9 files changed, 204 insertions, 67 deletions

diff --git a/vendor/github.com/hashicorp/terraform/helper/plugin/grpc_provider.go b/vendor/github.com/hashicorp/terraform/helper/plugin/grpc_provider.go
index 510f47f..104c8f5 100644
--- a/vendor/github.com/hashicorp/terraform/helper/plugin/grpc_provider.go
+++ b/vendor/github.com/hashicorp/terraform/helper/plugin/grpc_provider.go
@@ -2,7 +2,6 @@ package plugin
 
 import (
         "encoding/json"
-        "errors"
         "fmt"
         "log"
         "strconv"
@@ -16,6 +15,7 @@ import (
         "github.com/hashicorp/terraform/configs/configschema"
         "github.com/hashicorp/terraform/helper/schema"
         proto "github.com/hashicorp/terraform/internal/tfplugin5"
+        "github.com/hashicorp/terraform/plans/objchange"
         "github.com/hashicorp/terraform/plugin/convert"
         "github.com/hashicorp/terraform/terraform"
 )
@@ -284,6 +284,17 @@ func (s *GRPCProviderServer) UpgradeResourceState(_ context.Context, req *proto.
                 return resp, nil
         }
 
+        // Now we need to make sure blocks are represented correctly, which means
+        // that missing blocks are empty collections, rather than null.
+        // First we need to CoerceValue to ensure that all object types match.
+        val, err = schemaBlock.CoerceValue(val)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+        // Normalize the value and fill in any missing blocks.
+        val = objchange.NormalizeObjectFromLegacySDK(val, schemaBlock)
+
         // encode the final state to the expected msgpack format
         newStateMP, err := msgpack.Marshal(val, schemaBlock.ImpliedType())
         if err != nil {
@@ -316,11 +327,15 @@ func (s *GRPCProviderServer) upgradeFlatmapState(version int, m map[string]strin
                 requiresMigrate = version < res.StateUpgraders[0].Version
         }
 
-        if requiresMigrate {
-                if res.MigrateState == nil {
-                        return nil, 0, errors.New("cannot upgrade state, missing MigrateState function")
+        if requiresMigrate && res.MigrateState == nil {
+                // Providers were previously allowed to bump the version
+                // without declaring MigrateState.
+                // If there are further upgraders, then we've only updated that far.
+                if len(res.StateUpgraders) > 0 {
+                        schemaType = res.StateUpgraders[0].Type
+                        upgradedVersion = res.StateUpgraders[0].Version
                 }
-
+        } else if requiresMigrate {
                 is := &terraform.InstanceState{
                         ID:         m["id"],
                         Attributes: m,
@@ -476,7 +491,12 @@ func (s *GRPCProviderServer) Configure(_ context.Context, req *proto.Configure_R
 }
 
 func (s *GRPCProviderServer) ReadResource(_ context.Context, req *proto.ReadResource_Request) (*proto.ReadResource_Response, error) {
-        resp := &proto.ReadResource_Response{}
+        resp := &proto.ReadResource_Response{
+                // helper/schema did previously handle private data during refresh, but
+                // core is now going to expect this to be maintained in order to
+                // persist it in the state.
+                Private: req.Private,
+        }
 
         res := s.provider.ResourcesMap[req.TypeName]
         schemaBlock := s.getResourceSchemaBlock(req.TypeName)
@@ -493,6 +513,15 @@ func (s *GRPCProviderServer) ReadResource(_ context.Context, req *proto.ReadReso
                 return resp, nil
         }
 
+        private := make(map[string]interface{})
+        if len(req.Private) > 0 {
+                if err := json.Unmarshal(req.Private, &private); err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+        }
+        instanceState.Meta = private
+
         newInstanceState, err := res.RefreshWithoutUpgrade(instanceState, s.provider.Meta())
         if err != nil {
                 resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
@@ -569,6 +598,7 @@ func (s *GRPCProviderServer) PlanResourceChange(_ context.Context, req *proto.Pl
         // We don't usually plan destroys, but this can return early in any case.
         if proposedNewStateVal.IsNull() {
                 resp.PlannedState = req.ProposedNewState
+                resp.PlannedPrivate = req.PriorPrivate
                 return resp, nil
         }
 
@@ -623,6 +653,7 @@ func (s *GRPCProviderServer) PlanResourceChange(_ context.Context, req *proto.Pl
                 // description that _shows_ there are no changes. This is always the
                 // prior state, because we force a diff above if this is a new instance.
                 resp.PlannedState = req.PriorState
+                resp.PlannedPrivate = req.PriorPrivate
                 return resp, nil
         }
 
@@ -683,6 +714,18 @@ func (s *GRPCProviderServer) PlanResourceChange(_ context.Context, req *proto.Pl
                 Msgpack: plannedMP,
         }
 
+        // encode any timeouts into the diff Meta
+        t := &schema.ResourceTimeout{}
+        if err := t.ConfigDecode(res, cfg); err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        if err := t.DiffEncode(diff); err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
         // Now we need to store any NewExtra values, which are where any actual
         // StateFunc modified config fields are hidden.
         privateMap := diff.Meta
@@ -929,6 +972,9 @@ func (s *GRPCProviderServer) ImportResourceState(_ context.Context, req *proto.I
                         return resp, nil
                 }
 
+                // Normalize the value and fill in any missing blocks.
+                newStateVal = objchange.NormalizeObjectFromLegacySDK(newStateVal, schemaBlock)
+
                 newStateMP, err := msgpack.Marshal(newStateVal, schemaBlock.ImpliedType())
                 if err != nil {
                         resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
@@ -1160,6 +1206,8 @@ func normalizeNullValues(dst, src cty.Value, apply bool) cty.Value {
                 }
         }
 
+        // check the invariants that we need below, to ensure we are working with
+        // non-null and known values.
         if src.IsNull() || !src.IsKnown() || !dst.IsKnown() {
                 return dst
         }
@@ -1278,8 +1326,12 @@ func normalizeNullValues(dst, src cty.Value, apply bool) cty.Value {
                         return cty.ListVal(dsts)
                 }
 
-        case ty.IsPrimitiveType():
-                if dst.IsNull() && src.IsWhollyKnown() && apply {
+        case ty == cty.String:
+                // The legacy SDK should not be able to remove a value during plan or
+                // apply, however we are only going to overwrite this if the source was
+                // an empty string, since that is what is often equated with unset and
+                // lost in the diff process.
+                if dst.IsNull() && src.AsString() == "" {
                         return src
                 }
         }
@@ -1305,11 +1357,19 @@ func validateConfigNulls(v cty.Value, path cty.Path) []*proto.Diagnostic {
                 for it.Next() {
                         kv, ev := it.Element()
                         if ev.IsNull() {
+                                // if this is a set, the kv is also going to be null which
+                                // isn't a valid path element, so we can't append it to the
+                                // diagnostic.
+                                p := path
+                                if !kv.IsNull() {
+                                        p = append(p, cty.IndexStep{Key: kv})
+                                }
+
                                 diags = append(diags, &proto.Diagnostic{
                                         Severity:  proto.Diagnostic_ERROR,
                                         Summary:   "Null value found in list",
                                         Detail:    "Null values are not allowed for this attribute value.",
-                                        Attribute: convert.PathToAttributePath(append(path, cty.IndexStep{Key: kv})),
+                                        Attribute: convert.PathToAttributePath(p),
                                 })
                                 continue
                         }
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/state_shim.go b/vendor/github.com/hashicorp/terraform/helper/resource/state_shim.go
index b2aff99..f488207 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/state_shim.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/state_shim.go
@@ -1,6 +1,7 @@
 package resource
 
 import (
+        "encoding/json"
         "fmt"
 
         "github.com/hashicorp/terraform/addrs"
@@ -52,43 +53,57 @@ func shimNewState(newState *states.State, providers map[string]terraform.Resourc
                         resource := getResource(providers, providerType, res.Addr)
 
                         for key, i := range res.Instances {
-                                flatmap, err := shimmedAttributes(i.Current, resource)
-                                if err != nil {
-                                        return nil, fmt.Errorf("error decoding state for %q: %s", resType, err)
+                                resState := &terraform.ResourceState{
+                                        Type:     resType,
+                                        Provider: res.ProviderConfig.String(),
                                 }
 
-                                resState := &terraform.ResourceState{
-                                        Type: resType,
-                                        Primary: &terraform.InstanceState{
+                                // We should always have a Current instance here, but be safe about checking.
+                                if i.Current != nil {
+                                        flatmap, err := shimmedAttributes(i.Current, resource)
+                                        if err != nil {
+                                                return nil, fmt.Errorf("error decoding state for %q: %s", resType, err)
+                                        }
+
+                                        var meta map[string]interface{}
+                                        if i.Current.Private != nil {
+                                                err := json.Unmarshal(i.Current.Private, &meta)
+                                                if err != nil {
+                                                        return nil, err
+                                                }
+                                        }
+
+                                        resState.Primary = &terraform.InstanceState{
                                                 ID:         flatmap["id"],
                                                 Attributes: flatmap,
                                                 Tainted:    i.Current.Status == states.ObjectTainted,
-                                        },
-                                        Provider: res.ProviderConfig.String(),
-                                }
-                                if i.Current.SchemaVersion != 0 {
-                                        resState.Primary.Meta = map[string]interface{}{
-                                                "schema_version": i.Current.SchemaVersion,
+                                                Meta:       meta,
                                         }
-                                }
 
-                                for _, dep := range i.Current.Dependencies {
-                                        resState.Dependencies = append(resState.Dependencies, dep.String())
-                                }
+                                        if i.Current.SchemaVersion != 0 {
+                                                resState.Primary.Meta = map[string]interface{}{
+                                                        "schema_version": i.Current.SchemaVersion,
+                                                }
+                                        }
 
-                                // convert the indexes to the old style flapmap indexes
-                                idx := ""
-                                switch key.(type) {
-                                case addrs.IntKey:
-                                        // don't add numeric index values to resources with a count of 0
-                                        if len(res.Instances) > 1 {
-                                                idx = fmt.Sprintf(".%d", key)
+                                        for _, dep := range i.Current.Dependencies {
+                                                resState.Dependencies = append(resState.Dependencies, dep.String())
                                         }
-                                case addrs.StringKey:
-                                        idx = "." + key.String()
-                                }
 
-                                mod.Resources[res.Addr.String()+idx] = resState
+                                        // convert the indexes to the old style flapmap indexes
+                                        idx := ""
+                                        switch key.(type) {
+                                        case addrs.IntKey:
+                                                // don't add numeric index values to resources with a count of 0
+                                                if len(res.Instances) > 1 {
+                                                        idx = fmt.Sprintf(".%d", key)
+                                                }
+                                        case addrs.StringKey:
+                                                idx = "." + key.String()
+                                        }
+
+                                        mod.Resources[res.Addr.String()+idx] = resState
+                                }
 
                                 // add any deposed instances
                                 for _, dep := range i.Deposed {
@@ -97,10 +112,19 @@ func shimNewState(newState *states.State, providers map[string]terraform.Resourc
                                                 return nil, fmt.Errorf("error decoding deposed state for %q: %s", resType, err)
                                         }
 
+                                        var meta map[string]interface{}
+                                        if dep.Private != nil {
+                                                err := json.Unmarshal(dep.Private, &meta)
+                                                if err != nil {
+                                                        return nil, err
+                                                }
+                                        }
+
                                         deposed := &terraform.InstanceState{
                                                 ID:         flatmap["id"],
                                                 Attributes: flatmap,
                                                 Tainted:    dep.Status == states.ObjectTainted,
+                                                Meta:       meta,
                                         }
                                         if dep.SchemaVersion != 0 {
                                                 deposed.Meta = map[string]interface{}{
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go b/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go
index 311fdb6..f34e17a 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go
@@ -10,7 +10,6 @@ import (
         "strings"
 
         "github.com/hashicorp/terraform/addrs"
-        "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/config/hcl2shim"
         "github.com/hashicorp/terraform/states"
 
@@ -341,7 +340,7 @@ func legacyDiffComparisonString(changes *plans.Changes) string {
                                 v := newAttrs[attrK]
                                 u := oldAttrs[attrK]
 
-                                if v == config.UnknownVariableValue {
+                                if v == hcl2shim.UnknownVariableValue {
                                         v = "<computed>"
                                 }
                                 // NOTE: we don't support <sensitive> here because we would
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go
index 808375c..6ad3f13 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go
@@ -219,6 +219,9 @@ func (r *ConfigFieldReader) readMap(k string, schema *Schema) (FieldReadResult,
                         v, _ := r.Config.Get(key)
                         result[ik] = v
                 }
+        case nil:
+                // the map may have been empty on the configuration, so we leave the
+                // empty result
         default:
                 panic(fmt.Sprintf("unknown type: %#v", mraw))
         }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go
index ae35b4a..3e70acf 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go
@@ -95,7 +95,9 @@ func (r *DiffFieldReader) readMap(
                 return FieldReadResult{}, err
         }
         if source.Exists {
-                result = source.Value.(map[string]interface{})
+                // readMap may return a nil value, or an unknown value placeholder in
+                // some cases, causing the type assertion to panic if we don't assign the ok value
+                result, _ = source.Value.(map[string]interface{})
                 resultSet = true
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
index b5e3065..b59e4e8 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
@@ -95,9 +95,10 @@ type Resource struct {
         //
         // Exists is a function that is called to check if a resource still
         // exists. If this returns false, then this will affect the diff
-        // accordingly. If this function isn't set, it will not be called. It
-        // is highly recommended to set it. The *ResourceData passed to Exists
-        // should _not_ be modified.
+        // accordingly. If this function isn't set, it will not be called. You
+        // can also signal existence in the Read method by calling d.SetId("")
+        // if the Resource is no longer present and should be removed from state.
+        // The *ResourceData passed to Exists should _not_ be modified.
         Create CreateFunc
         Read   ReadFunc
         Update UpdateFunc
@@ -329,21 +330,13 @@ func (r *Resource) simpleDiff(
         c *terraform.ResourceConfig,
         meta interface{}) (*terraform.InstanceDiff, error) {
 
-        t := &ResourceTimeout{}
-        err := t.ConfigDecode(r, c)
-
-        if err != nil {
-                return nil, fmt.Errorf("[ERR] Error decoding timeout: %s", err)
-        }
-
         instanceDiff, err := schemaMap(r.Schema).Diff(s, c, r.CustomizeDiff, meta, false)
         if err != nil {
                 return instanceDiff, err
         }
 
         if instanceDiff == nil {
-                log.Printf("[DEBUG] Instance Diff is nil in SimpleDiff()")
-                return nil, err
+                instanceDiff = terraform.NewInstanceDiff()
         }
 
         // Make sure the old value is set in each of the instance diffs.
@@ -357,10 +350,7 @@ func (r *Resource) simpleDiff(
                 }
         }
 
-        if err := t.DiffEncode(instanceDiff); err != nil {
-                log.Printf("[ERR] Error encoding timeout to instance diff: %s", err)
-        }
-        return instanceDiff, err
+        return instanceDiff, nil
 }
 
 // Validate validates the resource configuration against the schema.
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource_timeout.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource_timeout.go
index 9e422c1..222b2cc 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/resource_timeout.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource_timeout.go
@@ -5,7 +5,7 @@ import (
         "log"
         "time"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/config/hcl2shim"
         "github.com/hashicorp/terraform/terraform"
         "github.com/mitchellh/copystructure"
 )
@@ -70,7 +70,7 @@ func (t *ResourceTimeout) ConfigDecode(s *Resource, c *terraform.ResourceConfig)
                 case []map[string]interface{}:
                         rawTimeouts = raw
                 case string:
-                        if raw == config.UnknownVariableValue {
+                        if raw == hcl2shim.UnknownVariableValue {
                                 // Timeout is not defined in the config
                                 // Defaults will be used instead
                                 return nil
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/schema.go b/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
index 6a3c15a..bcc8e4b 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
@@ -22,7 +22,7 @@ import (
         "strings"
         "sync"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/config/hcl2shim"
         "github.com/hashicorp/terraform/terraform"
         "github.com/mitchellh/copystructure"
         "github.com/mitchellh/mapstructure"
@@ -1365,10 +1365,15 @@ func (m schemaMap) validate(
                         "%q: this field cannot be set", k)}
         }
 
-        if raw == config.UnknownVariableValue {
-                // If the value is unknown then we can't validate it yet.
-                // In particular, this avoids spurious type errors where downstream
-                // validation code sees UnknownVariableValue as being just a string.
+        // If the value is unknown then we can't validate it yet.
+        // In particular, this avoids spurious type errors where downstream
+        // validation code sees UnknownVariableValue as being just a string.
+        // The SDK has to allow the unknown value through initially, so that
+        // Required fields set via an interpolated value are accepted.
+        if !isWhollyKnown(raw) {
+                if schema.Deprecated != "" {
+                        return []string{fmt.Sprintf("%q: [DEPRECATED] %s", k, schema.Deprecated)}, nil
+                }
                 return nil, nil
         }
 
@@ -1380,6 +1385,28 @@ func (m schemaMap) validate(
         return m.validateType(k, raw, schema, c)
 }
 
+// isWhollyKnown returns false if the argument contains an UnknownVariableValue
+func isWhollyKnown(raw interface{}) bool {
+        switch raw := raw.(type) {
+        case string:
+                if raw == hcl2shim.UnknownVariableValue {
+                        return false
+                }
+        case []interface{}:
+                for _, v := range raw {
+                        if !isWhollyKnown(v) {
+                                return false
+                        }
+                }
+        case map[string]interface{}:
+                for _, v := range raw {
+                        if !isWhollyKnown(v) {
+                                return false
+                        }
+                }
+        }
+        return true
+}
 func (m schemaMap) validateConflictingAttributes(
         k string,
         schema *Schema,
@@ -1391,7 +1418,7 @@ func (m schemaMap) validateConflictingAttributes(
 
         for _, conflictingKey := range schema.ConflictsWith {
                 if raw, ok := c.Get(conflictingKey); ok {
-                        if raw == config.UnknownVariableValue {
+                        if raw == hcl2shim.UnknownVariableValue {
                                 // An unknown value might become unset (null) once known, so
                                 // we must defer validation until it's known.
                                 continue
@@ -1411,11 +1438,16 @@ func (m schemaMap) validateList(
         c *terraform.ResourceConfig) ([]string, []error) {
         // first check if the list is wholly unknown
         if s, ok := raw.(string); ok {
-                if s == config.UnknownVariableValue {
+                if s == hcl2shim.UnknownVariableValue {
                         return nil, nil
                 }
         }
 
+        // schemaMap can't validate nil
+        if raw == nil {
+                return nil, nil
+        }
+
         // We use reflection to verify the slice because you can't
         // case to []interface{} unless the slice is exactly that type.
         rawV := reflect.ValueOf(raw)
@@ -1432,6 +1464,15 @@ func (m schemaMap) validateList(
                         "%s: should be a list", k)}
         }
 
+        // We can't validate list length if this came from a dynamic block.
+        // Since there's no way to determine if something was from a dynamic block
+        // at this point, we're going to skip validation in the new protocol if
+        // there are any unknowns. Validate will eventually be called again once
+        // all values are known.
+        if isProto5() && !isWhollyKnown(raw) {
+                return nil, nil
+        }
+
         // Validate length
         if schema.MaxItems > 0 && rawV.Len() > schema.MaxItems {
                 return nil, []error{fmt.Errorf(
@@ -1489,11 +1530,15 @@ func (m schemaMap) validateMap(
         c *terraform.ResourceConfig) ([]string, []error) {
         // first check if the list is wholly unknown
         if s, ok := raw.(string); ok {
-                if s == config.UnknownVariableValue {
+                if s == hcl2shim.UnknownVariableValue {
                         return nil, nil
                 }
         }
 
+        // schemaMap can't validate nil
+        if raw == nil {
+                return nil, nil
+        }
         // We use reflection to verify the slice because you can't
         // case to []interface{} unless the slice is exactly that type.
         rawV := reflect.ValueOf(raw)
@@ -1620,6 +1665,12 @@ func (m schemaMap) validateObject(
         schema map[string]*Schema,
         c *terraform.ResourceConfig) ([]string, []error) {
         raw, _ := c.Get(k)
+
+        // schemaMap can't validate nil
+        if raw == nil {
+                return nil, nil
+        }
+
         if _, ok := raw.(map[string]interface{}); !ok && !c.IsComputed(k) {
                 return nil, []error{fmt.Errorf(
                         "%s: expected object, got %s",
@@ -1664,6 +1715,14 @@ func (m schemaMap) validatePrimitive(
         raw interface{},
         schema *Schema,
         c *terraform.ResourceConfig) ([]string, []error) {
+
+        // a nil value shouldn't happen in the old protocol, and in the new
+        // protocol the types have already been validated. Either way, we can't
+        // reflect on nil, so don't panic.
+        if raw == nil {
+                return nil, nil
+        }
+
         // Catch if the user gave a complex type where a primitive was
         // expected, so we can return a friendly error message that
         // doesn't contain Go type system terminology.
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/shims.go b/vendor/github.com/hashicorp/terraform/helper/schema/shims.go
index 203d017..988573e 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/shims.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/shims.go
@@ -6,7 +6,7 @@ import (
         "github.com/zclconf/go-cty/cty"
         ctyjson "github.com/zclconf/go-cty/cty/json"
 
-        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/config/hcl2shim"
         "github.com/hashicorp/terraform/configs/configschema"
         "github.com/hashicorp/terraform/terraform"
 )
@@ -50,7 +50,7 @@ func removeConfigUnknowns(cfg map[string]interface{}) {
         for k, v := range cfg {
                 switch v := v.(type) {
                 case string:
-                        if v == config.UnknownVariableValue {
+                        if v == hcl2shim.UnknownVariableValue {
                                 delete(cfg, k)
                         }
                 case []interface{}: