6 files changed, 803 insertions, 150 deletions

diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/grpc_test_provider.go b/vendor/github.com/hashicorp/terraform/helper/resource/grpc_test_provider.go
new file mode 100644
index 0000000..0742e99
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/grpc_test_provider.go
@@ -0,0 +1,43 @@
+package resource
+
+import (
+        "context"
+        "net"
+        "time"
+
+        "github.com/hashicorp/terraform/helper/plugin"
+        proto "github.com/hashicorp/terraform/internal/tfplugin5"
+        tfplugin "github.com/hashicorp/terraform/plugin"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/terraform"
+        "google.golang.org/grpc"
+        "google.golang.org/grpc/test/bufconn"
+)
+
+// GRPCTestProvider takes a legacy ResourceProvider, wraps it in the new GRPC
+// shim and starts it in a grpc server using an inmem connection. It returns a
+// GRPCClient for this new server to test the shimmed resource provider.
+func GRPCTestProvider(rp terraform.ResourceProvider) providers.Interface {
+        listener := bufconn.Listen(256 * 1024)
+        grpcServer := grpc.NewServer()
+
+        p := plugin.NewGRPCProviderServerShim(rp)
+        proto.RegisterProviderServer(grpcServer, p)
+
+        go grpcServer.Serve(listener)
+
+        conn, err := grpc.Dial("", grpc.WithDialer(func(string, time.Duration) (net.Conn, error) {
+                return listener.Dial()
+        }), grpc.WithInsecure())
+        if err != nil {
+                panic(err)
+        }
+
+        var pp tfplugin.GRPCProviderPlugin
+        client, _ := pp.GRPCClient(context.Background(), nil, conn)
+
+        grpcClient := client.(*tfplugin.GRPCProvider)
+        grpcClient.TestServer = grpcServer
+
+        return grpcClient
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/state.go b/vendor/github.com/hashicorp/terraform/helper/resource/state.go
index c34e21b..88a8396 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/state.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/state.go
@@ -38,7 +38,7 @@ type StateChangeConf struct {
 // specified in the configuration using the specified Refresh() func,
 // waiting the number of seconds specified in the timeout configuration.
 //
-// If the Refresh function returns a error, exit immediately with that error.
+// If the Refresh function returns an error, exit immediately with that error.
 //
 // If the Refresh function returns a state other than the Target state or one
 // listed in Pending, return immediately with an error.
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/state_shim.go b/vendor/github.com/hashicorp/terraform/helper/resource/state_shim.go
new file mode 100644
index 0000000..b2aff99
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/state_shim.go
@@ -0,0 +1,163 @@
+package resource
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/hashicorp/terraform/helper/schema"
+
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/terraform"
+)
+
+// shimState takes a new *states.State and reverts it to a legacy state for the provider ACC tests
+func shimNewState(newState *states.State, providers map[string]terraform.ResourceProvider) (*terraform.State, error) {
+        state := terraform.NewState()
+
+        // in the odd case of a nil state, let the helper packages handle it
+        if newState == nil {
+                return nil, nil
+        }
+
+        for _, newMod := range newState.Modules {
+                mod := state.AddModule(newMod.Addr)
+
+                for name, out := range newMod.OutputValues {
+                        outputType := ""
+                        val := hcl2shim.ConfigValueFromHCL2(out.Value)
+                        ty := out.Value.Type()
+                        switch {
+                        case ty == cty.String:
+                                outputType = "string"
+                        case ty.IsTupleType() || ty.IsListType():
+                                outputType = "list"
+                        case ty.IsMapType():
+                                outputType = "map"
+                        }
+
+                        mod.Outputs[name] = &terraform.OutputState{
+                                Type:      outputType,
+                                Value:     val,
+                                Sensitive: out.Sensitive,
+                        }
+                }
+
+                for _, res := range newMod.Resources {
+                        resType := res.Addr.Type
+                        providerType := res.ProviderConfig.ProviderConfig.Type
+
+                        resource := getResource(providers, providerType, res.Addr)
+
+                        for key, i := range res.Instances {
+                                flatmap, err := shimmedAttributes(i.Current, resource)
+                                if err != nil {
+                                        return nil, fmt.Errorf("error decoding state for %q: %s", resType, err)
+                                }
+
+                                resState := &terraform.ResourceState{
+                                        Type: resType,
+                                        Primary: &terraform.InstanceState{
+                                                ID:         flatmap["id"],
+                                                Attributes: flatmap,
+                                                Tainted:    i.Current.Status == states.ObjectTainted,
+                                        },
+                                        Provider: res.ProviderConfig.String(),
+                                }
+                                if i.Current.SchemaVersion != 0 {
+                                        resState.Primary.Meta = map[string]interface{}{
+                                                "schema_version": i.Current.SchemaVersion,
+                                        }
+                                }
+
+                                for _, dep := range i.Current.Dependencies {
+                                        resState.Dependencies = append(resState.Dependencies, dep.String())
+                                }
+
+                                // convert the indexes to the old style flapmap indexes
+                                idx := ""
+                                switch key.(type) {
+                                case addrs.IntKey:
+                                        // don't add numeric index values to resources with a count of 0
+                                        if len(res.Instances) > 1 {
+                                                idx = fmt.Sprintf(".%d", key)
+                                        }
+                                case addrs.StringKey:
+                                        idx = "." + key.String()
+                                }
+
+                                mod.Resources[res.Addr.String()+idx] = resState
+
+                                // add any deposed instances
+                                for _, dep := range i.Deposed {
+                                        flatmap, err := shimmedAttributes(dep, resource)
+                                        if err != nil {
+                                                return nil, fmt.Errorf("error decoding deposed state for %q: %s", resType, err)
+                                        }
+
+                                        deposed := &terraform.InstanceState{
+                                                ID:         flatmap["id"],
+                                                Attributes: flatmap,
+                                                Tainted:    dep.Status == states.ObjectTainted,
+                                        }
+                                        if dep.SchemaVersion != 0 {
+                                                deposed.Meta = map[string]interface{}{
+                                                        "schema_version": dep.SchemaVersion,
+                                                }
+                                        }
+
+                                        resState.Deposed = append(resState.Deposed, deposed)
+                                }
+                        }
+                }
+        }
+
+        return state, nil
+}
+
+func getResource(providers map[string]terraform.ResourceProvider, providerName string, addr addrs.Resource) *schema.Resource {
+        p := providers[providerName]
+        if p == nil {
+                panic(fmt.Sprintf("provider %q not found in test step", providerName))
+        }
+
+        // this is only for tests, so should only see schema.Providers
+        provider := p.(*schema.Provider)
+
+        switch addr.Mode {
+        case addrs.ManagedResourceMode:
+                resource := provider.ResourcesMap[addr.Type]
+                if resource != nil {
+                        return resource
+                }
+        case addrs.DataResourceMode:
+                resource := provider.DataSourcesMap[addr.Type]
+                if resource != nil {
+                        return resource
+                }
+        }
+
+        panic(fmt.Sprintf("resource %s not found in test step", addr.Type))
+}
+
+func shimmedAttributes(instance *states.ResourceInstanceObjectSrc, res *schema.Resource) (map[string]string, error) {
+        flatmap := instance.AttrsFlat
+        if flatmap != nil {
+                return flatmap, nil
+        }
+
+        // if we have json attrs, they need to be decoded
+        rio, err := instance.Decode(res.CoreConfigSchema().ImpliedType())
+        if err != nil {
+                return nil, err
+        }
+
+        instanceState, err := res.ShimInstanceStateFromValue(rio.Value)
+        if err != nil {
+                return nil, err
+        }
+
+        return instanceState.Attributes, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/testing.go b/vendor/github.com/hashicorp/terraform/helper/resource/testing.go
index b97673f..aa7454d 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/testing.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/testing.go
@@ -1,6 +1,7 @@
 package resource
 
 import (
+        "bytes"
         "flag"
         "fmt"
         "io"
@@ -18,9 +19,18 @@ import (
         "github.com/hashicorp/errwrap"
         "github.com/hashicorp/go-multierror"
         "github.com/hashicorp/logutils"
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/mitchellh/colorstring"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/command/format"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/configs/configload"
         "github.com/hashicorp/terraform/helper/logging"
+        "github.com/hashicorp/terraform/internal/initwd"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
         "github.com/hashicorp/terraform/terraform"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // flagSweep is a flag available when running tests on the command line. It
@@ -373,6 +383,10 @@ type TestStep struct {
         // be refreshed and don't matter.
         ImportStateVerify       bool
         ImportStateVerifyIgnore []string
+
+        // provider s is used internally to maintain a reference to the
+        // underlying providers during the tests
+        providers map[string]terraform.ResourceProvider
 }
 
 // Set to a file mask in sprintf format where %s is test name
@@ -467,10 +481,22 @@ func Test(t TestT, c TestCase) {
                 c.PreCheck()
         }
 
+        // get instances of all providers, so we can use the individual
+        // resources to shim the state during the tests.
+        providers := make(map[string]terraform.ResourceProvider)
+        for name, pf := range testProviderFactories(c) {
+                p, err := pf()
+                if err != nil {
+                        t.Fatal(err)
+                }
+                providers[name] = p
+        }
+
         providerResolver, err := testProviderResolver(c)
         if err != nil {
                 t.Fatal(err)
         }
+
         opts := terraform.ContextOpts{ProviderResolver: providerResolver}
 
         // A single state variable to track the lifecycle, starting with no state
@@ -481,6 +507,10 @@ func Test(t TestT, c TestCase) {
         idRefresh := c.IDRefreshName != ""
         errored := false
         for i, step := range c.Steps {
+                // insert the providers into the step so we can get the resources for
+                // shimming the state
+                step.providers = providers
+
                 var err error
                 log.Printf("[DEBUG] Test: Executing step %d", i)
 
@@ -535,8 +565,7 @@ func Test(t TestT, c TestCase) {
                                 }
                         } else {
                                 errored = true
-                                t.Error(fmt.Sprintf(
-                                        "Step %d error: %s", i, err))
+                                t.Error(fmt.Sprintf("Step %d error: %s", i, detailedErrorMessage(err)))
                                 break
                         }
                 }
@@ -591,6 +620,7 @@ func Test(t TestT, c TestCase) {
                         Destroy:                   true,
                         PreventDiskCleanup:        lastStep.PreventDiskCleanup,
                         PreventPostDestroyRefresh: c.PreventPostDestroyRefresh,
+                        providers:                 providers,
                 }
 
                 log.Printf("[WARN] Test: Executing destroy step")
@@ -620,39 +650,50 @@ func testProviderConfig(c TestCase) string {
         return strings.Join(lines, "")
 }
 
-// testProviderResolver is a helper to build a ResourceProviderResolver
-// with pre instantiated ResourceProviders, so that we can reset them for the
-// test, while only calling the factory function once.
-// Any errors are stored so that they can be returned by the factory in
-// terraform to match non-test behavior.
-func testProviderResolver(c TestCase) (terraform.ResourceProviderResolver, error) {
-        ctxProviders := c.ProviderFactories
-        if ctxProviders == nil {
-                ctxProviders = make(map[string]terraform.ResourceProviderFactory)
+// testProviderFactories combines the fixed Providers and
+// ResourceProviderFactory functions into a single map of
+// ResourceProviderFactory functions.
+func testProviderFactories(c TestCase) map[string]terraform.ResourceProviderFactory {
+        ctxProviders := make(map[string]terraform.ResourceProviderFactory)
+        for k, pf := range c.ProviderFactories {
+                ctxProviders[k] = pf
         }
 
         // add any fixed providers
         for k, p := range c.Providers {
                 ctxProviders[k] = terraform.ResourceProviderFactoryFixed(p)
         }
+        return ctxProviders
+}
+
+// testProviderResolver is a helper to build a ResourceProviderResolver
+// with pre instantiated ResourceProviders, so that we can reset them for the
+// test, while only calling the factory function once.
+// Any errors are stored so that they can be returned by the factory in
+// terraform to match non-test behavior.
+func testProviderResolver(c TestCase) (providers.Resolver, error) {
+        ctxProviders := testProviderFactories(c)
+
+        // wrap the old provider factories in the test grpc server so they can be
+        // called from terraform.
+        newProviders := make(map[string]providers.Factory)
 
-        // reset the providers if needed
         for k, pf := range ctxProviders {
-                // we can ignore any errors here, if we don't have a provider to reset
-                // the error will be handled later
-                p, err := pf()
-                if err != nil {
-                        return nil, err
-                }
-                if p, ok := p.(TestProvider); ok {
-                        err := p.TestReset()
+                factory := pf // must copy to ensure each closure sees its own value
+                newProviders[k] = func() (providers.Interface, error) {
+                        p, err := factory()
                         if err != nil {
-                                return nil, fmt.Errorf("[ERROR] failed to reset provider %q: %s", k, err)
+                                return nil, err
                         }
+
+                        // The provider is wrapped in a GRPCTestProvider so that it can be
+                        // passed back to terraform core as a providers.Interface, rather
+                        // than the legacy ResourceProvider.
+                        return GRPCTestProvider(p), nil
                 }
         }
 
-        return terraform.ResourceProviderResolverFixed(ctxProviders), nil
+        return providers.ResolverFixed(newProviders), nil
 }
 
 // UnitTest is a helper to force the acceptance testing harness to run in the
@@ -670,33 +711,40 @@ func testIDOnlyRefresh(c TestCase, opts terraform.ContextOpts, step TestStep, r
                 return nil
         }
 
-        name := fmt.Sprintf("%s.foo", r.Type)
+        addr := addrs.Resource{
+                Mode: addrs.ManagedResourceMode,
+                Type: r.Type,
+                Name: "foo",
+        }.Instance(addrs.NoKey)
+        absAddr := addr.Absolute(addrs.RootModuleInstance)
 
         // Build the state. The state is just the resource with an ID. There
         // are no attributes. We only set what is needed to perform a refresh.
-        state := terraform.NewState()
-        state.RootModule().Resources[name] = &terraform.ResourceState{
-                Type: r.Type,
-                Primary: &terraform.InstanceState{
-                        ID: r.Primary.ID,
+        state := states.NewState()
+        state.RootModule().SetResourceInstanceCurrent(
+                addr,
+                &states.ResourceInstanceObjectSrc{
+                        AttrsFlat: r.Primary.Attributes,
+                        Status:    states.ObjectReady,
                 },
-        }
+                addrs.ProviderConfig{Type: "placeholder"}.Absolute(addrs.RootModuleInstance),
+        )
 
         // Create the config module. We use the full config because Refresh
         // doesn't have access to it and we may need things like provider
         // configurations. The initial implementation of id-only checks used
         // an empty config module, but that caused the aforementioned problems.
-        mod, err := testModule(opts, step)
+        cfg, err := testConfig(opts, step)
         if err != nil {
                 return err
         }
 
         // Initialize the context
-        opts.Module = mod
+        opts.Config = cfg
         opts.State = state
-        ctx, err := terraform.NewContext(&opts)
-        if err != nil {
-                return err
+        ctx, ctxDiags := terraform.NewContext(&opts)
+        if ctxDiags.HasErrors() {
+                return ctxDiags.Err()
         }
         if diags := ctx.Validate(); len(diags) > 0 {
                 if diags.HasErrors() {
@@ -707,20 +755,20 @@ func testIDOnlyRefresh(c TestCase, opts terraform.ContextOpts, step TestStep, r
         }
 
         // Refresh!
-        state, err = ctx.Refresh()
-        if err != nil {
-                return fmt.Errorf("Error refreshing: %s", err)
+        state, refreshDiags := ctx.Refresh()
+        if refreshDiags.HasErrors() {
+                return refreshDiags.Err()
         }
 
         // Verify attribute equivalence.
-        actualR := state.RootModule().Resources[name]
+        actualR := state.ResourceInstance(absAddr)
         if actualR == nil {
                 return fmt.Errorf("Resource gone!")
         }
-        if actualR.Primary == nil {
+        if actualR.Current == nil {
                 return fmt.Errorf("Resource has no primary instance")
         }
-        actual := actualR.Primary.Attributes
+        actual := actualR.Current.AttrsFlat
         expected := r.Primary.Attributes
         // Remove fields we're ignoring
         for _, v := range c.IDRefreshIgnore {
@@ -756,15 +804,14 @@ func testIDOnlyRefresh(c TestCase, opts terraform.ContextOpts, step TestStep, r
         return nil
 }
 
-func testModule(opts terraform.ContextOpts, step TestStep) (*module.Tree, error) {
+func testConfig(opts terraform.ContextOpts, step TestStep) (*configs.Config, error) {
         if step.PreConfig != nil {
                 step.PreConfig()
         }
 
         cfgPath, err := ioutil.TempDir("", "tf-test")
         if err != nil {
-                return nil, fmt.Errorf(
-                        "Error creating temporary directory for config: %s", err)
+                return nil, fmt.Errorf("Error creating temporary directory for config: %s", err)
         }
 
         if step.PreventDiskCleanup {
@@ -773,38 +820,38 @@ func testModule(opts terraform.ContextOpts, step TestStep) (*module.Tree, error)
                 defer os.RemoveAll(cfgPath)
         }
 
-        // Write the configuration
-        cfgF, err := os.Create(filepath.Join(cfgPath, "main.tf"))
+        // Write the main configuration file
+        err = ioutil.WriteFile(filepath.Join(cfgPath, "main.tf"), []byte(step.Config), os.ModePerm)
         if err != nil {
-                return nil, fmt.Errorf(
-                        "Error creating temporary file for config: %s", err)
+                return nil, fmt.Errorf("Error creating temporary file for config: %s", err)
         }
 
-        _, err = io.Copy(cfgF, strings.NewReader(step.Config))
-        cfgF.Close()
+        // Create directory for our child modules, if any.
+        modulesDir := filepath.Join(cfgPath, ".modules")
+        err = os.Mkdir(modulesDir, os.ModePerm)
         if err != nil {
-                return nil, fmt.Errorf(
-                        "Error creating temporary file for config: %s", err)
+                return nil, fmt.Errorf("Error creating child modules directory: %s", err)
         }
 
-        // Parse the configuration
-        mod, err := module.NewTreeModule("", cfgPath)
-        if err != nil {
-                return nil, fmt.Errorf(
-                        "Error loading configuration: %s", err)
+        inst := initwd.NewModuleInstaller(modulesDir, nil)
+        _, installDiags := inst.InstallModules(cfgPath, true, initwd.ModuleInstallHooksImpl{})
+        if installDiags.HasErrors() {
+                return nil, installDiags.Err()
         }
 
-        // Load the modules
-        modStorage := &module.Storage{
-                StorageDir: filepath.Join(cfgPath, ".tfmodules"),
-                Mode:       module.GetModeGet,
-        }
-        err = mod.Load(modStorage)
+        loader, err := configload.NewLoader(&configload.Config{
+                ModulesDir: modulesDir,
+        })
         if err != nil {
-                return nil, fmt.Errorf("Error downloading modules: %s", err)
+                return nil, fmt.Errorf("failed to create config loader: %s", err)
+        }
+
+        config, configDiags := loader.LoadConfig(cfgPath)
+        if configDiags.HasErrors() {
+                return nil, configDiags
         }
 
-        return mod, nil
+        return config, nil
 }
 
 func testResource(c TestStep, state *terraform.State) (*terraform.ResourceState, error) {
@@ -881,8 +928,9 @@ func TestCheckResourceAttrSet(name, key string) TestCheckFunc {
 // TestCheckModuleResourceAttrSet - as per TestCheckResourceAttrSet but with
 // support for non-root modules
 func TestCheckModuleResourceAttrSet(mp []string, name string, key string) TestCheckFunc {
+        mpt := addrs.Module(mp).UnkeyedInstanceShim()
         return func(s *terraform.State) error {
-                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                is, err := modulePathPrimaryInstanceState(s, mpt, name)
                 if err != nil {
                         return err
                 }
@@ -915,8 +963,9 @@ func TestCheckResourceAttr(name, key, value string) TestCheckFunc {
 // TestCheckModuleResourceAttr - as per TestCheckResourceAttr but with
 // support for non-root modules
 func TestCheckModuleResourceAttr(mp []string, name string, key string, value string) TestCheckFunc {
+        mpt := addrs.Module(mp).UnkeyedInstanceShim()
         return func(s *terraform.State) error {
-                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                is, err := modulePathPrimaryInstanceState(s, mpt, name)
                 if err != nil {
                         return err
                 }
@@ -926,7 +975,19 @@ func TestCheckModuleResourceAttr(mp []string, name string, key string, value str
 }
 
 func testCheckResourceAttr(is *terraform.InstanceState, name string, key string, value string) error {
+        // Empty containers may be elided from the state.
+        // If the intent here is to check for an empty container, allow the key to
+        // also be non-existent.
+        emptyCheck := false
+        if value == "0" && (strings.HasSuffix(key, ".#") || strings.HasSuffix(key, ".%")) {
+                emptyCheck = true
+        }
+
         if v, ok := is.Attributes[key]; !ok || v != value {
+                if emptyCheck && !ok {
+                        return nil
+                }
+
                 if !ok {
                         return fmt.Errorf("%s: Attribute '%s' not found", name, key)
                 }
@@ -957,8 +1018,9 @@ func TestCheckNoResourceAttr(name, key string) TestCheckFunc {
 // TestCheckModuleNoResourceAttr - as per TestCheckNoResourceAttr but with
 // support for non-root modules
 func TestCheckModuleNoResourceAttr(mp []string, name string, key string) TestCheckFunc {
+        mpt := addrs.Module(mp).UnkeyedInstanceShim()
         return func(s *terraform.State) error {
-                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                is, err := modulePathPrimaryInstanceState(s, mpt, name)
                 if err != nil {
                         return err
                 }
@@ -968,7 +1030,20 @@ func TestCheckModuleNoResourceAttr(mp []string, name string, key string) TestChe
 }
 
 func testCheckNoResourceAttr(is *terraform.InstanceState, name string, key string) error {
-        if _, ok := is.Attributes[key]; ok {
+        // Empty containers may sometimes be included in the state.
+        // If the intent here is to check for an empty container, allow the value to
+        // also be "0".
+        emptyCheck := false
+        if strings.HasSuffix(key, ".#") || strings.HasSuffix(key, ".%") {
+                emptyCheck = true
+        }
+
+        val, exists := is.Attributes[key]
+        if emptyCheck && val == "0" {
+                return nil
+        }
+
+        if exists {
                 return fmt.Errorf("%s: Attribute '%s' found when not expected", name, key)
         }
 
@@ -991,8 +1066,9 @@ func TestMatchResourceAttr(name, key string, r *regexp.Regexp) TestCheckFunc {
 // TestModuleMatchResourceAttr - as per TestMatchResourceAttr but with
 // support for non-root modules
 func TestModuleMatchResourceAttr(mp []string, name string, key string, r *regexp.Regexp) TestCheckFunc {
+        mpt := addrs.Module(mp).UnkeyedInstanceShim()
         return func(s *terraform.State) error {
-                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                is, err := modulePathPrimaryInstanceState(s, mpt, name)
                 if err != nil {
                         return err
                 }
@@ -1052,13 +1128,15 @@ func TestCheckResourceAttrPair(nameFirst, keyFirst, nameSecond, keySecond string
 // TestCheckModuleResourceAttrPair - as per TestCheckResourceAttrPair but with
 // support for non-root modules
 func TestCheckModuleResourceAttrPair(mpFirst []string, nameFirst string, keyFirst string, mpSecond []string, nameSecond string, keySecond string) TestCheckFunc {
+        mptFirst := addrs.Module(mpFirst).UnkeyedInstanceShim()
+        mptSecond := addrs.Module(mpSecond).UnkeyedInstanceShim()
         return func(s *terraform.State) error {
-                isFirst, err := modulePathPrimaryInstanceState(s, mpFirst, nameFirst)
+                isFirst, err := modulePathPrimaryInstanceState(s, mptFirst, nameFirst)
                 if err != nil {
                         return err
                 }
 
-                isSecond, err := modulePathPrimaryInstanceState(s, mpSecond, nameSecond)
+                isSecond, err := modulePathPrimaryInstanceState(s, mptSecond, nameSecond)
                 if err != nil {
                         return err
                 }
@@ -1068,14 +1146,32 @@ func TestCheckModuleResourceAttrPair(mpFirst []string, nameFirst string, keyFirs
 }
 
 func testCheckResourceAttrPair(isFirst *terraform.InstanceState, nameFirst string, keyFirst string, isSecond *terraform.InstanceState, nameSecond string, keySecond string) error {
-        vFirst, ok := isFirst.Attributes[keyFirst]
-        if !ok {
-                return fmt.Errorf("%s: Attribute '%s' not found", nameFirst, keyFirst)
+        vFirst, okFirst := isFirst.Attributes[keyFirst]
+        vSecond, okSecond := isSecond.Attributes[keySecond]
+
+        // Container count values of 0 should not be relied upon, and not reliably
+        // maintained by helper/schema. For the purpose of tests, consider unset and
+        // 0 to be equal.
+        if len(keyFirst) > 2 && len(keySecond) > 2 && keyFirst[len(keyFirst)-2:] == keySecond[len(keySecond)-2:] &&
+                (strings.HasSuffix(keyFirst, ".#") || strings.HasSuffix(keyFirst, ".%")) {
+                // they have the same suffix, and it is a collection count key.
+                if vFirst == "0" || vFirst == "" {
+                        okFirst = false
+                }
+                if vSecond == "0" || vSecond == "" {
+                        okSecond = false
+                }
         }
 
-        vSecond, ok := isSecond.Attributes[keySecond]
-        if !ok {
-                return fmt.Errorf("%s: Attribute '%s' not found", nameSecond, keySecond)
+        if okFirst != okSecond {
+                if !okFirst {
+                        return fmt.Errorf("%s: Attribute %q not set, but %q is set in %s as %q", nameFirst, keyFirst, keySecond, nameSecond, vSecond)
+                }
+                return fmt.Errorf("%s: Attribute %q is %q, but %q is not set in %s", nameFirst, keyFirst, vFirst, keySecond, nameSecond)
+        }
+        if !(okFirst || okSecond) {
+                // If they both don't exist then they are equally unset, so that's okay.
+                return nil
         }
 
         if vFirst != vSecond {
@@ -1163,7 +1259,7 @@ func modulePrimaryInstanceState(s *terraform.State, ms *terraform.ModuleState, n
 
 // modulePathPrimaryInstanceState returns the primary instance state for the
 // given resource name in a given module path.
-func modulePathPrimaryInstanceState(s *terraform.State, mp []string, name string) (*terraform.InstanceState, error) {
+func modulePathPrimaryInstanceState(s *terraform.State, mp addrs.ModuleInstance, name string) (*terraform.InstanceState, error) {
         ms := s.ModuleByPath(mp)
         if ms == nil {
                 return nil, fmt.Errorf("No module found at: %s", mp)
@@ -1178,3 +1274,47 @@ func primaryInstanceState(s *terraform.State, name string) (*terraform.InstanceS
         ms := s.RootModule()
         return modulePrimaryInstanceState(s, ms, name)
 }
+
+// operationError is a specialized implementation of error used to describe
+// failures during one of the several operations performed for a particular
+// test case.
+type operationError struct {
+        OpName string
+        Diags  tfdiags.Diagnostics
+}
+
+func newOperationError(opName string, diags tfdiags.Diagnostics) error {
+        return operationError{opName, diags}
+}
+
+// Error returns a terse error string containing just the basic diagnostic
+// messages, for situations where normal Go error behavior is appropriate.
+func (err operationError) Error() string {
+        return fmt.Sprintf("errors during %s: %s", err.OpName, err.Diags.Err().Error())
+}
+
+// ErrorDetail is like Error except it includes verbosely-rendered diagnostics
+// similar to what would come from a normal Terraform run, which include
+// additional context not included in Error().
+func (err operationError) ErrorDetail() string {
+        var buf bytes.Buffer
+        fmt.Fprintf(&buf, "errors during %s:", err.OpName)
+        clr := &colorstring.Colorize{Disable: true, Colors: colorstring.DefaultColors}
+        for _, diag := range err.Diags {
+                diagStr := format.Diagnostic(diag, nil, clr, 78)
+                buf.WriteByte('\n')
+                buf.WriteString(diagStr)
+        }
+        return buf.String()
+}
+
+// detailedErrorMessage is a helper for calling ErrorDetail on an error if
+// it is an operationError or just taking Error otherwise.
+func detailedErrorMessage(err error) string {
+        switch tErr := err.(type) {
+        case operationError:
+                return tErr.ErrorDetail()
+        default:
+                return err.Error()
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go b/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go
index 033f126..311fdb6 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go
@@ -1,13 +1,23 @@
 package resource
 
 import (
+        "bufio"
+        "bytes"
         "errors"
         "fmt"
         "log"
+        "sort"
         "strings"
 
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/hashicorp/terraform/states"
+
         "github.com/hashicorp/errwrap"
+        "github.com/hashicorp/terraform/plans"
         "github.com/hashicorp/terraform/terraform"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // testStepConfig runs a config-mode test step
@@ -18,69 +28,79 @@ func testStepConfig(
         return testStep(opts, state, step)
 }
 
-func testStep(
-        opts terraform.ContextOpts,
-        state *terraform.State,
-        step TestStep) (*terraform.State, error) {
-        // Pre-taint any resources that have been defined in Taint, as long as this
-        // is not a destroy step.
+func testStep(opts terraform.ContextOpts, state *terraform.State, step TestStep) (*terraform.State, error) {
         if !step.Destroy {
                 if err := testStepTaint(state, step); err != nil {
                         return state, err
                 }
         }
 
-        mod, err := testModule(opts, step)
+        cfg, err := testConfig(opts, step)
         if err != nil {
                 return state, err
         }
 
+        var stepDiags tfdiags.Diagnostics
+
         // Build the context
-        opts.Module = mod
-        opts.State = state
-        opts.Destroy = step.Destroy
-        ctx, err := terraform.NewContext(&opts)
+        opts.Config = cfg
+        opts.State, err = terraform.ShimLegacyState(state)
         if err != nil {
-                return state, fmt.Errorf("Error initializing context: %s", err)
+                return nil, err
+        }
+
+        opts.Destroy = step.Destroy
+        ctx, stepDiags := terraform.NewContext(&opts)
+        if stepDiags.HasErrors() {
+                return state, fmt.Errorf("Error initializing context: %s", stepDiags.Err())
         }
-        if diags := ctx.Validate(); len(diags) > 0 {
-                if diags.HasErrors() {
-                        return nil, errwrap.Wrapf("config is invalid: {{err}}", diags.Err())
+        if stepDiags := ctx.Validate(); len(stepDiags) > 0 {
+                if stepDiags.HasErrors() {
+                        return state, errwrap.Wrapf("config is invalid: {{err}}", stepDiags.Err())
                 }
 
-                log.Printf("[WARN] Config warnings:\n%s", diags)
+                log.Printf("[WARN] Config warnings:\n%s", stepDiags)
         }
 
         // Refresh!
-        state, err = ctx.Refresh()
+        newState, stepDiags := ctx.Refresh()
+        // shim the state first so the test can check the state on errors
+
+        state, err = shimNewState(newState, step.providers)
         if err != nil {
-                return state, fmt.Errorf(
-                        "Error refreshing: %s", err)
+                return nil, err
+        }
+        if stepDiags.HasErrors() {
+                return state, newOperationError("refresh", stepDiags)
         }
 
         // If this step is a PlanOnly step, skip over this first Plan and subsequent
         // Apply, and use the follow up Plan that checks for perpetual diffs
         if !step.PlanOnly {
                 // Plan!
-                if p, err := ctx.Plan(); err != nil {
-                        return state, fmt.Errorf(
-                                "Error planning: %s", err)
+                if p, stepDiags := ctx.Plan(); stepDiags.HasErrors() {
+                        return state, newOperationError("plan", stepDiags)
                 } else {
-                        log.Printf("[WARN] Test: Step plan: %s", p)
+                        log.Printf("[WARN] Test: Step plan: %s", legacyPlanComparisonString(newState, p.Changes))
                 }
 
                 // We need to keep a copy of the state prior to destroying
-                // such that destroy steps can verify their behaviour in the check
+                // such that destroy steps can verify their behavior in the check
                 // function
                 stateBeforeApplication := state.DeepCopy()
 
-                // Apply!
-                state, err = ctx.Apply()
+                // Apply the diff, creating real resources.
+                newState, stepDiags = ctx.Apply()
+                // shim the state first so the test can check the state on errors
+                state, err = shimNewState(newState, step.providers)
                 if err != nil {
-                        return state, fmt.Errorf("Error applying: %s", err)
+                        return nil, err
+                }
+                if stepDiags.HasErrors() {
+                        return state, newOperationError("apply", stepDiags)
                 }
 
-                // Check! Excitement!
+                // Run any configured checks
                 if step.Check != nil {
                         if step.Destroy {
                                 if err := step.Check(stateBeforeApplication); err != nil {
@@ -96,31 +116,35 @@ func testStep(
 
         // Now, verify that Plan is now empty and we don't have a perpetual diff issue
         // We do this with TWO plans. One without a refresh.
-        var p *terraform.Plan
-        if p, err = ctx.Plan(); err != nil {
-                return state, fmt.Errorf("Error on follow-up plan: %s", err)
+        var p *plans.Plan
+        if p, stepDiags = ctx.Plan(); stepDiags.HasErrors() {
+                return state, newOperationError("follow-up plan", stepDiags)
         }
-        if p.Diff != nil && !p.Diff.Empty() {
+        if !p.Changes.Empty() {
                 if step.ExpectNonEmptyPlan {
-                        log.Printf("[INFO] Got non-empty plan, as expected:\n\n%s", p)
+                        log.Printf("[INFO] Got non-empty plan, as expected:\n\n%s", legacyPlanComparisonString(newState, p.Changes))
                 } else {
                         return state, fmt.Errorf(
-                                "After applying this step, the plan was not empty:\n\n%s", p)
+                                "After applying this step, the plan was not empty:\n\n%s", legacyPlanComparisonString(newState, p.Changes))
                 }
         }
 
         // And another after a Refresh.
         if !step.Destroy || (step.Destroy && !step.PreventPostDestroyRefresh) {
-                state, err = ctx.Refresh()
+                newState, stepDiags = ctx.Refresh()
+                if stepDiags.HasErrors() {
+                        return state, newOperationError("follow-up refresh", stepDiags)
+                }
+
+                state, err = shimNewState(newState, step.providers)
                 if err != nil {
-                        return state, fmt.Errorf(
-                                "Error on follow-up refresh: %s", err)
+                        return nil, err
                 }
         }
-        if p, err = ctx.Plan(); err != nil {
-                return state, fmt.Errorf("Error on second follow-up plan: %s", err)
+        if p, stepDiags = ctx.Plan(); stepDiags.HasErrors() {
+                return state, newOperationError("second follow-up refresh", stepDiags)
         }
-        empty := p.Diff == nil || p.Diff.Empty()
+        empty := p.Changes.Empty()
 
         // Data resources are tricky because they legitimately get instantiated
         // during refresh so that they will be already populated during the
@@ -128,35 +152,28 @@ func testStep(
         // config we'll end up wanting to destroy them again here. This is
         // acceptable and expected, and we'll treat it as "empty" for the
         // sake of this testing.
-        if step.Destroy {
+        if step.Destroy && !empty {
                 empty = true
-
-                for _, moduleDiff := range p.Diff.Modules {
-                        for k, instanceDiff := range moduleDiff.Resources {
-                                if !strings.HasPrefix(k, "data.") {
-                                        empty = false
-                                        break
-                                }
-
-                                if !instanceDiff.Destroy {
-                                        empty = false
-                                }
+                for _, change := range p.Changes.Resources {
+                        if change.Addr.Resource.Resource.Mode != addrs.DataResourceMode {
+                                empty = false
+                                break
                         }
                 }
         }
 
         if !empty {
                 if step.ExpectNonEmptyPlan {
-                        log.Printf("[INFO] Got non-empty plan, as expected:\n\n%s", p)
+                        log.Printf("[INFO] Got non-empty plan, as expected:\n\n%s", legacyPlanComparisonString(newState, p.Changes))
                 } else {
                         return state, fmt.Errorf(
                                 "After applying this step and refreshing, "+
-                                        "the plan was not empty:\n\n%s", p)
+                                        "the plan was not empty:\n\n%s", legacyPlanComparisonString(newState, p.Changes))
                 }
         }
 
         // Made it here, but expected a non-empty plan, fail!
-        if step.ExpectNonEmptyPlan && (p.Diff == nil || p.Diff.Empty()) {
+        if step.ExpectNonEmptyPlan && empty {
                 return state, fmt.Errorf("Expected a non-empty plan, but got an empty plan!")
         }
 
@@ -164,6 +181,213 @@ func testStep(
         return state, nil
 }
 
+// legacyPlanComparisonString produces a string representation of the changes
+// from a plan and a given state togther, as was formerly produced by the
+// String method of terraform.Plan.
+//
+// This is here only for compatibility with existing tests that predate our
+// new plan and state types, and should not be used in new tests. Instead, use
+// a library like "cmp" to do a deep equality  and diff on the two
+// data structures.
+func legacyPlanComparisonString(state *states.State, changes *plans.Changes) string {
+        return fmt.Sprintf(
+                "DIFF:\n\n%s\n\nSTATE:\n\n%s",
+                legacyDiffComparisonString(changes),
+                state.String(),
+        )
+}
+
+// legacyDiffComparisonString produces a string representation of the changes
+// from a planned changes object, as was formerly produced by the String method
+// of terraform.Diff.
+//
+// This is here only for compatibility with existing tests that predate our
+// new plan types, and should not be used in new tests. Instead, use a library
+// like "cmp" to do a deep equality check and diff on the two data structures.
+func legacyDiffComparisonString(changes *plans.Changes) string {
+        // The old string representation of a plan was grouped by module, but
+        // our new plan structure is not grouped in that way and so we'll need
+        // to preprocess it in order to produce that grouping.
+        type ResourceChanges struct {
+                Current *plans.ResourceInstanceChangeSrc
+                Deposed map[states.DeposedKey]*plans.ResourceInstanceChangeSrc
+        }
+        byModule := map[string]map[string]*ResourceChanges{}
+        resourceKeys := map[string][]string{}
+        requiresReplace := map[string][]string{}
+        var moduleKeys []string
+        for _, rc := range changes.Resources {
+                if rc.Action == plans.NoOp {
+                        // We won't mention no-op changes here at all, since the old plan
+                        // model we are emulating here didn't have such a concept.
+                        continue
+                }
+                moduleKey := rc.Addr.Module.String()
+                if _, exists := byModule[moduleKey]; !exists {
+                        moduleKeys = append(moduleKeys, moduleKey)
+                        byModule[moduleKey] = make(map[string]*ResourceChanges)
+                }
+                resourceKey := rc.Addr.Resource.String()
+                if _, exists := byModule[moduleKey][resourceKey]; !exists {
+                        resourceKeys[moduleKey] = append(resourceKeys[moduleKey], resourceKey)
+                        byModule[moduleKey][resourceKey] = &ResourceChanges{
+                                Deposed: make(map[states.DeposedKey]*plans.ResourceInstanceChangeSrc),
+                        }
+                }
+
+                if rc.DeposedKey == states.NotDeposed {
+                        byModule[moduleKey][resourceKey].Current = rc
+                } else {
+                        byModule[moduleKey][resourceKey].Deposed[rc.DeposedKey] = rc
+                }
+
+                rr := []string{}
+                for _, p := range rc.RequiredReplace.List() {
+                        rr = append(rr, hcl2shim.FlatmapKeyFromPath(p))
+                }
+                requiresReplace[resourceKey] = rr
+        }
+        sort.Strings(moduleKeys)
+        for _, ks := range resourceKeys {
+                sort.Strings(ks)
+        }
+
+        var buf bytes.Buffer
+
+        for _, moduleKey := range moduleKeys {
+                rcs := byModule[moduleKey]
+                var mBuf bytes.Buffer
+
+                for _, resourceKey := range resourceKeys[moduleKey] {
+                        rc := rcs[resourceKey]
+
+                        forceNewAttrs := requiresReplace[resourceKey]
+
+                        crud := "UPDATE"
+                        if rc.Current != nil {
+                                switch rc.Current.Action {
+                                case plans.DeleteThenCreate:
+                                        crud = "DESTROY/CREATE"
+                                case plans.CreateThenDelete:
+                                        crud = "CREATE/DESTROY"
+                                case plans.Delete:
+                                        crud = "DESTROY"
+                                case plans.Create:
+                                        crud = "CREATE"
+                                }
+                        } else {
+                                // We must be working on a deposed object then, in which
+                                // case destroying is the only possible action.
+                                crud = "DESTROY"
+                        }
+
+                        extra := ""
+                        if rc.Current == nil && len(rc.Deposed) > 0 {
+                                extra = " (deposed only)"
+                        }
+
+                        fmt.Fprintf(
+                                &mBuf, "%s: %s%s\n",
+                                crud, resourceKey, extra,
+                        )
+
+                        attrNames := map[string]bool{}
+                        var oldAttrs map[string]string
+                        var newAttrs map[string]string
+                        if rc.Current != nil {
+                                if before := rc.Current.Before; before != nil {
+                                        ty, err := before.ImpliedType()
+                                        if err == nil {
+                                                val, err := before.Decode(ty)
+                                                if err == nil {
+                                                        oldAttrs = hcl2shim.FlatmapValueFromHCL2(val)
+                                                        for k := range oldAttrs {
+                                                                attrNames[k] = true
+                                                        }
+                                                }
+                                        }
+                                }
+                                if after := rc.Current.After; after != nil {
+                                        ty, err := after.ImpliedType()
+                                        if err == nil {
+                                                val, err := after.Decode(ty)
+                                                if err == nil {
+                                                        newAttrs = hcl2shim.FlatmapValueFromHCL2(val)
+                                                        for k := range newAttrs {
+                                                                attrNames[k] = true
+                                                        }
+                                                }
+                                        }
+                                }
+                        }
+                        if oldAttrs == nil {
+                                oldAttrs = make(map[string]string)
+                        }
+                        if newAttrs == nil {
+                                newAttrs = make(map[string]string)
+                        }
+
+                        attrNamesOrder := make([]string, 0, len(attrNames))
+                        keyLen := 0
+                        for n := range attrNames {
+                                attrNamesOrder = append(attrNamesOrder, n)
+                                if len(n) > keyLen {
+                                        keyLen = len(n)
+                                }
+                        }
+                        sort.Strings(attrNamesOrder)
+
+                        for _, attrK := range attrNamesOrder {
+                                v := newAttrs[attrK]
+                                u := oldAttrs[attrK]
+
+                                if v == config.UnknownVariableValue {
+                                        v = "<computed>"
+                                }
+                                // NOTE: we don't support <sensitive> here because we would
+                                // need schema to do that. Excluding sensitive values
+                                // is now done at the UI layer, and so should not be tested
+                                // at the core layer.
+
+                                updateMsg := ""
+
+                                // This may not be as precise as in the old diff, as it matches
+                                // everything under the attribute that was originally marked as
+                                // ForceNew, but should help make it easier to determine what
+                                // caused replacement here.
+                                for _, k := range forceNewAttrs {
+                                        if strings.HasPrefix(attrK, k) {
+                                                updateMsg = " (forces new resource)"
+                                                break
+                                        }
+                                }
+
+                                fmt.Fprintf(
+                                        &mBuf, "  %s:%s %#v => %#v%s\n",
+                                        attrK,
+                                        strings.Repeat(" ", keyLen-len(attrK)),
+                                        u, v,
+                                        updateMsg,
+                                )
+                        }
+                }
+
+                if moduleKey == "" { // root module
+                        buf.Write(mBuf.Bytes())
+                        buf.WriteByte('\n')
+                        continue
+                }
+
+                fmt.Fprintf(&buf, "%s:\n", moduleKey)
+                s := bufio.NewScanner(&mBuf)
+                for s.Scan() {
+                        buf.WriteString(fmt.Sprintf("  %s\n", s.Text()))
+                }
+        }
+
+        return buf.String()
+}
+
 func testStepTaint(state *terraform.State, step TestStep) error {
         for _, p := range step.Taint {
                 m := state.RootModule()
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go b/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go
index 94fef3c..e1b7aea 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go
@@ -7,6 +7,12 @@ import (
         "strings"
 
         "github.com/davecgh/go-spew/spew"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/helper/schema"
+        "github.com/hashicorp/terraform/states"
         "github.com/hashicorp/terraform/terraform"
 )
 
@@ -15,6 +21,7 @@ func testStepImportState(
         opts terraform.ContextOpts,
         state *terraform.State,
         step TestStep) (*terraform.State, error) {
+
         // Determine the ID to import
         var importId string
         switch {
@@ -41,33 +48,53 @@ func testStepImportState(
 
         // Setup the context. We initialize with an empty state. We use the
         // full config for provider configurations.
-        mod, err := testModule(opts, step)
+        cfg, err := testConfig(opts, step)
         if err != nil {
                 return state, err
         }
 
-        opts.Module = mod
-        opts.State = terraform.NewState()
-        ctx, err := terraform.NewContext(&opts)
-        if err != nil {
-                return state, err
+        opts.Config = cfg
+
+        // import tests start with empty state
+        opts.State = states.NewState()
+
+        ctx, stepDiags := terraform.NewContext(&opts)
+        if stepDiags.HasErrors() {
+                return state, stepDiags.Err()
         }
 
-        // Do the import!
-        newState, err := ctx.Import(&terraform.ImportOpts{
+        // The test step provides the resource address as a string, so we need
+        // to parse it to get an addrs.AbsResourceAddress to pass in to the
+        // import method.
+        traversal, hclDiags := hclsyntax.ParseTraversalAbs([]byte(step.ResourceName), "", hcl.Pos{})
+        if hclDiags.HasErrors() {
+                return nil, hclDiags
+        }
+        importAddr, stepDiags := addrs.ParseAbsResourceInstance(traversal)
+        if stepDiags.HasErrors() {
+                return nil, stepDiags.Err()
+        }
+
+        // Do the import
+        importedState, stepDiags := ctx.Import(&terraform.ImportOpts{
                 // Set the module so that any provider config is loaded
-                Module: mod,
+                Config: cfg,
 
                 Targets: []*terraform.ImportTarget{
                         &terraform.ImportTarget{
-                                Addr: step.ResourceName,
+                                Addr: importAddr,
                                 ID:   importId,
                         },
                 },
         })
+        if stepDiags.HasErrors() {
+                log.Printf("[ERROR] Test: ImportState failure: %s", stepDiags.Err())
+                return state, stepDiags.Err()
+        }
+
+        newState, err := shimNewState(importedState, step.providers)
         if err != nil {
-                log.Printf("[ERROR] Test: ImportState failure: %s", err)
-                return state, err
+                return nil, err
         }
 
         // Go through the new state and verify
@@ -75,7 +102,9 @@ func testStepImportState(
                 var states []*terraform.InstanceState
                 for _, r := range newState.RootModule().Resources {
                         if r.Primary != nil {
-                                states = append(states, r.Primary)
+                                is := r.Primary.DeepCopy()
+                                is.Ephemeral.Type = r.Type // otherwise the check function cannot see the type
+                                states = append(states, is)
                         }
                 }
                 if err := step.ImportStateCheck(states); err != nil {
@@ -102,30 +131,84 @@ func testStepImportState(
                                         r.Primary.ID)
                         }
 
+                        // We'll try our best to find the schema for this resource type
+                        // so we can ignore Removed fields during validation. If we fail
+                        // to find the schema then we won't ignore them and so the test
+                        // will need to rely on explicit ImportStateVerifyIgnore, though
+                        // this shouldn't happen in any reasonable case.
+                        var rsrcSchema *schema.Resource
+                        if providerAddr, diags := addrs.ParseAbsProviderConfigStr(r.Provider); !diags.HasErrors() {
+                                providerType := providerAddr.ProviderConfig.Type
+                                if provider, ok := step.providers[providerType]; ok {
+                                        if provider, ok := provider.(*schema.Provider); ok {
+                                                rsrcSchema = provider.ResourcesMap[r.Type]
+                                        }
+                                }
+                        }
+
+                        // don't add empty flatmapped containers, so we can more easily
+                        // compare the attributes
+                        skipEmpty := func(k, v string) bool {
+                                if strings.HasSuffix(k, ".#") || strings.HasSuffix(k, ".%") {
+                                        if v == "0" {
+                                                return true
+                                        }
+                                }
+                                return false
+                        }
+
                         // Compare their attributes
                         actual := make(map[string]string)
                         for k, v := range r.Primary.Attributes {
+                                if skipEmpty(k, v) {
+                                        continue
+                                }
                                 actual[k] = v
                         }
+
                         expected := make(map[string]string)
                         for k, v := range oldR.Primary.Attributes {
+                                if skipEmpty(k, v) {
+                                        continue
+                                }
                                 expected[k] = v
                         }
 
                         // Remove fields we're ignoring
                         for _, v := range step.ImportStateVerifyIgnore {
-                                for k, _ := range actual {
+                                for k := range actual {
                                         if strings.HasPrefix(k, v) {
                                                 delete(actual, k)
                                         }
                                 }
-                                for k, _ := range expected {
+                                for k := range expected {
                                         if strings.HasPrefix(k, v) {
                                                 delete(expected, k)
                                         }
                                 }
                         }
 
+                        // Also remove any attributes that are marked as "Removed" in the
+                        // schema, if we have a schema to check that against.
+                        if rsrcSchema != nil {
+                                for k := range actual {
+                                        for _, schema := range rsrcSchema.SchemasForFlatmapPath(k) {
+                                                if schema.Removed != "" {
+                                                        delete(actual, k)
+                                                        break
+                                                }
+                                        }
+                                }
+                                for k := range expected {
+                                        for _, schema := range rsrcSchema.SchemasForFlatmapPath(k) {
+                                                if schema.Removed != "" {
+                                                        delete(expected, k)
+                                                        break
+                                                }
+                                        }
+                                }
+                        }
+
                         if !reflect.DeepEqual(actual, expected) {
                                 // Determine only the different attributes
                                 for k, v := range expected {