30 files changed, 3539 insertions, 325 deletions

diff --git a/vendor/github.com/hashicorp/terraform/helper/didyoumean/name_suggestion.go b/vendor/github.com/hashicorp/terraform/helper/didyoumean/name_suggestion.go
new file mode 100644
index 0000000..54899bc
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/didyoumean/name_suggestion.go
@@ -0,0 +1,24 @@
+package didyoumean
+
+import (
+        "github.com/agext/levenshtein"
+)
+
+// NameSuggestion tries to find a name from the given slice of suggested names
+// that is close to the given name and returns it if found. If no suggestion
+// is close enough, returns the empty string.
+//
+// The suggestions are tried in order, so earlier suggestions take precedence
+// if the given string is similar to two or more suggestions.
+//
+// This function is intended to be used with a relatively-small number of
+// suggestions. It's not optimized for hundreds or thousands of them.
+func NameSuggestion(given string, suggestions []string) string {
+        for _, suggestion := range suggestions {
+                dist := levenshtein.Distance(given, suggestion, nil)
+                if dist < 3 { // threshold determined experimentally
+                        return suggestion
+                }
+        }
+        return ""
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/plugin/doc.go b/vendor/github.com/hashicorp/terraform/helper/plugin/doc.go
new file mode 100644
index 0000000..82b5937
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/plugin/doc.go
@@ -0,0 +1,6 @@
+// Package plugin contains types and functions to help Terraform plugins
+// implement the plugin rpc interface.
+// The primary Provider type will be responsible for converting from the grpc
+// wire protocol to the types and methods known to the provider
+// implementations.
+package plugin
diff --git a/vendor/github.com/hashicorp/terraform/helper/plugin/grpc_provider.go b/vendor/github.com/hashicorp/terraform/helper/plugin/grpc_provider.go
new file mode 100644
index 0000000..510f47f
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/plugin/grpc_provider.go
@@ -0,0 +1,1338 @@
+package plugin
+
+import (
+        "encoding/json"
+        "errors"
+        "fmt"
+        "log"
+        "strconv"
+
+        "github.com/zclconf/go-cty/cty"
+        ctyconvert "github.com/zclconf/go-cty/cty/convert"
+        "github.com/zclconf/go-cty/cty/msgpack"
+        context "golang.org/x/net/context"
+
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/helper/schema"
+        proto "github.com/hashicorp/terraform/internal/tfplugin5"
+        "github.com/hashicorp/terraform/plugin/convert"
+        "github.com/hashicorp/terraform/terraform"
+)
+
+const newExtraKey = "_new_extra_shim"
+
+// NewGRPCProviderServerShim wraps a terraform.ResourceProvider in a
+// proto.ProviderServer implementation. If the provided provider is not a
+// *schema.Provider, this will return nil,
+func NewGRPCProviderServerShim(p terraform.ResourceProvider) *GRPCProviderServer {
+        sp, ok := p.(*schema.Provider)
+        if !ok {
+                return nil
+        }
+
+        return &GRPCProviderServer{
+                provider: sp,
+        }
+}
+
+// GRPCProviderServer handles the server, or plugin side of the rpc connection.
+type GRPCProviderServer struct {
+        provider *schema.Provider
+}
+
+func (s *GRPCProviderServer) GetSchema(_ context.Context, req *proto.GetProviderSchema_Request) (*proto.GetProviderSchema_Response, error) {
+        // Here we are certain that the provider is being called through grpc, so
+        // make sure the feature flag for helper/schema is set
+        schema.SetProto5()
+
+        resp := &proto.GetProviderSchema_Response{
+                ResourceSchemas:   make(map[string]*proto.Schema),
+                DataSourceSchemas: make(map[string]*proto.Schema),
+        }
+
+        resp.Provider = &proto.Schema{
+                Block: convert.ConfigSchemaToProto(s.getProviderSchemaBlock()),
+        }
+
+        for typ, res := range s.provider.ResourcesMap {
+                resp.ResourceSchemas[typ] = &proto.Schema{
+                        Version: int64(res.SchemaVersion),
+                        Block:   convert.ConfigSchemaToProto(res.CoreConfigSchema()),
+                }
+        }
+
+        for typ, dat := range s.provider.DataSourcesMap {
+                resp.DataSourceSchemas[typ] = &proto.Schema{
+                        Version: int64(dat.SchemaVersion),
+                        Block:   convert.ConfigSchemaToProto(dat.CoreConfigSchema()),
+                }
+        }
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) getProviderSchemaBlock() *configschema.Block {
+        return schema.InternalMap(s.provider.Schema).CoreConfigSchema()
+}
+
+func (s *GRPCProviderServer) getResourceSchemaBlock(name string) *configschema.Block {
+        res := s.provider.ResourcesMap[name]
+        return res.CoreConfigSchema()
+}
+
+func (s *GRPCProviderServer) getDatasourceSchemaBlock(name string) *configschema.Block {
+        dat := s.provider.DataSourcesMap[name]
+        return dat.CoreConfigSchema()
+}
+
+func (s *GRPCProviderServer) PrepareProviderConfig(_ context.Context, req *proto.PrepareProviderConfig_Request) (*proto.PrepareProviderConfig_Response, error) {
+        resp := &proto.PrepareProviderConfig_Response{}
+
+        schemaBlock := s.getProviderSchemaBlock()
+
+        configVal, err := msgpack.Unmarshal(req.Config.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // lookup any required, top-level attributes that are Null, and see if we
+        // have a Default value available.
+        configVal, err = cty.Transform(configVal, func(path cty.Path, val cty.Value) (cty.Value, error) {
+                // we're only looking for top-level attributes
+                if len(path) != 1 {
+                        return val, nil
+                }
+
+                // nothing to do if we already have a value
+                if !val.IsNull() {
+                        return val, nil
+                }
+
+                // get the Schema definition for this attribute
+                getAttr, ok := path[0].(cty.GetAttrStep)
+                // these should all exist, but just ignore anything strange
+                if !ok {
+                        return val, nil
+                }
+
+                attrSchema := s.provider.Schema[getAttr.Name]
+                // continue to ignore anything that doesn't match
+                if attrSchema == nil {
+                        return val, nil
+                }
+
+                // this is deprecated, so don't set it
+                if attrSchema.Deprecated != "" || attrSchema.Removed != "" {
+                        return val, nil
+                }
+
+                // find a default value if it exists
+                def, err := attrSchema.DefaultValue()
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, fmt.Errorf("error getting default for %q: %s", getAttr.Name, err))
+                        return val, err
+                }
+
+                // no default
+                if def == nil {
+                        return val, nil
+                }
+
+                // create a cty.Value and make sure it's the correct type
+                tmpVal := hcl2shim.HCL2ValueFromConfigValue(def)
+
+                // helper/schema used to allow setting "" to a bool
+                if val.Type() == cty.Bool && tmpVal.RawEquals(cty.StringVal("")) {
+                        // return a warning about the conversion
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, "provider set empty string as default value for bool "+getAttr.Name)
+                        tmpVal = cty.False
+                }
+
+                val, err = ctyconvert.Convert(tmpVal, val.Type())
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, fmt.Errorf("error setting default for %q: %s", getAttr.Name, err))
+                }
+
+                return val, err
+        })
+        if err != nil {
+                // any error here was already added to the diagnostics
+                return resp, nil
+        }
+
+        configVal, err = schemaBlock.CoerceValue(configVal)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // Ensure there are no nulls that will cause helper/schema to panic.
+        if err := validateConfigNulls(configVal, nil); err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        config := terraform.NewResourceConfigShimmed(configVal, schemaBlock)
+
+        warns, errs := s.provider.Validate(config)
+        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, convert.WarnsAndErrsToProto(warns, errs))
+
+        preparedConfigMP, err := msgpack.Marshal(configVal, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        resp.PreparedConfig = &proto.DynamicValue{Msgpack: preparedConfigMP}
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) ValidateResourceTypeConfig(_ context.Context, req *proto.ValidateResourceTypeConfig_Request) (*proto.ValidateResourceTypeConfig_Response, error) {
+        resp := &proto.ValidateResourceTypeConfig_Response{}
+
+        schemaBlock := s.getResourceSchemaBlock(req.TypeName)
+
+        configVal, err := msgpack.Unmarshal(req.Config.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        config := terraform.NewResourceConfigShimmed(configVal, schemaBlock)
+
+        warns, errs := s.provider.ValidateResource(req.TypeName, config)
+        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, convert.WarnsAndErrsToProto(warns, errs))
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) ValidateDataSourceConfig(_ context.Context, req *proto.ValidateDataSourceConfig_Request) (*proto.ValidateDataSourceConfig_Response, error) {
+        resp := &proto.ValidateDataSourceConfig_Response{}
+
+        schemaBlock := s.getDatasourceSchemaBlock(req.TypeName)
+
+        configVal, err := msgpack.Unmarshal(req.Config.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // Ensure there are no nulls that will cause helper/schema to panic.
+        if err := validateConfigNulls(configVal, nil); err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        config := terraform.NewResourceConfigShimmed(configVal, schemaBlock)
+
+        warns, errs := s.provider.ValidateDataSource(req.TypeName, config)
+        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, convert.WarnsAndErrsToProto(warns, errs))
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) UpgradeResourceState(_ context.Context, req *proto.UpgradeResourceState_Request) (*proto.UpgradeResourceState_Response, error) {
+        resp := &proto.UpgradeResourceState_Response{}
+
+        res := s.provider.ResourcesMap[req.TypeName]
+        schemaBlock := s.getResourceSchemaBlock(req.TypeName)
+
+        version := int(req.Version)
+
+        jsonMap := map[string]interface{}{}
+        var err error
+
+        switch {
+        // We first need to upgrade a flatmap state if it exists.
+        // There should never be both a JSON and Flatmap state in the request.
+        case len(req.RawState.Flatmap) > 0:
+                jsonMap, version, err = s.upgradeFlatmapState(version, req.RawState.Flatmap, res)
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+        // if there's a JSON state, we need to decode it.
+        case len(req.RawState.Json) > 0:
+                err = json.Unmarshal(req.RawState.Json, &jsonMap)
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+        default:
+                log.Println("[DEBUG] no state provided to upgrade")
+                return resp, nil
+        }
+
+        // complete the upgrade of the JSON states
+        jsonMap, err = s.upgradeJSONState(version, jsonMap, res)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // The provider isn't required to clean out removed fields
+        s.removeAttributes(jsonMap, schemaBlock.ImpliedType())
+
+        // now we need to turn the state into the default json representation, so
+        // that it can be re-decoded using the actual schema.
+        val, err := schema.JSONMapToStateValue(jsonMap, schemaBlock)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // encode the final state to the expected msgpack format
+        newStateMP, err := msgpack.Marshal(val, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        resp.UpgradedState = &proto.DynamicValue{Msgpack: newStateMP}
+        return resp, nil
+}
+
+// upgradeFlatmapState takes a legacy flatmap state, upgrades it using Migrate
+// state if necessary, and converts it to the new JSON state format decoded as a
+// map[string]interface{}.
+// upgradeFlatmapState returns the json map along with the corresponding schema
+// version.
+func (s *GRPCProviderServer) upgradeFlatmapState(version int, m map[string]string, res *schema.Resource) (map[string]interface{}, int, error) {
+        // this will be the version we've upgraded so, defaulting to the given
+        // version in case no migration was called.
+        upgradedVersion := version
+
+        // first determine if we need to call the legacy MigrateState func
+        requiresMigrate := version < res.SchemaVersion
+
+        schemaType := res.CoreConfigSchema().ImpliedType()
+
+        // if there are any StateUpgraders, then we need to only compare
+        // against the first version there
+        if len(res.StateUpgraders) > 0 {
+                requiresMigrate = version < res.StateUpgraders[0].Version
+        }
+
+        if requiresMigrate {
+                if res.MigrateState == nil {
+                        return nil, 0, errors.New("cannot upgrade state, missing MigrateState function")
+                }
+
+                is := &terraform.InstanceState{
+                        ID:         m["id"],
+                        Attributes: m,
+                        Meta: map[string]interface{}{
+                                "schema_version": strconv.Itoa(version),
+                        },
+                }
+
+                is, err := res.MigrateState(version, is, s.provider.Meta())
+                if err != nil {
+                        return nil, 0, err
+                }
+
+                // re-assign the map in case there was a copy made, making sure to keep
+                // the ID
+                m := is.Attributes
+                m["id"] = is.ID
+
+                // if there are further upgraders, then we've only updated that far
+                if len(res.StateUpgraders) > 0 {
+                        schemaType = res.StateUpgraders[0].Type
+                        upgradedVersion = res.StateUpgraders[0].Version
+                }
+        } else {
+                // the schema version may be newer than the MigrateState functions
+                // handled and older than the current, but still stored in the flatmap
+                // form. If that's the case, we need to find the correct schema type to
+                // convert the state.
+                for _, upgrader := range res.StateUpgraders {
+                        if upgrader.Version == version {
+                                schemaType = upgrader.Type
+                                break
+                        }
+                }
+        }
+
+        // now we know the state is up to the latest version that handled the
+        // flatmap format state. Now we can upgrade the format and continue from
+        // there.
+        newConfigVal, err := hcl2shim.HCL2ValueFromFlatmap(m, schemaType)
+        if err != nil {
+                return nil, 0, err
+        }
+
+        jsonMap, err := schema.StateValueToJSONMap(newConfigVal, schemaType)
+        return jsonMap, upgradedVersion, err
+}
+
+func (s *GRPCProviderServer) upgradeJSONState(version int, m map[string]interface{}, res *schema.Resource) (map[string]interface{}, error) {
+        var err error
+
+        for _, upgrader := range res.StateUpgraders {
+                if version != upgrader.Version {
+                        continue
+                }
+
+                m, err = upgrader.Upgrade(m, s.provider.Meta())
+                if err != nil {
+                        return nil, err
+                }
+                version++
+        }
+
+        return m, nil
+}
+
+// Remove any attributes no longer present in the schema, so that the json can
+// be correctly decoded.
+func (s *GRPCProviderServer) removeAttributes(v interface{}, ty cty.Type) {
+        // we're only concerned with finding maps that corespond to object
+        // attributes
+        switch v := v.(type) {
+        case []interface{}:
+                // If these aren't blocks the next call will be a noop
+                if ty.IsListType() || ty.IsSetType() {
+                        eTy := ty.ElementType()
+                        for _, eV := range v {
+                                s.removeAttributes(eV, eTy)
+                        }
+                }
+                return
+        case map[string]interface{}:
+                // map blocks aren't yet supported, but handle this just in case
+                if ty.IsMapType() {
+                        eTy := ty.ElementType()
+                        for _, eV := range v {
+                                s.removeAttributes(eV, eTy)
+                        }
+                        return
+                }
+
+                if ty == cty.DynamicPseudoType {
+                        log.Printf("[DEBUG] ignoring dynamic block: %#v\n", v)
+                        return
+                }
+
+                if !ty.IsObjectType() {
+                        // This shouldn't happen, and will fail to decode further on, so
+                        // there's no need to handle it here.
+                        log.Printf("[WARN] unexpected type %#v for map in json state", ty)
+                        return
+                }
+
+                attrTypes := ty.AttributeTypes()
+                for attr, attrV := range v {
+                        attrTy, ok := attrTypes[attr]
+                        if !ok {
+                                log.Printf("[DEBUG] attribute %q no longer present in schema", attr)
+                                delete(v, attr)
+                                continue
+                        }
+
+                        s.removeAttributes(attrV, attrTy)
+                }
+        }
+}
+
+func (s *GRPCProviderServer) Stop(_ context.Context, _ *proto.Stop_Request) (*proto.Stop_Response, error) {
+        resp := &proto.Stop_Response{}
+
+        err := s.provider.Stop()
+        if err != nil {
+                resp.Error = err.Error()
+        }
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) Configure(_ context.Context, req *proto.Configure_Request) (*proto.Configure_Response, error) {
+        resp := &proto.Configure_Response{}
+
+        schemaBlock := s.getProviderSchemaBlock()
+
+        configVal, err := msgpack.Unmarshal(req.Config.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        s.provider.TerraformVersion = req.TerraformVersion
+
+        // Ensure there are no nulls that will cause helper/schema to panic.
+        if err := validateConfigNulls(configVal, nil); err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        config := terraform.NewResourceConfigShimmed(configVal, schemaBlock)
+        err = s.provider.Configure(config)
+        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) ReadResource(_ context.Context, req *proto.ReadResource_Request) (*proto.ReadResource_Response, error) {
+        resp := &proto.ReadResource_Response{}
+
+        res := s.provider.ResourcesMap[req.TypeName]
+        schemaBlock := s.getResourceSchemaBlock(req.TypeName)
+
+        stateVal, err := msgpack.Unmarshal(req.CurrentState.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        instanceState, err := res.ShimInstanceStateFromValue(stateVal)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        newInstanceState, err := res.RefreshWithoutUpgrade(instanceState, s.provider.Meta())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        if newInstanceState == nil || newInstanceState.ID == "" {
+                // The old provider API used an empty id to signal that the remote
+                // object appears to have been deleted, but our new protocol expects
+                // to see a null value (in the cty sense) in that case.
+                newStateMP, err := msgpack.Marshal(cty.NullVal(schemaBlock.ImpliedType()), schemaBlock.ImpliedType())
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                }
+                resp.NewState = &proto.DynamicValue{
+                        Msgpack: newStateMP,
+                }
+                return resp, nil
+        }
+
+        // helper/schema should always copy the ID over, but do it again just to be safe
+        newInstanceState.Attributes["id"] = newInstanceState.ID
+
+        newStateVal, err := hcl2shim.HCL2ValueFromFlatmap(newInstanceState.Attributes, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        newStateVal = normalizeNullValues(newStateVal, stateVal, false)
+        newStateVal = copyTimeoutValues(newStateVal, stateVal)
+
+        newStateMP, err := msgpack.Marshal(newStateVal, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        resp.NewState = &proto.DynamicValue{
+                Msgpack: newStateMP,
+        }
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) PlanResourceChange(_ context.Context, req *proto.PlanResourceChange_Request) (*proto.PlanResourceChange_Response, error) {
+        resp := &proto.PlanResourceChange_Response{}
+
+        // This is a signal to Terraform Core that we're doing the best we can to
+        // shim the legacy type system of the SDK onto the Terraform type system
+        // but we need it to cut us some slack. This setting should not be taken
+        // forward to any new SDK implementations, since setting it prevents us
+        // from catching certain classes of provider bug that can lead to
+        // confusing downstream errors.
+        resp.LegacyTypeSystem = true
+
+        res := s.provider.ResourcesMap[req.TypeName]
+        schemaBlock := s.getResourceSchemaBlock(req.TypeName)
+
+        priorStateVal, err := msgpack.Unmarshal(req.PriorState.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        create := priorStateVal.IsNull()
+
+        proposedNewStateVal, err := msgpack.Unmarshal(req.ProposedNewState.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // We don't usually plan destroys, but this can return early in any case.
+        if proposedNewStateVal.IsNull() {
+                resp.PlannedState = req.ProposedNewState
+                return resp, nil
+        }
+
+        info := &terraform.InstanceInfo{
+                Type: req.TypeName,
+        }
+
+        priorState, err := res.ShimInstanceStateFromValue(priorStateVal)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+        priorPrivate := make(map[string]interface{})
+        if len(req.PriorPrivate) > 0 {
+                if err := json.Unmarshal(req.PriorPrivate, &priorPrivate); err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+        }
+
+        priorState.Meta = priorPrivate
+
+        // Ensure there are no nulls that will cause helper/schema to panic.
+        if err := validateConfigNulls(proposedNewStateVal, nil); err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // turn the proposed state into a legacy configuration
+        cfg := terraform.NewResourceConfigShimmed(proposedNewStateVal, schemaBlock)
+
+        diff, err := s.provider.SimpleDiff(info, priorState, cfg)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // if this is a new instance, we need to make sure ID is going to be computed
+        if create {
+                if diff == nil {
+                        diff = terraform.NewInstanceDiff()
+                }
+
+                diff.Attributes["id"] = &terraform.ResourceAttrDiff{
+                        NewComputed: true,
+                }
+        }
+
+        if diff == nil || len(diff.Attributes) == 0 {
+                // schema.Provider.Diff returns nil if it ends up making a diff with no
+                // changes, but our new interface wants us to return an actual change
+                // description that _shows_ there are no changes. This is always the
+                // prior state, because we force a diff above if this is a new instance.
+                resp.PlannedState = req.PriorState
+                return resp, nil
+        }
+
+        if priorState == nil {
+                priorState = &terraform.InstanceState{}
+        }
+
+        // now we need to apply the diff to the prior state, so get the planned state
+        plannedAttrs, err := diff.Apply(priorState.Attributes, schemaBlock)
+
+        plannedStateVal, err := hcl2shim.HCL2ValueFromFlatmap(plannedAttrs, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        plannedStateVal, err = schemaBlock.CoerceValue(plannedStateVal)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        plannedStateVal = normalizeNullValues(plannedStateVal, proposedNewStateVal, false)
+
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        plannedStateVal = copyTimeoutValues(plannedStateVal, proposedNewStateVal)
+
+        // The old SDK code has some imprecisions that cause it to sometimes
+        // generate differences that the SDK itself does not consider significant
+        // but Terraform Core would. To avoid producing weird do-nothing diffs
+        // in that case, we'll check if the provider as produced something we
+        // think is "equivalent" to the prior state and just return the prior state
+        // itself if so, thus ensuring that Terraform Core will treat this as
+        // a no-op. See the docs for ValuesSDKEquivalent for some caveats on its
+        // accuracy.
+        forceNoChanges := false
+        if hcl2shim.ValuesSDKEquivalent(priorStateVal, plannedStateVal) {
+                plannedStateVal = priorStateVal
+                forceNoChanges = true
+        }
+
+        // if this was creating the resource, we need to set any remaining computed
+        // fields
+        if create {
+                plannedStateVal = SetUnknowns(plannedStateVal, schemaBlock)
+        }
+
+        plannedMP, err := msgpack.Marshal(plannedStateVal, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+        resp.PlannedState = &proto.DynamicValue{
+                Msgpack: plannedMP,
+        }
+
+        // Now we need to store any NewExtra values, which are where any actual
+        // StateFunc modified config fields are hidden.
+        privateMap := diff.Meta
+        if privateMap == nil {
+                privateMap = map[string]interface{}{}
+        }
+
+        newExtra := map[string]interface{}{}
+
+        for k, v := range diff.Attributes {
+                if v.NewExtra != nil {
+                        newExtra[k] = v.NewExtra
+                }
+        }
+        privateMap[newExtraKey] = newExtra
+
+        // the Meta field gets encoded into PlannedPrivate
+        plannedPrivate, err := json.Marshal(privateMap)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+        resp.PlannedPrivate = plannedPrivate
+
+        // collect the attributes that require instance replacement, and convert
+        // them to cty.Paths.
+        var requiresNew []string
+        if !forceNoChanges {
+                for attr, d := range diff.Attributes {
+                        if d.RequiresNew {
+                                requiresNew = append(requiresNew, attr)
+                        }
+                }
+        }
+
+        // If anything requires a new resource already, or the "id" field indicates
+        // that we will be creating a new resource, then we need to add that to
+        // RequiresReplace so that core can tell if the instance is being replaced
+        // even if changes are being suppressed via "ignore_changes".
+        id := plannedStateVal.GetAttr("id")
+        if len(requiresNew) > 0 || id.IsNull() || !id.IsKnown() {
+                requiresNew = append(requiresNew, "id")
+        }
+
+        requiresReplace, err := hcl2shim.RequiresReplace(requiresNew, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // convert these to the protocol structures
+        for _, p := range requiresReplace {
+                resp.RequiresReplace = append(resp.RequiresReplace, pathToAttributePath(p))
+        }
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) ApplyResourceChange(_ context.Context, req *proto.ApplyResourceChange_Request) (*proto.ApplyResourceChange_Response, error) {
+        resp := &proto.ApplyResourceChange_Response{
+                // Start with the existing state as a fallback
+                NewState: req.PriorState,
+        }
+
+        res := s.provider.ResourcesMap[req.TypeName]
+        schemaBlock := s.getResourceSchemaBlock(req.TypeName)
+
+        priorStateVal, err := msgpack.Unmarshal(req.PriorState.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        plannedStateVal, err := msgpack.Unmarshal(req.PlannedState.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        info := &terraform.InstanceInfo{
+                Type: req.TypeName,
+        }
+
+        priorState, err := res.ShimInstanceStateFromValue(priorStateVal)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        private := make(map[string]interface{})
+        if len(req.PlannedPrivate) > 0 {
+                if err := json.Unmarshal(req.PlannedPrivate, &private); err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+        }
+
+        var diff *terraform.InstanceDiff
+        destroy := false
+
+        // a null state means we are destroying the instance
+        if plannedStateVal.IsNull() {
+                destroy = true
+                diff = &terraform.InstanceDiff{
+                        Attributes: make(map[string]*terraform.ResourceAttrDiff),
+                        Meta:       make(map[string]interface{}),
+                        Destroy:    true,
+                }
+        } else {
+                diff, err = schema.DiffFromValues(priorStateVal, plannedStateVal, stripResourceModifiers(res))
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+        }
+
+        if diff == nil {
+                diff = &terraform.InstanceDiff{
+                        Attributes: make(map[string]*terraform.ResourceAttrDiff),
+                        Meta:       make(map[string]interface{}),
+                }
+        }
+
+        // add NewExtra Fields that may have been stored in the private data
+        if newExtra := private[newExtraKey]; newExtra != nil {
+                for k, v := range newExtra.(map[string]interface{}) {
+                        d := diff.Attributes[k]
+
+                        if d == nil {
+                                d = &terraform.ResourceAttrDiff{}
+                        }
+
+                        d.NewExtra = v
+                        diff.Attributes[k] = d
+                }
+        }
+
+        if private != nil {
+                diff.Meta = private
+        }
+
+        for k, d := range diff.Attributes {
+                // We need to turn off any RequiresNew. There could be attributes
+                // without changes in here inserted by helper/schema, but if they have
+                // RequiresNew then the state will be dropped from the ResourceData.
+                d.RequiresNew = false
+
+                // Check that any "removed" attributes that don't actually exist in the
+                // prior state, or helper/schema will confuse itself
+                if d.NewRemoved {
+                        if _, ok := priorState.Attributes[k]; !ok {
+                                delete(diff.Attributes, k)
+                        }
+                }
+        }
+
+        newInstanceState, err := s.provider.Apply(info, priorState, diff)
+        // we record the error here, but continue processing any returned state.
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+        }
+        newStateVal := cty.NullVal(schemaBlock.ImpliedType())
+
+        // Always return a null value for destroy.
+        // While this is usually indicated by a nil state, check for missing ID or
+        // attributes in the case of a provider failure.
+        if destroy || newInstanceState == nil || newInstanceState.Attributes == nil || newInstanceState.ID == "" {
+                newStateMP, err := msgpack.Marshal(newStateVal, schemaBlock.ImpliedType())
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+                resp.NewState = &proto.DynamicValue{
+                        Msgpack: newStateMP,
+                }
+                return resp, nil
+        }
+
+        // We keep the null val if we destroyed the resource, otherwise build the
+        // entire object, even if the new state was nil.
+        newStateVal, err = schema.StateValueFromInstanceState(newInstanceState, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        newStateVal = normalizeNullValues(newStateVal, plannedStateVal, true)
+
+        newStateVal = copyTimeoutValues(newStateVal, plannedStateVal)
+
+        newStateMP, err := msgpack.Marshal(newStateVal, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+        resp.NewState = &proto.DynamicValue{
+                Msgpack: newStateMP,
+        }
+
+        meta, err := json.Marshal(newInstanceState.Meta)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+        resp.Private = meta
+
+        // This is a signal to Terraform Core that we're doing the best we can to
+        // shim the legacy type system of the SDK onto the Terraform type system
+        // but we need it to cut us some slack. This setting should not be taken
+        // forward to any new SDK implementations, since setting it prevents us
+        // from catching certain classes of provider bug that can lead to
+        // confusing downstream errors.
+        resp.LegacyTypeSystem = true
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) ImportResourceState(_ context.Context, req *proto.ImportResourceState_Request) (*proto.ImportResourceState_Response, error) {
+        resp := &proto.ImportResourceState_Response{}
+
+        info := &terraform.InstanceInfo{
+                Type: req.TypeName,
+        }
+
+        newInstanceStates, err := s.provider.ImportState(info, req.Id)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        for _, is := range newInstanceStates {
+                // copy the ID again just to be sure it wasn't missed
+                is.Attributes["id"] = is.ID
+
+                resourceType := is.Ephemeral.Type
+                if resourceType == "" {
+                        resourceType = req.TypeName
+                }
+
+                schemaBlock := s.getResourceSchemaBlock(resourceType)
+                newStateVal, err := hcl2shim.HCL2ValueFromFlatmap(is.Attributes, schemaBlock.ImpliedType())
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+
+                newStateMP, err := msgpack.Marshal(newStateVal, schemaBlock.ImpliedType())
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+
+                meta, err := json.Marshal(is.Meta)
+                if err != nil {
+                        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                        return resp, nil
+                }
+
+                importedResource := &proto.ImportResourceState_ImportedResource{
+                        TypeName: resourceType,
+                        State: &proto.DynamicValue{
+                                Msgpack: newStateMP,
+                        },
+                        Private: meta,
+                }
+
+                resp.ImportedResources = append(resp.ImportedResources, importedResource)
+        }
+
+        return resp, nil
+}
+
+func (s *GRPCProviderServer) ReadDataSource(_ context.Context, req *proto.ReadDataSource_Request) (*proto.ReadDataSource_Response, error) {
+        resp := &proto.ReadDataSource_Response{}
+
+        schemaBlock := s.getDatasourceSchemaBlock(req.TypeName)
+
+        configVal, err := msgpack.Unmarshal(req.Config.Msgpack, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        info := &terraform.InstanceInfo{
+                Type: req.TypeName,
+        }
+
+        // Ensure there are no nulls that will cause helper/schema to panic.
+        if err := validateConfigNulls(configVal, nil); err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        config := terraform.NewResourceConfigShimmed(configVal, schemaBlock)
+
+        // we need to still build the diff separately with the Read method to match
+        // the old behavior
+        diff, err := s.provider.ReadDataDiff(info, config)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        // now we can get the new complete data source
+        newInstanceState, err := s.provider.ReadDataApply(info, diff)
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        newStateVal, err := schema.StateValueFromInstanceState(newInstanceState, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        newStateVal = copyTimeoutValues(newStateVal, configVal)
+
+        newStateMP, err := msgpack.Marshal(newStateVal, schemaBlock.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+        resp.State = &proto.DynamicValue{
+                Msgpack: newStateMP,
+        }
+        return resp, nil
+}
+
+func pathToAttributePath(path cty.Path) *proto.AttributePath {
+        var steps []*proto.AttributePath_Step
+
+        for _, step := range path {
+                switch s := step.(type) {
+                case cty.GetAttrStep:
+                        steps = append(steps, &proto.AttributePath_Step{
+                                Selector: &proto.AttributePath_Step_AttributeName{
+                                        AttributeName: s.Name,
+                                },
+                        })
+                case cty.IndexStep:
+                        ty := s.Key.Type()
+                        switch ty {
+                        case cty.Number:
+                                i, _ := s.Key.AsBigFloat().Int64()
+                                steps = append(steps, &proto.AttributePath_Step{
+                                        Selector: &proto.AttributePath_Step_ElementKeyInt{
+                                                ElementKeyInt: i,
+                                        },
+                                })
+                        case cty.String:
+                                steps = append(steps, &proto.AttributePath_Step{
+                                        Selector: &proto.AttributePath_Step_ElementKeyString{
+                                                ElementKeyString: s.Key.AsString(),
+                                        },
+                                })
+                        }
+                }
+        }
+
+        return &proto.AttributePath{Steps: steps}
+}
+
+// helper/schema throws away timeout values from the config and stores them in
+// the Private/Meta fields. we need to copy those values into the planned state
+// so that core doesn't see a perpetual diff with the timeout block.
+func copyTimeoutValues(to cty.Value, from cty.Value) cty.Value {
+        // if `to` is null we are planning to remove it altogether.
+        if to.IsNull() {
+                return to
+        }
+        toAttrs := to.AsValueMap()
+        // We need to remove the key since the hcl2shims will add a non-null block
+        // because we can't determine if a single block was null from the flatmapped
+        // values. This needs to conform to the correct schema for marshaling, so
+        // change the value to null rather than deleting it from the object map.
+        timeouts, ok := toAttrs[schema.TimeoutsConfigKey]
+        if ok {
+                toAttrs[schema.TimeoutsConfigKey] = cty.NullVal(timeouts.Type())
+        }
+
+        // if from is null then there are no timeouts to copy
+        if from.IsNull() {
+                return cty.ObjectVal(toAttrs)
+        }
+
+        fromAttrs := from.AsValueMap()
+        timeouts, ok = fromAttrs[schema.TimeoutsConfigKey]
+
+        // timeouts shouldn't be unknown, but don't copy possibly invalid values either
+        if !ok || timeouts.IsNull() || !timeouts.IsWhollyKnown() {
+                // no timeouts block to copy
+                return cty.ObjectVal(toAttrs)
+        }
+
+        toAttrs[schema.TimeoutsConfigKey] = timeouts
+
+        return cty.ObjectVal(toAttrs)
+}
+
+// stripResourceModifiers takes a *schema.Resource and returns a deep copy with all
+// StateFuncs and CustomizeDiffs removed. This will be used during apply to
+// create a diff from a planned state where the diff modifications have already
+// been applied.
+func stripResourceModifiers(r *schema.Resource) *schema.Resource {
+        if r == nil {
+                return nil
+        }
+        // start with a shallow copy
+        newResource := new(schema.Resource)
+        *newResource = *r
+
+        newResource.CustomizeDiff = nil
+        newResource.Schema = map[string]*schema.Schema{}
+
+        for k, s := range r.Schema {
+                newResource.Schema[k] = stripSchema(s)
+        }
+
+        return newResource
+}
+
+func stripSchema(s *schema.Schema) *schema.Schema {
+        if s == nil {
+                return nil
+        }
+        // start with a shallow copy
+        newSchema := new(schema.Schema)
+        *newSchema = *s
+
+        newSchema.StateFunc = nil
+
+        switch e := newSchema.Elem.(type) {
+        case *schema.Schema:
+                newSchema.Elem = stripSchema(e)
+        case *schema.Resource:
+                newSchema.Elem = stripResourceModifiers(e)
+        }
+
+        return newSchema
+}
+
+// Zero values and empty containers may be interchanged by the apply process.
+// When there is a discrepency between src and dst value being null or empty,
+// prefer the src value. This takes a little more liberty with set types, since
+// we can't correlate modified set values. In the case of sets, if the src set
+// was wholly known we assume the value was correctly applied and copy that
+// entirely to the new value.
+// While apply prefers the src value, during plan we prefer dst whenever there
+// is an unknown or a set is involved, since the plan can alter the value
+// however it sees fit. This however means that a CustomizeDiffFunction may not
+// be able to change a null to an empty value or vice versa, but that should be
+// very uncommon nor was it reliable before 0.12 either.
+func normalizeNullValues(dst, src cty.Value, apply bool) cty.Value {
+        ty := dst.Type()
+        if !src.IsNull() && !src.IsKnown() {
+                // Return src during plan to retain unknown interpolated placeholders,
+                // which could be lost if we're only updating a resource. If this is a
+                // read scenario, then there shouldn't be any unknowns at all.
+                if dst.IsNull() && !apply {
+                        return src
+                }
+                return dst
+        }
+
+        // Handle null/empty changes for collections during apply.
+        // A change between null and empty values prefers src to make sure the state
+        // is consistent between plan and apply.
+        if ty.IsCollectionType() && apply {
+                dstEmpty := !dst.IsNull() && dst.IsKnown() && dst.LengthInt() == 0
+                srcEmpty := !src.IsNull() && src.IsKnown() && src.LengthInt() == 0
+
+                if (src.IsNull() && dstEmpty) || (srcEmpty && dst.IsNull()) {
+                        return src
+                }
+        }
+
+        if src.IsNull() || !src.IsKnown() || !dst.IsKnown() {
+                return dst
+        }
+
+        switch {
+        case ty.IsMapType(), ty.IsObjectType():
+                var dstMap map[string]cty.Value
+                if !dst.IsNull() {
+                        dstMap = dst.AsValueMap()
+                }
+                if dstMap == nil {
+                        dstMap = map[string]cty.Value{}
+                }
+
+                srcMap := src.AsValueMap()
+                for key, v := range srcMap {
+                        dstVal, ok := dstMap[key]
+                        if !ok && apply && ty.IsMapType() {
+                                // don't transfer old map values to dst during apply
+                                continue
+                        }
+
+                        if dstVal == cty.NilVal {
+                                if !apply && ty.IsMapType() {
+                                        // let plan shape this map however it wants
+                                        continue
+                                }
+                                dstVal = cty.NullVal(v.Type())
+                        }
+
+                        dstMap[key] = normalizeNullValues(dstVal, v, apply)
+                }
+
+                // you can't call MapVal/ObjectVal with empty maps, but nothing was
+                // copied in anyway. If the dst is nil, and the src is known, assume the
+                // src is correct.
+                if len(dstMap) == 0 {
+                        if dst.IsNull() && src.IsWhollyKnown() && apply {
+                                return src
+                        }
+                        return dst
+                }
+
+                if ty.IsMapType() {
+                        // helper/schema will populate an optional+computed map with
+                        // unknowns which we have to fixup here.
+                        // It would be preferable to simply prevent any known value from
+                        // becoming unknown, but concessions have to be made to retain the
+                        // broken legacy behavior when possible.
+                        for k, srcVal := range srcMap {
+                                if !srcVal.IsNull() && srcVal.IsKnown() {
+                                        dstVal, ok := dstMap[k]
+                                        if !ok {
+                                                continue
+                                        }
+
+                                        if !dstVal.IsNull() && !dstVal.IsKnown() {
+                                                dstMap[k] = srcVal
+                                        }
+                                }
+                        }
+
+                        return cty.MapVal(dstMap)
+                }
+
+                return cty.ObjectVal(dstMap)
+
+        case ty.IsSetType():
+                // If the original was wholly known, then we expect that is what the
+                // provider applied. The apply process loses too much information to
+                // reliably re-create the set.
+                if src.IsWhollyKnown() && apply {
+                        return src
+                }
+
+        case ty.IsListType(), ty.IsTupleType():
+                // If the dst is null, and the src is known, then we lost an empty value
+                // so take the original.
+                if dst.IsNull() {
+                        if src.IsWhollyKnown() && src.LengthInt() == 0 && apply {
+                                return src
+                        }
+
+                        // if dst is null and src only contains unknown values, then we lost
+                        // those during a read or plan.
+                        if !apply && !src.IsNull() {
+                                allUnknown := true
+                                for _, v := range src.AsValueSlice() {
+                                        if v.IsKnown() {
+                                                allUnknown = false
+                                                break
+                                        }
+                                }
+                                if allUnknown {
+                                        return src
+                                }
+                        }
+
+                        return dst
+                }
+
+                // if the lengths are identical, then iterate over each element in succession.
+                srcLen := src.LengthInt()
+                dstLen := dst.LengthInt()
+                if srcLen == dstLen && srcLen > 0 {
+                        srcs := src.AsValueSlice()
+                        dsts := dst.AsValueSlice()
+
+                        for i := 0; i < srcLen; i++ {
+                                dsts[i] = normalizeNullValues(dsts[i], srcs[i], apply)
+                        }
+
+                        if ty.IsTupleType() {
+                                return cty.TupleVal(dsts)
+                        }
+                        return cty.ListVal(dsts)
+                }
+
+        case ty.IsPrimitiveType():
+                if dst.IsNull() && src.IsWhollyKnown() && apply {
+                        return src
+                }
+        }
+
+        return dst
+}
+
+// validateConfigNulls checks a config value for unsupported nulls before
+// attempting to shim the value. While null values can mostly be ignored in the
+// configuration, since they're not supported in HCL1, the case where a null
+// appears in a list-like attribute (list, set, tuple) will present a nil value
+// to helper/schema which can panic. Return an error to the user in this case,
+// indicating the attribute with the null value.
+func validateConfigNulls(v cty.Value, path cty.Path) []*proto.Diagnostic {
+        var diags []*proto.Diagnostic
+        if v.IsNull() || !v.IsKnown() {
+                return diags
+        }
+
+        switch {
+        case v.Type().IsListType() || v.Type().IsSetType() || v.Type().IsTupleType():
+                it := v.ElementIterator()
+                for it.Next() {
+                        kv, ev := it.Element()
+                        if ev.IsNull() {
+                                diags = append(diags, &proto.Diagnostic{
+                                        Severity:  proto.Diagnostic_ERROR,
+                                        Summary:   "Null value found in list",
+                                        Detail:    "Null values are not allowed for this attribute value.",
+                                        Attribute: convert.PathToAttributePath(append(path, cty.IndexStep{Key: kv})),
+                                })
+                                continue
+                        }
+
+                        d := validateConfigNulls(ev, append(path, cty.IndexStep{Key: kv}))
+                        diags = convert.AppendProtoDiag(diags, d)
+                }
+
+        case v.Type().IsMapType() || v.Type().IsObjectType():
+                it := v.ElementIterator()
+                for it.Next() {
+                        kv, ev := it.Element()
+                        var step cty.PathStep
+                        switch {
+                        case v.Type().IsMapType():
+                                step = cty.IndexStep{Key: kv}
+                        case v.Type().IsObjectType():
+                                step = cty.GetAttrStep{Name: kv.AsString()}
+                        }
+                        d := validateConfigNulls(ev, append(path, step))
+                        diags = convert.AppendProtoDiag(diags, d)
+                }
+        }
+
+        return diags
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/plugin/grpc_provisioner.go b/vendor/github.com/hashicorp/terraform/helper/plugin/grpc_provisioner.go
new file mode 100644
index 0000000..14494e4
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/plugin/grpc_provisioner.go
@@ -0,0 +1,147 @@
+package plugin
+
+import (
+        "log"
+
+        "github.com/hashicorp/terraform/helper/schema"
+        proto "github.com/hashicorp/terraform/internal/tfplugin5"
+        "github.com/hashicorp/terraform/plugin/convert"
+        "github.com/hashicorp/terraform/terraform"
+        "github.com/zclconf/go-cty/cty"
+        ctyconvert "github.com/zclconf/go-cty/cty/convert"
+        "github.com/zclconf/go-cty/cty/msgpack"
+        context "golang.org/x/net/context"
+)
+
+// NewGRPCProvisionerServerShim wraps a terraform.ResourceProvisioner in a
+// proto.ProvisionerServer implementation. If the provided provisioner is not a
+// *schema.Provisioner, this will return nil,
+func NewGRPCProvisionerServerShim(p terraform.ResourceProvisioner) *GRPCProvisionerServer {
+        sp, ok := p.(*schema.Provisioner)
+        if !ok {
+                return nil
+        }
+        return &GRPCProvisionerServer{
+                provisioner: sp,
+        }
+}
+
+type GRPCProvisionerServer struct {
+        provisioner *schema.Provisioner
+}
+
+func (s *GRPCProvisionerServer) GetSchema(_ context.Context, req *proto.GetProvisionerSchema_Request) (*proto.GetProvisionerSchema_Response, error) {
+        resp := &proto.GetProvisionerSchema_Response{}
+
+        resp.Provisioner = &proto.Schema{
+                Block: convert.ConfigSchemaToProto(schema.InternalMap(s.provisioner.Schema).CoreConfigSchema()),
+        }
+
+        return resp, nil
+}
+
+func (s *GRPCProvisionerServer) ValidateProvisionerConfig(_ context.Context, req *proto.ValidateProvisionerConfig_Request) (*proto.ValidateProvisionerConfig_Response, error) {
+        resp := &proto.ValidateProvisionerConfig_Response{}
+
+        cfgSchema := schema.InternalMap(s.provisioner.Schema).CoreConfigSchema()
+
+        configVal, err := msgpack.Unmarshal(req.Config.Msgpack, cfgSchema.ImpliedType())
+        if err != nil {
+                resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, err)
+                return resp, nil
+        }
+
+        config := terraform.NewResourceConfigShimmed(configVal, cfgSchema)
+
+        warns, errs := s.provisioner.Validate(config)
+        resp.Diagnostics = convert.AppendProtoDiag(resp.Diagnostics, convert.WarnsAndErrsToProto(warns, errs))
+
+        return resp, nil
+}
+
+// stringMapFromValue converts a cty.Value to a map[stirng]string.
+// This will panic if the val is not a cty.Map(cty.String).
+func stringMapFromValue(val cty.Value) map[string]string {
+        m := map[string]string{}
+        if val.IsNull() || !val.IsKnown() {
+                return m
+        }
+
+        for it := val.ElementIterator(); it.Next(); {
+                ak, av := it.Element()
+                name := ak.AsString()
+
+                if !av.IsKnown() || av.IsNull() {
+                        continue
+                }
+
+                av, _ = ctyconvert.Convert(av, cty.String)
+                m[name] = av.AsString()
+        }
+
+        return m
+}
+
+// uiOutput implements the terraform.UIOutput interface to adapt the grpc
+// stream to the legacy Provisioner.Apply method.
+type uiOutput struct {
+        srv proto.Provisioner_ProvisionResourceServer
+}
+
+func (o uiOutput) Output(s string) {
+        err := o.srv.Send(&proto.ProvisionResource_Response{
+                Output: s,
+        })
+        if err != nil {
+                log.Printf("[ERROR] %s", err)
+        }
+}
+
+func (s *GRPCProvisionerServer) ProvisionResource(req *proto.ProvisionResource_Request, srv proto.Provisioner_ProvisionResourceServer) error {
+        // We send back a diagnostics over the stream if there was a
+        // provisioner-side problem.
+        srvResp := &proto.ProvisionResource_Response{}
+
+        cfgSchema := schema.InternalMap(s.provisioner.Schema).CoreConfigSchema()
+        cfgVal, err := msgpack.Unmarshal(req.Config.Msgpack, cfgSchema.ImpliedType())
+        if err != nil {
+                srvResp.Diagnostics = convert.AppendProtoDiag(srvResp.Diagnostics, err)
+                srv.Send(srvResp)
+                return nil
+        }
+        resourceConfig := terraform.NewResourceConfigShimmed(cfgVal, cfgSchema)
+
+        connVal, err := msgpack.Unmarshal(req.Connection.Msgpack, cty.Map(cty.String))
+        if err != nil {
+                srvResp.Diagnostics = convert.AppendProtoDiag(srvResp.Diagnostics, err)
+                srv.Send(srvResp)
+                return nil
+        }
+
+        conn := stringMapFromValue(connVal)
+
+        instanceState := &terraform.InstanceState{
+                Ephemeral: terraform.EphemeralState{
+                        ConnInfo: conn,
+                },
+                Meta: make(map[string]interface{}),
+        }
+
+        err = s.provisioner.Apply(uiOutput{srv}, instanceState, resourceConfig)
+        if err != nil {
+                srvResp.Diagnostics = convert.AppendProtoDiag(srvResp.Diagnostics, err)
+                srv.Send(srvResp)
+        }
+        return nil
+}
+
+func (s *GRPCProvisionerServer) Stop(_ context.Context, req *proto.Stop_Request) (*proto.Stop_Response, error) {
+        resp := &proto.Stop_Response{}
+
+        err := s.provisioner.Stop()
+        if err != nil {
+                resp.Error = err.Error()
+        }
+
+        return resp, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/plugin/unknown.go b/vendor/github.com/hashicorp/terraform/helper/plugin/unknown.go
new file mode 100644
index 0000000..64a6784
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/plugin/unknown.go
@@ -0,0 +1,131 @@
+package plugin
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/zclconf/go-cty/cty"
+)
+
+// SetUnknowns takes a cty.Value, and compares it to the schema setting any null
+// values which are computed to unknown.
+func SetUnknowns(val cty.Value, schema *configschema.Block) cty.Value {
+        if !val.IsKnown() {
+                return val
+        }
+
+        // If the object was null, we still need to handle the top level attributes
+        // which might be computed, but we don't need to expand the blocks.
+        if val.IsNull() {
+                objMap := map[string]cty.Value{}
+                allNull := true
+                for name, attr := range schema.Attributes {
+                        switch {
+                        case attr.Computed:
+                                objMap[name] = cty.UnknownVal(attr.Type)
+                                allNull = false
+                        default:
+                                objMap[name] = cty.NullVal(attr.Type)
+                        }
+                }
+
+                // If this object has no unknown attributes, then we can leave it null.
+                if allNull {
+                        return val
+                }
+
+                return cty.ObjectVal(objMap)
+        }
+
+        valMap := val.AsValueMap()
+        newVals := make(map[string]cty.Value)
+
+        for name, attr := range schema.Attributes {
+                v := valMap[name]
+
+                if attr.Computed && v.IsNull() {
+                        newVals[name] = cty.UnknownVal(attr.Type)
+                        continue
+                }
+
+                newVals[name] = v
+        }
+
+        for name, blockS := range schema.BlockTypes {
+                blockVal := valMap[name]
+                if blockVal.IsNull() || !blockVal.IsKnown() {
+                        newVals[name] = blockVal
+                        continue
+                }
+
+                blockValType := blockVal.Type()
+                blockElementType := blockS.Block.ImpliedType()
+
+                // This switches on the value type here, so we can correctly switch
+                // between Tuples/Lists and Maps/Objects.
+                switch {
+                case blockS.Nesting == configschema.NestingSingle || blockS.Nesting == configschema.NestingGroup:
+                        // NestingSingle is the only exception here, where we treat the
+                        // block directly as an object
+                        newVals[name] = SetUnknowns(blockVal, &blockS.Block)
+
+                case blockValType.IsSetType(), blockValType.IsListType(), blockValType.IsTupleType():
+                        listVals := blockVal.AsValueSlice()
+                        newListVals := make([]cty.Value, 0, len(listVals))
+
+                        for _, v := range listVals {
+                                newListVals = append(newListVals, SetUnknowns(v, &blockS.Block))
+                        }
+
+                        switch {
+                        case blockValType.IsSetType():
+                                switch len(newListVals) {
+                                case 0:
+                                        newVals[name] = cty.SetValEmpty(blockElementType)
+                                default:
+                                        newVals[name] = cty.SetVal(newListVals)
+                                }
+                        case blockValType.IsListType():
+                                switch len(newListVals) {
+                                case 0:
+                                        newVals[name] = cty.ListValEmpty(blockElementType)
+                                default:
+                                        newVals[name] = cty.ListVal(newListVals)
+                                }
+                        case blockValType.IsTupleType():
+                                newVals[name] = cty.TupleVal(newListVals)
+                        }
+
+                case blockValType.IsMapType(), blockValType.IsObjectType():
+                        mapVals := blockVal.AsValueMap()
+                        newMapVals := make(map[string]cty.Value)
+
+                        for k, v := range mapVals {
+                                newMapVals[k] = SetUnknowns(v, &blockS.Block)
+                        }
+
+                        switch {
+                        case blockValType.IsMapType():
+                                switch len(newMapVals) {
+                                case 0:
+                                        newVals[name] = cty.MapValEmpty(blockElementType)
+                                default:
+                                        newVals[name] = cty.MapVal(newMapVals)
+                                }
+                        case blockValType.IsObjectType():
+                                if len(newMapVals) == 0 {
+                                        // We need to populate empty values to make a valid object.
+                                        for attr, ty := range blockElementType.AttributeTypes() {
+                                                newMapVals[attr] = cty.NullVal(ty)
+                                        }
+                                }
+                                newVals[name] = cty.ObjectVal(newMapVals)
+                        }
+
+                default:
+                        panic(fmt.Sprintf("failed to set unknown values for nested block %q:%#v", name, blockValType))
+                }
+        }
+
+        return cty.ObjectVal(newVals)
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/grpc_test_provider.go b/vendor/github.com/hashicorp/terraform/helper/resource/grpc_test_provider.go
new file mode 100644
index 0000000..0742e99
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/grpc_test_provider.go
@@ -0,0 +1,43 @@
+package resource
+
+import (
+        "context"
+        "net"
+        "time"
+
+        "github.com/hashicorp/terraform/helper/plugin"
+        proto "github.com/hashicorp/terraform/internal/tfplugin5"
+        tfplugin "github.com/hashicorp/terraform/plugin"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/terraform"
+        "google.golang.org/grpc"
+        "google.golang.org/grpc/test/bufconn"
+)
+
+// GRPCTestProvider takes a legacy ResourceProvider, wraps it in the new GRPC
+// shim and starts it in a grpc server using an inmem connection. It returns a
+// GRPCClient for this new server to test the shimmed resource provider.
+func GRPCTestProvider(rp terraform.ResourceProvider) providers.Interface {
+        listener := bufconn.Listen(256 * 1024)
+        grpcServer := grpc.NewServer()
+
+        p := plugin.NewGRPCProviderServerShim(rp)
+        proto.RegisterProviderServer(grpcServer, p)
+
+        go grpcServer.Serve(listener)
+
+        conn, err := grpc.Dial("", grpc.WithDialer(func(string, time.Duration) (net.Conn, error) {
+                return listener.Dial()
+        }), grpc.WithInsecure())
+        if err != nil {
+                panic(err)
+        }
+
+        var pp tfplugin.GRPCProviderPlugin
+        client, _ := pp.GRPCClient(context.Background(), nil, conn)
+
+        grpcClient := client.(*tfplugin.GRPCProvider)
+        grpcClient.TestServer = grpcServer
+
+        return grpcClient
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/state.go b/vendor/github.com/hashicorp/terraform/helper/resource/state.go
index c34e21b..88a8396 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/state.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/state.go
@@ -38,7 +38,7 @@ type StateChangeConf struct {
 // specified in the configuration using the specified Refresh() func,
 // waiting the number of seconds specified in the timeout configuration.
 //
-// If the Refresh function returns a error, exit immediately with that error.
+// If the Refresh function returns an error, exit immediately with that error.
 //
 // If the Refresh function returns a state other than the Target state or one
 // listed in Pending, return immediately with an error.
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/state_shim.go b/vendor/github.com/hashicorp/terraform/helper/resource/state_shim.go
new file mode 100644
index 0000000..b2aff99
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/state_shim.go
@@ -0,0 +1,163 @@
+package resource
+
+import (
+        "fmt"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/hashicorp/terraform/helper/schema"
+
+        "github.com/hashicorp/terraform/states"
+        "github.com/hashicorp/terraform/terraform"
+)
+
+// shimState takes a new *states.State and reverts it to a legacy state for the provider ACC tests
+func shimNewState(newState *states.State, providers map[string]terraform.ResourceProvider) (*terraform.State, error) {
+        state := terraform.NewState()
+
+        // in the odd case of a nil state, let the helper packages handle it
+        if newState == nil {
+                return nil, nil
+        }
+
+        for _, newMod := range newState.Modules {
+                mod := state.AddModule(newMod.Addr)
+
+                for name, out := range newMod.OutputValues {
+                        outputType := ""
+                        val := hcl2shim.ConfigValueFromHCL2(out.Value)
+                        ty := out.Value.Type()
+                        switch {
+                        case ty == cty.String:
+                                outputType = "string"
+                        case ty.IsTupleType() || ty.IsListType():
+                                outputType = "list"
+                        case ty.IsMapType():
+                                outputType = "map"
+                        }
+
+                        mod.Outputs[name] = &terraform.OutputState{
+                                Type:      outputType,
+                                Value:     val,
+                                Sensitive: out.Sensitive,
+                        }
+                }
+
+                for _, res := range newMod.Resources {
+                        resType := res.Addr.Type
+                        providerType := res.ProviderConfig.ProviderConfig.Type
+
+                        resource := getResource(providers, providerType, res.Addr)
+
+                        for key, i := range res.Instances {
+                                flatmap, err := shimmedAttributes(i.Current, resource)
+                                if err != nil {
+                                        return nil, fmt.Errorf("error decoding state for %q: %s", resType, err)
+                                }
+
+                                resState := &terraform.ResourceState{
+                                        Type: resType,
+                                        Primary: &terraform.InstanceState{
+                                                ID:         flatmap["id"],
+                                                Attributes: flatmap,
+                                                Tainted:    i.Current.Status == states.ObjectTainted,
+                                        },
+                                        Provider: res.ProviderConfig.String(),
+                                }
+                                if i.Current.SchemaVersion != 0 {
+                                        resState.Primary.Meta = map[string]interface{}{
+                                                "schema_version": i.Current.SchemaVersion,
+                                        }
+                                }
+
+                                for _, dep := range i.Current.Dependencies {
+                                        resState.Dependencies = append(resState.Dependencies, dep.String())
+                                }
+
+                                // convert the indexes to the old style flapmap indexes
+                                idx := ""
+                                switch key.(type) {
+                                case addrs.IntKey:
+                                        // don't add numeric index values to resources with a count of 0
+                                        if len(res.Instances) > 1 {
+                                                idx = fmt.Sprintf(".%d", key)
+                                        }
+                                case addrs.StringKey:
+                                        idx = "." + key.String()
+                                }
+
+                                mod.Resources[res.Addr.String()+idx] = resState
+
+                                // add any deposed instances
+                                for _, dep := range i.Deposed {
+                                        flatmap, err := shimmedAttributes(dep, resource)
+                                        if err != nil {
+                                                return nil, fmt.Errorf("error decoding deposed state for %q: %s", resType, err)
+                                        }
+
+                                        deposed := &terraform.InstanceState{
+                                                ID:         flatmap["id"],
+                                                Attributes: flatmap,
+                                                Tainted:    dep.Status == states.ObjectTainted,
+                                        }
+                                        if dep.SchemaVersion != 0 {
+                                                deposed.Meta = map[string]interface{}{
+                                                        "schema_version": dep.SchemaVersion,
+                                                }
+                                        }
+
+                                        resState.Deposed = append(resState.Deposed, deposed)
+                                }
+                        }
+                }
+        }
+
+        return state, nil
+}
+
+func getResource(providers map[string]terraform.ResourceProvider, providerName string, addr addrs.Resource) *schema.Resource {
+        p := providers[providerName]
+        if p == nil {
+                panic(fmt.Sprintf("provider %q not found in test step", providerName))
+        }
+
+        // this is only for tests, so should only see schema.Providers
+        provider := p.(*schema.Provider)
+
+        switch addr.Mode {
+        case addrs.ManagedResourceMode:
+                resource := provider.ResourcesMap[addr.Type]
+                if resource != nil {
+                        return resource
+                }
+        case addrs.DataResourceMode:
+                resource := provider.DataSourcesMap[addr.Type]
+                if resource != nil {
+                        return resource
+                }
+        }
+
+        panic(fmt.Sprintf("resource %s not found in test step", addr.Type))
+}
+
+func shimmedAttributes(instance *states.ResourceInstanceObjectSrc, res *schema.Resource) (map[string]string, error) {
+        flatmap := instance.AttrsFlat
+        if flatmap != nil {
+                return flatmap, nil
+        }
+
+        // if we have json attrs, they need to be decoded
+        rio, err := instance.Decode(res.CoreConfigSchema().ImpliedType())
+        if err != nil {
+                return nil, err
+        }
+
+        instanceState, err := res.ShimInstanceStateFromValue(rio.Value)
+        if err != nil {
+                return nil, err
+        }
+
+        return instanceState.Attributes, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/testing.go b/vendor/github.com/hashicorp/terraform/helper/resource/testing.go
index b97673f..aa7454d 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/testing.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/testing.go
@@ -1,6 +1,7 @@
 package resource
 
 import (
+        "bytes"
         "flag"
         "fmt"
         "io"
@@ -18,9 +19,18 @@ import (
         "github.com/hashicorp/errwrap"
         "github.com/hashicorp/go-multierror"
         "github.com/hashicorp/logutils"
-        "github.com/hashicorp/terraform/config/module"
+        "github.com/mitchellh/colorstring"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/command/format"
+        "github.com/hashicorp/terraform/configs"
+        "github.com/hashicorp/terraform/configs/configload"
         "github.com/hashicorp/terraform/helper/logging"
+        "github.com/hashicorp/terraform/internal/initwd"
+        "github.com/hashicorp/terraform/providers"
+        "github.com/hashicorp/terraform/states"
         "github.com/hashicorp/terraform/terraform"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // flagSweep is a flag available when running tests on the command line. It
@@ -373,6 +383,10 @@ type TestStep struct {
         // be refreshed and don't matter.
         ImportStateVerify       bool
         ImportStateVerifyIgnore []string
+
+        // provider s is used internally to maintain a reference to the
+        // underlying providers during the tests
+        providers map[string]terraform.ResourceProvider
 }
 
 // Set to a file mask in sprintf format where %s is test name
@@ -467,10 +481,22 @@ func Test(t TestT, c TestCase) {
                 c.PreCheck()
         }
 
+        // get instances of all providers, so we can use the individual
+        // resources to shim the state during the tests.
+        providers := make(map[string]terraform.ResourceProvider)
+        for name, pf := range testProviderFactories(c) {
+                p, err := pf()
+                if err != nil {
+                        t.Fatal(err)
+                }
+                providers[name] = p
+        }
+
         providerResolver, err := testProviderResolver(c)
         if err != nil {
                 t.Fatal(err)
         }
+
         opts := terraform.ContextOpts{ProviderResolver: providerResolver}
 
         // A single state variable to track the lifecycle, starting with no state
@@ -481,6 +507,10 @@ func Test(t TestT, c TestCase) {
         idRefresh := c.IDRefreshName != ""
         errored := false
         for i, step := range c.Steps {
+                // insert the providers into the step so we can get the resources for
+                // shimming the state
+                step.providers = providers
+
                 var err error
                 log.Printf("[DEBUG] Test: Executing step %d", i)
 
@@ -535,8 +565,7 @@ func Test(t TestT, c TestCase) {
                                 }
                         } else {
                                 errored = true
-                                t.Error(fmt.Sprintf(
-                                        "Step %d error: %s", i, err))
+                                t.Error(fmt.Sprintf("Step %d error: %s", i, detailedErrorMessage(err)))
                                 break
                         }
                 }
@@ -591,6 +620,7 @@ func Test(t TestT, c TestCase) {
                         Destroy:                   true,
                         PreventDiskCleanup:        lastStep.PreventDiskCleanup,
                         PreventPostDestroyRefresh: c.PreventPostDestroyRefresh,
+                        providers:                 providers,
                 }
 
                 log.Printf("[WARN] Test: Executing destroy step")
@@ -620,39 +650,50 @@ func testProviderConfig(c TestCase) string {
         return strings.Join(lines, "")
 }
 
-// testProviderResolver is a helper to build a ResourceProviderResolver
-// with pre instantiated ResourceProviders, so that we can reset them for the
-// test, while only calling the factory function once.
-// Any errors are stored so that they can be returned by the factory in
-// terraform to match non-test behavior.
-func testProviderResolver(c TestCase) (terraform.ResourceProviderResolver, error) {
-        ctxProviders := c.ProviderFactories
-        if ctxProviders == nil {
-                ctxProviders = make(map[string]terraform.ResourceProviderFactory)
+// testProviderFactories combines the fixed Providers and
+// ResourceProviderFactory functions into a single map of
+// ResourceProviderFactory functions.
+func testProviderFactories(c TestCase) map[string]terraform.ResourceProviderFactory {
+        ctxProviders := make(map[string]terraform.ResourceProviderFactory)
+        for k, pf := range c.ProviderFactories {
+                ctxProviders[k] = pf
         }
 
         // add any fixed providers
         for k, p := range c.Providers {
                 ctxProviders[k] = terraform.ResourceProviderFactoryFixed(p)
         }
+        return ctxProviders
+}
+
+// testProviderResolver is a helper to build a ResourceProviderResolver
+// with pre instantiated ResourceProviders, so that we can reset them for the
+// test, while only calling the factory function once.
+// Any errors are stored so that they can be returned by the factory in
+// terraform to match non-test behavior.
+func testProviderResolver(c TestCase) (providers.Resolver, error) {
+        ctxProviders := testProviderFactories(c)
+
+        // wrap the old provider factories in the test grpc server so they can be
+        // called from terraform.
+        newProviders := make(map[string]providers.Factory)
 
-        // reset the providers if needed
         for k, pf := range ctxProviders {
-                // we can ignore any errors here, if we don't have a provider to reset
-                // the error will be handled later
-                p, err := pf()
-                if err != nil {
-                        return nil, err
-                }
-                if p, ok := p.(TestProvider); ok {
-                        err := p.TestReset()
+                factory := pf // must copy to ensure each closure sees its own value
+                newProviders[k] = func() (providers.Interface, error) {
+                        p, err := factory()
                         if err != nil {
-                                return nil, fmt.Errorf("[ERROR] failed to reset provider %q: %s", k, err)
+                                return nil, err
                         }
+
+                        // The provider is wrapped in a GRPCTestProvider so that it can be
+                        // passed back to terraform core as a providers.Interface, rather
+                        // than the legacy ResourceProvider.
+                        return GRPCTestProvider(p), nil
                 }
         }
 
-        return terraform.ResourceProviderResolverFixed(ctxProviders), nil
+        return providers.ResolverFixed(newProviders), nil
 }
 
 // UnitTest is a helper to force the acceptance testing harness to run in the
@@ -670,33 +711,40 @@ func testIDOnlyRefresh(c TestCase, opts terraform.ContextOpts, step TestStep, r
                 return nil
         }
 
-        name := fmt.Sprintf("%s.foo", r.Type)
+        addr := addrs.Resource{
+                Mode: addrs.ManagedResourceMode,
+                Type: r.Type,
+                Name: "foo",
+        }.Instance(addrs.NoKey)
+        absAddr := addr.Absolute(addrs.RootModuleInstance)
 
         // Build the state. The state is just the resource with an ID. There
         // are no attributes. We only set what is needed to perform a refresh.
-        state := terraform.NewState()
-        state.RootModule().Resources[name] = &terraform.ResourceState{
-                Type: r.Type,
-                Primary: &terraform.InstanceState{
-                        ID: r.Primary.ID,
+        state := states.NewState()
+        state.RootModule().SetResourceInstanceCurrent(
+                addr,
+                &states.ResourceInstanceObjectSrc{
+                        AttrsFlat: r.Primary.Attributes,
+                        Status:    states.ObjectReady,
                 },
-        }
+                addrs.ProviderConfig{Type: "placeholder"}.Absolute(addrs.RootModuleInstance),
+        )
 
         // Create the config module. We use the full config because Refresh
         // doesn't have access to it and we may need things like provider
         // configurations. The initial implementation of id-only checks used
         // an empty config module, but that caused the aforementioned problems.
-        mod, err := testModule(opts, step)
+        cfg, err := testConfig(opts, step)
         if err != nil {
                 return err
         }
 
         // Initialize the context
-        opts.Module = mod
+        opts.Config = cfg
         opts.State = state
-        ctx, err := terraform.NewContext(&opts)
-        if err != nil {
-                return err
+        ctx, ctxDiags := terraform.NewContext(&opts)
+        if ctxDiags.HasErrors() {
+                return ctxDiags.Err()
         }
         if diags := ctx.Validate(); len(diags) > 0 {
                 if diags.HasErrors() {
@@ -707,20 +755,20 @@ func testIDOnlyRefresh(c TestCase, opts terraform.ContextOpts, step TestStep, r
         }
 
         // Refresh!
-        state, err = ctx.Refresh()
-        if err != nil {
-                return fmt.Errorf("Error refreshing: %s", err)
+        state, refreshDiags := ctx.Refresh()
+        if refreshDiags.HasErrors() {
+                return refreshDiags.Err()
         }
 
         // Verify attribute equivalence.
-        actualR := state.RootModule().Resources[name]
+        actualR := state.ResourceInstance(absAddr)
         if actualR == nil {
                 return fmt.Errorf("Resource gone!")
         }
-        if actualR.Primary == nil {
+        if actualR.Current == nil {
                 return fmt.Errorf("Resource has no primary instance")
         }
-        actual := actualR.Primary.Attributes
+        actual := actualR.Current.AttrsFlat
         expected := r.Primary.Attributes
         // Remove fields we're ignoring
         for _, v := range c.IDRefreshIgnore {
@@ -756,15 +804,14 @@ func testIDOnlyRefresh(c TestCase, opts terraform.ContextOpts, step TestStep, r
         return nil
 }
 
-func testModule(opts terraform.ContextOpts, step TestStep) (*module.Tree, error) {
+func testConfig(opts terraform.ContextOpts, step TestStep) (*configs.Config, error) {
         if step.PreConfig != nil {
                 step.PreConfig()
         }
 
         cfgPath, err := ioutil.TempDir("", "tf-test")
         if err != nil {
-                return nil, fmt.Errorf(
-                        "Error creating temporary directory for config: %s", err)
+                return nil, fmt.Errorf("Error creating temporary directory for config: %s", err)
         }
 
         if step.PreventDiskCleanup {
@@ -773,38 +820,38 @@ func testModule(opts terraform.ContextOpts, step TestStep) (*module.Tree, error)
                 defer os.RemoveAll(cfgPath)
         }
 
-        // Write the configuration
-        cfgF, err := os.Create(filepath.Join(cfgPath, "main.tf"))
+        // Write the main configuration file
+        err = ioutil.WriteFile(filepath.Join(cfgPath, "main.tf"), []byte(step.Config), os.ModePerm)
         if err != nil {
-                return nil, fmt.Errorf(
-                        "Error creating temporary file for config: %s", err)
+                return nil, fmt.Errorf("Error creating temporary file for config: %s", err)
         }
 
-        _, err = io.Copy(cfgF, strings.NewReader(step.Config))
-        cfgF.Close()
+        // Create directory for our child modules, if any.
+        modulesDir := filepath.Join(cfgPath, ".modules")
+        err = os.Mkdir(modulesDir, os.ModePerm)
         if err != nil {
-                return nil, fmt.Errorf(
-                        "Error creating temporary file for config: %s", err)
+                return nil, fmt.Errorf("Error creating child modules directory: %s", err)
         }
 
-        // Parse the configuration
-        mod, err := module.NewTreeModule("", cfgPath)
-        if err != nil {
-                return nil, fmt.Errorf(
-                        "Error loading configuration: %s", err)
+        inst := initwd.NewModuleInstaller(modulesDir, nil)
+        _, installDiags := inst.InstallModules(cfgPath, true, initwd.ModuleInstallHooksImpl{})
+        if installDiags.HasErrors() {
+                return nil, installDiags.Err()
         }
 
-        // Load the modules
-        modStorage := &module.Storage{
-                StorageDir: filepath.Join(cfgPath, ".tfmodules"),
-                Mode:       module.GetModeGet,
-        }
-        err = mod.Load(modStorage)
+        loader, err := configload.NewLoader(&configload.Config{
+                ModulesDir: modulesDir,
+        })
         if err != nil {
-                return nil, fmt.Errorf("Error downloading modules: %s", err)
+                return nil, fmt.Errorf("failed to create config loader: %s", err)
+        }
+
+        config, configDiags := loader.LoadConfig(cfgPath)
+        if configDiags.HasErrors() {
+                return nil, configDiags
         }
 
-        return mod, nil
+        return config, nil
 }
 
 func testResource(c TestStep, state *terraform.State) (*terraform.ResourceState, error) {
@@ -881,8 +928,9 @@ func TestCheckResourceAttrSet(name, key string) TestCheckFunc {
 // TestCheckModuleResourceAttrSet - as per TestCheckResourceAttrSet but with
 // support for non-root modules
 func TestCheckModuleResourceAttrSet(mp []string, name string, key string) TestCheckFunc {
+        mpt := addrs.Module(mp).UnkeyedInstanceShim()
         return func(s *terraform.State) error {
-                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                is, err := modulePathPrimaryInstanceState(s, mpt, name)
                 if err != nil {
                         return err
                 }
@@ -915,8 +963,9 @@ func TestCheckResourceAttr(name, key, value string) TestCheckFunc {
 // TestCheckModuleResourceAttr - as per TestCheckResourceAttr but with
 // support for non-root modules
 func TestCheckModuleResourceAttr(mp []string, name string, key string, value string) TestCheckFunc {
+        mpt := addrs.Module(mp).UnkeyedInstanceShim()
         return func(s *terraform.State) error {
-                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                is, err := modulePathPrimaryInstanceState(s, mpt, name)
                 if err != nil {
                         return err
                 }
@@ -926,7 +975,19 @@ func TestCheckModuleResourceAttr(mp []string, name string, key string, value str
 }
 
 func testCheckResourceAttr(is *terraform.InstanceState, name string, key string, value string) error {
+        // Empty containers may be elided from the state.
+        // If the intent here is to check for an empty container, allow the key to
+        // also be non-existent.
+        emptyCheck := false
+        if value == "0" && (strings.HasSuffix(key, ".#") || strings.HasSuffix(key, ".%")) {
+                emptyCheck = true
+        }
+
         if v, ok := is.Attributes[key]; !ok || v != value {
+                if emptyCheck && !ok {
+                        return nil
+                }
+
                 if !ok {
                         return fmt.Errorf("%s: Attribute '%s' not found", name, key)
                 }
@@ -957,8 +1018,9 @@ func TestCheckNoResourceAttr(name, key string) TestCheckFunc {
 // TestCheckModuleNoResourceAttr - as per TestCheckNoResourceAttr but with
 // support for non-root modules
 func TestCheckModuleNoResourceAttr(mp []string, name string, key string) TestCheckFunc {
+        mpt := addrs.Module(mp).UnkeyedInstanceShim()
         return func(s *terraform.State) error {
-                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                is, err := modulePathPrimaryInstanceState(s, mpt, name)
                 if err != nil {
                         return err
                 }
@@ -968,7 +1030,20 @@ func TestCheckModuleNoResourceAttr(mp []string, name string, key string) TestChe
 }
 
 func testCheckNoResourceAttr(is *terraform.InstanceState, name string, key string) error {
-        if _, ok := is.Attributes[key]; ok {
+        // Empty containers may sometimes be included in the state.
+        // If the intent here is to check for an empty container, allow the value to
+        // also be "0".
+        emptyCheck := false
+        if strings.HasSuffix(key, ".#") || strings.HasSuffix(key, ".%") {
+                emptyCheck = true
+        }
+
+        val, exists := is.Attributes[key]
+        if emptyCheck && val == "0" {
+                return nil
+        }
+
+        if exists {
                 return fmt.Errorf("%s: Attribute '%s' found when not expected", name, key)
         }
 
@@ -991,8 +1066,9 @@ func TestMatchResourceAttr(name, key string, r *regexp.Regexp) TestCheckFunc {
 // TestModuleMatchResourceAttr - as per TestMatchResourceAttr but with
 // support for non-root modules
 func TestModuleMatchResourceAttr(mp []string, name string, key string, r *regexp.Regexp) TestCheckFunc {
+        mpt := addrs.Module(mp).UnkeyedInstanceShim()
         return func(s *terraform.State) error {
-                is, err := modulePathPrimaryInstanceState(s, mp, name)
+                is, err := modulePathPrimaryInstanceState(s, mpt, name)
                 if err != nil {
                         return err
                 }
@@ -1052,13 +1128,15 @@ func TestCheckResourceAttrPair(nameFirst, keyFirst, nameSecond, keySecond string
 // TestCheckModuleResourceAttrPair - as per TestCheckResourceAttrPair but with
 // support for non-root modules
 func TestCheckModuleResourceAttrPair(mpFirst []string, nameFirst string, keyFirst string, mpSecond []string, nameSecond string, keySecond string) TestCheckFunc {
+        mptFirst := addrs.Module(mpFirst).UnkeyedInstanceShim()
+        mptSecond := addrs.Module(mpSecond).UnkeyedInstanceShim()
         return func(s *terraform.State) error {
-                isFirst, err := modulePathPrimaryInstanceState(s, mpFirst, nameFirst)
+                isFirst, err := modulePathPrimaryInstanceState(s, mptFirst, nameFirst)
                 if err != nil {
                         return err
                 }
 
-                isSecond, err := modulePathPrimaryInstanceState(s, mpSecond, nameSecond)
+                isSecond, err := modulePathPrimaryInstanceState(s, mptSecond, nameSecond)
                 if err != nil {
                         return err
                 }
@@ -1068,14 +1146,32 @@ func TestCheckModuleResourceAttrPair(mpFirst []string, nameFirst string, keyFirs
 }
 
 func testCheckResourceAttrPair(isFirst *terraform.InstanceState, nameFirst string, keyFirst string, isSecond *terraform.InstanceState, nameSecond string, keySecond string) error {
-        vFirst, ok := isFirst.Attributes[keyFirst]
-        if !ok {
-                return fmt.Errorf("%s: Attribute '%s' not found", nameFirst, keyFirst)
+        vFirst, okFirst := isFirst.Attributes[keyFirst]
+        vSecond, okSecond := isSecond.Attributes[keySecond]
+
+        // Container count values of 0 should not be relied upon, and not reliably
+        // maintained by helper/schema. For the purpose of tests, consider unset and
+        // 0 to be equal.
+        if len(keyFirst) > 2 && len(keySecond) > 2 && keyFirst[len(keyFirst)-2:] == keySecond[len(keySecond)-2:] &&
+                (strings.HasSuffix(keyFirst, ".#") || strings.HasSuffix(keyFirst, ".%")) {
+                // they have the same suffix, and it is a collection count key.
+                if vFirst == "0" || vFirst == "" {
+                        okFirst = false
+                }
+                if vSecond == "0" || vSecond == "" {
+                        okSecond = false
+                }
         }
 
-        vSecond, ok := isSecond.Attributes[keySecond]
-        if !ok {
-                return fmt.Errorf("%s: Attribute '%s' not found", nameSecond, keySecond)
+        if okFirst != okSecond {
+                if !okFirst {
+                        return fmt.Errorf("%s: Attribute %q not set, but %q is set in %s as %q", nameFirst, keyFirst, keySecond, nameSecond, vSecond)
+                }
+                return fmt.Errorf("%s: Attribute %q is %q, but %q is not set in %s", nameFirst, keyFirst, vFirst, keySecond, nameSecond)
+        }
+        if !(okFirst || okSecond) {
+                // If they both don't exist then they are equally unset, so that's okay.
+                return nil
         }
 
         if vFirst != vSecond {
@@ -1163,7 +1259,7 @@ func modulePrimaryInstanceState(s *terraform.State, ms *terraform.ModuleState, n
 
 // modulePathPrimaryInstanceState returns the primary instance state for the
 // given resource name in a given module path.
-func modulePathPrimaryInstanceState(s *terraform.State, mp []string, name string) (*terraform.InstanceState, error) {
+func modulePathPrimaryInstanceState(s *terraform.State, mp addrs.ModuleInstance, name string) (*terraform.InstanceState, error) {
         ms := s.ModuleByPath(mp)
         if ms == nil {
                 return nil, fmt.Errorf("No module found at: %s", mp)
@@ -1178,3 +1274,47 @@ func primaryInstanceState(s *terraform.State, name string) (*terraform.InstanceS
         ms := s.RootModule()
         return modulePrimaryInstanceState(s, ms, name)
 }
+
+// operationError is a specialized implementation of error used to describe
+// failures during one of the several operations performed for a particular
+// test case.
+type operationError struct {
+        OpName string
+        Diags  tfdiags.Diagnostics
+}
+
+func newOperationError(opName string, diags tfdiags.Diagnostics) error {
+        return operationError{opName, diags}
+}
+
+// Error returns a terse error string containing just the basic diagnostic
+// messages, for situations where normal Go error behavior is appropriate.
+func (err operationError) Error() string {
+        return fmt.Sprintf("errors during %s: %s", err.OpName, err.Diags.Err().Error())
+}
+
+// ErrorDetail is like Error except it includes verbosely-rendered diagnostics
+// similar to what would come from a normal Terraform run, which include
+// additional context not included in Error().
+func (err operationError) ErrorDetail() string {
+        var buf bytes.Buffer
+        fmt.Fprintf(&buf, "errors during %s:", err.OpName)
+        clr := &colorstring.Colorize{Disable: true, Colors: colorstring.DefaultColors}
+        for _, diag := range err.Diags {
+                diagStr := format.Diagnostic(diag, nil, clr, 78)
+                buf.WriteByte('\n')
+                buf.WriteString(diagStr)
+        }
+        return buf.String()
+}
+
+// detailedErrorMessage is a helper for calling ErrorDetail on an error if
+// it is an operationError or just taking Error otherwise.
+func detailedErrorMessage(err error) string {
+        switch tErr := err.(type) {
+        case operationError:
+                return tErr.ErrorDetail()
+        default:
+                return err.Error()
+        }
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go b/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go
index 033f126..311fdb6 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/testing_config.go
@@ -1,13 +1,23 @@
 package resource
 
 import (
+        "bufio"
+        "bytes"
         "errors"
         "fmt"
         "log"
+        "sort"
         "strings"
 
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/hashicorp/terraform/states"
+
         "github.com/hashicorp/errwrap"
+        "github.com/hashicorp/terraform/plans"
         "github.com/hashicorp/terraform/terraform"
+        "github.com/hashicorp/terraform/tfdiags"
 )
 
 // testStepConfig runs a config-mode test step
@@ -18,69 +28,79 @@ func testStepConfig(
         return testStep(opts, state, step)
 }
 
-func testStep(
-        opts terraform.ContextOpts,
-        state *terraform.State,
-        step TestStep) (*terraform.State, error) {
-        // Pre-taint any resources that have been defined in Taint, as long as this
-        // is not a destroy step.
+func testStep(opts terraform.ContextOpts, state *terraform.State, step TestStep) (*terraform.State, error) {
         if !step.Destroy {
                 if err := testStepTaint(state, step); err != nil {
                         return state, err
                 }
         }
 
-        mod, err := testModule(opts, step)
+        cfg, err := testConfig(opts, step)
         if err != nil {
                 return state, err
         }
 
+        var stepDiags tfdiags.Diagnostics
+
         // Build the context
-        opts.Module = mod
-        opts.State = state
-        opts.Destroy = step.Destroy
-        ctx, err := terraform.NewContext(&opts)
+        opts.Config = cfg
+        opts.State, err = terraform.ShimLegacyState(state)
         if err != nil {
-                return state, fmt.Errorf("Error initializing context: %s", err)
+                return nil, err
+        }
+
+        opts.Destroy = step.Destroy
+        ctx, stepDiags := terraform.NewContext(&opts)
+        if stepDiags.HasErrors() {
+                return state, fmt.Errorf("Error initializing context: %s", stepDiags.Err())
         }
-        if diags := ctx.Validate(); len(diags) > 0 {
-                if diags.HasErrors() {
-                        return nil, errwrap.Wrapf("config is invalid: {{err}}", diags.Err())
+        if stepDiags := ctx.Validate(); len(stepDiags) > 0 {
+                if stepDiags.HasErrors() {
+                        return state, errwrap.Wrapf("config is invalid: {{err}}", stepDiags.Err())
                 }
 
-                log.Printf("[WARN] Config warnings:\n%s", diags)
+                log.Printf("[WARN] Config warnings:\n%s", stepDiags)
         }
 
         // Refresh!
-        state, err = ctx.Refresh()
+        newState, stepDiags := ctx.Refresh()
+        // shim the state first so the test can check the state on errors
+
+        state, err = shimNewState(newState, step.providers)
         if err != nil {
-                return state, fmt.Errorf(
-                        "Error refreshing: %s", err)
+                return nil, err
+        }
+        if stepDiags.HasErrors() {
+                return state, newOperationError("refresh", stepDiags)
         }
 
         // If this step is a PlanOnly step, skip over this first Plan and subsequent
         // Apply, and use the follow up Plan that checks for perpetual diffs
         if !step.PlanOnly {
                 // Plan!
-                if p, err := ctx.Plan(); err != nil {
-                        return state, fmt.Errorf(
-                                "Error planning: %s", err)
+                if p, stepDiags := ctx.Plan(); stepDiags.HasErrors() {
+                        return state, newOperationError("plan", stepDiags)
                 } else {
-                        log.Printf("[WARN] Test: Step plan: %s", p)
+                        log.Printf("[WARN] Test: Step plan: %s", legacyPlanComparisonString(newState, p.Changes))
                 }
 
                 // We need to keep a copy of the state prior to destroying
-                // such that destroy steps can verify their behaviour in the check
+                // such that destroy steps can verify their behavior in the check
                 // function
                 stateBeforeApplication := state.DeepCopy()
 
-                // Apply!
-                state, err = ctx.Apply()
+                // Apply the diff, creating real resources.
+                newState, stepDiags = ctx.Apply()
+                // shim the state first so the test can check the state on errors
+                state, err = shimNewState(newState, step.providers)
                 if err != nil {
-                        return state, fmt.Errorf("Error applying: %s", err)
+                        return nil, err
+                }
+                if stepDiags.HasErrors() {
+                        return state, newOperationError("apply", stepDiags)
                 }
 
-                // Check! Excitement!
+                // Run any configured checks
                 if step.Check != nil {
                         if step.Destroy {
                                 if err := step.Check(stateBeforeApplication); err != nil {
@@ -96,31 +116,35 @@ func testStep(
 
         // Now, verify that Plan is now empty and we don't have a perpetual diff issue
         // We do this with TWO plans. One without a refresh.
-        var p *terraform.Plan
-        if p, err = ctx.Plan(); err != nil {
-                return state, fmt.Errorf("Error on follow-up plan: %s", err)
+        var p *plans.Plan
+        if p, stepDiags = ctx.Plan(); stepDiags.HasErrors() {
+                return state, newOperationError("follow-up plan", stepDiags)
         }
-        if p.Diff != nil && !p.Diff.Empty() {
+        if !p.Changes.Empty() {
                 if step.ExpectNonEmptyPlan {
-                        log.Printf("[INFO] Got non-empty plan, as expected:\n\n%s", p)
+                        log.Printf("[INFO] Got non-empty plan, as expected:\n\n%s", legacyPlanComparisonString(newState, p.Changes))
                 } else {
                         return state, fmt.Errorf(
-                                "After applying this step, the plan was not empty:\n\n%s", p)
+                                "After applying this step, the plan was not empty:\n\n%s", legacyPlanComparisonString(newState, p.Changes))
                 }
         }
 
         // And another after a Refresh.
         if !step.Destroy || (step.Destroy && !step.PreventPostDestroyRefresh) {
-                state, err = ctx.Refresh()
+                newState, stepDiags = ctx.Refresh()
+                if stepDiags.HasErrors() {
+                        return state, newOperationError("follow-up refresh", stepDiags)
+                }
+
+                state, err = shimNewState(newState, step.providers)
                 if err != nil {
-                        return state, fmt.Errorf(
-                                "Error on follow-up refresh: %s", err)
+                        return nil, err
                 }
         }
-        if p, err = ctx.Plan(); err != nil {
-                return state, fmt.Errorf("Error on second follow-up plan: %s", err)
+        if p, stepDiags = ctx.Plan(); stepDiags.HasErrors() {
+                return state, newOperationError("second follow-up refresh", stepDiags)
         }
-        empty := p.Diff == nil || p.Diff.Empty()
+        empty := p.Changes.Empty()
 
         // Data resources are tricky because they legitimately get instantiated
         // during refresh so that they will be already populated during the
@@ -128,35 +152,28 @@ func testStep(
         // config we'll end up wanting to destroy them again here. This is
         // acceptable and expected, and we'll treat it as "empty" for the
         // sake of this testing.
-        if step.Destroy {
+        if step.Destroy && !empty {
                 empty = true
-
-                for _, moduleDiff := range p.Diff.Modules {
-                        for k, instanceDiff := range moduleDiff.Resources {
-                                if !strings.HasPrefix(k, "data.") {
-                                        empty = false
-                                        break
-                                }
-
-                                if !instanceDiff.Destroy {
-                                        empty = false
-                                }
+                for _, change := range p.Changes.Resources {
+                        if change.Addr.Resource.Resource.Mode != addrs.DataResourceMode {
+                                empty = false
+                                break
                         }
                 }
         }
 
         if !empty {
                 if step.ExpectNonEmptyPlan {
-                        log.Printf("[INFO] Got non-empty plan, as expected:\n\n%s", p)
+                        log.Printf("[INFO] Got non-empty plan, as expected:\n\n%s", legacyPlanComparisonString(newState, p.Changes))
                 } else {
                         return state, fmt.Errorf(
                                 "After applying this step and refreshing, "+
-                                        "the plan was not empty:\n\n%s", p)
+                                        "the plan was not empty:\n\n%s", legacyPlanComparisonString(newState, p.Changes))
                 }
         }
 
         // Made it here, but expected a non-empty plan, fail!
-        if step.ExpectNonEmptyPlan && (p.Diff == nil || p.Diff.Empty()) {
+        if step.ExpectNonEmptyPlan && empty {
                 return state, fmt.Errorf("Expected a non-empty plan, but got an empty plan!")
         }
 
@@ -164,6 +181,213 @@ func testStep(
         return state, nil
 }
 
+// legacyPlanComparisonString produces a string representation of the changes
+// from a plan and a given state togther, as was formerly produced by the
+// String method of terraform.Plan.
+//
+// This is here only for compatibility with existing tests that predate our
+// new plan and state types, and should not be used in new tests. Instead, use
+// a library like "cmp" to do a deep equality  and diff on the two
+// data structures.
+func legacyPlanComparisonString(state *states.State, changes *plans.Changes) string {
+        return fmt.Sprintf(
+                "DIFF:\n\n%s\n\nSTATE:\n\n%s",
+                legacyDiffComparisonString(changes),
+                state.String(),
+        )
+}
+
+// legacyDiffComparisonString produces a string representation of the changes
+// from a planned changes object, as was formerly produced by the String method
+// of terraform.Diff.
+//
+// This is here only for compatibility with existing tests that predate our
+// new plan types, and should not be used in new tests. Instead, use a library
+// like "cmp" to do a deep equality check and diff on the two data structures.
+func legacyDiffComparisonString(changes *plans.Changes) string {
+        // The old string representation of a plan was grouped by module, but
+        // our new plan structure is not grouped in that way and so we'll need
+        // to preprocess it in order to produce that grouping.
+        type ResourceChanges struct {
+                Current *plans.ResourceInstanceChangeSrc
+                Deposed map[states.DeposedKey]*plans.ResourceInstanceChangeSrc
+        }
+        byModule := map[string]map[string]*ResourceChanges{}
+        resourceKeys := map[string][]string{}
+        requiresReplace := map[string][]string{}
+        var moduleKeys []string
+        for _, rc := range changes.Resources {
+                if rc.Action == plans.NoOp {
+                        // We won't mention no-op changes here at all, since the old plan
+                        // model we are emulating here didn't have such a concept.
+                        continue
+                }
+                moduleKey := rc.Addr.Module.String()
+                if _, exists := byModule[moduleKey]; !exists {
+                        moduleKeys = append(moduleKeys, moduleKey)
+                        byModule[moduleKey] = make(map[string]*ResourceChanges)
+                }
+                resourceKey := rc.Addr.Resource.String()
+                if _, exists := byModule[moduleKey][resourceKey]; !exists {
+                        resourceKeys[moduleKey] = append(resourceKeys[moduleKey], resourceKey)
+                        byModule[moduleKey][resourceKey] = &ResourceChanges{
+                                Deposed: make(map[states.DeposedKey]*plans.ResourceInstanceChangeSrc),
+                        }
+                }
+
+                if rc.DeposedKey == states.NotDeposed {
+                        byModule[moduleKey][resourceKey].Current = rc
+                } else {
+                        byModule[moduleKey][resourceKey].Deposed[rc.DeposedKey] = rc
+                }
+
+                rr := []string{}
+                for _, p := range rc.RequiredReplace.List() {
+                        rr = append(rr, hcl2shim.FlatmapKeyFromPath(p))
+                }
+                requiresReplace[resourceKey] = rr
+        }
+        sort.Strings(moduleKeys)
+        for _, ks := range resourceKeys {
+                sort.Strings(ks)
+        }
+
+        var buf bytes.Buffer
+
+        for _, moduleKey := range moduleKeys {
+                rcs := byModule[moduleKey]
+                var mBuf bytes.Buffer
+
+                for _, resourceKey := range resourceKeys[moduleKey] {
+                        rc := rcs[resourceKey]
+
+                        forceNewAttrs := requiresReplace[resourceKey]
+
+                        crud := "UPDATE"
+                        if rc.Current != nil {
+                                switch rc.Current.Action {
+                                case plans.DeleteThenCreate:
+                                        crud = "DESTROY/CREATE"
+                                case plans.CreateThenDelete:
+                                        crud = "CREATE/DESTROY"
+                                case plans.Delete:
+                                        crud = "DESTROY"
+                                case plans.Create:
+                                        crud = "CREATE"
+                                }
+                        } else {
+                                // We must be working on a deposed object then, in which
+                                // case destroying is the only possible action.
+                                crud = "DESTROY"
+                        }
+
+                        extra := ""
+                        if rc.Current == nil && len(rc.Deposed) > 0 {
+                                extra = " (deposed only)"
+                        }
+
+                        fmt.Fprintf(
+                                &mBuf, "%s: %s%s\n",
+                                crud, resourceKey, extra,
+                        )
+
+                        attrNames := map[string]bool{}
+                        var oldAttrs map[string]string
+                        var newAttrs map[string]string
+                        if rc.Current != nil {
+                                if before := rc.Current.Before; before != nil {
+                                        ty, err := before.ImpliedType()
+                                        if err == nil {
+                                                val, err := before.Decode(ty)
+                                                if err == nil {
+                                                        oldAttrs = hcl2shim.FlatmapValueFromHCL2(val)
+                                                        for k := range oldAttrs {
+                                                                attrNames[k] = true
+                                                        }
+                                                }
+                                        }
+                                }
+                                if after := rc.Current.After; after != nil {
+                                        ty, err := after.ImpliedType()
+                                        if err == nil {
+                                                val, err := after.Decode(ty)
+                                                if err == nil {
+                                                        newAttrs = hcl2shim.FlatmapValueFromHCL2(val)
+                                                        for k := range newAttrs {
+                                                                attrNames[k] = true
+                                                        }
+                                                }
+                                        }
+                                }
+                        }
+                        if oldAttrs == nil {
+                                oldAttrs = make(map[string]string)
+                        }
+                        if newAttrs == nil {
+                                newAttrs = make(map[string]string)
+                        }
+
+                        attrNamesOrder := make([]string, 0, len(attrNames))
+                        keyLen := 0
+                        for n := range attrNames {
+                                attrNamesOrder = append(attrNamesOrder, n)
+                                if len(n) > keyLen {
+                                        keyLen = len(n)
+                                }
+                        }
+                        sort.Strings(attrNamesOrder)
+
+                        for _, attrK := range attrNamesOrder {
+                                v := newAttrs[attrK]
+                                u := oldAttrs[attrK]
+
+                                if v == config.UnknownVariableValue {
+                                        v = "<computed>"
+                                }
+                                // NOTE: we don't support <sensitive> here because we would
+                                // need schema to do that. Excluding sensitive values
+                                // is now done at the UI layer, and so should not be tested
+                                // at the core layer.
+
+                                updateMsg := ""
+
+                                // This may not be as precise as in the old diff, as it matches
+                                // everything under the attribute that was originally marked as
+                                // ForceNew, but should help make it easier to determine what
+                                // caused replacement here.
+                                for _, k := range forceNewAttrs {
+                                        if strings.HasPrefix(attrK, k) {
+                                                updateMsg = " (forces new resource)"
+                                                break
+                                        }
+                                }
+
+                                fmt.Fprintf(
+                                        &mBuf, "  %s:%s %#v => %#v%s\n",
+                                        attrK,
+                                        strings.Repeat(" ", keyLen-len(attrK)),
+                                        u, v,
+                                        updateMsg,
+                                )
+                        }
+                }
+
+                if moduleKey == "" { // root module
+                        buf.Write(mBuf.Bytes())
+                        buf.WriteByte('\n')
+                        continue
+                }
+
+                fmt.Fprintf(&buf, "%s:\n", moduleKey)
+                s := bufio.NewScanner(&mBuf)
+                for s.Scan() {
+                        buf.WriteString(fmt.Sprintf("  %s\n", s.Text()))
+                }
+        }
+
+        return buf.String()
+}
+
 func testStepTaint(state *terraform.State, step TestStep) error {
         for _, p := range step.Taint {
                 m := state.RootModule()
diff --git a/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go b/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go
index 94fef3c..e1b7aea 100644
--- a/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go
+++ b/vendor/github.com/hashicorp/terraform/helper/resource/testing_import_state.go
@@ -7,6 +7,12 @@ import (
         "strings"
 
         "github.com/davecgh/go-spew/spew"
+        "github.com/hashicorp/hcl2/hcl"
+        "github.com/hashicorp/hcl2/hcl/hclsyntax"
+
+        "github.com/hashicorp/terraform/addrs"
+        "github.com/hashicorp/terraform/helper/schema"
+        "github.com/hashicorp/terraform/states"
         "github.com/hashicorp/terraform/terraform"
 )
 
@@ -15,6 +21,7 @@ func testStepImportState(
         opts terraform.ContextOpts,
         state *terraform.State,
         step TestStep) (*terraform.State, error) {
+
         // Determine the ID to import
         var importId string
         switch {
@@ -41,33 +48,53 @@ func testStepImportState(
 
         // Setup the context. We initialize with an empty state. We use the
         // full config for provider configurations.
-        mod, err := testModule(opts, step)
+        cfg, err := testConfig(opts, step)
         if err != nil {
                 return state, err
         }
 
-        opts.Module = mod
-        opts.State = terraform.NewState()
-        ctx, err := terraform.NewContext(&opts)
-        if err != nil {
-                return state, err
+        opts.Config = cfg
+
+        // import tests start with empty state
+        opts.State = states.NewState()
+
+        ctx, stepDiags := terraform.NewContext(&opts)
+        if stepDiags.HasErrors() {
+                return state, stepDiags.Err()
         }
 
-        // Do the import!
-        newState, err := ctx.Import(&terraform.ImportOpts{
+        // The test step provides the resource address as a string, so we need
+        // to parse it to get an addrs.AbsResourceAddress to pass in to the
+        // import method.
+        traversal, hclDiags := hclsyntax.ParseTraversalAbs([]byte(step.ResourceName), "", hcl.Pos{})
+        if hclDiags.HasErrors() {
+                return nil, hclDiags
+        }
+        importAddr, stepDiags := addrs.ParseAbsResourceInstance(traversal)
+        if stepDiags.HasErrors() {
+                return nil, stepDiags.Err()
+        }
+
+        // Do the import
+        importedState, stepDiags := ctx.Import(&terraform.ImportOpts{
                 // Set the module so that any provider config is loaded
-                Module: mod,
+                Config: cfg,
 
                 Targets: []*terraform.ImportTarget{
                         &terraform.ImportTarget{
-                                Addr: step.ResourceName,
+                                Addr: importAddr,
                                 ID:   importId,
                         },
                 },
         })
+        if stepDiags.HasErrors() {
+                log.Printf("[ERROR] Test: ImportState failure: %s", stepDiags.Err())
+                return state, stepDiags.Err()
+        }
+
+        newState, err := shimNewState(importedState, step.providers)
         if err != nil {
-                log.Printf("[ERROR] Test: ImportState failure: %s", err)
-                return state, err
+                return nil, err
         }
 
         // Go through the new state and verify
@@ -75,7 +102,9 @@ func testStepImportState(
                 var states []*terraform.InstanceState
                 for _, r := range newState.RootModule().Resources {
                         if r.Primary != nil {
-                                states = append(states, r.Primary)
+                                is := r.Primary.DeepCopy()
+                                is.Ephemeral.Type = r.Type // otherwise the check function cannot see the type
+                                states = append(states, is)
                         }
                 }
                 if err := step.ImportStateCheck(states); err != nil {
@@ -102,30 +131,84 @@ func testStepImportState(
                                         r.Primary.ID)
                         }
 
+                        // We'll try our best to find the schema for this resource type
+                        // so we can ignore Removed fields during validation. If we fail
+                        // to find the schema then we won't ignore them and so the test
+                        // will need to rely on explicit ImportStateVerifyIgnore, though
+                        // this shouldn't happen in any reasonable case.
+                        var rsrcSchema *schema.Resource
+                        if providerAddr, diags := addrs.ParseAbsProviderConfigStr(r.Provider); !diags.HasErrors() {
+                                providerType := providerAddr.ProviderConfig.Type
+                                if provider, ok := step.providers[providerType]; ok {
+                                        if provider, ok := provider.(*schema.Provider); ok {
+                                                rsrcSchema = provider.ResourcesMap[r.Type]
+                                        }
+                                }
+                        }
+
+                        // don't add empty flatmapped containers, so we can more easily
+                        // compare the attributes
+                        skipEmpty := func(k, v string) bool {
+                                if strings.HasSuffix(k, ".#") || strings.HasSuffix(k, ".%") {
+                                        if v == "0" {
+                                                return true
+                                        }
+                                }
+                                return false
+                        }
+
                         // Compare their attributes
                         actual := make(map[string]string)
                         for k, v := range r.Primary.Attributes {
+                                if skipEmpty(k, v) {
+                                        continue
+                                }
                                 actual[k] = v
                         }
+
                         expected := make(map[string]string)
                         for k, v := range oldR.Primary.Attributes {
+                                if skipEmpty(k, v) {
+                                        continue
+                                }
                                 expected[k] = v
                         }
 
                         // Remove fields we're ignoring
                         for _, v := range step.ImportStateVerifyIgnore {
-                                for k, _ := range actual {
+                                for k := range actual {
                                         if strings.HasPrefix(k, v) {
                                                 delete(actual, k)
                                         }
                                 }
-                                for k, _ := range expected {
+                                for k := range expected {
                                         if strings.HasPrefix(k, v) {
                                                 delete(expected, k)
                                         }
                                 }
                         }
 
+                        // Also remove any attributes that are marked as "Removed" in the
+                        // schema, if we have a schema to check that against.
+                        if rsrcSchema != nil {
+                                for k := range actual {
+                                        for _, schema := range rsrcSchema.SchemasForFlatmapPath(k) {
+                                                if schema.Removed != "" {
+                                                        delete(actual, k)
+                                                        break
+                                                }
+                                        }
+                                }
+                                for k := range expected {
+                                        for _, schema := range rsrcSchema.SchemasForFlatmapPath(k) {
+                                                if schema.Removed != "" {
+                                                        delete(expected, k)
+                                                        break
+                                                }
+                                        }
+                                }
+                        }
+
                         if !reflect.DeepEqual(actual, expected) {
                                 // Determine only the different attributes
                                 for k, v := range expected {
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/backend.go b/vendor/github.com/hashicorp/terraform/helper/schema/backend.go
index 57fbba7..c8d8ae2 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/backend.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/backend.go
@@ -2,8 +2,15 @@ package schema
 
 import (
         "context"
+        "fmt"
 
+        "github.com/hashicorp/terraform/tfdiags"
+        "github.com/zclconf/go-cty/cty"
+
+        "github.com/hashicorp/terraform/config/hcl2shim"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/hashicorp/terraform/terraform"
+        ctyconvert "github.com/zclconf/go-cty/cty/convert"
 )
 
 // Backend represents a partial backend.Backend implementation and simplifies
@@ -38,41 +45,123 @@ func FromContextBackendConfig(ctx context.Context) *ResourceData {
         return ctx.Value(backendConfigKey).(*ResourceData)
 }
 
-func (b *Backend) Input(
-        input terraform.UIInput,
-        c *terraform.ResourceConfig) (*terraform.ResourceConfig, error) {
+func (b *Backend) ConfigSchema() *configschema.Block {
+        // This is an alias of CoreConfigSchema just to implement the
+        // backend.Backend interface.
+        return b.CoreConfigSchema()
+}
+
+func (b *Backend) PrepareConfig(configVal cty.Value) (cty.Value, tfdiags.Diagnostics) {
         if b == nil {
-                return c, nil
+                return configVal, nil
         }
+        var diags tfdiags.Diagnostics
+        var err error
 
-        return schemaMap(b.Schema).Input(input, c)
-}
+        // In order to use Transform below, this needs to be filled out completely
+        // according the schema.
+        configVal, err = b.CoreConfigSchema().CoerceValue(configVal)
+        if err != nil {
+                return configVal, diags.Append(err)
+        }
 
-func (b *Backend) Validate(c *terraform.ResourceConfig) ([]string, []error) {
-        if b == nil {
-                return nil, nil
+        // lookup any required, top-level attributes that are Null, and see if we
+        // have a Default value available.
+        configVal, err = cty.Transform(configVal, func(path cty.Path, val cty.Value) (cty.Value, error) {
+                // we're only looking for top-level attributes
+                if len(path) != 1 {
+                        return val, nil
+                }
+
+                // nothing to do if we already have a value
+                if !val.IsNull() {
+                        return val, nil
+                }
+
+                // get the Schema definition for this attribute
+                getAttr, ok := path[0].(cty.GetAttrStep)
+                // these should all exist, but just ignore anything strange
+                if !ok {
+                        return val, nil
+                }
+
+                attrSchema := b.Schema[getAttr.Name]
+                // continue to ignore anything that doesn't match
+                if attrSchema == nil {
+                        return val, nil
+                }
+
+                // this is deprecated, so don't set it
+                if attrSchema.Deprecated != "" || attrSchema.Removed != "" {
+                        return val, nil
+                }
+
+                // find a default value if it exists
+                def, err := attrSchema.DefaultValue()
+                if err != nil {
+                        diags = diags.Append(fmt.Errorf("error getting default for %q: %s", getAttr.Name, err))
+                        return val, err
+                }
+
+                // no default
+                if def == nil {
+                        return val, nil
+                }
+
+                // create a cty.Value and make sure it's the correct type
+                tmpVal := hcl2shim.HCL2ValueFromConfigValue(def)
+
+                // helper/schema used to allow setting "" to a bool
+                if val.Type() == cty.Bool && tmpVal.RawEquals(cty.StringVal("")) {
+                        // return a warning about the conversion
+                        diags = diags.Append("provider set empty string as default value for bool " + getAttr.Name)
+                        tmpVal = cty.False
+                }
+
+                val, err = ctyconvert.Convert(tmpVal, val.Type())
+                if err != nil {
+                        diags = diags.Append(fmt.Errorf("error setting default for %q: %s", getAttr.Name, err))
+                }
+
+                return val, err
+        })
+        if err != nil {
+                // any error here was already added to the diagnostics
+                return configVal, diags
         }
 
-        return schemaMap(b.Schema).Validate(c)
+        shimRC := b.shimConfig(configVal)
+        warns, errs := schemaMap(b.Schema).Validate(shimRC)
+        for _, warn := range warns {
+                diags = diags.Append(tfdiags.SimpleWarning(warn))
+        }
+        for _, err := range errs {
+                diags = diags.Append(err)
+        }
+        return configVal, diags
 }
 
-func (b *Backend) Configure(c *terraform.ResourceConfig) error {
+func (b *Backend) Configure(obj cty.Value) tfdiags.Diagnostics {
         if b == nil {
                 return nil
         }
 
+        var diags tfdiags.Diagnostics
         sm := schemaMap(b.Schema)
+        shimRC := b.shimConfig(obj)
 
         // Get a ResourceData for this configuration. To do this, we actually
         // generate an intermediary "diff" although that is never exposed.
-        diff, err := sm.Diff(nil, c, nil, nil)
+        diff, err := sm.Diff(nil, shimRC, nil, nil, true)
         if err != nil {
-                return err
+                diags = diags.Append(err)
+                return diags
         }
 
         data, err := sm.Data(nil, diff)
         if err != nil {
-                return err
+                diags = diags.Append(err)
+                return diags
         }
         b.config = data
 
@@ -80,11 +169,28 @@ func (b *Backend) Configure(c *terraform.ResourceConfig) error {
                 err = b.ConfigureFunc(context.WithValue(
                         context.Background(), backendConfigKey, data))
                 if err != nil {
-                        return err
+                        diags = diags.Append(err)
+                        return diags
                 }
         }
 
-        return nil
+        return diags
+}
+
+// shimConfig turns a new-style cty.Value configuration (which must be of
+// an object type) into a minimal old-style *terraform.ResourceConfig object
+// that should be populated enough to appease the not-yet-updated functionality
+// in this package. This should be removed once everything is updated.
+func (b *Backend) shimConfig(obj cty.Value) *terraform.ResourceConfig {
+        shimMap, ok := hcl2shim.ConfigValueFromHCL2(obj).(map[string]interface{})
+        if !ok {
+                // If the configVal was nil, we still want a non-nil map here.
+                shimMap = map[string]interface{}{}
+        }
+        return &terraform.ResourceConfig{
+                Config: shimMap,
+                Raw:    shimMap,
+        }
 }
 
 // Config returns the configuration. This is available after Configure is
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go b/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go
index bf952f6..875677e 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/core_schema.go
@@ -3,7 +3,7 @@ package schema
 import (
         "fmt"
 
-        "github.com/hashicorp/terraform/config/configschema"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/zclconf/go-cty/cty"
 )
 
@@ -39,14 +39,42 @@ func (m schemaMap) CoreConfigSchema() *configschema.Block {
                         ret.Attributes[name] = schema.coreConfigSchemaAttribute()
                         continue
                 }
-                switch schema.Elem.(type) {
-                case *Schema:
+                if schema.Type == TypeMap {
+                        // For TypeMap in particular, it isn't valid for Elem to be a
+                        // *Resource (since that would be ambiguous in flatmap) and
+                        // so Elem is treated as a TypeString schema if so. This matches
+                        // how the field readers treat this situation, for compatibility
+                        // with configurations targeting Terraform 0.11 and earlier.
+                        if _, isResource := schema.Elem.(*Resource); isResource {
+                                sch := *schema // shallow copy
+                                sch.Elem = &Schema{
+                                        Type: TypeString,
+                                }
+                                ret.Attributes[name] = sch.coreConfigSchemaAttribute()
+                                continue
+                        }
+                }
+                switch schema.ConfigMode {
+                case SchemaConfigModeAttr:
                         ret.Attributes[name] = schema.coreConfigSchemaAttribute()
-                case *Resource:
+                case SchemaConfigModeBlock:
                         ret.BlockTypes[name] = schema.coreConfigSchemaBlock()
-                default:
-                        // Should never happen for a valid schema
-                        panic(fmt.Errorf("invalid Schema.Elem %#v; need *Schema or *Resource", schema.Elem))
+                default: // SchemaConfigModeAuto, or any other invalid value
+                        if schema.Computed && !schema.Optional {
+                                // Computed-only schemas are always handled as attributes,
+                                // because they never appear in configuration.
+                                ret.Attributes[name] = schema.coreConfigSchemaAttribute()
+                                continue
+                        }
+                        switch schema.Elem.(type) {
+                        case *Schema, ValueType:
+                                ret.Attributes[name] = schema.coreConfigSchemaAttribute()
+                        case *Resource:
+                                ret.BlockTypes[name] = schema.coreConfigSchemaBlock()
+                        default:
+                                // Should never happen for a valid schema
+                                panic(fmt.Errorf("invalid Schema.Elem %#v; need *Schema or *Resource", schema.Elem))
+                        }
                 }
         }
 
@@ -58,12 +86,42 @@ func (m schemaMap) CoreConfigSchema() *configschema.Block {
 // Elem is an instance of Schema. Use coreConfigSchemaBlock for collections
 // whose elem is a whole resource.
 func (s *Schema) coreConfigSchemaAttribute() *configschema.Attribute {
+        // The Schema.DefaultFunc capability adds some extra weirdness here since
+        // it can be combined with "Required: true" to create a sitution where
+        // required-ness is conditional. Terraform Core doesn't share this concept,
+        // so we must sniff for this possibility here and conditionally turn
+        // off the "Required" flag if it looks like the DefaultFunc is going
+        // to provide a value.
+        // This is not 100% true to the original interface of DefaultFunc but
+        // works well enough for the EnvDefaultFunc and MultiEnvDefaultFunc
+        // situations, which are the main cases we care about.
+        //
+        // Note that this also has a consequence for commands that return schema
+        // information for documentation purposes: running those for certain
+        // providers will produce different results depending on which environment
+        // variables are set. We accept that weirdness in order to keep this
+        // interface to core otherwise simple.
+        reqd := s.Required
+        opt := s.Optional
+        if reqd && s.DefaultFunc != nil {
+                v, err := s.DefaultFunc()
+                // We can't report errors from here, so we'll instead just force
+                // "Required" to false and let the provider try calling its
+                // DefaultFunc again during the validate step, where it can then
+                // return the error.
+                if err != nil || (err == nil && v != nil) {
+                        reqd = false
+                        opt = true
+                }
+        }
+
         return &configschema.Attribute{
-                Type:      s.coreConfigSchemaType(),
-                Optional:  s.Optional,
-                Required:  s.Required,
-                Computed:  s.Computed,
-                Sensitive: s.Sensitive,
+                Type:        s.coreConfigSchemaType(),
+                Optional:    opt,
+                Required:    reqd,
+                Computed:    s.Computed,
+                Sensitive:   s.Sensitive,
+                Description: s.Description,
         }
 }
 
@@ -72,7 +130,7 @@ func (s *Schema) coreConfigSchemaAttribute() *configschema.Attribute {
 // of Resource, and will panic otherwise.
 func (s *Schema) coreConfigSchemaBlock() *configschema.NestedBlock {
         ret := &configschema.NestedBlock{}
-        if nested := s.Elem.(*Resource).CoreConfigSchema(); nested != nil {
+        if nested := s.Elem.(*Resource).coreConfigSchema(); nested != nil {
                 ret.Block = *nested
         }
         switch s.Type {
@@ -95,6 +153,20 @@ func (s *Schema) coreConfigSchemaBlock() *configschema.NestedBlock {
                 // blocks, but we can fake it by requiring at least one item.
                 ret.MinItems = 1
         }
+        if s.Optional && s.MinItems > 0 {
+                // Historically helper/schema would ignore MinItems if Optional were
+                // set, so we must mimic this behavior here to ensure that providers
+                // relying on that undocumented behavior can continue to operate as
+                // they did before.
+                ret.MinItems = 0
+        }
+        if s.Computed && !s.Optional {
+                // MinItems/MaxItems are meaningless for computed nested blocks, since
+                // they are never set by the user anyway. This ensures that we'll never
+                // generate weird errors about them.
+                ret.MinItems = 0
+                ret.MaxItems = 0
+        }
 
         return ret
 }
@@ -117,11 +189,16 @@ func (s *Schema) coreConfigSchemaType() cty.Type {
                 switch set := s.Elem.(type) {
                 case *Schema:
                         elemType = set.coreConfigSchemaType()
+                case ValueType:
+                        // This represents a mistake in the provider code, but it's a
+                        // common one so we'll just shim it.
+                        elemType = (&Schema{Type: set}).coreConfigSchemaType()
                 case *Resource:
-                        // In practice we don't actually use this for normal schema
-                        // construction because we construct a NestedBlock in that
-                        // case instead. See schemaMap.CoreConfigSchema.
-                        elemType = set.CoreConfigSchema().ImpliedType()
+                        // By default we construct a NestedBlock in this case, but this
+                        // behavior is selected either for computed-only schemas or
+                        // when ConfigMode is explicitly SchemaConfigModeBlock.
+                        // See schemaMap.CoreConfigSchema for the exact rules.
+                        elemType = set.coreConfigSchema().ImpliedType()
                 default:
                         if set != nil {
                                 // Should never happen for a valid schema
@@ -148,8 +225,85 @@ func (s *Schema) coreConfigSchemaType() cty.Type {
         }
 }
 
-// CoreConfigSchema is a convenient shortcut for calling CoreConfigSchema
-// on the resource's schema.
+// CoreConfigSchema is a convenient shortcut for calling CoreConfigSchema on
+// the resource's schema. CoreConfigSchema adds the implicitly required "id"
+// attribute for top level resources if it doesn't exist.
 func (r *Resource) CoreConfigSchema() *configschema.Block {
+        block := r.coreConfigSchema()
+
+        if block.Attributes == nil {
+                block.Attributes = map[string]*configschema.Attribute{}
+        }
+
+        // Add the implicitly required "id" field if it doesn't exist
+        if block.Attributes["id"] == nil {
+                block.Attributes["id"] = &configschema.Attribute{
+                        Type:     cty.String,
+                        Optional: true,
+                        Computed: true,
+                }
+        }
+
+        _, timeoutsAttr := block.Attributes[TimeoutsConfigKey]
+        _, timeoutsBlock := block.BlockTypes[TimeoutsConfigKey]
+
+        // Insert configured timeout values into the schema, as long as the schema
+        // didn't define anything else by that name.
+        if r.Timeouts != nil && !timeoutsAttr && !timeoutsBlock {
+                timeouts := configschema.Block{
+                        Attributes: map[string]*configschema.Attribute{},
+                }
+
+                if r.Timeouts.Create != nil {
+                        timeouts.Attributes[TimeoutCreate] = &configschema.Attribute{
+                                Type:     cty.String,
+                                Optional: true,
+                        }
+                }
+
+                if r.Timeouts.Read != nil {
+                        timeouts.Attributes[TimeoutRead] = &configschema.Attribute{
+                                Type:     cty.String,
+                                Optional: true,
+                        }
+                }
+
+                if r.Timeouts.Update != nil {
+                        timeouts.Attributes[TimeoutUpdate] = &configschema.Attribute{
+                                Type:     cty.String,
+                                Optional: true,
+                        }
+                }
+
+                if r.Timeouts.Delete != nil {
+                        timeouts.Attributes[TimeoutDelete] = &configschema.Attribute{
+                                Type:     cty.String,
+                                Optional: true,
+                        }
+                }
+
+                if r.Timeouts.Default != nil {
+                        timeouts.Attributes[TimeoutDefault] = &configschema.Attribute{
+                                Type:     cty.String,
+                                Optional: true,
+                        }
+                }
+
+                block.BlockTypes[TimeoutsConfigKey] = &configschema.NestedBlock{
+                        Nesting: configschema.NestingSingle,
+                        Block:   timeouts,
+                }
+        }
+
+        return block
+}
+
+func (r *Resource) coreConfigSchema() *configschema.Block {
+        return schemaMap(r.Schema).CoreConfigSchema()
+}
+
+// CoreConfigSchema is a convenient shortcut for calling CoreConfigSchema
+// on the backends's schema.
+func (r *Backend) CoreConfigSchema() *configschema.Block {
         return schemaMap(r.Schema).CoreConfigSchema()
 }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go
index b80b223..2a66a06 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader.go
@@ -3,6 +3,7 @@ package schema
 import (
         "fmt"
         "strconv"
+        "strings"
 )
 
 // FieldReaders are responsible for decoding fields out of data into
@@ -41,6 +42,13 @@ func (r *FieldReadResult) ValueOrZero(s *Schema) interface{} {
         return s.ZeroValue()
 }
 
+// SchemasForFlatmapPath tries its best to find a sequence of schemas that
+// the given dot-delimited attribute path traverses through.
+func SchemasForFlatmapPath(path string, schemaMap map[string]*Schema) []*Schema {
+        parts := strings.Split(path, ".")
+        return addrToSchema(parts, schemaMap)
+}
+
 // addrToSchema finds the final element schema for the given address
 // and the given schema. It returns all the schemas that led to the final
 // schema. These are in order of the address (out to in).
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go
index 55a301d..808375c 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_config.go
@@ -2,6 +2,7 @@ package schema
 
 import (
         "fmt"
+        "log"
         "strconv"
         "strings"
         "sync"
@@ -93,6 +94,22 @@ func (r *ConfigFieldReader) readField(
                 }
         }
 
+        if protoVersion5 {
+                switch schema.Type {
+                case TypeList, TypeSet, TypeMap, typeObject:
+                        // Check if the value itself is unknown.
+                        // The new protocol shims will add unknown values to this list of
+                        // ComputedKeys. This is the only way we have to indicate that a
+                        // collection is unknown in the config
+                        for _, unknown := range r.Config.ComputedKeys {
+                                if k == unknown {
+                                        log.Printf("[DEBUG] setting computed for %q from ComputedKeys", k)
+                                        return FieldReadResult{Computed: true, Exists: true}, nil
+                                }
+                        }
+                }
+        }
+
         switch schema.Type {
         case TypeBool, TypeFloat, TypeInt, TypeString:
                 return r.readPrimitive(k, schema)
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go
index d558a5b..ae35b4a 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_diff.go
@@ -174,6 +174,9 @@ func (r *DiffFieldReader) readPrimitive(
 
 func (r *DiffFieldReader) readSet(
         address []string, schema *Schema) (FieldReadResult, error) {
+        // copy address to ensure we don't modify the argument
+        address = append([]string(nil), address...)
+
         prefix := strings.Join(address, ".") + "."
 
         // Create the set that will be our result
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go
index 054efe0..53f73b7 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_reader_map.go
@@ -98,6 +98,9 @@ func (r *MapFieldReader) readPrimitive(
 
 func (r *MapFieldReader) readSet(
         address []string, schema *Schema) (FieldReadResult, error) {
+        // copy address to ensure we don't modify the argument
+        address = append([]string(nil), address...)
+
         // Get the number of elements in the list
         countRaw, err := r.readPrimitive(
                 append(address, "#"), &Schema{Type: TypeInt})
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go b/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go
index 814c7ba..c09358b 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/field_writer_map.go
@@ -297,13 +297,14 @@ func (w *MapFieldWriter) setSet(
         // we get the proper order back based on the hash code.
         if v := reflect.ValueOf(value); v.Kind() == reflect.Slice {
                 // Build a temp *ResourceData to use for the conversion
+                tempAddr := addr[len(addr)-1:]
                 tempSchema := *schema
                 tempSchema.Type = TypeList
-                tempSchemaMap := map[string]*Schema{addr[0]: &tempSchema}
+                tempSchemaMap := map[string]*Schema{tempAddr[0]: &tempSchema}
                 tempW := &MapFieldWriter{Schema: tempSchemaMap}
 
                 // Set the entire list, this lets us get sane values out of it
-                if err := tempW.WriteField(addr, value); err != nil {
+                if err := tempW.WriteField(tempAddr, value); err != nil {
                         return err
                 }
 
@@ -319,7 +320,7 @@ func (w *MapFieldWriter) setSet(
                 }
                 for i := 0; i < v.Len(); i++ {
                         is := strconv.FormatInt(int64(i), 10)
-                        result, err := tempR.ReadField(append(addrCopy, is))
+                        result, err := tempR.ReadField(append(tempAddr, is))
                         if err != nil {
                                 return err
                         }
@@ -340,6 +341,11 @@ func (w *MapFieldWriter) setSet(
         // problems when the old data isn't wiped first.
         w.clearTree(addr)
 
+        if value.(*Set) == nil {
+                w.result[k+".#"] = "0"
+                return nil
+        }
+
         for code, elem := range value.(*Set).m {
                 if err := w.set(append(addrCopy, code), elem); err != nil {
                         return err
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go b/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go
index 38cd8c7..0184d7b 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/getsource_string.go
@@ -4,6 +4,18 @@ package schema
 
 import "strconv"
 
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[getSourceState-1]
+        _ = x[getSourceConfig-2]
+        _ = x[getSourceDiff-4]
+        _ = x[getSourceSet-8]
+        _ = x[getSourceExact-16]
+        _ = x[getSourceLevelMask-15]
+}
+
 const (
         _getSource_name_0 = "getSourceStategetSourceConfig"
         _getSource_name_1 = "getSourceDiff"
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/provider.go b/vendor/github.com/hashicorp/terraform/helper/schema/provider.go
index 6cd325d..9702447 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/provider.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/provider.go
@@ -9,7 +9,7 @@ import (
 
         "github.com/hashicorp/go-multierror"
         "github.com/hashicorp/terraform/config"
-        "github.com/hashicorp/terraform/config/configschema"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/hashicorp/terraform/terraform"
 )
 
@@ -64,6 +64,8 @@ type Provider struct {
         stopCtx       context.Context
         stopCtxCancel context.CancelFunc
         stopOnce      sync.Once
+
+        TerraformVersion string
 }
 
 // ConfigureFunc is the function used to configure a Provider.
@@ -251,7 +253,7 @@ func (p *Provider) Configure(c *terraform.ResourceConfig) error {
 
         // Get a ResourceData for this configuration. To do this, we actually
         // generate an intermediary "diff" although that is never exposed.
-        diff, err := sm.Diff(nil, c, nil, p.meta)
+        diff, err := sm.Diff(nil, c, nil, p.meta, true)
         if err != nil {
                 return err
         }
@@ -296,6 +298,20 @@ func (p *Provider) Diff(
         return r.Diff(s, c, p.meta)
 }
 
+// SimpleDiff is used by the new protocol wrappers to get a diff that doesn't
+// attempt to calculate ignore_changes.
+func (p *Provider) SimpleDiff(
+        info *terraform.InstanceInfo,
+        s *terraform.InstanceState,
+        c *terraform.ResourceConfig) (*terraform.InstanceDiff, error) {
+        r, ok := p.ResourcesMap[info.Type]
+        if !ok {
+                return nil, fmt.Errorf("unknown resource type: %s", info.Type)
+        }
+
+        return r.simpleDiff(s, c, p.meta)
+}
+
 // Refresh implementation of terraform.ResourceProvider interface.
 func (p *Provider) Refresh(
         info *terraform.InstanceInfo,
@@ -311,7 +327,7 @@ func (p *Provider) Refresh(
 // Resources implementation of terraform.ResourceProvider interface.
 func (p *Provider) Resources() []terraform.ResourceType {
         keys := make([]string, 0, len(p.ResourcesMap))
-        for k, _ := range p.ResourcesMap {
+        for k := range p.ResourcesMap {
                 keys = append(keys, k)
         }
         sort.Strings(keys)
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go b/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go
index a8d42db..637e221 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/provisioner.go
@@ -8,6 +8,7 @@ import (
 
         "github.com/hashicorp/go-multierror"
         "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/configs/configschema"
         "github.com/hashicorp/terraform/terraform"
 )
 
@@ -121,6 +122,11 @@ func (p *Provisioner) Stop() error {
         return nil
 }
 
+// GetConfigSchema implementation of terraform.ResourceProvisioner interface.
+func (p *Provisioner) GetConfigSchema() (*configschema.Block, error) {
+        return schemaMap(p.Schema).CoreConfigSchema(), nil
+}
+
 // Apply implementation of terraform.ResourceProvisioner interface.
 func (p *Provisioner) Apply(
         o terraform.UIOutput,
@@ -146,7 +152,7 @@ func (p *Provisioner) Apply(
                 }
 
                 sm := schemaMap(p.ConnSchema)
-                diff, err := sm.Diff(nil, terraform.NewResourceConfig(c), nil, nil)
+                diff, err := sm.Diff(nil, terraform.NewResourceConfig(c), nil, nil, true)
                 if err != nil {
                         return err
                 }
@@ -160,7 +166,7 @@ func (p *Provisioner) Apply(
                 // Build the configuration data. Doing this requires making a "diff"
                 // even though that's never used. We use that just to get the correct types.
                 configMap := schemaMap(p.Schema)
-                diff, err := configMap.Diff(nil, c, nil, nil)
+                diff, err := configMap.Diff(nil, c, nil, nil, true)
                 if err != nil {
                         return err
                 }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
index d3be2d6..b5e3065 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource.go
@@ -8,6 +8,7 @@ import (
 
         "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/terraform"
+        "github.com/zclconf/go-cty/cty"
 )
 
 // Resource represents a thing in Terraform that has a set of configurable
@@ -44,6 +45,12 @@ type Resource struct {
         // their Versioning at any integer >= 1
         SchemaVersion int
 
+        // MigrateState is deprecated and any new changes to a resource's schema
+        // should be handled by StateUpgraders. Existing MigrateState implementations
+        // should remain for compatibility with existing state. MigrateState will
+        // still be called if the stored SchemaVersion is less than the
+        // first version of the StateUpgraders.
+        //
         // MigrateState is responsible for updating an InstanceState with an old
         // version to the format expected by the current version of the Schema.
         //
@@ -56,6 +63,18 @@ type Resource struct {
         // needs to make any remote API calls.
         MigrateState StateMigrateFunc
 
+        // StateUpgraders contains the functions responsible for upgrading an
+        // existing state with an old schema version to a newer schema. It is
+        // called specifically by Terraform when the stored schema version is less
+        // than the current SchemaVersion of the Resource.
+        //
+        // StateUpgraders map specific schema versions to a StateUpgrader
+        // function. The registered versions are expected to be ordered,
+        // consecutive values. The initial value may be greater than 0 to account
+        // for legacy schemas that weren't recorded and can be handled by
+        // MigrateState.
+        StateUpgraders []StateUpgrader
+
         // The functions below are the CRUD operations for this resource.
         //
         // The only optional operation is Update. If Update is not implemented,
@@ -136,6 +155,27 @@ type Resource struct {
         Timeouts *ResourceTimeout
 }
 
+// ShimInstanceStateFromValue converts a cty.Value to a
+// terraform.InstanceState.
+func (r *Resource) ShimInstanceStateFromValue(state cty.Value) (*terraform.InstanceState, error) {
+        // Get the raw shimmed value. While this is correct, the set hashes don't
+        // match those from the Schema.
+        s := terraform.NewInstanceStateShimmedFromValue(state, r.SchemaVersion)
+
+        // We now rebuild the state through the ResourceData, so that the set indexes
+        // match what helper/schema expects.
+        data, err := schemaMap(r.Schema).Data(s, nil)
+        if err != nil {
+                return nil, err
+        }
+
+        s = data.State()
+        if s == nil {
+                s = &terraform.InstanceState{}
+        }
+        return s, nil
+}
+
 // See Resource documentation.
 type CreateFunc func(*ResourceData, interface{}) error
 
@@ -155,6 +195,27 @@ type ExistsFunc func(*ResourceData, interface{}) (bool, error)
 type StateMigrateFunc func(
         int, *terraform.InstanceState, interface{}) (*terraform.InstanceState, error)
 
+type StateUpgrader struct {
+        // Version is the version schema that this Upgrader will handle, converting
+        // it to Version+1.
+        Version int
+
+        // Type describes the schema that this function can upgrade. Type is
+        // required to decode the schema if the state was stored in a legacy
+        // flatmap format.
+        Type cty.Type
+
+        // Upgrade takes the JSON encoded state and the provider meta value, and
+        // upgrades the state one single schema version. The provided state is
+        // deocded into the default json types using a map[string]interface{}. It
+        // is up to the StateUpgradeFunc to ensure that the returned value can be
+        // encoded using the new schema.
+        Upgrade StateUpgradeFunc
+}
+
+// See StateUpgrader
+type StateUpgradeFunc func(rawState map[string]interface{}, meta interface{}) (map[string]interface{}, error)
+
 // See Resource documentation.
 type CustomizeDiffFunc func(*ResourceDiff, interface{}) error
 
@@ -247,7 +308,7 @@ func (r *Resource) Diff(
                 return nil, fmt.Errorf("[ERR] Error decoding timeout: %s", err)
         }
 
-        instanceDiff, err := schemaMap(r.Schema).Diff(s, c, r.CustomizeDiff, meta)
+        instanceDiff, err := schemaMap(r.Schema).Diff(s, c, r.CustomizeDiff, meta, true)
         if err != nil {
                 return instanceDiff, err
         }
@@ -263,6 +324,45 @@ func (r *Resource) Diff(
         return instanceDiff, err
 }
 
+func (r *Resource) simpleDiff(
+        s *terraform.InstanceState,
+        c *terraform.ResourceConfig,
+        meta interface{}) (*terraform.InstanceDiff, error) {
+
+        t := &ResourceTimeout{}
+        err := t.ConfigDecode(r, c)
+
+        if err != nil {
+                return nil, fmt.Errorf("[ERR] Error decoding timeout: %s", err)
+        }
+
+        instanceDiff, err := schemaMap(r.Schema).Diff(s, c, r.CustomizeDiff, meta, false)
+        if err != nil {
+                return instanceDiff, err
+        }
+
+        if instanceDiff == nil {
+                log.Printf("[DEBUG] Instance Diff is nil in SimpleDiff()")
+                return nil, err
+        }
+
+        // Make sure the old value is set in each of the instance diffs.
+        // This was done by the RequiresNew logic in the full legacy Diff.
+        for k, attr := range instanceDiff.Attributes {
+                if attr == nil {
+                        continue
+                }
+                if s != nil {
+                        attr.Old = s.Attributes[k]
+                }
+        }
+
+        if err := t.DiffEncode(instanceDiff); err != nil {
+                log.Printf("[ERR] Error encoding timeout to instance diff: %s", err)
+        }
+        return instanceDiff, err
+}
+
 // Validate validates the resource configuration against the schema.
 func (r *Resource) Validate(c *terraform.ResourceConfig) ([]string, []error) {
         warns, errs := schemaMap(r.Schema).Validate(c)
@@ -300,8 +400,11 @@ func (r *Resource) ReadDataApply(
         return r.recordCurrentSchemaVersion(state), err
 }
 
-// Refresh refreshes the state of the resource.
-func (r *Resource) Refresh(
+// RefreshWithoutUpgrade reads the instance state, but does not call
+// MigrateState or the StateUpgraders, since those are now invoked in a
+// separate API call.
+// RefreshWithoutUpgrade is part of the new plugin shims.
+func (r *Resource) RefreshWithoutUpgrade(
         s *terraform.InstanceState,
         meta interface{}) (*terraform.InstanceState, error) {
         // If the ID is already somehow blank, it doesn't exist
@@ -335,12 +438,60 @@ func (r *Resource) Refresh(
                 }
         }
 
-        needsMigration, stateSchemaVersion := r.checkSchemaVersion(s)
-        if needsMigration && r.MigrateState != nil {
-                s, err := r.MigrateState(stateSchemaVersion, s, meta)
+        data, err := schemaMap(r.Schema).Data(s, nil)
+        data.timeouts = &rt
+        if err != nil {
+                return s, err
+        }
+
+        err = r.Read(data, meta)
+        state := data.State()
+        if state != nil && state.ID == "" {
+                state = nil
+        }
+
+        return r.recordCurrentSchemaVersion(state), err
+}
+
+// Refresh refreshes the state of the resource.
+func (r *Resource) Refresh(
+        s *terraform.InstanceState,
+        meta interface{}) (*terraform.InstanceState, error) {
+        // If the ID is already somehow blank, it doesn't exist
+        if s.ID == "" {
+                return nil, nil
+        }
+
+        rt := ResourceTimeout{}
+        if _, ok := s.Meta[TimeoutKey]; ok {
+                if err := rt.StateDecode(s); err != nil {
+                        log.Printf("[ERR] Error decoding ResourceTimeout: %s", err)
+                }
+        }
+
+        if r.Exists != nil {
+                // Make a copy of data so that if it is modified it doesn't
+                // affect our Read later.
+                data, err := schemaMap(r.Schema).Data(s, nil)
+                data.timeouts = &rt
+
                 if err != nil {
                         return s, err
                 }
+
+                exists, err := r.Exists(data, meta)
+                if err != nil {
+                        return s, err
+                }
+                if !exists {
+                        return nil, nil
+                }
+        }
+
+        // there may be new StateUpgraders that need to be run
+        s, err := r.upgradeState(s, meta)
+        if err != nil {
+                return s, err
         }
 
         data, err := schemaMap(r.Schema).Data(s, nil)
@@ -358,6 +509,71 @@ func (r *Resource) Refresh(
         return r.recordCurrentSchemaVersion(state), err
 }
 
+func (r *Resource) upgradeState(s *terraform.InstanceState, meta interface{}) (*terraform.InstanceState, error) {
+        var err error
+
+        needsMigration, stateSchemaVersion := r.checkSchemaVersion(s)
+        migrate := needsMigration && r.MigrateState != nil
+
+        if migrate {
+                s, err = r.MigrateState(stateSchemaVersion, s, meta)
+                if err != nil {
+                        return s, err
+                }
+        }
+
+        if len(r.StateUpgraders) == 0 {
+                return s, nil
+        }
+
+        // If we ran MigrateState, then the stateSchemaVersion value is no longer
+        // correct. We can expect the first upgrade function to be the correct
+        // schema type version.
+        if migrate {
+                stateSchemaVersion = r.StateUpgraders[0].Version
+        }
+
+        schemaType := r.CoreConfigSchema().ImpliedType()
+        // find the expected type to convert the state
+        for _, upgrader := range r.StateUpgraders {
+                if stateSchemaVersion == upgrader.Version {
+                        schemaType = upgrader.Type
+                }
+        }
+
+        // StateUpgraders only operate on the new JSON format state, so the state
+        // need to be converted.
+        stateVal, err := StateValueFromInstanceState(s, schemaType)
+        if err != nil {
+                return nil, err
+        }
+
+        jsonState, err := StateValueToJSONMap(stateVal, schemaType)
+        if err != nil {
+                return nil, err
+        }
+
+        for _, upgrader := range r.StateUpgraders {
+                if stateSchemaVersion != upgrader.Version {
+                        continue
+                }
+
+                jsonState, err = upgrader.Upgrade(jsonState, meta)
+                if err != nil {
+                        return nil, err
+                }
+                stateSchemaVersion++
+        }
+
+        // now we need to re-flatmap the new state
+        stateVal, err = JSONMapToStateValue(jsonState, r.CoreConfigSchema())
+        if err != nil {
+                return nil, err
+        }
+
+        return r.ShimInstanceStateFromValue(stateVal)
+}
+
 // InternalValidate should be called to validate the structure
 // of the resource.
 //
@@ -437,6 +653,31 @@ func (r *Resource) InternalValidate(topSchemaMap schemaMap, writable bool) error
                 }
         }
 
+        lastVersion := -1
+        for _, u := range r.StateUpgraders {
+                if lastVersion >= 0 && u.Version-lastVersion > 1 {
+                        return fmt.Errorf("missing schema version between %d and %d", lastVersion, u.Version)
+                }
+
+                if u.Version >= r.SchemaVersion {
+                        return fmt.Errorf("StateUpgrader version %d is >= current version %d", u.Version, r.SchemaVersion)
+                }
+
+                if !u.Type.IsObjectType() {
+                        return fmt.Errorf("StateUpgrader %d type is not cty.Object", u.Version)
+                }
+
+                if u.Upgrade == nil {
+                        return fmt.Errorf("StateUpgrader %d missing StateUpgradeFunc", u.Version)
+                }
+
+                lastVersion = u.Version
+        }
+
+        if lastVersion >= 0 && lastVersion != r.SchemaVersion-1 {
+                return fmt.Errorf("missing StateUpgrader between %d and %d", lastVersion, r.SchemaVersion)
+        }
+
         // Data source
         if r.isTopLevel() && !writable {
                 tsm = schemaMap(r.Schema)
@@ -513,6 +754,13 @@ func (r *Resource) TestResourceData() *ResourceData {
         }
 }
 
+// SchemasForFlatmapPath tries its best to find a sequence of schemas that
+// the given dot-delimited attribute path traverses through in the schema
+// of the receiving Resource.
+func (r *Resource) SchemasForFlatmapPath(path string) []*Schema {
+        return SchemasForFlatmapPath(path, r.Schema)
+}
+
 // Returns true if the resource is "top level" i.e. not a sub-resource.
 func (r *Resource) isTopLevel() bool {
         // TODO: This is a heuristic; replace with a definitive attribute?
@@ -538,7 +786,15 @@ func (r *Resource) checkSchemaVersion(is *terraform.InstanceState) (bool, int) {
         }
 
         stateSchemaVersion, _ := strconv.Atoi(rawString)
-        return stateSchemaVersion < r.SchemaVersion, stateSchemaVersion
+
+        // Don't run MigrateState if the version is handled by a StateUpgrader,
+        // since StateMigrateFuncs are not required to handle unknown versions
+        maxVersion := r.SchemaVersion
+        if len(r.StateUpgraders) > 0 {
+                maxVersion = r.StateUpgraders[0].Version
+        }
+
+        return stateSchemaVersion < maxVersion, stateSchemaVersion
 }
 
 func (r *Resource) recordCurrentSchemaVersion(
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go
index 6cc01ee..1c39070 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource_data.go
@@ -52,6 +52,8 @@ type getResult struct {
 // UnsafeSetFieldRaw allows setting arbitrary values in state to arbitrary
 // values, bypassing schema. This MUST NOT be used in normal circumstances -
 // it exists only to support the remote_state data source.
+//
+// Deprecated: Fully define schema attributes and use Set() instead.
 func (d *ResourceData) UnsafeSetFieldRaw(key string, value string) {
         d.once.Do(d.init)
 
@@ -219,10 +221,16 @@ func (d *ResourceData) Id() string {
 
         if d.state != nil {
                 result = d.state.ID
+                if result == "" {
+                        result = d.state.Attributes["id"]
+                }
         }
 
         if d.newState != nil {
                 result = d.newState.ID
+                if result == "" {
+                        result = d.newState.Attributes["id"]
+                }
         }
 
         return result
@@ -246,6 +254,18 @@ func (d *ResourceData) ConnInfo() map[string]string {
 func (d *ResourceData) SetId(v string) {
         d.once.Do(d.init)
         d.newState.ID = v
+
+        // once we transition away from the legacy state types, "id" will no longer
+        // be a special field, and will become a normal attribute.
+        // set the attribute normally
+        d.setWriter.unsafeWriteField("id", v)
+
+        // Make sure the newState is also set, otherwise the old value
+        // may get precedence.
+        if d.newState.Attributes == nil {
+                d.newState.Attributes = map[string]string{}
+        }
+        d.newState.Attributes["id"] = v
 }
 
 // SetConnInfo sets the connection info for a resource.
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go
index 7db3dec..47b5481 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource_diff.go
@@ -367,7 +367,7 @@ func (d *ResourceDiff) Get(key string) interface{} {
 }
 
 // GetChange gets the change between the state and diff, checking first to see
-// if a overridden diff exists.
+// if an overridden diff exists.
 //
 // This implementation differs from ResourceData's in the way that we first get
 // results from the exact levels for the new diff, then from state and diff as
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/resource_timeout.go b/vendor/github.com/hashicorp/terraform/helper/schema/resource_timeout.go
index 445819f..9e422c1 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/resource_timeout.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/resource_timeout.go
@@ -5,6 +5,7 @@ import (
         "log"
         "time"
 
+        "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/terraform"
         "github.com/mitchellh/copystructure"
 )
@@ -62,55 +63,70 @@ func (t *ResourceTimeout) ConfigDecode(s *Resource, c *terraform.ResourceConfig)
         }
 
         if raw, ok := c.Config[TimeoutsConfigKey]; ok {
-                if configTimeouts, ok := raw.([]map[string]interface{}); ok {
-                        for _, timeoutValues := range configTimeouts {
-                                // loop through each Timeout given in the configuration and validate they
-                                // the Timeout defined in the resource
-                                for timeKey, timeValue := range timeoutValues {
-                                        // validate that we're dealing with the normal CRUD actions
-                                        var found bool
-                                        for _, key := range timeoutKeys() {
-                                                if timeKey == key {
-                                                        found = true
-                                                        break
-                                                }
-                                        }
+                var rawTimeouts []map[string]interface{}
+                switch raw := raw.(type) {
+                case map[string]interface{}:
+                        rawTimeouts = append(rawTimeouts, raw)
+                case []map[string]interface{}:
+                        rawTimeouts = raw
+                case string:
+                        if raw == config.UnknownVariableValue {
+                                // Timeout is not defined in the config
+                                // Defaults will be used instead
+                                return nil
+                        } else {
+                                log.Printf("[ERROR] Invalid timeout value: %q", raw)
+                                return fmt.Errorf("Invalid Timeout value found")
+                        }
+                default:
+                        log.Printf("[ERROR] Invalid timeout structure: %#v", raw)
+                        return fmt.Errorf("Invalid Timeout structure found")
+                }
 
-                                        if !found {
-                                                return fmt.Errorf("Unsupported Timeout configuration key found (%s)", timeKey)
+                for _, timeoutValues := range rawTimeouts {
+                        for timeKey, timeValue := range timeoutValues {
+                                // validate that we're dealing with the normal CRUD actions
+                                var found bool
+                                for _, key := range timeoutKeys() {
+                                        if timeKey == key {
+                                                found = true
+                                                break
                                         }
+                                }
 
-                                        // Get timeout
-                                        rt, err := time.ParseDuration(timeValue.(string))
-                                        if err != nil {
-                                                return fmt.Errorf("Error parsing Timeout for (%s): %s", timeKey, err)
-                                        }
+                                if !found {
+                                        return fmt.Errorf("Unsupported Timeout configuration key found (%s)", timeKey)
+                                }
 
-                                        var timeout *time.Duration
-                                        switch timeKey {
-                                        case TimeoutCreate:
-                                                timeout = t.Create
-                                        case TimeoutUpdate:
-                                                timeout = t.Update
-                                        case TimeoutRead:
-                                                timeout = t.Read
-                                        case TimeoutDelete:
-                                                timeout = t.Delete
-                                        case TimeoutDefault:
-                                                timeout = t.Default
-                                        }
+                                // Get timeout
+                                rt, err := time.ParseDuration(timeValue.(string))
+                                if err != nil {
+                                        return fmt.Errorf("Error parsing %q timeout: %s", timeKey, err)
+                                }
 
-                                        // If the resource has not delcared this in the definition, then error
-                                        // with an unsupported message
-                                        if timeout == nil {
-                                                return unsupportedTimeoutKeyError(timeKey)
-                                        }
+                                var timeout *time.Duration
+                                switch timeKey {
+                                case TimeoutCreate:
+                                        timeout = t.Create
+                                case TimeoutUpdate:
+                                        timeout = t.Update
+                                case TimeoutRead:
+                                        timeout = t.Read
+                                case TimeoutDelete:
+                                        timeout = t.Delete
+                                case TimeoutDefault:
+                                        timeout = t.Default
+                                }
 
-                                        *timeout = rt
+                                // If the resource has not delcared this in the definition, then error
+                                // with an unsupported message
+                                if timeout == nil {
+                                        return unsupportedTimeoutKeyError(timeKey)
                                 }
+
+                                *timeout = rt
                         }
-                } else {
-                        log.Printf("[WARN] Invalid Timeout structure found, skipping timeouts")
+                        return nil
                 }
         }
 
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/schema.go b/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
index 0ea5aad..6a3c15a 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/schema.go
@@ -12,6 +12,7 @@
 package schema
 
 import (
+        "context"
         "fmt"
         "os"
         "reflect"
@@ -19,7 +20,9 @@ import (
         "sort"
         "strconv"
         "strings"
+        "sync"
 
+        "github.com/hashicorp/terraform/config"
         "github.com/hashicorp/terraform/terraform"
         "github.com/mitchellh/copystructure"
         "github.com/mitchellh/mapstructure"
@@ -31,6 +34,27 @@ const PanicOnErr = "TF_SCHEMA_PANIC_ON_ERROR"
 // type used for schema package context keys
 type contextKey string
 
+var (
+        protoVersionMu sync.Mutex
+        protoVersion5  = false
+)
+
+func isProto5() bool {
+        protoVersionMu.Lock()
+        defer protoVersionMu.Unlock()
+        return protoVersion5
+
+}
+
+// SetProto5 enables a feature flag for any internal changes required required
+// to work with the new plugin protocol.  This should not be called by
+// provider.
+func SetProto5() {
+        protoVersionMu.Lock()
+        defer protoVersionMu.Unlock()
+        protoVersion5 = true
+}
+
 // Schema is used to describe the structure of a value.
 //
 // Read the documentation of the struct elements for important details.
@@ -51,6 +75,26 @@ type Schema struct {
         //
         Type ValueType
 
+        // ConfigMode allows for overriding the default behaviors for mapping
+        // schema entries onto configuration constructs.
+        //
+        // By default, the Elem field is used to choose whether a particular
+        // schema is represented in configuration as an attribute or as a nested
+        // block; if Elem is a *schema.Resource then it's a block and it's an
+        // attribute otherwise.
+        //
+        // If Elem is *schema.Resource then setting ConfigMode to
+        // SchemaConfigModeAttr will force it to be represented in configuration
+        // as an attribute, which means that the Computed flag can be used to
+        // provide default elements when the argument isn't set at all, while still
+        // allowing the user to force zero elements by explicitly assigning an
+        // empty list.
+        //
+        // When Computed is set without Optional, the attribute is not settable
+        // in configuration at all and so SchemaConfigModeAttr is the automatic
+        // behavior, and SchemaConfigModeBlock is not permitted.
+        ConfigMode SchemaConfigMode
+
         // If one of these is set, then this item can come from the configuration.
         // Both cannot be set. If Optional is set, the value is optional. If
         // Required is set, the value is required.
@@ -123,7 +167,8 @@ type Schema struct {
         // The following fields are only set for a TypeList, TypeSet, or TypeMap.
         //
         // Elem represents the element type. For a TypeMap, it must be a *Schema
-        // with a Type of TypeString, otherwise it may be either a *Schema or a
+        // with a Type that is one of the primitives: TypeString, TypeBool,
+        // TypeInt, or TypeFloat. Otherwise it may be either a *Schema or a
         // *Resource. If it is *Schema, the element type is just a simple value.
         // If it is *Resource, the element type is a complex structure,
         // potentially with its own lifecycle.
@@ -141,13 +186,17 @@ type Schema struct {
         // used to wrap a complex structure, however less than one instance would
         // cause instability.
         //
-        // PromoteSingle, if true, will allow single elements to be standalone
-        // and promote them to a list. For example "foo" would be promoted to
-        // ["foo"] automatically. This is primarily for legacy reasons and the
-        // ambiguity is not recommended for new usage. Promotion is only allowed
-        // for primitive element types.
-        MaxItems      int
-        MinItems      int
+        // If the field Optional is set to true then MinItems is ignored and thus
+        // effectively zero.
+        MaxItems int
+        MinItems int
+
+        // PromoteSingle originally allowed for a single element to be assigned
+        // where a primitive list was expected, but this no longer works from
+        // Terraform v0.12 onwards (Terraform Core will require a list to be set
+        // regardless of what this is set to) and so only applies to Terraform v0.11
+        // and earlier, and so should be used only to retain this functionality
+        // for those still using v0.11 with a provider that formerly used this.
         PromoteSingle bool
 
         // The following fields are only valid for a TypeSet type.
@@ -189,7 +238,8 @@ type Schema struct {
         // guaranteed to be of the proper Schema type, and it can yield warnings or
         // errors based on inspection of that value.
         //
-        // ValidateFunc currently only works for primitive types.
+        // ValidateFunc is honored only when the schema's Type is set to TypeInt,
+        // TypeFloat, TypeString, TypeBool, or TypeMap. It is ignored for all other types.
         ValidateFunc SchemaValidateFunc
 
         // Sensitive ensures that the attribute's value does not get displayed in
@@ -199,6 +249,17 @@ type Schema struct {
         Sensitive bool
 }
 
+// SchemaConfigMode is used to influence how a schema item is mapped into a
+// corresponding configuration construct, using the ConfigMode field of
+// Schema.
+type SchemaConfigMode int
+
+const (
+        SchemaConfigModeAuto SchemaConfigMode = iota
+        SchemaConfigModeAttr
+        SchemaConfigModeBlock
+)
+
 // SchemaDiffSuppressFunc is a function which can be used to determine
 // whether a detected diff on a schema element is "valid" or not, and
 // suppress it from the plan if necessary.
@@ -364,6 +425,11 @@ func (s *Schema) finalizeDiff(d *terraform.ResourceAttrDiff, customized bool) *t
         return d
 }
 
+// InternalMap is used to aid in the transition to the new schema types and
+// protocol. The name is not meant to convey any usefulness, as this is not to
+// be used directly by any providers.
+type InternalMap = schemaMap
+
 // schemaMap is a wrapper that adds nice functions on top of schemas.
 type schemaMap map[string]*Schema
 
@@ -404,7 +470,8 @@ func (m schemaMap) Diff(
         s *terraform.InstanceState,
         c *terraform.ResourceConfig,
         customizeDiff CustomizeDiffFunc,
-        meta interface{}) (*terraform.InstanceDiff, error) {
+        meta interface{},
+        handleRequiresNew bool) (*terraform.InstanceDiff, error) {
         result := new(terraform.InstanceDiff)
         result.Attributes = make(map[string]*terraform.ResourceAttrDiff)
 
@@ -450,82 +517,85 @@ func (m schemaMap) Diff(
                 }
         }
 
-        // If the diff requires a new resource, then we recompute the diff
-        // so we have the complete new resource diff, and preserve the
-        // RequiresNew fields where necessary so the user knows exactly what
-        // caused that.
-        if result.RequiresNew() {
-                // Create the new diff
-                result2 := new(terraform.InstanceDiff)
-                result2.Attributes = make(map[string]*terraform.ResourceAttrDiff)
-
-                // Preserve the DestroyTainted flag
-                result2.DestroyTainted = result.DestroyTainted
+        if handleRequiresNew {
+                // If the diff requires a new resource, then we recompute the diff
+                // so we have the complete new resource diff, and preserve the
+                // RequiresNew fields where necessary so the user knows exactly what
+                // caused that.
+                if result.RequiresNew() {
+                        // Create the new diff
+                        result2 := new(terraform.InstanceDiff)
+                        result2.Attributes = make(map[string]*terraform.ResourceAttrDiff)
 
-                // Reset the data to not contain state. We have to call init()
-                // again in order to reset the FieldReaders.
-                d.state = nil
-                d.init()
+                        // Preserve the DestroyTainted flag
+                        result2.DestroyTainted = result.DestroyTainted
 
-                // Perform the diff again
-                for k, schema := range m {
-                        err := m.diff(k, schema, result2, d, false)
-                        if err != nil {
-                                return nil, err
-                        }
-                }
+                        // Reset the data to not contain state. We have to call init()
+                        // again in order to reset the FieldReaders.
+                        d.state = nil
+                        d.init()
 
-                // Re-run customization
-                if !result2.DestroyTainted && customizeDiff != nil {
-                        mc := m.DeepCopy()
-                        rd := newResourceDiff(mc, c, d.state, result2)
-                        if err := customizeDiff(rd, meta); err != nil {
-                                return nil, err
-                        }
-                        for _, k := range rd.UpdatedKeys() {
-                                err := m.diff(k, mc[k], result2, rd, false)
+                        // Perform the diff again
+                        for k, schema := range m {
+                                err := m.diff(k, schema, result2, d, false)
                                 if err != nil {
                                         return nil, err
                                 }
                         }
-                }
 
-                // Force all the fields to not force a new since we know what we
-                // want to force new.
-                for k, attr := range result2.Attributes {
-                        if attr == nil {
-                                continue
+                        // Re-run customization
+                        if !result2.DestroyTainted && customizeDiff != nil {
+                                mc := m.DeepCopy()
+                                rd := newResourceDiff(mc, c, d.state, result2)
+                                if err := customizeDiff(rd, meta); err != nil {
+                                        return nil, err
+                                }
+                                for _, k := range rd.UpdatedKeys() {
+                                        err := m.diff(k, mc[k], result2, rd, false)
+                                        if err != nil {
+                                                return nil, err
+                                        }
+                                }
                         }
 
-                        if attr.RequiresNew {
-                                attr.RequiresNew = false
-                        }
+                        // Force all the fields to not force a new since we know what we
+                        // want to force new.
+                        for k, attr := range result2.Attributes {
+                                if attr == nil {
+                                        continue
+                                }
 
-                        if s != nil {
-                                attr.Old = s.Attributes[k]
-                        }
-                }
+                                if attr.RequiresNew {
+                                        attr.RequiresNew = false
+                                }
 
-                // Now copy in all the requires new diffs...
-                for k, attr := range result.Attributes {
-                        if attr == nil {
-                                continue
+                                if s != nil {
+                                        attr.Old = s.Attributes[k]
+                                }
                         }
 
-                        newAttr, ok := result2.Attributes[k]
-                        if !ok {
-                                newAttr = attr
-                        }
+                        // Now copy in all the requires new diffs...
+                        for k, attr := range result.Attributes {
+                                if attr == nil {
+                                        continue
+                                }
 
-                        if attr.RequiresNew {
-                                newAttr.RequiresNew = true
+                                newAttr, ok := result2.Attributes[k]
+                                if !ok {
+                                        newAttr = attr
+                                }
+
+                                if attr.RequiresNew {
+                                        newAttr.RequiresNew = true
+                                }
+
+                                result2.Attributes[k] = newAttr
                         }
 
-                        result2.Attributes[k] = newAttr
+                        // And set the diff!
+                        result = result2
                 }
 
-                // And set the diff!
-                result = result2
         }
 
         // Go through and detect all of the ComputedWhens now that we've
@@ -611,6 +681,10 @@ func (m schemaMap) Validate(c *terraform.ResourceConfig) ([]string, []error) {
 // from a unit test (and not in user-path code) to verify that a schema
 // is properly built.
 func (m schemaMap) InternalValidate(topSchemaMap schemaMap) error {
+        return m.internalValidate(topSchemaMap, false)
+}
+
+func (m schemaMap) internalValidate(topSchemaMap schemaMap, attrsOnly bool) error {
         if topSchemaMap == nil {
                 topSchemaMap = m
         }
@@ -631,6 +705,34 @@ func (m schemaMap) InternalValidate(topSchemaMap schemaMap) error {
                         return fmt.Errorf("%s: One of optional, required, or computed must be set", k)
                 }
 
+                computedOnly := v.Computed && !v.Optional
+
+                switch v.ConfigMode {
+                case SchemaConfigModeBlock:
+                        if _, ok := v.Elem.(*Resource); !ok {
+                                return fmt.Errorf("%s: ConfigMode of block is allowed only when Elem is *schema.Resource", k)
+                        }
+                        if attrsOnly {
+                                return fmt.Errorf("%s: ConfigMode of block cannot be used in child of schema with ConfigMode of attribute", k)
+                        }
+                        if computedOnly {
+                                return fmt.Errorf("%s: ConfigMode of block cannot be used for computed schema", k)
+                        }
+                case SchemaConfigModeAttr:
+                        // anything goes
+                case SchemaConfigModeAuto:
+                        // Since "Auto" for Elem: *Resource would create a nested block,
+                        // and that's impossible inside an attribute, we require it to be
+                        // explicitly overridden as mode "Attr" for clarity.
+                        if _, ok := v.Elem.(*Resource); ok {
+                                if attrsOnly {
+                                        return fmt.Errorf("%s: in *schema.Resource with ConfigMode of attribute, so must also have ConfigMode of attribute", k)
+                                }
+                        }
+                default:
+                        return fmt.Errorf("%s: invalid ConfigMode value", k)
+                }
+
                 if v.Computed && v.Default != nil {
                         return fmt.Errorf("%s: Default must be nil if computed", k)
                 }
@@ -695,7 +797,9 @@ func (m schemaMap) InternalValidate(topSchemaMap schemaMap) error {
 
                         switch t := v.Elem.(type) {
                         case *Resource:
-                                if err := t.InternalValidate(topSchemaMap, true); err != nil {
+                                attrsOnly := attrsOnly || v.ConfigMode == SchemaConfigModeAttr
+
+                                if err := schemaMap(t.Schema).internalValidate(topSchemaMap, attrsOnly); err != nil {
                                         return err
                                 }
                         case *Schema:
@@ -785,10 +889,19 @@ func (m schemaMap) diff(
         for attrK, attrV := range unsupressedDiff.Attributes {
                 switch rd := d.(type) {
                 case *ResourceData:
-                        if schema.DiffSuppressFunc != nil &&
-                                attrV != nil &&
+                        if schema.DiffSuppressFunc != nil && attrV != nil &&
                                 schema.DiffSuppressFunc(attrK, attrV.Old, attrV.New, rd) {
-                                continue
+                                // If this attr diff is suppressed, we may still need it in the
+                                // overall diff if it's contained within a set. Rather than
+                                // dropping the diff, make it a NOOP.
+                                if !all {
+                                        continue
+                                }
+
+                                attrV = &terraform.ResourceAttrDiff{
+                                        Old: attrV.Old,
+                                        New: attrV.Old,
+                                }
                         }
                 }
                 diff.Attributes[attrK] = attrV
@@ -1171,7 +1284,7 @@ func (m schemaMap) diffString(
                 return fmt.Errorf("%s: %s", k, err)
         }
 
-        if os == ns && !all {
+        if os == ns && !all && !computed {
                 // They're the same value. If there old value is not blank or we
                 // have an ID, then return right away since we're already setup.
                 if os != "" || d.Id() != "" {
@@ -1179,7 +1292,7 @@ func (m schemaMap) diffString(
                 }
 
                 // Otherwise, only continue if we're computed
-                if !schema.Computed && !computed {
+                if !schema.Computed {
                         return nil
                 }
         }
@@ -1210,7 +1323,7 @@ func (m schemaMap) inputString(
         input terraform.UIInput,
         k string,
         schema *Schema) (interface{}, error) {
-        result, err := input.Input(&terraform.InputOpts{
+        result, err := input.Input(context.Background(), &terraform.InputOpts{
                 Id:          k,
                 Query:       k,
                 Description: schema.Description,
@@ -1252,6 +1365,13 @@ func (m schemaMap) validate(
                         "%q: this field cannot be set", k)}
         }
 
+        if raw == config.UnknownVariableValue {
+                // If the value is unknown then we can't validate it yet.
+                // In particular, this avoids spurious type errors where downstream
+                // validation code sees UnknownVariableValue as being just a string.
+                return nil, nil
+        }
+
         err := m.validateConflictingAttributes(k, schema, c)
         if err != nil {
                 return nil, []error{err}
@@ -1269,10 +1389,15 @@ func (m schemaMap) validateConflictingAttributes(
                 return nil
         }
 
-        for _, conflicting_key := range schema.ConflictsWith {
-                if _, ok := c.Get(conflicting_key); ok {
+        for _, conflictingKey := range schema.ConflictsWith {
+                if raw, ok := c.Get(conflictingKey); ok {
+                        if raw == config.UnknownVariableValue {
+                                // An unknown value might become unset (null) once known, so
+                                // we must defer validation until it's known.
+                                continue
+                        }
                         return fmt.Errorf(
-                                "%q: conflicts with %s", k, conflicting_key)
+                                "%q: conflicts with %s", k, conflictingKey)
                 }
         }
 
@@ -1284,6 +1409,13 @@ func (m schemaMap) validateList(
         raw interface{},
         schema *Schema,
         c *terraform.ResourceConfig) ([]string, []error) {
+        // first check if the list is wholly unknown
+        if s, ok := raw.(string); ok {
+                if s == config.UnknownVariableValue {
+                        return nil, nil
+                }
+        }
+
         // We use reflection to verify the slice because you can't
         // case to []interface{} unless the slice is exactly that type.
         rawV := reflect.ValueOf(raw)
@@ -1355,6 +1487,13 @@ func (m schemaMap) validateMap(
         raw interface{},
         schema *Schema,
         c *terraform.ResourceConfig) ([]string, []error) {
+        // first check if the list is wholly unknown
+        if s, ok := raw.(string); ok {
+                if s == config.UnknownVariableValue {
+                        return nil, nil
+                }
+        }
+
         // We use reflection to verify the slice because you can't
         // case to []interface{} unless the slice is exactly that type.
         rawV := reflect.ValueOf(raw)
@@ -1556,12 +1695,25 @@ func (m schemaMap) validatePrimitive(
                 }
                 decoded = n
         case TypeInt:
-                // Verify that we can parse this as an int
-                var n int
-                if err := mapstructure.WeakDecode(raw, &n); err != nil {
-                        return nil, []error{fmt.Errorf("%s: %s", k, err)}
+                switch {
+                case isProto5():
+                        // We need to verify the type precisely, because WeakDecode will
+                        // decode a float as an integer.
+
+                        // the config shims only use int for integral number values
+                        if v, ok := raw.(int); ok {
+                                decoded = v
+                        } else {
+                                return nil, []error{fmt.Errorf("%s: must be a whole number, got %v", k, raw)}
+                        }
+                default:
+                        // Verify that we can parse this as an int
+                        var n int
+                        if err := mapstructure.WeakDecode(raw, &n); err != nil {
+                                return nil, []error{fmt.Errorf("%s: %s", k, err)}
+                        }
+                        decoded = n
                 }
-                decoded = n
         case TypeFloat:
                 // Verify that we can parse this as an int
                 var n float64
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/set.go b/vendor/github.com/hashicorp/terraform/helper/schema/set.go
index cba2890..8ee89e4 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/set.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/set.go
@@ -198,6 +198,16 @@ func (s *Set) add(item interface{}, computed bool) string {
         code := s.hash(item)
         if computed {
                 code = "~" + code
+
+                if isProto5() {
+                        tmpCode := code
+                        count := 0
+                        for _, exists := s.m[tmpCode]; exists; _, exists = s.m[tmpCode] {
+                                count++
+                                tmpCode = fmt.Sprintf("%s%d", code, count)
+                        }
+                        code = tmpCode
+                }
         }
 
         if _, ok := s.m[code]; !ok {
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/shims.go b/vendor/github.com/hashicorp/terraform/helper/schema/shims.go
new file mode 100644
index 0000000..203d017
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/shims.go
@@ -0,0 +1,115 @@
+package schema
+
+import (
+        "encoding/json"
+
+        "github.com/zclconf/go-cty/cty"
+        ctyjson "github.com/zclconf/go-cty/cty/json"
+
+        "github.com/hashicorp/terraform/config"
+        "github.com/hashicorp/terraform/configs/configschema"
+        "github.com/hashicorp/terraform/terraform"
+)
+
+// DiffFromValues takes the current state and desired state as cty.Values and
+// derives a terraform.InstanceDiff to give to the legacy providers. This is
+// used to take the states provided by the new ApplyResourceChange method and
+// convert them to a state+diff required for the legacy Apply method.
+func DiffFromValues(prior, planned cty.Value, res *Resource) (*terraform.InstanceDiff, error) {
+        return diffFromValues(prior, planned, res, nil)
+}
+
+// diffFromValues takes an additional CustomizeDiffFunc, so we can generate our
+// test fixtures from the legacy tests. In the new provider protocol the diff
+// only needs to be created for the apply operation, and any customizations
+// have already been done.
+func diffFromValues(prior, planned cty.Value, res *Resource, cust CustomizeDiffFunc) (*terraform.InstanceDiff, error) {
+        instanceState, err := res.ShimInstanceStateFromValue(prior)
+        if err != nil {
+                return nil, err
+        }
+
+        configSchema := res.CoreConfigSchema()
+
+        cfg := terraform.NewResourceConfigShimmed(planned, configSchema)
+        removeConfigUnknowns(cfg.Config)
+        removeConfigUnknowns(cfg.Raw)
+
+        diff, err := schemaMap(res.Schema).Diff(instanceState, cfg, cust, nil, false)
+        if err != nil {
+                return nil, err
+        }
+
+        return diff, err
+}
+
+// During apply the only unknown values are those which are to be computed by
+// the resource itself. These may have been marked as unknown config values, and
+// need to be removed to prevent the UnknownVariableValue from appearing the diff.
+func removeConfigUnknowns(cfg map[string]interface{}) {
+        for k, v := range cfg {
+                switch v := v.(type) {
+                case string:
+                        if v == config.UnknownVariableValue {
+                                delete(cfg, k)
+                        }
+                case []interface{}:
+                        for _, i := range v {
+                                if m, ok := i.(map[string]interface{}); ok {
+                                        removeConfigUnknowns(m)
+                                }
+                        }
+                case map[string]interface{}:
+                        removeConfigUnknowns(v)
+                }
+        }
+}
+
+// ApplyDiff takes a cty.Value state and applies a terraform.InstanceDiff to
+// get a new cty.Value state. This is used to convert the diff returned from
+// the legacy provider Diff method to the state required for the new
+// PlanResourceChange method.
+func ApplyDiff(base cty.Value, d *terraform.InstanceDiff, schema *configschema.Block) (cty.Value, error) {
+        return d.ApplyToValue(base, schema)
+}
+
+// StateValueToJSONMap converts a cty.Value to generic JSON map via the cty JSON
+// encoding.
+func StateValueToJSONMap(val cty.Value, ty cty.Type) (map[string]interface{}, error) {
+        js, err := ctyjson.Marshal(val, ty)
+        if err != nil {
+                return nil, err
+        }
+
+        var m map[string]interface{}
+        if err := json.Unmarshal(js, &m); err != nil {
+                return nil, err
+        }
+
+        return m, nil
+}
+
+// JSONMapToStateValue takes a generic json map[string]interface{} and converts it
+// to the specific type, ensuring that the values conform to the schema.
+func JSONMapToStateValue(m map[string]interface{}, block *configschema.Block) (cty.Value, error) {
+        var val cty.Value
+
+        js, err := json.Marshal(m)
+        if err != nil {
+                return val, err
+        }
+
+        val, err = ctyjson.Unmarshal(js, block.ImpliedType())
+        if err != nil {
+                return val, err
+        }
+
+        return block.CoerceValue(val)
+}
+
+// StateValueFromInstanceState converts a terraform.InstanceState to a
+// cty.Value as described by the provided cty.Type, and maintains the resource
+// ID as the "id" attribute.
+func StateValueFromInstanceState(is *terraform.InstanceState, ty cty.Type) (cty.Value, error) {
+        return is.AttrsAsObjectValue(ty)
+}
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/testing.go b/vendor/github.com/hashicorp/terraform/helper/schema/testing.go
index da754ac..a367a1f 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/testing.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/testing.go
@@ -18,7 +18,7 @@ func TestResourceDataRaw(
         }
 
         sm := schemaMap(schema)
-        diff, err := sm.Diff(nil, terraform.NewResourceConfig(c), nil, nil)
+        diff, err := sm.Diff(nil, terraform.NewResourceConfig(c), nil, nil, true)
         if err != nil {
                 t.Fatalf("err: %s", err)
         }
diff --git a/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go b/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go
index 3bc3ac4..914ca32 100644
--- a/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go
+++ b/vendor/github.com/hashicorp/terraform/helper/schema/valuetype_string.go
@@ -4,6 +4,21 @@ package schema
 
 import "strconv"
 
+func _() {
+        // An "invalid array index" compiler error signifies that the constant values have changed.
+        // Re-run the stringer command to generate them again.
+        var x [1]struct{}
+        _ = x[TypeInvalid-0]
+        _ = x[TypeBool-1]
+        _ = x[TypeInt-2]
+        _ = x[TypeFloat-3]
+        _ = x[TypeString-4]
+        _ = x[TypeList-5]
+        _ = x[TypeMap-6]
+        _ = x[TypeSet-7]
+        _ = x[typeObject-8]
+}
+
 const _ValueType_name = "TypeInvalidTypeBoolTypeIntTypeFloatTypeStringTypeListTypeMapTypeSettypeObject"
 
 var _ValueType_index = [...]uint8{0, 11, 19, 26, 35, 45, 53, 60, 67, 77}