname),
+                        Path:   discoPath,
+                },
+                hostname:  hostname.ForDisplay(),
+                services:  services,
+                transport: d.Transport,
+        }
+}
+
+// Discover runs the discovery protocol against the given hostname (which must
+// already have been validated and prepared with svchost.ForComparison) and
+// returns an object describing the services available at that host.
+//
+// If a given hostname supports no Terraform services at all, a non-nil but
+// empty Host object is returned. When giving feedback to the end user about
+// such situations, we say "host <name> does not provide a <service> service",
+// regardless of whether that is due to that service specifically being absent
+// or due to the host not providing Terraform services at all, since we don't
+// wish to expose the detail of whole-host discovery to an end-user.
+func (d *Disco) Discover(hostname svchost.Hostname) (*Host, error) {
+        if host, cached := d.hostCache[hostname]; cached {
+                return host, nil
+        }
+
+        host, err := d.discover(hostname)
+        if err != nil {
+                return nil, err
+        }
+        d.hostCache[hostname] = host
+
+        return host, nil
+}
+
+// DiscoverServiceURL is a convenience wrapper for discovery on a given
+// hostname and then looking up a particular service in the result.
+func (d *Disco) DiscoverServiceURL(hostname svchost.Hostname, serviceID string) (*url.URL, error) {
+        host, err := d.Discover(hostname)
+        if err != nil {
+                return nil, err
+        }
+        return host.ServiceURL(serviceID)
+}
+
+// discover implements the actual discovery process, with its result cached
+// by the public-facing Discover method.
+func (d *Disco) discover(hostname svchost.Hostname) (*Host, error) {
+        discoURL := &url.URL{
+                Scheme: "https",
+                Host:   hostname.String(),
+                Path:   discoPath,
+        }
+
+        client := &http.Client{
+                Transport: d.Transport,
+                Timeout:   discoTimeout,
+
+                CheckRedirect: func(req *http.Request, via []*http.Request) error {
+                        log.Printf("[DEBUG] Service discovery redirected to %s", req.URL)
+                        if len(via) > maxRedirects {
+                                return errors.New("too many redirects") // this error will never actually be seen
+                        }
+                        return nil
+                },
+        }
+
+        req := &http.Request{
+                Header: make(http.Header),
+                Method: "GET",
+                URL:    discoURL,
+        }
+        req.Header.Set("Accept", "application/json")
+        req.Header.Set("User-Agent", httpclient.UserAgentString())
+
+        creds, err := d.CredentialsForHost(hostname)
+        if err != nil {
+                log.Printf("[WARN] Failed to get credentials for %s: %s (ignoring)", hostname, err)
+        }
+        if creds != nil {
+                // Update the request to include credentials.
+                creds.PrepareRequest(req)
+        }
+
+        log.Printf("[DEBUG] Service discovery for %s at %s", hostname, discoURL)
+
+        resp, err := client.Do(req)
+        if err != nil {
+                return nil, fmt.Errorf("Failed to request discovery document: %v", err)
+        }
+        defer resp.Body.Close()
+
+        host := &Host{
+                // Use the discovery URL from resp.Request in
+                // case the client followed any redirects.
+                discoURL:  resp.Request.URL,
+                hostname:  hostname.ForDisplay(),
+                transport: d.Transport,
+        }
+
+        // Return the host without any services.
+        if resp.StatusCode == 404 {
+                return host, nil
+        }
+
+        if resp.StatusCode != 200 {
+                return nil, fmt.Errorf("Failed to request discovery document: %s", resp.Status)
+        }
+
+        contentType := resp.Header.Get("Content-Type")
+        mediaType, _, err := mime.ParseMediaType(contentType)
+        if err != nil {
+                return nil, fmt.Errorf("Discovery URL has a malformed Content-Type %q", contentType)
+        }
+        if mediaType != "application/json" {
+                return nil, fmt.Errorf("Discovery URL returned an unsupported Content-Type %q", mediaType)
+        }
+
+        // This doesn't catch chunked encoding, because ContentLength is -1 in that case.
+        if resp.ContentLength > maxDiscoDocBytes {
+                // Size limit here is not a contractual requirement and so we may
+                // adjust it over time if we find a different limit is warranted.
+                return nil, fmt.Errorf(
+                        "Discovery doc response is too large (got %d bytes; limit %d)",
+                        resp.ContentLength, maxDiscoDocBytes,
+                )
+        }
+
+        // If the response is using chunked encoding then we can't predict its
+        // size, but we'll at least prevent reading the entire thing into memory.
+        lr := io.LimitReader(resp.Body, maxDiscoDocBytes)
+
+        servicesBytes, err := ioutil.ReadAll(lr)
+        if err != nil {
+                return nil, fmt.Errorf("Error reading discovery document body: %v", err)
+        }
+
+        var services map[string]interface{}
+        err = json.Unmarshal(servicesBytes, &services)
+        if err != nil {
+                return nil, fmt.Errorf("Failed to decode discovery document as a JSON object: %v", err)
+        }
+        host.services = services
+
+        return host, nil
+}
+
+// Forget invalidates any cached record of the given hostname. If the host
+// has no cache entry then this is a no-op.
+func (d *Disco) Forget(hostname svchost.Hostname) {
+        delete(d.hostCache, hostname)
+}
+
+// ForgetAll is like Forget, but for all of the hostnames that have cache entries.
+func (d *Disco) ForgetAll() {
+        d.hostCache = make(map[svchost.Hostname]*Host)
+}
diff --git a/vendor/github.com/hashicorp/terraform/svchost/disco/host.go b/vendor/github.com/hashicorp/terraform/svchost/disco/host.go
new file mode 100644
index 0000000..ab9514c
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/svchost/disco/host.go
@@ -0,0 +1,264 @@
+package disco
+
+import (
+        "encoding/json"
+        "fmt"
+        "log"
+        "net/http"
+        "net/url"
+        "os"
+        "strconv"
+        "strings"
+        "time"
+
+        "github.com/hashicorp/go-version"
+        "github.com/hashicorp/terraform/httpclient"
+)
+
+const versionServiceID = "versions.v1"
+
+// Host represents a service discovered host.
+type Host struct {
+        discoURL  *url.URL
+        hostname  string
+        services  map[string]interface{}
+        transport http.RoundTripper
+}
+
+// Constraints represents the version constraints of a service.
+type Constraints struct {
+        Service   string   `json:"service"`
+        Product   string   `json:"product"`
+        Minimum   string   `json:"minimum"`
+        Maximum   string   `json:"maximum"`
+        Excluding []string `json:"excluding"`
+}
+
+// ErrServiceNotProvided is returned when the service is not provided.
+type ErrServiceNotProvided struct {
+        hostname string
+        service  string
+}
+
+// Error returns a customized error message.
+func (e *ErrServiceNotProvided) Error() string {
+        if e.hostname == "" {
+                return fmt.Sprintf("host does not provide a %s service", e.service)
+        }
+        return fmt.Sprintf("host %s does not provide a %s service", e.hostname, e.service)
+}
+
+// ErrVersionNotSupported is returned when the version is not supported.
+type ErrVersionNotSupported struct {
+        hostname string
+        service  string
+        version  string
+}
+
+// Error returns a customized error message.
+func (e *ErrVersionNotSupported) Error() string {
+        if e.hostname == "" {
+                return fmt.Sprintf("host does not support %s version %s", e.service, e.version)
+        }
+        return fmt.Sprintf("host %s does not support %s version %s", e.hostname, e.service, e.version)
+}
+
+// ErrNoVersionConstraints is returned when checkpoint was disabled
+// or the endpoint to query for version constraints was unavailable.
+type ErrNoVersionConstraints struct {
+        disabled bool
+}
+
+// Error returns a customized error message.
+func (e *ErrNoVersionConstraints) Error() string {
+        if e.disabled {
+                return "checkpoint disabled"
+        }
+        return "unable to contact versions service"
+}
+
+// ServiceURL returns the URL associated with the given service identifier,
+// which should be of the form "servicename.vN".
+//
+// A non-nil result is always an absolute URL with a scheme of either HTTPS
+// or HTTP.
+func (h *Host) ServiceURL(id string) (*url.URL, error) {
+        svc, ver, err := parseServiceID(id)
+        if err != nil {
+                return nil, err
+        }
+
+        // No services supported for an empty Host.
+        if h == nil || h.services == nil {
+                return nil, &ErrServiceNotProvided{service: svc}
+        }
+
+        urlStr, ok := h.services[id].(string)
+        if !ok {
+                // See if we have a matching service as that would indicate
+                // the service is supported, but not the requested version.
+                for serviceID := range h.services {
+                        if strings.HasPrefix(serviceID, svc+".") {
+                                return nil, &ErrVersionNotSupported{
+                                        hostname: h.hostname,
+                                        service:  svc,
+                                        version:  ver.Original(),
+                                }
+                        }
+                }
+
+                // No discovered services match the requested service.
+                return nil, &ErrServiceNotProvided{hostname: h.hostname, service: svc}
+        }
+
+        u, err := url.Parse(urlStr)
+        if err != nil {
+                return nil, fmt.Errorf("Failed to parse service URL: %v", err)
+        }
+
+        // Make relative URLs absolute using our discovery URL.
+        if !u.IsAbs() {
+                u = h.discoURL.ResolveReference(u)
+        }
+
+        if u.Scheme != "https" && u.Scheme != "http" {
+                return nil, fmt.Errorf("Service URL is using an unsupported scheme: %s", u.Scheme)
+        }
+        if u.User != nil {
+                return nil, fmt.Errorf("Embedded username/password information is not permitted")
+        }
+
+        // Fragment part is irrelevant, since we're not a browser.
+        u.Fragment = ""
+
+        return h.discoURL.ResolveReference(u), nil
+}
+
+// VersionConstraints returns the contraints for a given service identifier
+// (which should be of the form "servicename.vN") and product.
+//
+// When an exact (service and version) match is found, the constraints for
+// that service are returned.
+//
+// When the requested version is not provided but the service is, we will
+// search for all alternative versions. If mutliple alternative versions
+// are found, the contrains of the latest available version are returned.
+//
+// When a service is not provided at all an error will be returned instead.
+//
+// When checkpoint is disabled or when a 404 is returned after making the
+// HTTP call, an ErrNoVersionConstraints error will be returned.
+func (h *Host) VersionConstraints(id, product string) (*Constraints, error) {
+        svc, _, err := parseServiceID(id)
+        if err != nil {
+                return nil, err
+        }
+
+        // Return early if checkpoint is disabled.
+        if disabled := os.Getenv("CHECKPOINT_DISABLE"); disabled != "" {
+                return nil, &ErrNoVersionConstraints{disabled: true}
+        }
+
+        // No services supported for an empty Host.
+        if h == nil || h.services == nil {
+                return nil, &ErrServiceNotProvided{service: svc}
+        }
+
+        // Try to get the service URL for the version service and
+        // return early if the service isn't provided by the host.
+        u, err := h.ServiceURL(versionServiceID)
+        if err != nil {
+                return nil, err
+        }
+
+        // Check if we have an exact (service and version) match.
+        if _, ok := h.services[id].(string); !ok {
+                // If we don't have an exact match, we search for all matching
+                // services and then use the service ID of the latest version.
+                var services []string
+                for serviceID := range h.services {
+                        if strings.HasPrefix(serviceID, svc+".") {
+                                services = append(services, serviceID)
+                        }
+                }
+
+                if len(services) == 0 {
+                        // No discovered services match the requested service.
+                        return nil, &ErrServiceNotProvided{hostname: h.hostname, service: svc}
+                }
+
+                // Set id to the latest service ID we found.
+                var latest *version.Version
+                for _, serviceID := range services {
+                        if _, ver, err := parseServiceID(serviceID); err == nil {
+                                if latest == nil || latest.LessThan(ver) {
+                                        id = serviceID
+                                        latest = ver
+                                }
+                        }
+                }
+        }
+
+        // Set a default timeout of 1 sec for the versions request (in milliseconds)
+        timeout := 1000
+        if v, err := strconv.Atoi(os.Getenv("CHECKPOINT_TIMEOUT")); err == nil {
+                timeout = v
+        }
+
+        client := &http.Client{
+                Transport: h.transport,
+                Timeout:   time.Duration(timeout) * time.Millisecond,
+        }
+
+        // Prepare the service URL by setting the service and product.
+        v := u.Query()
+        v.Set("product", product)
+        u.Path += id
+        u.RawQuery = v.Encode()
+
+        // Create a new request.
+        req, err := http.NewRequest("GET", u.String(), nil)
+        if err != nil {
+                return nil, fmt.Errorf("Failed to create version constraints request: %v", err)
+        }
+        req.Header.Set("Accept", "application/json")
+        req.Header.Set("User-Agent", httpclient.UserAgentString())
+
+        log.Printf("[DEBUG] Retrieve version constraints for service %s and product %s", id, product)
+
+        resp, err := client.Do(req)
+        if err != nil {
+                return nil, fmt.Errorf("Failed to request version constraints: %v", err)
+        }
+        defer resp.Body.Close()
+
+        if resp.StatusCode == 404 {
+                return nil, &ErrNoVersionConstraints{disabled: false}
+        }
+
+        if resp.StatusCode != 200 {
+                return nil, fmt.Errorf("Failed to request version constraints: %s", resp.Status)
+        }
+
+        // Parse the constraints from the response body.
+        result := &Constraints{}
+        if err := json.NewDecoder(resp.Body).Decode(result); err != nil {
+                return nil, fmt.Errorf("Error parsing version constraints: %v", err)
+        }
+
+        return result, nil
+}
+
+func parseServiceID(id string) (string, *version.Version, error) {
+        parts := strings.SplitN(id, ".", 2)
+        if len(parts) != 2 {
+                return "", nil, fmt.Errorf("Invalid service ID format (i.e. service.vN): %s", id)
+        }
+
+        version, err := version.NewVersion(parts[1])
+        if err != nil {
+                return "", nil, fmt.Errorf("Invalid service version: %v", err)
+        }
+
+        return parts[0], version, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/svchost/label_iter.go b/vendor/github.com/hashicorp/terraform/svchost/label_iter.go
new file mode 100644
index 0000000..af8ccba
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/svchost/label_iter.go
@@ -0,0 +1,69 @@
+package svchost
+
+import (
+        "strings"
+)
+
+// A labelIter allows iterating over domain name labels.
+//
+// This type is copied from golang.org/x/net/idna, where it is used
+// to segment hostnames into their separate labels for analysis. We use
+// it for the same purpose here, in ForComparison.
+type labelIter struct {
+        orig     string
+        slice    []string
+        curStart int
+        curEnd   int
+        i        int
+}
+
+func (l *labelIter) reset() {
+        l.curStart = 0
+        l.curEnd = 0
+        l.i = 0
+}
+
+func (l *labelIter) done() bool {
+        return l.curStart >= len(l.orig)
+}
+
+func (l *labelIter) result() string {
+        if l.slice != nil {
+                return strings.Join(l.slice, ".")
+        }
+        return l.orig
+}
+
+func (l *labelIter) label() string {
+        if l.slice != nil {
+                return l.slice[l.i]
+        }
+        p := strings.IndexByte(l.orig[l.curStart:], '.')
+        l.curEnd = l.curStart + p
+        if p == -1 {
+                l.curEnd = len(l.orig)
+        }
+        return l.orig[l.curStart:l.curEnd]
+}
+
+// next sets the value to the next label. It skips the last label if it is empty.
+func (l *labelIter) next() {
+        l.i++
+        if l.slice != nil {
+                if l.i >= len(l.slice) || l.i == len(l.slice)-1 && l.slice[l.i] == "" {
+                        l.curStart = len(l.orig)
+                }
+        } else {
+                l.curStart = l.curEnd + 1
+                if l.curStart == len(l.orig)-1 && l.orig[l.curStart] == '.' {
+                        l.curStart = len(l.orig)
+                }
+        }
+}
+
+func (l *labelIter) set(s string) {
+        if l.slice == nil {
+                l.slice = strings.Split(l.orig, ".")
+        }
+        l.slice[l.i] = s
+}
diff --git a/vendor/github.com/hashicorp/terraform/svchost/svchost.go b/vendor/github.com/hashicorp/terraform/svchost/svchost.go
new file mode 100644
index 0000000..4eded14
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/svchost/svchost.go
@@ -0,0 +1,207 @@
+// Package svchost deals with the representations of the so-called "friendly
+// hostnames" that we use to represent systems that provide Terraform-native
+// remote services, such as module registry, remote operations, etc.
+//
+// Friendly hostnames are specified such that, as much as possible, they
+// are consistent with how web browsers think of hostnames, so that users
+// can bring their intuitions about how hostnames behave when they access
+// a Terraform Enterprise instance's web UI (or indeed any other website)
+// and have this behave in a similar way.
+package svchost
+
+import (
+        "errors"
+        "fmt"
+        "strconv"
+        "strings"
+
+        "golang.org/x/net/idna"
+)
+
+// Hostname is specialized name for string that indicates that the string
+// has been converted to (or was already in) the storage and comparison form.
+//
+// Hostname values are not suitable for display in the user-interface. Use
+// the ForDisplay method to obtain a form suitable for display in the UI.
+//
+// Unlike user-supplied hostnames, strings of type Hostname (assuming they
+// were constructed by a function within this package) can be compared for
+// equality using the standard Go == operator.
+type Hostname string
+
+// acePrefix is the ASCII Compatible Encoding prefix, used to indicate that
+// a domain name label is in "punycode" form.
+const acePrefix = "xn--"
+
+// displayProfile is a very liberal idna profile that we use to do
+// normalization for display without imposing validation rules.
+var displayProfile = idna.New(
+        idna.MapForLookup(),
+        idna.Transitional(true),
+)
+
+// ForDisplay takes a user-specified hostname and returns a normalized form of
+// it suitable for display in the UI.
+//
+// If the input is so invalid that no normalization can be performed then
+// this will return the input, assuming that the caller still wants to
+// display _something_. This function is, however, more tolerant than the
+// other functions in this package and will make a best effort to prepare
+// _any_ given hostname for display.
+//
+// For validation, use either IsValid (for explicit validation) or
+// ForComparison (which implicitly validates, returning an error if invalid).
+func ForDisplay(given string) string {
+        var portPortion string
+        if colonPos := strings.Index(given, ":"); colonPos != -1 {
+                given, portPortion = given[:colonPos], given[colonPos:]
+        }
+        portPortion, _ = normalizePortPortion(portPortion)
+
+        ascii, err := displayProfile.ToASCII(given)
+        if err != nil {
+                return given + portPortion
+        }
+        display, err := displayProfile.ToUnicode(ascii)
+        if err != nil {
+                return given + portPortion
+        }
+        return display + portPortion
+}
+
+// IsValid returns true if the given user-specified hostname is a valid
+// service hostname.
+//
+// Validity is determined by complying with the RFC 5891 requirements for
+// names that are valid for domain lookup (section 5), with the additional
+// requirement that user-supplied forms must not _already_ contain
+// Punycode segments.
+func IsValid(given string) bool {
+        _, err := ForComparison(given)
+        return err == nil
+}
+
+// ForComparison takes a user-specified hostname and returns a normalized
+// form of it suitable for storage and comparison. The result is not suitable
+// for display to end-users because it uses Punycode to represent non-ASCII
+// characters, and this form is unreadable for non-ASCII-speaking humans.
+//
+// The result is typed as Hostname -- a specialized name for string -- so that
+// other APIs can make it clear within the type system whether they expect a
+// user-specified or display-form hostname or a value already normalized for
+// comparison.
+//
+// The returned Hostname is not valid if the returned error is non-nil.
+func ForComparison(given string) (Hostname, error) {
+        var portPortion string
+        if colonPos := strings.Index(given, ":"); colonPos != -1 {
+                given, portPortion = given[:colonPos], given[colonPos:]
+        }
+
+        var err error
+        portPortion, err = normalizePortPortion(portPortion)
+        if err != nil {
+                return Hostname(""), err
+        }
+
+        if given == "" {
+                return Hostname(""), fmt.Errorf("empty string is not a valid hostname")
+        }
+
+        // First we'll apply our additional constraint that Punycode must not
+        // be given directly by the user. This is not an IDN specification
+        // requirement, but we prohibit it to force users to use human-readable
+        // hostname forms within Terraform configuration.
+        labels := labelIter{orig: given}
+        for ; !labels.done(); labels.next() {
+                label := labels.label()
+                if label == "" {
+                        return Hostname(""), fmt.Errorf(
+                                "hostname contains empty label (two consecutive periods)",
+                        )
+                }
+                if strings.HasPrefix(label, acePrefix) {
+                        return Hostname(""), fmt.Errorf(
+                                "hostname label %q specified in punycode format; service hostnames must be given in unicode",
+                                label,
+                        )
+                }
+        }
+
+        result, err := idna.Lookup.ToASCII(given)
+        if err != nil {
+                return Hostname(""), err
+        }
+        return Hostname(result + portPortion), nil
+}
+
+// ForDisplay returns a version of the receiver that is appropriate for display
+// in the UI. This includes converting any punycode labels to their
+// corresponding Unicode characters.
+//
+// A round-trip through ForComparison and this ForDisplay method does not
+// guarantee the same result as calling this package's top-level ForDisplay
+// function, since a round-trip through the Hostname type implies stricter
+// handling than we do when doing basic display-only processing.
+func (h Hostname) ForDisplay() string {
+        given := string(h)
+        var portPortion string
+        if colonPos := strings.Index(given, ":"); colonPos != -1 {
+                given, portPortion = given[:colonPos], given[colonPos:]
+        }
+        // We don't normalize the port portion here because we assume it's
+        // already been normalized on the way in.
+
+        result, err := idna.Lookup.ToUnicode(given)
+        if err != nil {
+                // Should never happen, since type Hostname indicates that a string
+                // passed through our validation rules.
+                panic(fmt.Errorf("ForDisplay called on invalid Hostname: %s", err))
+        }
+        return result + portPortion
+}
+
+func (h Hostname) String() string {
+        return string(h)
+}
+
+func (h Hostname) GoString() string {
+        return fmt.Sprintf("svchost.Hostname(%q)", string(h))
+}
+
+// normalizePortPortion attempts to normalize the "port portion" of a hostname,
+// which begins with the first colon in the hostname and should be followed
+// by a string of decimal digits.
+//
+// If the port portion is valid, a normalized version of it is returned along
+// with a nil error.
+//
+// If the port portion is invalid, the input string is returned verbatim along
+// with a non-nil error.
+//
+// An empty string is a valid port portion representing the absense of a port.
+// If non-empty, the first character must be a colon.
+func normalizePortPortion(s string) (string, error) {
+        if s == "" {
+                return s, nil
+        }
+
+        if s[0] != ':' {
+                // should never happen, since caller tends to guarantee the presence
+                // of a colon due to how it's extracted from the string.
+                return s, errors.New("port portion is missing its initial colon")
+        }
+
+        numStr := s[1:]
+        num, err := strconv.Atoi(numStr)
+        if err != nil {
+                return s, errors.New("port portion contains non-digit characters")
+        }
+        if num == 443 {
+                return "", nil // ":443" is the default
+        }
+        if num > 65535 {
+                return s, errors.New("port number is greater than 65535")
+        }
+        return fmt.Sprintf(":%d", num), nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/context.go b/vendor/github.com/hashicorp/terraform/terraform/context.go
index a814a85..f133cc2 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/context.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/context.go
@@ -8,11 +8,13 @@ import (
         "strings"
         "sync"
 
+        "github.com/hashicorp/terraform/tfdiags"
+
         "github.com/hashicorp/go-multierror"
         "github.com/hashicorp/hcl"
         "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/config/module"
-        "github.com/hashicorp/terraform/helper/experiment"
+        "github.com/hashicorp/terraform/version"
 )
 
 // InputMode defines what sort of input will be asked for when Input
@@ -123,7 +125,7 @@ type Context struct {
 func NewContext(opts *ContextOpts) (*Context, error) {
         // Validate the version requirement if it is given
         if opts.Module != nil {
-                if err := checkRequiredVersion(opts.Module); err != nil {
+                if err := CheckRequiredVersion(opts.Module); err != nil {
                         return nil, err
                 }
         }
@@ -143,19 +145,14 @@ func NewContext(opts *ContextOpts) (*Context, error) {
 
         // If our state is from the future, then error. Callers can avoid
         // this error by explicitly setting `StateFutureAllowed`.
-        if !opts.StateFutureAllowed && state.FromFutureTerraform() {
-                return nil, fmt.Errorf(
-                        "Terraform doesn't allow running any operations against a state\n"+
-                                "that was written by a future Terraform version. The state is\n"+
-                                "reporting it is written by Terraform '%s'.\n\n"+
-                                "Please run at least that version of Terraform to continue.",
-                        state.TFVersion)
+        if err := CheckStateVersion(state); err != nil && !opts.StateFutureAllowed {
+                return nil, err
         }
 
         // Explicitly reset our state version to our current version so that
         // any operations we do will write out that our latest version
         // has run.
-        state.TFVersion = Version
+        state.TFVersion = version.Version
 
         // Determine parallelism, default to 10. We do this both to limit
         // CPU pressure but also to have an extra guard against rate throttling
@@ -465,7 +462,7 @@ func (c *Context) Input(mode InputMode) error {
                 }
 
                 // Do the walk
-                if _, err := c.walk(graph, nil, walkInput); err != nil {
+                if _, err := c.walk(graph, walkInput); err != nil {
                         return err
                 }
         }
@@ -490,6 +487,13 @@ func (c *Context) Input(mode InputMode) error {
 func (c *Context) Apply() (*State, error) {
         defer c.acquireRun("apply")()
 
+        // Check there are no empty target parameter values
+        for _, target := range c.targets {
+                if target == "" {
+                        return nil, fmt.Errorf("Target parameter must not have empty value")
+                }
+        }
+
         // Copy our own state
         c.state = c.state.DeepCopy()
 
@@ -506,7 +510,7 @@ func (c *Context) Apply() (*State, error) {
         }
 
         // Walk the graph
-        walker, err := c.walk(graph, graph, operation)
+        walker, err := c.walk(graph, operation)
         if len(walker.ValidationErrors) > 0 {
                 err = multierror.Append(err, walker.ValidationErrors...)
         }
@@ -527,19 +531,27 @@ func (c *Context) Apply() (*State, error) {
 func (c *Context) Plan() (*Plan, error) {
         defer c.acquireRun("plan")()
 
+        // Check there are no empty target parameter values
+        for _, target := range c.targets {
+                if target == "" {
+                        return nil, fmt.Errorf("Target parameter must not have empty value")
+                }
+        }
+
         p := &Plan{
                 Module:  c.module,
                 Vars:    c.variables,
                 State:   c.state,
                 Targets: c.targets,
 
-                TerraformVersion: VersionString(),
+                TerraformVersion: version.String(),
                 ProviderSHA256s:  c.providerSHA256s,
         }
 
         var operation walkOperation
         if c.destroy {
                 operation = walkPlanDestroy
+                p.Destroy = true
         } else {
                 // Set our state to be something temporary. We do this so that
                 // the plan can update a fake state so that variables work, then
@@ -575,7 +587,7 @@ func (c *Context) Plan() (*Plan, error) {
         }
 
         // Do the walk
-        walker, err := c.walk(graph, graph, operation)
+        walker, err := c.walk(graph, operation)
         if err != nil {
                 return nil, err
         }
@@ -630,7 +642,7 @@ func (c *Context) Refresh() (*State, error) {
         }
 
         // Do the walk
-        if _, err := c.walk(graph, graph, walkRefresh); err != nil {
+        if _, err := c.walk(graph, walkRefresh); err != nil {
                 return nil, err
         }
 
@@ -670,29 +682,27 @@ func (c *Context) Stop() {
 }
 
 // Validate validates the configuration and returns any warnings or errors.
-func (c *Context) Validate() ([]string, []error) {
+func (c *Context) Validate() tfdiags.Diagnostics {
         defer c.acquireRun("validate")()
 
-        var errs error
+        var diags tfdiags.Diagnostics
 
         // Validate the configuration itself
-        if err := c.module.Validate(); err != nil {
-                errs = multierror.Append(errs, err)
-        }
+        diags = diags.Append(c.module.Validate())
 
         // This only needs to be done for the root module, since inter-module
         // variables are validated in the module tree.
         if config := c.module.Config(); config != nil {
                 // Validate the user variables
-                if err := smcUserVariables(config, c.variables); len(err) > 0 {
-                        errs = multierror.Append(errs, err...)
+                for _, err := range smcUserVariables(config, c.variables) {
+                        diags = diags.Append(err)
                 }
         }
 
         // If we have errors at this point, the graphing has no chance,
         // so just bail early.
-        if errs != nil {
-                return nil, []error{errs}
+        if diags.HasErrors() {
+                return diags
         }
 
         // Build the graph so we can walk it and run Validate on nodes.
@@ -701,24 +711,29 @@ func (c *Context) Validate() ([]string, []error) {
         // graph again later after Planning.
         graph, err := c.Graph(GraphTypeValidate, nil)
         if err != nil {
-                return nil, []error{err}
+                diags = diags.Append(err)
+                return diags
         }
 
         // Walk
-        walker, err := c.walk(graph, graph, walkValidate)
+        walker, err := c.walk(graph, walkValidate)
         if err != nil {
-                return nil, multierror.Append(errs, err).Errors
+                diags = diags.Append(err)
         }
 
-        // Return the result
-        rerrs := multierror.Append(errs, walker.ValidationErrors...)
-
         sort.Strings(walker.ValidationWarnings)
-        sort.Slice(rerrs.Errors, func(i, j int) bool {
-                return rerrs.Errors[i].Error() < rerrs.Errors[j].Error()
+        sort.Slice(walker.ValidationErrors, func(i, j int) bool {
+                return walker.ValidationErrors[i].Error() < walker.ValidationErrors[j].Error()
         })
 
-        return walker.ValidationWarnings, rerrs.Errors
+        for _, warn := range walker.ValidationWarnings {
+                diags = diags.Append(tfdiags.SimpleWarning(warn))
+        }
+        for _, err := range walker.ValidationErrors {
+                diags = diags.Append(err)
+        }
+
+        return diags
 }
 
 // Module returns the module tree associated with this context.
@@ -792,33 +807,11 @@ func (c *Context) releaseRun() {
         c.runContext = nil
 }
 
-func (c *Context) walk(
-        graph, shadow *Graph, operation walkOperation) (*ContextGraphWalker, error) {
+func (c *Context) walk(graph *Graph, operation walkOperation) (*ContextGraphWalker, error) {
         // Keep track of the "real" context which is the context that does
         // the real work: talking to real providers, modifying real state, etc.
         realCtx := c
 
-        // If we don't want shadowing, remove it
-        if !experiment.Enabled(experiment.X_shadow) {
-                shadow = nil
-        }
-
-        // Just log this so we can see it in a debug log
-        if !c.shadow {
-                log.Printf("[WARN] terraform: shadow graph disabled")
-                shadow = nil
-        }
-
-        // If we have a shadow graph, walk that as well
-        var shadowCtx *Context
-        var shadowCloser Shadow
-        if shadow != nil {
-                // Build the shadow context. In the process, override the real context
-                // with the one that is wrapped so that the shadow context can verify
-                // the results of the real.
-                realCtx, shadowCtx, shadowCloser = newShadowContext(c)
-        }
-
         log.Printf("[DEBUG] Starting graph walk: %s", operation.String())
 
         walker := &ContextGraphWalker{
@@ -837,90 +830,6 @@ func (c *Context) walk(
         close(watchStop)
         <-watchWait
 
-        // If we have a shadow graph and we interrupted the real graph, then
-        // we just close the shadow and never verify it. It is non-trivial to
-        // recreate the exact execution state up until an interruption so this
-        // isn't supported with shadows at the moment.
-        if shadowCloser != nil && c.sh.Stopped() {
-                // Ignore the error result, there is nothing we could care about
-                shadowCloser.CloseShadow()
-
-                // Set it to nil so we don't do anything
-                shadowCloser = nil
-        }
-
-        // If we have a shadow graph, wait for that to complete.
-        if shadowCloser != nil {
-                // Build the graph walker for the shadow. We also wrap this in
-                // a panicwrap so that panics are captured. For the shadow graph,
-                // we just want panics to be normal errors rather than to crash
-                // Terraform.
-                shadowWalker := GraphWalkerPanicwrap(&ContextGraphWalker{
-                        Context:   shadowCtx,
-                        Operation: operation,
-                })
-
-                // Kick off the shadow walk. This will block on any operations
-                // on the real walk so it is fine to start first.
-                log.Printf("[INFO] Starting shadow graph walk: %s", operation.String())
-                shadowCh := make(chan error)
-                go func() {
-                        shadowCh <- shadow.Walk(shadowWalker)
-                }()
-
-                // Notify the shadow that we're done
-                if err := shadowCloser.CloseShadow(); err != nil {
-                        c.shadowErr = multierror.Append(c.shadowErr, err)
-                }
-
-                // Wait for the walk to end
-                log.Printf("[DEBUG] Waiting for shadow graph to complete...")
-                shadowWalkErr := <-shadowCh
-
-                // Get any shadow errors
-                if err := shadowCloser.ShadowError(); err != nil {
-                        c.shadowErr = multierror.Append(c.shadowErr, err)
-                }
-
-                // Verify the contexts (compare)
-                if err := shadowContextVerify(realCtx, shadowCtx); err != nil {
-                        c.shadowErr = multierror.Append(c.shadowErr, err)
-                }
-
-                // At this point, if we're supposed to fail on error, then
-                // we PANIC. Some tests just verify that there is an error,
-                // so simply appending it to realErr and returning could hide
-                // shadow problems.
-                //
-                // This must be done BEFORE appending shadowWalkErr since the
-                // shadowWalkErr may include expected errors.
-                //
-                // We only do this if we don't have a real error. In the case of
-                // a real error, we can't guarantee what nodes were and weren't
-                // traversed in parallel scenarios so we can't guarantee no
-                // shadow errors.
-                if c.shadowErr != nil && contextFailOnShadowError && realErr == nil {
-                        panic(multierror.Prefix(c.shadowErr, "shadow graph:"))
-                }
-
-                // Now, if we have a walk error, we append that through
-                if shadowWalkErr != nil {
-                        c.shadowErr = multierror.Append(c.shadowErr, shadowWalkErr)
-                }
-
-                if c.shadowErr == nil {
-                        log.Printf("[INFO] Shadow graph success!")
-                } else {
-                        log.Printf("[ERROR] Shadow graph error: %s", c.shadowErr)
-
-                        // If we're supposed to fail on shadow errors, then report it
-                        if contextFailOnShadowError {
-                                realErr = multierror.Append(realErr, multierror.Prefix(
-                                        c.shadowErr, "shadow graph:"))
-                        }
-                }
-        }
-
         return walker, realErr
 }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/context_import.go b/vendor/github.com/hashicorp/terraform/terraform/context_import.go
index f1d5776..e940143 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/context_import.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/context_import.go
@@ -66,7 +66,7 @@ func (c *Context) Import(opts *ImportOpts) (*State, error) {
         }
 
         // Walk it
-        if _, err := c.walk(graph, nil, walkImport); err != nil {
+        if _, err := c.walk(graph, walkImport); err != nil {
                 return c.state, err
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/diff.go b/vendor/github.com/hashicorp/terraform/terraform/diff.go
index fd1687e..d6dc550 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/diff.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/diff.go
@@ -23,6 +23,12 @@ const (
         DiffUpdate
         DiffDestroy
         DiffDestroyCreate
+
+        // DiffRefresh is only used in the UI for displaying diffs.
+        // Managed resource reads never appear in plan, and when data source
+        // reads appear they are represented as DiffCreate in core before
+        // transforming to DiffRefresh in the UI layer.
+        DiffRefresh // TODO: Actually use DiffRefresh in core too, for less confusion
 )
 
 // multiVal matches the index key to a flatmapped set, list or map
@@ -831,7 +837,14 @@ func (d *InstanceDiff) Same(d2 *InstanceDiff) (bool, string) {
                         }
                 }
 
-                // TODO: check for the same value if not computed
+                // We don't compare the values because we can't currently actually
+                // guarantee to generate the same value two two diffs created from
+                // the same state+config: we have some pesky interpolation functions
+                // that do not behave as pure functions (uuid, timestamp) and so they
+                // can be different each time a diff is produced.
+                // FIXME: Re-organize our config handling so that we don't re-evaluate
+                // expressions when we produce a second comparison diff during
+                // apply (for EvalCompareDiff).
         }
 
         // Check for leftover attributes
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval.go b/vendor/github.com/hashicorp/terraform/terraform/eval.go
index 3cb088a..10d9c22 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval.go
@@ -49,11 +49,11 @@ func EvalRaw(n EvalNode, ctx EvalContext) (interface{}, error) {
                 path = strings.Join(ctx.Path(), ".")
         }
 
-        log.Printf("[DEBUG] %s: eval: %T", path, n)
+        log.Printf("[TRACE] %s: eval: %T", path, n)
         output, err := n.Eval(ctx)
         if err != nil {
                 if _, ok := err.(EvalEarlyExitError); ok {
-                        log.Printf("[DEBUG] %s: eval: %T, err: %s", path, n, err)
+                        log.Printf("[TRACE] %s: eval: %T, err: %s", path, n, err)
                 } else {
                         log.Printf("[ERROR] %s: eval: %T, err: %s", path, n, err)
                 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_apply.go b/vendor/github.com/hashicorp/terraform/terraform/eval_apply.go
index 2f6a497..b9b4806 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_apply.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_apply.go
@@ -112,7 +112,7 @@ func (n *EvalApplyPre) Eval(ctx EvalContext) (interface{}, error) {
         }
         state.init()
 
-        {
+        if resourceHasUserVisibleApply(n.Info) {
                 // Call post-apply hook
                 err := ctx.Hook(func(h Hook) (HookAction, error) {
                         return h.PreApply(n.Info, state, diff)
@@ -136,7 +136,7 @@ type EvalApplyPost struct {
 func (n *EvalApplyPost) Eval(ctx EvalContext) (interface{}, error) {
         state := *n.State
 
-        {
+        if resourceHasUserVisibleApply(n.Info) {
                 // Call post-apply hook
                 err := ctx.Hook(func(h Hook) (HookAction, error) {
                         return h.PostApply(n.Info, state, *n.Error)
@@ -149,6 +149,22 @@ func (n *EvalApplyPost) Eval(ctx EvalContext) (interface{}, error) {
         return nil, *n.Error
 }
 
+// resourceHasUserVisibleApply returns true if the given resource is one where
+// apply actions should be exposed to the user.
+//
+// Certain resources do apply actions only as an implementation detail, so
+// these should not be advertised to code outside of this package.
+func resourceHasUserVisibleApply(info *InstanceInfo) bool {
+        addr := info.ResourceAddress()
+
+        // Only managed resources have user-visible apply actions.
+        // In particular, this excludes data resources since we "apply" these
+        // only as an implementation detail of removing them from state when
+        // they are destroyed. (When reading, they don't get here at all because
+        // we present them as "Refresh" actions.)
+        return addr.Mode == config.ManagedResourceMode
+}
+
 // EvalApplyProvisioners is an EvalNode implementation that executes
 // the provisioners for a resource.
 //
@@ -211,11 +227,8 @@ func (n *EvalApplyProvisioners) Eval(ctx EvalContext) (interface{}, error) {
                         state.Tainted = true
                 }
 
-                if n.Error != nil {
-                        *n.Error = multierror.Append(*n.Error, err)
-                } else {
-                        return nil, err
-                }
+                *n.Error = multierror.Append(*n.Error, err)
+                return nil, err
         }
 
         {
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_context.go b/vendor/github.com/hashicorp/terraform/terraform/eval_context.go
index a1f815b..86481de 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_context.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_context.go
@@ -22,11 +22,11 @@ type EvalContext interface {
         // Input is the UIInput object for interacting with the UI.
         Input() UIInput
 
-        // InitProvider initializes the provider with the given name and
+        // InitProvider initializes the provider with the given type and name, and
         // returns the implementation of the resource provider or an error.
         //
         // It is an error to initialize the same provider more than once.
-        InitProvider(string) (ResourceProvider, error)
+        InitProvider(typ string, name string) (ResourceProvider, error)
 
         // Provider gets the provider instance with the given name (already
         // initialized) or returns nil if the provider isn't initialized.
@@ -40,8 +40,6 @@ type EvalContext interface {
         // is used to store the provider configuration for inheritance lookups
         // with ParentProviderConfig().
         ConfigureProvider(string, *ResourceConfig) error
-        SetProviderConfig(string, *ResourceConfig) error
-        ParentProviderConfig(string) *ResourceConfig
 
         // ProviderInput and SetProviderInput are used to configure providers
         // from user input.
@@ -69,6 +67,13 @@ type EvalContext interface {
         // that is currently being acted upon.
         Interpolate(*config.RawConfig, *Resource) (*ResourceConfig, error)
 
+        // InterpolateProvider takes a ProviderConfig and interpolates it with the
+        // stored interpolation scope. Since provider configurations can be
+        // inherited, the interpolation scope may be different from the current
+        // context path. Interplation is otherwise executed the same as in the
+        // Interpolation method.
+        InterpolateProvider(*config.ProviderConfig, *Resource) (*ResourceConfig, error)
+
         // SetVariables sets the variables for the module within
         // this context with the name n. This function call is additive:
         // the second parameter is merged with any previous call.
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_context_builtin.go b/vendor/github.com/hashicorp/terraform/terraform/eval_context_builtin.go
index 3dcfb22..1b6ee5a 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_context_builtin.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_context_builtin.go
@@ -4,7 +4,6 @@ import (
         "context"
         "fmt"
         "log"
-        "strings"
         "sync"
 
         "github.com/hashicorp/terraform/config"
@@ -34,7 +33,6 @@ type BuiltinEvalContext struct {
         Hooks               []Hook
         InputValue          UIInput
         ProviderCache       map[string]ResourceProvider
-        ProviderConfigCache map[string]*ResourceConfig
         ProviderInputConfig map[string]map[string]interface{}
         ProviderLock        *sync.Mutex
         ProvisionerCache    map[string]ResourceProvisioner
@@ -80,12 +78,12 @@ func (ctx *BuiltinEvalContext) Input() UIInput {
         return ctx.InputValue
 }
 
-func (ctx *BuiltinEvalContext) InitProvider(n string) (ResourceProvider, error) {
+func (ctx *BuiltinEvalContext) InitProvider(typeName, name string) (ResourceProvider, error) {
         ctx.once.Do(ctx.init)
 
         // If we already initialized, it is an error
-        if p := ctx.Provider(n); p != nil {
-                return nil, fmt.Errorf("Provider '%s' already initialized", n)
+        if p := ctx.Provider(name); p != nil {
+                return nil, fmt.Errorf("Provider '%s' already initialized", name)
         }
 
         // Warning: make sure to acquire these locks AFTER the call to Provider
@@ -93,18 +91,12 @@ func (ctx *BuiltinEvalContext) InitProvider(n string) (ResourceProvider, error)
         ctx.ProviderLock.Lock()
         defer ctx.ProviderLock.Unlock()
 
-        providerPath := make([]string, len(ctx.Path())+1)
-        copy(providerPath, ctx.Path())
-        providerPath[len(providerPath)-1] = n
-        key := PathCacheKey(providerPath)
-
-        typeName := strings.SplitN(n, ".", 2)[0]
-        p, err := ctx.Components.ResourceProvider(typeName, key)
+        p, err := ctx.Components.ResourceProvider(typeName, name)
         if err != nil {
                 return nil, err
         }
 
-        ctx.ProviderCache[key] = p
+        ctx.ProviderCache[name] = p
         return p, nil
 }
 
@@ -114,11 +106,7 @@ func (ctx *BuiltinEvalContext) Provider(n string) ResourceProvider {
         ctx.ProviderLock.Lock()
         defer ctx.ProviderLock.Unlock()
 
-        providerPath := make([]string, len(ctx.Path())+1)
-        copy(providerPath, ctx.Path())
-        providerPath[len(providerPath)-1] = n
-
-        return ctx.ProviderCache[PathCacheKey(providerPath)]
+        return ctx.ProviderCache[n]
 }
 
 func (ctx *BuiltinEvalContext) CloseProvider(n string) error {
@@ -127,15 +115,11 @@ func (ctx *BuiltinEvalContext) CloseProvider(n string) error {
         ctx.ProviderLock.Lock()
         defer ctx.ProviderLock.Unlock()
 
-        providerPath := make([]string, len(ctx.Path())+1)
-        copy(providerPath, ctx.Path())
-        providerPath[len(providerPath)-1] = n
-
         var provider interface{}
-        provider = ctx.ProviderCache[PathCacheKey(providerPath)]
+        provider = ctx.ProviderCache[n]
         if provider != nil {
                 if p, ok := provider.(ResourceProviderCloser); ok {
-                        delete(ctx.ProviderCache, PathCacheKey(providerPath))
+                        delete(ctx.ProviderCache, n)
                         return p.Close()
                 }
         }
@@ -149,28 +133,9 @@ func (ctx *BuiltinEvalContext) ConfigureProvider(
         if p == nil {
                 return fmt.Errorf("Provider '%s' not initialized", n)
         }
-
-        if err := ctx.SetProviderConfig(n, cfg); err != nil {
-                return nil
-        }
-
         return p.Configure(cfg)
 }
 
-func (ctx *BuiltinEvalContext) SetProviderConfig(
-        n string, cfg *ResourceConfig) error {
-        providerPath := make([]string, len(ctx.Path())+1)
-        copy(providerPath, ctx.Path())
-        providerPath[len(providerPath)-1] = n
-
-        // Save the configuration
-        ctx.ProviderLock.Lock()
-        ctx.ProviderConfigCache[PathCacheKey(providerPath)] = cfg
-        ctx.ProviderLock.Unlock()
-
-        return nil
-}
-
 func (ctx *BuiltinEvalContext) ProviderInput(n string) map[string]interface{} {
         ctx.ProviderLock.Lock()
         defer ctx.ProviderLock.Unlock()
@@ -203,27 +168,6 @@ func (ctx *BuiltinEvalContext) SetProviderInput(n string, c map[string]interface
         ctx.ProviderLock.Unlock()
 }
 
-func (ctx *BuiltinEvalContext) ParentProviderConfig(n string) *ResourceConfig {
-        ctx.ProviderLock.Lock()
-        defer ctx.ProviderLock.Unlock()
-
-        // Make a copy of the path so we can safely edit it
-        path := ctx.Path()
-        pathCopy := make([]string, len(path)+1)
-        copy(pathCopy, path)
-
-        // Go up the tree.
-        for i := len(path) - 1; i >= 0; i-- {
-                pathCopy[i+1] = n
-                k := PathCacheKey(pathCopy[:i+2])
-                if v, ok := ctx.ProviderConfigCache[k]; ok {
-                        return v
-                }
-        }
-
-        return nil
-}
-
 func (ctx *BuiltinEvalContext) InitProvisioner(
         n string) (ResourceProvisioner, error) {
         ctx.once.Do(ctx.init)
@@ -289,6 +233,7 @@ func (ctx *BuiltinEvalContext) CloseProvisioner(n string) error {
 
 func (ctx *BuiltinEvalContext) Interpolate(
         cfg *config.RawConfig, r *Resource) (*ResourceConfig, error) {
+
         if cfg != nil {
                 scope := &InterpolationScope{
                         Path:     ctx.Path(),
@@ -311,6 +256,35 @@ func (ctx *BuiltinEvalContext) Interpolate(
         return result, nil
 }
 
+func (ctx *BuiltinEvalContext) InterpolateProvider(
+        pc *config.ProviderConfig, r *Resource) (*ResourceConfig, error) {
+
+        var cfg *config.RawConfig
+
+        if pc != nil && pc.RawConfig != nil {
+                scope := &InterpolationScope{
+                        Path:     ctx.Path(),
+                        Resource: r,
+                }
+
+                cfg = pc.RawConfig
+
+                vs, err := ctx.Interpolater.Values(scope, cfg.Variables)
+                if err != nil {
+                        return nil, err
+                }
+
+                // Do the interpolation
+                if err := cfg.Interpolate(vs); err != nil {
+                        return nil, err
+                }
+        }
+
+        result := NewResourceConfig(cfg)
+        result.interpolateForce()
+        return result, nil
+}
+
 func (ctx *BuiltinEvalContext) Path() []string {
         return ctx.PathValue
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_context_mock.go b/vendor/github.com/hashicorp/terraform/terraform/eval_context_mock.go
index 4f90d5b..6464517 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_context_mock.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_context_mock.go
@@ -45,14 +45,6 @@ type MockEvalContext struct {
         ConfigureProviderConfig *ResourceConfig
         ConfigureProviderError  error
 
-        SetProviderConfigCalled bool
-        SetProviderConfigName   string
-        SetProviderConfigConfig *ResourceConfig
-
-        ParentProviderConfigCalled bool
-        ParentProviderConfigName   string
-        ParentProviderConfigConfig *ResourceConfig
-
         InitProvisionerCalled      bool
         InitProvisionerName        string
         InitProvisionerProvisioner ResourceProvisioner
@@ -72,6 +64,12 @@ type MockEvalContext struct {
         InterpolateConfigResult *ResourceConfig
         InterpolateError        error
 
+        InterpolateProviderCalled       bool
+        InterpolateProviderConfig       *config.ProviderConfig
+        InterpolateProviderResource     *Resource
+        InterpolateProviderConfigResult *ResourceConfig
+        InterpolateProviderError        error
+
         PathCalled bool
         PathPath   []string
 
@@ -109,7 +107,7 @@ func (c *MockEvalContext) Input() UIInput {
         return c.InputInput
 }
 
-func (c *MockEvalContext) InitProvider(n string) (ResourceProvider, error) {
+func (c *MockEvalContext) InitProvider(t, n string) (ResourceProvider, error) {
         c.InitProviderCalled = true
         c.InitProviderName = n
         return c.InitProviderProvider, c.InitProviderError
@@ -134,20 +132,6 @@ func (c *MockEvalContext) ConfigureProvider(n string, cfg *ResourceConfig) error
         return c.ConfigureProviderError
 }
 
-func (c *MockEvalContext) SetProviderConfig(
-        n string, cfg *ResourceConfig) error {
-        c.SetProviderConfigCalled = true
-        c.SetProviderConfigName = n
-        c.SetProviderConfigConfig = cfg
-        return nil
-}
-
-func (c *MockEvalContext) ParentProviderConfig(n string) *ResourceConfig {
-        c.ParentProviderConfigCalled = true
-        c.ParentProviderConfigName = n
-        return c.ParentProviderConfigConfig
-}
-
 func (c *MockEvalContext) ProviderInput(n string) map[string]interface{} {
         c.ProviderInputCalled = true
         c.ProviderInputName = n
@@ -186,6 +170,14 @@ func (c *MockEvalContext) Interpolate(
         return c.InterpolateConfigResult, c.InterpolateError
 }
 
+func (c *MockEvalContext) InterpolateProvider(
+        config *config.ProviderConfig, resource *Resource) (*ResourceConfig, error) {
+        c.InterpolateProviderCalled = true
+        c.InterpolateProviderConfig = config
+        c.InterpolateProviderResource = resource
+        return c.InterpolateProviderConfigResult, c.InterpolateError
+}
+
 func (c *MockEvalContext) Path() []string {
         c.PathCalled = true
         return c.PathPath
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go b/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go
index c35f908..26205ce 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_diff.go
@@ -6,6 +6,7 @@ import (
         "strings"
 
         "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/version"
 )
 
 // EvalCompareDiff is an EvalNode implementation that compares two diffs
@@ -60,7 +61,7 @@ func (n *EvalCompareDiff) Eval(ctx EvalContext) (interface{}, error) {
                                 "\n"+
                                 "Also include as much context as you can about your config, state, "+
                                 "and the steps you performed to trigger this error.\n",
-                        n.Info.Id, Version, n.Info.Id, reason, one, two)
+                        n.Info.Id, version.Version, n.Info.Id, reason, one, two)
         }
 
         return nil, nil
@@ -255,11 +256,15 @@ func (n *EvalDiff) processIgnoreChanges(diff *InstanceDiff) error {
                 containers := groupContainers(diff)
                 keep := map[string]bool{}
                 for _, v := range containers {
-                        if v.keepDiff() {
+                        if v.keepDiff(ignorableAttrKeys) {
                                 // At least one key has changes, so list all the sibling keys
-                                // to keep in the diff.
+                                // to keep in the diff
                                 for k := range v {
                                         keep[k] = true
+                                        // this key may have been added by the user to ignore, but
+                                        // if it's a subkey in a container, we need to un-ignore it
+                                        // to keep the complete containter.
+                                        delete(ignorableAttrKeys, k)
                                 }
                         }
                 }
@@ -291,10 +296,17 @@ func (n *EvalDiff) processIgnoreChanges(diff *InstanceDiff) error {
 // a group of key-*ResourceAttrDiff pairs from the same flatmapped container
 type flatAttrDiff map[string]*ResourceAttrDiff
 
-// we need to keep all keys if any of them have a diff
-func (f flatAttrDiff) keepDiff() bool {
-        for _, v := range f {
-                if !v.Empty() && !v.NewComputed {
+// we need to keep all keys if any of them have a diff that's not ignored
+func (f flatAttrDiff) keepDiff(ignoreChanges map[string]bool) bool {
+        for k, v := range f {
+                ignore := false
+                for attr := range ignoreChanges {
+                        if strings.HasPrefix(k, attr) {
+                                ignore = true
+                        }
+                }
+
+                if !v.Empty() && !v.NewComputed && !ignore {
                         return true
                 }
         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_interpolate.go b/vendor/github.com/hashicorp/terraform/terraform/eval_interpolate.go
index 6825ff5..6a78a6b 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_interpolate.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_interpolate.go
@@ -1,18 +1,50 @@
 package terraform
 
-import "github.com/hashicorp/terraform/config"
+import (
+        "log"
+
+        "github.com/hashicorp/terraform/config"
+)
 
 // EvalInterpolate is an EvalNode implementation that takes a raw
 // configuration and interpolates it.
 type EvalInterpolate struct {
-        Config   *config.RawConfig
-        Resource *Resource
-        Output   **ResourceConfig
+        Config        *config.RawConfig
+        Resource      *Resource
+        Output        **ResourceConfig
+        ContinueOnErr bool
 }
 
 func (n *EvalInterpolate) Eval(ctx EvalContext) (interface{}, error) {
         rc, err := ctx.Interpolate(n.Config, n.Resource)
         if err != nil {
+                if n.ContinueOnErr {
+                        log.Printf("[WARN] Interpolation %q failed: %s", n.Config.Key, err)
+                        return nil, EvalEarlyExitError{}
+                }
+                return nil, err
+        }
+
+        if n.Output != nil {
+                *n.Output = rc
+        }
+
+        return nil, nil
+}
+
+// EvalInterpolateProvider is an EvalNode implementation that takes a
+// ProviderConfig and interpolates it. Provider configurations are the only
+// "inherited" type of configuration we have, and the original raw config may
+// have a different interpolation scope.
+type EvalInterpolateProvider struct {
+        Config   *config.ProviderConfig
+        Resource *Resource
+        Output   **ResourceConfig
+}
+
+func (n *EvalInterpolateProvider) Eval(ctx EvalContext) (interface{}, error) {
+        rc, err := ctx.InterpolateProvider(n.Config, n.Resource)
+        if err != nil {
                 return nil, err
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_local.go b/vendor/github.com/hashicorp/terraform/terraform/eval_local.go
new file mode 100644
index 0000000..a4b2a50
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_local.go
@@ -0,0 +1,86 @@
+package terraform
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/config"
+)
+
+// EvalLocal is an EvalNode implementation that evaluates the
+// expression for a local value and writes it into a transient part of
+// the state.
+type EvalLocal struct {
+        Name  string
+        Value *config.RawConfig
+}
+
+func (n *EvalLocal) Eval(ctx EvalContext) (interface{}, error) {
+        cfg, err := ctx.Interpolate(n.Value, nil)
+        if err != nil {
+                return nil, fmt.Errorf("local.%s: %s", n.Name, err)
+        }
+
+        state, lock := ctx.State()
+        if state == nil {
+                return nil, fmt.Errorf("cannot write local value to nil state")
+        }
+
+        // Get a write lock so we can access the state
+        lock.Lock()
+        defer lock.Unlock()
+
+        // Look for the module state. If we don't have one, create it.
+        mod := state.ModuleByPath(ctx.Path())
+        if mod == nil {
+                mod = state.AddModule(ctx.Path())
+        }
+
+        // Get the value from the config
+        var valueRaw interface{} = config.UnknownVariableValue
+        if cfg != nil {
+                var ok bool
+                valueRaw, ok = cfg.Get("value")
+                if !ok {
+                        valueRaw = ""
+                }
+                if cfg.IsComputed("value") {
+                        valueRaw = config.UnknownVariableValue
+                }
+        }
+
+        if mod.Locals == nil {
+                // initialize
+                mod.Locals = map[string]interface{}{}
+        }
+        mod.Locals[n.Name] = valueRaw
+
+        return nil, nil
+}
+
+// EvalDeleteLocal is an EvalNode implementation that deletes a Local value
+// from the state. Locals aren't persisted, but we don't need to evaluate them
+// during destroy.
+type EvalDeleteLocal struct {
+        Name string
+}
+
+func (n *EvalDeleteLocal) Eval(ctx EvalContext) (interface{}, error) {
+        state, lock := ctx.State()
+        if state == nil {
+                return nil, nil
+        }
+
+        // Get a write lock so we can access this instance
+        lock.Lock()
+        defer lock.Unlock()
+
+        // Look for the module state. If we don't have one, create it.
+        mod := state.ModuleByPath(ctx.Path())
+        if mod == nil {
+                return nil, nil
+        }
+
+        delete(mod.Locals, n.Name)
+
+        return nil, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_output.go b/vendor/github.com/hashicorp/terraform/terraform/eval_output.go
index cf61781..a834627 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_output.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_output.go
@@ -41,15 +41,16 @@ type EvalWriteOutput struct {
         Name      string
         Sensitive bool
         Value     *config.RawConfig
+        // ContinueOnErr allows interpolation to fail during Input
+        ContinueOnErr bool
 }
 
 // TODO: test
 func (n *EvalWriteOutput) Eval(ctx EvalContext) (interface{}, error) {
+        // This has to run before we have a state lock, since interpolation also
+        // reads the state
         cfg, err := ctx.Interpolate(n.Value, nil)
-        if err != nil {
-                // Log error but continue anyway
-                log.Printf("[WARN] Output interpolation %q failed: %s", n.Name, err)
-        }
+        // handle the error after we have the module from the state
 
         state, lock := ctx.State()
         if state == nil {
@@ -59,13 +60,27 @@ func (n *EvalWriteOutput) Eval(ctx EvalContext) (interface{}, error) {
         // Get a write lock so we can access this instance
         lock.Lock()
         defer lock.Unlock()
-
         // Look for the module state. If we don't have one, create it.
         mod := state.ModuleByPath(ctx.Path())
         if mod == nil {
                 mod = state.AddModule(ctx.Path())
         }
 
+        // handling the interpolation error
+        if err != nil {
+                if n.ContinueOnErr || flagWarnOutputErrors {
+                        log.Printf("[ERROR] Output interpolation %q failed: %s", n.Name, err)
+                        // if we're continuing, make sure the output is included, and
+                        // marked as unknown
+                        mod.Outputs[n.Name] = &OutputState{
+                                Type:  "string",
+                                Value: config.UnknownVariableValue,
+                        }
+                        return nil, EvalEarlyExitError{}
+                }
+                return nil, err
+        }
+
         // Get the value from the config
         var valueRaw interface{} = config.UnknownVariableValue
         if cfg != nil {
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_provider.go b/vendor/github.com/hashicorp/terraform/terraform/eval_provider.go
index 092fd18..61f6ff9 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_provider.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_provider.go
@@ -6,17 +6,6 @@ import (
         "github.com/hashicorp/terraform/config"
 )
 
-// EvalSetProviderConfig sets the parent configuration for a provider
-// without configuring that provider, validating it, etc.
-type EvalSetProviderConfig struct {
-        Provider string
-        Config   **ResourceConfig
-}
-
-func (n *EvalSetProviderConfig) Eval(ctx EvalContext) (interface{}, error) {
-        return nil, ctx.SetProviderConfig(n.Provider, *n.Config)
-}
-
 // EvalBuildProviderConfig outputs a *ResourceConfig that is properly
 // merged with parents and inputs on top of what is configured in the file.
 type EvalBuildProviderConfig struct {
@@ -28,7 +17,7 @@ type EvalBuildProviderConfig struct {
 func (n *EvalBuildProviderConfig) Eval(ctx EvalContext) (interface{}, error) {
         cfg := *n.Config
 
-        // If we have a configuration set, then merge that in
+        // If we have an Input configuration set, then merge that in
         if input := ctx.ProviderInput(n.Provider); input != nil {
                 // "input" is a map of the subset of config values that were known
                 // during the input walk, set by EvalInputProvider. Note that
@@ -40,13 +29,7 @@ func (n *EvalBuildProviderConfig) Eval(ctx EvalContext) (interface{}, error) {
                         return nil, err
                 }
 
-                merged := cfg.raw.Merge(rc)
-                cfg = NewResourceConfig(merged)
-        }
-
-        // Get the parent configuration if there is one
-        if parent := ctx.ParentProviderConfig(n.Provider); parent != nil {
-                merged := cfg.raw.Merge(parent.raw)
+                merged := rc.Merge(cfg.raw)
                 cfg = NewResourceConfig(merged)
         }
 
@@ -69,11 +52,12 @@ func (n *EvalConfigProvider) Eval(ctx EvalContext) (interface{}, error) {
 // and returns nothing. The provider can be retrieved again with the
 // EvalGetProvider node.
 type EvalInitProvider struct {
-        Name string
+        TypeName string
+        Name     string
 }
 
 func (n *EvalInitProvider) Eval(ctx EvalContext) (interface{}, error) {
-        return ctx.InitProvider(n.Name)
+        return ctx.InitProvider(n.TypeName, n.Name)
 }
 
 // EvalCloseProvider is an EvalNode implementation that closes provider
@@ -116,12 +100,8 @@ type EvalInputProvider struct {
 }
 
 func (n *EvalInputProvider) Eval(ctx EvalContext) (interface{}, error) {
-        // If we already configured this provider, then don't do this again
-        if v := ctx.ProviderInput(n.Name); v != nil {
-                return nil, nil
-        }
-
         rc := *n.Config
+        orig := rc.DeepCopy()
 
         // Wrap the input into a namespace
         input := &PrefixUIInput{
@@ -138,27 +118,20 @@ func (n *EvalInputProvider) Eval(ctx EvalContext) (interface{}, error) {
                         "Error configuring %s: %s", n.Name, err)
         }
 
-        // Set the input that we received so that child modules don't attempt
-        // to ask for input again.
+        // We only store values that have changed through Input.
+        // The goal is to cache cache input responses, not to provide a complete
+        // config for other providers.
+        confMap := make(map[string]interface{})
         if config != nil && len(config.Config) > 0 {
-                // This repository of provider input results on the context doesn't
-                // retain config.ComputedKeys, so we need to filter those out here
-                // in order that later users of this data won't try to use the unknown
-                // value placeholder as if it were a literal value. This map is just
-                // of known values we've been able to complete so far; dynamic stuff
-                // will be merged in by EvalBuildProviderConfig on subsequent
-                // (post-input) walks.
-                confMap := config.Config
-                if config.ComputedKeys != nil {
-                        for _, key := range config.ComputedKeys {
-                                delete(confMap, key)
+                // any values that weren't in the original ResourcConfig will be cached
+                for k, v := range config.Config {
+                        if _, ok := orig.Config[k]; !ok {
+                                confMap[k] = v
                         }
                 }
-
-                ctx.SetProviderInput(n.Name, confMap)
-        } else {
-                ctx.SetProviderInput(n.Name, map[string]interface{}{})
         }
 
+        ctx.SetProviderInput(n.Name, confMap)
+
         return nil, nil
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_state.go b/vendor/github.com/hashicorp/terraform/terraform/eval_state.go
index 126a0e6..1182690 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_state.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_state.go
@@ -1,6 +1,8 @@
 package terraform
 
-import "fmt"
+import (
+        "fmt"
+)
 
 // EvalReadState is an EvalNode implementation that reads the
 // primary InstanceState for a specific resource out of the state.
@@ -212,37 +214,6 @@ func writeInstanceToState(
         return nil, nil
 }
 
-// EvalClearPrimaryState is an EvalNode implementation that clears the primary
-// instance from a resource state.
-type EvalClearPrimaryState struct {
-        Name string
-}
-
-func (n *EvalClearPrimaryState) Eval(ctx EvalContext) (interface{}, error) {
-        state, lock := ctx.State()
-
-        // Get a read lock so we can access this instance
-        lock.RLock()
-        defer lock.RUnlock()
-
-        // Look for the module state. If we don't have one, then it doesn't matter.
-        mod := state.ModuleByPath(ctx.Path())
-        if mod == nil {
-                return nil, nil
-        }
-
-        // Look for the resource state. If we don't have one, then it is okay.
-        rs := mod.Resources[n.Name]
-        if rs == nil {
-                return nil, nil
-        }
-
-        // Clear primary from the resource state
-        rs.Primary = nil
-
-        return nil, nil
-}
-
 // EvalDeposeState is an EvalNode implementation that takes the primary
 // out of a state and makes it Deposed. This is done at the beginning of
 // create-before-destroy calls so that the create can create while preserving
diff --git a/vendor/github.com/hashicorp/terraform/terraform/eval_validate.go b/vendor/github.com/hashicorp/terraform/terraform/eval_validate.go
index 478aa64..3e5a84c 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/eval_validate.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/eval_validate.go
@@ -144,16 +144,20 @@ func (n *EvalValidateProvisioner) validateConnConfig(connConfig *ResourceConfig)
 
                 // For type=ssh only (enforced in ssh communicator)
                 PrivateKey        interface{} `mapstructure:"private_key"`
+                HostKey           interface{} `mapstructure:"host_key"`
                 Agent             interface{} `mapstructure:"agent"`
                 BastionHost       interface{} `mapstructure:"bastion_host"`
+                BastionHostKey    interface{} `mapstructure:"bastion_host_key"`
                 BastionPort       interface{} `mapstructure:"bastion_port"`
                 BastionUser       interface{} `mapstructure:"bastion_user"`
                 BastionPassword   interface{} `mapstructure:"bastion_password"`
                 BastionPrivateKey interface{} `mapstructure:"bastion_private_key"`
+                AgentIdentity     interface{} `mapstructure:"agent_identity"`
 
                 // For type=winrm only (enforced in winrm communicator)
                 HTTPS    interface{} `mapstructure:"https"`
                 Insecure interface{} `mapstructure:"insecure"`
+                NTLM     interface{} `mapstructure:"use_ntlm"`
                 CACert   interface{} `mapstructure:"cacert"`
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/evaltree_provider.go b/vendor/github.com/hashicorp/terraform/terraform/evaltree_provider.go
index 00392ef..0c3da48 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/evaltree_provider.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/evaltree_provider.go
@@ -1,17 +1,24 @@
 package terraform
 
 import (
+        "strings"
+
         "github.com/hashicorp/terraform/config"
 )
 
 // ProviderEvalTree returns the evaluation tree for initializing and
 // configuring providers.
-func ProviderEvalTree(n string, config *config.RawConfig) EvalNode {
+func ProviderEvalTree(n *NodeApplyableProvider, config *config.ProviderConfig) EvalNode {
         var provider ResourceProvider
         var resourceConfig *ResourceConfig
 
+        typeName := strings.SplitN(n.NameValue, ".", 2)[0]
+
         seq := make([]EvalNode, 0, 5)
-        seq = append(seq, &EvalInitProvider{Name: n})
+        seq = append(seq, &EvalInitProvider{
+                TypeName: typeName,
+                Name:     n.Name(),
+        })
 
         // Input stuff
         seq = append(seq, &EvalOpFilter{
@@ -19,20 +26,20 @@ func ProviderEvalTree(n string, config *config.RawConfig) EvalNode {
                 Node: &EvalSequence{
                         Nodes: []EvalNode{
                                 &EvalGetProvider{
-                                        Name:   n,
+                                        Name:   n.Name(),
                                         Output: &provider,
                                 },
-                                &EvalInterpolate{
+                                &EvalInterpolateProvider{
                                         Config: config,
                                         Output: &resourceConfig,
                                 },
                                 &EvalBuildProviderConfig{
-                                        Provider: n,
+                                        Provider: n.NameValue,
                                         Config:   &resourceConfig,
                                         Output:   &resourceConfig,
                                 },
                                 &EvalInputProvider{
-                                        Name:     n,
+                                        Name:     n.NameValue,
                                         Provider: &provider,
                                         Config:   &resourceConfig,
                                 },
@@ -45,15 +52,15 @@ func ProviderEvalTree(n string, config *config.RawConfig) EvalNode {
                 Node: &EvalSequence{
                         Nodes: []EvalNode{
                                 &EvalGetProvider{
-                                        Name:   n,
+                                        Name:   n.Name(),
                                         Output: &provider,
                                 },
-                                &EvalInterpolate{
+                                &EvalInterpolateProvider{
                                         Config: config,
                                         Output: &resourceConfig,
                                 },
                                 &EvalBuildProviderConfig{
-                                        Provider: n,
+                                        Provider: n.NameValue,
                                         Config:   &resourceConfig,
                                         Output:   &resourceConfig,
                                 },
@@ -61,10 +68,6 @@ func ProviderEvalTree(n string, config *config.RawConfig) EvalNode {
                                         Provider: &provider,
                                         Config:   &resourceConfig,
                                 },
-                                &EvalSetProviderConfig{
-                                        Provider: n,
-                                        Config:   &resourceConfig,
-                                },
                         },
                 },
         })
@@ -75,22 +78,18 @@ func ProviderEvalTree(n string, config *config.RawConfig) EvalNode {
                 Node: &EvalSequence{
                         Nodes: []EvalNode{
                                 &EvalGetProvider{
-                                        Name:   n,
+                                        Name:   n.Name(),
                                         Output: &provider,
                                 },
-                                &EvalInterpolate{
+                                &EvalInterpolateProvider{
                                         Config: config,
                                         Output: &resourceConfig,
                                 },
                                 &EvalBuildProviderConfig{
-                                        Provider: n,
+                                        Provider: n.NameValue,
                                         Config:   &resourceConfig,
                                         Output:   &resourceConfig,
                                 },
-                                &EvalSetProviderConfig{
-                                        Provider: n,
-                                        Config:   &resourceConfig,
-                                },
                         },
                 },
         })
@@ -102,7 +101,7 @@ func ProviderEvalTree(n string, config *config.RawConfig) EvalNode {
                 Node: &EvalSequence{
                         Nodes: []EvalNode{
                                 &EvalConfigProvider{
-                                        Provider: n,
+                                        Provider: n.Name(),
                                         Config:   &resourceConfig,
                                 },
                         },
diff --git a/vendor/github.com/hashicorp/terraform/terraform/features.go b/vendor/github.com/hashicorp/terraform/terraform/features.go
new file mode 100644
index 0000000..97c77bd
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/features.go
@@ -0,0 +1,7 @@
+package terraform
+
+import "os"
+
+// This file holds feature flags for the next release
+
+var flagWarnOutputErrors = os.Getenv("TF_WARN_OUTPUT_ERRORS") != ""
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph.go b/vendor/github.com/hashicorp/terraform/terraform/graph.go
index 48ce6a3..735ec4e 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph.go
@@ -70,7 +70,7 @@ func (g *Graph) walk(walker GraphWalker) error {
         // Walk the graph.
         var walkFn dag.WalkFunc
         walkFn = func(v dag.Vertex) (rerr error) {
-                log.Printf("[DEBUG] vertex '%s.%s': walking", path, dag.VertexName(v))
+                log.Printf("[TRACE] vertex '%s.%s': walking", path, dag.VertexName(v))
                 g.DebugVisitInfo(v, g.debugName)
 
                 // If we have a panic wrap GraphWalker and a panic occurs, recover
@@ -118,7 +118,7 @@ func (g *Graph) walk(walker GraphWalker) error {
 
                         // Allow the walker to change our tree if needed. Eval,
                         // then callback with the output.
-                        log.Printf("[DEBUG] vertex '%s.%s': evaluating", path, dag.VertexName(v))
+                        log.Printf("[TRACE] vertex '%s.%s': evaluating", path, dag.VertexName(v))
 
                         g.DebugVertexInfo(v, fmt.Sprintf("evaluating %T(%s)", v, path))
 
@@ -132,7 +132,7 @@ func (g *Graph) walk(walker GraphWalker) error {
                 // If the node is dynamically expanded, then expand it
                 if ev, ok := v.(GraphNodeDynamicExpandable); ok {
                         log.Printf(
-                                "[DEBUG] vertex '%s.%s': expanding/walking dynamic subgraph",
+                                "[TRACE] vertex '%s.%s': expanding/walking dynamic subgraph",
                                 path,
                                 dag.VertexName(v))
 
@@ -154,7 +154,7 @@ func (g *Graph) walk(walker GraphWalker) error {
                 // If the node has a subgraph, then walk the subgraph
                 if sn, ok := v.(GraphNodeSubgraph); ok {
                         log.Printf(
-                                "[DEBUG] vertex '%s.%s': walking subgraph",
+                                "[TRACE] vertex '%s.%s': walking subgraph",
                                 path,
                                 dag.VertexName(v))
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_apply.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_apply.go
index 38a90f2..0c2b233 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_apply.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_apply.go
@@ -87,12 +87,8 @@ func (b *ApplyGraphBuilder) Steps() []GraphTransformer {
                 // Attach the state
                 &AttachStateTransformer{State: b.State},
 
-                // Create all the providers
-                &MissingProviderTransformer{Providers: b.Providers, Concrete: concreteProvider},
-                &ProviderTransformer{},
-                &DisableProviderTransformer{},
-                &ParentProviderTransformer{},
-                &AttachProviderConfigTransformer{Module: b.Module},
+                // add providers
+                TransformProviders(b.Providers, concreteProvider, b.Module),
 
                 // Destruction ordering
                 &DestroyEdgeTransformer{Module: b.Module, State: b.State},
@@ -108,15 +104,36 @@ func (b *ApplyGraphBuilder) Steps() []GraphTransformer {
                 // Add root variables
                 &RootVariableTransformer{Module: b.Module},
 
+                // Add the local values
+                &LocalTransformer{Module: b.Module},
+
                 // Add the outputs
                 &OutputTransformer{Module: b.Module},
 
                 // Add module variables
                 &ModuleVariableTransformer{Module: b.Module},
 
+                // Remove modules no longer present in the config
+                &RemovedModuleTransformer{Module: b.Module, State: b.State},
+
                 // Connect references so ordering is correct
                 &ReferenceTransformer{},
 
+                // Handle destroy time transformations for output and local values.
+                // Reverse the edges from outputs and locals, so that
+                // interpolations don't fail during destroy.
+                // Create a destroy node for outputs to remove them from the state.
+                // Prune unreferenced values, which may have interpolations that can't
+                // be resolved.
+                GraphTransformIf(
+                        func() bool { return b.Destroy },
+                        GraphTransformMulti(
+                                &DestroyValueReferenceTransformer{},
+                                &DestroyOutputTransformer{},
+                                &PruneUnusedValuesTransformer{},
+                        ),
+                ),
+
                 // Add the node to fix the state count boundaries
                 &CountBoundaryTransformer{},
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_import.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_import.go
index 7070c59..07a1eaf 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_import.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_import.go
@@ -52,12 +52,7 @@ func (b *ImportGraphBuilder) Steps() []GraphTransformer {
                 // Add the import steps
                 &ImportStateTransformer{Targets: b.ImportTargets},
 
-                // Provider-related transformations
-                &MissingProviderTransformer{Providers: b.Providers, Concrete: concreteProvider},
-                &ProviderTransformer{},
-                &DisableProviderTransformer{},
-                &ParentProviderTransformer{},
-                &AttachProviderConfigTransformer{Module: mod},
+                TransformProviders(b.Providers, concreteProvider, mod),
 
                 // This validates that the providers only depend on variables
                 &ImportProviderValidateTransformer{},
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_plan.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_plan.go
index 4b29bbb..f8dd0fc 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_plan.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_plan.go
@@ -71,6 +71,9 @@ func (b *PlanGraphBuilder) Steps() []GraphTransformer {
                         Module:   b.Module,
                 },
 
+                // Add the local values
+                &LocalTransformer{Module: b.Module},
+
                 // Add the outputs
                 &OutputTransformer{Module: b.Module},
 
@@ -81,6 +84,12 @@ func (b *PlanGraphBuilder) Steps() []GraphTransformer {
                         Module:   b.Module,
                 },
 
+                // Create orphan output nodes
+                &OrphanOutputTransformer{
+                        Module: b.Module,
+                        State:  b.State,
+                },
+
                 // Attach the configuration to any resources
                 &AttachResourceConfigTransformer{Module: b.Module},
 
@@ -90,12 +99,7 @@ func (b *PlanGraphBuilder) Steps() []GraphTransformer {
                 // Add root variables
                 &RootVariableTransformer{Module: b.Module},
 
-                // Create all the providers
-                &MissingProviderTransformer{Providers: b.Providers, Concrete: b.ConcreteProvider},
-                &ProviderTransformer{},
-                &DisableProviderTransformer{},
-                &ParentProviderTransformer{},
-                &AttachProviderConfigTransformer{Module: b.Module},
+                TransformProviders(b.Providers, b.ConcreteProvider, b.Module),
 
                 // Provisioner-related transformations. Only add these if requested.
                 GraphTransformIf(
@@ -107,7 +111,12 @@ func (b *PlanGraphBuilder) Steps() []GraphTransformer {
                 ),
 
                 // Add module variables
-                &ModuleVariableTransformer{Module: b.Module},
+                &ModuleVariableTransformer{
+                        Module: b.Module,
+                },
+
+                // Remove modules no longer present in the config
+                &RemovedModuleTransformer{Module: b.Module, State: b.State},
 
                 // Connect so that the references are ready for targeting. We'll
                 // have to connect again later for providers and so on.
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_refresh.go b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_refresh.go
index 3d3e968..9638d4c 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_builder_refresh.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_builder_refresh.go
@@ -126,12 +126,10 @@ func (b *RefreshGraphBuilder) Steps() []GraphTransformer {
                 // Add root variables
                 &RootVariableTransformer{Module: b.Module},
 
-                // Create all the providers
-                &MissingProviderTransformer{Providers: b.Providers, Concrete: concreteProvider},
-                &ProviderTransformer{},
-                &DisableProviderTransformer{},
-                &ParentProviderTransformer{},
-                &AttachProviderConfigTransformer{Module: b.Module},
+                TransformProviders(b.Providers, concreteProvider, b.Module),
+
+                // Add the local values
+                &LocalTransformer{Module: b.Module},
 
                 // Add the outputs
                 &OutputTransformer{Module: b.Module},
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graph_walk_context.go b/vendor/github.com/hashicorp/terraform/terraform/graph_walk_context.go
index e63b460..89f376e 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graph_walk_context.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graph_walk_context.go
@@ -32,7 +32,6 @@ type ContextGraphWalker struct {
         interpolaterVars    map[string]map[string]interface{}
         interpolaterVarLock sync.Mutex
         providerCache       map[string]ResourceProvider
-        providerConfigCache map[string]*ResourceConfig
         providerLock        sync.Mutex
         provisionerCache    map[string]ResourceProvisioner
         provisionerLock     sync.Mutex
@@ -73,7 +72,6 @@ func (w *ContextGraphWalker) EnterPath(path []string) EvalContext {
                 InputValue:          w.Context.uiInput,
                 Components:          w.Context.components,
                 ProviderCache:       w.providerCache,
-                ProviderConfigCache: w.providerConfigCache,
                 ProviderInputConfig: w.Context.providerInputConfig,
                 ProviderLock:        &w.providerLock,
                 ProvisionerCache:    w.provisionerCache,
@@ -151,7 +149,6 @@ func (w *ContextGraphWalker) ExitEvalTree(
 func (w *ContextGraphWalker) init() {
         w.contexts = make(map[string]*BuiltinEvalContext, 5)
         w.providerCache = make(map[string]ResourceProvider, 5)
-        w.providerConfigCache = make(map[string]*ResourceConfig, 5)
         w.provisionerCache = make(map[string]ResourceProvisioner, 5)
         w.interpolaterVars = make(map[string]map[string]interface{}, 5)
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/graphtype_string.go b/vendor/github.com/hashicorp/terraform/terraform/graphtype_string.go
index e97b485..95ef4e9 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/graphtype_string.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/graphtype_string.go
@@ -2,7 +2,7 @@
 
 package terraform
 
-import "fmt"
+import "strconv"
 
 const _GraphType_name = "GraphTypeInvalidGraphTypeLegacyGraphTypeRefreshGraphTypePlanGraphTypePlanDestroyGraphTypeApplyGraphTypeInputGraphTypeValidate"
 
@@ -10,7 +10,7 @@ var _GraphType_index = [...]uint8{0, 16, 31, 47, 60, 80, 94, 108, 125}
 
 func (i GraphType) String() string {
         if i >= GraphType(len(_GraphType_index)-1) {
-                return fmt.Sprintf("GraphType(%d)", i)
+                return "GraphType(" + strconv.FormatInt(int64(i), 10) + ")"
         }
         return _GraphType_name[_GraphType_index[i]:_GraphType_index[i+1]]
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/instancetype_string.go b/vendor/github.com/hashicorp/terraform/terraform/instancetype_string.go
index f69267c..b8e7d1f 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/instancetype_string.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/instancetype_string.go
@@ -2,7 +2,7 @@
 
 package terraform
 
-import "fmt"
+import "strconv"
 
 const _InstanceType_name = "TypeInvalidTypePrimaryTypeTaintedTypeDeposed"
 
@@ -10,7 +10,7 @@ var _InstanceType_index = [...]uint8{0, 11, 22, 33, 44}
 
 func (i InstanceType) String() string {
         if i < 0 || i >= InstanceType(len(_InstanceType_index)-1) {
-                return fmt.Sprintf("InstanceType(%d)", i)
+                return "InstanceType(" + strconv.FormatInt(int64(i), 10) + ")"
         }
         return _InstanceType_name[_InstanceType_index[i]:_InstanceType_index[i+1]]
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/interpolate.go b/vendor/github.com/hashicorp/terraform/terraform/interpolate.go
index 22ddce6..4f4e178 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/interpolate.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/interpolate.go
@@ -90,6 +90,8 @@ func (i *Interpolater) Values(
                         err = i.valueSimpleVar(scope, n, v, result)
                 case *config.TerraformVariable:
                         err = i.valueTerraformVar(scope, n, v, result)
+                case *config.LocalVariable:
+                        err = i.valueLocalVar(scope, n, v, result)
                 case *config.UserVariable:
                         err = i.valueUserVar(scope, n, v, result)
                 default:
@@ -140,7 +142,6 @@ func (i *Interpolater) valueModuleVar(
         n string,
         v *config.ModuleVariable,
         result map[string]ast.Variable) error {
-
         // Build the path to the child module we want
         path := make([]string, len(scope.Path), len(scope.Path)+1)
         copy(path, scope.Path)
@@ -317,7 +318,6 @@ func (i *Interpolater) valueTerraformVar(
         n string,
         v *config.TerraformVariable,
         result map[string]ast.Variable) error {
-
         // "env" is supported for backward compatibility, but it's deprecated and
         // so we won't advertise it as being allowed in the error message. It will
         // be removed in a future version of Terraform.
@@ -335,6 +335,59 @@ func (i *Interpolater) valueTerraformVar(
         return nil
 }
 
+func (i *Interpolater) valueLocalVar(
+        scope *InterpolationScope,
+        n string,
+        v *config.LocalVariable,
+        result map[string]ast.Variable,
+) error {
+        i.StateLock.RLock()
+        defer i.StateLock.RUnlock()
+
+        modTree := i.Module
+        if len(scope.Path) > 1 {
+                modTree = i.Module.Child(scope.Path[1:])
+        }
+
+        // Get the resource from the configuration so we can verify
+        // that the resource is in the configuration and so we can access
+        // the configuration if we need to.
+        var cl *config.Local
+        for _, l := range modTree.Config().Locals {
+                if l.Name == v.Name {
+                        cl = l
+                        break
+                }
+        }
+
+        if cl == nil {
+                return fmt.Errorf("%s: no local value of this name has been declared", n)
+        }
+
+        // Get the relevant module
+        module := i.State.ModuleByPath(scope.Path)
+        if module == nil {
+                result[n] = unknownVariable()
+                return nil
+        }
+
+        rawV, exists := module.Locals[v.Name]
+        if !exists {
+                result[n] = unknownVariable()
+                return nil
+        }
+
+        varV, err := hil.InterfaceToVariable(rawV)
+        if err != nil {
+                // Should never happen, since interpolation should always produce
+                // something we can feed back in to interpolation.
+                return fmt.Errorf("%s: %s", n, err)
+        }
+
+        result[n] = varV
+        return nil
+}
+
 func (i *Interpolater) valueUserVar(
         scope *InterpolationScope,
         n string,
@@ -465,6 +518,16 @@ func (i *Interpolater) computeResourceVariable(
                 return &v, err
         }
 
+        // special case for the "id" field which is usually also an attribute
+        if v.Field == "id" && r.Primary.ID != "" {
+                // This is usually pulled from the attributes, but is sometimes missing
+                // during destroy. We can return the ID field in this case.
+                // FIXME: there should only be one ID to rule them all.
+                log.Printf("[WARN] resource %s missing 'id' attribute", v.ResourceId())
+                v, err := hil.InterfaceToVariable(r.Primary.ID)
+                return &v, err
+        }
+
         // computed list or map attribute
         _, isList = r.Primary.Attributes[v.Field+".#"]
         _, isMap = r.Primary.Attributes[v.Field+".%"]
@@ -602,6 +665,11 @@ func (i *Interpolater) computeResourceMultiVariable(
                         continue
                 }
 
+                if v.Field == "id" && r.Primary.ID != "" {
+                        log.Printf("[WARN] resource %s missing 'id' attribute", v.ResourceId())
+                        values = append(values, r.Primary.ID)
+                }
+
                 // computed list or map attribute
                 _, isList := r.Primary.Attributes[v.Field+".#"]
                 _, isMap := r.Primary.Attributes[v.Field+".%"]
@@ -646,7 +714,6 @@ func (i *Interpolater) computeResourceMultiVariable(
 func (i *Interpolater) interpolateComplexTypeAttribute(
         resourceID string,
         attributes map[string]string) (ast.Variable, error) {
-
         // We can now distinguish between lists and maps in state by the count field:
         //    - lists (and by extension, sets) use the traditional .# notation
         //    - maps use the newer .% notation
@@ -722,7 +789,8 @@ func (i *Interpolater) resourceCountMax(
         // If we're NOT applying, then we assume we can read the count
         // from the state. Plan and so on may not have any state yet so
         // we do a full interpolation.
-        if i.Operation != walkApply {
+        // Don't forget walkDestroy, which is a special case of walkApply
+        if !(i.Operation == walkApply || i.Operation == walkDestroy) {
                 if cr == nil {
                         return 0, nil
                 }
@@ -753,7 +821,13 @@ func (i *Interpolater) resourceCountMax(
         // use "cr.Count()" but that doesn't work if the count is interpolated
         // and we can't guarantee that so we instead depend on the state.
         max := -1
-        for k, _ := range ms.Resources {
+        for k, s := range ms.Resources {
+                // This resource may have been just removed, in which case the Primary
+                // may be nil, or just empty.
+                if s == nil || s.Primary == nil || len(s.Primary.Attributes) == 0 {
+                        continue
+                }
+
                 // Get the index number for this resource
                 index := ""
                 if k == id {
diff --git a/vendor/github.com/hashicorp/terraform/terraform/module_dependencies.go b/vendor/github.com/hashicorp/terraform/terraform/module_dependencies.go
index b9f44a0..4594cb6 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/module_dependencies.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/module_dependencies.go
@@ -17,7 +17,6 @@ import (
 // present in the configuration. This is guaranteed not to happen for any
 // configuration that has passed a call to Config.Validate().
 func ModuleTreeDependencies(root *module.Tree, state *State) *moduledeps.Module {
-
         // First we walk the configuration tree to build the overall structure
         // and capture the explicit/implicit/inherited provider dependencies.
         deps := moduleTreeConfigDependencies(root, nil)
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_data_refresh.go b/vendor/github.com/hashicorp/terraform/terraform/node_data_refresh.go
index 45129b3..d5ca641 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_data_refresh.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_data_refresh.go
@@ -27,6 +27,7 @@ func (n *NodeRefreshableDataResource) DynamicExpand(ctx EvalContext) (*Graph, er
         concreteResource := func(a *NodeAbstractResource) dag.Vertex {
                 // Add the config and state since we don't do that via transforms
                 a.Config = n.Config
+                a.ResolvedProvider = n.ResolvedProvider
 
                 return &NodeRefreshableDataResourceInstance{
                         NodeAbstractResource: a,
@@ -107,7 +108,9 @@ func (n *NodeRefreshableDataResourceInstance) EvalTree() EvalNode {
         // Get the state if we have it, if not we build it
         rs := n.ResourceState
         if rs == nil {
-                rs = &ResourceState{}
+                rs = &ResourceState{
+                        Provider: n.ResolvedProvider,
+                }
         }
 
         // If the config isn't empty we update the state
@@ -145,7 +148,7 @@ func (n *NodeRefreshableDataResourceInstance) EvalTree() EvalNode {
                         &EvalWriteState{
                                 Name:         stateId,
                                 ResourceType: rs.Type,
-                                Provider:     rs.Provider,
+                                Provider:     n.ResolvedProvider,
                                 Dependencies: rs.Dependencies,
                                 State:        &state, // state is nil here
                         },
@@ -185,7 +188,7 @@ func (n *NodeRefreshableDataResourceInstance) EvalTree() EvalNode {
                         // provider configurations that need this data during
                         // refresh/plan.
                         &EvalGetProvider{
-                                Name:   n.ProvidedBy()[0],
+                                Name:   n.ResolvedProvider,
                                 Output: &provider,
                         },
 
@@ -207,7 +210,7 @@ func (n *NodeRefreshableDataResourceInstance) EvalTree() EvalNode {
                         &EvalWriteState{
                                 Name:         stateId,
                                 ResourceType: rs.Type,
-                                Provider:     rs.Provider,
+                                Provider:     n.ResolvedProvider,
                                 Dependencies: rs.Dependencies,
                                 State:        &state,
                         },
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_local.go b/vendor/github.com/hashicorp/terraform/terraform/node_local.go
new file mode 100644
index 0000000..d387222
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_local.go
@@ -0,0 +1,66 @@
+package terraform
+
+import (
+        "fmt"
+        "strings"
+
+        "github.com/hashicorp/terraform/config"
+)
+
+// NodeLocal represents a named local value in a particular module.
+//
+// Local value nodes only have one operation, common to all walk types:
+// evaluate the result and place it in state.
+type NodeLocal struct {
+        PathValue []string
+        Config    *config.Local
+}
+
+func (n *NodeLocal) Name() string {
+        result := fmt.Sprintf("local.%s", n.Config.Name)
+        if len(n.PathValue) > 1 {
+                result = fmt.Sprintf("%s.%s", modulePrefixStr(n.PathValue), result)
+        }
+
+        return result
+}
+
+// GraphNodeSubPath
+func (n *NodeLocal) Path() []string {
+        return n.PathValue
+}
+
+// RemovableIfNotTargeted
+func (n *NodeLocal) RemoveIfNotTargeted() bool {
+        return true
+}
+
+// GraphNodeReferenceable
+func (n *NodeLocal) ReferenceableName() []string {
+        name := fmt.Sprintf("local.%s", n.Config.Name)
+        return []string{name}
+}
+
+// GraphNodeReferencer
+func (n *NodeLocal) References() []string {
+        var result []string
+        result = append(result, ReferencesFromConfig(n.Config.RawConfig)...)
+        for _, v := range result {
+                split := strings.Split(v, "/")
+                for i, s := range split {
+                        split[i] = s + ".destroy"
+                }
+
+                result = append(result, strings.Join(split, "/"))
+        }
+
+        return result
+}
+
+// GraphNodeEvalable
+func (n *NodeLocal) EvalTree() EvalNode {
+        return &EvalLocal{
+                Name:  n.Config.Name,
+                Value: n.Config.RawConfig,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_module_destroy.go b/vendor/github.com/hashicorp/terraform/terraform/node_module_destroy.go
deleted file mode 100644
index 319df1e..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/node_module_destroy.go
+++ /dev/null
@@ -1,29 +0,0 @@
-package terraform
-
-import (
-        "fmt"
-)
-
-// NodeDestroyableModule represents a module destruction.
-type NodeDestroyableModuleVariable struct {
-        PathValue []string
-}
-
-func (n *NodeDestroyableModuleVariable) Name() string {
-        result := "plan-destroy"
-        if len(n.PathValue) > 1 {
-                result = fmt.Sprintf("%s.%s", modulePrefixStr(n.PathValue), result)
-        }
-
-        return result
-}
-
-// GraphNodeSubPath
-func (n *NodeDestroyableModuleVariable) Path() []string {
-        return n.PathValue
-}
-
-// GraphNodeEvalable
-func (n *NodeDestroyableModuleVariable) EvalTree() EvalNode {
-        return &EvalDiffDestroyModule{Path: n.PathValue}
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_module_removed.go b/vendor/github.com/hashicorp/terraform/terraform/node_module_removed.go
new file mode 100644
index 0000000..bb3e5ee
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_module_removed.go
@@ -0,0 +1,77 @@
+package terraform
+
+import (
+        "fmt"
+        "log"
+        "reflect"
+)
+
+// NodeModuleRemoved represents a module that is no longer in the
+// config.
+type NodeModuleRemoved struct {
+        PathValue []string
+}
+
+func (n *NodeModuleRemoved) Name() string {
+        return fmt.Sprintf("%s (removed)", modulePrefixStr(n.PathValue))
+}
+
+// GraphNodeSubPath
+func (n *NodeModuleRemoved) Path() []string {
+        return n.PathValue
+}
+
+// GraphNodeEvalable
+func (n *NodeModuleRemoved) EvalTree() EvalNode {
+        return &EvalOpFilter{
+                Ops: []walkOperation{walkRefresh, walkApply, walkDestroy},
+                Node: &EvalDeleteModule{
+                        PathValue: n.PathValue,
+                },
+        }
+}
+
+func (n *NodeModuleRemoved) ReferenceGlobal() bool {
+        return true
+}
+
+func (n *NodeModuleRemoved) References() []string {
+        return []string{modulePrefixStr(n.PathValue)}
+}
+
+// EvalDeleteModule is an EvalNode implementation that removes an empty module
+// entry from the state.
+type EvalDeleteModule struct {
+        PathValue []string
+}
+
+func (n *EvalDeleteModule) Eval(ctx EvalContext) (interface{}, error) {
+        state, lock := ctx.State()
+        if state == nil {
+                return nil, nil
+        }
+
+        // Get a write lock so we can access this instance
+        lock.Lock()
+        defer lock.Unlock()
+
+        // Make sure we have a clean state
+        // Destroyed resources aren't deleted, they're written with an ID of "".
+        state.prune()
+
+        // find the module and delete it
+        for i, m := range state.Modules {
+                if reflect.DeepEqual(m.Path, n.PathValue) {
+                        if !m.Empty() {
+                                // a targeted apply may leave module resources even without a config,
+                                // so just log this and return.
+                                log.Printf("[DEBUG] cannot remove module %s, not empty", modulePrefixStr(n.PathValue))
+                                break
+                        }
+                        state.Modules = append(state.Modules[:i], state.Modules[i+1:]...)
+                        break
+                }
+        }
+
+        return nil, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_module_variable.go b/vendor/github.com/hashicorp/terraform/terraform/node_module_variable.go
index 13fe8fc..66ff7d5 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_module_variable.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_module_variable.go
@@ -92,11 +92,24 @@ func (n *NodeApplyableModuleVariable) EvalTree() EvalNode {
         // within the variables mapping.
         var config *ResourceConfig
         variables := make(map[string]interface{})
+
         return &EvalSequence{
                 Nodes: []EvalNode{
-                        &EvalInterpolate{
-                                Config: n.Value,
-                                Output: &config,
+                        &EvalOpFilter{
+                                Ops: []walkOperation{walkInput},
+                                Node: &EvalInterpolate{
+                                        Config:        n.Value,
+                                        Output:        &config,
+                                        ContinueOnErr: true,
+                                },
+                        },
+                        &EvalOpFilter{
+                                Ops: []walkOperation{walkRefresh, walkPlan, walkApply,
+                                        walkDestroy, walkValidate},
+                                Node: &EvalInterpolate{
+                                        Config: n.Value,
+                                        Output: &config,
+                                },
                         },
 
                         &EvalVariableBlock{
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_output.go b/vendor/github.com/hashicorp/terraform/terraform/node_output.go
index 9017a63..83e9925 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_output.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_output.go
@@ -69,12 +69,22 @@ func (n *NodeApplyableOutput) References() []string {
 
 // GraphNodeEvalable
 func (n *NodeApplyableOutput) EvalTree() EvalNode {
-        return &EvalOpFilter{
-                Ops: []walkOperation{walkRefresh, walkPlan, walkApply,
-                        walkDestroy, walkInput, walkValidate},
-                Node: &EvalSequence{
-                        Nodes: []EvalNode{
-                                &EvalWriteOutput{
+        return &EvalSequence{
+                Nodes: []EvalNode{
+                        &EvalOpFilter{
+                                // Don't let interpolation errors stop Input, since it happens
+                                // before Refresh.
+                                Ops: []walkOperation{walkInput},
+                                Node: &EvalWriteOutput{
+                                        Name:          n.Config.Name,
+                                        Sensitive:     n.Config.Sensitive,
+                                        Value:         n.Config.RawConfig,
+                                        ContinueOnErr: true,
+                                },
+                        },
+                        &EvalOpFilter{
+                                Ops: []walkOperation{walkRefresh, walkPlan, walkApply, walkValidate, walkDestroy, walkPlanDestroy},
+                                Node: &EvalWriteOutput{
                                         Name:      n.Config.Name,
                                         Sensitive: n.Config.Sensitive,
                                         Value:     n.Config.RawConfig,
@@ -83,3 +93,61 @@ func (n *NodeApplyableOutput) EvalTree() EvalNode {
                 },
         }
 }
+
+// NodeDestroyableOutput represents an output that is "destroybale":
+// its application will remove the output from the state.
+type NodeDestroyableOutput struct {
+        PathValue []string
+        Config    *config.Output // Config is the output in the config
+}
+
+func (n *NodeDestroyableOutput) Name() string {
+        result := fmt.Sprintf("output.%s (destroy)", n.Config.Name)
+        if len(n.PathValue) > 1 {
+                result = fmt.Sprintf("%s.%s", modulePrefixStr(n.PathValue), result)
+        }
+
+        return result
+}
+
+// GraphNodeSubPath
+func (n *NodeDestroyableOutput) Path() []string {
+        return n.PathValue
+}
+
+// RemovableIfNotTargeted
+func (n *NodeDestroyableOutput) RemoveIfNotTargeted() bool {
+        // We need to add this so that this node will be removed if
+        // it isn't targeted or a dependency of a target.
+        return true
+}
+
+// This will keep the destroy node in the graph if its corresponding output
+// node is also in the destroy graph.
+func (n *NodeDestroyableOutput) TargetDownstream(targetedDeps, untargetedDeps *dag.Set) bool {
+        return true
+}
+
+// GraphNodeReferencer
+func (n *NodeDestroyableOutput) References() []string {
+        var result []string
+        result = append(result, n.Config.DependsOn...)
+        result = append(result, ReferencesFromConfig(n.Config.RawConfig)...)
+        for _, v := range result {
+                split := strings.Split(v, "/")
+                for i, s := range split {
+                        split[i] = s + ".destroy"
+                }
+
+                result = append(result, strings.Join(split, "/"))
+        }
+
+        return result
+}
+
+// GraphNodeEvalable
+func (n *NodeDestroyableOutput) EvalTree() EvalNode {
+        return &EvalDeleteOutput{
+                Name: n.Config.Name,
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_output_orphan.go b/vendor/github.com/hashicorp/terraform/terraform/node_output_orphan.go
index 636a15d..0fd1554 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_output_orphan.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_output_orphan.go
@@ -19,6 +19,11 @@ func (n *NodeOutputOrphan) Name() string {
         return result
 }
 
+// GraphNodeReferenceable
+func (n *NodeOutputOrphan) ReferenceableName() []string {
+        return []string{"output." + n.OutputName}
+}
+
 // GraphNodeSubPath
 func (n *NodeOutputOrphan) Path() []string {
         return n.PathValue
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_provider.go b/vendor/github.com/hashicorp/terraform/terraform/node_provider.go
index 8e2c176..2071ab1 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_provider.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_provider.go
@@ -7,5 +7,5 @@ type NodeApplyableProvider struct {
 
 // GraphNodeEvalable
 func (n *NodeApplyableProvider) EvalTree() EvalNode {
-        return ProviderEvalTree(n.NameValue, n.ProviderConfig())
+        return ProviderEvalTree(n, n.ProviderConfig())
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_provider_abstract.go b/vendor/github.com/hashicorp/terraform/terraform/node_provider_abstract.go
index 6cc8365..9e490f7 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_provider_abstract.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_provider_abstract.go
@@ -2,6 +2,7 @@ package terraform
 
 import (
         "fmt"
+        "strings"
 
         "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/dag"
@@ -24,13 +25,22 @@ type NodeAbstractProvider struct {
         Config *config.ProviderConfig
 }
 
-func (n *NodeAbstractProvider) Name() string {
-        result := fmt.Sprintf("provider.%s", n.NameValue)
-        if len(n.PathValue) > 1 {
-                result = fmt.Sprintf("%s.%s", modulePrefixStr(n.PathValue), result)
+func ResolveProviderName(name string, path []string) string {
+        if strings.Contains(name, "provider.") {
+                // already resolved
+                return name
+        }
+
+        name = fmt.Sprintf("provider.%s", name)
+        if len(path) >= 1 {
+                name = fmt.Sprintf("%s.%s", modulePrefixStr(path), name)
         }
 
-        return result
+        return name
+}
+
+func (n *NodeAbstractProvider) Name() string {
+        return ResolveProviderName(n.NameValue, n.PathValue)
 }
 
 // GraphNodeSubPath
@@ -60,12 +70,12 @@ func (n *NodeAbstractProvider) ProviderName() string {
 }
 
 // GraphNodeProvider
-func (n *NodeAbstractProvider) ProviderConfig() *config.RawConfig {
+func (n *NodeAbstractProvider) ProviderConfig() *config.ProviderConfig {
         if n.Config == nil {
                 return nil
         }
 
-        return n.Config.RawConfig
+        return n.Config
 }
 
 // GraphNodeAttachProvider
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_provider_disabled.go b/vendor/github.com/hashicorp/terraform/terraform/node_provider_disabled.go
index 25e7e62..a00bc46 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_provider_disabled.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_provider_disabled.go
@@ -20,7 +20,7 @@ func (n *NodeDisabledProvider) EvalTree() EvalNode {
         var resourceConfig *ResourceConfig
         return &EvalSequence{
                 Nodes: []EvalNode{
-                        &EvalInterpolate{
+                        &EvalInterpolateProvider{
                                 Config: n.ProviderConfig(),
                                 Output: &resourceConfig,
                         },
@@ -29,10 +29,6 @@ func (n *NodeDisabledProvider) EvalTree() EvalNode {
                                 Config:   &resourceConfig,
                                 Output:   &resourceConfig,
                         },
-                        &EvalSetProviderConfig{
-                                Provider: n.ProviderName(),
-                                Config:   &resourceConfig,
-                        },
                 },
         }
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract.go
index 50bb707..73509c8 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_abstract.go
@@ -33,6 +33,9 @@ type NodeAbstractResource struct {
         ResourceState *ResourceState   // ResourceState is the ResourceState for this
 
         Targets []ResourceAddress // Set from GraphNodeTargetable
+
+        // The address of the provider this resource will use
+        ResolvedProvider string
 }
 
 func (n *NodeAbstractResource) Name() string {
@@ -170,20 +173,24 @@ func (n *NodeAbstractResource) StateReferences() []string {
         return deps
 }
 
+func (n *NodeAbstractResource) SetProvider(p string) {
+        n.ResolvedProvider = p
+}
+
 // GraphNodeProviderConsumer
-func (n *NodeAbstractResource) ProvidedBy() []string {
+func (n *NodeAbstractResource) ProvidedBy() string {
         // If we have a config we prefer that above all else
         if n.Config != nil {
-                return []string{resourceProvider(n.Config.Type, n.Config.Provider)}
+                return resourceProvider(n.Config.Type, n.Config.Provider)
         }
 
         // If we have state, then we will use the provider from there
         if n.ResourceState != nil && n.ResourceState.Provider != "" {
-                return []string{n.ResourceState.Provider}
+                return n.ResourceState.Provider
         }
 
         // Use our type
-        return []string{resourceProvider(n.Addr.Type, "")}
+        return resourceProvider(n.Addr.Type, "")
 }
 
 // GraphNodeProvisionerConsumer
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply.go
index 3599782..40ee1cf 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_apply.go
@@ -124,6 +124,27 @@ func (n *NodeApplyableResource) evalTreeDataResource(
                                 Then: EvalNoop{},
                         },
 
+                        // Normally we interpolate count as a preparation step before
+                        // a DynamicExpand, but an apply graph has pre-expanded nodes
+                        // and so the count would otherwise never be interpolated.
+                        //
+                        // This is redundant when there are multiple instances created
+                        // from the same config (count > 1) but harmless since the
+                        // underlying structures have mutexes to make this concurrency-safe.
+                        //
+                        // In most cases this isn't actually needed because we dealt with
+                        // all of the counts during the plan walk, but we do it here
+                        // for completeness because other code assumes that the
+                        // final count is always available during interpolation.
+                        //
+                        // Here we are just populating the interpolated value in-place
+                        // inside this RawConfig object, like we would in
+                        // NodeAbstractCountResource.
+                        &EvalInterpolate{
+                                Config:        n.Config.RawCount,
+                                ContinueOnErr: true,
+                        },
+
                         // We need to re-interpolate the config here, rather than
                         // just using the diff's values directly, because we've
                         // potentially learned more variable values during the
@@ -135,7 +156,7 @@ func (n *NodeApplyableResource) evalTreeDataResource(
                         },
 
                         &EvalGetProvider{
-                                Name:   n.ProvidedBy()[0],
+                                Name:   n.ResolvedProvider,
                                 Output: &provider,
                         },
 
@@ -158,7 +179,7 @@ func (n *NodeApplyableResource) evalTreeDataResource(
                         &EvalWriteState{
                                 Name:         stateId,
                                 ResourceType: n.Config.Type,
-                                Provider:     n.Config.Provider,
+                                Provider:     n.ResolvedProvider,
                                 Dependencies: stateDeps,
                                 State:        &state,
                         },
@@ -236,13 +257,35 @@ func (n *NodeApplyableResource) evalTreeManagedResource(
                                 },
                         },
 
+                        // Normally we interpolate count as a preparation step before
+                        // a DynamicExpand, but an apply graph has pre-expanded nodes
+                        // and so the count would otherwise never be interpolated.
+                        //
+                        // This is redundant when there are multiple instances created
+                        // from the same config (count > 1) but harmless since the
+                        // underlying structures have mutexes to make this concurrency-safe.
+                        //
+                        // In most cases this isn't actually needed because we dealt with
+                        // all of the counts during the plan walk, but we need to do this
+                        // in order to support interpolation of resource counts from
+                        // apply-time-interpolated expressions, such as those in
+                        // "provisioner" blocks.
+                        //
+                        // Here we are just populating the interpolated value in-place
+                        // inside this RawConfig object, like we would in
+                        // NodeAbstractCountResource.
+                        &EvalInterpolate{
+                                Config:        n.Config.RawCount,
+                                ContinueOnErr: true,
+                        },
+
                         &EvalInterpolate{
                                 Config:   n.Config.RawConfig.Copy(),
                                 Resource: resource,
                                 Output:   &resourceConfig,
                         },
                         &EvalGetProvider{
-                                Name:   n.ProvidedBy()[0],
+                                Name:   n.ResolvedProvider,
                                 Output: &provider,
                         },
                         &EvalReadState{
@@ -283,7 +326,7 @@ func (n *NodeApplyableResource) evalTreeManagedResource(
                         },
 
                         &EvalGetProvider{
-                                Name:   n.ProvidedBy()[0],
+                                Name:   n.ResolvedProvider,
                                 Output: &provider,
                         },
                         &EvalReadState{
@@ -308,7 +351,7 @@ func (n *NodeApplyableResource) evalTreeManagedResource(
                         &EvalWriteState{
                                 Name:         stateId,
                                 ResourceType: n.Config.Type,
-                                Provider:     n.Config.Provider,
+                                Provider:     n.ResolvedProvider,
                                 Dependencies: stateDeps,
                                 State:        &state,
                         },
@@ -332,7 +375,7 @@ func (n *NodeApplyableResource) evalTreeManagedResource(
                                 Else: &EvalWriteState{
                                         Name:         stateId,
                                         ResourceType: n.Config.Type,
-                                        Provider:     n.Config.Provider,
+                                        Provider:     n.ResolvedProvider,
                                         Dependencies: stateDeps,
                                         State:        &state,
                                 },
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_destroy.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_destroy.go
index c2efd2c..657bbee 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_destroy.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_destroy.go
@@ -102,8 +102,9 @@ func (n *NodeDestroyResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
 
         // We want deposed resources in the state to be destroyed
         steps = append(steps, &DeposedTransformer{
-                State: state,
-                View:  n.Addr.stateId(),
+                State:            state,
+                View:             n.Addr.stateId(),
+                ResolvedProvider: n.ResolvedProvider,
         })
 
         // Target
@@ -148,7 +149,9 @@ func (n *NodeDestroyResource) EvalTree() EvalNode {
         // Get our state
         rs := n.ResourceState
         if rs == nil {
-                rs = &ResourceState{}
+                rs = &ResourceState{
+                        Provider: n.ResolvedProvider,
+                }
         }
 
         var diffApply *InstanceDiff
@@ -188,7 +191,7 @@ func (n *NodeDestroyResource) EvalTree() EvalNode {
                                 &EvalInstanceInfo{Info: info},
 
                                 &EvalGetProvider{
-                                        Name:   n.ProvidedBy()[0],
+                                        Name:   n.ResolvedProvider,
                                         Output: &provider,
                                 },
                                 &EvalReadState{
@@ -272,7 +275,7 @@ func (n *NodeDestroyResource) EvalTree() EvalNode {
                                 &EvalWriteState{
                                         Name:         stateId,
                                         ResourceType: n.Addr.Type,
-                                        Provider:     rs.Provider,
+                                        Provider:     n.ResolvedProvider,
                                         Dependencies: rs.Dependencies,
                                         State:        &state,
                                 },
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan.go
index 52bbf88..1afae7a 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan.go
@@ -27,6 +27,7 @@ func (n *NodePlannableResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
         concreteResource := func(a *NodeAbstractResource) dag.Vertex {
                 // Add the config and state since we don't do that via transforms
                 a.Config = n.Config
+                a.ResolvedProvider = n.ResolvedProvider
 
                 return &NodePlannableResourceInstance{
                         NodeAbstractResource: a,
@@ -37,6 +38,7 @@ func (n *NodePlannableResource) DynamicExpand(ctx EvalContext) (*Graph, error) {
         concreteResourceOrphan := func(a *NodeAbstractResource) dag.Vertex {
                 // Add the config and state since we don't do that via transforms
                 a.Config = n.Config
+                a.ResolvedProvider = n.ResolvedProvider
 
                 return &NodePlannableResourceOrphan{
                         NodeAbstractResource: a,
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_instance.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_instance.go
index b529569..7d9fcdd 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_instance.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_plan_instance.go
@@ -97,7 +97,7 @@ func (n *NodePlannableResourceInstance) evalTreeDataResource(
                         },
 
                         &EvalGetProvider{
-                                Name:   n.ProvidedBy()[0],
+                                Name:   n.ResolvedProvider,
                                 Output: &provider,
                         },
 
@@ -112,7 +112,7 @@ func (n *NodePlannableResourceInstance) evalTreeDataResource(
                         &EvalWriteState{
                                 Name:         stateId,
                                 ResourceType: n.Config.Type,
-                                Provider:     n.Config.Provider,
+                                Provider:     n.ResolvedProvider,
                                 Dependencies: stateDeps,
                                 State:        &state,
                         },
@@ -143,7 +143,7 @@ func (n *NodePlannableResourceInstance) evalTreeManagedResource(
                                 Output:   &resourceConfig,
                         },
                         &EvalGetProvider{
-                                Name:   n.ProvidedBy()[0],
+                                Name:   n.ResolvedProvider,
                                 Output: &provider,
                         },
                         // Re-run validation to catch any errors we missed, e.g. type
@@ -177,7 +177,7 @@ func (n *NodePlannableResourceInstance) evalTreeManagedResource(
                         &EvalWriteState{
                                 Name:         stateId,
                                 ResourceType: n.Config.Type,
-                                Provider:     n.Config.Provider,
+                                Provider:     n.ResolvedProvider,
                                 Dependencies: stateDeps,
                                 State:        &state,
                         },
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_refresh.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_refresh.go
index cd4fe92..697bd49 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_refresh.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_refresh.go
@@ -30,6 +30,7 @@ func (n *NodeRefreshableManagedResource) DynamicExpand(ctx EvalContext) (*Graph,
         concreteResource := func(a *NodeAbstractResource) dag.Vertex {
                 // Add the config and state since we don't do that via transforms
                 a.Config = n.Config
+                a.ResolvedProvider = n.ResolvedProvider
 
                 return &NodeRefreshableManagedResourceInstance{
                         NodeAbstractResource: a,
@@ -149,7 +150,7 @@ func (n *NodeRefreshableManagedResourceInstance) evalTreeManagedResource() EvalN
         return &EvalSequence{
                 Nodes: []EvalNode{
                         &EvalGetProvider{
-                                Name:   n.ProvidedBy()[0],
+                                Name:   n.ResolvedProvider,
                                 Output: &provider,
                         },
                         &EvalReadState{
@@ -165,7 +166,7 @@ func (n *NodeRefreshableManagedResourceInstance) evalTreeManagedResource() EvalN
                         &EvalWriteState{
                                 Name:         stateId,
                                 ResourceType: n.ResourceState.Type,
-                                Provider:     n.ResourceState.Provider,
+                                Provider:     n.ResolvedProvider,
                                 Dependencies: n.ResourceState.Dependencies,
                                 State:        &state,
                         },
@@ -212,15 +213,21 @@ func (n *NodeRefreshableManagedResourceInstance) evalTreeManagedResourceNoState(
         // Determine the dependencies for the state.
         stateDeps := n.StateReferences()
 
+        // n.Config can be nil if the config and state don't match
+        var raw *config.RawConfig
+        if n.Config != nil {
+                raw = n.Config.RawConfig.Copy()
+        }
+
         return &EvalSequence{
                 Nodes: []EvalNode{
                         &EvalInterpolate{
-                                Config:   n.Config.RawConfig.Copy(),
+                                Config:   raw,
                                 Resource: resource,
                                 Output:   &resourceConfig,
                         },
                         &EvalGetProvider{
-                                Name:   n.ProvidedBy()[0],
+                                Name:   n.ResolvedProvider,
                                 Output: &provider,
                         },
                         // Re-run validation to catch any errors we missed, e.g. type
@@ -250,7 +257,7 @@ func (n *NodeRefreshableManagedResourceInstance) evalTreeManagedResourceNoState(
                         &EvalWriteState{
                                 Name:         stateID,
                                 ResourceType: n.Config.Type,
-                                Provider:     n.Config.Provider,
+                                Provider:     n.ResolvedProvider,
                                 Dependencies: stateDeps,
                                 State:        &state,
                         },
diff --git a/vendor/github.com/hashicorp/terraform/terraform/node_resource_validate.go b/vendor/github.com/hashicorp/terraform/terraform/node_resource_validate.go
index f528f24..0df223d 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/node_resource_validate.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/node_resource_validate.go
@@ -39,6 +39,7 @@ func (n *NodeValidatableResource) DynamicExpand(ctx EvalContext) (*Graph, error)
         concreteResource := func(a *NodeAbstractResource) dag.Vertex {
                 // Add the config and state since we don't do that via transforms
                 a.Config = n.Config
+                a.ResolvedProvider = n.ResolvedProvider
 
                 return &NodeValidatableResourceInstance{
                         NodeAbstractResource: a,
@@ -108,7 +109,7 @@ func (n *NodeValidatableResourceInstance) EvalTree() EvalNode {
                                 Config: &n.Config.RawConfig,
                         },
                         &EvalGetProvider{
-                                Name:   n.ProvidedBy()[0],
+                                Name:   n.ResolvedProvider,
                                 Output: &provider,
                         },
                         &EvalInterpolate{
diff --git a/vendor/github.com/hashicorp/terraform/terraform/path.go b/vendor/github.com/hashicorp/terraform/terraform/path.go
index ca99685..51dd412 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/path.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/path.go
@@ -1,24 +1,10 @@
 package terraform
 
 import (
-        "crypto/md5"
-        "encoding/hex"
+        "strings"
 )
 
 // PathCacheKey returns a cache key for a module path.
-//
-// TODO: test
 func PathCacheKey(path []string) string {
-        // There is probably a better way to do this, but this is working for now.
-        // We just create an MD5 hash of all the MD5 hashes of all the path
-        // elements. This gets us the property that it is unique per ordering.
-        hash := md5.New()
-        for _, p := range path {
-                single := md5.Sum([]byte(p))
-                if _, err := hash.Write(single[:]); err != nil {
-                        panic(err)
-                }
-        }
-
-        return hex.EncodeToString(hash.Sum(nil))
+        return strings.Join(path, "|")
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/plan.go b/vendor/github.com/hashicorp/terraform/terraform/plan.go
index 51d6652..30db195 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/plan.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/plan.go
@@ -10,6 +10,7 @@ import (
         "sync"
 
         "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/version"
 )
 
 func init() {
@@ -26,18 +27,54 @@ func init() {
 // necessary to make a change: the state, diff, config, backend config, etc.
 // This is so that it can run alone without any other data.
 type Plan struct {
-        Diff    *Diff
-        Module  *module.Tree
-        State   *State
-        Vars    map[string]interface{}
+        // Diff describes the resource actions that must be taken when this
+        // plan is applied.
+        Diff *Diff
+
+        // Module represents the entire configuration that was present when this
+        // plan was created.
+        Module *module.Tree
+
+        // State is the Terraform state that was current when this plan was
+        // created.
+        //
+        // It is not allowed to apply a plan that has a stale state, since its
+        // diff could be outdated.
+        State *State
+
+        // Vars retains the variables that were set when creating the plan, so
+        // that the same variables can be applied during apply.
+        Vars map[string]interface{}
+
+        // Targets, if non-empty, contains a set of resource address strings that
+        // identify graph nodes that were selected as targets for plan.
+        //
+        // When targets are set, any graph node that is not directly targeted or
+        // indirectly targeted via dependencies is excluded from the graph.
         Targets []string
 
+        // TerraformVersion is the version of Terraform that was used to create
+        // this plan.
+        //
+        // It is not allowed to apply a plan created with a different version of
+        // Terraform, since the other fields of this structure may be interpreted
+        // in different ways between versions.
         TerraformVersion string
-        ProviderSHA256s  map[string][]byte
+
+        // ProviderSHA256s is a map giving the SHA256 hashes of the exact binaries
+        // used as plugins for each provider during plan.
+        //
+        // These must match between plan and apply to ensure that the diff is
+        // correctly interpreted, since different provider versions may have
+        // different attributes or attribute value constraints.
+        ProviderSHA256s map[string][]byte
 
         // Backend is the backend that this plan should use and store data with.
         Backend *BackendState
 
+        // Destroy indicates that this plan was created for a full destroy operation
+        Destroy bool
+
         once sync.Once
 }
 
@@ -67,6 +104,7 @@ func (p *Plan) contextOpts(base *ContextOpts) (*ContextOpts, error) {
         opts.Module = p.Module
         opts.Targets = p.Targets
         opts.ProviderSHA256s = p.ProviderSHA256s
+        opts.Destroy = p.Destroy
 
         if opts.State == nil {
                 opts.State = p.State
@@ -79,10 +117,10 @@ func (p *Plan) contextOpts(base *ContextOpts) (*ContextOpts, error) {
                 // the state, there is little chance that these aren't actually equal.
                 // Log the error condition for reference, but continue with the state
                 // we have.
-                log.Println("[WARNING] Plan state and ContextOpts state are not equal")
+                log.Println("[WARN] Plan state and ContextOpts state are not equal")
         }
 
-        thisVersion := VersionString()
+        thisVersion := version.String()
         if p.TerraformVersion != "" && p.TerraformVersion != thisVersion {
                 return nil, fmt.Errorf(
                         "plan was created with a different version of Terraform (created with %s, but running %s)",
diff --git a/vendor/github.com/hashicorp/terraform/terraform/resource.go b/vendor/github.com/hashicorp/terraform/terraform/resource.go
index 0acf0be..2f5ebb5 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/resource.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/resource.go
@@ -88,6 +88,46 @@ func (i *InstanceInfo) HumanId() string {
                 i.Id)
 }
 
+// ResourceAddress returns the address of the resource that the receiver is describing.
+func (i *InstanceInfo) ResourceAddress() *ResourceAddress {
+        // GROSS: for tainted and deposed instances, their status gets appended
+        // to i.Id to create a unique id for the graph node. Historically these
+        // ids were displayed to the user, so it's designed to be human-readable:
+        //   "aws_instance.bar.0 (deposed #0)"
+        //
+        // So here we detect such suffixes and try to interpret them back to
+        // their original meaning so we can then produce a ResourceAddress
+        // with a suitable InstanceType.
+        id := i.Id
+        instanceType := TypeInvalid
+        if idx := strings.Index(id, " ("); idx != -1 {
+                remain := id[idx:]
+                id = id[:idx]
+
+                switch {
+                case strings.Contains(remain, "tainted"):
+                        instanceType = TypeTainted
+                case strings.Contains(remain, "deposed"):
+                        instanceType = TypeDeposed
+                }
+        }
+
+        addr, err := parseResourceAddressInternal(id)
+        if err != nil {
+                // should never happen, since that would indicate a bug in the
+                // code that constructed this InstanceInfo.
+                panic(fmt.Errorf("InstanceInfo has invalid Id %s", id))
+        }
+        if len(i.ModulePath) > 1 {
+                addr.Path = i.ModulePath[1:] // trim off "root" prefix, which is implied
+        }
+        if instanceType != TypeInvalid {
+                addr.InstanceTypeSet = true
+                addr.InstanceType = instanceType
+        }
+        return addr
+}
+
 func (i *InstanceInfo) uniqueId() string {
         prefix := i.HumanId()
         if v := i.uniqueExtra; v != "" {
@@ -306,7 +346,7 @@ func (c *ResourceConfig) get(
                                 if err != nil {
                                         return nil, false
                                 }
-                                if i >= int64(cv.Len()) {
+                                if int(i) < 0 || int(i) >= cv.Len() {
                                         return nil, false
                                 }
                                 current = cv.Index(int(i)).Interface()
diff --git a/vendor/github.com/hashicorp/terraform/terraform/resource_address.go b/vendor/github.com/hashicorp/terraform/terraform/resource_address.go
index 8badca8..a64f5d8 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/resource_address.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/resource_address.go
@@ -42,9 +42,9 @@ func (r *ResourceAddress) Copy() *ResourceAddress {
                 Type:         r.Type,
                 Mode:         r.Mode,
         }
-        for _, p := range r.Path {
-                n.Path = append(n.Path, p)
-        }
+
+        n.Path = append(n.Path, r.Path...)
+
         return n
 }
 
@@ -362,40 +362,41 @@ func (addr *ResourceAddress) Less(other *ResourceAddress) bool {
 
         switch {
 
-        case len(addr.Path) < len(other.Path):
-                return true
+        case len(addr.Path) != len(other.Path):
+                return len(addr.Path) < len(other.Path)
 
         case !reflect.DeepEqual(addr.Path, other.Path):
                 // If the two paths are the same length but don't match, we'll just
                 // cheat and compare the string forms since it's easier than
-                // comparing all of the path segments in turn.
+                // comparing all of the path segments in turn, and lexicographic
+                // comparison is correct for the module path portion.
                 addrStr := addr.String()
                 otherStr := other.String()
                 return addrStr < otherStr
 
-        case addr.Mode == config.DataResourceMode && other.Mode != config.DataResourceMode:
-                return true
+        case addr.Mode != other.Mode:
+                return addr.Mode == config.DataResourceMode
 
-        case addr.Type < other.Type:
-                return true
+        case addr.Type != other.Type:
+                return addr.Type < other.Type
 
-        case addr.Name < other.Name:
-                return true
+        case addr.Name != other.Name:
+                return addr.Name < other.Name
 
-        case addr.Index < other.Index:
+        case addr.Index != other.Index:
                 // Since "Index" is -1 for an un-indexed address, this also conveniently
                 // sorts unindexed addresses before indexed ones, should they both
                 // appear for some reason.
-                return true
+                return addr.Index < other.Index
 
-        case other.InstanceTypeSet && !addr.InstanceTypeSet:
-                return true
+        case addr.InstanceTypeSet != other.InstanceTypeSet:
+                return !addr.InstanceTypeSet
 
-        case addr.InstanceType < other.InstanceType:
+        case addr.InstanceType != other.InstanceType:
                 // InstanceType is actually an enum, so this is just an arbitrary
                 // sort based on the enum numeric values, and thus not particularly
                 // meaningful.
-                return true
+                return addr.InstanceType < other.InstanceType
 
         default:
                 return false
diff --git a/vendor/github.com/hashicorp/terraform/terraform/resource_provider.go b/vendor/github.com/hashicorp/terraform/terraform/resource_provider.go
index 7d78f67..93fd14f 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/resource_provider.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/resource_provider.go
@@ -21,6 +21,15 @@ type ResourceProvider interface {
         * Functions related to the provider
         *********************************************************************/
 
+        // ProviderSchema returns the config schema for the main provider
+        // configuration, as would appear in a "provider" block in the
+        // configuration files.
+        //
+        // Currently not all providers support schema. Callers must therefore
+        // first call Resources and DataSources and ensure that at least one
+        // resource or data source has the SchemaAvailable flag set.
+        GetSchema(*ProviderSchemaRequest) (*ProviderSchema, error)
+
         // Input is called to ask the provider to ask the user for input
         // for completing the configuration if necesarry.
         //
@@ -183,11 +192,25 @@ type ResourceProviderCloser interface {
 type ResourceType struct {
         Name       string // Name of the resource, example "instance" (no provider prefix)
         Importable bool   // Whether this resource supports importing
+
+        // SchemaAvailable is set if the provider supports the ProviderSchema,
+        // ResourceTypeSchema and DataSourceSchema methods. Although it is
+        // included on each resource type, it's actually a provider-wide setting
+        // that's smuggled here only because that avoids a breaking change to
+        // the plugin protocol.
+        SchemaAvailable bool
 }
 
 // DataSource is a data source that a resource provider implements.
 type DataSource struct {
         Name string
+
+        // SchemaAvailable is set if the provider supports the ProviderSchema,
+        // ResourceTypeSchema and DataSourceSchema methods. Although it is
+        // included on each resource type, it's actually a provider-wide setting
+        // that's smuggled here only because that avoids a breaking change to
+        // the plugin protocol.
+        SchemaAvailable bool
 }
 
 // ResourceProviderResolver is an interface implemented by objects that are
diff --git a/vendor/github.com/hashicorp/terraform/terraform/resource_provider_mock.go b/vendor/github.com/hashicorp/terraform/terraform/resource_provider_mock.go
index f531533..4000e3d 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/resource_provider_mock.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/resource_provider_mock.go
@@ -1,6 +1,8 @@
 package terraform
 
-import "sync"
+import (
+        "sync"
+)
 
 // MockResourceProvider implements ResourceProvider but mocks out all the
 // calls for testing purposes.
@@ -12,6 +14,10 @@ type MockResourceProvider struct {
 
         CloseCalled                    bool
         CloseError                     error
+        GetSchemaCalled                bool
+        GetSchemaRequest               *ProviderSchemaRequest
+        GetSchemaReturn                *ProviderSchema
+        GetSchemaReturnError           error
         InputCalled                    bool
         InputInput                     UIInput
         InputConfig                    *ResourceConfig
@@ -92,8 +98,19 @@ func (p *MockResourceProvider) Close() error {
         return p.CloseError
 }
 
+func (p *MockResourceProvider) GetSchema(req *ProviderSchemaRequest) (*ProviderSchema, error) {
+        p.Lock()
+        defer p.Unlock()
+
+        p.GetSchemaCalled = true
+        p.GetSchemaRequest = req
+        return p.GetSchemaReturn, p.GetSchemaReturnError
+}
+
 func (p *MockResourceProvider) Input(
         input UIInput, c *ResourceConfig) (*ResourceConfig, error) {
+        p.Lock()
+        defer p.Unlock()
         p.InputCalled = true
         p.InputInput = input
         p.InputConfig = c
@@ -186,6 +203,7 @@ func (p *MockResourceProvider) Diff(
         p.DiffInfo = info
         p.DiffState = state
         p.DiffDesired = desired
+
         if p.DiffFn != nil {
                 return p.DiffFn(info, state, desired)
         }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/schemas.go b/vendor/github.com/hashicorp/terraform/terraform/schemas.go
new file mode 100644
index 0000000..ec46efc
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/schemas.go
@@ -0,0 +1,34 @@
+package terraform
+
+import (
+        "github.com/hashicorp/terraform/config/configschema"
+)
+
+type Schemas struct {
+        Providers ProviderSchemas
+}
+
+// ProviderSchemas is a map from provider names to provider schemas.
+//
+// The names in this map are the direct plugin name (e.g. "aws") rather than
+// any alias name (e.g. "aws.foo"), since.
+type ProviderSchemas map[string]*ProviderSchema
+
+// ProviderSchema represents the schema for a provider's own configuration
+// and the configuration for some or all of its resources and data sources.
+//
+// The completeness of this structure depends on how it was constructed.
+// When constructed for a configuration, it will generally include only
+// resource types and data sources used by that configuration.
+type ProviderSchema struct {
+        Provider      *configschema.Block
+        ResourceTypes map[string]*configschema.Block
+        DataSources   map[string]*configschema.Block
+}
+
+// ProviderSchemaRequest is used to describe to a ResourceProvider which
+// aspects of schema are required, when calling the GetSchema method.
+type ProviderSchemaRequest struct {
+        ResourceTypes []string
+        DataSources   []string
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/shadow.go b/vendor/github.com/hashicorp/terraform/terraform/shadow.go
deleted file mode 100644
index 4632559..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/shadow.go
+++ /dev/null
@@ -1,28 +0,0 @@
-package terraform
-
-// Shadow is the interface that any "shadow" structures must implement.
-//
-// A shadow structure is an interface implementation (typically) that
-// shadows a real implementation and verifies that the same behavior occurs
-// on both. The semantics of this behavior are up to the interface itself.
-//
-// A shadow NEVER modifies real values or state. It must always be safe to use.
-//
-// For example, a ResourceProvider shadow ensures that the same operations
-// are done on the same resources with the same configurations.
-//
-// The typical usage of a shadow following this interface is to complete
-// the real operations, then call CloseShadow which tells the shadow that
-// the real side is done. Then, once the shadow is also complete, call
-// ShadowError to find any errors that may have been caught.
-type Shadow interface {
-        // CloseShadow tells the shadow that the REAL implementation is
-        // complete. Therefore, any calls that would block should now return
-        // immediately since no more changes will happen to the real side.
-        CloseShadow() error
-
-        // ShadowError returns the errors that the shadow has found.
-        // This should be called AFTER CloseShadow and AFTER the shadow is
-        // known to be complete (no more calls to it).
-        ShadowError() error
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/shadow_components.go b/vendor/github.com/hashicorp/terraform/terraform/shadow_components.go
deleted file mode 100644
index 116cf84..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/shadow_components.go
+++ /dev/null
@@ -1,273 +0,0 @@
-package terraform
-
-import (
-        "fmt"
-        "sync"
-
-        "github.com/hashicorp/go-multierror"
-        "github.com/hashicorp/terraform/helper/shadow"
-)
-
-// newShadowComponentFactory creates a shadowed contextComponentFactory
-// so that requests to create new components result in both a real and
-// shadow side.
-func newShadowComponentFactory(
-        f contextComponentFactory) (contextComponentFactory, *shadowComponentFactory) {
-        // Create the shared data
-        shared := &shadowComponentFactoryShared{contextComponentFactory: f}
-
-        // Create the real side
-        real := &shadowComponentFactory{
-                shadowComponentFactoryShared: shared,
-        }
-
-        // Create the shadow
-        shadow := &shadowComponentFactory{
-                shadowComponentFactoryShared: shared,
-                Shadow: true,
-        }
-
-        return real, shadow
-}
-
-// shadowComponentFactory is the shadow side. Any components created
-// with this factory are fake and will not cause real work to happen.
-//
-// Unlike other shadowers, the shadow component factory will allow the
-// shadow to create _any_ component even if it is never requested on the
-// real side. This is because errors will happen later downstream as function
-// calls are made to the shadows that are never matched on the real side.
-type shadowComponentFactory struct {
-        *shadowComponentFactoryShared
-
-        Shadow bool // True if this should return the shadow
-        lock   sync.Mutex
-}
-
-func (f *shadowComponentFactory) ResourceProvider(
-        n, uid string) (ResourceProvider, error) {
-        f.lock.Lock()
-        defer f.lock.Unlock()
-
-        real, shadow, err := f.shadowComponentFactoryShared.ResourceProvider(n, uid)
-        var result ResourceProvider = real
-        if f.Shadow {
-                result = shadow
-        }
-
-        return result, err
-}
-
-func (f *shadowComponentFactory) ResourceProvisioner(
-        n, uid string) (ResourceProvisioner, error) {
-        f.lock.Lock()
-        defer f.lock.Unlock()
-
-        real, shadow, err := f.shadowComponentFactoryShared.ResourceProvisioner(n, uid)
-        var result ResourceProvisioner = real
-        if f.Shadow {
-                result = shadow
-        }
-
-        return result, err
-}
-
-// CloseShadow is called when the _real_ side is complete. This will cause
-// all future blocking operations to return immediately on the shadow to
-// ensure the shadow also completes.
-func (f *shadowComponentFactory) CloseShadow() error {
-        // If we aren't the shadow, just return
-        if !f.Shadow {
-                return nil
-        }
-
-        // Lock ourselves so we don't modify state
-        f.lock.Lock()
-        defer f.lock.Unlock()
-
-        // Grab our shared state
-        shared := f.shadowComponentFactoryShared
-
-        // If we're already closed, its an error
-        if shared.closed {
-                return fmt.Errorf("component factory shadow already closed")
-        }
-
-        // Close all the providers and provisioners and return the error
-        var result error
-        for _, n := range shared.providerKeys {
-                _, shadow, err := shared.ResourceProvider(n, n)
-                if err == nil && shadow != nil {
-                        if err := shadow.CloseShadow(); err != nil {
-                                result = multierror.Append(result, err)
-                        }
-                }
-        }
-
-        for _, n := range shared.provisionerKeys {
-                _, shadow, err := shared.ResourceProvisioner(n, n)
-                if err == nil && shadow != nil {
-                        if err := shadow.CloseShadow(); err != nil {
-                                result = multierror.Append(result, err)
-                        }
-                }
-        }
-
-        // Mark ourselves as closed
-        shared.closed = true
-
-        return result
-}
-
-func (f *shadowComponentFactory) ShadowError() error {
-        // If we aren't the shadow, just return
-        if !f.Shadow {
-                return nil
-        }
-
-        // Lock ourselves so we don't modify state
-        f.lock.Lock()
-        defer f.lock.Unlock()
-
-        // Grab our shared state
-        shared := f.shadowComponentFactoryShared
-
-        // If we're not closed, its an error
-        if !shared.closed {
-                return fmt.Errorf("component factory must be closed to retrieve errors")
-        }
-
-        // Close all the providers and provisioners and return the error
-        var result error
-        for _, n := range shared.providerKeys {
-                _, shadow, err := shared.ResourceProvider(n, n)
-                if err == nil && shadow != nil {
-                        if err := shadow.ShadowError(); err != nil {
-                                result = multierror.Append(result, err)
-                        }
-                }
-        }
-
-        for _, n := range shared.provisionerKeys {
-                _, shadow, err := shared.ResourceProvisioner(n, n)
-                if err == nil && shadow != nil {
-                        if err := shadow.ShadowError(); err != nil {
-                                result = multierror.Append(result, err)
-                        }
-                }
-        }
-
-        return result
-}
-
-// shadowComponentFactoryShared is shared data between the two factories.
-//
-// It is NOT SAFE to run any function on this struct in parallel. Lock
-// access to this struct.
-type shadowComponentFactoryShared struct {
-        contextComponentFactory
-
-        closed          bool
-        providers       shadow.KeyedValue
-        providerKeys    []string
-        provisioners    shadow.KeyedValue
-        provisionerKeys []string
-}
-
-// shadowResourceProviderFactoryEntry is the entry that is stored in
-// the Shadows key/value for a provider.
-type shadowComponentFactoryProviderEntry struct {
-        Real   ResourceProvider
-        Shadow shadowResourceProvider
-        Err    error
-}
-
-type shadowComponentFactoryProvisionerEntry struct {
-        Real   ResourceProvisioner
-        Shadow shadowResourceProvisioner
-        Err    error
-}
-
-func (f *shadowComponentFactoryShared) ResourceProvider(
-        n, uid string) (ResourceProvider, shadowResourceProvider, error) {
-        // Determine if we already have a value
-        raw, ok := f.providers.ValueOk(uid)
-        if !ok {
-                // Build the entry
-                var entry shadowComponentFactoryProviderEntry
-
-                // No value, initialize. Create the original
-                p, err := f.contextComponentFactory.ResourceProvider(n, uid)
-                if err != nil {
-                        entry.Err = err
-                        p = nil // Just to be sure
-                }
-
-                if p != nil {
-                        // Create the shadow
-                        real, shadow := newShadowResourceProvider(p)
-                        entry.Real = real
-                        entry.Shadow = shadow
-
-                        if f.closed {
-                                shadow.CloseShadow()
-                        }
-                }
-
-                // Store the value
-                f.providers.SetValue(uid, &entry)
-                f.providerKeys = append(f.providerKeys, uid)
-                raw = &entry
-        }
-
-        // Read the entry
-        entry, ok := raw.(*shadowComponentFactoryProviderEntry)
-        if !ok {
-                return nil, nil, fmt.Errorf("Unknown value for shadow provider: %#v", raw)
-        }
-
-        // Return
-        return entry.Real, entry.Shadow, entry.Err
-}
-
-func (f *shadowComponentFactoryShared) ResourceProvisioner(
-        n, uid string) (ResourceProvisioner, shadowResourceProvisioner, error) {
-        // Determine if we already have a value
-        raw, ok := f.provisioners.ValueOk(uid)
-        if !ok {
-                // Build the entry
-                var entry shadowComponentFactoryProvisionerEntry
-
-                // No value, initialize. Create the original
-                p, err := f.contextComponentFactory.ResourceProvisioner(n, uid)
-                if err != nil {
-                        entry.Err = err
-                        p = nil // Just to be sure
-                }
-
-                if p != nil {
-                        // For now, just create a mock since we don't support provisioners yet
-                        real, shadow := newShadowResourceProvisioner(p)
-                        entry.Real = real
-                        entry.Shadow = shadow
-
-                        if f.closed {
-                                shadow.CloseShadow()
-                        }
-                }
-
-                // Store the value
-                f.provisioners.SetValue(uid, &entry)
-                f.provisionerKeys = append(f.provisionerKeys, uid)
-                raw = &entry
-        }
-
-        // Read the entry
-        entry, ok := raw.(*shadowComponentFactoryProvisionerEntry)
-        if !ok {
-                return nil, nil, fmt.Errorf("Unknown value for shadow provisioner: %#v", raw)
-        }
-
-        // Return
-        return entry.Real, entry.Shadow, entry.Err
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/shadow_context.go b/vendor/github.com/hashicorp/terraform/terraform/shadow_context.go
deleted file mode 100644
index 5588af2..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/shadow_context.go
+++ /dev/null
@@ -1,158 +0,0 @@
-package terraform
-
-import (
-        "fmt"
-        "strings"
-
-        "github.com/hashicorp/go-multierror"
-        "github.com/mitchellh/copystructure"
-)
-
-// newShadowContext creates a new context that will shadow the given context
-// when walking the graph. The resulting context should be used _only once_
-// for a graph walk.
-//
-// The returned Shadow should be closed after the graph walk with the
-// real context is complete. Errors from the shadow can be retrieved there.
-//
-// Most importantly, any operations done on the shadow context (the returned
-// context) will NEVER affect the real context. All structures are deep
-// copied, no real providers or resources are used, etc.
-func newShadowContext(c *Context) (*Context, *Context, Shadow) {
-        // Copy the targets
-        targetRaw, err := copystructure.Copy(c.targets)
-        if err != nil {
-                panic(err)
-        }
-
-        // Copy the variables
-        varRaw, err := copystructure.Copy(c.variables)
-        if err != nil {
-                panic(err)
-        }
-
-        // Copy the provider inputs
-        providerInputRaw, err := copystructure.Copy(c.providerInputConfig)
-        if err != nil {
-                panic(err)
-        }
-
-        // The factories
-        componentsReal, componentsShadow := newShadowComponentFactory(c.components)
-
-        // Create the shadow
-        shadow := &Context{
-                components: componentsShadow,
-                destroy:    c.destroy,
-                diff:       c.diff.DeepCopy(),
-                hooks:      nil,
-                meta:       c.meta,
-                module:     c.module,
-                state:      c.state.DeepCopy(),
-                targets:    targetRaw.([]string),
-                variables:  varRaw.(map[string]interface{}),
-
-                // NOTE(mitchellh): This is not going to work for shadows that are
-                // testing that input results in the proper end state. At the time
-                // of writing, input is not used in any state-changing graph
-                // walks anyways, so this checks nothing. We set it to this to avoid
-                // any panics but even a "nil" value worked here.
-                uiInput: new(MockUIInput),
-
-                // Hardcoded to 4 since parallelism in the shadow doesn't matter
-                // a ton since we're doing far less compared to the real side
-                // and our operations are MUCH faster.
-                parallelSem:         NewSemaphore(4),
-                providerInputConfig: providerInputRaw.(map[string]map[string]interface{}),
-        }
-
-        // Create the real context. This is effectively just a copy of
-        // the context given except we need to modify some of the values
-        // to point to the real side of a shadow so the shadow can compare values.
-        real := &Context{
-                // The fields below are changed.
-                components: componentsReal,
-
-                // The fields below are direct copies
-                destroy: c.destroy,
-                diff:    c.diff,
-                // diffLock - no copy
-                hooks:  c.hooks,
-                meta:   c.meta,
-                module: c.module,
-                sh:     c.sh,
-                state:  c.state,
-                // stateLock - no copy
-                targets:   c.targets,
-                uiInput:   c.uiInput,
-                variables: c.variables,
-
-                // l - no copy
-                parallelSem:         c.parallelSem,
-                providerInputConfig: c.providerInputConfig,
-                runContext:          c.runContext,
-                runContextCancel:    c.runContextCancel,
-                shadowErr:           c.shadowErr,
-        }
-
-        return real, shadow, &shadowContextCloser{
-                Components: componentsShadow,
-        }
-}
-
-// shadowContextVerify takes the real and shadow context and verifies they
-// have equal diffs and states.
-func shadowContextVerify(real, shadow *Context) error {
-        var result error
-
-        // The states compared must be pruned so they're minimal/clean
-        real.state.prune()
-        shadow.state.prune()
-
-        // Compare the states
-        if !real.state.Equal(shadow.state) {
-                result = multierror.Append(result, fmt.Errorf(
-                        "Real and shadow states do not match! "+
-                                "Real state:\n\n%s\n\n"+
-                                "Shadow state:\n\n%s\n\n",
-                        real.state, shadow.state))
-        }
-
-        // Compare the diffs
-        if !real.diff.Equal(shadow.diff) {
-                result = multierror.Append(result, fmt.Errorf(
-                        "Real and shadow diffs do not match! "+
-                                "Real diff:\n\n%s\n\n"+
-                                "Shadow diff:\n\n%s\n\n",
-                        real.diff, shadow.diff))
-        }
-
-        return result
-}
-
-// shadowContextCloser is the io.Closer returned by newShadowContext that
-// closes all the shadows and returns the results.
-type shadowContextCloser struct {
-        Components *shadowComponentFactory
-}
-
-// Close closes the shadow context.
-func (c *shadowContextCloser) CloseShadow() error {
-        return c.Components.CloseShadow()
-}
-
-func (c *shadowContextCloser) ShadowError() error {
-        err := c.Components.ShadowError()
-        if err == nil {
-                return nil
-        }
-
-        // This is a sad edge case: if the configuration contains uuid() at
-        // any point, we cannot reason aboyt the shadow execution. Tested
-        // with Context2Plan_shadowUuid.
-        if strings.Contains(err.Error(), "uuid()") {
-                err = nil
-        }
-
-        return err
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/shadow_resource_provider.go b/vendor/github.com/hashicorp/terraform/terraform/shadow_resource_provider.go
deleted file mode 100644
index 9741d7e..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/shadow_resource_provider.go
+++ /dev/null
@@ -1,815 +0,0 @@
-package terraform
-
-import (
-        "fmt"
-        "log"
-        "sync"
-
-        "github.com/hashicorp/go-multierror"
-        "github.com/hashicorp/terraform/helper/shadow"
-)
-
-// shadowResourceProvider implements ResourceProvider for the shadow
-// eval context defined in eval_context_shadow.go.
-//
-// This is used to verify behavior with a real provider. This shouldn't
-// be used directly.
-type shadowResourceProvider interface {
-        ResourceProvider
-        Shadow
-}
-
-// newShadowResourceProvider creates a new shadowed ResourceProvider.
-//
-// This will assume a well behaved real ResourceProvider. For example,
-// it assumes that the `Resources` call underneath doesn't change values
-// since once it is called on the real provider, it will be cached and
-// returned in the shadow since number of calls to that shouldn't affect
-// actual behavior.
-//
-// However, with calls like Apply, call order is taken into account,
-// parameters are checked for equality, etc.
-func newShadowResourceProvider(p ResourceProvider) (ResourceProvider, shadowResourceProvider) {
-        // Create the shared data
-        shared := shadowResourceProviderShared{}
-
-        // Create the real provider that does actual work
-        real := &shadowResourceProviderReal{
-                ResourceProvider: p,
-                Shared:           &shared,
-        }
-
-        // Create the shadow that watches the real value
-        shadow := &shadowResourceProviderShadow{
-                Shared: &shared,
-
-                resources:   p.Resources(),
-                dataSources: p.DataSources(),
-        }
-
-        return real, shadow
-}
-
-// shadowResourceProviderReal is the real resource provider. Function calls
-// to this will perform real work. This records the parameters and return
-// values and call order for the shadow to reproduce.
-type shadowResourceProviderReal struct {
-        ResourceProvider
-
-        Shared *shadowResourceProviderShared
-}
-
-func (p *shadowResourceProviderReal) Close() error {
-        var result error
-        if c, ok := p.ResourceProvider.(ResourceProviderCloser); ok {
-                result = c.Close()
-        }
-
-        p.Shared.CloseErr.SetValue(result)
-        return result
-}
-
-func (p *shadowResourceProviderReal) Input(
-        input UIInput, c *ResourceConfig) (*ResourceConfig, error) {
-        cCopy := c.DeepCopy()
-
-        result, err := p.ResourceProvider.Input(input, c)
-        p.Shared.Input.SetValue(&shadowResourceProviderInput{
-                Config:    cCopy,
-                Result:    result.DeepCopy(),
-                ResultErr: err,
-        })
-
-        return result, err
-}
-
-func (p *shadowResourceProviderReal) Validate(c *ResourceConfig) ([]string, []error) {
-        warns, errs := p.ResourceProvider.Validate(c)
-        p.Shared.Validate.SetValue(&shadowResourceProviderValidate{
-                Config:     c.DeepCopy(),
-                ResultWarn: warns,
-                ResultErr:  errs,
-        })
-
-        return warns, errs
-}
-
-func (p *shadowResourceProviderReal) Configure(c *ResourceConfig) error {
-        cCopy := c.DeepCopy()
-
-        err := p.ResourceProvider.Configure(c)
-        p.Shared.Configure.SetValue(&shadowResourceProviderConfigure{
-                Config: cCopy,
-                Result: err,
-        })
-
-        return err
-}
-
-func (p *shadowResourceProviderReal) Stop() error {
-        return p.ResourceProvider.Stop()
-}
-
-func (p *shadowResourceProviderReal) ValidateResource(
-        t string, c *ResourceConfig) ([]string, []error) {
-        key := t
-        configCopy := c.DeepCopy()
-
-        // Real operation
-        warns, errs := p.ResourceProvider.ValidateResource(t, c)
-
-        // Initialize to ensure we always have a wrapper with a lock
-        p.Shared.ValidateResource.Init(
-                key, &shadowResourceProviderValidateResourceWrapper{})
-
-        // Get the result
-        raw := p.Shared.ValidateResource.Value(key)
-        wrapper, ok := raw.(*shadowResourceProviderValidateResourceWrapper)
-        if !ok {
-                // If this fails then we just continue with our day... the shadow
-                // will fail to but there isn't much we can do.
-                log.Printf(
-                        "[ERROR] unknown value in ValidateResource shadow value: %#v", raw)
-                return warns, errs
-        }
-
-        // Lock the wrapper for writing and record our call
-        wrapper.Lock()
-        defer wrapper.Unlock()
-
-        wrapper.Calls = append(wrapper.Calls, &shadowResourceProviderValidateResource{
-                Config: configCopy,
-                Warns:  warns,
-                Errors: errs,
-        })
-
-        // With it locked, call SetValue again so that it triggers WaitForChange
-        p.Shared.ValidateResource.SetValue(key, wrapper)
-
-        // Return the result
-        return warns, errs
-}
-
-func (p *shadowResourceProviderReal) Apply(
-        info *InstanceInfo,
-        state *InstanceState,
-        diff *InstanceDiff) (*InstanceState, error) {
-        // Thse have to be copied before the call since call can modify
-        stateCopy := state.DeepCopy()
-        diffCopy := diff.DeepCopy()
-
-        result, err := p.ResourceProvider.Apply(info, state, diff)
-        p.Shared.Apply.SetValue(info.uniqueId(), &shadowResourceProviderApply{
-                State:     stateCopy,
-                Diff:      diffCopy,
-                Result:    result.DeepCopy(),
-                ResultErr: err,
-        })
-
-        return result, err
-}
-
-func (p *shadowResourceProviderReal) Diff(
-        info *InstanceInfo,
-        state *InstanceState,
-        desired *ResourceConfig) (*InstanceDiff, error) {
-        // Thse have to be copied before the call since call can modify
-        stateCopy := state.DeepCopy()
-        desiredCopy := desired.DeepCopy()
-
-        result, err := p.ResourceProvider.Diff(info, state, desired)
-        p.Shared.Diff.SetValue(info.uniqueId(), &shadowResourceProviderDiff{
-                State:     stateCopy,
-                Desired:   desiredCopy,
-                Result:    result.DeepCopy(),
-                ResultErr: err,
-        })
-
-        return result, err
-}
-
-func (p *shadowResourceProviderReal) Refresh(
-        info *InstanceInfo,
-        state *InstanceState) (*InstanceState, error) {
-        // Thse have to be copied before the call since call can modify
-        stateCopy := state.DeepCopy()
-
-        result, err := p.ResourceProvider.Refresh(info, state)
-        p.Shared.Refresh.SetValue(info.uniqueId(), &shadowResourceProviderRefresh{
-                State:     stateCopy,
-                Result:    result.DeepCopy(),
-                ResultErr: err,
-        })
-
-        return result, err
-}
-
-func (p *shadowResourceProviderReal) ValidateDataSource(
-        t string, c *ResourceConfig) ([]string, []error) {
-        key := t
-        configCopy := c.DeepCopy()
-
-        // Real operation
-        warns, errs := p.ResourceProvider.ValidateDataSource(t, c)
-
-        // Initialize
-        p.Shared.ValidateDataSource.Init(
-                key, &shadowResourceProviderValidateDataSourceWrapper{})
-
-        // Get the result
-        raw := p.Shared.ValidateDataSource.Value(key)
-        wrapper, ok := raw.(*shadowResourceProviderValidateDataSourceWrapper)
-        if !ok {
-                // If this fails then we just continue with our day... the shadow
-                // will fail to but there isn't much we can do.
-                log.Printf(
-                        "[ERROR] unknown value in ValidateDataSource shadow value: %#v", raw)
-                return warns, errs
-        }
-
-        // Lock the wrapper for writing and record our call
-        wrapper.Lock()
-        defer wrapper.Unlock()
-
-        wrapper.Calls = append(wrapper.Calls, &shadowResourceProviderValidateDataSource{
-                Config: configCopy,
-                Warns:  warns,
-                Errors: errs,
-        })
-
-        // Set it
-        p.Shared.ValidateDataSource.SetValue(key, wrapper)
-
-        // Return the result
-        return warns, errs
-}
-
-func (p *shadowResourceProviderReal) ReadDataDiff(
-        info *InstanceInfo,
-        desired *ResourceConfig) (*InstanceDiff, error) {
-        // These have to be copied before the call since call can modify
-        desiredCopy := desired.DeepCopy()
-
-        result, err := p.ResourceProvider.ReadDataDiff(info, desired)
-        p.Shared.ReadDataDiff.SetValue(info.uniqueId(), &shadowResourceProviderReadDataDiff{
-                Desired:   desiredCopy,
-                Result:    result.DeepCopy(),
-                ResultErr: err,
-        })
-
-        return result, err
-}
-
-func (p *shadowResourceProviderReal) ReadDataApply(
-        info *InstanceInfo,
-        diff *InstanceDiff) (*InstanceState, error) {
-        // Thse have to be copied before the call since call can modify
-        diffCopy := diff.DeepCopy()
-
-        result, err := p.ResourceProvider.ReadDataApply(info, diff)
-        p.Shared.ReadDataApply.SetValue(info.uniqueId(), &shadowResourceProviderReadDataApply{
-                Diff:      diffCopy,
-                Result:    result.DeepCopy(),
-                ResultErr: err,
-        })
-
-        return result, err
-}
-
-// shadowResourceProviderShadow is the shadow resource provider. Function
-// calls never affect real resources. This is paired with the "real" side
-// which must be called properly to enable recording.
-type shadowResourceProviderShadow struct {
-        Shared *shadowResourceProviderShared
-
-        // Cached values that are expected to not change
-        resources   []ResourceType
-        dataSources []DataSource
-
-        Error     error // Error is the list of errors from the shadow
-        ErrorLock sync.Mutex
-}
-
-type shadowResourceProviderShared struct {
-        // NOTE: Anytime a value is added here, be sure to add it to
-        // the Close() method so that it is closed.
-
-        CloseErr           shadow.Value
-        Input              shadow.Value
-        Validate           shadow.Value
-        Configure          shadow.Value
-        ValidateResource   shadow.KeyedValue
-        Apply              shadow.KeyedValue
-        Diff               shadow.KeyedValue
-        Refresh            shadow.KeyedValue
-        ValidateDataSource shadow.KeyedValue
-        ReadDataDiff       shadow.KeyedValue
-        ReadDataApply      shadow.KeyedValue
-}
-
-func (p *shadowResourceProviderShared) Close() error {
-        return shadow.Close(p)
-}
-
-func (p *shadowResourceProviderShadow) CloseShadow() error {
-        err := p.Shared.Close()
-        if err != nil {
-                err = fmt.Errorf("close error: %s", err)
-        }
-
-        return err
-}
-
-func (p *shadowResourceProviderShadow) ShadowError() error {
-        return p.Error
-}
-
-func (p *shadowResourceProviderShadow) Resources() []ResourceType {
-        return p.resources
-}
-
-func (p *shadowResourceProviderShadow) DataSources() []DataSource {
-        return p.dataSources
-}
-
-func (p *shadowResourceProviderShadow) Close() error {
-        v := p.Shared.CloseErr.Value()
-        if v == nil {
-                return nil
-        }
-
-        return v.(error)
-}
-
-func (p *shadowResourceProviderShadow) Input(
-        input UIInput, c *ResourceConfig) (*ResourceConfig, error) {
-        // Get the result of the input call
-        raw := p.Shared.Input.Value()
-        if raw == nil {
-                return nil, nil
-        }
-
-        result, ok := raw.(*shadowResourceProviderInput)
-        if !ok {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'input' shadow value: %#v", raw))
-                return nil, nil
-        }
-
-        // Compare the parameters, which should be identical
-        if !c.Equal(result.Config) {
-                p.ErrorLock.Lock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Input had unequal configurations (real, then shadow):\n\n%#v\n\n%#v",
-                        result.Config, c))
-                p.ErrorLock.Unlock()
-        }
-
-        // Return the results
-        return result.Result, result.ResultErr
-}
-
-func (p *shadowResourceProviderShadow) Validate(c *ResourceConfig) ([]string, []error) {
-        // Get the result of the validate call
-        raw := p.Shared.Validate.Value()
-        if raw == nil {
-                return nil, nil
-        }
-
-        result, ok := raw.(*shadowResourceProviderValidate)
-        if !ok {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'validate' shadow value: %#v", raw))
-                return nil, nil
-        }
-
-        // Compare the parameters, which should be identical
-        if !c.Equal(result.Config) {
-                p.ErrorLock.Lock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Validate had unequal configurations (real, then shadow):\n\n%#v\n\n%#v",
-                        result.Config, c))
-                p.ErrorLock.Unlock()
-        }
-
-        // Return the results
-        return result.ResultWarn, result.ResultErr
-}
-
-func (p *shadowResourceProviderShadow) Configure(c *ResourceConfig) error {
-        // Get the result of the call
-        raw := p.Shared.Configure.Value()
-        if raw == nil {
-                return nil
-        }
-
-        result, ok := raw.(*shadowResourceProviderConfigure)
-        if !ok {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'configure' shadow value: %#v", raw))
-                return nil
-        }
-
-        // Compare the parameters, which should be identical
-        if !c.Equal(result.Config) {
-                p.ErrorLock.Lock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Configure had unequal configurations (real, then shadow):\n\n%#v\n\n%#v",
-                        result.Config, c))
-                p.ErrorLock.Unlock()
-        }
-
-        // Return the results
-        return result.Result
-}
-
-// Stop returns immediately.
-func (p *shadowResourceProviderShadow) Stop() error {
-        return nil
-}
-
-func (p *shadowResourceProviderShadow) ValidateResource(t string, c *ResourceConfig) ([]string, []error) {
-        // Unique key
-        key := t
-
-        // Get the initial value
-        raw := p.Shared.ValidateResource.Value(key)
-
-        // Find a validation with our configuration
-        var result *shadowResourceProviderValidateResource
-        for {
-                // Get the value
-                if raw == nil {
-                        p.ErrorLock.Lock()
-                        defer p.ErrorLock.Unlock()
-                        p.Error = multierror.Append(p.Error, fmt.Errorf(
-                                "Unknown 'ValidateResource' call for %q:\n\n%#v",
-                                key, c))
-                        return nil, nil
-                }
-
-                wrapper, ok := raw.(*shadowResourceProviderValidateResourceWrapper)
-                if !ok {
-                        p.ErrorLock.Lock()
-                        defer p.ErrorLock.Unlock()
-                        p.Error = multierror.Append(p.Error, fmt.Errorf(
-                                "Unknown 'ValidateResource' shadow value for %q: %#v", key, raw))
-                        return nil, nil
-                }
-
-                // Look for the matching call with our configuration
-                wrapper.RLock()
-                for _, call := range wrapper.Calls {
-                        if call.Config.Equal(c) {
-                                result = call
-                                break
-                        }
-                }
-                wrapper.RUnlock()
-
-                // If we found a result, exit
-                if result != nil {
-                        break
-                }
-
-                // Wait for a change so we can get the wrapper again
-                raw = p.Shared.ValidateResource.WaitForChange(key)
-        }
-
-        return result.Warns, result.Errors
-}
-
-func (p *shadowResourceProviderShadow) Apply(
-        info *InstanceInfo,
-        state *InstanceState,
-        diff *InstanceDiff) (*InstanceState, error) {
-        // Unique key
-        key := info.uniqueId()
-        raw := p.Shared.Apply.Value(key)
-        if raw == nil {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'apply' call for %q:\n\n%#v\n\n%#v",
-                        key, state, diff))
-                return nil, nil
-        }
-
-        result, ok := raw.(*shadowResourceProviderApply)
-        if !ok {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'apply' shadow value for %q: %#v", key, raw))
-                return nil, nil
-        }
-
-        // Compare the parameters, which should be identical
-        if !state.Equal(result.State) {
-                p.ErrorLock.Lock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Apply %q: state had unequal states (real, then shadow):\n\n%#v\n\n%#v",
-                        key, result.State, state))
-                p.ErrorLock.Unlock()
-        }
-
-        if !diff.Equal(result.Diff) {
-                p.ErrorLock.Lock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Apply %q: unequal diffs (real, then shadow):\n\n%#v\n\n%#v",
-                        key, result.Diff, diff))
-                p.ErrorLock.Unlock()
-        }
-
-        return result.Result, result.ResultErr
-}
-
-func (p *shadowResourceProviderShadow) Diff(
-        info *InstanceInfo,
-        state *InstanceState,
-        desired *ResourceConfig) (*InstanceDiff, error) {
-        // Unique key
-        key := info.uniqueId()
-        raw := p.Shared.Diff.Value(key)
-        if raw == nil {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'diff' call for %q:\n\n%#v\n\n%#v",
-                        key, state, desired))
-                return nil, nil
-        }
-
-        result, ok := raw.(*shadowResourceProviderDiff)
-        if !ok {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'diff' shadow value for %q: %#v", key, raw))
-                return nil, nil
-        }
-
-        // Compare the parameters, which should be identical
-        if !state.Equal(result.State) {
-                p.ErrorLock.Lock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Diff %q had unequal states (real, then shadow):\n\n%#v\n\n%#v",
-                        key, result.State, state))
-                p.ErrorLock.Unlock()
-        }
-        if !desired.Equal(result.Desired) {
-                p.ErrorLock.Lock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Diff %q had unequal states (real, then shadow):\n\n%#v\n\n%#v",
-                        key, result.Desired, desired))
-                p.ErrorLock.Unlock()
-        }
-
-        return result.Result, result.ResultErr
-}
-
-func (p *shadowResourceProviderShadow) Refresh(
-        info *InstanceInfo,
-        state *InstanceState) (*InstanceState, error) {
-        // Unique key
-        key := info.uniqueId()
-        raw := p.Shared.Refresh.Value(key)
-        if raw == nil {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'refresh' call for %q:\n\n%#v",
-                        key, state))
-                return nil, nil
-        }
-
-        result, ok := raw.(*shadowResourceProviderRefresh)
-        if !ok {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'refresh' shadow value: %#v", raw))
-                return nil, nil
-        }
-
-        // Compare the parameters, which should be identical
-        if !state.Equal(result.State) {
-                p.ErrorLock.Lock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Refresh %q had unequal states (real, then shadow):\n\n%#v\n\n%#v",
-                        key, result.State, state))
-                p.ErrorLock.Unlock()
-        }
-
-        return result.Result, result.ResultErr
-}
-
-func (p *shadowResourceProviderShadow) ValidateDataSource(
-        t string, c *ResourceConfig) ([]string, []error) {
-        // Unique key
-        key := t
-
-        // Get the initial value
-        raw := p.Shared.ValidateDataSource.Value(key)
-
-        // Find a validation with our configuration
-        var result *shadowResourceProviderValidateDataSource
-        for {
-                // Get the value
-                if raw == nil {
-                        p.ErrorLock.Lock()
-                        defer p.ErrorLock.Unlock()
-                        p.Error = multierror.Append(p.Error, fmt.Errorf(
-                                "Unknown 'ValidateDataSource' call for %q:\n\n%#v",
-                                key, c))
-                        return nil, nil
-                }
-
-                wrapper, ok := raw.(*shadowResourceProviderValidateDataSourceWrapper)
-                if !ok {
-                        p.ErrorLock.Lock()
-                        defer p.ErrorLock.Unlock()
-                        p.Error = multierror.Append(p.Error, fmt.Errorf(
-                                "Unknown 'ValidateDataSource' shadow value: %#v", raw))
-                        return nil, nil
-                }
-
-                // Look for the matching call with our configuration
-                wrapper.RLock()
-                for _, call := range wrapper.Calls {
-                        if call.Config.Equal(c) {
-                                result = call
-                                break
-                        }
-                }
-                wrapper.RUnlock()
-
-                // If we found a result, exit
-                if result != nil {
-                        break
-                }
-
-                // Wait for a change so we can get the wrapper again
-                raw = p.Shared.ValidateDataSource.WaitForChange(key)
-        }
-
-        return result.Warns, result.Errors
-}
-
-func (p *shadowResourceProviderShadow) ReadDataDiff(
-        info *InstanceInfo,
-        desired *ResourceConfig) (*InstanceDiff, error) {
-        // Unique key
-        key := info.uniqueId()
-        raw := p.Shared.ReadDataDiff.Value(key)
-        if raw == nil {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'ReadDataDiff' call for %q:\n\n%#v",
-                        key, desired))
-                return nil, nil
-        }
-
-        result, ok := raw.(*shadowResourceProviderReadDataDiff)
-        if !ok {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'ReadDataDiff' shadow value for %q: %#v", key, raw))
-                return nil, nil
-        }
-
-        // Compare the parameters, which should be identical
-        if !desired.Equal(result.Desired) {
-                p.ErrorLock.Lock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "ReadDataDiff %q had unequal configs (real, then shadow):\n\n%#v\n\n%#v",
-                        key, result.Desired, desired))
-                p.ErrorLock.Unlock()
-        }
-
-        return result.Result, result.ResultErr
-}
-
-func (p *shadowResourceProviderShadow) ReadDataApply(
-        info *InstanceInfo,
-        d *InstanceDiff) (*InstanceState, error) {
-        // Unique key
-        key := info.uniqueId()
-        raw := p.Shared.ReadDataApply.Value(key)
-        if raw == nil {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'ReadDataApply' call for %q:\n\n%#v",
-                        key, d))
-                return nil, nil
-        }
-
-        result, ok := raw.(*shadowResourceProviderReadDataApply)
-        if !ok {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'ReadDataApply' shadow value for %q: %#v", key, raw))
-                return nil, nil
-        }
-
-        // Compare the parameters, which should be identical
-        if !d.Equal(result.Diff) {
-                p.ErrorLock.Lock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "ReadDataApply: unequal diffs (real, then shadow):\n\n%#v\n\n%#v",
-                        result.Diff, d))
-                p.ErrorLock.Unlock()
-        }
-
-        return result.Result, result.ResultErr
-}
-
-func (p *shadowResourceProviderShadow) ImportState(info *InstanceInfo, id string) ([]*InstanceState, error) {
-        panic("import not supported by shadow graph")
-}
-
-// The structs for the various function calls are put below. These structs
-// are used to carry call information across the real/shadow boundaries.
-
-type shadowResourceProviderInput struct {
-        Config    *ResourceConfig
-        Result    *ResourceConfig
-        ResultErr error
-}
-
-type shadowResourceProviderValidate struct {
-        Config     *ResourceConfig
-        ResultWarn []string
-        ResultErr  []error
-}
-
-type shadowResourceProviderConfigure struct {
-        Config *ResourceConfig
-        Result error
-}
-
-type shadowResourceProviderValidateResourceWrapper struct {
-        sync.RWMutex
-
-        Calls []*shadowResourceProviderValidateResource
-}
-
-type shadowResourceProviderValidateResource struct {
-        Config *ResourceConfig
-        Warns  []string
-        Errors []error
-}
-
-type shadowResourceProviderApply struct {
-        State     *InstanceState
-        Diff      *InstanceDiff
-        Result    *InstanceState
-        ResultErr error
-}
-
-type shadowResourceProviderDiff struct {
-        State     *InstanceState
-        Desired   *ResourceConfig
-        Result    *InstanceDiff
-        ResultErr error
-}
-
-type shadowResourceProviderRefresh struct {
-        State     *InstanceState
-        Result    *InstanceState
-        ResultErr error
-}
-
-type shadowResourceProviderValidateDataSourceWrapper struct {
-        sync.RWMutex
-
-        Calls []*shadowResourceProviderValidateDataSource
-}
-
-type shadowResourceProviderValidateDataSource struct {
-        Config *ResourceConfig
-        Warns  []string
-        Errors []error
-}
-
-type shadowResourceProviderReadDataDiff struct {
-        Desired   *ResourceConfig
-        Result    *InstanceDiff
-        ResultErr error
-}
-
-type shadowResourceProviderReadDataApply struct {
-        Diff      *InstanceDiff
-        Result    *InstanceState
-        ResultErr error
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/shadow_resource_provisioner.go b/vendor/github.com/hashicorp/terraform/terraform/shadow_resource_provisioner.go
deleted file mode 100644
index 60a4908..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/shadow_resource_provisioner.go
+++ /dev/null
@@ -1,282 +0,0 @@
-package terraform
-
-import (
-        "fmt"
-        "io"
-        "log"
-        "sync"
-
-        "github.com/hashicorp/go-multierror"
-        "github.com/hashicorp/terraform/helper/shadow"
-)
-
-// shadowResourceProvisioner implements ResourceProvisioner for the shadow
-// eval context defined in eval_context_shadow.go.
-//
-// This is used to verify behavior with a real provisioner. This shouldn't
-// be used directly.
-type shadowResourceProvisioner interface {
-        ResourceProvisioner
-        Shadow
-}
-
-// newShadowResourceProvisioner creates a new shadowed ResourceProvisioner.
-func newShadowResourceProvisioner(
-        p ResourceProvisioner) (ResourceProvisioner, shadowResourceProvisioner) {
-        // Create the shared data
-        shared := shadowResourceProvisionerShared{
-                Validate: shadow.ComparedValue{
-                        Func: shadowResourceProvisionerValidateCompare,
-                },
-        }
-
-        // Create the real provisioner that does actual work
-        real := &shadowResourceProvisionerReal{
-                ResourceProvisioner: p,
-                Shared:              &shared,
-        }
-
-        // Create the shadow that watches the real value
-        shadow := &shadowResourceProvisionerShadow{
-                Shared: &shared,
-        }
-
-        return real, shadow
-}
-
-// shadowResourceProvisionerReal is the real resource provisioner. Function calls
-// to this will perform real work. This records the parameters and return
-// values and call order for the shadow to reproduce.
-type shadowResourceProvisionerReal struct {
-        ResourceProvisioner
-
-        Shared *shadowResourceProvisionerShared
-}
-
-func (p *shadowResourceProvisionerReal) Close() error {
-        var result error
-        if c, ok := p.ResourceProvisioner.(ResourceProvisionerCloser); ok {
-                result = c.Close()
-        }
-
-        p.Shared.CloseErr.SetValue(result)
-        return result
-}
-
-func (p *shadowResourceProvisionerReal) Validate(c *ResourceConfig) ([]string, []error) {
-        warns, errs := p.ResourceProvisioner.Validate(c)
-        p.Shared.Validate.SetValue(&shadowResourceProvisionerValidate{
-                Config:     c,
-                ResultWarn: warns,
-                ResultErr:  errs,
-        })
-
-        return warns, errs
-}
-
-func (p *shadowResourceProvisionerReal) Apply(
-        output UIOutput, s *InstanceState, c *ResourceConfig) error {
-        err := p.ResourceProvisioner.Apply(output, s, c)
-
-        // Write the result, grab a lock for writing. This should nver
-        // block long since the operations below don't block.
-        p.Shared.ApplyLock.Lock()
-        defer p.Shared.ApplyLock.Unlock()
-
-        key := s.ID
-        raw, ok := p.Shared.Apply.ValueOk(key)
-        if !ok {
-                // Setup a new value
-                raw = &shadow.ComparedValue{
-                        Func: shadowResourceProvisionerApplyCompare,
-                }
-
-                // Set it
-                p.Shared.Apply.SetValue(key, raw)
-        }
-
-        compareVal, ok := raw.(*shadow.ComparedValue)
-        if !ok {
-                // Just log and return so that we don't cause the real side
-                // any side effects.
-                log.Printf("[ERROR] unknown value in 'apply': %#v", raw)
-                return err
-        }
-
-        // Write the resulting value
-        compareVal.SetValue(&shadowResourceProvisionerApply{
-                Config:    c,
-                ResultErr: err,
-        })
-
-        return err
-}
-
-func (p *shadowResourceProvisionerReal) Stop() error {
-        return p.ResourceProvisioner.Stop()
-}
-
-// shadowResourceProvisionerShadow is the shadow resource provisioner. Function
-// calls never affect real resources. This is paired with the "real" side
-// which must be called properly to enable recording.
-type shadowResourceProvisionerShadow struct {
-        Shared *shadowResourceProvisionerShared
-
-        Error     error // Error is the list of errors from the shadow
-        ErrorLock sync.Mutex
-}
-
-type shadowResourceProvisionerShared struct {
-        // NOTE: Anytime a value is added here, be sure to add it to
-        // the Close() method so that it is closed.
-
-        CloseErr  shadow.Value
-        Validate  shadow.ComparedValue
-        Apply     shadow.KeyedValue
-        ApplyLock sync.Mutex // For writing only
-}
-
-func (p *shadowResourceProvisionerShared) Close() error {
-        closers := []io.Closer{
-                &p.CloseErr,
-        }
-
-        for _, c := range closers {
-                // This should never happen, but we don't panic because a panic
-                // could affect the real behavior of Terraform and a shadow should
-                // never be able to do that.
-                if err := c.Close(); err != nil {
-                        return err
-                }
-        }
-
-        return nil
-}
-
-func (p *shadowResourceProvisionerShadow) CloseShadow() error {
-        err := p.Shared.Close()
-        if err != nil {
-                err = fmt.Errorf("close error: %s", err)
-        }
-
-        return err
-}
-
-func (p *shadowResourceProvisionerShadow) ShadowError() error {
-        return p.Error
-}
-
-func (p *shadowResourceProvisionerShadow) Close() error {
-        v := p.Shared.CloseErr.Value()
-        if v == nil {
-                return nil
-        }
-
-        return v.(error)
-}
-
-func (p *shadowResourceProvisionerShadow) Validate(c *ResourceConfig) ([]string, []error) {
-        // Get the result of the validate call
-        raw := p.Shared.Validate.Value(c)
-        if raw == nil {
-                return nil, nil
-        }
-
-        result, ok := raw.(*shadowResourceProvisionerValidate)
-        if !ok {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'validate' shadow value: %#v", raw))
-                return nil, nil
-        }
-
-        // We don't need to compare configurations because we key on the
-        // configuration so just return right away.
-        return result.ResultWarn, result.ResultErr
-}
-
-func (p *shadowResourceProvisionerShadow) Apply(
-        output UIOutput, s *InstanceState, c *ResourceConfig) error {
-        // Get the value based on the key
-        key := s.ID
-        raw := p.Shared.Apply.Value(key)
-        if raw == nil {
-                return nil
-        }
-
-        compareVal, ok := raw.(*shadow.ComparedValue)
-        if !ok {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'apply' shadow value: %#v", raw))
-                return nil
-        }
-
-        // With the compared value, we compare against our config
-        raw = compareVal.Value(c)
-        if raw == nil {
-                return nil
-        }
-
-        result, ok := raw.(*shadowResourceProvisionerApply)
-        if !ok {
-                p.ErrorLock.Lock()
-                defer p.ErrorLock.Unlock()
-                p.Error = multierror.Append(p.Error, fmt.Errorf(
-                        "Unknown 'apply' shadow value: %#v", raw))
-                return nil
-        }
-
-        return result.ResultErr
-}
-
-func (p *shadowResourceProvisionerShadow) Stop() error {
-        // For the shadow, we always just return nil since a Stop indicates
-        // that we were interrupted and shadows are disabled during interrupts
-        // anyways.
-        return nil
-}
-
-// The structs for the various function calls are put below. These structs
-// are used to carry call information across the real/shadow boundaries.
-
-type shadowResourceProvisionerValidate struct {
-        Config     *ResourceConfig
-        ResultWarn []string
-        ResultErr  []error
-}
-
-type shadowResourceProvisionerApply struct {
-        Config    *ResourceConfig
-        ResultErr error
-}
-
-func shadowResourceProvisionerValidateCompare(k, v interface{}) bool {
-        c, ok := k.(*ResourceConfig)
-        if !ok {
-                return false
-        }
-
-        result, ok := v.(*shadowResourceProvisionerValidate)
-        if !ok {
-                return false
-        }
-
-        return c.Equal(result.Config)
-}
-
-func shadowResourceProvisionerApplyCompare(k, v interface{}) bool {
-        c, ok := k.(*ResourceConfig)
-        if !ok {
-                return false
-        }
-
-        result, ok := v.(*shadowResourceProvisionerApply)
-        if !ok {
-                return false
-        }
-
-        return c.Equal(result.Config)
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/state.go b/vendor/github.com/hashicorp/terraform/terraform/state.go
index 0c46194..04b14a6 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/state.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/state.go
@@ -9,6 +9,7 @@ import (
         "io"
         "io/ioutil"
         "log"
+        "os"
         "reflect"
         "sort"
         "strconv"
@@ -16,10 +17,12 @@ import (
         "sync"
 
         "github.com/hashicorp/go-multierror"
+        "github.com/hashicorp/go-uuid"
         "github.com/hashicorp/go-version"
         "github.com/hashicorp/terraform/config"
         "github.com/mitchellh/copystructure"
-        "github.com/satori/go.uuid"
+
+        tfversion "github.com/hashicorp/terraform/version"
 )
 
 const (
@@ -664,7 +667,7 @@ func (s *State) FromFutureTerraform() bool {
         }
 
         v := version.Must(version.NewVersion(s.TFVersion))
-        return SemVersion.LessThan(v)
+        return tfversion.SemVer.LessThan(v)
 }
 
 func (s *State) Init() {
@@ -704,7 +707,11 @@ func (s *State) EnsureHasLineage() {
 
 func (s *State) ensureHasLineage() {
         if s.Lineage == "" {
-                s.Lineage = uuid.NewV4().String()
+                lineage, err := uuid.GenerateUUID()
+                if err != nil {
+                        panic(fmt.Errorf("Failed to generate lineage: %v", err))
+                }
+                s.Lineage = lineage
                 log.Printf("[DEBUG] New state was assigned lineage %q\n", s.Lineage)
         } else {
                 log.Printf("[TRACE] Preserving existing state lineage %q\n", s.Lineage)
@@ -977,6 +984,10 @@ type ModuleState struct {
         // always disjoint, so the path represents amodule tree
         Path []string `json:"path"`
 
+        // Locals are kept only transiently in-memory, because we can always
+        // re-compute them.
+        Locals map[string]interface{} `json:"-"`
+
         // Outputs declared by the module and maintained for each module
         // even though only the root module technically needs to be kept.
         // This allows operators to inspect values at the boundaries.
@@ -1083,7 +1094,7 @@ func (m *ModuleState) Orphans(c *config.Config) []string {
         defer m.Unlock()
 
         keys := make(map[string]struct{})
-        for k, _ := range m.Resources {
+        for k := range m.Resources {
                 keys[k] = struct{}{}
         }
 
@@ -1091,7 +1102,7 @@ func (m *ModuleState) Orphans(c *config.Config) []string {
                 for _, r := range c.Resources {
                         delete(keys, r.Id())
 
-                        for k, _ := range keys {
+                        for k := range keys {
                                 if strings.HasPrefix(k, r.Id()+".") {
                                         delete(keys, k)
                                 }
@@ -1100,7 +1111,32 @@ func (m *ModuleState) Orphans(c *config.Config) []string {
         }
 
         result := make([]string, 0, len(keys))
-        for k, _ := range keys {
+        for k := range keys {
+                result = append(result, k)
+        }
+
+        return result
+}
+
+// RemovedOutputs returns a list of outputs that are in the State but aren't
+// present in the configuration itself.
+func (m *ModuleState) RemovedOutputs(c *config.Config) []string {
+        m.Lock()
+        defer m.Unlock()
+
+        keys := make(map[string]struct{})
+        for k := range m.Outputs {
+                keys[k] = struct{}{}
+        }
+
+        if c != nil {
+                for _, o := range c.Outputs {
+                        delete(keys, o.Name)
+                }
+        }
+
+        result := make([]string, 0, len(keys))
+        for k := range keys {
                 result = append(result, k)
         }
 
@@ -1308,6 +1344,10 @@ func (m *ModuleState) String() string {
         return buf.String()
 }
 
+func (m *ModuleState) Empty() bool {
+        return len(m.Locals) == 0 && len(m.Outputs) == 0 && len(m.Resources) == 0
+}
+
 // ResourceStateKey is a structured representation of the key used for the
 // ModuleState.Resources mapping
 type ResourceStateKey struct {
@@ -1681,7 +1721,20 @@ func (s *InstanceState) Equal(other *InstanceState) bool {
                 // We only do the deep check if both are non-nil. If one is nil
                 // we treat it as equal since their lengths are both zero (check
                 // above).
-                if !reflect.DeepEqual(s.Meta, other.Meta) {
+                //
+                // Since this can contain numeric values that may change types during
+                // serialization, let's compare the serialized values.
+                sMeta, err := json.Marshal(s.Meta)
+                if err != nil {
+                        // marshaling primitives shouldn't ever error out
+                        panic(err)
+                }
+                otherMeta, err := json.Marshal(other.Meta)
+                if err != nil {
+                        panic(err)
+                }
+
+                if !bytes.Equal(sMeta, otherMeta) {
                         return false
                 }
         }
@@ -1824,11 +1877,19 @@ var ErrNoState = errors.New("no state")
 // ReadState reads a state structure out of a reader in the format that
 // was written by WriteState.
 func ReadState(src io.Reader) (*State, error) {
+        // check for a nil file specifically, since that produces a platform
+        // specific error if we try to use it in a bufio.Reader.
+        if f, ok := src.(*os.File); ok && f == nil {
+                return nil, ErrNoState
+        }
+
         buf := bufio.NewReader(src)
+
         if _, err := buf.Peek(1); err != nil {
-                // the error is either io.EOF or "invalid argument", and both are from
-                // an empty state.
-                return nil, ErrNoState
+                if err == io.EOF {
+                        return nil, ErrNoState
+                }
+                return nil, err
         }
 
         if err := testForV0State(buf); err != nil {
@@ -1891,7 +1952,7 @@ func ReadState(src io.Reader) (*State, error) {
                 result = v3State
         default:
                 return nil, fmt.Errorf("Terraform %s does not support state version %d, please update.",
-                        SemVersion.String(), versionIdentifier.Version)
+                        tfversion.SemVer.String(), versionIdentifier.Version)
         }
 
         // If we reached this place we must have a result set
@@ -1935,7 +1996,7 @@ func ReadStateV2(jsonBytes []byte) (*State, error) {
         // version that we don't understand
         if state.Version > StateVersion {
                 return nil, fmt.Errorf("Terraform %s does not support state version %d, please update.",
-                        SemVersion.String(), state.Version)
+                        tfversion.SemVer.String(), state.Version)
         }
 
         // Make sure the version is semantic
@@ -1970,7 +2031,7 @@ func ReadStateV3(jsonBytes []byte) (*State, error) {
         // version that we don't understand
         if state.Version > StateVersion {
                 return nil, fmt.Errorf("Terraform %s does not support state version %d, please update.",
-                        SemVersion.String(), state.Version)
+                        tfversion.SemVer.String(), state.Version)
         }
 
         // Make sure the version is semantic
@@ -2126,6 +2187,19 @@ func (s moduleStateSort) Swap(i, j int) {
         s[i], s[j] = s[j], s[i]
 }
 
+// StateCompatible returns an error if the state is not compatible with the
+// current version of terraform.
+func CheckStateVersion(state *State) error {
+        if state == nil {
+                return nil
+        }
+
+        if state.FromFutureTerraform() {
+                return fmt.Errorf(stateInvalidTerraformVersionErr, state.TFVersion)
+        }
+        return nil
+}
+
 const stateValidateErrMultiModule = `
 Multiple modules with the same path: %s
 
@@ -2134,3 +2208,11 @@ in your state file that point to the same module. This will cause Terraform
 to behave in unexpected and error prone ways and is invalid. Please back up
 and modify your state file manually to resolve this.
 `
+
+const stateInvalidTerraformVersionErr = `
+Terraform doesn't allow running any operations against a state
+that was written by a future Terraform version. The state is
+reporting it is written by Terraform '%s'
+
+Please run at least that version of Terraform to continue.
+`
diff --git a/vendor/github.com/hashicorp/terraform/terraform/test_failure b/vendor/github.com/hashicorp/terraform/terraform/test_failure
deleted file mode 100644
index 5d3ad1a..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/test_failure
+++ /dev/null
@@ -1,9 +0,0 @@
---- FAIL: TestContext2Plan_moduleProviderInherit (0.01s)
-        context_plan_test.go:552: bad: []string{"child"}
-map[string]dag.Vertex{}
-"module.middle.null"
-map[string]dag.Vertex{}
-"module.middle.module.inner.null"
-map[string]dag.Vertex{}
-"aws"
-FAIL
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform.go b/vendor/github.com/hashicorp/terraform/terraform/transform.go
index f4a431a..0e47f20 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform.go
@@ -1,6 +1,8 @@
 package terraform
 
 import (
+        "log"
+
         "github.com/hashicorp/terraform/dag"
 )
 
@@ -40,6 +42,9 @@ func (t *graphTransformerMulti) Transform(g *Graph) error {
                 if err := t.Transform(g); err != nil {
                         return err
                 }
+                log.Printf(
+                        "[TRACE] Graph after step %T:\n\n%s",
+                        t, g.StringWithNodeTypes())
         }
 
         return nil
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_provider.go b/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_provider.go
index 10506ea..39cf097 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_provider.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_attach_config_provider.go
@@ -1,10 +1,7 @@
 package terraform
 
 import (
-        "log"
-
         "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/module"
 )
 
 // GraphNodeAttachProvider is an interface that must be implemented by nodes
@@ -19,62 +16,3 @@ type GraphNodeAttachProvider interface {
         // Sets the configuration
         AttachProvider(*config.ProviderConfig)
 }
-
-// AttachProviderConfigTransformer goes through the graph and attaches
-// provider configuration structures to nodes that implement the interfaces
-// above.
-//
-// The attached configuration structures are directly from the configuration.
-// If they're going to be modified, a copy should be made.
-type AttachProviderConfigTransformer struct {
-        Module *module.Tree // Module is the root module for the config
-}
-
-func (t *AttachProviderConfigTransformer) Transform(g *Graph) error {
-        if err := t.attachProviders(g); err != nil {
-                return err
-        }
-
-        return nil
-}
-
-func (t *AttachProviderConfigTransformer) attachProviders(g *Graph) error {
-        // Go through and find GraphNodeAttachProvider
-        for _, v := range g.Vertices() {
-                // Only care about GraphNodeAttachProvider implementations
-                apn, ok := v.(GraphNodeAttachProvider)
-                if !ok {
-                        continue
-                }
-
-                // Determine what we're looking for
-                path := normalizeModulePath(apn.Path())
-                path = path[1:]
-                name := apn.ProviderName()
-                log.Printf("[TRACE] Attach provider request: %#v %s", path, name)
-
-                // Get the configuration.
-                tree := t.Module.Child(path)
-                if tree == nil {
-                        continue
-                }
-
-                // Go through the provider configs to find the matching config
-                for _, p := range tree.Config().ProviderConfigs {
-                        // Build the name, which is "name.alias" if an alias exists
-                        current := p.Name
-                        if p.Alias != "" {
-                                current += "." + p.Alias
-                        }
-
-                        // If the configs match then attach!
-                        if current == name {
-                                log.Printf("[TRACE] Attaching provider config: %#v", p)
-                                apn.AttachProvider(p)
-                                break
-                        }
-                }
-        }
-
-        return nil
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_deposed.go b/vendor/github.com/hashicorp/terraform/terraform/transform_deposed.go
index 2148cef..87a1f9c 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_deposed.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_deposed.go
@@ -12,6 +12,9 @@ type DeposedTransformer struct {
         // View, if non-empty, is the ModuleState.View used around the state
         // to find deposed resources.
         View string
+
+        // The provider used by the resourced which were deposed
+        ResolvedProvider string
 }
 
 func (t *DeposedTransformer) Transform(g *Graph) error {
@@ -33,14 +36,16 @@ func (t *DeposedTransformer) Transform(g *Graph) error {
                 if len(rs.Deposed) == 0 {
                         continue
                 }
+
                 deposed := rs.Deposed
 
                 for i, _ := range deposed {
                         g.Add(&graphNodeDeposedResource{
-                                Index:        i,
-                                ResourceName: k,
-                                ResourceType: rs.Type,
-                                Provider:     rs.Provider,
+                                Index:            i,
+                                ResourceName:     k,
+                                ResourceType:     rs.Type,
+                                ProviderName:     rs.Provider,
+                                ResolvedProvider: t.ResolvedProvider,
                         })
                 }
         }
@@ -50,18 +55,23 @@ func (t *DeposedTransformer) Transform(g *Graph) error {
 
 // graphNodeDeposedResource is the graph vertex representing a deposed resource.
 type graphNodeDeposedResource struct {
-        Index        int
-        ResourceName string
-        ResourceType string
-        Provider     string
+        Index            int
+        ResourceName     string
+        ResourceType     string
+        ProviderName     string
+        ResolvedProvider string
 }
 
 func (n *graphNodeDeposedResource) Name() string {
         return fmt.Sprintf("%s (deposed #%d)", n.ResourceName, n.Index)
 }
 
-func (n *graphNodeDeposedResource) ProvidedBy() []string {
-        return []string{resourceProvider(n.ResourceName, n.Provider)}
+func (n *graphNodeDeposedResource) ProvidedBy() string {
+        return resourceProvider(n.ResourceName, n.ProviderName)
+}
+
+func (n *graphNodeDeposedResource) SetProvider(p string) {
+        n.ResolvedProvider = p
 }
 
 // GraphNodeEvalable impl.
@@ -81,7 +91,7 @@ func (n *graphNodeDeposedResource) EvalTree() EvalNode {
                 Node: &EvalSequence{
                         Nodes: []EvalNode{
                                 &EvalGetProvider{
-                                        Name:   n.ProvidedBy()[0],
+                                        Name:   n.ResolvedProvider,
                                         Output: &provider,
                                 },
                                 &EvalReadStateDeposed{
@@ -98,7 +108,7 @@ func (n *graphNodeDeposedResource) EvalTree() EvalNode {
                                 &EvalWriteStateDeposed{
                                         Name:         n.ResourceName,
                                         ResourceType: n.ResourceType,
-                                        Provider:     n.Provider,
+                                        Provider:     n.ResolvedProvider,
                                         State:        &state,
                                         Index:        n.Index,
                                 },
@@ -114,7 +124,7 @@ func (n *graphNodeDeposedResource) EvalTree() EvalNode {
                 Node: &EvalSequence{
                         Nodes: []EvalNode{
                                 &EvalGetProvider{
-                                        Name:   n.ProvidedBy()[0],
+                                        Name:   n.ResolvedProvider,
                                         Output: &provider,
                                 },
                                 &EvalReadStateDeposed{
@@ -147,7 +157,7 @@ func (n *graphNodeDeposedResource) EvalTree() EvalNode {
                                 &EvalWriteStateDeposed{
                                         Name:         n.ResourceName,
                                         ResourceType: n.ResourceType,
-                                        Provider:     n.Provider,
+                                        Provider:     n.ResolvedProvider,
                                         State:        &state,
                                         Index:        n.Index,
                                 },
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_edge.go b/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_edge.go
index 22be1ab..a06ff29 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_edge.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_destroy_edge.go
@@ -119,17 +119,15 @@ func (t *DestroyEdgeTransformer) Transform(g *Graph) error {
                 return &NodeApplyableProvider{NodeAbstractProvider: a}
         }
         steps := []GraphTransformer{
+                // Add the local values
+                &LocalTransformer{Module: t.Module},
+
                 // Add outputs and metadata
                 &OutputTransformer{Module: t.Module},
                 &AttachResourceConfigTransformer{Module: t.Module},
                 &AttachStateTransformer{State: t.State},
 
-                // Add providers since they can affect destroy order as well
-                &MissingProviderTransformer{AllowAny: true, Concrete: providerFn},
-                &ProviderTransformer{},
-                &DisableProviderTransformer{},
-                &ParentProviderTransformer{},
-                &AttachProviderConfigTransformer{Module: t.Module},
+                TransformProviders(nil, providerFn, t.Module),
 
                 // Add all the variables. We can depend on resources through
                 // variables due to module parameters, and we need to properly
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_import_state.go b/vendor/github.com/hashicorp/terraform/terraform/transform_import_state.go
index 081df2f..fcbff65 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_import_state.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_import_state.go
@@ -21,9 +21,9 @@ func (t *ImportStateTransformer) Transform(g *Graph) error {
                 }
 
                 nodes = append(nodes, &graphNodeImportState{
-                        Addr:     addr,
-                        ID:       target.ID,
-                        Provider: target.Provider,
+                        Addr:         addr,
+                        ID:           target.ID,
+                        ProviderName: target.Provider,
                 })
         }
 
@@ -36,9 +36,10 @@ func (t *ImportStateTransformer) Transform(g *Graph) error {
 }
 
 type graphNodeImportState struct {
-        Addr     *ResourceAddress // Addr is the resource address to import to
-        ID       string           // ID is the ID to import as
-        Provider string           // Provider string
+        Addr             *ResourceAddress // Addr is the resource address to import to
+        ID               string           // ID is the ID to import as
+        ProviderName     string           // Provider string
+        ResolvedProvider string           // provider node address
 
         states []*InstanceState
 }
@@ -47,8 +48,12 @@ func (n *graphNodeImportState) Name() string {
         return fmt.Sprintf("%s (import id: %s)", n.Addr, n.ID)
 }
 
-func (n *graphNodeImportState) ProvidedBy() []string {
-        return []string{resourceProvider(n.Addr.Type, n.Provider)}
+func (n *graphNodeImportState) ProvidedBy() string {
+        return resourceProvider(n.Addr.Type, n.ProviderName)
+}
+
+func (n *graphNodeImportState) SetProvider(p string) {
+        n.ResolvedProvider = p
 }
 
 // GraphNodeSubPath
@@ -72,7 +77,7 @@ func (n *graphNodeImportState) EvalTree() EvalNode {
         return &EvalSequence{
                 Nodes: []EvalNode{
                         &EvalGetProvider{
-                                Name:   n.ProvidedBy()[0],
+                                Name:   n.ResolvedProvider,
                                 Output: &provider,
                         },
                         &EvalImportState{
@@ -149,10 +154,11 @@ func (n *graphNodeImportState) DynamicExpand(ctx EvalContext) (*Graph, error) {
         // is safe.
         for i, state := range n.states {
                 g.Add(&graphNodeImportStateSub{
-                        Target:   addrs[i],
-                        Path_:    n.Path(),
-                        State:    state,
-                        Provider: n.Provider,
+                        Target:           addrs[i],
+                        Path_:            n.Path(),
+                        State:            state,
+                        ProviderName:     n.ProviderName,
+                        ResolvedProvider: n.ResolvedProvider,
                 })
         }
 
@@ -170,10 +176,11 @@ func (n *graphNodeImportState) DynamicExpand(ctx EvalContext) (*Graph, error) {
 // and is part of the subgraph. This node is responsible for refreshing
 // and adding a resource to the state once it is imported.
 type graphNodeImportStateSub struct {
-        Target   *ResourceAddress
-        State    *InstanceState
-        Path_    []string
-        Provider string
+        Target           *ResourceAddress
+        State            *InstanceState
+        Path_            []string
+        ProviderName     string
+        ResolvedProvider string
 }
 
 func (n *graphNodeImportStateSub) Name() string {
@@ -216,7 +223,7 @@ func (n *graphNodeImportStateSub) EvalTree() EvalNode {
         return &EvalSequence{
                 Nodes: []EvalNode{
                         &EvalGetProvider{
-                                Name:   resourceProvider(info.Type, n.Provider),
+                                Name:   n.ResolvedProvider,
                                 Output: &provider,
                         },
                         &EvalRefresh{
@@ -233,7 +240,7 @@ func (n *graphNodeImportStateSub) EvalTree() EvalNode {
                         &EvalWriteState{
                                 Name:         key.String(),
                                 ResourceType: info.Type,
-                                Provider:     resourceProvider(info.Type, n.Provider),
+                                Provider:     n.ResolvedProvider,
                                 State:        &state,
                         },
                 },
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_local.go b/vendor/github.com/hashicorp/terraform/terraform/transform_local.go
new file mode 100644
index 0000000..95ecfc0
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_local.go
@@ -0,0 +1,40 @@
+package terraform
+
+import (
+        "github.com/hashicorp/terraform/config/module"
+)
+
+// LocalTransformer is a GraphTransformer that adds all the local values
+// from the configuration to the graph.
+type LocalTransformer struct {
+        Module *module.Tree
+}
+
+func (t *LocalTransformer) Transform(g *Graph) error {
+        return t.transformModule(g, t.Module)
+}
+
+func (t *LocalTransformer) transformModule(g *Graph, m *module.Tree) error {
+        if m == nil {
+                // Can't have any locals if there's no config
+                return nil
+        }
+
+        for _, local := range m.Config().Locals {
+                node := &NodeLocal{
+                        PathValue: normalizeModulePath(m.Path()),
+                        Config:    local,
+                }
+
+                g.Add(node)
+        }
+
+        // Also populate locals for child modules
+        for _, c := range m.Children() {
+                if err := t.transformModule(g, c); err != nil {
+                        return err
+                }
+        }
+
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_output.go b/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_output.go
index 49568d5..aea2bd0 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_output.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_orphan_output.go
@@ -21,43 +21,32 @@ func (t *OrphanOutputTransformer) Transform(g *Graph) error {
                 return nil
         }
 
-        return t.transform(g, t.Module)
-}
-
-func (t *OrphanOutputTransformer) transform(g *Graph, m *module.Tree) error {
-        // Get our configuration, and recurse into children
-        var c *config.Config
-        if m != nil {
-                c = m.Config()
-                for _, child := range m.Children() {
-                        if err := t.transform(g, child); err != nil {
-                                return err
-                        }
+        for _, ms := range t.State.Modules {
+                if err := t.transform(g, ms); err != nil {
+                        return err
                 }
         }
+        return nil
+}
 
-        // Get the state. If there is no state, then we have no orphans!
-        path := normalizeModulePath(m.Path())
-        state := t.State.ModuleByPath(path)
-        if state == nil {
+func (t *OrphanOutputTransformer) transform(g *Graph, ms *ModuleState) error {
+        if ms == nil {
                 return nil
         }
 
-        // Make a map of the valid outputs
-        valid := make(map[string]struct{})
-        for _, o := range c.Outputs {
-                valid[o.Name] = struct{}{}
-        }
+        path := normalizeModulePath(ms.Path)
 
-        // Go through the outputs and find the ones that aren't in our config.
-        for n, _ := range state.Outputs {
-                // If it is in the valid map, then ignore
-                if _, ok := valid[n]; ok {
-                        continue
-                }
+        // Get the config for this path, which is nil if the entire module has been
+        // removed.
+        var c *config.Config
+        if m := t.Module.Child(path[1:]); m != nil {
+                c = m.Config()
+        }
 
-                // Orphan!
+        // add all the orphaned outputs to the graph
+        for _, n := range ms.RemovedOutputs(c) {
                 g.Add(&NodeOutputOrphan{OutputName: n, PathValue: path})
+
         }
 
         return nil
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_output.go b/vendor/github.com/hashicorp/terraform/terraform/transform_output.go
index b260f4c..faa25e4 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_output.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_output.go
@@ -1,7 +1,10 @@
 package terraform
 
 import (
+        "log"
+
         "github.com/hashicorp/terraform/config/module"
+        "github.com/hashicorp/terraform/dag"
 )
 
 // OutputTransformer is a GraphTransformer that adds all the outputs
@@ -41,11 +44,6 @@ func (t *OutputTransformer) transform(g *Graph, m *module.Tree) error {
 
         // Add all outputs here
         for _, o := range os {
-                // Build the node.
-                //
-                // NOTE: For now this is just an "applyable" output. As we build
-                // new graph builders for the other operations I suspect we'll
-                // find a way to parameterize this, require new transforms, etc.
                 node := &NodeApplyableOutput{
                         PathValue: normalizeModulePath(m.Path()),
                         Config:    o,
@@ -57,3 +55,41 @@ func (t *OutputTransformer) transform(g *Graph, m *module.Tree) error {
 
         return nil
 }
+
+// DestroyOutputTransformer is a GraphTransformer that adds nodes to delete
+// outputs during destroy. We need to do this to ensure that no stale outputs
+// are ever left in the state.
+type DestroyOutputTransformer struct {
+}
+
+func (t *DestroyOutputTransformer) Transform(g *Graph) error {
+        for _, v := range g.Vertices() {
+                output, ok := v.(*NodeApplyableOutput)
+                if !ok {
+                        continue
+                }
+
+                // create the destroy node for this output
+                node := &NodeDestroyableOutput{
+                        PathValue: output.PathValue,
+                        Config:    output.Config,
+                }
+
+                log.Printf("[TRACE] creating %s", node.Name())
+                g.Add(node)
+
+                deps, err := g.Descendents(v)
+                if err != nil {
+                        return err
+                }
+
+                // the destroy node must depend on the eval node
+                deps.Add(v)
+
+                for _, d := range deps.List() {
+                        log.Printf("[TRACE] %s depends on %s", node.Name(), dag.VertexName(d))
+                        g.Connect(dag.BasicEdge(node, d))
+                }
+        }
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_provider.go b/vendor/github.com/hashicorp/terraform/terraform/transform_provider.go
index b9695d5..c4772b4 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_provider.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_provider.go
@@ -1,19 +1,46 @@
 package terraform
 
 import (
+        "errors"
         "fmt"
         "log"
         "strings"
 
         "github.com/hashicorp/go-multierror"
+        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/config/module"
         "github.com/hashicorp/terraform/dag"
 )
 
+func TransformProviders(providers []string, concrete ConcreteProviderNodeFunc, mod *module.Tree) GraphTransformer {
+        return GraphTransformMulti(
+                // Add providers from the config
+                &ProviderConfigTransformer{
+                        Module:    mod,
+                        Providers: providers,
+                        Concrete:  concrete,
+                },
+                // Add any remaining missing providers
+                &MissingProviderTransformer{
+                        Providers: providers,
+                        Concrete:  concrete,
+                },
+                // Connect the providers
+                &ProviderTransformer{},
+                // Remove unused providers and proxies
+                &PruneProviderTransformer{},
+                // Connect provider to their parent provider nodes
+                &ParentProviderTransformer{},
+        )
+}
+
 // GraphNodeProvider is an interface that nodes that can be a provider
-// must implement. The ProviderName returned is the name of the provider
-// they satisfy.
+// must implement.
+// ProviderName returns the name of the provider this satisfies.
+// Name returns the full name of the provider in the config.
 type GraphNodeProvider interface {
         ProviderName() string
+        Name() string
 }
 
 // GraphNodeCloseProvider is an interface that nodes that can be a close
@@ -25,9 +52,12 @@ type GraphNodeCloseProvider interface {
 
 // GraphNodeProviderConsumer is an interface that nodes that require
 // a provider must implement. ProvidedBy must return the name of the provider
-// to use.
+// to use. This may be a provider by type, type.alias or a fully resolved
+// provider name
 type GraphNodeProviderConsumer interface {
-        ProvidedBy() []string
+        ProvidedBy() string
+        // Set the resolved provider address for this resource.
+        SetProvider(string)
 }
 
 // ProviderTransformer is a GraphTransformer that maps resources to
@@ -41,18 +71,52 @@ func (t *ProviderTransformer) Transform(g *Graph) error {
         m := providerVertexMap(g)
         for _, v := range g.Vertices() {
                 if pv, ok := v.(GraphNodeProviderConsumer); ok {
-                        for _, p := range pv.ProvidedBy() {
-                                target := m[providerMapKey(p, pv)]
-                                if target == nil {
-                                        println(fmt.Sprintf("%#v\n\n%#v", m, providerMapKey(p, pv)))
-                                        err = multierror.Append(err, fmt.Errorf(
-                                                "%s: provider %s couldn't be found",
-                                                dag.VertexName(v), p))
-                                        continue
+                        p := pv.ProvidedBy()
+
+                        key := providerMapKey(p, pv)
+                        target := m[key]
+
+                        sp, ok := pv.(GraphNodeSubPath)
+                        if !ok && target == nil {
+                                // no target, and no path to walk up
+                                err = multierror.Append(err, fmt.Errorf(
+                                        "%s: provider %s couldn't be found",
+                                        dag.VertexName(v), p))
+                                break
+                        }
+
+                        // if we don't have a provider at this level, walk up the path looking for one
+                        for i := 1; target == nil; i++ {
+                                path := normalizeModulePath(sp.Path())
+                                if len(path) < i {
+                                        break
+                                }
+
+                                key = ResolveProviderName(p, path[:len(path)-i])
+                                target = m[key]
+                                if target != nil {
+                                        break
                                 }
+                        }
+
+                        if target == nil {
+                                err = multierror.Append(err, fmt.Errorf(
+                                        "%s: configuration for %s is not present; a provider configuration block is required for all operations",
+                                        dag.VertexName(v), p,
+                                ))
+                                break
+                        }
 
-                                g.Connect(dag.BasicEdge(v, target))
+                        // see if this in  an inherited provider
+                        if p, ok := target.(*graphNodeProxyProvider); ok {
+                                g.Remove(p)
+                                target = p.Target()
+                                key = target.(GraphNodeProvider).Name()
                         }
+
+                        log.Printf("[DEBUG] resource %s using provider %s", dag.VertexName(pv), key)
+                        pv.SetProvider(key)
+                        g.Connect(dag.BasicEdge(v, target))
                 }
         }
 
@@ -67,36 +131,32 @@ type CloseProviderTransformer struct{}
 
 func (t *CloseProviderTransformer) Transform(g *Graph) error {
         pm := providerVertexMap(g)
-        cpm := closeProviderVertexMap(g)
+        cpm := make(map[string]*graphNodeCloseProvider)
         var err error
-        for _, v := range g.Vertices() {
-                if pv, ok := v.(GraphNodeProviderConsumer); ok {
-                        for _, p := range pv.ProvidedBy() {
-                                key := p
-                                source := cpm[key]
-
-                                if source == nil {
-                                        // Create a new graphNodeCloseProvider and add it to the graph
-                                        source = &graphNodeCloseProvider{ProviderNameValue: p}
-                                        g.Add(source)
-
-                                        // Close node needs to depend on provider
-                                        provider, ok := pm[key]
-                                        if !ok {
-                                                err = multierror.Append(err, fmt.Errorf(
-                                                        "%s: provider %s couldn't be found for closing",
-                                                        dag.VertexName(v), p))
-                                                continue
-                                        }
-                                        g.Connect(dag.BasicEdge(source, provider))
-
-                                        // Make sure we also add the new graphNodeCloseProvider to the map
-                                        // so we don't create and add any duplicate graphNodeCloseProviders.
-                                        cpm[key] = source
-                                }
 
-                                // Close node depends on all nodes provided by the provider
-                                g.Connect(dag.BasicEdge(source, v))
+        for _, v := range pm {
+                p := v.(GraphNodeProvider)
+
+                // get the close provider of this type if we alread created it
+                closer := cpm[p.Name()]
+
+                if closer == nil {
+                        // create a closer for this provider type
+                        closer = &graphNodeCloseProvider{ProviderNameValue: p.Name()}
+                        g.Add(closer)
+                        cpm[p.Name()] = closer
+                }
+
+                // Close node depends on the provider itself
+                // this is added unconditionally, so it will connect to all instances
+                // of the provider. Extra edges will be removed by transitive
+                // reduction.
+                g.Connect(dag.BasicEdge(closer, p))
+
+                // connect all the provider's resources to the close node
+                for _, s := range g.UpEdges(p).List() {
+                        if _, ok := s.(GraphNodeProviderConsumer); ok {
+                                g.Connect(dag.BasicEdge(closer, s))
                         }
                 }
         }
@@ -104,18 +164,14 @@ func (t *CloseProviderTransformer) Transform(g *Graph) error {
         return err
 }
 
-// MissingProviderTransformer is a GraphTransformer that adds nodes
-// for missing providers into the graph. Specifically, it creates provider
-// configuration nodes for all the providers that we support. These are
-// pruned later during an optimization pass.
+// MissingProviderTransformer is a GraphTransformer that adds nodes for all
+// required providers into the graph. Specifically, it creates provider
+// configuration nodes for all the providers that we support. These are pruned
+// later during an optimization pass.
 type MissingProviderTransformer struct {
         // Providers is the list of providers we support.
         Providers []string
 
-        // AllowAny will not check that a provider is supported before adding
-        // it to the graph.
-        AllowAny bool
-
         // Concrete, if set, overrides how the providers are made.
         Concrete ConcreteProviderNodeFunc
 }
@@ -128,99 +184,57 @@ func (t *MissingProviderTransformer) Transform(g *Graph) error {
                 }
         }
 
-        // Create a set of our supported providers
-        supported := make(map[string]struct{}, len(t.Providers))
-        for _, v := range t.Providers {
-                supported[v] = struct{}{}
-        }
-
-        // Get the map of providers we already have in our graph
+        var err error
         m := providerVertexMap(g)
-
-        // Go through all the provider consumers and make sure we add
-        // that provider if it is missing. We use a for loop here instead
-        // of "range" since we'll modify check as we go to add more to check.
-        check := g.Vertices()
-        for i := 0; i < len(check); i++ {
-                v := check[i]
-
+        for _, v := range g.Vertices() {
                 pv, ok := v.(GraphNodeProviderConsumer)
                 if !ok {
                         continue
                 }
 
-                // If this node has a subpath, then we use that as a prefix
-                // into our map to check for an existing provider.
-                var path []string
-                if sp, ok := pv.(GraphNodeSubPath); ok {
-                        raw := normalizeModulePath(sp.Path())
-                        if len(raw) > len(rootModulePath) {
-                                path = raw
-                        }
-                }
+                p := pv.ProvidedBy()
+                // this may be the resolved provider from the state, so we need to get
+                // the base provider name.
+                parts := strings.SplitAfter(p, "provider.")
+                p = parts[len(parts)-1]
 
-                for _, p := range pv.ProvidedBy() {
-                        key := providerMapKey(p, pv)
-                        if _, ok := m[key]; ok {
-                                // This provider already exists as a configure node
-                                continue
-                        }
+                key := ResolveProviderName(p, nil)
+                provider := m[key]
 
-                        // If the provider has an alias in it, we just want the type
-                        ptype := p
-                        if idx := strings.IndexRune(p, '.'); idx != -1 {
-                                ptype = p[:idx]
-                        }
+                // we already have it
+                if provider != nil {
+                        continue
+                }
 
-                        if !t.AllowAny {
-                                if _, ok := supported[ptype]; !ok {
-                                        // If we don't support the provider type, skip it.
-                                        // Validation later will catch this as an error.
-                                        continue
-                                }
-                        }
+                // we don't implicitly create aliased providers
+                if strings.Contains(p, ".") {
+                        log.Println("[DEBUG] not adding missing provider alias:", p)
+                        continue
+                }
 
-                        // Add the missing provider node to the graph
-                        v := t.Concrete(&NodeAbstractProvider{
-                                NameValue: p,
-                                PathValue: path,
-                        }).(dag.Vertex)
-                        if len(path) > 0 {
-                                // We'll need the parent provider as well, so let's
-                                // add a dummy node to check to make sure that we add
-                                // that parent provider.
-                                check = append(check, &graphNodeProviderConsumerDummy{
-                                        ProviderValue: p,
-                                        PathValue:     path[:len(path)-1],
-                                })
-                        }
+                log.Println("[DEBUG] adding missing provider:", p)
 
-                        m[key] = g.Add(v)
-                }
+                // create the misisng top-level provider
+                provider = t.Concrete(&NodeAbstractProvider{
+                        NameValue: p,
+                }).(dag.Vertex)
+
+                m[key] = g.Add(provider)
         }
 
-        return nil
+        return err
 }
 
 // ParentProviderTransformer connects provider nodes to their parents.
 //
 // This works by finding nodes that are both GraphNodeProviders and
 // GraphNodeSubPath. It then connects the providers to their parent
-// path.
+// path. The parent provider is always at the root level.
 type ParentProviderTransformer struct{}
 
 func (t *ParentProviderTransformer) Transform(g *Graph) error {
-        // Make a mapping of path to dag.Vertex, where path is: "path.name"
-        m := make(map[string]dag.Vertex)
-
-        // Also create a map that maps a provider to its parent
-        parentMap := make(map[dag.Vertex]string)
-        for _, raw := range g.Vertices() {
-                // If it is the flat version, then make it the non-flat version.
-                // We eventually want to get rid of the flat version entirely so
-                // this is a stop-gap while it still exists.
-                var v dag.Vertex = raw
-
+        pm := providerVertexMap(g)
+        for _, v := range g.Vertices() {
                 // Only care about providers
                 pn, ok := v.(GraphNodeProvider)
                 if !ok || pn.ProviderName() == "" {
@@ -228,53 +242,48 @@ func (t *ParentProviderTransformer) Transform(g *Graph) error {
                 }
 
                 // Also require a subpath, if there is no subpath then we
-                // just totally ignore it. The expectation of this transform is
-                // that it is used with a graph builder that is already flattened.
-                var path []string
-                if pn, ok := raw.(GraphNodeSubPath); ok {
-                        path = pn.Path()
-                }
-                path = normalizeModulePath(path)
-
-                // Build the key with path.name i.e. "child.subchild.aws"
-                key := fmt.Sprintf("%s.%s", strings.Join(path, "."), pn.ProviderName())
-                m[key] = raw
-
-                // Determine the parent if we're non-root. This is length 1 since
-                // the 0 index should be "root" since we normalize above.
-                if len(path) > 1 {
-                        path = path[:len(path)-1]
-                        key := fmt.Sprintf("%s.%s", strings.Join(path, "."), pn.ProviderName())
-                        parentMap[raw] = key
+                // can't have a parent.
+                if pn, ok := v.(GraphNodeSubPath); ok {
+                        if len(normalizeModulePath(pn.Path())) <= 1 {
+                                continue
+                        }
                 }
-        }
 
-        // Connect!
-        for v, key := range parentMap {
-                if parent, ok := m[key]; ok {
+                // this provider may be disabled, but we can only get it's name from
+                // the ProviderName string
+                name := ResolveProviderName(strings.SplitN(pn.ProviderName(), " ", 2)[0], nil)
+                parent := pm[name]
+                if parent != nil {
                         g.Connect(dag.BasicEdge(v, parent))
                 }
-        }
 
+        }
         return nil
 }
 
-// PruneProviderTransformer is a GraphTransformer that prunes all the
-// providers that aren't needed from the graph. A provider is unneeded if
-// no resource or module is using that provider.
+// PruneProviderTransformer removes any providers that are not actually used by
+// anything, and provider proxies. This avoids the provider being initialized
+// and configured.  This both saves resources but also avoids errors since
+// configuration may imply initialization which may require auth.
 type PruneProviderTransformer struct{}
 
 func (t *PruneProviderTransformer) Transform(g *Graph) error {
         for _, v := range g.Vertices() {
-                // We only care about the providers
-                if pn, ok := v.(GraphNodeProvider); !ok || pn.ProviderName() == "" {
+                // We only care about providers
+                pn, ok := v.(GraphNodeProvider)
+                if !ok || pn.ProviderName() == "" {
                         continue
                 }
-                // Does anything depend on this? If not, then prune it.
-                if s := g.UpEdges(v); s.Len() == 0 {
-                        if nv, ok := v.(dag.NamedVertex); ok {
-                                log.Printf("[DEBUG] Pruning provider with no dependencies: %s", nv.Name())
-                        }
+
+                // ProxyProviders will have up edges, but we're now done with them in the graph
+                if _, ok := v.(*graphNodeProxyProvider); ok {
+                        log.Printf("[DEBUG] pruning proxy provider %s", dag.VertexName(v))
+                        g.Remove(v)
+                }
+
+                // Remove providers with no dependencies.
+                if g.UpEdges(v).Len() == 0 {
+                        log.Printf("[DEBUG] pruning unused provider %s", dag.VertexName(v))
                         g.Remove(v)
                 }
         }
@@ -285,23 +294,26 @@ func (t *PruneProviderTransformer) Transform(g *Graph) error {
 // providerMapKey is a helper that gives us the key to use for the
 // maps returned by things such as providerVertexMap.
 func providerMapKey(k string, v dag.Vertex) string {
-        pathPrefix := ""
-        if sp, ok := v.(GraphNodeSubPath); ok {
-                raw := normalizeModulePath(sp.Path())
-                if len(raw) > len(rootModulePath) {
-                        pathPrefix = modulePrefixStr(raw) + "."
-                }
+        if strings.Contains(k, "provider.") {
+                // this is already resolved
+                return k
         }
 
-        return pathPrefix + k
+        // we create a dummy provider to
+        var path []string
+        if sp, ok := v.(GraphNodeSubPath); ok {
+                path = normalizeModulePath(sp.Path())
+        }
+        return ResolveProviderName(k, path)
 }
 
 func providerVertexMap(g *Graph) map[string]dag.Vertex {
         m := make(map[string]dag.Vertex)
         for _, v := range g.Vertices() {
                 if pv, ok := v.(GraphNodeProvider); ok {
-                        key := providerMapKey(pv.ProviderName(), v)
-                        m[key] = v
+                        // TODO:  The Name may have meta info, like " (disabled)"
+                        name := strings.SplitN(pv.Name(), " ", 2)[0]
+                        m[name] = v
                 }
         }
 
@@ -324,7 +336,7 @@ type graphNodeCloseProvider struct {
 }
 
 func (n *graphNodeCloseProvider) Name() string {
-        return fmt.Sprintf("provider.%s (close)", n.ProviderNameValue)
+        return n.ProviderNameValue + " (close)"
 }
 
 // GraphNodeEvalable impl.
@@ -362,19 +374,233 @@ func (n *graphNodeCloseProvider) RemoveIfNotTargeted() bool {
         return true
 }
 
-// graphNodeProviderConsumerDummy is a struct that never enters the real
-// graph (though it could to no ill effect). It implements
-// GraphNodeProviderConsumer and GraphNodeSubpath as a way to force
-// certain transformations.
-type graphNodeProviderConsumerDummy struct {
-        ProviderValue string
-        PathValue     []string
+// graphNodeProxyProvider is a GraphNodeProvider implementation that is used to
+// store the name and value of a provider node for inheritance between modules.
+// These nodes are only used to store the data while loading the provider
+// configurations, and are removed after all the resources have been connected
+// to their providers.
+type graphNodeProxyProvider struct {
+        nameValue string
+        path      []string
+        target    GraphNodeProvider
+}
+
+func (n *graphNodeProxyProvider) ProviderName() string {
+        return n.Target().ProviderName()
+}
+
+func (n *graphNodeProxyProvider) Name() string {
+        return ResolveProviderName(n.nameValue, n.path)
+}
+
+// find the concrete provider instance
+func (n *graphNodeProxyProvider) Target() GraphNodeProvider {
+        switch t := n.target.(type) {
+        case *graphNodeProxyProvider:
+                return t.Target()
+        default:
+                return n.target
+        }
+}
+
+// ProviderConfigTransformer adds all provider nodes from the configuration and
+// attaches the configs.
+type ProviderConfigTransformer struct {
+        Providers []string
+        Concrete  ConcreteProviderNodeFunc
+
+        // each provider node is stored here so that the proxy nodes can look up
+        // their targets by name.
+        providers map[string]GraphNodeProvider
+        // record providers that can be overriden with a proxy
+        proxiable map[string]bool
+
+        // Module is the module to add resources from.
+        Module *module.Tree
 }
 
-func (n *graphNodeProviderConsumerDummy) Path() []string {
-        return n.PathValue
+func (t *ProviderConfigTransformer) Transform(g *Graph) error {
+        // If no module is given, we don't do anything
+        if t.Module == nil {
+                return nil
+        }
+
+        // If the module isn't loaded, that is simply an error
+        if !t.Module.Loaded() {
+                return errors.New("module must be loaded for ProviderConfigTransformer")
+        }
+
+        t.providers = make(map[string]GraphNodeProvider)
+        t.proxiable = make(map[string]bool)
+
+        // Start the transformation process
+        if err := t.transform(g, t.Module); err != nil {
+                return err
+        }
+
+        // finally attach the configs to the new nodes
+        return t.attachProviderConfigs(g)
 }
 
-func (n *graphNodeProviderConsumerDummy) ProvidedBy() []string {
-        return []string{n.ProviderValue}
+func (t *ProviderConfigTransformer) transform(g *Graph, m *module.Tree) error {
+        // If no config, do nothing
+        if m == nil {
+                return nil
+        }
+
+        // Add our resources
+        if err := t.transformSingle(g, m); err != nil {
+                return err
+        }
+
+        // Transform all the children.
+        for _, c := range m.Children() {
+                if err := t.transform(g, c); err != nil {
+                        return err
+                }
+        }
+        return nil
+}
+
+func (t *ProviderConfigTransformer) transformSingle(g *Graph, m *module.Tree) error {
+        log.Printf("[TRACE] ProviderConfigTransformer: Starting for path: %v", m.Path())
+
+        // Get the configuration for this module
+        conf := m.Config()
+
+        // Build the path we're at
+        path := m.Path()
+        if len(path) > 0 {
+                path = append([]string{RootModuleName}, path...)
+        }
+
+        // add all providers from the configuration
+        for _, p := range conf.ProviderConfigs {
+                name := p.Name
+                if p.Alias != "" {
+                        name += "." + p.Alias
+                }
+
+                v := t.Concrete(&NodeAbstractProvider{
+                        NameValue: name,
+                        PathValue: path,
+                })
+
+                // Add it to the graph
+                g.Add(v)
+                fullName := ResolveProviderName(name, path)
+                t.providers[fullName] = v.(GraphNodeProvider)
+                t.proxiable[fullName] = len(p.RawConfig.RawMap()) == 0
+        }
+
+        // Now replace the provider nodes with proxy nodes if a provider was being
+        // passed in, and create implicit proxies if there was no config. Any extra
+        // proxies will be removed in the prune step.
+        return t.addProxyProviders(g, m)
+}
+
+func (t *ProviderConfigTransformer) addProxyProviders(g *Graph, m *module.Tree) error {
+        path := m.Path()
+
+        // can't add proxies at the root
+        if len(path) == 0 {
+                return nil
+        }
+
+        parentPath := path[:len(path)-1]
+        parent := t.Module.Child(parentPath)
+        if parent == nil {
+                return nil
+        }
+
+        var parentCfg *config.Module
+        for _, mod := range parent.Config().Modules {
+                if mod.Name == m.Name() {
+                        parentCfg = mod
+                        break
+                }
+        }
+
+        if parentCfg == nil {
+                // this can't really happen during normal execution.
+                return fmt.Errorf("parent module config not found for %s", m.Name())
+        }
+
+        // Go through all the providers the parent is passing in, and add proxies to
+        // the parent provider nodes.
+        for name, parentName := range parentCfg.Providers {
+                fullName := ResolveProviderName(name, path)
+                fullParentName := ResolveProviderName(parentName, parentPath)
+
+                parentProvider := t.providers[fullParentName]
+
+                if parentProvider == nil {
+                        return fmt.Errorf("missing provider %s", fullParentName)
+                }
+
+                proxy := &graphNodeProxyProvider{
+                        nameValue: name,
+                        path:      path,
+                        target:    parentProvider,
+                }
+
+                concreteProvider := t.providers[fullName]
+
+                // replace the concrete node with the provider passed in
+                if concreteProvider != nil && t.proxiable[fullName] {
+                        g.Replace(concreteProvider, proxy)
+                        t.providers[fullName] = proxy
+                        continue
+                }
+
+                // aliased providers can't be implicitly passed in
+                if strings.Contains(name, ".") {
+                        continue
+                }
+
+                // There was no concrete provider, so add this as an implicit provider.
+                // The extra proxy will be pruned later if it's unused.
+                g.Add(proxy)
+                t.providers[fullName] = proxy
+        }
+        return nil
+}
+
+func (t *ProviderConfigTransformer) attachProviderConfigs(g *Graph) error {
+        for _, v := range g.Vertices() {
+                // Only care about GraphNodeAttachProvider implementations
+                apn, ok := v.(GraphNodeAttachProvider)
+                if !ok {
+                        continue
+                }
+
+                // Determine what we're looking for
+                path := normalizeModulePath(apn.Path())[1:]
+                name := apn.ProviderName()
+                log.Printf("[TRACE] Attach provider request: %#v %s", path, name)
+
+                // Get the configuration.
+                tree := t.Module.Child(path)
+                if tree == nil {
+                        continue
+                }
+
+                // Go through the provider configs to find the matching config
+                for _, p := range tree.Config().ProviderConfigs {
+                        // Build the name, which is "name.alias" if an alias exists
+                        current := p.Name
+                        if p.Alias != "" {
+                                current += "." + p.Alias
+                        }
+
+                        // If the configs match then attach!
+                        if current == name {
+                                log.Printf("[TRACE] Attaching provider config: %#v", p)
+                                apn.AttachProvider(p)
+                                break
+                        }
+                }
+        }
+
+        return nil
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_provider_disable.go b/vendor/github.com/hashicorp/terraform/terraform/transform_provider_disable.go
deleted file mode 100644
index d9919f3..0000000
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_provider_disable.go
+++ /dev/null
@@ -1,50 +0,0 @@
-package terraform
-
-import (
-        "fmt"
-
-        "github.com/hashicorp/terraform/dag"
-)
-
-// DisableProviderTransformer "disables" any providers that are not actually
-// used by anything. This avoids the provider being initialized and configured.
-// This both saves resources but also avoids errors since configuration
-// may imply initialization which may require auth.
-type DisableProviderTransformer struct{}
-
-func (t *DisableProviderTransformer) Transform(g *Graph) error {
-        for _, v := range g.Vertices() {
-                // We only care about providers
-                pn, ok := v.(GraphNodeProvider)
-                if !ok || pn.ProviderName() == "" {
-                        continue
-                }
-
-                // If we have dependencies, then don't disable
-                if g.UpEdges(v).Len() > 0 {
-                        continue
-                }
-
-                // Get the path
-                var path []string
-                if pn, ok := v.(GraphNodeSubPath); ok {
-                        path = pn.Path()
-                }
-
-                // Disable the provider by replacing it with a "disabled" provider
-                disabled := &NodeDisabledProvider{
-                        NodeAbstractProvider: &NodeAbstractProvider{
-                                NameValue: pn.ProviderName(),
-                                PathValue: path,
-                        },
-                }
-
-                if !g.Replace(v, disabled) {
-                        panic(fmt.Sprintf(
-                                "vertex disappeared from under us: %s",
-                                dag.VertexName(v)))
-                }
-        }
-
-        return nil
-}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_reference.go b/vendor/github.com/hashicorp/terraform/terraform/transform_reference.go
index c545235..be8c7f9 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_reference.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_reference.go
@@ -76,6 +76,85 @@ func (t *ReferenceTransformer) Transform(g *Graph) error {
         return nil
 }
 
+// DestroyReferenceTransformer is a GraphTransformer that reverses the edges
+// for locals and outputs that depend on other nodes which will be
+// removed during destroy. If a destroy node is evaluated before the local or
+// output value, it will be removed from the state, and the later interpolation
+// will fail.
+type DestroyValueReferenceTransformer struct{}
+
+func (t *DestroyValueReferenceTransformer) Transform(g *Graph) error {
+        vs := g.Vertices()
+        for _, v := range vs {
+                switch v.(type) {
+                case *NodeApplyableOutput, *NodeLocal:
+                        // OK
+                default:
+                        continue
+                }
+
+                // reverse any outgoing edges so that the value is evaluated first.
+                for _, e := range g.EdgesFrom(v) {
+                        target := e.Target()
+
+                        // only destroy nodes will be evaluated in reverse
+                        if _, ok := target.(GraphNodeDestroyer); !ok {
+                                continue
+                        }
+
+                        log.Printf("[TRACE] output dep: %s", dag.VertexName(target))
+
+                        g.RemoveEdge(e)
+                        g.Connect(&DestroyEdge{S: target, T: v})
+                }
+        }
+
+        return nil
+}
+
+// PruneUnusedValuesTransformer is s GraphTransformer that removes local and
+// output values which are not referenced in the graph. Since outputs and
+// locals always need to be evaluated, if they reference a resource that is not
+// available in the state the interpolation could fail.
+type PruneUnusedValuesTransformer struct{}
+
+func (t *PruneUnusedValuesTransformer) Transform(g *Graph) error {
+        // this might need multiple runs in order to ensure that pruning a value
+        // doesn't effect a previously checked value.
+        for removed := 0; ; removed = 0 {
+                for _, v := range g.Vertices() {
+                        switch v.(type) {
+                        case *NodeApplyableOutput, *NodeLocal:
+                                // OK
+                        default:
+                                continue
+                        }
+
+                        dependants := g.UpEdges(v)
+
+                        switch dependants.Len() {
+                        case 0:
+                                // nothing at all depends on this
+                                g.Remove(v)
+                                removed++
+                        case 1:
+                                // because an output's destroy node always depends on the output,
+                                // we need to check for the case of a single destroy node.
+                                d := dependants.List()[0]
+                                if _, ok := d.(*NodeDestroyableOutput); ok {
+                                        g.Remove(v)
+                                        removed++
+                                }
+                        }
+                }
+                if removed == 0 {
+                        break
+                }
+        }
+
+        return nil
+}
+
 // ReferenceMap is a structure that can be used to efficiently check
 // for references on a graph.
 type ReferenceMap struct {
@@ -96,6 +175,7 @@ func (m *ReferenceMap) References(v dag.Vertex) ([]dag.Vertex, []string) {
         var matches []dag.Vertex
         var missing []string
         prefix := m.prefix(v)
+
         for _, ns := range rn.References() {
                 found := false
                 for _, n := range strings.Split(ns, "/") {
@@ -108,19 +188,14 @@ func (m *ReferenceMap) References(v dag.Vertex) ([]dag.Vertex, []string) {
                         // Mark that we found a match
                         found = true
 
-                        // Make sure this isn't a self reference, which isn't included
-                        selfRef := false
                         for _, p := range parents {
+                                // don't include self-references
                                 if p == v {
-                                        selfRef = true
-                                        break
+                                        continue
                                 }
-                        }
-                        if selfRef {
-                                continue
+                                matches = append(matches, p)
                         }
 
-                        matches = append(matches, parents...)
                         break
                 }
 
@@ -296,14 +371,21 @@ func ReferenceFromInterpolatedVar(v config.InterpolatedVariable) []string {
                 return []string{fmt.Sprintf("%s.%d/%s.N", id, idx, id)}
         case *config.UserVariable:
                 return []string{fmt.Sprintf("var.%s", v.Name)}
+        case *config.LocalVariable:
+                return []string{fmt.Sprintf("local.%s", v.Name)}
         default:
                 return nil
         }
 }
 
 func modulePrefixStr(p []string) string {
+        // strip "root"
+        if len(p) > 0 && p[0] == rootModulePath[0] {
+                p = p[1:]
+        }
+
         parts := make([]string, 0, len(p)*2)
-        for _, p := range p[1:] {
+        for _, p := range p {
                 parts = append(parts, "module", p)
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_removed_modules.go b/vendor/github.com/hashicorp/terraform/terraform/transform_removed_modules.go
new file mode 100644
index 0000000..2e05edb
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_removed_modules.go
@@ -0,0 +1,32 @@
+package terraform
+
+import (
+        "log"
+
+        "github.com/hashicorp/terraform/config/module"
+)
+
+// RemoveModuleTransformer implements GraphTransformer to add nodes indicating
+// when a module was removed from the configuration.
+type RemovedModuleTransformer struct {
+        Module *module.Tree // root module
+        State  *State
+}
+
+func (t *RemovedModuleTransformer) Transform(g *Graph) error {
+        // nothing to remove if there's no state!
+        if t.State == nil {
+                return nil
+        }
+
+        for _, m := range t.State.Modules {
+                c := t.Module.Child(m.Path[1:])
+                if c != nil {
+                        continue
+                }
+
+                log.Printf("[DEBUG] module %s no longer in config\n", modulePrefixStr(m.Path))
+                g.Add(&NodeModuleRemoved{PathValue: m.Path})
+        }
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_resource_count.go b/vendor/github.com/hashicorp/terraform/terraform/transform_resource_count.go
index cda35cb..e528b37 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_resource_count.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_resource_count.go
@@ -37,7 +37,9 @@ func (t *ResourceCountTransformer) Transform(g *Graph) error {
                 addr.Index = index
 
                 // Build the abstract node and the concrete one
-                abstract := &NodeAbstractResource{Addr: addr}
+                abstract := &NodeAbstractResource{
+                        Addr: addr,
+                }
                 var node dag.Vertex = abstract
                 if f := t.Concrete; f != nil {
                         node = f(abstract)
diff --git a/vendor/github.com/hashicorp/terraform/terraform/transform_targets.go b/vendor/github.com/hashicorp/terraform/terraform/transform_targets.go
index 4f117b4..af6defe 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/transform_targets.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/transform_targets.go
@@ -73,9 +73,11 @@ func (t *TargetsTransformer) Transform(g *Graph) error {
                         if _, ok := v.(GraphNodeResource); ok {
                                 removable = true
                         }
+
                         if vr, ok := v.(RemovableIfNotTargeted); ok {
                                 removable = vr.RemoveIfNotTargeted()
                         }
+
                         if removable && !targetedNodes.Include(v) {
                                 log.Printf("[DEBUG] Removing %q, filtered by targeting.", dag.VertexName(v))
                                 g.Remove(v)
@@ -135,7 +137,10 @@ func (t *TargetsTransformer) selectTargetedNodes(
                         }
                 }
         }
+        return t.addDependencies(targetedNodes, g)
+}
 
+func (t *TargetsTransformer) addDependencies(targetedNodes *dag.Set, g *Graph) (*dag.Set, error) {
         // Handle nodes that need to be included if their dependencies are included.
         // This requires multiple passes since we need to catch transitive
         // dependencies if and only if they are via other nodes that also
@@ -157,11 +162,6 @@ func (t *TargetsTransformer) selectTargetedNodes(
                         }
 
                         dependers = dependers.Filter(func(dv interface{}) bool {
-                                // Can ignore nodes that are already targeted
-                                /*if targetedNodes.Include(dv) {
-                                        return false
-                                }*/
-
                                 _, ok := dv.(GraphNodeTargetDownstream)
                                 return ok
                         })
@@ -180,6 +180,7 @@ func (t *TargetsTransformer) selectTargetedNodes(
                                 // depending on in case that informs its decision about whether
                                 // it is safe to be targeted.
                                 deps := g.DownEdges(v)
+
                                 depsTargeted := deps.Intersection(targetedNodes)
                                 depsUntargeted := deps.Difference(depsTargeted)
 
@@ -193,7 +194,50 @@ func (t *TargetsTransformer) selectTargetedNodes(
                 }
         }
 
-        return targetedNodes, nil
+        return targetedNodes.Filter(func(dv interface{}) bool {
+                return filterPartialOutputs(dv, targetedNodes, g)
+        }), nil
+}
+
+// Outputs may have been included transitively, but if any of their
+// dependencies have been pruned they won't be resolvable.
+// If nothing depends on the output, and the output is missing any
+// dependencies, remove it from the graph.
+// This essentially maintains the previous behavior where interpolation in
+// outputs would fail silently, but can now surface errors where the output
+// is required.
+func filterPartialOutputs(v interface{}, targetedNodes *dag.Set, g *Graph) bool {
+        // should this just be done with TargetDownstream?
+        if _, ok := v.(*NodeApplyableOutput); !ok {
+                return true
+        }
+
+        dependers := g.UpEdges(v)
+        for _, d := range dependers.List() {
+                if _, ok := d.(*NodeCountBoundary); ok {
+                        continue
+                }
+
+                if !targetedNodes.Include(d) {
+                        // this one is going to be removed, so it doesn't count
+                        continue
+                }
+
+                // as soon as we see a real dependency, we mark this as
+                // non-removable
+                return true
+        }
+
+        depends := g.DownEdges(v)
+
+        for _, d := range depends.List() {
+                if !targetedNodes.Include(d) {
+                        log.Printf("[WARN] %s missing targeted dependency %s, removing from the graph",
+                                dag.VertexName(v), dag.VertexName(d))
+                        return false
+                }
+        }
+        return true
 }
 
 func (t *TargetsTransformer) nodeIsTarget(
diff --git a/vendor/github.com/hashicorp/terraform/terraform/ui_output_mock.go b/vendor/github.com/hashicorp/terraform/terraform/ui_output_mock.go
index 7852bc4..d828c92 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/ui_output_mock.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/ui_output_mock.go
@@ -1,13 +1,18 @@
 package terraform
 
+import "sync"
+
 // MockUIOutput is an implementation of UIOutput that can be used for tests.
 type MockUIOutput struct {
+        sync.Mutex
         OutputCalled  bool
         OutputMessage string
         OutputFn      func(string)
 }
 
 func (o *MockUIOutput) Output(v string) {
+        o.Lock()
+        defer o.Unlock()
         o.OutputCalled = true
         o.OutputMessage = v
         if o.OutputFn != nil {
diff --git a/vendor/github.com/hashicorp/terraform/terraform/user_agent.go b/vendor/github.com/hashicorp/terraform/terraform/user_agent.go
index 700be2a..a42613e 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/user_agent.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/user_agent.go
@@ -1,14 +1,13 @@
 package terraform
 
 import (
-        "fmt"
-        "runtime"
+        "github.com/hashicorp/terraform/httpclient"
 )
 
-// The standard Terraform User-Agent format
-const UserAgent = "Terraform %s (%s)"
-
 // Generate a UserAgent string
+//
+// Deprecated: Use httpclient.UserAgentString if you are setting your
+// own User-Agent header.
 func UserAgentString() string {
-        return fmt.Sprintf(UserAgent, VersionString(), runtime.Version())
+        return httpclient.UserAgentString()
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/version.go b/vendor/github.com/hashicorp/terraform/terraform/version.go
index d61b11e..ac73015 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/version.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/version.go
@@ -1,31 +1,10 @@
 package terraform
 
 import (
-        "fmt"
-
-        "github.com/hashicorp/go-version"
+        "github.com/hashicorp/terraform/version"
 )
 
-// The main version number that is being run at the moment.
-const Version = "0.10.0"
-
-// A pre-release marker for the version. If this is "" (empty string)
-// then it means that it is a final release. Otherwise, this is a pre-release
-// such as "dev" (in development), "beta", "rc1", etc.
-var VersionPrerelease = "dev"
-
-// SemVersion is an instance of version.Version. This has the secondary
-// benefit of verifying during tests and init time that our version is a
-// proper semantic version, which should always be the case.
-var SemVersion = version.Must(version.NewVersion(Version))
-
-// VersionHeader is the header name used to send the current terraform version
-// in http requests.
-const VersionHeader = "Terraform-Version"
-
+// TODO: update providers to use the version package directly
 func VersionString() string {
-        if VersionPrerelease != "" {
-                return fmt.Sprintf("%s-%s", Version, VersionPrerelease)
-        }
-        return Version
+        return version.String()
 }
diff --git a/vendor/github.com/hashicorp/terraform/terraform/version_required.go b/vendor/github.com/hashicorp/terraform/terraform/version_required.go
index 3cbbf56..1f43045 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/version_required.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/version_required.go
@@ -6,19 +6,21 @@ import (
         "github.com/hashicorp/go-version"
         "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/config/module"
+
+        tfversion "github.com/hashicorp/terraform/version"
 )
 
-// checkRequiredVersion verifies that any version requirements specified by
+// CheckRequiredVersion verifies that any version requirements specified by
 // the configuration are met.
 //
 // This checks the root module as well as any additional version requirements
 // from child modules.
 //
 // This is tested in context_test.go.
-func checkRequiredVersion(m *module.Tree) error {
+func CheckRequiredVersion(m *module.Tree) error {
         // Check any children
         for _, c := range m.Children() {
-                if err := checkRequiredVersion(c); err != nil {
+                if err := CheckRequiredVersion(c); err != nil {
                         return err
                 }
         }
@@ -49,7 +51,7 @@ func checkRequiredVersion(m *module.Tree) error {
                         tf.RequiredVersion, err)
         }
 
-        if !cs.Check(SemVersion) {
+        if !cs.Check(tfversion.SemVer) {
                 return fmt.Errorf(
                         "The currently running version of Terraform doesn't meet the\n"+
                                 "version requirements explicitly specified by the configuration.\n"+
@@ -62,7 +64,7 @@ func checkRequiredVersion(m *module.Tree) error {
                                 "  Current version: %s",
                         module,
                         tf.RequiredVersion,
-                        SemVersion)
+                        tfversion.SemVer)
         }
 
         return nil
diff --git a/vendor/github.com/hashicorp/terraform/terraform/walkoperation_string.go b/vendor/github.com/hashicorp/terraform/terraform/walkoperation_string.go
index cbd78dd..4cfc528 100644
--- a/vendor/github.com/hashicorp/terraform/terraform/walkoperation_string.go
+++ b/vendor/github.com/hashicorp/terraform/terraform/walkoperation_string.go
@@ -2,7 +2,7 @@
 
 package terraform
 
-import "fmt"
+import "strconv"
 
 const _walkOperation_name = "walkInvalidwalkInputwalkApplywalkPlanwalkPlanDestroywalkRefreshwalkValidatewalkDestroywalkImport"
 
@@ -10,7 +10,7 @@ var _walkOperation_index = [...]uint8{0, 11, 20, 29, 37, 52, 63, 75, 86, 96}
 
 func (i walkOperation) String() string {
         if i >= walkOperation(len(_walkOperation_index)-1) {
-                return fmt.Sprintf("walkOperation(%d)", i)
+                return "walkOperation(" + strconv.FormatInt(int64(i), 10) + ")"
         }
         return _walkOperation_name[_walkOperation_index[i]:_walkOperation_index[i+1]]
 }
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/diagnostic.go b/vendor/github.com/hashicorp/terraform/tfdiags/diagnostic.go
new file mode 100644
index 0000000..2c23f76
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/diagnostic.go
@@ -0,0 +1,26 @@
+package tfdiags
+
+type Diagnostic interface {
+        Severity() Severity
+        Description() Description
+        Source() Source
+}
+
+type Severity rune
+
+//go:generate stringer -type=Severity
+
+const (
+        Error   Severity = 'E'
+        Warning Severity = 'W'
+)
+
+type Description struct {
+        Summary string
+        Detail  string
+}
+
+type Source struct {
+        Subject *SourceRange
+        Context *SourceRange
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/diagnostics.go b/vendor/github.com/hashicorp/terraform/tfdiags/diagnostics.go
new file mode 100644
index 0000000..667ba80
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/diagnostics.go
@@ -0,0 +1,181 @@
+package tfdiags
+
+import (
+        "bytes"
+        "fmt"
+
+        "github.com/hashicorp/errwrap"
+        multierror "github.com/hashicorp/go-multierror"
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// Diagnostics is a list of diagnostics. Diagnostics is intended to be used
+// where a Go "error" might normally be used, allowing richer information
+// to be conveyed (more context, support for warnings).
+//
+// A nil Diagnostics is a valid, empty diagnostics list, thus allowing
+// heap allocation to be avoided in the common case where there are no
+// diagnostics to report at all.
+type Diagnostics []Diagnostic
+
+// Append is the main interface for constructing Diagnostics lists, taking
+// an existing list (which may be nil) and appending the new objects to it
+// after normalizing them to be implementations of Diagnostic.
+//
+// The usual pattern for a function that natively "speaks" diagnostics is:
+//
+//     // Create a nil Diagnostics at the start of the function
+//     var diags diag.Diagnostics
+//
+//     // At later points, build on it if errors / warnings occur:
+//     foo, err := DoSomethingRisky()
+//     if err != nil {
+//         diags = diags.Append(err)
+//     }
+//
+//     // Eventually return the result and diagnostics in place of error
+//     return result, diags
+//
+// Append accepts a variety of different diagnostic-like types, including
+// native Go errors and HCL diagnostics. It also knows how to unwrap
+// a multierror.Error into separate error diagnostics. It can be passed
+// another Diagnostics to concatenate the two lists. If given something
+// it cannot handle, this function will panic.
+func (diags Diagnostics) Append(new ...interface{}) Diagnostics {
+        for _, item := range new {
+                if item == nil {
+                        continue
+                }
+
+                switch ti := item.(type) {
+                case Diagnostic:
+                        diags = append(diags, ti)
+                case Diagnostics:
+                        diags = append(diags, ti...) // flatten
+                case diagnosticsAsError:
+                        diags = diags.Append(ti.Diagnostics) // unwrap
+                case hcl.Diagnostics:
+                        for _, hclDiag := range ti {
+                                diags = append(diags, hclDiagnostic{hclDiag})
+                        }
+                case *hcl.Diagnostic:
+                        diags = append(diags, hclDiagnostic{ti})
+                case *multierror.Error:
+                        for _, err := range ti.Errors {
+                                diags = append(diags, nativeError{err})
+                        }
+                case error:
+                        switch {
+                        case errwrap.ContainsType(ti, Diagnostics(nil)):
+                                // If we have an errwrap wrapper with a Diagnostics hiding
+                                // inside then we'll unpick it here to get access to the
+                                // individual diagnostics.
+                                diags = diags.Append(errwrap.GetType(ti, Diagnostics(nil)))
+                        case errwrap.ContainsType(ti, hcl.Diagnostics(nil)):
+                                // Likewise, if we have HCL diagnostics we'll unpick that too.
+                                diags = diags.Append(errwrap.GetType(ti, hcl.Diagnostics(nil)))
+                        default:
+                                diags = append(diags, nativeError{ti})
+                        }
+                default:
+                        panic(fmt.Errorf("can't construct diagnostic(s) from %T", item))
+                }
+        }
+
+        // Given the above, we should never end up with a non-nil empty slice
+        // here, but we'll make sure of that so callers can rely on empty == nil
+        if len(diags) == 0 {
+                return nil
+        }
+
+        return diags
+}
+
+// HasErrors returns true if any of the diagnostics in the list have
+// a severity of Error.
+func (diags Diagnostics) HasErrors() bool {
+        for _, diag := range diags {
+                if diag.Severity() == Error {
+                        return true
+                }
+        }
+        return false
+}
+
+// ForRPC returns a version of the receiver that has been simplified so that
+// it is friendly to RPC protocols.
+//
+// Currently this means that it can be serialized with encoding/gob and
+// subsequently re-inflated. It may later grow to include other serialization
+// formats.
+//
+// Note that this loses information about the original objects used to
+// construct the diagnostics, so e.g. the errwrap API will not work as
+// expected on an error-wrapped Diagnostics that came from ForRPC.
+func (diags Diagnostics) ForRPC() Diagnostics {
+        ret := make(Diagnostics, len(diags))
+        for i := range diags {
+                ret[i] = makeRPCFriendlyDiag(diags[i])
+        }
+        return ret
+}
+
+// Err flattens a diagnostics list into a single Go error, or to nil
+// if the diagnostics list does not include any error-level diagnostics.
+//
+// This can be used to smuggle diagnostics through an API that deals in
+// native errors, but unfortunately it will lose naked warnings (warnings
+// that aren't accompanied by at least one error) since such APIs have no
+// mechanism through which to report these.
+//
+//     return result, diags.Error()
+func (diags Diagnostics) Err() error {
+        if !diags.HasErrors() {
+                return nil
+        }
+        return diagnosticsAsError{diags}
+}
+
+type diagnosticsAsError struct {
+        Diagnostics
+}
+
+func (dae diagnosticsAsError) Error() string {
+        diags := dae.Diagnostics
+        switch {
+        case len(diags) == 0:
+                // should never happen, since we don't create this wrapper if
+                // there are no diagnostics in the list.
+                return "no errors"
+        case len(diags) == 1:
+                desc := diags[0].Description()
+                if desc.Detail == "" {
+                        return desc.Summary
+                }
+                return fmt.Sprintf("%s: %s", desc.Summary, desc.Detail)
+        default:
+                var ret bytes.Buffer
+                fmt.Fprintf(&ret, "%d problems:\n", len(diags))
+                for _, diag := range dae.Diagnostics {
+                        desc := diag.Description()
+                        if desc.Detail == "" {
+                                fmt.Fprintf(&ret, "\n- %s", desc.Summary)
+                        } else {
+                                fmt.Fprintf(&ret, "\n- %s: %s", desc.Summary, desc.Detail)
+                        }
+                }
+                return ret.String()
+        }
+}
+
+// WrappedErrors is an implementation of errwrap.Wrapper so that an error-wrapped
+// diagnostics object can be picked apart by errwrap-aware code.
+func (dae diagnosticsAsError) WrappedErrors() []error {
+        var errs []error
+        for _, diag := range dae.Diagnostics {
+                if wrapper, isErr := diag.(nativeError); isErr {
+                        errs = append(errs, wrapper.err)
+                }
+        }
+        return errs
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/doc.go b/vendor/github.com/hashicorp/terraform/tfdiags/doc.go
new file mode 100644
index 0000000..c427879
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/doc.go
@@ -0,0 +1,16 @@
+// Package tfdiags is a utility package for representing errors and
+// warnings in a manner that allows us to produce good messages for the
+// user.
+//
+// "diag" is short for "diagnostics", and is meant as a general word for
+// feedback to a user about potential or actual problems.
+//
+// A design goal for this package is for it to be able to provide rich
+// messaging where possible but to also be pragmatic about dealing with
+// generic errors produced by system components that _can't_ provide
+// such rich messaging. As a consequence, the main types in this package --
+// Diagnostics and Diagnostic -- are designed so that they can be "smuggled"
+// over an error channel and then be unpacked at the other end, so that
+// error diagnostics (at least) can transit through APIs that are not
+// aware of this package.
+package tfdiags
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/error.go b/vendor/github.com/hashicorp/terraform/tfdiags/error.go
new file mode 100644
index 0000000..35edc30
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/error.go
@@ -0,0 +1,23 @@
+package tfdiags
+
+// nativeError is a Diagnostic implementation that wraps a normal Go error
+type nativeError struct {
+        err error
+}
+
+var _ Diagnostic = nativeError{}
+
+func (e nativeError) Severity() Severity {
+        return Error
+}
+
+func (e nativeError) Description() Description {
+        return Description{
+                Summary: e.err.Error(),
+        }
+}
+
+func (e nativeError) Source() Source {
+        // No source information available for a native error
+        return Source{}
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/hcl.go b/vendor/github.com/hashicorp/terraform/tfdiags/hcl.go
new file mode 100644
index 0000000..24851f4
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/hcl.go
@@ -0,0 +1,77 @@
+package tfdiags
+
+import (
+        "github.com/hashicorp/hcl2/hcl"
+)
+
+// hclDiagnostic is a Diagnostic implementation that wraps a HCL Diagnostic
+type hclDiagnostic struct {
+        diag *hcl.Diagnostic
+}
+
+var _ Diagnostic = hclDiagnostic{}
+
+func (d hclDiagnostic) Severity() Severity {
+        switch d.diag.Severity {
+        case hcl.DiagWarning:
+                return Warning
+        default:
+                return Error
+        }
+}
+
+func (d hclDiagnostic) Description() Description {
+        return Description{
+                Summary: d.diag.Summary,
+                Detail:  d.diag.Detail,
+        }
+}
+
+func (d hclDiagnostic) Source() Source {
+        var ret Source
+        if d.diag.Subject != nil {
+                rng := SourceRangeFromHCL(*d.diag.Subject)
+                ret.Subject = &rng
+        }
+        if d.diag.Context != nil {
+                rng := SourceRangeFromHCL(*d.diag.Context)
+                ret.Context = &rng
+        }
+        return ret
+}
+
+// SourceRangeFromHCL constructs a SourceRange from the corresponding range
+// type within the HCL package.
+func SourceRangeFromHCL(hclRange hcl.Range) SourceRange {
+        return SourceRange{
+                Filename: hclRange.Filename,
+                Start: SourcePos{
+                        Line:   hclRange.Start.Line,
+                        Column: hclRange.Start.Column,
+                        Byte:   hclRange.Start.Byte,
+                },
+                End: SourcePos{
+                        Line:   hclRange.End.Line,
+                        Column: hclRange.End.Column,
+                        Byte:   hclRange.End.Byte,
+                },
+        }
+}
+
+// ToHCL constructs a HCL Range from the receiving SourceRange. This is the
+// opposite of SourceRangeFromHCL.
+func (r SourceRange) ToHCL() hcl.Range {
+        return hcl.Range{
+                Filename: r.Filename,
+                Start: hcl.Pos{
+                        Line:   r.Start.Line,
+                        Column: r.Start.Column,
+                        Byte:   r.Start.Byte,
+                },
+                End: hcl.Pos{
+                        Line:   r.End.Line,
+                        Column: r.End.Column,
+                        Byte:   r.End.Byte,
+                },
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/rpc_friendly.go b/vendor/github.com/hashicorp/terraform/tfdiags/rpc_friendly.go
new file mode 100644
index 0000000..6cc95cc
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/rpc_friendly.go
@@ -0,0 +1,53 @@
+package tfdiags
+
+import (
+        "encoding/gob"
+)
+
+type rpcFriendlyDiag struct {
+        Severity_ Severity
+        Summary_  string
+        Detail_   string
+        Subject_  *SourceRange
+        Context_  *SourceRange
+}
+
+// rpcFriendlyDiag transforms a given diagnostic so that is more friendly to
+// RPC.
+//
+// In particular, it currently returns an object that can be serialized and
+// later re-inflated using gob. This definition may grow to include other
+// serializations later.
+func makeRPCFriendlyDiag(diag Diagnostic) Diagnostic {
+        desc := diag.Description()
+        source := diag.Source()
+        return &rpcFriendlyDiag{
+                Severity_: diag.Severity(),
+                Summary_:  desc.Summary,
+                Detail_:   desc.Detail,
+                Subject_:  source.Subject,
+                Context_:  source.Context,
+        }
+}
+
+func (d *rpcFriendlyDiag) Severity() Severity {
+        return d.Severity_
+}
+
+func (d *rpcFriendlyDiag) Description() Description {
+        return Description{
+                Summary: d.Summary_,
+                Detail:  d.Detail_,
+        }
+}
+
+func (d *rpcFriendlyDiag) Source() Source {
+        return Source{
+                Subject: d.Subject_,
+                Context: d.Context_,
+        }
+}
+
+func init() {
+        gob.Register((*rpcFriendlyDiag)(nil))
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/severity_string.go b/vendor/github.com/hashicorp/terraform/tfdiags/severity_string.go
new file mode 100644
index 0000000..0b1249b
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/severity_string.go
@@ -0,0 +1,21 @@
+// Code generated by "stringer -type=Severity"; DO NOT EDIT.
+
+package tfdiags
+
+import "strconv"
+
+const (
+        _Severity_name_0 = "Error"
+        _Severity_name_1 = "Warning"
+)
+
+func (i Severity) String() string {
+        switch {
+        case i == 69:
+                return _Severity_name_0
+        case i == 87:
+                return _Severity_name_1
+        default:
+                return "Severity(" + strconv.FormatInt(int64(i), 10) + ")"
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/simple_warning.go b/vendor/github.com/hashicorp/terraform/tfdiags/simple_warning.go
new file mode 100644
index 0000000..fb3ac98
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/simple_warning.go
@@ -0,0 +1,25 @@
+package tfdiags
+
+type simpleWarning string
+
+var _ Diagnostic = simpleWarning("")
+
+// SimpleWarning constructs a simple (summary-only) warning diagnostic.
+func SimpleWarning(msg string) Diagnostic {
+        return simpleWarning(msg)
+}
+
+func (e simpleWarning) Severity() Severity {
+        return Warning
+}
+
+func (e simpleWarning) Description() Description {
+        return Description{
+                Summary: string(e),
+        }
+}
+
+func (e simpleWarning) Source() Source {
+        // No source information available for a native error
+        return Source{}
+}
diff --git a/vendor/github.com/hashicorp/terraform/tfdiags/source_range.go b/vendor/github.com/hashicorp/terraform/tfdiags/source_range.go
new file mode 100644
index 0000000..3031168
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/tfdiags/source_range.go
@@ -0,0 +1,35 @@
+package tfdiags
+
+import (
+        "fmt"
+        "os"
+        "path/filepath"
+)
+
+type SourceRange struct {
+        Filename   string
+        Start, End SourcePos
+}
+
+type SourcePos struct {
+        Line, Column, Byte int
+}
+
+// StartString returns a string representation of the start of the range,
+// including the filename and the line and column numbers.
+func (r SourceRange) StartString() string {
+        filename := r.Filename
+
+        // We'll try to relative-ize our filename here so it's less verbose
+        // in the common case of being in the current working directory. If not,
+        // we'll just show the full path.
+        wd, err := os.Getwd()
+        if err == nil {
+                relFn, err := filepath.Rel(wd, filename)
+                if err == nil {
+                        filename = relFn
+                }
+        }
+
+        return fmt.Sprintf("%s:%d,%d", filename, r.Start.Line, r.Start.Column)
+}
diff --git a/vendor/github.com/hashicorp/terraform/version/version.go b/vendor/github.com/hashicorp/terraform/version/version.go
new file mode 100644
index 0000000..b21b297
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/version/version.go
@@ -0,0 +1,36 @@
+// The version package provides a location to set the release versions for all
+// packages to consume, without creating import cycles.
+//
+// This package should not import any other terraform packages.
+package version
+
+import (
+        "fmt"
+
+        version "github.com/hashicorp/go-version"
+)
+
+// The main version number that is being run at the moment.
+var Version = "0.11.12"
+
+// A pre-release marker for the version. If this is "" (empty string)
+// then it means that it is a final release. Otherwise, this is a pre-release
+// such as "dev" (in development), "beta", "rc1", etc.
+var Prerelease = "dev"
+
+// SemVer is an instance of version.Version. This has the secondary
+// benefit of verifying during tests and init time that our version is a
+// proper semantic version, which should always be the case.
+var SemVer = version.Must(version.NewVersion(Version))
+
+// Header is the header name used to send the current terraform version
+// in http requests.
+const Header = "Terraform-Version"
+
+// String returns the complete version string, including prerelease
+func String() string {
+        if Prerelease != "" {
+                return fmt.Sprintf("%s-%s", Version, Prerelease)
+        }
+        return Version
+}